CrowdStrike OpenAPI

Assign new MSSP Role(s) between User Group and CID Group. It does not revoke existing role(s) between User Group and CID Group. User Group ID and CID Group ID have to be specified in request.

Add new User Group member. Maximum 500 members allowed per User Group.

Add new CID Group member.

Retrieve aggregate allowlist ticket values based on the matched filter.

Retrieve aggregate block list ticket values based on the matched filter.

Retrieve aggregate detection values based on the matched filter.

Retrieve aggregate host/devices count based on the matched filter.

Retrieve aggregate escalation ticket values based on the matched filter.

Get notification aggregates as specified via JSON in request body.

Retrieve aggregate remediation ticket values based on the matched filter.

Aggregate events for customer.

Retrieve aggregate incident values based on the matched filter.

Aggregate rules within a policy for customer.

Aggregate rule groups for customer.

Aggregate rules for customer.

Get the total number of detections pushed across all customers.

Get aggregate OverWatch detection event info by providing an aggregate query.

Get OverWatch detection event collection info by providing an aggregate query.

Get the total number of incidents pushed across all customers.

Get the total number of OverWatch events across all customers.

Identity Protection GraphQL API. Allows to retrieve entities, timeline activities, identity-based incidents and security assessment. Allows to perform actions on entities and identity-based incidents.

Search for audit events by providing an FQL filter and paging details.

Gets the details of one or more audit events by id.

Batch executes a RTR active-responder command across the hosts mapped to the given batch ID.

Batch executes a RTR administrator command across the hosts mapped to the given batch ID.

Batch executes a RTR read-only command across the hosts mapped to the given batch ID.

Batch executes `get` command across hosts to retrieve files. After this call is made `GET /real-time-response/combined/batch-get-command/v1` is used to query for the results.

Retrieves the status of the specified batch get command. Will return successful files when they are finished processing.

Batch initialize a RTR session on multiple hosts. Before any RTR commands can be used, an active session is needed on the host.

Batch refresh a RTR session on multiple hosts. RTR sessions will expire after 10 minutes unless refreshed.

Create actions for a monitoring rule. Accepts a list of actions that will be attached to the monitoring rule.

Create Device Control Policies by specifying details about the policy to create.

Create Firewall Policies by specifying details about the policy to create.

Create Host Groups by specifying details about the group to create.

Create or update Global Settings which are applicable to all provisioned AWS accounts.

Create Prevention Policies by specifying details about the policy to create.

Create monitoring rules.

Create Sensor Update Policies by specifying details about the policy to create.

Create Sensor Update Policies by specifying details about the policy to create with additional support for uninstall protection.

Create a new user. After creating a user, assign one or more roles with POST /user-roles/entities/user-roles/v1.

Create new User Group(s). Maximum 500 User Group(s) allowed per customer.

Creates a new AWS account in our system for a customer and generates the installation script.

Create new CID Group(s). Maximum 500 CID Group(s) allowed.

Creates a new account in our system for a customer and generates a script for them to run in their AWS cloud environment to grant us access.

Creates a new account in our system for a customer and generates a new service account for them to add access to in their GCP environment to grant us access.

Create the ML exclusions.

Create Response Policies by specifying details about the policy to create.

Create a rule within a rule group. Returns the rule.

Create new rule group on a platform for a customer with a name and description, and return the ID.

Create a rule group for a platform with a name and an optional description. Returns the rule group.

Create the sensor visibility exclusions.

Query environment wide CrowdScore and return the entity data.

Check current installation token settings.

Delete an action from a monitoring rule based on the action ID.

Delete a set of Device Control Policies by specifying their IDs.

Delete a set of Firewall Policies by specifying their IDs.

Delete a set of Host Groups by specifying their IDs.

Delete notifications based on IDs. Notifications cannot be recovered after they are deleted.

Delete a set of Prevention Policies by specifying their IDs.

Delete report based on the report ID. Operation can be checked for success by polling for the report ID on the report-summaries endpoint.

