Promote Sign in Sign up

Repository

crimson-falcon

A Shiny Ruby SDK of our Falcon API

CrowdStrike
Repository

README

Crimson Falcon - The CrowdStrike Falcon SDK for Ruby

Gem Version

Welcome to Crimson Falcon, the Ruby SDK for the CrowdStrike Falcon Platform. This is where the power of the CrowdStrike Falcon Platform meets the elegance and simplicity of Ruby.

"Why Ruby?" you might ask.

Well, Ruby is a dynamic, open source programming language with a focus on simplicity and productivity. It has an elegant syntax that is natural to read and easy to write. It's unique balance of simplicity, productivity, and just sheer fun, makes coding feel less like a task and more like a hobby. It's like your favorite pair of comfy shoes - familiar, comfortable, and always reliable. :wink:

That's what we aim to achieve with Crimson Falcon - a tool that brings together the robust capabilities of CrowdStrike Falcon with the friendly charm of Ruby.

Ready to bring some fun to your cybersecurity game with Ruby and Crimson Falcon? Let's jump right in!

Installation

From RubyGems (This is the way)

To install from RubyGems, use the following command:

gem install crimson-falcon

Add this to the Gemfile:

    gem 'crimson-falcon', '~> 1.2.0'

From Source to Gem: Building the Ruby Code

To build the Ruby code into a gem:

gem build crimson-falcon.gemspec

Then install the gem locally:

gem install ./crimson-falcon-1.2.0.gem

Finally, add this to the Gemfile:

    gem 'crimson-falcon', '~> 1.2.0'

Install from Git

If the Ruby gem is hosted at a git repository: https://github.com/GIT_USER_ID/GIT_REPO_ID, then add the following in the Gemfile:

    # Example
    gem 'crimson-falcon', :git => 'https://github.com/CrowdStrike/crimson-falcon.git'

Getting Started

Samples

We have a collection of sample code that demonstrates how to use the Crimson Falcon SDK.
These samples are a great way to get started with the SDK. You can find the samples in the samples directory.

Take Flight

Eager to take flight? Follow the installation process, and then launch into the following code:

# Load the gem
require 'crimson-falcon'

# Setup authorization
Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = "us-2" # or "us-2", "eu-1", "us-gov1"
end

# Create a new API instance
api_instance = Falcon::SensorDownload.new

begin
  # Get CCID to use with sensor installers
  result = api_instance.get_sensor_installers_ccidby_query
  p result.resources
rescue Falcon::ApiError => e
  puts "Error when calling SensorDownload->get_sensor_installers_ccidby_query: #{e}"
end

Welcome aboard the Crimson Falcon! Fly high, code with grace.

Contribute to Crimson Falcon

We are always excited to have contributions from the community! It's what makes open source truly powerful. If you are looking to help out, that's awesome and we thank you in advance.

To get started, please read our Contributing Guide that explains the development process, the project structure, how to propose bugfixes and improvements, and how to build and test your changes to the project. It's a set of directions that will help establish a baseline of expectation for any contributions.

Please make sure you also follow our Code of Conduct. It outlines our expectations for participant behavior as well as the steps for reporting unacceptable behavior.

We appreciate your interest in our project and look forward to collaborating with you!

Crimson Falcon API Docs

:recycle: API Docs are automatically generated from the CrowdStrike API specification. :recycle:

Class: Falcon::ASPM

  • Operation: create_executor_node
  • POST: /aspm-api-gateway/api/v1/executor_nodes
  • Description: Create a new relay node

Class: Falcon::ASPM

  • Operation: create_integration
  • POST: /aspm-api-gateway/api/v1/integrations
  • Description: Create a new integration

Class: Falcon::ASPM

  • Operation: create_integration_task
  • POST: /aspm-api-gateway/api/v1/integration_tasks
  • Description: Create new integration task.

Class: Falcon::ASPM

  • Operation: delete_executor_node
  • DELETE: /aspm-api-gateway/api/v1/executor_nodes/{ID}
  • Description: Delete a relay node

Class: Falcon::ASPM

Class: Falcon::ASPM

  • Operation: delete_integration
  • DELETE: /aspm-api-gateway/api/v1/integrations/{ID}
  • Description: Delete an existing integration by its ID

Class: Falcon::ASPM

  • Operation: delete_integration_task
  • DELETE: /aspm-api-gateway/api/v1/integration_tasks/{ID}
  • Description: Delete an existing integration task by its ID

Class: Falcon::ASPM

  • Operation: delete_tags
  • POST: /aspm-api-gateway/api/v1/tags
  • Description: Remove existing tags

Class: Falcon::ASPM

  • Operation: execute_function_data
  • GET: /application-security/combined/function-data/v1
  • Description: A selected list of queryLanguage queries. request & response are in MSA format

