CrowdStrike US2 n8n Node

n8n community node for the CrowdStrike Falcon API for Crowdstrike tenants in the US2 Region. Interact with detections, alerts, devices, network containment, threat intelligence, and more via OAuth2-authenticated REST endpoints.

Installation

In your n8n instance, go to Settings > Community Nodes and install:

@zackrobertstech/n8n-nodes-crowdstrike-api-us2

Compatibility

• n8n version: >=1.0.0
• Node.js version: >=18

Credentials

Configure your CrowdStrike US2 API credentials in n8n.

Resources & Operations

Base URL: https://api.us-2.crowdstrike.com

Access Scopes

Endpoint	Description
🔵 GET /access-scope-management/entities/access-scopes/v1	List Access Scopes By ID
🔵 GET /access-scope-management/queries/access-scopes/v1	Query Access Scopes and returns IDs

Admission Control Policies

Endpoint	Description
🔵 GET /admission-control-policies/entities/policies/v1	Get admission control policies.
🟢 POST /admission-control-policies/entities/policies/v1	Create an admission control policy.
🟣 PATCH /admission-control-policies/entities/policies/v1	Update an admission control policy.
🔴 DELETE /admission-control-policies/entities/policies/v1	Delete an admission control policy.
🟢 POST /admission-control-policies/entities/policy-host-groups/v1	Add one or more host groups to an admission control policy.
🔴 DELETE /admission-control-policies/entities/policy-host-groups/v1	Remove one or more host groups from an admission control policy.
🟣 PATCH /admission-control-policies/entities/policy-precedence/v1	Update admission control policy precedence.
🟢 POST /admission-control-policies/entities/policy-rule-group-custom-rules/v1	Add one or more custom Rego rules to a rule group in an admission control policy. The requested custom rules are also added to all other unspecified rule groups in the policy with action 'Disabled'.
🔴 DELETE /admission-control-policies/entities/policy-rule-group-custom-rules/v1	Delete one or more custom Rego rules from all rule groups in an admission control policy.
🟡 PUT /admission-control-policies/entities/policy-rule-group-precedence/v1	Change precedence of rule groups within an admission control policy.
🟡 PUT /admission-control-policies/entities/policy-rule-group-selectors/v1	Replace labels and/or namespaces of a rule group within an admission control policy.
🟢 POST /admission-control-policies/entities/policy-rule-groups/v1	Create one or more rule groups and add them to an existing admission control policy. The list of new rule groups will be created with the last rule group having highest precedence, second to last with second highest precedence, and so on.
🟣 PATCH /admission-control-policies/entities/policy-rule-groups/v1	Update a rule group. Change rule group name, description, deny on error, Image Assessment settings, default rule actions, and custom rule actions.
🔴 DELETE /admission-control-policies/entities/policy-rule-groups/v1	Delete rule groups.
🔵 GET /admission-control-policies/queries/policies/v1	Search admission control policies.

Agent Invocation

Endpoint	Description
🟢 POST /agentic-studio/entities/agent-invocations/v1	Invoke a published agent by ID with the specified input. Returns the agent's completion response.
🔵 GET /agentic-studio/entities/agent-invocations/v3	Retrieves the list of of messages that are resulted from the specified invocation
🟢 POST /agentic-studio/entities/agent-version-invocations/v1	Invoke a specific agent version by agent ID and version ID with the specified input. Returns the agent's completion response.

Agent Templates

Endpoint	Description
🔵 GET /agentic-studio/entities/agent-templates/v1	Retrieve agent template entities for the provided IDs
🔵 GET /agentic-studio/queries/agent-templates/v1	Query agent template IDs with pagination

Agent Versions

Endpoint	Description
🔵 GET /agentic-studio/entities/agent-versions/v1	Retrieve agent version entities for the provided ids.
🔵 GET /agentic-studio/queries/agent-versions/v1	Query agent versions based on the provided filters.

Agents

Endpoint	Description
🔴 DELETE /agentic-studio/entities/agents/v1	Delete an agent and all its versions. This soft-deletes the agent and propagates deletion to GCE and GenAI Platform.
🔵 GET /agentic-studio/entities/agents/v2	Retrieve agents entities for the provided ids.
🟢 POST /agentic-studio/entities/agents/v3	Create or update an agent. Updating an agent always creates a new agent version, so the version ID in the response differs from the previous one while the agent ID stays the same.
🟣 PATCH /agentic-studio/entities/agents/v3	Modifies existing agents
🔵 GET /agentic-studio/queries/agents/v2	Query agents based on the provided filters. TBD what the available filters are.

