Recon

Using the Recon service collection

Uber class support

Method	Operation ID	Description
aggregate_notifications	AggregateNotificationsV1	Get notification aggregates as specified via JSON in request body.
preview_rule	PreviewRuleV1	Preview rules notification count and distribution. This will return aggregations on: channel, count, site.
get_actions	GetActionsV1	Get actions based on their IDs. IDs can be retrieved using the GET /queries/actions/v1 endpoint.
create_actions	CreateActionsV1	Create actions for a monitoring rule. Accepts a list of actions that will be attached to the monitoring rule.
delete_action	DeleteActionV1	Delete an action from a monitoring rule based on the action ID.
update_action	UpdateActionV1	Update an action for a monitoring rule.
get_notifications_detailed_translated	GetNotificationsDetailedTranslatedV1	Get detailed notifications based on their IDs. These include the raw intelligence content that generated the match.This endpoint will return translated notification content. The only target language available is English. A single notification can be translated per request
get_notifications_detailed	GetNotificationsDetailedV1	Get detailed notifications based on their IDs. These include the raw intelligence content that generated the match.
get_notifications_translated	GetNotificationsTranslatedV1	Get notifications based on their IDs. IDs can be retrieved using the GET /queries/notifications/v1 endpoint. This endpoint will return translated notification content. The only target language available is English.
get_notifications	GetNotificationsV1	Get notifications based on their IDs. IDs can be retrieved using the GET /queries/notifications/v1 endpoint.
delete_notifications	DeleteNotificationsV1	Delete notifications based on IDs. Notifications cannot be recovered after they are deleted.
update_notifications	UpdateNotificationsV1	Update notification status or assignee. Accepts bulk requests
get_rules	GetRulesV1	Get monitoring rules rules by provided IDs.
create_rules	CreateRulesV1	Create monitoring rules.
delete_rules	DeleteRulesV1	Delete monitoring rules.
update_rules	UpdateRulesV1	Update monitoring rules.
query_actions	QueryActionsV1	Query actions based on provided criteria. Use the IDs from this response to get the action entities on GET /entities/actions/v1.
query_notifications	QueryNotificationsV1	Query notifications based on provided criteria. Use the IDs from this response to get the notification entities on GET /entities/notifications/v1 or GET /entities/notifications-detailed/v1.
query_rules	QueryRulesV1	Query monitoring rules based on provided criteria. Use the IDs from this response to fetch the rules on /entities/rules/v1.

AggregateNotificationsV1

Get notification aggregates as specified via JSON in request body.

Content-Type

Consumes: application/json
Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	body	body	string

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.aggregate_notifications(body=BODY)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.AggregateNotificationsV1(body=BODY)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.command("AggregateNotificationsV1", body=BODY)
print(response)

PreviewRuleV1

Preview rules notification count and distribution. This will return aggregations on: channel, count, site.

Content-Type

Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
	X_CS_USERUUID	header	string	User UUID
✅	body	body	string

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

HEADERS = {
    "X-CS-USERUUID": "string"
}

response = falcon.preview_rule(body=BODY, headers=HEADERS)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

HEADERS = {
    "X-CS-USERUUID": "string"
}

response = falcon.PreviewRuleV1(body=BODY, headers=HEADERS)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
    "Body Payload": "See body description above"
}

HEADERS = {
    "X-CS-USERUUID": "string"
}

response = falcon.command("PreviewRuleV1", body=BODY, headers=HEADERS)
print(response)

GetActionsV1

Get actions based on their IDs. IDs can be retrieved using the GET /queries/actions/v1 endpoint.

Content-Type

Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	ids	query	array (string)	Action IDs.

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_actions(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetActionsV1(ids=id_list)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetActionsV1", ids=id_list)
print(response)

CreateActionsV1

Create actions for a monitoring rule. Accepts a list of actions that will be attached to the monitoring rule.

Content-Type

Consumes: application/json
Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	body	body	string

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.create_actions(body=BODY)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.CreateActionsV1(body=BODY)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.command("CreateActionsV1", body=BODY)
print(response)

DeleteActionV1

Delete an action from a monitoring rule based on the action ID.

Content-Type

Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	id	query	string	ID of the action.

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.delete_action(id="string")
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.DeleteActionV1(id="string")
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "id": "string"
}

response = falcon.command("DeleteActionV1", parameters=PARAMS)
print(response)

UpdateActionV1

Update an action for a monitoring rule.

Content-Type

Consumes: application/json
Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	body	body	string

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.update_action(body=BODY)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.UpdateActionV1(body=BODY)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.command("UpdateActionV1", body=BODY)
print(response)

GetNotificationsDetailedTranslatedV1

Get detailed notifications based on their IDs. These include the raw intelligence content that generated the match.This endpoint will return translated notification content. The only target language available is English. A single notification can be translated per request

Content-Type

Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	ids	query	array (string)	Notification IDs.