Class: Falcon::ASPM

  • Operation: execute_function_data_count
  • POST: /application-security/aggregates/function-data/count/v1
  • Description: A selected list of queryLanguage count queries. request & response are in MSA format

Class: Falcon::ASPM

  • Operation: execute_function_data_query
  • GET: /application-security/combined/query-function-data/v1
  • Description: A selected list of queryLanguage queries. request & response are in MSA format

Class: Falcon::ASPM

  • Operation: execute_function_data_query_count
  • GET: /application-security/aggregates/query-function-data-count/v1
  • Description: A selected list of queryLanguage count queries. request & response are in MSA format

Class: Falcon::ASPM

  • Operation: execute_functions
  • GET: /application-security/combined/functions/v1
  • Description: A selected list of queryLanguage services queries. request & response are in MSA format

Class: Falcon::ASPM

  • Operation: execute_functions_count
  • POST: /application-security/aggregates/functions/count/v1
  • Description: A selected list of queryLanguage count queries. request & response are in MSA format

Class: Falcon::ASPM

  • Operation: execute_functions_overtime
  • GET: /application-security/combined/functions-overtime/v1
  • Description: A selected list of queryLanguage overtime queries. request & response are in MSA format

Class: Falcon::ASPM

  • Operation: execute_functions_query
  • GET: /application-security/combined/query-functions/v1
  • Description: A selected list of queryLanguage services queries. request & response are in MSA format

Class: Falcon::ASPM

  • Operation: execute_functions_query_count
  • GET: /application-security/aggregates/query-functions-count/v1
  • Description: A selected list of queryLanguage count queries. request & response are in MSA format

Class: Falcon::ASPM

  • Operation: execute_functions_query_overtime
  • GET: /application-security/combined/query-functions-overtime/v1
  • Description: A selected list of queryLanguage overtime queries. request & response are in MSA format

Class: Falcon::ASPM

  • Operation: execute_query
  • POST: /aspm-api-gateway/api/v1/query
  • Description: Execute a query. The syntax used is identical to that of the query page.

Class: Falcon::ASPM

Class: Falcon::ASPM

  • Operation: get_cspm_inventory_ba_services
  • GET: /application-security/combined/cspm-inventory-ba-services/v1
  • Description: Gets services ordered by risk score for given BA

Class: Falcon::ASPM

  • Operation: get_cspm_inventory_service_details
  • GET: /application-security/combined/cspm-inventory-service-data/v1
  • Description: Gets all service details for CSPM Inventory.

Class: Falcon::ASPM

  • Operation: get_executor_nodes
  • GET: /aspm-api-gateway/api/v1/executor_nodes
  • Description: Get all the relay nodes

Class: Falcon::ASPM

Class: Falcon::ASPM

  • Operation: get_executor_nodes_metadata
  • GET: /aspm-api-gateway/api/v1/executor_nodes/metadata
  • Description: Get metadata about all executor nodes

Class: Falcon::ASPM

  • Operation: get_group_id_09_v2
  • GET: /aspm-api-gateway/api/v1/group/{ID}/v2
  • Description: Get group details

Class: Falcon::ASPM

  • Operation: get_groups_hier_v2
  • GET: /aspm-api-gateway/api/v1/groups/hier/v2
  • Description: Get group hierarchy

Class: Falcon::ASPM

Class: Falcon::ASPM

  • Operation: get_integration_tasks
  • GET: /aspm-api-gateway/api/v1/integration_tasks
  • Description: Get all the integration tasks

Class: Falcon::ASPM

  • Operation: get_integration_tasks_admin
  • GET: /aspm-api-gateway/api/v1/integration_tasks/admin
  • Description: Get all the integration tasks, requires admin scope

Class: Falcon::ASPM

  • Operation: get_integration_tasks_metadata
  • GET: /aspm-api-gateway/api/v1/integration_tasks/metadata
  • Description: Get metadata about all integration tasks

Class: Falcon::ASPM

  • Operation: get_integration_tasks_v2
  • GET: /aspm-api-gateway/api/v1/integration_tasks/v2
  • Description: Get all the integration tasks

Class: Falcon::ASPM

  • Operation: get_integration_types
  • GET: /aspm-api-gateway/api/v1/integration_types
  • Description: Get all the integration types

Class: Falcon::ASPM

  • Operation: get_integrations
  • GET: /aspm-api-gateway/api/v1/integrations
  • Description: Get a list of all the integrations

Class: Falcon::ASPM

  • Operation: get_integrations_v2
  • GET: /aspm-api-gateway/api/v1/integrations/v2
  • Description: Get a list of all the integrations

Class: Falcon::ASPM

Class: Falcon::ASPM

  • Operation: get_service_violation_types
  • GET: /aspm-api-gateway/api/v1/services/violations/types
  • Description: Get the different types of violation

Class: Falcon::ASPM

  • Operation: get_services_count
  • POST: /aspm-api-gateway/api/v1/services/count
  • Description: Get the total amount of existing services