Alerts

Endpoint	Description
🟢 POST /alerts/aggregates/alerts/v1	Deprecated: Please use version v2 of this endpoint. Retrieves aggregate values for Alerts across all CIDs.
🟢 POST /alerts/aggregates/alerts/v2	Retrieves aggregate values for Alerts across all CIDs.
🟢 POST /alerts/combined/alerts/v1	Retrieves all Alerts that match a particular FQL filter. This API is intended for retrieval of large amounts of Alerts(>10k) using a pagination based on a after token. If you need to use offset pagination, consider using GET /alerts/queries/alerts/* and POST /alerts/entities/alerts/* APIs.
🟢 POST /alerts/entities/alerts/v1	Deprecated: please use version v2 of this endpoint. Retrieves all Alerts given their ids.
🟢 POST /alerts/entities/alerts/v2	Retrieves all Alerts given their composite ids.
🟣 PATCH /alerts/entities/alerts/v2	Deprecated: Please use version v3 of this endpoint. Perform actions on Alerts identified by composite ID(s) in request. Each action has a name and a description which describes what the action does. If a request adds and removes tag in a single request, the order of processing would be to remove tags before adding new ones in.
🟣 PATCH /alerts/entities/alerts/v3	Perform actions on Alerts identified by composite ID(s) in request. Each action has a name and a description which describes what the action does. If a request adds and removes tag in a single request, the order of processing would be to remove tags before adding new ones in.
🔵 GET /alerts/queries/alerts/v1	Deprecated: please use version v2 of this endpoint. Retrieves all Alerts ids that match a given query.
🔵 GET /alerts/queries/alerts/v2	Retrieves all Alerts ids that match a given query.

Api Clients

Endpoint	Description
🔵 GET /api-clients/entities/accessible-scopes/v1	Get all available scopes for customer.
🟢 POST /api-clients/entities/api-clients-actions/v1	Reset existing API Client(s)'s secret based on API Client ID(s) provided as request parameter(s) 'ids'. API Client Secret can be reset by specifying appropriate action in request parameter 'action_name'.
🔵 GET /api-clients/entities/api-clients/v1	Get API Client(s) based on API Client ID(s) provided as request parameter(s) 'ids'.
🟢 POST /api-clients/entities/api-clients/v1	Create new API Client.
🟣 PATCH /api-clients/entities/api-clients/v1	Update existing API Client based on API Client ID provided as request parameter 'ids'. Client Secret remains unaffected.
🔴 DELETE /api-clients/entities/api-clients/v1	Delete existing API Client(s) based on API Client ID(s) provided as request parameter(s) 'ids'.
🔵 GET /api-clients/queries/api-clients/v1	Get All API client ID(s) for customer.

Api Integrations

Endpoint	Description
🔵 GET /plugins/combined/configs/v1	Queries for config resources and returns details
🟢 POST /plugins/entities/execute-proxy/v1	Execute a command and proxy the response directly.
🟢 POST /plugins/entities/execute/v1	Execute a command.

