Falcon Complete Dashboard

Using the Falcon Complete Dashboard service collection

Table of Contents

Operation ID	Description
AggregateAllowList PEP 8 aggregate_allow_list	Retrieve aggregate allowlist ticket values based on the matched filter
AggregateBlockList PEP 8 aggregate_block_list	Retrieve aggregate blocklist ticket values based on the matched filter
AggregateDetections PEP 8 aggregate_detections	Retrieve aggregate detection values based on the matched filter
AggregateDeviceCountCollection PEP 8 aggregate_device_count_collection	Retrieve aggregate host/devices count based on the matched filter
AggregateEscalations PEP 8 aggregate_escalations	Retrieve aggregate escalation ticket values based on the matched filter
AggregateFCIncidents PEP 8 aggregate_fc_incidents	Retrieve aggregate incident values based on the matched filter
AggregateRemediations PEP 8 aggregate_remediations	Retrieve aggregate remediation ticket values based on the matched filter
QueryAllowListFilter PEP 8 query_allow_list_filter	Retrieve allowlist tickets that match the provided filter criteria with scrolling enabled
QueryBlockListFilter PEP 8 query_block_list_filter	Retrieve block listtickets that match the provided filter criteria with scrolling enabled
QueryDetectionIdsByFilter PEP 8 query_detection_ids_by_filter	Retrieve DetectionsIds that match the provided FQL filter, criteria with scrolling enabled
GetDeviceCountCollectionQueriesByFilter PEP 8 get_device_count_collection_queries_by_filter	Retrieve device count collection Ids that match the provided FQL filter, criteria with scrolling enabled
QueryEscalationsFilter PEP 8 query_escalations_filter	Retrieve escalation tickets that match the provided filter criteria with scrolling enabled
QueryIncidentIdsByFilter PEP 8 query_incident_ids_by_filter	Retrieve incidents that match the provided filter criteria with scrolling enabled
QueryRemediationsFilter PEP 8 query_remediations_filter	Retrieve remediation tickets that match the provided filter criteria with scrolling enabled

Passing credentials

WARNING

client_id and client_secret are input variables that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (All values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

AggregateAllowList

Retrieve aggregate allowlist ticket values based on the matched filter

PEP8 method name

aggregate_allow_list

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
body			body	list of dictionaries	Full body payload in JSON format.
date_ranges			body	list of dictionaries	Applies to date_range aggregations. Example: [   {     "from": "2016-05-28T09:00:31Z",     "to": "2016-05-30T09:00:31Z"   },   {     "from": "2016-06-01T09:00:31Z",     "to": "2016-06-10T09:00:31Z"   } ]
field			body	string	The field on which to compute the aggregation.
filter			body	string	FQL syntax formatted string to use to filter the results.
interval			body	string	Time interval for date histogram aggregations. Valid values include: year month week day hour minute
min_doc_count			body	integer	Only return buckets if values are greater than or equal to the value here.
missing			body	string	Missing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value.
name			body	string	Name of the aggregate query, as chosen by the user. Used to identify the results returned to you.
q			body	string	Full text search across all metadata fields.
ranges			body	list of dictionaries	Applies to range aggregations. Ranges values will depend on field. For example, if max_severity is used, ranges might look like: [   {     "From": 0,     "To": 70   },   {     "From": 70,     "To": 100   } ]
size			body	integer	The max number of term buckets to be returned.
sub_aggregates			body	list of dictionaries	A nested aggregation, such as: [   {     "name": "max_first_behavior",     "type": "max",     "field": "first_behavior"   } ] There is a maximum of 3 nested aggregations per request.
sort			body	string	FQL syntax string to sort bucket results. _count - sort by document count _term - sort by the string value alphabetically Supports asc and desc using | format. Example: _count|desc
time_zone			body	string	Time zone for bucket results.
type			body	string	Type of aggregation. Valid values include: date_histogram - Aggregates counts on a specified time interval. Requires use of “interval” field. date_range - Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601. terms - Buckets detections by the value of a specified field. For example, if field used is scenario, then detections will be bucketed by the various detection scenario names. range - Buckets detections by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the detects will be counted by the specified ranges of severity. cardinality - Returns the count of distinct values in a specified field. max - Returns the maximum value of a specified field. min - Returns the minimum value of a specified field. avg - Returns the average value of the specified field. sum - Returns the total sum of all values for the specified field. percentiles - Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.