Class: Falcon::ASPM

  • Operation: get_tags
  • GET: /aspm-api-gateway/api/v1/tags
  • Description: Get all the tags

Class: Falcon::ASPM

  • Operation: get_users_v2
  • GET: /aspm-api-gateway/api/v1/users/v2
  • Description: List users

Class: Falcon::ASPM

Class: Falcon::ASPM

  • Operation: post_group_id_09_v2
  • POST: /aspm-api-gateway/api/v1/group/{ID}/v2
  • Description: Update group

Class: Falcon::ASPM

  • Operation: post_group_v2
  • POST: /aspm-api-gateway/api/v1/group/v2
  • Description: Create group

Class: Falcon::ASPM

  • Operation: run_integration_task
  • POST: /aspm-api-gateway/api/v1/integration_tasks/{ID}/run
  • Description: Run an integration task by its ID

Class: Falcon::ASPM

  • Operation: run_integration_task_admin
  • POST: /aspm-api-gateway/api/v1/integration_tasks/{ID}/run/admin
  • Description: Run an integration task by its ID - for admin scope

Class: Falcon::ASPM

  • Operation: run_integration_task_v2
  • POST: /aspm-api-gateway/api/v1/integration_tasks/{ID}/run/v2
  • Description: Run an integration task by its ID

Class: Falcon::ASPM

Class: Falcon::ASPM

Class: Falcon::ASPM

Class: Falcon::ASPM

  • Operation: update_executor_node
  • PUT: /aspm-api-gateway/api/v1/executor_nodes
  • Description: Update an existing relay node

Class: Falcon::ASPM

  • Operation: update_integration
  • PUT: /aspm-api-gateway/api/v1/integrations/{ID}
  • Description: Update an existing integration by its ID

Class: Falcon::ASPM

  • Operation: update_integration_task
  • PUT: /aspm-api-gateway/api/v1/integration_tasks/{ID}
  • Description: Update an existing integration task by its ID

Class: Falcon::ASPM

  • Operation: upsert_business_applications
  • PUT: /aspm-api-gateway/api/v1/business_applications
  • Description: Create or Update Business Applications

Class: Falcon::ASPM

  • Operation: upsert_tags
  • PUT: /aspm-api-gateway/api/v1/tags
  • Description: Create new or update existing tag. You can update unique tags table or regular tags table

Class: Falcon::ActivityMonitor

Class: Falcon::Alerts

  • Operation: get_alerts_v3
  • GET: /saas-security/entities/alerts/v3
  • Description: GET Alert by ID or GET Alerts

Class: Falcon::Alerts

  • Operation: get_queries_alerts_v1
  • GET: /alerts/queries/alerts/v1
  • Description: Deprecated: please use version v2 of this endpoint. Retrieves all Alerts ids that match a given query.

Class: Falcon::Alerts

  • Operation: get_queries_alerts_v2
  • GET: /alerts/queries/alerts/v2
  • Description: Retrieves all Alerts ids that match a given query.

Class: Falcon::Alerts

  • Operation: patch_entities_alerts_v2
  • PATCH: /alerts/entities/alerts/v2
  • Description: Deprecated: Please use version v3 of this endpoint. Perform actions on Alerts identified by composite ID(s) in request. Each action has a name and a description which describes what the action does. If a request adds and removes tag in a single request, the order of processing would be to remove tags before adding new ones in.

Class: Falcon::Alerts

  • Operation: patch_entities_alerts_v3
  • PATCH: /alerts/entities/alerts/v3
  • Description: Perform actions on Alerts identified by composite ID(s) in request. Each action has a name and a description which describes what the action does. If a request adds and removes tag in a single request, the order of processing would be to remove tags before adding new ones in.

Class: Falcon::Alerts

  • Operation: post_aggregates_alerts_v1
  • POST: /alerts/aggregates/alerts/v1
  • Description: Deprecated: Please use version v2 of this endpoint. Retrieves aggregate values for Alerts across all CIDs.

Class: Falcon::Alerts

  • Operation: post_aggregates_alerts_v2
  • POST: /alerts/aggregates/alerts/v2
  • Description: Retrieves aggregate values for Alerts across all CIDs.

Class: Falcon::Alerts

  • Operation: post_combined_alerts_v1
  • POST: /alerts/combined/alerts/v1
  • Description: Retrieves all Alerts that match a particular FQL filter. This API is intended for retrieval of large amounts of Alerts(>10k) using a pagination based on a `after` token. If you need to use `offset` pagination, consider using GET /alerts/queries/alerts/and POST /alerts/entities/alerts/ APIs.

Class: Falcon::Alerts

  • Operation: post_entities_alerts_v1
  • POST: /alerts/entities/alerts/v1
  • Description: Deprecated: please use version v2 of this endpoint. Retrieves all Alerts given their ids.