ASPM

Endpoint	Description
🟢 POST /application-security/aggregates/function-data/count/v1	A selected list of queryLanguage count queries. request & response are in MSA format
🟢 POST /application-security/aggregates/functions/count/v1	A selected list of queryLanguage count queries. request & response are in MSA format
🔵 GET /application-security/aggregates/query-function-data-count/v1	A selected list of queryLanguage count queries. request & response are in MSA format
🔵 GET /application-security/aggregates/query-functions-count/v1	A selected list of queryLanguage count queries. request & response are in MSA format
🔵 GET /application-security/combined/function-data/v1	A selected list of queryLanguage queries. request & response are in MSA format
🔵 GET /application-security/combined/functions-overtime/v1	A selected list of queryLanguage overtime queries. request & response are in MSA format
🔵 GET /application-security/combined/functions/v1	A selected list of queryLanguage services queries. request & response are in MSA format
🔵 GET /application-security/combined/query-function-data/v1	A selected list of queryLanguage queries. request & response are in MSA format
🔵 GET /application-security/combined/query-functions-overtime/v1	A selected list of queryLanguage overtime queries. request & response are in MSA format
🔵 GET /application-security/combined/query-functions/v1	A selected list of queryLanguage services queries. request & response are in MSA format
🔵 GET /aspm-api-gateway/api/v1/artifacts	Get Service Artifacts
🟡 PUT /aspm-api-gateway/api/v1/business_applications	Create or Update Business Applications
🔵 GET /aspm-api-gateway/api/v1/cloud_security_config	Get Cloud Security integration state
🟢 POST /aspm-api-gateway/api/v1/cloud_security_config	Set Cloud Security integration state
🔵 GET /aspm-api-gateway/api/v1/executor_nodes	Get all the relay nodes
🟢 POST /aspm-api-gateway/api/v1/executor_nodes	Create a new relay node
🟡 PUT /aspm-api-gateway/api/v1/executor_nodes	Update an existing relay node
🔴 DELETE /aspm-api-gateway/api/v1/executor_nodes/{ID}	Delete a relay node
🔵 GET /aspm-api-gateway/api/v1/executor_nodes/{ID}/instances/csv	Retrieve the relay instances in CSV format
🔵 GET /aspm-api-gateway/api/v1/executor_nodes/metadata	Get metadata about all executor nodes
🔴 DELETE /aspm-api-gateway/api/v1/group/{ID}	Delete Group ID:[0 9]+
🟢 POST /aspm-api-gateway/api/v1/group/{ID}/update_default	Update default group
🔵 GET /aspm-api-gateway/api/v1/group/{ID}/v2	Get group details
🟢 POST /aspm-api-gateway/api/v1/group/{ID}/v2	Update group
🟢 POST /aspm-api-gateway/api/v1/group/v2	Create group
🔵 GET /aspm-api-gateway/api/v1/groups/hier/v2	Get group hierarchy
🔵 GET /aspm-api-gateway/api/v1/groups/list/v2	Get Groups List V2
🔵 GET /aspm-api-gateway/api/v1/integration_tasks	Get all the integration tasks
🟢 POST /aspm-api-gateway/api/v1/integration_tasks	Create new integration task.
🟡 PUT /aspm-api-gateway/api/v1/integration_tasks/{ID}	Update an existing integration task by its ID
🔴 DELETE /aspm-api-gateway/api/v1/integration_tasks/{ID}	Delete an existing integration task by its ID
🟢 POST /aspm-api-gateway/api/v1/integration_tasks/{ID}/run	Run an integration task by its ID
🟢 POST /aspm-api-gateway/api/v1/integration_tasks/{ID}/run/admin	Run an integration task by its ID - for admin scope
🟢 POST /aspm-api-gateway/api/v1/integration_tasks/{ID}/run/v2	Run an integration task by its ID
🔵 GET /aspm-api-gateway/api/v1/integration_tasks/admin	Get all the integration tasks, requires admin scope
🔵 GET /aspm-api-gateway/api/v1/integration_tasks/metadata	Get metadata about all integration tasks
🔵 GET /aspm-api-gateway/api/v1/integration_tasks/v2	Get all the integration tasks
🔵 GET /aspm-api-gateway/api/v1/integration_types	Get all the integration types
🔵 GET /aspm-api-gateway/api/v1/integrations	Get a list of all the integrations
🟢 POST /aspm-api-gateway/api/v1/integrations	Create a new integration
🟡 PUT /aspm-api-gateway/api/v1/integrations/{ID}	Update an existing integration by its ID
🔴 DELETE /aspm-api-gateway/api/v1/integrations/{ID}	Delete an existing integration by its ID
🔵 GET /aspm-api-gateway/api/v1/integrations/v2	Get a list of all the integrations
🟢 POST /aspm-api-gateway/api/v1/query	Execute a query. The syntax used is identical to that of the query page.
🔵 GET /aspm-api-gateway/api/v1/servicenow/deployments	Service Now Get Deployments
🔵 GET /aspm-api-gateway/api/v1/servicenow/services	Service Now Get Services
🟢 POST /aspm-api-gateway/api/v1/services/count	Get the total amount of existing services
🔵 GET /aspm-api-gateway/api/v1/services/violations/types	Get the different types of violation
🔵 GET /aspm-api-gateway/api/v1/tags	Get all the tags
🟢 POST /aspm-api-gateway/api/v1/tags	Remove existing tags
🟡 PUT /aspm-api-gateway/api/v1/tags	Create new or update existing tag. You can update unique tags table or regular tags table
🔵 GET /aspm-api-gateway/api/v1/users/v2	List users

Cao Hunting

Endpoint	Description
🟢 POST /hunting/aggregates/hunting-guides/v1	Aggregate Hunting Guides
🟢 POST /hunting/aggregates/intelligence-queries/v1	Aggregate intelligence queries
🔵 GET /hunting/entities/archive-exports/v1	Creates an Archive Export
🔵 GET /hunting/entities/hunting-guides/v1	Retrieves a list of Hunting Guides
🔵 GET /hunting/entities/intelligence-queries/v1	Retrieves the details of a list of Intelligence queries IDs
🔵 GET /hunting/queries/hunting-guides/v1	Search for Hunting Guides that match the provided conditions
🔵 GET /hunting/queries/intelligence-queries/v1	Search for a list of intelligence queries IDs that match the provided conditions

Case Files

Endpoint	Description
🟢 POST /case-files/aggregates/file-details/v1	Get file details aggregates as specified via json in the request body.
🔵 GET /case-files/combined/file-details/v1	Query file details
🔵 GET /case-files/entities/file-details/v1	Get file details by id
🟣 PATCH /case-files/entities/file-details/v1	Update file details
🟢 POST /case-files/entities/files/bulk-download/v1	Download multiple existing file from case as a ZIP
🔵 GET /case-files/entities/files/download/v1	Download existing file from case
🟢 POST /case-files/entities/files/download/v1	Download existing files from case
🟢 POST /case-files/entities/files/upload/v1	Upload file for case
🔴 DELETE /case-files/entities/files/v1	Delete file details by id
🟢 POST /case-files/entities/get-rtr-file-metadata/v1	gets metadata for a file via RTR without retrieving it
🟢 POST /case-files/entities/retrieve-rtr-file/v1	retrieves a file from host using RTR and adds it to a case
🟢 POST /case-files/entities/retrieve-rtr-recent-file/v1	RetrieveRecentRTRFile retrieves a recently fetched RTR file and adds it to a case
🔵 GET /case-files/queries/file-details/v1	Query for ids of file details

