Skip to content

Device Control Policies

Jump to bottom
Joshua Hiller edited this page Aug 30, 2021 · 20 revisions

CrowdStrike Falcon Twitter URL

Using the Device Control Policies service collection

Uber class support Service class support

Table of Contents

Operation ID Description
queryCombinedDeviceControlPolicyMembers
PEP8 query_combined_policy_members
Search for members of a Device Control Policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria
queryCombinedDeviceControlPolicies
PEP8 query_combined_policies
Search for Device Control Policies in your environment by providing an FQL filter and paging details. Returns a set of Device Control Policies which match the filter criteria
performDeviceControlPoliciesAction
PEP8 perform_action
Perform the specified action on the Device Control Policies specified in the request
setDeviceControlPoliciesPrecedence
PEP8 set_precedence
Sets the precedence of Device Control Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence
getDeviceControlPolicies
PEP8 get_policies
Retrieve a set of Device Control Policies by specifying their IDs
createDeviceControlPolicies
PEP8 create_policies
Create Device Control Policies by specifying details about the policy to create
deleteDeviceControlPolicies
PEP8 delete_policies
Delete a set of Device Control Policies by specifying their IDs
updateDeviceControlPolicies
PEP8 update_policies
Update Device Control Policies by specifying the ID of the policy and details to update
queryDeviceControlPolicyMembers
PEP8 query_policy_members
Search for members of a Device Control Policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria
queryDeviceControlPolicies
PEP8 query_policies
Search for Device Control Policies in your environment by providing an FQL filter and paging details. Returns a set of Device Control Policy IDs which match the filter criteria

queryCombinedDeviceControlPolicyMembers

Search for members of a Device Control Policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria

PEP8 method name

query_combined_policy_members

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
id query string The ID of the Device Control Policy to search for members of
filter query string The filter expression that should be used to limit the results
offset query integer The offset to start retrieving records from
limit query integer The maximum records to return. [1-5000]
sort query string The property to sort by

Usage

Service class example (PEP8 syntax)
from falconpy.device_control_policies import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

response = falcon.query_combined_policy_members(id="string",
                                                filter="string",
                                                offset=integer,
                                                limit=integer,
                                                sort="string"
                                                )
print(response)
Service class example (Operation ID syntax)
from falconpy.device_control_policies import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

response = falcon.queryCombinedDeviceControlPolicyMembers(id="string",
                                                          filter="string",
                                                          offset=integer,
                                                          limit=integer,
                                                          sort="string"
                                                          )
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "id": "string",
    "filter": "string",
    "offset": integer,
    "limit": integer,
    "sort": "string"
}

response = falcon.command("queryCombinedDeviceControlPolicyMembers", parameters=PARAMS)
print(response)

queryCombinedDeviceControlPolicies

Search for Device Control Policies in your environment by providing an FQL filter and paging details. Returns a set of Device Control Policies which match the filter criteria

PEP8 method name

query_combined_policies

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
filter query string The filter expression that should be used to limit the results
offset query integer The offset to start retrieving records from
limit query integer The maximum records to return. [1-5000]
sort query string The property to sort by

Usage

Service class example (PEP8 syntax)
from falconpy.device_control_policies import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

response = falcon.query_combined_policies(filter="string",
                                          offset=integer,
                                          limit=integer,
                                          sort="string"
                                          )
print(response)
Service class example (Operation ID syntax)
from falconpy.device_control_policies import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

response = falcon.queryCombinedDeviceControlPolicies(filter="string",
                                                     offset=integer,
                                                     limit=integer,
                                                     sort="string"
                                                     )
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "filter": "string",
    "offset": integer,
    "limit": integer,
    "sort": "string"
}

response = falcon.command("queryCombinedDeviceControlPolicies", parameters=PARAMS)
print(response)

performDeviceControlPoliciesAction

Perform the specified action on the Device Control Policies specified in the request

PEP8 method name

perform_action

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ action_name query string The action to perform
✅ body body string

Usage

Service class example (PEP8 syntax)
from falconpy.device_control_policies import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.perform_action(action_name="string", body=BODY)
print(response)
Service class example (Operation ID syntax)
from falconpy.device_control_policies import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.performDeviceControlPoliciesAction(action_name="string", body=BODY)
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "action_name": "string"
}

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.command("performDeviceControlPoliciesAction", parameters=PARAMS, body=BODY)
print(response)

setDeviceControlPoliciesPrecedence

Sets the precedence of Device Control Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence

PEP8 method name

set_precedence

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ body body string

Usage

Service class example (PEP8 syntax)
from falconpy.device_control_policies import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.set_precedence(body=BODY)
print(response)
Service class example (Operation ID syntax)
from falconpy.device_control_policies import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.setDeviceControlPoliciesPrecedence(body=BODY)
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.command("setDeviceControlPoliciesPrecedence", body=BODY)
print(response)

getDeviceControlPolicies

Retrieve a set of Device Control Policies by specifying their IDs

PEP8 method name

get_policies

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ ids query array (string) The IDs of the Device Control Policies to return

Usage

Service class example (PEP8 syntax)
from falconpy.device_control_policies import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_policies(ids=id_list)
print(response)
Service class example (Operation ID syntax)
from falconpy.device_control_policies import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getDeviceControlPolicies(ids=id_list)
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getDeviceControlPolicies", ids=id_list)
print(response)

createDeviceControlPolicies

Create Device Control Policies by specifying details about the policy to create

PEP8 method name

create_policies

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ body body string

Usage

Service class example (PEP8 syntax)
from falconpy.device_control_policies import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.create_policies(body=BODY)
print(response)
Service class example (Operation ID syntax)
from falconpy.device_control_policies import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.createDeviceControlPolicies(body=BODY)
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.command("createDeviceControlPolicies", body=BODY)
print(response)

deleteDeviceControlPolicies

Delete a set of Device Control Policies by specifying their IDs

PEP8 method name

delete_policies

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ ids query array (string) The IDs of the Device Control Policies to delete

Usage

Service class example (PEP8 syntax)
from falconpy.device_control_policies import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_policies(ids=id_list)
print(response)
Service class example (Operation ID syntax)
from falconpy.device_control_policies import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteDeviceControlPolicies(ids=id_list)
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteDeviceControlPolicies", ids=id_list)
print(response)

updateDeviceControlPolicies

Update Device Control Policies by specifying the ID of the policy and details to update

PEP8 method name

update_policies

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ body body string

Usage

Service class example (PEP8 syntax)
from falconpy.device_control_policies import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.update_policies(body=BODY)
print(response)
Service class example (Operation ID syntax)
from falconpy.device_control_policies import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.updateDeviceControlPolicies(body=BODY)
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
    "Body Payload": "See body description above"
}

response = falcon.command("updateDeviceControlPolicies", body=BODY)
print(response)

queryDeviceControlPolicyMembers

Search for members of a Device Control Policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria

PEP8 method name

query_policy_members

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
id query string The ID of the Device Control Policy to search for members of
filter query string The filter expression that should be used to limit the results
offset query integer The offset to start retrieving records from
limit query integer The maximum records to return. [1-5000]
sort query string The property to sort by

Usage

Service class example (PEP8 syntax)
from falconpy.device_control_policies import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

response = falcon.query_policy_members(id="string",
                                       filter="string",
                                       offset=integer,
                                       limit=integer,
                                       sort="string"
                                       )
print(response)
Service class example (Operation ID syntax)
from falconpy.device_control_policies import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

response = falcon.queryDeviceControlPolicyMembers(id="string",
                                                  filter="string",
                                                  offset=integer,
                                                  limit=integer,
                                                  sort="string"
                                                  )
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "id": "string",
    "filter": "string",
    "offset": integer,
    "limit": integer,
    "sort": "string"
}

response = falcon.command("queryDeviceControlPolicyMembers", parameters=PARAMS)
print(response)

queryDeviceControlPolicies

Search for Device Control Policies in your environment by providing an FQL filter and paging details. Returns a set of Device Control Policy IDs which match the filter criteria

PEP8 method name

query_policies

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
filter query string The filter expression that should be used to limit the results
offset query integer The offset to start retrieving records from
limit query integer The maximum records to return. [1-5000]
sort query string The property to sort by

Usage

Service class example (PEP8 syntax)
from falconpy.device_control_policies import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

response = falcon.query_policies(filter="string",
                                 offset=integer,
                                 limit=integer,
                                 sort="string"
                                 )
print(response)
Service class example (Operation ID syntax)
from falconpy.device_control_policies import DeviceControlPolicies

falcon = DeviceControlPolicies(client_id="API_CLIENT_ID_HERE",
                               client_secret="API_CLIENT_SECRET_HERE"
                               )

response = falcon.queryDeviceControlPolicies(filter="string",
                                             offset=integer,
                                             limit=integer,
                                             sort="string"
                                             )
print(response)
Uber class example
from falconpy.api_complete import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

PARAMS = {
    "filter": "string",
    "offset": integer,
    "limit": integer,
    "sort": "string"
}

response = falcon.command("queryDeviceControlPolicies", parameters=PARAMS)
print(response)

CrowdStrike Falcon

Clone this wiki locally