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_notifications_detailed_translated(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetNotificationsDetailedTranslatedV1(ids=id_list)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetNotificationsDetailedTranslatedV1", ids=id_list)
print(response)

GetNotificationsDetailedV1

Get detailed notifications based on their IDs. These include the raw intelligence content that generated the match.

Content-Type

Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	ids	query	array (string)	Notification IDs.

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_notifications_detailed(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetNotificationsDetailedV1(ids=id_list)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetNotificationsDetailedV1", ids=id_list)
print(response)

GetNotificationsTranslatedV1

Get notifications based on their IDs. IDs can be retrieved using the GET /queries/notifications/v1 endpoint. This endpoint will return translated notification content. The only target language available is English.

Content-Type

Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	ids	query	array (string)	Notification IDs.

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_notifications_translated(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetNotificationsTranslatedV1(ids=id_list)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetNotificationsTranslatedV1", ids=id_list)
print(response)

GetNotificationsV1

Get notifications based on their IDs. IDs can be retrieved using the GET /queries/notifications/v1 endpoint.

Content-Type

Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	ids	query	array (string)	Notification IDs.

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_notifications(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetNotificationsV1(ids=id_list)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetNotificationsV1", ids=id_list)
print(response)

DeleteNotificationsV1

Delete notifications based on IDs. Notifications cannot be recovered after they are deleted.

Content-Type

Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	ids	query	array (string)	Notifications IDs.

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_notifications(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteNotificationsV1(ids=id_list)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteNotificationsV1", ids=id_list)
print(response)

UpdateNotificationsV1

Update notification status or assignee. Accepts bulk requests

Content-Type

Consumes: application/json
Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	body	body	string

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.update_notifications(body=BODY)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.UpdateNotificationsV1(body=BODY)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.command("UpdateNotificationsV1", body=BODY)
print(response)

GetRulesV1

Get monitoring rules rules by provided IDs.

Content-Type

Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
	X_CS_USERUUID	header	string	User UUID
✅	ids	query	array (string)	IDs of rules.

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

HEADERS = {
    "X-CS-USERUUID": "string"
}

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rules(headers=HEADERS, ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

HEADERS = {
    "X-CS-USERUUID": "string"
}

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetRulesV1(headers=HEADERS, ids=id_list)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

HEADERS = {
    "X-CS-USERUUID": "string"
}

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetRulesV1", headers=HEADERS, ids=id_list)
print(response)

CreateRulesV1

Create monitoring rules.

Content-Type

Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
	X_CS_USERUUID	header	string	User UUID
✅	body	body	string

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

HEADERS = {
    "X-CS-USERUUID": "string"
}

response = falcon.create_rules(body=BODY, headers=HEADERS)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

HEADERS = {
    "X-CS-USERUUID": "string"
}

response = falcon.CreateRulesV1(body=BODY, headers=HEADERS)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
    "Body Payload": "See body description above"
}

HEADERS = {
    "X-CS-USERUUID": "string"
}

response = falcon.command("CreateRulesV1", body=BODY, headers=HEADERS)
print(response)

DeleteRulesV1

Delete monitoring rules.

Content-Type

Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
	X_CS_USERUUID	header	string	User UUID
✅	ids	query	array (string)	IDs of rules.

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

HEADERS = {
    "X-CS-USERUUID": "string"
}

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_rules(headers=HEADERS, ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

HEADERS = {
    "X-CS-USERUUID": "string"
}

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteRulesV1(headers=HEADERS, ids=id_list)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

HEADERS = {
    "X-CS-USERUUID": "string"
}

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteRulesV1", headers=HEADERS, ids=id_list)
print(response)

UpdateRulesV1

Update monitoring rules.

Content-Type

Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
	X_CS_USERUUID	header	string	User UUID
✅	body	body	string

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

HEADERS = {
    "X-CS-USERUUID": "string"
}

response = falcon.update_rules(body=BODY, headers=HEADERS)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

HEADERS = {
    "X-CS-USERUUID": "string"
}

response = falcon.UpdateRulesV1(body=BODY, headers=HEADERS)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
    "Body Payload": "See body description above"
}

HEADERS = {
    "X-CS-USERUUID": "string"
}

response = falcon.command("UpdateRulesV1", body=BODY, headers=HEADERS)
print(response)

QueryActionsV1

Query actions based on provided criteria. Use the IDs from this response to get the action entities on GET /entities/actions/v1.