Case Management

Endpoint	Description
🟢 POST /casemgmt/aggregates/access-tags/v1	Get access tag aggregates
🟢 POST /casemgmt/aggregates/notification-groups/v1	Get notification groups aggregations
🟢 POST /casemgmt/aggregates/notification-groups/v2	Get notification groups aggregations
🟢 POST /casemgmt/aggregates/slas/v1	Get SLA aggregations
🟢 POST /casemgmt/aggregates/templates/v1	Get templates aggregations
🔵 GET /casemgmt/entities/access-tags/v1	Get access tags
🔵 GET /casemgmt/entities/fields/v1	Get fields by ID
🔵 GET /casemgmt/entities/notification-groups/v1	Get notification groups by ID
🟢 POST /casemgmt/entities/notification-groups/v1	Create notification group
🟣 PATCH /casemgmt/entities/notification-groups/v1	Update notification group
🔴 DELETE /casemgmt/entities/notification-groups/v1	Delete notification groups by ID
🔵 GET /casemgmt/entities/notification-groups/v2	Get notification groups by ID
🟢 POST /casemgmt/entities/notification-groups/v2	Create notification group
🟣 PATCH /casemgmt/entities/notification-groups/v2	Update notification group
🔴 DELETE /casemgmt/entities/notification-groups/v2	Delete notification groups by ID
🔵 GET /casemgmt/entities/slas/v1	Get SLAs by ID
🟢 POST /casemgmt/entities/slas/v1	Create SLA
🟣 PATCH /casemgmt/entities/slas/v1	Update SLA
🔴 DELETE /casemgmt/entities/slas/v1	Delete SLAs
🔵 GET /casemgmt/entities/template-snapshots/v1	Get template snapshots
🔵 GET /casemgmt/entities/templates/export/v1	Export templates to files in a zip archive
🟢 POST /casemgmt/entities/templates/import/v1	Import a template from a file
🔵 GET /casemgmt/entities/templates/v1	Get templates by ID
🟢 POST /casemgmt/entities/templates/v1	Create template
🟣 PATCH /casemgmt/entities/templates/v1	Update template
🔴 DELETE /casemgmt/entities/templates/v1	Delete templates
🔵 GET /casemgmt/queries/access-tags/v1	Query access tags
🔵 GET /casemgmt/queries/fields/v1	Query fields
🔵 GET /casemgmt/queries/notification-groups/v1	Query notification groups
🔵 GET /casemgmt/queries/notification-groups/v2	Query notification groups
🔵 GET /casemgmt/queries/slas/v1	Query SLAs
🔵 GET /casemgmt/queries/template-snapshots/v1	Query template snapshots
🔵 GET /casemgmt/queries/templates/v1	Query templates

Cases

Endpoint	Description
🟢 POST /cases/entities/alert-evidence/v1	Adds the given list of alert evidence to the specified case.
🟢 POST /cases/entities/case-tags/v1	Adds the given list of tags to the specified case.
🔴 DELETE /cases/entities/case-tags/v1	Removes the specified tags from the specified case.
🟢 POST /cases/entities/cases/v2	Retrieves all Cases given their IDs.
🟡 PUT /cases/entities/cases/v2	Creates the given Case
🟣 PATCH /cases/entities/cases/v2	Updates given fields on the specified case.
🟢 POST /cases/entities/event-evidence/v1	Adds the given list of event evidence to the specified case.
🟢 POST /cases/entities/merge/v1	Merges a source case into a destination case.
🔵 GET /cases/queries/cases/v1	Retrieves all Cases IDs that match a given query.

Certificate Based Exclusions

Endpoint	Description
🔵 GET /exclusions/entities/cert-based-exclusions/v1	Find all exclusion IDs matching the query with filter
🟢 POST /exclusions/entities/cert-based-exclusions/v1	Create new Certificate Based Exclusions.
🟣 PATCH /exclusions/entities/cert-based-exclusions/v1	Updates existing Certificate Based Exclusions
🔴 DELETE /exclusions/entities/cert-based-exclusions/v1	Delete the exclusions by id
🔵 GET /exclusions/entities/certificates/v1	Retrieves certificate signing information for a file
🔵 GET /exclusions/queries/cert-based-exclusions/v1	Search for cert-based exclusions.

Cloud Aws Registration

Endpoint	Description
🟢 POST /cloud-security-registration-aws/entities/account-scans/v1	Trigger health check scan for AWS accounts
🔵 GET /cloud-security-registration-aws/entities/account/v1	Retrieve existing AWS accounts by account IDs or organization IDs
🟢 POST /cloud-security-registration-aws/entities/account/v1	Creates a new account in our system for a customer.
🟣 PATCH /cloud-security-registration-aws/entities/account/v1	Patches a existing account in our system for a customer.
🔴 DELETE /cloud-security-registration-aws/entities/account/v1	Deletes an existing AWS account or organization in our system.
🟢 POST /cloud-security-registration-aws/entities/account/validate/v1	Validates the AWS account registration status, and discover organization child accounts if organization is specified
🔵 GET /cloud-security-registration-aws/queries/account/v1	Retrieve existing AWS accounts by account IDs