Class: Falcon::Alerts

  • Operation: post_entities_alerts_v2
  • POST: /alerts/entities/alerts/v2
  • Description: Retrieves all Alerts given their composite ids.

Class: Falcon::ApiIntegrations

  • Operation: execute_command
  • POST: /plugins/entities/execute/v1
  • Description: Execute a command.

Class: Falcon::ApiIntegrations

  • Operation: execute_command_proxy
  • POST: /plugins/entities/execute-proxy/v1
  • Description: Execute a command and proxy the response directly.

Class: Falcon::ApiIntegrations

  • Operation: get_combined_plugin_configs
  • GET: /plugins/combined/configs/v1
  • Description: Queries for config resources and returns details

Class: Falcon::CaoHunting

Class: Falcon::CaoHunting

  • Operation: get_archive_export
  • GET: /hunting/entities/archive-exports/v1
  • Description: Creates an Archive Export

Class: Falcon::CaoHunting

  • Operation: get_intelligence_queries
  • GET: /hunting/entities/intelligence-queries/v1
  • Description: Retrieves a list of Intelligence queries

Class: Falcon::CaoHunting

  • Operation: search_intelligence_queries
  • GET: /hunting/queries/intelligence-queries/v1
  • Description: Search intelligence queries that match the provided conditions

Class: Falcon::CertificateBasedExclusions

  • Operation: cb_exclusions_create_v1
  • POST: /exclusions/entities/cert-based-exclusions/v1
  • Description: Create new Certificate Based Exclusions.

Class: Falcon::CertificateBasedExclusions

  • Operation: cb_exclusions_delete_v1
  • DELETE: /exclusions/entities/cert-based-exclusions/v1
  • Description: Delete the exclusions by id

Class: Falcon::CertificateBasedExclusions

  • Operation: cb_exclusions_get_v1
  • GET: /exclusions/entities/cert-based-exclusions/v1
  • Description: Find all exclusion IDs matching the query with filter

Class: Falcon::CertificateBasedExclusions

  • Operation: cb_exclusions_query_v1
  • GET: /exclusions/queries/cert-based-exclusions/v1
  • Description: Search for cert-based exclusions.

Class: Falcon::CertificateBasedExclusions

  • Operation: cb_exclusions_update_v1
  • PATCH: /exclusions/entities/cert-based-exclusions/v1
  • Description: Updates existing Certificate Based Exclusions

Class: Falcon::CertificateBasedExclusions

  • Operation: certificates_get_v1
  • GET: /exclusions/entities/certificates/v1
  • Description: Retrieves certificate signing information for a file

Class: Falcon::CloudAwsRegistration

Class: Falcon::CloudAwsRegistration

  • Operation: cloud_registration_aws_delete_account
  • DELETE: /cloud-security-registration-aws/entities/account/v1
  • Description: Deletes an existing AWS account or organization in our system.

Class: Falcon::CloudAwsRegistration

Class: Falcon::CloudAwsRegistration

Class: Falcon::CloudAwsRegistration

Class: Falcon::CloudAzureRegistration

Class: Falcon::CloudAzureRegistration

Class: Falcon::CloudAzureRegistration

Class: Falcon::CloudAzureRegistration

Class: Falcon::CloudAzureRegistration

Class: Falcon::CloudAzureRegistration

  • Operation: download_azure_script
  • GET: /cloud-security-registration-azure/entities/scripts/v1
  • Description: Download Azure deployment script (Terraform or Bicep)

Class: Falcon::CloudConnectAws

  • Operation: create_or_update_aws_settings
  • POST: /cloud-connect-aws/entities/settings/v1
  • Description: Create or update Global Settings which are applicable to all provisioned AWS accounts

Class: Falcon::CloudConnectAws

  • Operation: delete_aws_accounts
  • DELETE: /cloud-connect-aws/entities/accounts/v1
  • Description: Delete a set of AWS Accounts by specifying their IDs

Class: Falcon::CloudConnectAws

  • Operation: get_aws_accounts
  • GET: /cloud-connect-aws/entities/accounts/v1
  • Description: Retrieve a set of AWS Accounts by specifying their IDs

Class: Falcon::CloudConnectAws

  • Operation: get_aws_settings
  • GET: /cloud-connect-aws/combined/settings/v1
  • Description: Retrieve a set of Global Settings which are applicable to all provisioned AWS accounts

Class: Falcon::CloudConnectAws

  • Operation: provision_aws_accounts
  • POST: /cloud-connect-aws/entities/accounts/v1
  • Description: Provision AWS Accounts by specifying details about the accounts to provision

Class: Falcon::CloudConnectAws

  • Operation: query_aws_accounts
  • GET: /cloud-connect-aws/combined/accounts/v1
  • Description: Search for provisioned AWS Accounts by providing an FQL filter and paging details. Returns a set of AWS accounts which match the filter criteria