Content-Type

Produces: application/json

Parameters

Name	Type	Datatype	Description
offset	query	string	Starting index of overall result set from which to return IDs.
limit	query	integer	Number of IDs to return.
sort	query	string	Possible order by fields: created_timestamp, updated_timestamp. Ex: 'updated_timestamp
filter	query	string	FQL query to filter actions by. Possible filter properties are: [id cid user_uuid rule_id type frequency recipients status created_timestamp updated_timestamp]
q	query	string	Free text search across all indexed fields

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.query_actions(offset="string",
                                limit=integer,
                                sort="string",
                                filter="string",
                                q="string"
                                )
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.QueryActionsV1(offset="string",
                                 limit=integer,
                                 sort="string",
                                 filter="string",
                                 q="string"
                                 )
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "offset": "string",
    "limit": integer,
    "sort": "string",
    "filter": "string",
    "q": "string"
}

response = falcon.command("QueryActionsV1", parameters=PARAMS)
print(response)

QueryNotificationsV1

Query notifications based on provided criteria. Use the IDs from this response to get the notification entities on GET /entities/notifications/v1 or GET /entities/notifications-detailed/v1.

Content-Type

Produces: application/json

Parameters

Name	Type	Datatype	Description
offset	query	integer	Starting index of overall result set from which to return ids.
limit	query	integer	Number of ids to return.
sort	query	string	Possible order by fields: created_date, updated_date. Ex: 'updated_date
filter	query	string	FQL query to filter notifications by. Possible filter properties are: [id cid user_uuid status rule_id rule_name rule_topic rule_priority item_type created_date updated_date]
q	query	string	Free text search across all indexed fields.

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.query_notifications(offset=integer,
                                      limit=integer,
                                      sort="string",
                                      filter="string",
                                      q="string"
                                      )
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.QueryNotificationsV1(offset=integer,
                                       limit=integer,
                                       sort="string",
                                       filter="string",
                                       q="string"
                                       )
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "offset": integer,
    "limit": integer,
    "sort": "string",
    "filter": "string",
    "q": "string"
}

response = falcon.command("QueryNotificationsV1", parameters=PARAMS)
print(response)

QueryRulesV1

Query monitoring rules based on provided criteria. Use the IDs from this response to fetch the rules on /entities/rules/v1.

Content-Type

Produces: application/json

Parameters

Name	Type	Datatype	Description
X_CS_USERUUID	header	string	User UUID
offset	query	string	Starting index of overall result set from which to return ids.
limit	query	integer	Number of ids to return.
sort	query	string	Possible order by fields: created_timestamp, last_updated_timestamp. Ex: 'last_updated_timestamp
filter	query	string	FQL query to filter rules by. Possible filter properties are: [id cid user_uuid topic priority permissions filter status created_timestamp last_updated_timestamp]
q	query	string	Free text search across all indexed fields.

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

HEADERS = {
    "X-CS-USERUUID": "string"
}

response = falcon.query_rules(offset="string",
                              limit=integer,
                              sort="string",
                              filter="string",
                              q="string"
                              , headers=HEADERS)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

HEADERS = {
    "X-CS-USERUUID": "string"
}

response = falcon.QueryRulesV1(offset="string",
                               limit=integer,
                               sort="string",
                               filter="string",
                               q="string"
                               , headers=HEADERS)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "offset": "string",
    "limit": integer,
    "sort": "string",
    "filter": "string",
    "q": "string"
}

HEADERS = {
    "X-CS-USERUUID": "string"
}

response = falcon.command("QueryRulesV1", parameters=PARAMS, headers=HEADERS)
print(response)

Home
Discussions Board
Glossary of Terms
Installation, Upgrades and Removal
Samples Collection
Using FalconPy
API Operations
Service Collections
Documentation Support
- Report broken link
- Report documentation error
CrowdStrike SDKs
- Crimson Falcon - Ruby
- FalconPy - Python 3
- FalconJS - Javascript
- goFalcon - Go
- PSFalcon - Powershell
- Rusty Falcon - Rust

CrowdStrike Falcon

Recon

Using the Recon service collection

Table of Contents

AggregateNotificationsV1

Content-Type

Parameters

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

PreviewRuleV1

Content-Type

Parameters

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

GetActionsV1

Content-Type

Parameters

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

CreateActionsV1

Content-Type

Parameters

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

DeleteActionV1

Content-Type

Parameters

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

UpdateActionV1

Content-Type

Parameters

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

GetNotificationsDetailedTranslatedV1

Content-Type

Parameters

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

GetNotificationsDetailedV1

Content-Type

Parameters

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

GetNotificationsTranslatedV1

Content-Type

Parameters

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

GetNotificationsV1

Content-Type

Parameters

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

DeleteNotificationsV1

Content-Type

Parameters

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example