-
Notifications
You must be signed in to change notification settings - Fork 162
CAO Hunting
| Operation ID | Description | ||||
|---|---|---|---|---|---|
|
Aggregate Hunting Guides | ||||
|
Aggregate intelligence queries. | ||||
|
Creates an Archive Export. | ||||
|
Retrieves a list of Hunting Guides | ||||
|
Retrieves a list of Intelligence queries. | ||||
|
Search for Hunting Guides that match the provided conditions | ||||
|
Search intelligence queries that match the provided conditions. | ||||
WARNING
client_idandclient_secretare keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.
Aggregate intelligence queries.
aggregate_queries
| Method | Route |
|---|---|
/hunting/aggregates/intelligence-queries/v1 |
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| body | body | dictionary | Full body payload as a dictionary. Not required when using other keywords. | ||
| date_ranges | body | list of dictionaries | Applies to date_range aggregations. Example: [ { "from": "2016-05-28T09:00:31Z", "to": "2016-05-30T09:00:31Z" }, { "from": "2016-06-01T09:00:31Z", "to": "2016-06-10T09:00:31Z" } ] |
||
| exclude | body | string | Elements to exclude. | ||
| extended_bounds | body | dictionary | Extended aggregate boundaries. Contains max and min values as strings.Example: { "max": "string", "min": "string" } |
||
| field | body | string | The field on which to compute the aggregation. | ||
| filter | body | string | FQL syntax formatted string to use to filter the results. | ||
| from | body | integer | Starting position. | ||
| include | body | string | Elements to include. | ||
| interval | body | string | Time interval for date histogram aggregations. Valid values include:
|
||
| max_doc_count | body | integer | Only return buckets if values are less than or equal to the value here. | ||
| min_doc_count | body | integer | Only return buckets if values are greater than or equal to the value here. | ||
| missing | body | string | Missing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value. | ||
| name | body | string | Name of the aggregate query, as chosen by the user. Used to identify the results returned to you. | ||
| q | body | string | Full text search across all metadata fields. | ||
| ranges | body | list of dictionaries | Applies to range aggregations. Ranges values will depend on field. For example, if max_severity is used, ranges might look like: [ { "From": 0, "To": 70 }, { "From": 70, "To": 100 } ] |
||
| size | body | integer | The max number of term buckets to be returned. | ||
| sub_aggregates | body | list of dictionaries | A nested aggregation, such as: [ { "name": "max_first_behavior", "type": "max", "field": "first_behavior" } ] There is a maximum of 3 nested aggregations per request. |
||
| sort | body | string |
FQL syntax string to sort bucket results.
asc and desc using | format. Example: _count|desc
|
||
| time_zone | body | string | Time zone for bucket results. | ||
| type | body | string | Type of aggregation. Valid values include:
|
from falconpy import CAOHunting
# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
date_range = {
"from": "string",
"to": "string"
}
bounds = {
"max": "string",
"min": "string"
}
search_range = {
"From": integer,
"To": integer
}
response = falcon.aggregate_queries(date_ranges=[date_range],
exclude="string",
extended_bounds=bounds,
field="string",
filter="string",
from=integer,
include="string",
interval="string",
max_doc_count=integer,
min_doc_count=integer,
missing="string",
name="string",
q="string",
ranges=[search_range],
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)from falconpy import CAOHunting
# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
date_range = {
"from": "string",
"to": "string"
}
bounds = {
"max": "string",
"min": "string"
}
search_range = {
"From": integer,
"To": integer
}
response = falcon.AggregateIntelligenceQueries(date_ranges=[date_range],
exclude="string",
extended_bounds=bounds,
field="string",
filter="string",
from=integer,
include="string",
interval="string",
max_doc_count=integer,
min_doc_count=integer,
missing="string",
name="string",
q="string",
ranges=[search_range],
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)from falconpy import APIHarnessV2
# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
body_payload = [
{
"date_ranges": [
{
"from": "string",
"to": "string"
}
],
"exclude": "string",
"extended_bounds": {
"max": "string",
"min": "string"
},
"field": "string",
"filter": "string",
"from": integer,
"include": "string",
"interval": "string",
"max_doc_count": integer,
"min_doc_count": integer,
"missing": "string",
"name": "string",
"q": "string",
"ranges": [
{
"From": integer,
"To": integer
}
],
"size": integer,
"sort": "string",
"sub_aggregates": [
null
],
"time_zone": "string",
"type": "string"
}
]
response = falcon.command("AggregateIntelligenceQueries", body=body_payload)
print(response)Back to Table of Contents
Creates an Archive Export.