Class: Falcon::CloudConnectAws

  • Operation: query_aws_accounts_for_ids
  • GET: /cloud-connect-aws/queries/accounts/v1
  • Description: Search for provisioned AWS Accounts by providing an FQL filter and paging details. Returns a set of AWS account IDs which match the filter criteria

Class: Falcon::CloudConnectAws

  • Operation: update_aws_accounts
  • PATCH: /cloud-connect-aws/entities/accounts/v1
  • Description: Update AWS Accounts by specifying the ID of the account and details to update

Class: Falcon::CloudConnectAws

  • Operation: verify_aws_account_access
  • POST: /cloud-connect-aws/entities/verify-account-access/v1
  • Description: Performs an Access Verification check on the specified AWS Account IDs

Class: Falcon::CloudOciRegistration

Class: Falcon::CloudOciRegistration

Class: Falcon::CloudOciRegistration

Class: Falcon::CloudOciRegistration

  • Operation: cloud_security_registration_oci_get_account
  • GET: /cloud-security-registration-oci/combined/accounts/v1
  • Description: Retrieve a list of OCI tenancies with support for FQL filtering, sorting, and pagination

Class: Falcon::CloudOciRegistration

Class: Falcon::CloudOciRegistration

Class: Falcon::CloudOciRegistration

Class: Falcon::CloudSecurityAssets

  • Operation: cloud_security_assets_combined_compliance_by_account
  • GET: /cloud-security-assets/combined/compliance-controls/by-account-region-and-resource-type/v1
  • Description: Gets combined compliance data aggregated by account and region. Results can be filtered and sorted.

Class: Falcon::CloudSecurityAssets

  • Operation: cloud_security_assets_entities_get
  • GET: /cloud-security-assets/entities/resources/v1
  • Description: Gets raw resources based on the provided IDs param. Maximum of 100 resources can be requested with this method. Use POST method with same path if more are required.

Class: Falcon::CloudSecurityAssets

  • Operation: cloud_security_assets_queries
  • GET: /cloud-security-assets/queries/resources/v1
  • Description: Gets a list of resource IDs for the given parameters, filters and sort criteria

Class: Falcon::CloudSnapshots

  • Operation: create_deployment_entity
  • POST: /snapshots/entities/deployments/v1
  • Description: Launch a snapshot scan for a given cloud asset

Class: Falcon::CloudSnapshots

Class: Falcon::CloudSnapshots

  • Operation: get_scan_report
  • GET: /snapshots/entities/scanreports/v1
  • Description: retrieve the scan report for an instance

Class: Falcon::CloudSnapshots

  • Operation: read_deployments_combined
  • GET: /snapshots/combined/deployments/v1
  • Description: Retrieve snapshot jobs identified by the provided IDs

Class: Falcon::CloudSnapshots

  • Operation: read_deployments_entities
  • GET: /snapshots/entities/deployments/v1
  • Description: Retrieve snapshot jobs identified by the provided IDs

Class: Falcon::CloudSnapshots

Class: Falcon::ConfigurationAssessment

  • Operation: get_combined_assessments_query
  • GET: /configuration-assessment/combined/assessments/v1
  • Description: Search for assessments in your environment by providing an FQL filter and paging details. Returns a set of HostFinding entities which match the filter criteria

Class: Falcon::ConfigurationAssessment

  • Operation: get_rule_details
  • GET: /configuration-assessment/entities/rule-details/v1
  • Description: Get rules details for provided one or more rule IDs

Class: Falcon::ConfigurationAssessmentEvaluationLogic

  • Operation: get_evaluation_logic_mixin0
  • GET: /configuration-assessment/entities/evaluation-logic/v1
  • Description: Get details on evaluation logic items by providing one or more finding IDs.

Class: Falcon::ContainerAlerts

  • Operation: read_container_alerts_count
  • GET: /container-security/aggregates/container-alerts/count/v1
  • Description: Search Container Alerts by the provided search criteria

Class: Falcon::ContainerAlerts

Class: Falcon::ContainerAlerts

Class: Falcon::ContainerDetections

  • Operation: read_combined_detections
  • GET: /container-security/combined/detections/v1
  • Description: Maximum offset = 10000 - limit

Class: Falcon::ContainerDetections

  • Operation: read_detections
  • GET: /container-security/entities/detections/v1
  • Description: Maximum offset = 10000 - limit

Class: Falcon::ContainerDetections

  • Operation: read_detections_count
  • GET: /container-security/aggregates/detections/count/v1
  • Description: Aggregate count of detections

Class: Falcon::ContainerDetections

  • Operation: read_detections_count_by_severity
  • GET: /container-security/aggregates/detections/count-by-severity/v1
  • Description: Aggregate counts of detections by severity

Class: Falcon::ContainerDetections

  • Operation: read_detections_count_by_type
  • GET: /container-security/aggregates/detections/count-by-type/v1
  • Description: Aggregate counts of detections by detection type