Delete monitoring rules.

Removes a sample, including file, meta and submissions from the collection.

Removes a sample, including file, meta and submissions from the collection.

Delete a set of Sensor Update Policies by specifying their IDs.

Delete the sensor visibility exclusions by id.

Delete a user permanently.

Delete User Group members entry.

Delete User Group(s) by ID(s).

Delete a set of AWS Accounts by specifying their IDs.

Delete AWS accounts.

Delete CID Group members entry.

Delete CID Group(s) by ID(s).

Deletes an existing AWS account or organization in our system.

Deletes an Azure subscription from the system.

Delete MSSP Role assignment(s) between User Group and CID Group. User Group ID and CID Group ID have to be specified in request. Only specified roles are removed if specified in request payload, else association between User Group and CID Group is dissolved completely (if no roles specified).

Delete the IOA exclusions by id.

Delete the ML exclusions by id.

Delete a set of Response Policies by specifying their IDs.

Delete rule group entities by ID.

Delete rule groups by ID.

Delete rules from a rule group by ID.

Number of hosts in your customer account that have observed a given custom IOC.

Find hosts that have observed a given custom IOC. For details about those hosts, use GET /devices/entities/devices/v2.

Download sensor installer by SHA256 ID.

For the provided ProcessID retrieve the process details.

Get actions based on their IDs. IDs can be retrieved using the GET /queries/actions/v1 endpoint.

Get detect aggregates as specified via json in request body.

Download IOC packs, PCAP files, and other analysis artifacts.

Get Zero Trust Assessment data for one or more hosts by providing agent IDs (AID) and a customer ID (CID).

Show role IDs for all roles available in your customer account. For more information on each role, provide the role ID to `/customer/entities/roles/v1`.

Get details on behaviors by providing behavior IDs.

Get link to child customer by child CID(s).

Return information about Azure account registration.

Return a script for customer to run in their cloud environment to grant us access to their Azure environment as a downloadable attachment.

Return information about Azure account registration.

Return a script for customer to run in their cloud environment to grant us access to their Azure environment as a downloadable attachment.

Provides the clusters acknowledged by the Kubernetes Protection service.

Get sensor installer details by provided query.

View information about detections.

Retrieve a set of Device Control Policies by specifying their IDs.

Retrieve device count collection Ids that match the provided FQL filter, criteria with scrolling enabled.

Get details on one or more hosts by providing agent IDs (AID). You can get a host's agent IDs (AIDs) from the /devices/queries/devices/v1 endpoint, the Falcon console or the Streaming API.

Retrieve details about recent login sessions for a set of devices.

Retrieve history of IP and MAC addresses of devices.

Retrieve a set of Firewall Policies by specifying their IDs.

Provides a sample Helm values.yaml file for a customer to install alongside the agent Helm chart.

Retrieve a set of Host Groups by specifying their IDs.

Get details on incidents by providing incident IDs.

Retrieve specific actors using their actor IDs.

Retrieve specific indicators using their indicator IDs.

Retrieve specific reports using their report IDs.

Return a Report PDF attachment.

Retrieve details for rule sets for the specified ids.

Download earlier rule sets.

Download the latest rule set.

Provides the cloud locations acknowledged by the Kubernetes Protection service.

Download a file indexed by MalQuery. Specify the file using its SHA256. Only one file is supported at this time.

Fetch a zip archive with password 'infected' containing the samples. Call this once the /entities/samples-multidownload request has finished processing.

Retrieve indexed files metadata by their hash.

Get information about search and download quotas in your environment.

Check the status and results of an asynchronous request, such as hunt or exact-search. Supports a single request id at this time.

Get detailed notifications based on their IDs. These include the raw intelligence content that generated the match.This endpoint will return translated notification content. The only target language available is English. A single notification can be translated per request.

Get detailed notifications based on their IDs. These include the raw intelligence content that generated the match.