Usage

Service class example (PEP8 syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.aggregate_allow_list(date_ranges=date_ranges,
                                       field="string",
                                       filter="string",
                                       interval="string",
                                       min_doc_count=integer,
                                       missing="string",
                                       name="string",
                                       q="string",
                                       ranges=ranges,
                                       size=integer,
                                       sort="string",
                                       time_zone="string",
                                       type="string"
                                       )
print(response)

Service class example (Operation ID syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.AggregateAllowList(date_ranges=date_ranges,
                                     field="string",
                                     filter="string",
                                     interval="string",
                                     min_doc_count=integer,
                                     missing="string",
                                     name="string",
                                     q="string",
                                     ranges=ranges,
                                     size=integer,
                                     sort="string",
                                     time_zone="string",
                                     type="string"
                                     )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

BODY = [{
    "date_ranges": date_ranges,
    "field": "string",
    "filter": "string",
    "interval": "string",
    "min_doc_count": 0,
    "missing": "string",
    "name": "string",
    "q": "string",
    "ranges": ranges,
    "size": 0,
    "sort": "string",
    "sub_aggregates": [
        null
    ],
    "time_zone": "string",
    "type": "string"
}]

response = falcon.command("AggregateAllowList", body=BODY)
print(response)

AggregateBlockList

Retrieve aggregate blocklist ticket values based on the matched filter

PEP8 method name

aggregate_block_list

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
body			body	list of dictionaries	Full body payload in JSON format.
date_ranges			body	list of dictionaries	Applies to date_range aggregations. Example: [   {     "from": "2016-05-28T09:00:31Z",     "to": "2016-05-30T09:00:31Z"   },   {     "from": "2016-06-01T09:00:31Z",     "to": "2016-06-10T09:00:31Z"   } ]
field			body	string	The field on which to compute the aggregation.
filter			body	string	FQL syntax formatted string to use to filter the results.
interval			body	string	Time interval for date histogram aggregations. Valid values include: year month week day hour minute
min_doc_count			body	integer	Only return buckets if values are greater than or equal to the value here.
missing			body	string	Missing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value.
name			body	string	Name of the aggregate query, as chosen by the user. Used to identify the results returned to you.
q			body	string	Full text search across all metadata fields.
ranges			body	list of dictionaries	Applies to range aggregations. Ranges values will depend on field. For example, if max_severity is used, ranges might look like: [   {     "From": 0,     "To": 70   },   {     "From": 70,     "To": 100   } ]
size			body	integer	The max number of term buckets to be returned.
sub_aggregates			body	list of dictionaries	A nested aggregation, such as: [   {     "name": "max_first_behavior",     "type": "max",     "field": "first_behavior"   } ] There is a maximum of 3 nested aggregations per request.
sort			body	string	FQL syntax string to sort bucket results. _count - sort by document count _term - sort by the string value alphabetically Supports asc and desc using | format. Example: _count|desc
time_zone			body	string	Time zone for bucket results.
type			body	string	Type of aggregation. Valid values include: date_histogram - Aggregates counts on a specified time interval. Requires use of “interval” field. date_range - Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601. terms - Buckets detections by the value of a specified field. For example, if field used is scenario, then detections will be bucketed by the various detection scenario names. range - Buckets detections by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the detects will be counted by the specified ranges of severity. cardinality - Returns the count of distinct values in a specified field. max - Returns the maximum value of a specified field. min - Returns the minimum value of a specified field. avg - Returns the average value of the specified field. sum - Returns the total sum of all values for the specified field. percentiles - Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.