Class: Falcon::ContainerDetections

  • Operation: search_detections
  • GET: /container-security/queries/detections/v1
  • Description: Maximum offset = 10000 - limit

Class: Falcon::ContainerImageCompliance

Class: Falcon::ContainerImageCompliance

Class: Falcon::ContainerImageCompliance

Class: Falcon::ContainerImageCompliance

Class: Falcon::ContainerImageCompliance

Class: Falcon::ContainerImageCompliance

  • Operation: ext_aggregate_failed_rules_by_clusters
  • GET: /container-compliance/aggregates/failed-rules-by-clusters/v2
  • Description: get the failed rules for each cluster grouped into severity levels

Class: Falcon::ContainerImageCompliance

  • Operation: ext_aggregate_failed_rules_by_images
  • GET: /container-compliance/aggregates/failed-rules-by-images/v2
  • Description: get images with failed rules, rule count grouped by severity for each image

Class: Falcon::ContainerImageCompliance

Class: Falcon::ContainerImageCompliance

Class: Falcon::ContainerImageCompliance

Class: Falcon::ContainerImageCompliance

  • Operation: ext_aggregate_rules_by_status
  • GET: /container-compliance/aggregates/rules-by-status/v2
  • Description: get the rules grouped by their statuses

Class: Falcon::ContainerImages

Class: Falcon::ContainerImages

  • Operation: aggregate_image_count
  • GET: /container-security/aggregates/images/count/v1
  • Description: Aggregate count of images

Class: Falcon::ContainerImages

  • Operation: aggregate_image_count_by_base_os
  • GET: /container-security/aggregates/images/count-by-os-distribution/v1
  • Description: Aggregate count of images grouped by Base OS distribution

Class: Falcon::ContainerImages

  • Operation: aggregate_image_count_by_state
  • GET: /container-security/aggregates/images/count-by-state/v1
  • Description: Aggregate count of images grouped by state

Class: Falcon::ContainerImages

  • Operation: combined_base_images
  • GET: /container-security/combined/base-images/v1
  • Description: Retrieves a list of base images for the provided filter. Maximum page size: 100

Class: Falcon::ContainerImages

Class: Falcon::ContainerImages

  • Operation: combined_image_detail
  • GET: /container-security/combined/images/detail/v1
  • Description: Maximum offset = 10000 - limit

Class: Falcon::ContainerImages

  • Operation: combined_image_issues_summary
  • GET: /container-security/combined/images/issues-summary/v1
  • Description: Retrieve image issues summary such as Image detections, Runtime detections, Policies, vulnerabilities

Class: Falcon::ContainerImages

  • Operation: combined_image_vulnerability_summary
  • GET: /container-security/combined/images/vulnerabilities-summary/v1
  • Description: aggregates information about vulnerabilities for an image

Class: Falcon::ContainerImages

  • Operation: create_base_images_entities
  • POST: /container-security/entities/base-images/v1
  • Description: Creates base images using the provided details

Class: Falcon::ContainerImages

  • Operation: delete_base_images
  • DELETE: /container-security/entities/base-images/v1
  • Description: Delete base images by base image uuid

Class: Falcon::ContainerImages

  • Operation: get_combined_images
  • GET: /container-security/combined/image-assessment/images/v1
  • Description: Maximum offset = 10000 - limit

Class: Falcon::ContainerImages

  • Operation: read_combined_images_export
  • GET: /container-security/combined/images/export/v1
  • Description: Maximum offset = 10000 - limit

Class: Falcon::ContainerPackages

  • Operation: read_packages_by_fixable_vuln_count
  • GET: /container-security/combined/packages/app-by-fixable-vulnerability-count/v1
  • Description: Maximum offset = 10000 - limit

Class: Falcon::ContainerPackages

  • Operation: read_packages_by_image_count
  • GET: /container-security/aggregates/packages/by-image-count/v1
  • Description: Retrieves the N most frequently used packages across images

Class: Falcon::ContainerPackages

  • Operation: read_packages_by_vuln_count
  • GET: /container-security/combined/packages/by-vulnerability-count/v1
  • Description: Maximum offset = 10000 - limit

Class: Falcon::ContainerPackages

  • Operation: read_packages_combined
  • GET: /container-security/combined/packages/v1
  • Description: Maximum offset = 10000 - limit

Class: Falcon::ContainerPackages

Class: Falcon::ContainerPackages

  • Operation: read_packages_combined_v2
  • GET: /container-security/combined/packages/v2
  • Description: Maximum offset = 10000 - limit

Class: Falcon::ContainerPackages

  • Operation: read_packages_count_by_zero_day
  • GET: /container-security/aggregates/packages/count-by-zero-day/v1
  • Description: Retrieve packages count affected by zero day vulnerabilities