Get notifications based on their IDs. IDs can be retrieved using the GET /queries/notifications/v1 endpoint. This endpoint will return translated notification content. The only target language available is English.

Get notifications based on their IDs. IDs can be retrieved using the GET /queries/notifications/v1 endpoint.

Retrieve a set of Prevention Policies by specifying their IDs.

Get a full sandbox report.

Get info about a role.

Get MSSP Role assignment(s). MSSP Role assignment is of the format :.

Get monitoring rules rules by provided IDs.

Retrieves the file associated with the given ID (SHA256).

Retrieves the file associated with the given ID (SHA256).

Check the status of a volume scan. Time required for analysis increases with the number of samples in a volume but usually it should take less than 1 minute.

Get scans aggregations as specified via json in request body.

Get sensor installer IDs by provided query.

Get sensor installer details by provided SHA256 IDs.

Get CCID to use with sensor installers.

Retrieve a set of Sensor Update Policies by specifying their IDs.

Retrieve a set of Sensor Update Policies with additional support for uninstall protection by specifying their IDs.

Get a set of Sensor Visibility Exclusions by specifying their IDs.

Check the status of a sandbox analysis. Time required for analysis varies but is usually less than 15 minutes.

Get a short summary version of a sandbox report.

Get User Group members by User Group ID(s).

Get User Group by ID(s).

Show role IDs of roles assigned to a user. For more information on each role, provide the role ID to `/customer/entities/roles/v1`.

Get details on vulnerabilities by providing one or more IDs.

Retrieve a set of AWS Accounts by specifying their IDs.

Provides a list of AWS accounts.

Retrieve a set of Global Settings which are applicable to all provisioned AWS accounts.

Get CID Group(s) by ID(s).

Get CID Group members by CID Group IDs.

Returns information about the current status of an AWS account.

Return a script for customer to run in their cloud environment to grant us access to their AWS environment as a downloadable attachment.

Return a URL for customer to visit in their cloud environment to grant us access to their AWS environment.

Return a script for customer to run in their cloud environment to grant us access to their Azure environment.

Given a policy ID, returns detailed policy information.

Returns information about current policy settings.

Returns scan schedule configuration for one or more cloud platforms.

Returns information about the current status of an GCP account.

Return a script for customer to run in their cloud environment to grant us access to their GCP environment.

Return a script for customer to run in their cloud environment to grant us access to their GCP environment as a downloadable attachment.

Get events entities by ID and optionally version.

Get the firewall field specifications by ID.

For CSPM IOA events, gets list of IOA events.

Get a set of IOA Exclusions by specifying their IDs.

For CSPM IOA users, gets list of IOA users.

DEPRECATED Use the new IOC Management endpoint (GET /iocs/entities/indicators/v1). Get an IOC by providing a type and value.

Get a set of ML Exclusions by specifying their IDs.

Get pattern severities by ID.

Get platforms by ID, e.g., windows or mac or droid.

Get platforms by ID.

Get policy container entities by policy ID.

Retrieve a set of Response Policies by specifying their IDs.

Get rule group entities by ID. These groups do not contain their rule entites, just the rule IDs in precedence order.

Get rule groups by ID.

Get rule entities by ID (64-bit unsigned int as decimal string) or Family ID (32-character hexadecimal string).

Get rules by ID and optionally version in the following format: `ID[:version]`. The max number of IDs is constrained by URL size.

Get rules by ID and optionally version in the following format: `ID[:version]`.

Get rule types by ID.

Assign one or more roles to a user.

Get Combined for Indicators.

Create Indicators.

Delete Indicators by ids.

Get Indicators by ids.

Search for Indicators.

Update Indicators.

Discover all event streams in your environment.

Generate an OAuth2 access token.

Revoke a previously issued OAuth2 access token before the end of its standard 30-minute life .

Update an Azure service account in our system by with the user-created client_id created with the public key we've provided.

Update an Azure service account in our system by with the user-created client_id created with the public key we've provided.

Patches a existing account in our system for a customer.