Usage

Service class example (PEP8 syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.aggregate_block_list(date_ranges=date_ranges,
                                       field="string",
                                       filter="string",
                                       interval="string",
                                       min_doc_count=integer,
                                       missing="string",
                                       name="string",
                                       q="string",
                                       ranges=ranges,
                                       size=integer,
                                       sort="string",
                                       time_zone="string",
                                       type="string"
                                       )
print(response)

Service class example (Operation ID syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.AggregateBlockList(date_ranges=date_ranges,
                                     field="string",
                                     filter="string",
                                     interval="string",
                                     min_doc_count=integer,
                                     missing="string",
                                     name="string",
                                     q="string",
                                     ranges=ranges,
                                     size=integer,
                                     sort="string",
                                     time_zone="string",
                                     type="string"
                                     )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

BODY = [{
    "date_ranges": date_ranges,
    "field": "string",
    "filter": "string",
    "interval": "string",
    "min_doc_count": 0,
    "missing": "string",
    "name": "string",
    "q": "string",
    "ranges": ranges,
    "size": 0,
    "sort": "string",
    "sub_aggregates": [
        null
    ],
    "time_zone": "string",
    "type": "string"
}]

response = falcon.command("AggregateBlockList", body=BODY)
print(response)

AggregateDetections

Retrieve aggregate detection values based on the matched filter

PEP8 method name

aggregate_detections

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
body			body	list of dictionaries	Full body payload in JSON format.
date_ranges			body	list of dictionaries	Applies to date_range aggregations. Example: [   {     "from": "2016-05-28T09:00:31Z",     "to": "2016-05-30T09:00:31Z"   },   {     "from": "2016-06-01T09:00:31Z",     "to": "2016-06-10T09:00:31Z"   } ]
field			body	string	The field on which to compute the aggregation.
filter			body	string	FQL syntax formatted string to use to filter the results.
interval			body	string	Time interval for date histogram aggregations. Valid values include: year month week day hour minute
min_doc_count			body	integer	Only return buckets if values are greater than or equal to the value here.
missing			body	string	Missing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value.
name			body	string	Name of the aggregate query, as chosen by the user. Used to identify the results returned to you.
q			body	string	Full text search across all metadata fields.
ranges			body	list of dictionaries	Applies to range aggregations. Ranges values will depend on field. For example, if max_severity is used, ranges might look like: [   {     "From": 0,     "To": 70   },   {     "From": 70,     "To": 100   } ]
size			body	integer	The max number of term buckets to be returned.
sub_aggregates			body	list of dictionaries	A nested aggregation, such as: [   {     "name": "max_first_behavior",     "type": "max",     "field": "first_behavior"   } ] There is a maximum of 3 nested aggregations per request.
sort			body	string	FQL syntax string to sort bucket results. _count - sort by document count _term - sort by the string value alphabetically Supports asc and desc using | format. Example: _count|desc
time_zone			body	string	Time zone for bucket results.
type			body	string	Type of aggregation. Valid values include: date_histogram - Aggregates counts on a specified time interval. Requires use of “interval” field. date_range - Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601. terms - Buckets detections by the value of a specified field. For example, if field used is scenario, then detections will be bucketed by the various detection scenario names. range - Buckets detections by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the detects will be counted by the specified ranges of severity. cardinality - Returns the count of distinct values in a specified field. max - Returns the maximum value of a specified field. min - Returns the minimum value of a specified field. avg - Returns the average value of the specified field. sum - Returns the total sum of all values for the specified field. percentiles - Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.

Usage

Service class example (PEP8 syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.aggregate_detections(date_ranges=date_ranges,
                                       field="string",
                                       filter="string",
                                       interval="string",
                                       min_doc_count=integer,
                                       missing="string",
                                       name="string",
                                       q="string",
                                       ranges=ranges,
                                       size=integer,
                                       sort="string",
                                       time_zone="string",
                                       type="string"
                                       )
print(response)

Service class example (Operation ID syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.AggregateDetections(date_ranges=date_ranges,
                                      field="string",
                                      filter="string",
                                      interval="string",
                                      min_doc_count=integer,
                                      missing="string",
                                      name="string",
                                      q="string",
                                      ranges=ranges,
                                      size=integer,
                                      sort="string",
                                      time_zone="string",
                                      type="string"
                                      )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

BODY = [{
    "date_ranges": date_ranges,
    "field": "string",
    "filter": "string",
    "interval": "string",
    "min_doc_count": 0,
    "missing": "string",
    "name": "string",
    "q": "string",
    "ranges": ranges,
    "size": 0,
    "sort": "string",
    "sub_aggregates": [
        null
    ],
    "time_zone": "string",
    "type": "string"
}]

response = falcon.command("AggregateDetections", body=BODY)
print(response)