create_export_archive
| Method | Route |
|---|---|
/hunting/entities/archive-exports/v1 |
- Produces: application/octet-stream
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| archive_type | query | string | The Archive Type can be one of 'zip' and 'gzip'. Defaults to 'zip'. | ||
| filter | query | string | The FQL Filter. | ||
| language | query | string | The Query Language. Accepted Values:
|
||
| parameters | query | dictionary | Full query string parameters payload in JSON format. Not required when using other keywords. |
from falconpy import CAOHunting
# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
save_file = "some_file.ext"
with open(save_file, "wb") as file_output:
file_output.write(falcon.create_export_archive(language="string",
filter="string",
archive_type="string"
))from falconpy import CAOHunting
# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
save_file = "some_file.ext"
with open(save_file, "wb") as file_output:
file_output.write(falcon.GetArchiveExport(language="string",
filter="string",
archive_type="string"
))from falconpy import APIHarnessV2
# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
save_file = "some_file.ext"
with open(save_file, "wb") as file_output:
file_output.write(falcon.command("GetArchiveExport",
language="string",
filter="string",
archive_type="string"
))Back to Table of Contents
Retrieves a list of Intelligence queries.
get_queries
| Method | Route |
|---|---|
/hunting/entities/intelligence-queries/v1 |
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| ids | query | string or list of strings | Intelligence queries IDs. | ||
| include_translated_content | query | string or list of strings | The AI translated language that should be returned if it exists. Accepted values are: SPL, __all__. |
||
| parameters | query | dictionary | Full query string parameters payload in JSON format. Not required when using other keywords. |
from falconpy import CAOHunting
# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
translated_langs = 'SPL,__all__' # Can also pass a list here: ['SPL', '__all__']
response = falcon.get_queries(ids=id_list,
include_translated_content=translated_langs
)
print(response)from falconpy import CAOHunting
# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
translated_langs = 'SPL,__all__' # Can also pass a list here: ['SPL', '__all__']
response = falcon.GetIntelligenceQueries(ids=id_list,
include_translated_content=translated_langs
)
print(response)from falconpy import APIHarnessV2
# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
translated_langs = 'SPL,__all__' # Can also pass a list here: ['SPL', '__all__']
response = falcon.command("GetIntelligenceQueries",
ids=id_list,
include_translated_content=translated_langs
)
print(response)Back to Table of Contents
Search intelligence queries that match the provided conditions.
search_queries
| Method | Route |
|---|---|
/hunting/queries/intelligence-queries/v1 |
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| filter | query | string | FQL query specifying the filter parameters. | ||
| limit | query | integer | Number of IDs to return. | ||
| offset | query | string | Starting index of result set from which to return IDs. | ||
| parameters | query | dictionary | Full query string parameters payload in JSON format. Not required when using other keywords. | ||
| q | query | string | Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed). | ||
| sort | query | string | Order by fields. |
from falconpy import CAOHunting
# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.search_queries(offset="string",
limit=integer,
sort="string",
filter="string",
q="string"
)
print(response)from falconpy import CAOHunting
# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.SearchIntelligenceQueries(offset="string",
limit=integer,
sort="string",
filter="string",
q="string"
)
print(response)from falconpy import APIHarnessV2
# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.command("SearchIntelligenceQueries",
offset="string",
limit=integer,
sort="string",
filter="string",
q="string"
)
print(response)Back to Table of Contents
Aggregate Hunting Guides
aggregate_guides
| Method | Route |
|---|---|
/hunting/aggregates/hunting-guides/v1 |
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| body | body | list of dictionaries | Full body payload as a list of dictionaries. Not required when using other keywords. | ||
| date_ranges | body | list of dictionaries | Applies to date_range aggregations. Example: [ { "from": "2016-05-28T09:00:31Z", "to": "2016-05-30T09:00:31Z" }, { "from": "2016-06-01T09:00:31Z", "to": "2016-06-10T09:00:31Z" } ] |
||
| exclude | body | string | Elements to exclude. | ||
| extended_bounds | body | dictionary | Extended aggregate boundaries. Contains max and min values as strings.Example: { "max": "string", "min": "string" } |
||
| field | body | string | The field on which to compute the aggregation. | ||
| filter | body | string | FQL syntax formatted string to use to filter the results. | ||
| filters_spec | body | dictionary | Filters specification containing filters, other_bucket, and other_bucket_key. Example: { "filters": { "additionalProp1": "string", "additionalProp2": "string" }, "other_bucket": boolean, "other_bucket_key": "string" } |
||
| from | body | integer | Starting position. | ||
| include | body | string | Elements to include. | ||
| interval | body | string | Time interval for date histogram aggregations. Valid values include:
|
||
| max_doc_count | body | integer | Only return buckets if values are less than or equal to the value here. | ||
| min_doc_count | body | integer | Only return buckets if values are greater than or equal to the value here. | ||
| missing | body | string | Missing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value. | ||
| name | body | string | Name of the aggregate query, as chosen by the user. Used to identify the results returned to you. | ||
| percents | body | list of integers | Percentile values for percentile aggregations. | ||
| q | body | string | Full text search across all metadata fields. | ||
| ranges | body | list of dictionaries | Applies to range aggregations. Ranges values will depend on field. For example, if max_severity is used, ranges might look like: [ { "From": 0, "To": 70 }, { "From": 70, "To": 100 } ] |
||
| size | body | integer | The max number of term buckets to be returned. | ||
| sort | body | string |
FQL syntax string to sort bucket results.