Take various actions on the hosts in your environment. Contain or lift containment on a host. Delete or restore a host.

Perform the specified action on the Device Control Policies specified in the request.

Perform the specified action on the Firewall Policies specified in the request.

Perform the specified action on the Host Groups specified in the request.

Perform a set of actions on one or more incidents, such as adding tags or comments or updating the incident name or description.

Perform the specified action on the Prevention Policies specified in the request.

Perform the specified action on the Sensor Update Policies specified in the request.

Perform the specified action on the Response Policies specified in the request.

Creates a new account in our system for a customer and generates a script for them to run in their cloud environment to grant us access.

Creates a new account in our system for a customer and generates a script for them to run in their cloud environment to grant us access.

Schedule samples for download. Use the result id with the /request endpoint to check if the download is ready after which you can call the /entities/samples-fetch to get the zip.

Search Falcon MalQuery for a combination of hex patterns and strings in order to identify samples based upon file content at byte level granularity. You can filter results on criteria such as file type, file size and first seen date. Returns a request id which can be used with the /request endpoint.

Search Falcon MalQuery quickly, but with more potential for false positives. Search for a combination of hex patterns and strings in order to identify samples based upon file content at byte level granularity.

Schedule a YARA-based search for execution. Returns a request id which can be used with the /request endpoint.

Preview rules notification count and distribution. This will return aggregations on: channel, count, site.

Search for processes associated with a custom IOC.

Provision AWS Accounts by specifying details about the accounts to provision.

Query actions based on provided criteria. Use the IDs from this response to get the action entities on GET /entities/actions/v1.

Retrieve allowlist tickets that match the provided filter criteria with scrolling enabled.

Search for behaviors by providing an FQL filter, sorting, and paging details.

Retrieve block listtickets that match the provided filter criteria with scrolling enabled.

Query for customers linked as children.

Search for Device Control Policies in your environment by providing an FQL filter and paging details. Returns a set of Device Control Policies which match the filter criteria.

Search for members of a Device Control Policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria.

Search for Firewall Policies in your environment by providing an FQL filter and paging details. Returns a set of Firewall Policies which match the filter criteria.

Search for members of a Firewall Policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria.

Search for members of a Host Group in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria.

Search for Host Groups in your environment by providing an FQL filter and paging details. Returns a set of Host Groups which match the filter criteria.

Search for Prevention Policies in your environment by providing an FQL filter and paging details. Returns a set of Prevention Policies which match the filter criteria.

Search for members of a Prevention Policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria.

Retrieve available builds for use with Sensor Update Policies.

Search for Sensor Update Policies in your environment by providing an FQL filter and paging details. Returns a set of Sensor Update Policies which match the filter criteria.

Search for Sensor Update Policies with additional support for uninstall protection in your environment by providing an FQL filter and paging details. Returns a set of Sensor Update Policies which match the filter criteria.

Search for members of a Sensor Update Policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria.

Search for Response Policies in your environment by providing an FQL filter and paging details. Returns a set of Response Policies which match the filter criteria.

Search for members of a Response policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria.

Retrieve DetectionsIds that match the provided FQL filter, criteria with scrolling enabled.

Search for detection IDs that match a given query.

Search for Device Control Policies in your environment by providing an FQL filter and paging details. Returns a set of Device Control Policy IDs which match the filter criteria.

Search for members of a Device Control Policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria.

Search for hosts in your environment by platform, hostname, IP, and other criteria.

Search for hosts in your environment by platform, hostname, IP, and other criteria with continuous pagination capability (based on offset pointer which expires after 2 minutes with no maximum limit).

Retrieve escalation tickets that match the provided filter criteria with scrolling enabled.

Search for Firewall Policies in your environment by providing an FQL filter and paging details. Returns a set of Firewall Policy IDs which match the filter criteria.

Search for members of a Firewall Policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria.

Search for members of a Host Group in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria.

Retrieve hidden hosts that match the provided filter criteria.