AggregateDeviceCountCollection

Retrieve aggregate host/devices count based on the matched filter

PEP8 method name

aggregate_device_count_collection

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
body			body	list of dictionaries	Full body payload in JSON format.
date_ranges			body	list of dictionaries	Applies to date_range aggregations. Example: [   {     "from": "2016-05-28T09:00:31Z",     "to": "2016-05-30T09:00:31Z"   },   {     "from": "2016-06-01T09:00:31Z",     "to": "2016-06-10T09:00:31Z"   } ]
field			body	string	The field on which to compute the aggregation.
filter			body	string	FQL syntax formatted string to use to filter the results.
interval			body	string	Time interval for date histogram aggregations. Valid values include: year month week day hour minute
min_doc_count			body	integer	Only return buckets if values are greater than or equal to the value here.
missing			body	string	Missing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value.
name			body	string	Name of the aggregate query, as chosen by the user. Used to identify the results returned to you.
q			body	string	Full text search across all metadata fields.
ranges			body	list of dictionaries	Applies to range aggregations. Ranges values will depend on field. For example, if max_severity is used, ranges might look like: [   {     "From": 0,     "To": 70   },   {     "From": 70,     "To": 100   } ]
size			body	integer	The max number of term buckets to be returned.
sub_aggregates			body	list of dictionaries	A nested aggregation, such as: [   {     "name": "max_first_behavior",     "type": "max",     "field": "first_behavior"   } ] There is a maximum of 3 nested aggregations per request.
sort			body	string	FQL syntax string to sort bucket results. _count - sort by document count _term - sort by the string value alphabetically Supports asc and desc using | format. Example: _count|desc
time_zone			body	string	Time zone for bucket results.
type			body	string	Type of aggregation. Valid values include: date_histogram - Aggregates counts on a specified time interval. Requires use of “interval” field. date_range - Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601. terms - Buckets detections by the value of a specified field. For example, if field used is scenario, then detections will be bucketed by the various detection scenario names. range - Buckets detections by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the detects will be counted by the specified ranges of severity. cardinality - Returns the count of distinct values in a specified field. max - Returns the maximum value of a specified field. min - Returns the minimum value of a specified field. avg - Returns the average value of the specified field. sum - Returns the total sum of all values for the specified field. percentiles - Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.

Usage

Service class example (PEP8 syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.aggregate_device_count_collection(date_ranges=date_ranges,
                                                    field="string",
                                                    filter="string",
                                                    interval="string",
                                                    min_doc_count=integer,
                                                    missing="string",
                                                    name="string",
                                                    q="string",
                                                    ranges=ranges,
                                                    size=integer,
                                                    sort="string",
                                                    time_zone="string",
                                                    type="string"
                                                    )
print(response)

Service class example (Operation ID syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.AggregateDeviceCountCollection(date_ranges=date_ranges,
                                                 field="string",
                                                 filter="string",
                                                 interval="string",
                                                 min_doc_count=integer,
                                                 missing="string",
                                                 name="string",
                                                 q="string",
                                                 ranges=ranges,
                                                 size=integer,
                                                 sort="string",
                                                 time_zone="string",
                                                 type="string"
                                                 )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

BODY = [{
    "date_ranges": date_ranges,
    "field": "string",
    "filter": "string",
    "interval": "string",
    "min_doc_count": 0,
    "missing": "string",
    "name": "string",
    "q": "string",
    "ranges": ranges,
    "size": 0,
    "sort": "string",
    "sub_aggregates": [
        null
    ],
    "time_zone": "string",
    "type": "string"
}]

response = falcon.command("AggregateDeviceCountCollection", body=BODY)
print(response)

