Recon

Using the Recon service collection

Table of Contents

Operation ID	Description
AggregateNotificationsV1 PEP8 aggregate_notifications	Get notification aggregates as specified via JSON in request body.
PreviewRuleV1 PEP8 preview_rule	Preview rules notification count and distribution. This will return aggregations on: channel, count, site.
GetActionsV1 PEP8 get_actions	Get actions based on their IDs. IDs can be retrieved using the GET /queries/actions/v1 endpoint.
CreateActionsV1 PEP8 create_actions	Create actions for a monitoring rule. Accepts a list of actions that will be attached to the monitoring rule.
DeleteActionV1 PEP8 delete_action	Delete an action from a monitoring rule based on the action ID.
UpdateActionV1 PEP8 update_action	Update an action for a monitoring rule.
GetNotificationsDetailedTranslatedV1 PEP8 get_notifications_detailed_translated	Get detailed notifications based on their IDs. These include the raw intelligence content that generated the match.This endpoint will return translated notification content. The only target language available is English. A single notification can be translated per request
GetNotificationsDetailedV1 PEP8 get_notifications_detailed	Get detailed notifications based on their IDs. These include the raw intelligence content that generated the match.
GetNotificationsTranslatedV1 PEP8 get_notifications_translated	Get notifications based on their IDs. IDs can be retrieved using the GET /queries/notifications/v1 endpoint. This endpoint will return translated notification content. The only target language available is English.
GetNotificationsV1 PEP8 get_notifications	Get notifications based on their IDs. IDs can be retrieved using the GET /queries/notifications/v1 endpoint.
DeleteNotificationsV1 PEP8 delete_notifications	Delete notifications based on IDs. Notifications cannot be recovered after they are deleted.
UpdateNotificationsV1 PEP8 update_notifications	Update notification status or assignee. Accepts bulk requests
GetRulesV1 PEP8 get_rules	Get monitoring rules rules by provided IDs.
CreateRulesV1 PEP8 create_rules	Create monitoring rules.
DeleteRulesV1 PEP8 delete_rules	Delete monitoring rules.
UpdateRulesV1 PEP8 update_rules	Update monitoring rules.
QueryActionsV1 PEP8 query_actions	Query actions based on provided criteria. Use the IDs from this response to get the action entities on GET /entities/actions/v1.
QueryNotificationsV1 PEP8 query_notifications	Query notifications based on provided criteria. Use the IDs from this response to get the notification entities on GET /entities/notifications/v1 or GET /entities/notifications-detailed/v1.
QueryRulesV1 PEP8 query_rules	Query monitoring rules based on provided criteria. Use the IDs from this response to fetch the rules on /entities/rules/v1.

AggregateNotificationsV1

Get notification aggregates as specified via JSON in request body.

PEP8 method name

aggregate_notifications

Content-Type

• Consumes: application/json
• Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	body	body	string

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.aggregate_notifications(body=BODY)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.AggregateNotificationsV1(body=BODY)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.command("AggregateNotificationsV1", body=BODY)
print(response)

PreviewRuleV1

Preview rules notification count and distribution. This will return aggregations on: channel, count, site.

PEP8 method name

preview_rule

Content-Type

• Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	body	body	string

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.preview_rule(body=BODY)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.PreviewRuleV1(body=BODY)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.command("PreviewRuleV1", body=BODY)
print(response)

GetActionsV1

Get actions based on their IDs. IDs can be retrieved using the GET /queries/actions/v1 endpoint.

PEP8 method name

get_actions

Content-Type

• Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	ids	query	array (string)	Action IDs.

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_actions(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetActionsV1(ids=id_list)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetActionsV1", ids=id_list)
print(response)

CreateActionsV1

Create actions for a monitoring rule. Accepts a list of actions that will be attached to the monitoring rule.

