Overwatch Dashboard

Using the Overwatch Dashboard service collection

Table of Contents

Operation ID	Description
AggregatesDetectionsGlobalCounts PEP 8 aggregates_detections_global_counts	Get the total number of detections pushed across all customers
AggregatesEventsCollections PEP 8 aggregates_events_collections	Get OverWatch detection event collection info by providing an aggregate query
AggregatesEvents PEP 8 aggregates_events	Get aggregate OverWatch detection event info by providing an aggregate query
AggregatesIncidentsGlobalCounts PEP 8 aggregates_incidents_global_counts	Get the total number of incidents pushed across all customers
AggregatesOWEventsGlobalCounts PEP 8 aggregates_events_global_counts	Get the total number of OverWatch events across all customers

AggregatesDetectionsGlobalCounts

Get the total number of detections pushed across all customers

PEP8 method name

aggregates_detections_global_counts

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
filter			query	string	FQL query expression that should be used to limit the results.
parameters			query	string	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import OverwatchDashboard

falcon = OverwatchDashboard(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

response = falcon.aggregates_detections_global_counts(filter="string")
print(response)

Service class example (Operation ID syntax)

from falconpy import OverwatchDashboard

falcon = OverwatchDashboard(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

response = falcon.AggregatesDetectionsGlobalCounts(filter="string")
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "filter": "string"
}

response = falcon.command("AggregatesDetectionsGlobalCounts", filter="string")
print(response)

AggregatesEventsCollections

Get OverWatch detection event collection info by providing an aggregate query

PEP8 method name

aggregates_events_collections

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
body			body	string	Full body payload in JSON format.
date_ranges			body	list of dictionaries
field			body	string
filter			body	string	FQL syntax
interval			body	string
min_doc_count			body	integer	Minimum number of documents required to match.
missing			body	string
name			body	string
q			body	string	FQL syntax
ranges			body	list of dictionaries
size			body	integer
sort			body	string	FQL syntax
time_zone			body	string
type			body	string

Usage

Service class example (PEP8 syntax)

from falconpy import OverwatchDashboard

falcon = OverwatchDashboard(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.aggregates_events_collections(date_ranges=date_ranges,
                                                field="string",
                                                filter="string",
                                                interval="string",
                                                min_doc_count=integer,
                                                missing="string",
                                                name="string",
                                                q="string",
                                                ranges=ranges,
                                                size=integer,
                                                sort="string",
                                                time_zone="string",
                                                type="string"
                                                )
print(response)

Service class example (Operation ID syntax)

from falconpy import OverwatchDashboard

falcon = OverwatchDashboard(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.AggregatesEventsCollections(date_ranges=date_ranges,
                                              field="string",
                                              filter="string",
                                              interval="string",
                                              min_doc_count=integer,
                                              missing="string",
                                              name="string",
                                              q="string",
                                              ranges=ranges,
                                              size=integer,
                                              sort="string",
                                              time_zone="string",
                                              type="string"
                                              )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

BODY = [{
    "date_ranges": date_ranges,
    "field": "string",
    "filter": "string",
    "interval": "string",
    "min_doc_count": 0,
    "missing": "string",
    "name": "string",
    "q": "string",
    "ranges": ranges,
    "size": 0,
    "sort": "string",
    "sub_aggregates": [
        null
    ],
    "time_zone": "string",
    "type": "string"
}]

response = falcon.command("AggregatesEventsCollections", body=BODY)
print(response)

AggregatesEvents

Get aggregate OverWatch detection event info by providing an aggregate query

PEP8 method name

aggregates_events

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
body			body	string	Full body payload in JSON format.
date_ranges			body	list of dictionaries
field			body	string
filter			body	string	FQL syntax
interval			body	string
min_doc_count			body	integer	Minimum number of documents required to match.
missing			body	string
name			body	string
q			body	string	FQL syntax
ranges			body	list of dictionaries
size			body	integer
sort			body	string	FQL syntax
time_zone			body	string
type			body	string

Usage

Service class example (PEP8 syntax)

from falconpy import OverwatchDashboard

falcon = OverwatchDashboard(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.aggregates_events(date_ranges=date_ranges,
                                    field="string",
                                    filter="string",
                                    interval="string",
                                    min_doc_count=integer,
                                    missing="string",
                                    name="string",
                                    q="string",
                                    ranges=ranges,
                                    size=integer,
                                    sort="string",
                                    time_zone="string",
                                    type="string"
                                    )
print(response)

Service class example (Operation ID syntax)

from falconpy import OverwatchDashboard

falcon = OverwatchDashboard(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.AggregatesEvents(date_ranges=date_ranges,
                                   field="string",
                                   filter="string",
                                   interval="string",
                                   min_doc_count=integer,
                                   missing="string",
                                   name="string",
                                   q="string",
                                   ranges=ranges,
                                   size=integer,
                                   sort="string",
                                   time_zone="string",
                                   type="string"
                                   )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

BODY = [{
    "date_ranges": date_ranges,
    "field": "string",
    "filter": "string",
    "interval": "string",
    "min_doc_count": 0,
    "missing": "string",
    "name": "string",
    "q": "string",
    "ranges": ranges,
    "size": 0,
    "sort": "string",
    "sub_aggregates": [
        null
    ],
    "time_zone": "string",
    "type": "string"
}]

response = falcon.command("AggregatesEvents", body=BODY)
print(response)

AggregatesIncidentsGlobalCounts

Get the total number of incidents pushed across all customers

PEP8 method name

aggregates_incidents_global_counts

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
filter			query	string	FQL query expression that should be used to limit the results.
parameters			query	string	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import OverwatchDashboard

falcon = OverwatchDashboard(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

response = falcon.aggregates_incidents_global_counts(filter="string")
print(response)

Service class example (Operation ID syntax)

from falconpy import OverwatchDashboard

falcon = OverwatchDashboard(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

response = falcon.AggregatesIncidentsGlobalCounts(filter="string")
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("AggregatesIncidentsGlobalCounts", filter="string")
print(response)

AggregatesOWEventsGlobalCounts

Get the total number of OverWatch events across all customers

PEP8 method name

aggregates_events_global_counts

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
filter			query	string	FQL query expression that should be used to limit the results.
parameters			query	string	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import OverwatchDashboard

falcon = OverwatchDashboard(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

response = falcon.aggregates_events_global_counts(filter="string")
print(response)

Service class example (Operation ID syntax)

from falconpy import OverwatchDashboard

falcon = OverwatchDashboard(client_id="API_CLIENT_ID_HERE",
                            client_secret="API_CLIENT_SECRET_HERE"
                            )

response = falcon.AggregatesOWEventsGlobalCounts(filter="string")
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("AggregatesOWEventsGlobalCounts", filter="string")
print(response)