AggregateEscalations

Retrieve aggregate escalation ticket values based on the matched filter

PEP8 method name

aggregate_escalations

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
body			body	list of dictionaries	Full body payload in JSON format.
date_ranges			body	list of dictionaries	Applies to date_range aggregations. Example: [   {     "from": "2016-05-28T09:00:31Z",     "to": "2016-05-30T09:00:31Z"   },   {     "from": "2016-06-01T09:00:31Z",     "to": "2016-06-10T09:00:31Z"   } ]
field			body	string	The field on which to compute the aggregation.
filter			body	string	FQL syntax formatted string to use to filter the results.
interval			body	string	Time interval for date histogram aggregations. Valid values include: year month week day hour minute
min_doc_count			body	integer	Only return buckets if values are greater than or equal to the value here.
missing			body	string	Missing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value.
name			body	string	Name of the aggregate query, as chosen by the user. Used to identify the results returned to you.
q			body	string	Full text search across all metadata fields.
ranges			body	list of dictionaries	Applies to range aggregations. Ranges values will depend on field. For example, if max_severity is used, ranges might look like: [   {     "From": 0,     "To": 70   },   {     "From": 70,     "To": 100   } ]
size			body	integer	The max number of term buckets to be returned.
sub_aggregates			body	list of dictionaries	A nested aggregation, such as: [   {     "name": "max_first_behavior",     "type": "max",     "field": "first_behavior"   } ] There is a maximum of 3 nested aggregations per request.
sort			body	string	FQL syntax string to sort bucket results. _count - sort by document count _term - sort by the string value alphabetically Supports asc and desc using | format. Example: _count|desc
time_zone			body	string	Time zone for bucket results.
type			body	string	Type of aggregation. Valid values include: date_histogram - Aggregates counts on a specified time interval. Requires use of “interval” field. date_range - Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601. terms - Buckets detections by the value of a specified field. For example, if field used is scenario, then detections will be bucketed by the various detection scenario names. range - Buckets detections by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the detects will be counted by the specified ranges of severity. cardinality - Returns the count of distinct values in a specified field. max - Returns the maximum value of a specified field. min - Returns the minimum value of a specified field. avg - Returns the average value of the specified field. sum - Returns the total sum of all values for the specified field. percentiles - Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.

Usage

Service class example (PEP8 syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.aggregate_escalations(date_ranges=date_ranges,
                                        field="string",
                                        filter="string",
                                        interval="string",
                                        min_doc_count=integer,
                                        missing="string",
                                        name="string",
                                        q="string",
                                        ranges=ranges,
                                        size=integer,
                                        sort="string",
                                        time_zone="string",
                                        type="string"
                                        )
print(response)

Service class example (Operation ID syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.AggregateEscalations(date_ranges=date_ranges,
                                       field="string",
                                       filter="string",
                                       interval="string",
                                       min_doc_count=integer,
                                       missing="string",
                                       name="string",
                                       q="string",
                                       ranges=ranges,
                                       size=integer,
                                       sort="string",
                                       time_zone="string",
                                       type="string"
                                       )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

BODY = [{
    "date_ranges": date_ranges,
    "field": "string",
    "filter": "string",
    "interval": "string",
    "min_doc_count": 0,
    "missing": "string",
    "name": "string",
    "q": "string",
    "ranges": ranges,
    "size": 0,
    "sort": "string",
    "sub_aggregates": [
        null
    ],
    "time_zone": "string",
    "type": "string"
}]

response = falcon.command("AggregateEscalations", body=BODY)
print(response)

AggregateFCIncidents

Retrieve aggregate incident values based on the matched filter

PEP8 method name

aggregate_fc_incidents

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
body			body	list of dictionaries	Full body payload in JSON format.
date_ranges			body	list of dictionaries	Applies to date_range aggregations. Example: [   {     "from": "2016-05-28T09:00:31Z",     "to": "2016-05-30T09:00:31Z"   },   {     "from": "2016-06-01T09:00:31Z",     "to": "2016-06-10T09:00:31Z"   } ]
field			body	string	The field on which to compute the aggregation.
filter			body	string	FQL syntax formatted string to use to filter the results.
interval			body	string	Time interval for date histogram aggregations. Valid values include: year month week day hour minute
min_doc_count			body	integer	Only return buckets if values are greater than or equal to the value here.
missing			body	string	Missing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value.
name			body	string	Name of the aggregate query, as chosen by the user. Used to identify the results returned to you.
q			body	string	Full text search across all metadata fields.
ranges			body	list of dictionaries	Applies to range aggregations. Ranges values will depend on field. For example, if max_severity is used, ranges might look like: [   {     "From": 0,     "To": 70   },   {     "From": 70,     "To": 100   } ]
size			body	integer	The max number of term buckets to be returned.
sub_aggregates			body	list of dictionaries	A nested aggregation, such as: [   {     "name": "max_first_behavior",     "type": "max",     "field": "first_behavior"   } ] There is a maximum of 3 nested aggregations per request.
sort			body	string	FQL syntax string to sort bucket results. _count - sort by document count _term - sort by the string value alphabetically Supports asc and desc using | format. Example: _count|desc
time_zone			body	string	Time zone for bucket results.
type			body	string	Type of aggregation. Valid values include: date_histogram - Aggregates counts on a specified time interval. Requires use of “interval” field. date_range - Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601. terms - Buckets detections by the value of a specified field. For example, if field used is scenario, then detections will be bucketed by the various detection scenario names. range - Buckets detections by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the detects will be counted by the specified ranges of severity. cardinality - Returns the count of distinct values in a specified field. max - Returns the maximum value of a specified field. min - Returns the minimum value of a specified field. avg - Returns the average value of the specified field. sum - Returns the total sum of all values for the specified field. percentiles - Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.