Cloud Azure Registration

Endpoint	Description
🔵 GET /cloud-security-registration-azure/aggregates/issue-suppressions-values-by-fields/v1	Retrieve distinct filterable values for issue suppression fields
🔵 GET /cloud-security-registration-azure/aggregates/issues-values-by-fields/v1	Retrieve distinct filterable values for issue fields
🔴 DELETE /cloud-security-registration-azure/entities/accounts/legacy/v1	Delete existing legacy Azure subscriptions.
🔵 GET /cloud-security-registration-azure/entities/issue-suppressions/v1	Retrieve existing suppression rules with filtering
🟢 POST /cloud-security-registration-azure/entities/issue-suppressions/v1	Create new issue suppression rules
🟣 PATCH /cloud-security-registration-azure/entities/issue-suppressions/v1	Update existing suppression rules
🔴 DELETE /cloud-security-registration-azure/entities/issue-suppressions/v1	Remove/revoke suppression rules
🔵 GET /cloud-security-registration-azure/entities/issues/v1	Retrieve issues for Azure registrations
🟢 POST /cloud-security-registration-azure/entities/registrations/healthcheck/v1	Trigger health check scan for Azure registrations
🔵 GET /cloud-security-registration-azure/entities/registrations/v1	Retrieve existing Azure registration for a tenant.
🟢 POST /cloud-security-registration-azure/entities/registrations/v1	Create an Azure registration for a tenant.
🟣 PATCH /cloud-security-registration-azure/entities/registrations/v1	Update an existing Azure registration for a tenant.
🔴 DELETE /cloud-security-registration-azure/entities/registrations/v1	Deletes existing Azure registrations.
🟢 POST /cloud-security-registration-azure/entities/registrations/validate/v1	Validate an Azure registration by checking service principal, role assignments and deployment stack (if the deployment method is Bicep)
🔵 GET /cloud-security-registration-azure/entities/script-versions/v1	Retrieve all available script versions with filtering and sorting
🔵 GET /cloud-security-registration-azure/entities/scripts/v1	Download Azure deployment script (Terraform or Bicep)
🟢 POST /cloud-security-registration-azure/entities/scripts/v1	Retrieve script to create resources

Cloud Google Cloud Registration

Endpoint	Description
🔵 GET /cloud-security-registration-google-cloud/entities/accounts/v1	Retrieve all GCP entities (organizations, folders, projects) grouped by type with support for FQL filtering, sorting, and pagination.
🟢 POST /cloud-security-registration-google-cloud/entities/registration-scans/v1	Trigger health check scan for GCP registrations
🔵 GET /cloud-security-registration-google-cloud/entities/registrations/v1	Retrieve a Google Cloud Registration.
🟢 POST /cloud-security-registration-google-cloud/entities/registrations/v1	Create a Google Cloud Registration.
🟡 PUT /cloud-security-registration-google-cloud/entities/registrations/v1	Creates/Updates a Google Cloud Registration.
🟣 PATCH /cloud-security-registration-google-cloud/entities/registrations/v1	Update a Google Cloud Registration.
🔴 DELETE /cloud-security-registration-google-cloud/entities/registrations/v1	Deletes a Google Cloud Registration and returns the deleted registration in the response body.
🟢 POST /cloud-security-registration-google-cloud/entities/scripts-terraform/v1	Generate Google Cloud Terraform deployment scripts (zip files)

Cloud Oci Registration

Endpoint	Description
🔵 GET /cloud-security-registration-oci/combined/accounts/v1	Retrieve a list of OCI tenancies with support for FQL filtering, sorting, and pagination
🟢 POST /cloud-security-registration-oci/entities/account-rotate-keys/v1	Refresh key for the OCI Tenancy
🟢 POST /cloud-security-registration-oci/entities/account-validate/v1	Validate the OCI account in CSPM for a provided CID.
🟢 POST /cloud-security-registration-oci/entities/accounts/v1	Create OCI tenancy account in CSPM
🟣 PATCH /cloud-security-registration-oci/entities/accounts/v1	Patch an existing OCI account in our system for a customer.
🔴 DELETE /cloud-security-registration-oci/entities/accounts/v1	Delete an existing OCI tenancy in CSPM.
🟢 POST /cloud-security-registration-oci/entities/scripts/v1	Retrieve script to create resources in tenancy OCID