PEP8 method name

create_actions

Content-Type

• Consumes: application/json
• Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	body	body	string

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.create_actions(body=BODY)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.CreateActionsV1(body=BODY)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.command("CreateActionsV1", body=BODY)
print(response)

DeleteActionV1

Delete an action from a monitoring rule based on the action ID.

PEP8 method name

delete_action

Content-Type

• Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	id	query	string	ID of the action.

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.delete_action(id="string")
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.DeleteActionV1(id="string")
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "id": "string"
}

response = falcon.command("DeleteActionV1", parameters=PARAMS)
print(response)

UpdateActionV1

Update an action for a monitoring rule.

PEP8 method name

update_action

Content-Type

• Consumes: application/json
• Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	body	body	string

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.update_action(body=BODY)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.UpdateActionV1(body=BODY)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.command("UpdateActionV1", body=BODY)
print(response)

GetNotificationsDetailedTranslatedV1

Get detailed notifications based on their IDs. These include the raw intelligence content that generated the match.This endpoint will return translated notification content. The only target language available is English. A single notification can be translated per request

PEP8 method name

get_notifications_detailed_translated

Content-Type

• Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	ids	query	array (string)	Notification IDs.

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_notifications_detailed_translated(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetNotificationsDetailedTranslatedV1(ids=id_list)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetNotificationsDetailedTranslatedV1", ids=id_list)
print(response)

GetNotificationsDetailedV1

Get detailed notifications based on their IDs. These include the raw intelligence content that generated the match.

PEP8 method name

get_notifications_detailed

Content-Type

• Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	ids	query	array (string)	Notification IDs.

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_notifications_detailed(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetNotificationsDetailedV1(ids=id_list)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetNotificationsDetailedV1", ids=id_list)
print(response)

GetNotificationsTranslatedV1

Get notifications based on their IDs. IDs can be retrieved using the GET /queries/notifications/v1 endpoint. This endpoint will return translated notification content. The only target language available is English.

PEP8 method name

get_notifications_translated

Content-Type

• Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	ids	query	array (string)	Notification IDs.

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_notifications_translated(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetNotificationsTranslatedV1(ids=id_list)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetNotificationsTranslatedV1", ids=id_list)
print(response)

GetNotificationsV1

Get notifications based on their IDs. IDs can be retrieved using the GET /queries/notifications/v1 endpoint.

PEP8 method name

get_notifications

Content-Type

• Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	ids	query	array (string)	Notification IDs.

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_notifications(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetNotificationsV1(ids=id_list)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetNotificationsV1", ids=id_list)
print(response)

DeleteNotificationsV1

Delete notifications based on IDs. Notifications cannot be recovered after they are deleted.

PEP8 method name

delete_notifications

Content-Type

• Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	ids	query	array (string)	Notifications IDs.

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_notifications(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteNotificationsV1(ids=id_list)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteNotificationsV1", ids=id_list)
print(response)

UpdateNotificationsV1

Update notification status or assignee. Accepts bulk requests

PEP8 method name

update_notifications

Content-Type

• Consumes: application/json
• Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	body	body	string

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.update_notifications(body=BODY)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.UpdateNotificationsV1(body=BODY)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.command("UpdateNotificationsV1", body=BODY)
print(response)

GetRulesV1

Get monitoring rules rules by provided IDs.

PEP8 method name

get_rules

Content-Type

• Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	ids	query	array (string)	IDs of rules.

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rules(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetRulesV1(ids=id_list)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetRulesV1", ids=id_list)
print(response)

CreateRulesV1

Create monitoring rules.

PEP8 method name

create_rules

Content-Type

• Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	body	body	string

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.create_rules(body=BODY)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.CreateRulesV1(body=BODY)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.command("CreateRulesV1", body=BODY)
print(response)

DeleteRulesV1

Delete monitoring rules.

PEP8 method name

delete_rules

Content-Type

• Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	ids	query	array (string)	IDs of rules.

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_rules(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteRulesV1(ids=id_list)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteRulesV1", ids=id_list)
print(response)

UpdateRulesV1

Update monitoring rules.