Usage

Service class example (PEP8 syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.aggregate_fc_incidents(date_ranges=date_ranges,
                                         field="string",
                                         filter="string",
                                         interval="string",
                                         min_doc_count=integer,
                                         missing="string",
                                         name="string",
                                         q="string",
                                         ranges=ranges,
                                         size=integer,
                                         sort="string",
                                         time_zone="string",
                                         type="string"
                                         )
print(response)

Service class example (Operation ID syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.AggregateFCIncidents(date_ranges=date_ranges,
                                       field="string",
                                       filter="string",
                                       interval="string",
                                       min_doc_count=integer,
                                       missing="string",
                                       name="string",
                                       q="string",
                                       ranges=ranges,
                                       size=integer,
                                       sort="string",
                                       time_zone="string",
                                       type="string"
                                       )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

BODY = [{
    "date_ranges": date_ranges,
    "field": "string",
    "filter": "string",
    "interval": "string",
    "min_doc_count": 0,
    "missing": "string",
    "name": "string",
    "q": "string",
    "ranges": ranges,
    "size": 0,
    "sort": "string",
    "sub_aggregates": [
        null
    ],
    "time_zone": "string",
    "type": "string"
}]

response = falcon.command("AggregateFCIncidents", body=BODY)
print(response)

AggregateRemediations

Retrieve aggregate remediation ticket values based on the matched filter

PEP8 method name

aggregate_remediations

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
body			body	list of dictionaries	Full body payload in JSON format.
date_ranges			body	list of dictionaries	Applies to date_range aggregations. Example: [   {     "from": "2016-05-28T09:00:31Z",     "to": "2016-05-30T09:00:31Z"   },   {     "from": "2016-06-01T09:00:31Z",     "to": "2016-06-10T09:00:31Z"   } ]
field			body	string	The field on which to compute the aggregation.
filter			body	string	FQL syntax formatted string to use to filter the results.
interval			body	string	Time interval for date histogram aggregations. Valid values include: year month week day hour minute
min_doc_count			body	integer	Only return buckets if values are greater than or equal to the value here.
missing			body	string	Missing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value.
name			body	string	Name of the aggregate query, as chosen by the user. Used to identify the results returned to you.
q			body	string	Full text search across all metadata fields.
ranges			body	list of dictionaries	Applies to range aggregations. Ranges values will depend on field. For example, if max_severity is used, ranges might look like: [   {     "From": 0,     "To": 70   },   {     "From": 70,     "To": 100   } ]
size			body	integer	The max number of term buckets to be returned.
sub_aggregates			body	list of dictionaries	A nested aggregation, such as: [   {     "name": "max_first_behavior",     "type": "max",     "field": "first_behavior"   } ] There is a maximum of 3 nested aggregations per request.
sort			body	string	FQL syntax string to sort bucket results. _count - sort by document count _term - sort by the string value alphabetically Supports asc and desc using | format. Example: _count|desc
time_zone			body	string	Time zone for bucket results.
type			body	string	Type of aggregation. Valid values include: date_histogram - Aggregates counts on a specified time interval. Requires use of “interval” field. date_range - Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601. terms - Buckets detections by the value of a specified field. For example, if field used is scenario, then detections will be bucketed by the various detection scenario names. range - Buckets detections by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the detects will be counted by the specified ranges of severity. cardinality - Returns the count of distinct values in a specified field. max - Returns the maximum value of a specified field. min - Returns the minimum value of a specified field. avg - Returns the average value of the specified field. sum - Returns the total sum of all values for the specified field. percentiles - Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.