Search for Host Groups in your environment by providing an FQL filter and paging details. Returns a set of Host Group IDs which match the filter criteria.

Retrieve incidents that match the provided filter criteria with scrolling enabled.

Search for incidents by providing an FQL filter, sorting, and paging details.

Get info about actors that match provided FQL filters.

Get actor IDs that match provided FQL filters.

Get info about indicators that match provided FQL filters.

Get indicators IDs that match provided FQL filters.

Get info about reports that match provided FQL filters.

Get report IDs that match provided FQL filters.

Search for rule IDs that match provided filter criteria.

Query notifications based on provided criteria. Use the IDs from this response to get the notification entities on GET /entities/notifications/v1 or GET /entities/notifications-detailed/v1.

Search for Prevention Policies in your environment by providing an FQL filter and paging details. Returns a set of Prevention Policy IDs which match the filter criteria.

Search for members of a Prevention Policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria.

Retrieve remediation tickets that match the provided filter criteria with scrolling enabled.

Find sandbox reports by providing an FQL filter and paging details. Returns a set of report IDs that match your criteria.

Query MSSP Role assignment. At least one of CID Group ID or User Group ID should also be provided. Role ID is optional.

Query monitoring rules based on provided criteria. Use the IDs from this response to fetch the rules on /entities/rules/v1.

Retrieves a list with sha256 of samples that exist and customer has rights to access them, maximum number of accepted items is 200.

Search for Sensor Update Policies in your environment by providing an FQL filter and paging details. Returns a set of Sensor Update Policy IDs which match the filter criteria.

Search for members of a Sensor Update Policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria.

Search for sensor visibility exclusions.

Find submission IDs for uploaded files by providing an FQL filter and paging details. Returns a set of submission IDs that match your criteria.

Find IDs for submitted scans by providing an FQL filter and paging details. Returns a set of volume IDs that match your criteria.

Query User Group member by User UUID.

Query User Groups.

Search for Vulnerabilities in your environment by providing an FQL filter and paging details. Returns a set of Vulnerability IDs which match the filter criteria.

Search for provisioned AWS Accounts by providing an FQL filter and paging details. Returns a set of AWS accounts which match the filter criteria.

Search for provisioned AWS Accounts by providing an FQL filter and paging details. Returns a set of AWS account IDs which match the filter criteria.

Query a CID Groups members by associated CID.

Query CID Groups.

Find all event IDs matching the query with filter.

Get the firewall field specification IDs for the provided platform.

DEPRECATED Use the new IOC Management endpoint (GET /iocs/queries/indicators/v1). Search the custom IOCs in your customer account.

Search for IOA exclusions.

Search for ML exclusions.

Get all pattern severity IDs.

Get the list of platform names.

Get all platform IDs.

Find all firewall rule IDs matching the query with filter, and return them in precedence order.

Search for Response Policies in your environment by providing an FQL filter with sort and/or paging details. This returns a set of Response Policy IDs that match the given criteria.

Search for members of a Response policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria.

Find all rule group IDs matching the query with filter.

Finds all rule group IDs matching the query with optional filter.

Find all rule groups matching the query with optional filter.

Find all rule IDs matching the query with filter.

Finds all rule IDs matching the query with optional filter.

Get all rule type IDs.

Refresh an active event stream. Use the URL shown in a GET /sensors/entities/datafeed/v2 response.

Regenerate API key for docker registry integrations.

List the usernames (usually an email address) for all users in your customer account.

Get info about a user.

List user IDs for all users in your customer account. For more information on each user, provide the user ID to `/users/entities/user/v1`.

Get a user's ID by providing a username (usually an email address).

Reveals an uninstall token for a specific device. To retrieve the bulk maintenance token pass the value 'MAINTENANCE' as the value for 'device_id'.

Revoke one or more roles from a user.

Get aggregates on session data.

Get status of an executed active-responder command on a single host.

Get status of an executed RTR administrator command on a single host.

