CrowdStrike Falcon CrowdStrike Subreddit

Using the Prevention Policy service collection

Uber class support Service class support Documentation Version Page Updated

Table of Contents

Operation IDDescription
queryCombinedPreventionPolicyMembers
PEP 8query_combined_policy_members
Search for members of a Prevention Policy in your environment by providing a FQL filter and paging details. Returns a set of host details which match the filter criteria
queryCombinedPreventionPolicies
PEP 8query_combined_policies
Search for Prevention Policies in your environment by providing a FQL filter and paging details. Returns a set of Prevention Policies which match the filter criteria
performPreventionPoliciesAction
PEP 8perform_policies_action
Perform the specified action on the Prevention Policies specified in the request
setPreventionPoliciesPrecedence
PEP 8set_policies_precedence
Sets the precedence of Prevention Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence
getPreventionPolicies
PEP 8get_policies
Retrieve a set of Prevention Policies by specifying their IDs
createPreventionPolicies
PEP 8create_policies
Create Prevention Policies by specifying details about the policy to create
deletePreventionPolicies
PEP 8delete_policies
Delete a set of Prevention Policies by specifying their IDs
updatePreventionPolicies
PEP 8update_policies
Update Prevention Policies by specifying the ID of the policy and details to update
queryPreventionPolicyMembers
PEP 8query_policy_members
Search for members of a Prevention Policy in your environment by providing a FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria
queryPreventionPolicies
PEP 8query_policies
Search for Prevention Policies in your environment by providing a FQL filter and paging details. Returns a set of Prevention Policy IDs which match the filter criteria

Passing credentials

WARNING

client_id and client_secret are keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

queryCombinedPreventionPolicyMembers

Search for members of a Prevention Policy in your environment by providing a FQL filter and paging details. Returns a set of host details which match the filter criteria

PEP8 method name

query_combined_policy_members

Endpoint

MethodRoute
GET/policy/combined/prevention-members/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filter
Service Class Support

Uber Class Support
querystringFQL query expression that should be used to limit the results.
limit
Service Class Support

Uber Class Support
queryintegerMaximum number of records to return. Max: 5000.
offset
Service Class Support

Uber Class Support
querystringStarting index of overall result set from which to return ids.
id
Service Class Support

Uber Class Support
querystringThe ID of the Prevention Policy to search for members of.
sort
Service Class Support

Uber Class Support
querystringThe property to sort by.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import PreventionPolicy

# Do not hardcode API credentials!
falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.query_combined_policy_members(id="string",
                                                filter="string",
                                                offset=integer,
                                                limit=integer,
                                                sort="string"
                                                )
print(response)

Service class example (Operation ID syntax)
from falconpy import PreventionPolicy

# Do not hardcode API credentials!
falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.queryCombinedPreventionPolicyMembers(id="string",
                                                       filter="string",
                                                       offset=integer,
                                                       limit=integer,
                                                       sort="string"
                                                       )
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryCombinedPreventionPolicyMembers",
                          id="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )
print(response)

queryCombinedPreventionPolicies

Search for Prevention Policies in your environment by providing a FQL filter and paging details. Returns a set of Prevention Policies which match the filter criteria

PEP8 method name

query_combined_policies

Endpoint

MethodRoute
GET/policy/combined/prevention/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filter
Service Class Support

Uber Class Support
querystringFQL query expression that should be used to limit the results.
limit
Service Class Support

Uber Class Support
queryintegerMaximum number of records to return. Max: 5000.
offset
Service Class Support

Uber Class Support
querystringStarting index of overall result set from which to return ids.
sort
Service Class Support

Uber Class Support
querystringThe property to sort by.

Available fields:
  • created_by
  • modified_timestamp
  • created_timestamp
  • name
  • enabled
  • platform_name
  • modified_by
  • precedence
Example: created_timestamp.desc
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import PreventionPolicy

# Do not hardcode API credentials!
falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.query_combined_policies(filter="string",
                                          offset=integer,
                                          limit=integer,
                                          sort="string"
                                          )
print(response)

Service class example (Operation ID syntax)
from falconpy import PreventionPolicy

# Do not hardcode API credentials!
falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.queryCombinedPreventionPolicies(filter="string",
                                                  offset=integer,
                                                  limit=integer,
                                                  sort="string"
                                                  )
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryCombinedPreventionPolicies",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )
print(response)

performPreventionPoliciesAction

Perform the specified action on the Prevention Policies specified in the request

PEP8 method name

perform_policies_action

Endpoint

MethodRoute
POST/policy/entities/prevention-actions/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
action_name
Service Class Support

Uber Class Support
querystringThe action to perform. Allowed values:
  • add-host-group
  • add-rule-group
  • disable
  • enable
  • remove-host-group
  • remove-rule-group
action_parameters
Service Class Support

Uber Class Support
bodylist of dictionariesList of name / value pairs in JSON format.
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
rule_group_id
Service Class Support