Usage

Service class example (PEP8 syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.aggregate_remediations(date_ranges=date_ranges,
                                         field="string",
                                         filter="string",
                                         interval="string",
                                         min_doc_count=integer,
                                         missing="string",
                                         name="string",
                                         q="string",
                                         ranges=ranges,
                                         size=integer,
                                         sort="string",
                                         time_zone="string",
                                         type="string"
                                         )
print(response)

Service class example (Operation ID syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.AggregateRemediations(date_ranges=date_ranges,
                                        field="string",
                                        filter="string",
                                        interval="string",
                                        min_doc_count=integer,
                                        missing="string",
                                        name="string",
                                        q="string",
                                        ranges=ranges,
                                        size=integer,
                                        sort="string",
                                        time_zone="string",
                                        type="string"
                                        )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

BODY = [{
    "date_ranges": date_ranges,
    "field": "string",
    "filter": "string",
    "interval": "string",
    "min_doc_count": 0,
    "missing": "string",
    "name": "string",
    "q": "string",
    "ranges": ranges,
    "size": 0,
    "sort": "string",
    "sub_aggregates": [
        null
    ],
    "time_zone": "string",
    "type": "string"
}]

response = falcon.command("AggregateRemediations", body=BODY)
print(response)

QueryAllowListFilter

Retrieve allowlist tickets that match the provided filter criteria with scrolling enabled

PEP8 method name

query_allow_list_filter

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
filter			query	string	Optional filter and sort criteria in the form of an FQL query.
limit			query	integer	The maximum records to return. (Max: 500).
offset			query	integer	Starting index of overall result set from which to return ids.
parameters			query	dictionary	Full query string parameters payload in JSON format.
sort			query	string	The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc.

Usage

Service class example (PEP8 syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.query_allow_list_filter(limit=integer,
                                          sort="string",
                                          filter="string",
                                          offset="string"
                                          )
print(response)

Service class example (Operation ID syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.QueryAllowListFilter(limit=integer,
                                       sort="string",
                                       filter="string",
                                       offset="string"
                                       )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("QueryAllowListFilter",
                          limit=integer,
                          sort="string",
                          filter="string",
                          offset="string"
                          )
print(response)

QueryBlockListFilter

Retrieve block listtickets that match the provided filter criteria with scrolling enabled

PEP8 method name

query_block_list_filter

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
filter			query	string	Optional filter and sort criteria in the form of an FQL query.
limit			query	integer	The maximum records to return. (Max: 500).
offset			query	integer	Starting index of overall result set from which to return ids.
parameters			query	dictionary	Full query string parameters payload in JSON format.
sort			query	string	The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc.

Usage

Service class example (PEP8 syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.query_block_list_filter(limit=integer,
                                          sort="string",
                                          filter="string",
                                          offset="string"
                                          )
print(response)

Service class example (Operation ID syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.QueryBlockListFilter(limit=integer,
                                       sort="string",
                                       filter="string",
                                       offset="string"
                                       )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("QueryBlockListFilter",
                          limit=integer,
                          sort="string",
                          filter="string",
                          offset="string"
                          )
print(response)

QueryDetectionIdsByFilter

Retrieve DetectionsIds that match the provided FQL filter, criteria with scrolling enabled

PEP8 method name

query_detection_ids_by_filter

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
filter			query	string	Optional filter and sort criteria in the form of an FQL query.
limit			query	integer	The maximum records to return. (Max: 500).
offset			query	integer	Starting index of overall result set from which to return ids.
parameters			query	dictionary	Full query string parameters payload in JSON format.
sort			query	string	The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc.