Cloud Policies

Endpoint	Description
🔵 GET /cloud-policies/combined/rules/input-schema/v1	Get rule input schema for given resource type
🟢 POST /cloud-policies/entities/compliance/clone-framework/v1	Clone an existing compliance framework to create a custom copy
🟡 PUT /cloud-policies/entities/compliance/control-rule-assignments/v1	Assign rules to a compliance control (full replace)
🔵 GET /cloud-policies/entities/compliance/controls/v1	Get compliance controls by ID
🟢 POST /cloud-policies/entities/compliance/controls/v1	Create a new custom compliance control
🟣 PATCH /cloud-policies/entities/compliance/controls/v1	Update a custom compliance control
🔴 DELETE /cloud-policies/entities/compliance/controls/v1	Delete custom compliance controls
🟣 PATCH /cloud-policies/entities/compliance/frameworks/section/v1	Rename a section in a custom compliance framework
🔵 GET /cloud-policies/entities/compliance/frameworks/v1	Get compliance frameworks by ID
🟢 POST /cloud-policies/entities/compliance/frameworks/v1	Create a new custom compliance framework
🟣 PATCH /cloud-policies/entities/compliance/frameworks/v1	Update a custom compliance framework
🔴 DELETE /cloud-policies/entities/compliance/frameworks/v1	Delete a custom compliance framework and all associated controls and rule assignments
🔵 GET /cloud-policies/entities/enriched-resources/v1	Gets enriched assets that combine a primary resource with all its related resources
🟢 POST /cloud-policies/entities/evaluation/v1	Gets evaluation results based on the provided rule
🔵 GET /cloud-policies/entities/rule-overrides/v1	Get a rule override
🟢 POST /cloud-policies/entities/rule-overrides/v1	Create a new rule override
🟣 PATCH /cloud-policies/entities/rule-overrides/v1	Update a rule override
🔴 DELETE /cloud-policies/entities/rule-overrides/v1	Delete a rule override
🔵 GET /cloud-policies/entities/rules/v1	Get a rule by id
🟢 POST /cloud-policies/entities/rules/v1	Create a new rule
🟣 PATCH /cloud-policies/entities/rules/v1	Update a rule
🔴 DELETE /cloud-policies/entities/rules/v1	Delete a rule
🔵 GET /cloud-policies/entities/suppression-rules/v1	Get Suppression Rules by ID
🟢 POST /cloud-policies/entities/suppression-rules/v1	Create a new suppression rule
🟣 PATCH /cloud-policies/entities/suppression-rules/v1	Update a suppression rule
🔴 DELETE /cloud-policies/entities/suppression-rules/v1	Delete Suppression Rules by ID
🔵 GET /cloud-policies/queries/compliance/controls/v1	Query for compliance controls by various parameters
🔵 GET /cloud-policies/queries/compliance/frameworks/v1	Query for compliance frameworks by various parameters
🔵 GET /cloud-policies/queries/rules/v1	Query for rules by various parameters
🔵 GET /cloud-policies/queries/suppression-rules/v1	Query suppression rules with filtering, sorting and pagination

Cloud Security

Endpoint	Description
🔵 GET /cloud-security-risks/combined/cloud-risks/v1	Gets cloud risks with full details based on filters and sort criteria
🔵 GET /cloud-security/combined/cloud-groups/v1	Query Cloud Groups and returns entities
🔵 GET /cloud-security/entities/cloud-groups/v1	List Cloud Groups By ID
🟢 POST /cloud-security/entities/cloud-groups/v1	Create a Cloud Group. The created_by field will be set to the API client ID.
🟣 PATCH /cloud-security/entities/cloud-groups/v1	Update Cloud Group
🔴 DELETE /cloud-security/entities/cloud-groups/v1	Delete Cloud Groups in batch
🔵 GET /cloud-security/queries/cloud-groups/v1	Query Cloud Groups and returns IDs

Cloud Security Assets

Endpoint	Description
🔵 GET /cloud-security-assets/combined/application-findings/v1	Get findings for an application resource with pagination
🔵 GET /cloud-security-assets/combined/compliance-controls/by-account-region-and-resource-type/v1	Gets combined compliance data aggregated by account and region. Results can be filtered and sorted.
🔵 GET /cloud-security-assets/entities/resources/v1	Gets raw resources based on the provided IDs param. Maximum of 100 resources can be requested with this method. Use POST method with same path if more are required.
🟢 POST /cloud-security-assets/entities/resources/v1	Gets raw resources based on IDs in the request body. Maximum of 500 resources can be requested.
🔵 GET /cloud-security-assets/queries/resources/v1	Gets a list of resource IDs for the given parameters, filters and sort criteria

Cloud Security Compliance

Endpoint	Description
🔵 GET /cloud-security-compliance/entities/framework-posture-summaries/v1	Get sections and requirements with scores for benchmarks.
🔵 GET /cloud-security-compliance/entities/rule-posture-summaries/v1	Get compliance score and counts for rules.

Cloud Security Detections

Endpoint	Description
🔵 GET /cloud-security-evaluations/combined/ioms-by-rule/v1	returns ioms grouped by rule
🔵 GET /cloud-security-evaluations/entities/ioms/v1	Gets IOMs based on the provided IDs
🟢 POST /cloud-security-evaluations/entities/ioms/v1	Gets IOMs based on IDs in the request body. Maximum of 500 resources can be requested.
🔵 GET /cloud-security-evaluations/queries/ioms/v1	Gets a list of IOM IDs for the given parameters, filters and sort criteria.

Cloud Security Registration Combined

Endpoint	Description
🟢 POST /cloud-security-registration/aggregates/accounts/v1	Returns cross-provider account aggregates by status

Cloud Security Risks

Endpoint	Description
🔵 GET /cloud-security-timeline/entities/cloud-risks-enriched-timeline/v1	Returns the enriched asset timeline. Rate limited to 500 requests per minute per CID. Exceeding this limit returns HTTP 429 (Too Many Requests).