Class: Falcon::ContainerVulnerabilities

Class: Falcon::ContainerVulnerabilities

Class: Falcon::ContainerVulnerabilities

Class: Falcon::ContainerVulnerabilities

Class: Falcon::ContainerVulnerabilities

Class: Falcon::ContainerVulnerabilities

  • Operation: read_vulnerability_count
  • GET: /container-security/aggregates/vulnerabilities/count/v1
  • Description: Maximum offset = 10000 - limit

Class: Falcon::ContainerVulnerabilities

Class: Falcon::ContainerVulnerabilities

Class: Falcon::ContainerVulnerabilities

Class: Falcon::ContainerVulnerabilities

Class: Falcon::ContentUpdatePolicies

  • Operation: create_content_update_policies
  • POST: /policy/entities/content-update/v1
  • Description: Create Content Update Policies by specifying details about the policy to create

Class: Falcon::ContentUpdatePolicies

  • Operation: delete_content_update_policies
  • DELETE: /policy/entities/content-update/v1
  • Description: Delete a set of Content Update Policies by specifying their IDs

Class: Falcon::ContentUpdatePolicies

  • Operation: get_content_update_policies
  • GET: /policy/entities/content-update/v1
  • Description: Retrieve a set of Content Update Policies by specifying their IDs

Class: Falcon::ContentUpdatePolicies

  • Operation: perform_content_update_policies_action
  • POST: /policy/entities/content-update-actions/v1
  • Description: Perform the specified action on the Content Update Policies specified in the request

Class: Falcon::ContentUpdatePolicies

  • Operation: query_combined_content_update_policies
  • GET: /policy/combined/content-update/v1
  • Description: Search for Content Update Policies in your environment by providing an FQL filter and paging details. Returns a set of Content Update Policies which match the filter criteria

Class: Falcon::ContentUpdatePolicies

  • Operation: query_combined_content_update_policy_members
  • GET: /policy/combined/content-update-members/v1
  • Description: Search for members of a Content Update Policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria

Class: Falcon::ContentUpdatePolicies

  • Operation: query_content_update_policies
  • GET: /policy/queries/content-update/v1
  • Description: Search for Content Update Policies in your environment by providing an FQL filter and paging details. Returns a set of Content Update Policy IDs which match the filter criteria

Class: Falcon::ContentUpdatePolicies

  • Operation: query_content_update_policy_members
  • GET: /policy/queries/content-update-members/v1
  • Description: Search for members of a Content Update Policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria

Class: Falcon::ContentUpdatePolicies

  • Operation: query_pinnable_content_versions
  • GET: /policy/queries/content-update-pin-versions/v1
  • Description: Search for content versions available for pinning given the category.

Class: Falcon::ContentUpdatePolicies

  • Operation: set_content_update_policies_precedence
  • POST: /policy/entities/content-update-precedence/v1
  • Description: Sets the precedence of Content Update Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies when updating precedence

Class: Falcon::ContentUpdatePolicies

  • Operation: update_content_update_policies
  • PATCH: /policy/entities/content-update/v1
  • Description: Update Content Update Policies by specifying the ID of the policy and details to update

Class: Falcon::CorrelationRules

  • Operation: aggregates_rule_versions_post_v1
  • POST: /correlation-rules/aggregates/rule-versions/v1
  • Description: Get rules aggregates as specified via json in the request body.

Class: Falcon::CorrelationRules

  • Operation: combined_rules_get_v1
  • GET: /correlation-rules/combined/rules/v1
  • Description: Find all rules matching the query and filter. Supported filters: customer_id,user_id,user_uuid,status,name,created_on,last_updated_on Supported range filters: created_on,last_updated_on

Class: Falcon::CorrelationRules

  • Operation: combined_rules_get_v2
  • GET: /correlation-rules/combined/rules/v2
  • Description: Find all rules matching the query and filter. Supported filters: customer_id,user_id,user_uuid,status,name,created_on,last_updated_on Supported range filters: created_on,last_updated_on

Class: Falcon::CorrelationRules

  • Operation: entities_latest_rules_get_v1
  • GET: /correlation-rules/entities/latest-rules/v1
  • Description: Retrieve latest rule versions by rule IDs

Class: Falcon::CorrelationRules

Class: Falcon::CorrelationRules

Class: Falcon::CorrelationRules

Class: Falcon::CorrelationRules

Class: Falcon::CorrelationRules

Class: Falcon::CorrelationRules

  • Operation: entities_rules_get_v1
  • GET: /correlation-rules/entities/rules/v1
  • Description: Retrieve rules by IDs

Class: Falcon::CorrelationRules

  • Operation: entities_rules_get_v2
  • GET: /correlation-rules/entities/rules/v2
  • Description: Retrieve rule versions by IDs