PEP8 method name

update_rules

Content-Type

• Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
✅	body	body	string

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.update_rules(body=BODY)
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.UpdateRulesV1(body=BODY)
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.command("UpdateRulesV1", body=BODY)
print(response)

QueryActionsV1

Query actions based on provided criteria. Use the IDs from this response to get the action entities on GET /entities/actions/v1.

PEP8 method name

query_actions

Content-Type

• Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
	offset	query	string	Starting index of overall result set from which to return IDs.
	limit	query	integer	Number of IDs to return.
	sort	query	string	Possible order by fields: created_timestamp, updated_timestamp. Ex: 'updated_timestamp
	filter	query	string	FQL query to filter actions by. Possible filter properties are: [id cid user_uuid rule_id type frequency recipients status created_timestamp updated_timestamp]
	q	query	string	Free text search across all indexed fields

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.query_actions(offset="string",
                                limit=integer,
                                sort="string",
                                filter="string",
                                q="string"
                                )
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.QueryActionsV1(offset="string",
                                 limit=integer,
                                 sort="string",
                                 filter="string",
                                 q="string"
                                 )
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "offset": "string",
    "limit": integer,
    "sort": "string",
    "filter": "string",
    "q": "string"
}

response = falcon.command("QueryActionsV1", parameters=PARAMS)
print(response)

QueryNotificationsV1

Query notifications based on provided criteria. Use the IDs from this response to get the notification entities on GET /entities/notifications/v1 or GET /entities/notifications-detailed/v1.

PEP8 method name

query_notifications

Content-Type

• Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
	offset	query	integer	Starting index of overall result set from which to return ids.
	limit	query	integer	Number of ids to return.
	sort	query	string	Possible order by fields: created_date, updated_date. Ex: 'updated_date
	filter	query	string	FQL query to filter notifications by. Possible filter properties are: [id cid user_uuid status rule_id rule_name rule_topic rule_priority item_type created_date updated_date]
	q	query	string	Free text search across all indexed fields.

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.query_notifications(offset=integer,
                                      limit=integer,
                                      sort="string",
                                      filter="string",
                                      q="string"
                                      )
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.QueryNotificationsV1(offset=integer,
                                       limit=integer,
                                       sort="string",
                                       filter="string",
                                       q="string"
                                       )
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "offset": integer,
    "limit": integer,
    "sort": "string",
    "filter": "string",
    "q": "string"
}

response = falcon.command("QueryNotificationsV1", parameters=PARAMS)
print(response)

QueryRulesV1

Query monitoring rules based on provided criteria. Use the IDs from this response to fetch the rules on /entities/rules/v1.

PEP8 method name

query_rules

Content-Type

• Produces: application/json

Parameters

Required	Name	Type	Datatype	Description
	offset	query	string	Starting index of overall result set from which to return ids.
	limit	query	integer	Number of ids to return.
	sort	query	string	Possible order by fields: created_timestamp, last_updated_timestamp. Ex: 'last_updated_timestamp
	filter	query	string	FQL query to filter rules by. Possible filter properties are: [id cid user_uuid topic priority permissions filter status created_timestamp last_updated_timestamp]
	q	query	string	Free text search across all indexed fields.

Usage

Service class example (PEP8 syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.query_rules(offset="string",
                              limit=integer,
                              sort="string",
                              filter="string",
                              q="string"
                              )
print(response)

Service class example (Operation ID syntax)

from falconpy.recon import Recon

falcon = Recon(client_id="API_CLIENT_ID_HERE",
               client_secret="API_CLIENT_SECRET_HERE"
               )

response = falcon.QueryRulesV1(offset="string",
                               limit=integer,
                               sort="string",
                               filter="string",
                               q="string"
                               )
print(response)

Uber class example

from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "offset": "string",
    "limit": integer,
    "sort": "string",
    "filter": "string",
    "q": "string"
}

response = falcon.command("QueryRulesV1", parameters=PARAMS)
print(response)