Get status of an executed command on a single host.

Upload a new put-file to use for the RTR `put` command.

Upload a new custom-script to use for the RTR `runscript` command.

Delete a RTR session file.

Delete a put-file based on the ID given. Can only delete one file at a time.

Delete a queued session command.

Delete a custom-script based on the ID given. Can only delete one script at a time.

Delete a session.

Execute an active responder command on a single host.

Execute a RTR administrator command on a single host.

Execute a command on a single host.

Get RTR extracted file contents for specified session and sha256.

Get put-files based on the ID's given. These are used for the RTR `put` command.

Get custom-scripts based on the ID's given. These are used for the RTR `runscript` command.

Initialize a new session with the RTR cloud.

Get a list of session_ids.

Get a list of files for the specified RTR session.

Get a list of put-file ID's that are available to the user for the `put` command.

Get queued session metadata by session ID.

Get a list of custom-script ID's that are available to the user for the `runscript` command.

Get session metadata by session id.

Refresh a session timeout on a single host.

Upload a new scripts to replace an existing one.

Submit a volume of files for ml scanning. Time required for analysis increases with the number of samples in a volume but usually it should take less than 1 minute.

Sets the precedence of Device Control Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence.

Sets the precedence of Firewall Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence.

Sets the precedence of Prevention Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence.

Sets the precedence of Sensor Update Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence.

Sets the precedence of Response Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence.

Submit an uploaded file or a URL for sandbox analysis. Time required for analysis varies but is usually less than 15 minutes.

Creates a token.

Deletes a token immediately. To revoke a token, use PATCH /installation-tokens/entities/tokens/v1 instead.

Search for tokens by providing an FQL filter and paging details.

Gets the details of one or more tokens by id.

Updates one or more tokens. Use this endpoint to edit labels, change expiration, revoke, or restore.

Triggers a dry run or a full scan of a customer's kubernetes footprint.

Update an action for a monitoring rule.

Modify the state, assignee, and visibility of detections.

Update Device Control Policies by specifying the ID of the policy and details to update.

Append or remove one or more Falcon Grouping Tags on one or more hosts.

Update Firewall Policies by specifying the ID of the policy and details to update.

Update Host Groups by specifying the ID of the group and details to update.

Update notification status or assignee. Accepts bulk requests.

Update Prevention Policies by specifying the ID of the policy and details to update.

Update monitoring rules.

Update Sensor Update Policies by specifying the ID of the policy and details to update.

Update Sensor Update Policies by specifying the ID of the policy and details to update with additional support for uninstall protection.

Update the sensor visibility exclusions.

Modify an existing user's first or last name.

Update existing User Group(s). User Group ID is expected for each User Group definition provided in request body. User Group member(s) remain unaffected.

Updates the AWS account per the query meters provided.

Update AWS Accounts by specifying the ID of the account and details to update.

Update existing CID Group(s). CID Group ID is expected for each CID Group definition provided in request body. CID Group member(s) remain unaffected.

Update an Azure default subscription_id in our system for given tenant_id.

Updates a policy setting - can be used to override policy severity or to disable a policy entirely.

Updates scan schedule configuration for one or more cloud platforms.

Update the IOA exclusions.

DEPRECATED Use the new IOC Management endpoint (PATCH /iocs/entities/indicators/v1). Update an IOC by providing a type and value.

Update the ML exclusions.

Update an identified policy container.

Update Response Policies by specifying the ID of the policy and details to update.

Update name, description, or enabled status of a rule group, or create, edit, delete, or reorder rules.

Update a rule group. The following properties can be modified: name, description, enabled.

Update rules within a rule group. Return the updated rules.

Upload a file for sandbox analysis. After uploading, use `/falconx/entities/submissions/v1` to start analyzing the file.

Upload a file for further cloud analysis. After uploading, call the specific analysis API endpoint.

Validates field values and checks for matches if a test string is provided.

Performs an Access Verification check on the specified AWS Account IDs.