asc and desc using | format. Example: _count|desc
|
||
| sub_aggregates | body | list of dictionaries | A nested aggregation, such as: [ { "name": "max_first_behavior", "type": "max", "field": "first_behavior" } ] There is a maximum of 3 nested aggregations per request. |
||
| time_zone | body | string | Time zone for bucket results. | ||
| type | body | string | Type of aggregation. Valid values include:
|
from falconpy import CAOHunting
# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
date_range = {
"from": "string",
"to": "string"
}
bounds = {
"max": "string",
"min": "string"
}
filter_spec = {
"filters": {
"additionalProp1": "string",
"additionalProp2": "string"
},
"other_bucket": boolean,
"other_bucket_key": "string"
}
search_range = {
"From": integer,
"To": integer
}
response = falcon.aggregate_guides(date_ranges=[date_range],
exclude="string",
extended_bounds=bounds,
field="string",
filter="string",
filters_spec=filter_spec,
from=integer,
include="string",
interval="string",
max_doc_count=integer,
min_doc_count=integer,
missing="string",
name="string",
percents=[integer],
q="string",
ranges=[search_range],
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)from falconpy import CAOHunting
# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
date_range = {
"from": "string",
"to": "string"
}
bounds = {
"max": "string",
"min": "string"
}
filter_spec = {
"filters": {
"additionalProp1": "string",
"additionalProp2": "string"
},
"other_bucket": boolean,
"other_bucket_key": "string"
}
search_range = {
"From": integer,
"To": integer
}
response = falcon.AggregateHuntingGuides(date_ranges=[date_range],
exclude="string",
extended_bounds=bounds,
field="string",
filter="string",
filters_spec=filter_spec,
from=integer,
include="string",
interval="string",
max_doc_count=integer,
min_doc_count=integer,
missing="string",
name="string",
percents=[integer],
q="string",
ranges=[search_range],
size=integer,
sort="string",
time_zone="string",
type="string"
)
print(response)from falconpy import APIHarnessV2
# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
body_payload = [
{
"date_ranges": [
{
"from": "string",
"to": "string"
}
],
"exclude": "string",
"extended_bounds": {
"max": "string",
"min": "string"
},
"field": "string",
"filter": "string",
"filters_spec": {
"filters": {
"additionalProp1": "string",
"additionalProp2": "string",
"additionalProp3": "string"
},
"other_bucket": boolean,
"other_bucket_key": "string"
},
"from": integer,
"include": "string",
"interval": "string",
"max_doc_count": integer,
"min_doc_count": integer,
"missing": "string",
"name": "string",
"percents": [
integer
],
"q": "string",
"ranges": [
{
"From": integer,
"To": integer
}
],
"size": integer,
"sort": "string",
"sub_aggregates": [
null
],
"time_zone": "string",
"type": "string"
}
]
response = falcon.command("AggregateHuntingGuides", body=body_payload)
print(response)Back to Table of Contents
Retrieves a list of Hunting Guides
get_guides
| Method | Route |
|---|---|
/hunting/entities/hunting-guides/v1 |
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| ids | query | string or list of strings | Hunting Guides IDs. Required parameter. | ||
| parameters | query | dictionary | Full query string parameters payload in JSON format. Not required when using other keywords. |
from falconpy import CAOHunting
# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_guides(ids=id_list)
print(response)from falconpy import CAOHunting
# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.GetHuntingGuides(ids=id_list)
print(response)from falconpy import APIHarnessV2
# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("GetHuntingGuides", ids=id_list)
print(response)Back to Table of Contents
Search for Hunting Guides that match the provided conditions
search_guides
| Method | Route |
|---|---|
/hunting/queries/hunting-guides/v1 |
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| filter | query | string | FQL query specifying the filter parameters. | ||
| limit | query | integer | Number of IDs to return. | ||
| offset | query | string | Starting index of result set from which to return IDs. | ||
| parameters | query | dictionary | Full query string parameters payload in JSON format. Not required when using other keywords. | ||
| sort | query | string | Order by fields. | ||
| q | query | string | Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed). |
from falconpy import CAOHunting
# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.search_guides(offset="string",
limit=integer,
sort="string",
filter="string",
q="string"
)