Cloud Snapshots

Endpoint	Description
🔵 GET /snapshots/combined/deployments/v1	Retrieve snapshot jobs identified by the provided IDs
🟢 POST /snapshots/entities/accounts/v1	Register customer cloud account for snapshot scanning
🔵 GET /snapshots/entities/deployments/v1	Retrieve snapshot jobs identified by the provided IDs
🟢 POST /snapshots/entities/deployments/v1	Launch a snapshot scan for a given cloud asset
🔵 GET /snapshots/entities/image-registry-credentials/v1	Gets the registry credentials
🔵 GET /snapshots/entities/scanreports/v1	retrieve the scan report for an instance

Configuration Assessment

Endpoint	Description
🔵 GET /configuration-assessment/combined/assessments/v1	Search for assessments in your environment by providing an FQL filter and paging details. Returns a set of HostFinding entities which match the filter criteria
🔵 GET /configuration-assessment/entities/rule-details/v1	Get rules details for provided one or more rule IDs

Configuration Assessment Evaluation Logic

Endpoint	Description
🔵 GET /configuration-assessment/entities/evaluation-logic/v1	Get details on evaluation logic items by providing one or more finding IDs.

Container Alerts

Endpoint	Description
🔵 GET /container-security/aggregates/container-alerts/count-by-severity/v1	Get Container Alerts counts by severity
🔵 GET /container-security/aggregates/container-alerts/count/v1	Search Container Alerts by the provided search criteria
🔵 GET /container-security/combined/container-alerts/v1	Search Container Alerts by the provided search criteria

Container Detections

Endpoint	Description
🔵 GET /container-security/aggregates/detections/count-by-severity/v1	Aggregate counts of detections by severity
🔵 GET /container-security/aggregates/detections/count-by-type/v1	Aggregate counts of detections by detection type
🔵 GET /container-security/aggregates/detections/count/v1	Aggregate count of detections
🔵 GET /container-security/combined/detections/v1	Retrieve image assessment detections identified by the provided filter criteria
🔵 GET /container-security/entities/detections/v1	Retrieve image assessment detection entities identified by the provided filter criteria
🔵 GET /container-security/queries/detections/v1	Retrieve image assessment detection entities identified by the provided filter criteria

Container Image Compliance

Endpoint	Description
🔵 GET /container-compliance/aggregates/compliance-by-clusters/v2	get the assessments for each cluster
🔵 GET /container-compliance/aggregates/compliance-by-images/v2	get the assessments for each image
🔵 GET /container-compliance/aggregates/compliance-by-rules/v2	get the assessments for each rule
🔵 GET /container-compliance/aggregates/failed-containers-by-rules/v2	get the containers grouped into rules on which they failed
🔵 GET /container-compliance/aggregates/failed-containers-count-by-severity/v2	get the failed containers count grouped into severity levels
🔵 GET /container-compliance/aggregates/failed-images-by-rules/v2	get the images grouped into rules on which they failed
🔵 GET /container-compliance/aggregates/failed-images-count-by-severity/v2	get the failed images count grouped into severity levels
🔵 GET /container-compliance/aggregates/failed-rules-by-clusters/v2	get the failed rules for each cluster grouped into severity levels
🔵 GET /container-compliance/aggregates/failed-rules-by-images/v2	get images with failed rules, rule count grouped by severity for each image
🔵 GET /container-compliance/aggregates/failed-rules-count-by-severity/v2	get the failed rules count grouped into severity levels
🔵 GET /container-compliance/aggregates/rules-by-status/v2	get the rules grouped by their statuses

Container Images

Endpoint	Description
🔵 GET /container-security/aggregates/images/assessment-history/v1	Image assessment history
🔵 GET /container-security/aggregates/images/count-by-os-distribution/v1	Aggregate count of images grouped by Base OS distribution
🔵 GET /container-security/aggregates/images/count-by-state/v1	Aggregate count of images grouped by state
🔵 GET /container-security/aggregates/images/count/v1	Aggregate count of images
🔵 GET /container-security/combined/base-images/v1	Retrieves a list of base images for the provided filter. Maximum page size: 100
🔵 GET /container-security/combined/image-assessment/images/v1	Get image assessment results by providing an FQL filter and paging details
🔵 GET /container-security/combined/images/by-vulnerability-count/v1	Retrieve top x images with the most vulnerabilities
🔵 GET /container-security/combined/images/detail/v1	Retrieve image entities identified by the provided filter criteria
🔵 GET /container-security/combined/images/export/v1	Retrieves a paginated list of images, with an option to expand aggregated vulnerabilities/detections. Maximum page size: 100. Maximum available images: 10,000
🔵 GET /container-security/combined/images/issues-summary/v1	Retrieve image issues summary such as Image detections, Runtime detections, Policies, vulnerabilities
🔵 GET /container-security/combined/images/vulnerabilities-summary/v1	aggregates information about vulnerabilities for an image
🟢 POST /container-security/entities/base-images/v1	Creates base images using the provided details
🔴 DELETE /container-security/entities/base-images/v1	Delete base images by base image uuid