Uber Class Support
body
action_parameters
stringHost Group ID to apply the policy to. String. Overridden if action_parameters is specified.
ids
Service Class Support

Uber Class Support
bodystring or list of stringsPrevention Policy ID(s) to perform actions against.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import PreventionPolicy

# Do not hardcode API credentials!
falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.perform_policies_action(action_name="string",
                                          rule_group_id="HOST_GROUP_ID",
                                          ids="ID_TO_UPDATE"
                                          )
print(response)

Service class example (Operation ID syntax)
from falconpy import PreventionPolicy

# Do not hardcode API credentials!
falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

# Can also be provided as the keyword `rule_group_id`
act_params = [{
    "name": "rule_group_id",
    "value": "HOST_GROUP_ID"
}]


response = falcon.performPreventionPoliciesAction(action_name="string",
                                                  action_parameters=act_params,
                                                  ids="ID_TO_UPDATE"
                                                  )
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

PARAMS = {
    "action_name": "string"  # Can also pass action_name using a keyword
}

act_params = [{
    "name": "rule_group_id",
    "value": "HOST_GROUP_ID"
}]

# Only one ID may be updated at a time
BODY = {
    "action_parameters": act_params,
    "ids": ["ID_TO_UPDATE"]
}

response = falcon.command("performPreventionPoliciesAction", parameters=PARAMS, body=BODY)
print(response)

setPreventionPoliciesPrecedence

Sets the precedence of Prevention Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence

PEP8 method name

set_policies_precedence

Endpoint

MethodRoute
POST/policy/entities/prevention-precedence/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
ids
Service Class Support

Uber Class Support
bodystring or list of stringsPrevention Policy ID(s) to adjust precedence.
platform_name
Service Class Support

Uber Class Support
bodystringOS platform name.
  • Linux
  • Mac
  • Windows
  • iOS
  • Android

Usage

Service class example (PEP8 syntax)
from falconpy import PreventionPolicy

# Do not hardcode API credentials!
falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = "ID1,ID2,ID3"  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.set_policies_precedence(ids=id_list, platform_name="string")
print(response)

Service class example (Operation ID syntax)
from falconpy import PreventionPolicy

# Do not hardcode API credentials!
falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = "ID1,ID2,ID3"  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.setPreventionPoliciesPrecedence(ids=id_list, platform_name="string")
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = ['ID1', 'ID2', 'ID3']

BODY = {
    "ids": id_list,
    "platform_name": "string"
}

response = falcon.command("setPreventionPoliciesPrecedence", body=BODY)
print(response)

getPreventionPolicies

Retrieve a set of Prevention Policies by specifying their IDs

PEP8 method name

get_policies

Endpoint

MethodRoute
GET/policy/entities/prevention/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
ids
Service Class Support

Uber Class Support
querystring or list of stringsThe ID(s) of the Prevention Policies to return.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import PreventionPolicy

# Do not hardcode API credentials!
falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_policies(ids=id_list)
print(response)

Service class example (Operation ID syntax)
from falconpy import PreventionPolicy

# Do not hardcode API credentials!
falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getPreventionPolicies(ids=id_list)
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getPreventionPolicies", ids=id_list)
print(response)

createPreventionPolicies

Create Prevention Policies by specifying details about the policy to create

PEP8 method name

create_policies

Endpoint

MethodRoute
POST/policy/entities/prevention/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
clone_id
Service Class Support

Uber Class Support
bodystringPrevention Policy ID to clone.
description
Service Class Support

Uber Class Support
bodystringPrevention Policy description.
name
Service Class Support

Uber Class Support
bodystringPrevention Policy name.
platform_name
Service Class Support

Uber Class Support
bodystringOperating system platform name.
  • Linux
  • Mac
  • Windows
  • iOS
  • Android
settings
Service Class Support

Uber Class Support
bodylist of dictionariesList of policy-specific settings to apply to the newly created policy. Multiple settings can be applied by passing a list containing multiple entries.

Usage

Service class example (PEP8 syntax)
from falconpy import PreventionPolicy

# Do not hardcode API credentials!
falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

policy_settings = [{
    "id": "string",
    "value": {}
}]

response = falcon.create_policies(clone_id="string",
                                  description="string",
                                  name="string",
                                  platform_name="string",
                                  settings=policy_settings
                                  )
print(response)

Service class example (Operation ID syntax)
from falconpy import PreventionPolicy

# Do not hardcode API credentials!
falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

policy_settings = [{
    "id": "string",
    "value": {}
}]

response = falcon.createPreventionPolicies(clone_id="string",
                                           description="string",
                                           name="string",
                                           platform_name="string",
                                           settings=policy_settings
                                           )
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

BODY = {
    "resources": [
        {
            "clone_id": "string",
            "description": "string",
            "name": "string",
            "platform_name": "string",
            "settings": [
                {
                    "id": "string",
                    "value": {}
                }
            ]
        }
    ]
}

response = falcon.command("createPreventionPolicies", body=BODY)
print(response)

deletePreventionPolicies

Delete a set of Prevention Policies by specifying their IDs

PEP8 method name

delete_policies

Endpoint

MethodRoute
DELETE/policy/entities/prevention/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
ids
Service Class Support