Class: Falcon::CorrelationRules

Class: Falcon::CorrelationRules

Class: Falcon::CorrelationRules

  • Operation: queries_rules_get_v1
  • GET: /correlation-rules/queries/rules/v1
  • Description: Find all rule IDs matching the query and filter. Supported filters: customer_id,user_id,user_uuid,status,name,created_on,last_updated_on Supported range filters: created_on,last_updated_on

Class: Falcon::CorrelationRules

  • Operation: queries_rules_get_v2
  • GET: /correlation-rules/queries/rules/v2
  • Description: Find all rule version IDs matching the query and filter. Supported filters: customer_id,user_id,user_uuid,status,name,created_on,last_updated_on,state,version,rule_id Supported range filters: created_on,last_updated_on

Class: Falcon::CspgIac

  • Operation: get_credentials_mixin0
  • GET: /iac/entities/image-registry-credentials/v1
  • Description: Gets the registry credentials (external endpoint)

Class: Falcon::CspmRegistration

  • Operation: azure_download_certificate
  • GET: /cloud-connect-cspm-azure/entities/download-certificate/v1
  • Description: Returns JSON object(s) that contain the base64 encoded certificate for a service principal.

Class: Falcon::CspmRegistration

  • Operation: azure_refresh_certificate
  • POST: /cloud-connect-cspm-azure/entities/refresh-certificate/v1
  • Description: Refresh certificate and returns JSON object(s) that contain the base64 encoded certificate for a service principal.

Class: Falcon::CspmRegistration

  • Operation: connect_cspm_gcp_account
  • POST: /cloud-connect-cspm-gcp/entities/account/v2
  • Description: Creates a new GCP account with newly-uploaded service account or connects with existing service account with only the following fields: parent_id, parent_type and service_account_id

Class: Falcon::CspmRegistration

  • Operation: create_cspm_aws_account
  • POST: /cloud-connect-cspm-aws/entities/account/v1
  • Description: Creates a new account in our system for a customer and generates a script for them to run in their AWS cloud environment to grant us access.

Class: Falcon::CspmRegistration

  • Operation: create_cspm_azure_account
  • POST: /cloud-connect-cspm-azure/entities/account/v1
  • Description: Creates a new account in our system for a customer and generates a script for them to run in their cloud environment to grant us access.

Class: Falcon::CspmRegistration

  • Operation: create_cspm_azure_management_group
  • POST: /cloud-connect-cspm-azure/entities/management-group/v1
  • Description: Creates a new management group in our system for a customer.

Class: Falcon::CspmRegistration

  • Operation: create_cspm_gcp_account
  • POST: /cloud-connect-cspm-gcp/entities/account/v1
  • Description: Creates a new account in our system for a customer and generates a new service account for them to add access to in their GCP environment to grant us access.

Class: Falcon::CspmRegistration

  • Operation: delete_cspm_aws_account
  • DELETE: /cloud-connect-cspm-aws/entities/account/v1
  • Description: Deletes an existing AWS account or organization in our system.

Class: Falcon::CspmRegistration

  • Operation: delete_cspm_azure_account
  • DELETE: /cloud-connect-cspm-azure/entities/account/v1
  • Description: Deletes an Azure subscription from the system.

Class: Falcon::CspmRegistration

  • Operation: delete_cspm_azure_management_group
  • DELETE: /cloud-connect-cspm-azure/entities/management-group/v1
  • Description: Deletes Azure management groups from the system.

Class: Falcon::CspmRegistration

  • Operation: delete_cspm_gcp_account
  • DELETE: /cloud-connect-cspm-gcp/entities/account/v1
  • Description: Deletes a GCP account from the system.

Class: Falcon::CspmRegistration

Class: Falcon::CspmRegistration

  • Operation: get_cloud_event_ids
  • GET: /detects/queries/cloud-events/v1
  • Description: Get list of related cloud event LogScale IDs for a given IOA

Class: Falcon::CspmRegistration

  • Operation: get_configuration_detection_entities
  • GET: /detects/entities/iom/v2
  • Description: Get misconfigurations based on the ID - including custom policy detections in addition to default policy detections.

Class: Falcon::CspmRegistration

  • Operation: get_configuration_detection_ids_v2
  • GET: /detects/queries/iom/v2
  • Description: Get list of active misconfiguration ids - including custom policy detections in addition to default policy detections.

Class: Falcon::CspmRegistration

  • Operation: get_configuration_detections
  • GET: /detects/entities/iom/v1
  • Description: Get list of active misconfigurations. This endpoint is deprecated, please use /queries/iom/v2 and /entities/iom/v2 instead

Class: Falcon::CspmRegistration

  • Operation: get_cspm_aws_account
  • GET: /cloud-connect-cspm-aws/entities/account/v1
  • Description: Returns information about the current status of an AWS account.

Class: Falcon::CspmRegistration

  • **Op

From RubyGems ( This is the way )

1

  • To install from RubyGems, use the following command: