Skip to content

FileVantage

Joshua Hiller edited this page Dec 15, 2021 · 12 revisions

CrowdStrike Falcon Twitter URL

Using the FileVantage service collection

Uber class support Service class support Documentation Version Page Updated

Table of Contents

Operation ID Description
getChanges
PEP8 get_changes
Retrieve information on changes.
queryChanges
PEP8 query_changes
Returns one or more change IDs.

getChanges

Retrieve information on changes

PEP8 method name

get_changes

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Datatype Description
ids
Service Class Support

Uber Class Support
query string or list of strings The ID(s) of the changes to return.
parameters
Service Class Support

Uber Class Support
query string Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import FileVantage

falcon = FileVantage(client_id="API_CLIENT_ID_HERE",
                     client_secret="API_CLIENT_SECRET_HERE"
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_changes(ids=id_list)
print(response)
Service class example (Operation ID syntax)
from falconpy import FileVantage

falcon = FileVantage(client_id="API_CLIENT_ID_HERE",
                     client_secret="API_CLIENT_SECRET_HERE"
                     )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getChanges(ids=id_list)
print(response)
Uber class example
from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getChanges", ids=id_list)
print(response)

queryChanges

Returns one or more change IDs

PEP8 method name

query_changes

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Datatype Description
filter
Service Class Support

Uber Class Support
query string FQL Syntax formatted string used to limit the results.

Available filters
  • action_timestamp
  • ingestion_timestamp
  • host.name
limit
Service Class Support

Uber Class Support
query integer The maximum number of changes to return in the response (default: 100; max: 500). Use with the offset parameter to manage pagination of results
offset
Service Class Support

Uber Class Support
query integer The first change index to return in the response. If not provided it will default to 0. Use with the limit parameter to manage pagination of results.
sort
Service Class Support

Uber Class Support
query string Sort changes using action_timestamp (timestamp of the change occurrence) or ingestion_timestamp (timestamp of whent he change was ingested). Sort either asc (ascending) or desc (descending). For example: `action_timestamp
parameters
Service Class Support

Uber Class Support
query string Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import FileVantage

falcon = FileVantage(client_id="API_CLIENT_ID_HERE",
                     client_secret="API_CLIENT_SECRET_HERE"
                     )

response = falcon.query_changes(offset=integer,
                                limit=integer,
                                sort="string",
                                filter="string"
                                )
print(response)
Service class example (Operation ID syntax)
from falconpy import FileVantage

falcon = FileVantage(client_id="API_CLIENT_ID_HERE",
                     client_secret="API_CLIENT_SECRET_HERE"
                     )

response = falcon.queryChanges(offset=integer,
                               limit=integer,
                               sort="string",
                               filter="string"
                               )
print(response)
Uber class example
from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("queryChanges", 
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string"
                          )
print(response)

CrowdStrike Falcon

Clone this wiki locally