Uber Class Support
querystring or list of stringsThe ID(s) of the Prevention Policies to delete.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import PreventionPolicy

# Do not hardcode API credentials!
falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_policies(ids=id_list)
print(response)

Service class example (Operation ID syntax)
from falconpy import PreventionPolicy

# Do not hardcode API credentials!
falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deletePreventionPolicies(ids=id_list)
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deletePreventionPolicies", ids=id_list)
print(response)

updatePreventionPolicies

Update Prevention Policies by specifying the ID of the policy and details to update

PEP8 method name

update_policies

Endpoint

MethodRoute
PATCH/policy/entities/prevention/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
body
Service Class Support

Uber Class Support
bodydictionaryFull body payload in JSON format.
description
Service Class Support

Uber Class Support
bodystringPrevention Policy description.
id
Service Class Support

Uber Class Support
bodystringPrevention Policy ID to update.
name
Service Class Support

Uber Class Support
bodystringPrevention Policy name.
settings
Service Class Support

Uber Class Support
bodylist of dictionariesList of policy-specific settings to apply to the newly created policy. Multiple settings can be applied by passing a list containing multiple entries.

Usage

Service class example (PEP8 syntax)
from falconpy import PreventionPolicy

# Do not hardcode API credentials!
falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

policy_settings = [{
    "id": "string",
    "value": "string"
}]

response = falcon.update_policies(id="string",
                                  description="string",
                                  name="string",
                                  settings=policy_settings
                                  )
print(response)

Service class example (Operation ID syntax)
from falconpy import PreventionPolicy

# Do not hardcode API credentials!
falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

policy_settings = [{
    "id": "string",
    "value": "string"
}]

response = falcon.updatePreventionPolicies(id="string",
                                           description="string",
                                           name="string",
                                           settings=policy_settings
                                           )
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

BODY = {
    "resources": [
        {
            "description": "string",
            "id": "string",
            "name": "string",
            "settings": [
                {
                    "id": "string",
                    "value": {}
                }
            ]
        }
    ]
}

response = falcon.command("updatePreventionPolicies", body=BODY)
print(response)

queryPreventionPolicyMembers

Search for members of a Prevention Policy in your environment by providing a FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria

PEP8 method name

query_policy_members

Endpoint

MethodRoute
GET/policy/queries/prevention-members/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filter
Service Class Support

Uber Class Support
querystringFQL query expression that should be used to limit the results.
limit
Service Class Support

Uber Class Support
queryintegerMaximum number of records to return. Max: 5000.
offset
Service Class Support

Uber Class Support
querystringStarting index of overall result set from which to return ids.
id
Service Class Support

Uber Class Support
querystringThe ID of the Prevention Policy to search for members of.
sort
Service Class Support

Uber Class Support
querystringThe property to sort by.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import PreventionPolicy

# Do not hardcode API credentials!
falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.query_policy_members(id="string",
                                       filter="string",
                                       offset=integer,
                                       limit=integer,
                                       sort="string"
                                       )
print(response)

Service class example (Operation ID syntax)
from falconpy import PreventionPolicy

# Do not hardcode API credentials!
falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.queryPreventionPolicyMembers(id="string",
                                               filter="string",
                                               offset=integer,
                                               limit=integer,
                                               sort="string"
                                               )
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryPreventionPolicyMembers",
                          id="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )
print(response)

queryPreventionPolicies

Search for Prevention Policies in your environment by providing a FQL filter and paging details. Returns a set of Prevention Policy IDs which match the filter criteria

PEP8 method name

query_policies

Endpoint

MethodRoute
GET/policy/queries/prevention/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filter
Service Class Support

Uber Class Support
querystringFQL query expression that should be used to limit the results.
limit
Service Class Support

Uber Class Support
queryintegerMaximum number of records to return. Max: 5000.
offset
Service Class Support

Uber Class Support
querystringStarting index of overall result set from which to return ids.
sort
Service Class Support

Uber Class Support
querystringThe property to sort by.

Available fields:
  • created_by
  • modified_timestamp
  • created_timestamp
  • name
  • enabled
  • platform_name
  • modified_by
  • precedence
Example: created_timestamp.desc
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import PreventionPolicy

# Do not hardcode API credentials!
falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.query_policies(filter="string",
                                 offset=integer,
                                 limit=integer,
                                 sort="string"
                                 )
print(response)

Service class example (Operation ID syntax)
from falconpy import PreventionPolicy

# Do not hardcode API credentials!
falcon = PreventionPolicy(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.queryPreventionPolicies(filter="string",
                                          offset=integer,
                                          limit=integer,
                                          sort="string"
                                          )
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryPreventionPolicies",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )
print(response)