print(response)from falconpy import CAOHunting
# Do not hardcode API credentials!
falcon = CAOHunting(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.SearchHuntingGuides(offset="string",
limit=integer,
sort="string",
filter="string",
q="string"
)
print(response)from falconpy import APIHarnessV2
# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.command("SearchHuntingGuides",
offset="string",
limit=integer,
sort="string",
filter="string",
q="string"
)
print(response)Back to Table of Contents

- Home
- Discussions Board
- Glossary of Terms
- Installation, Upgrades and Removal
- Samples Collection
- Using FalconPy
- API Operations
-
Service Collections
- Admission Control Policies
- Alerts
- API Integrations
- ASPM
- CAO Hunting
- Case Management
- Certificate Based Exclusions
- Cloud AWS Registration
- Cloud Azure Registration
- Cloud GCP Registration
- Cloud OCI Registration
- Cloud Policies
- Cloud Connect AWS (deprecated)
- Cloud Security Assets
- Cloud Security
- Cloud Security Compliance
- Cloud Security Detections
- Cloud Snapshots
- Configuration Assessment
- Configuration Assessment Evaluation Logic
- Container Alerts
- Container Detections
- Container Image Compliance
- Container Images
- Container Packages
- Container Vulnerabilities
- Content Update Policies
- Correlation Rules
- Correlation Rules Admin
- CSPM Registration
- Custom IOAs
- Custom Storage
- D4C Registration (deprecated)
- Data Protection Configuration
- DataScanner (deprecated)
- Delivery Settings
- Deployments
- Detects (deprecated)
- Device Content
- Device Control Policies
- Discover
- Downloads
- Drift Indicators
- Event Streams
- Exposure Management
- FaaS Execution
- Falcon Complete Dashboard
- Falcon Container
- Falcon Intelligence Sandbox
- FDR
- FileVantage
- Firewall Management
- Firewall Policies
- Foundry LogScale
- Host Group
- Host Migration
- Hosts
- Identity Protection
- Image Assessment Policies
- Incidents
- Installation Tokens
- Intel
- Intelligence Feeds
- Intelligence Indicator Graph
- IOA Exclusions
- IOC
- IOCs (deprecated)
- IT Automation
- Kubernetes Container Compliance
- Kubernetes Protection
- MalQuery
- Message Center
- ML Exclusions
- Mobile Enrollment
- MSSP (Flight Control)
- NGSIEM
- OAuth2
- ODS (On Demand Scan)
- Prevention Policy
- Quarantine
- Quick Scan
- Quick Scan Pro
- Real Time Response
- Real Time Response Admin
- Real Time Response Audit
- Recon
- Report Executions
- Response Policies
- Sample Uploads
- SaaS Security
- Scheduled Reports
- Sensor Download
- Sensor Update Policy
- Sensor Usage
- Sensor Visibility Exclusions
- Serverless Exports
- Serverless Vulnerabilities
- Spotlight Evaluation Logic
- Spotlight Vulnerabilities
- Spotlight Vulnerability Metadata
- Tailored Intelligence
- ThreatGraph
- Unidentified Containers
- User Management
- Workflows
- Zero Trust Assessment
- Documentation Support
-
CrowdStrike SDKs
- Crimson Falcon - Ruby
- FalconPy - Python 3
- FalconJS - Javascript
- goFalcon - Go
- PSFalcon - Powershell
- Rusty Falcon - Rust