Usage

Service class example (PEP8 syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.query_detection_ids_by_filter(limit=integer,
                                                sort="string",
                                                filter="string",
                                                offset="string"
                                                )
print(response)

Service class example (Operation ID syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.QueryDetectionIdsByFilter(limit=integer,
                                            sort="string",
                                            filter="string",
                                            offset="string"
                                            )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("QueryDetectionIdsByFilter",
                          limit=integer,
                          sort="string",
                          filter="string",
                          offset="string"
                          )
print(response)

GetDeviceCountCollectionQueriesByFilter

Retrieve device count collection Ids that match the provided FQL filter, criteria with scrolling enabled

PEP8 method name

get_device_count_collection_queries_by_filter

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
filter			query	string	Optional filter and sort criteria in the form of an FQL query.
limit			query	integer	The maximum records to return. (Max: 500).
offset			query	integer	Starting index of overall result set from which to return ids.
parameters			query	dictionary	Full query string parameters payload in JSON format.
sort			query	string	The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc.

Usage

Service class example (PEP8 syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.get_device_count_collection_queries_by_filter(limit=integer,
                                                                sort="string",
                                                                filter="string",
                                                                offset="string"
                                                                )
print(response)

Service class example (Operation ID syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.GetDeviceCountCollectionQueriesByFilter(limit=integer,
                                                          sort="string",
                                                          filter="string",
                                                          offset="string"
                                                          )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("GetDeviceCountCollectionQueriesByFilter",
                          limit=integer,
                          sort="string",
                          filter="string",
                          offset="string"
                          )
print(response)

QueryEscalationsFilter

Retrieve escalation tickets that match the provided filter criteria with scrolling enabled

PEP8 method name

query_escalations_filter

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
filter			query	string	Optional filter and sort criteria in the form of an FQL query.
limit			query	integer	The maximum records to return. (Max: 500).
offset			query	integer	Starting index of overall result set from which to return ids.
parameters			query	dictionary	Full query string parameters payload in JSON format.
sort			query	string	The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc.

Usage

Service class example (PEP8 syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.query_escalations_filter(limit=integer,
                                           sort="string",
                                           filter="string",
                                           offset="string"
                                           )
print(response)

Service class example (Operation ID syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.QueryEscalationsFilter(limit=integer,
                                         sort="string",
                                         filter="string",
                                         offset="string"
                                         )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("QueryEscalationsFilter",
                          limit=integer,
                          sort="string",
                          filter="string",
                          offset="string"
                          )
print(response)

QueryIncidentIdsByFilter

Retrieve incidents that match the provided filter criteria with scrolling enabled

PEP8 method name

query_incident_ids_by_filter

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
filter			query	string	Optional filter and sort criteria in the form of an FQL query.
limit			query	integer	The maximum records to return. (Max: 500).
offset			query	integer	Starting index of overall result set from which to return ids.
parameters			query	dictionary	Full query string parameters payload in JSON format.
sort			query	string	The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc.

Usage

Service class example (PEP8 syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.query_incident_ids_by_filter(limit=integer,
                                               sort="string",
                                               filter="string",
                                               offset="string"
                                               )
print(response)

Service class example (Operation ID syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.QueryIncidentIdsByFilter(limit=integer,
                                           sort="string",
                                           filter="string",
                                           offset="string"
                                           )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("QueryIncidentIdsByFilter",
                          limit=integer,
                          sort="string",
                          filter="string",
                          offset="string"
                          )
print(response)

QueryRemediationsFilter

Retrieve remediation tickets that match the provided filter criteria with scrolling enabled

PEP8 method name

query_remediations_filter

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
filter			query	string	Optional filter and sort criteria in the form of an FQL query.
limit			query	integer	The maximum records to return. (Max: 500).
offset			query	integer	Starting index of overall result set from which to return ids.
parameters			query	dictionary	Full query string parameters payload in JSON format.
sort			query	string	The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc.

Usage

Service class example (PEP8 syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.query_remediations_filter(limit=integer,
                                            sort="string",
                                            filter="string",
                                            offset="string"
                                            )
print(response)

Service class example (Operation ID syntax)

from falconpy import CompleteDashboard

# Do not hardcode API credentials!
falcon = CompleteDashboard(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.QueryRemediationsFilter(limit=integer,
                                          sort="string",
                                          filter="string",
                                          offset="string"
                                          )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("QueryRemediationsFilter",
                          limit=integer,
                          sort="string",
                          filter="string",
                          offset="string"
                          )
print(response)