Container Packages

Endpoint	Description
🔵 GET /container-security/aggregates/packages/by-image-count/v1	Retrieves the N most frequently used packages across images
🔵 GET /container-security/aggregates/packages/count-by-zero-day/v1	Retrieve packages count affected by zero day vulnerabilities
🔵 GET /container-security/combined/packages/app-by-fixable-vulnerability-count/v1	Retrieve top x app packages with the most fixable vulnerabilities
🔵 GET /container-security/combined/packages/by-vulnerability-count/v1	Retrieve top x packages with the most vulnerabilities
🔵 GET /container-security/combined/packages/export/v1	Retrieves a paginated list of packages identified by the provided filter criteria,used for export.Maximum page size: 100. Maximum available packages: 10,000
🔵 GET /container-security/combined/packages/v1	Retrieve packages identified by the provided filter criteria
🔵 GET /container-security/combined/packages/v2	Retrieve packages identified by the provided filter criteria

Container Vulnerabilities

Endpoint	Description
🔵 GET /container-security/aggregates/vulnerabilities/count-by-actively-exploited/v1	Aggregate count of vulnerabilities grouped by actively exploited
🔵 GET /container-security/aggregates/vulnerabilities/count-by-cps-rating/v1	Aggregate count of vulnerabilities grouped by csp_rating
🔵 GET /container-security/aggregates/vulnerabilities/count-by-cvss-score/v1	Aggregate count of vulnerabilities grouped by CVSS score
🔵 GET /container-security/aggregates/vulnerabilities/count-by-severity/v1	Aggregate count of vulnerabilities grouped by severity
🔵 GET /container-security/aggregates/vulnerabilities/count/v1	Aggregate count of vulnerabilities
🔵 GET /container-security/combined/vulnerabilities/by-image-count/v1	Retrieve top x vulnerabilities with the most impacted images
🔵 GET /container-security/combined/vulnerabilities/by-published-date/v1	Retrieve top x vulnerabilities with the most recent publication date
🔵 GET /container-security/combined/vulnerabilities/details/v1	Retrieve vulnerability details related to an image
🔵 GET /container-security/combined/vulnerabilities/info/v1	Retrieve vulnerability and package related info for this customer
🔵 GET /container-security/combined/vulnerabilities/v1	Retrieves a paginated list of vulnerabilities filtered by the provided FQL. Maximum page size: 100. Maximum available vulnerabilities: 10,000

Content Update Policies

Endpoint	Description
🔵 GET /policy/combined/content-update-members/v1	Search for members of a Content Update Policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria
🔵 GET /policy/combined/content-update/v1	Search for Content Update Policies in your environment by providing an FQL filter and paging details. Returns a set of Content Update Policies which match the filter criteria
🟢 POST /policy/entities/content-update-actions/v1	Perform the specified action on the Content Update Policies specified in the request
🟢 POST /policy/entities/content-update-precedence/v1	Sets the precedence of Content Update Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies when updating precedence
🔵 GET /policy/entities/content-update/v1	Retrieve a set of Content Update Policies by specifying their IDs
🟢 POST /policy/entities/content-update/v1	Create Content Update Policies by specifying details about the policy to create
🟣 PATCH /policy/entities/content-update/v1	Update Content Update Policies by specifying the ID of the policy and details to update
🔴 DELETE /policy/entities/content-update/v1	Delete a set of Content Update Policies by specifying their IDs
🔵 GET /policy/queries/content-update-members/v1	Search for members of a Content Update Policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria
🔵 GET /policy/queries/content-update-pin-versions/v1	Search for content versions available for pinning given the category.
🔵 GET /policy/queries/content-update/v1	Search for Content Update Policies in your environment by providing an FQL filter and paging details. Returns a set of Content Update Policy IDs which match the filter criteria

Correlation Rules

Endpoint	Description
🟢 POST /correlation-rules/aggregates/rule-versions/v1	Get rules aggregates as specified via json in the request body.
🔵 GET /correlation-rules/combined/rules/v1	Find all rules matching the query and filter. Supported filters: customer_id,user_id,user_uuid,status,name,created_on,last_updated_on Supported range filters: created_on,last_updated_on
🔵 GET /correlation-rules/combined/rules/v2	Find all rules matching the query and filter. Supported filters: customer_id,user_id,user_uuid,status,name,created_on,last_updated_on Supported range filters: created_on,last_updated_on
🔵 GET /correlation-rules/entities/latest-rules/v1	Retrieve latest rule versions by rule IDs
🟢 POST /correlation-rules/entities/rule-versions/export/v1	Export rule versions
🟢 POST /correlation-rules/entities/rule-versions/import/v1	Import rule versions
🟣 PATCH /correlation-rules/entities/rule-versions/publish/v1	Publish existing rule version
🔴 DELETE /correlation-rules/entities/rule-versions/v1	Delete versions by IDs
🔵 GET /correlation-rules/entities/rules/v1	Retrieve rules by IDs
🟢 POST /correlation-rules/entities/rules/v1	Create rule
🟣 PATCH /correlation-rules/entities/rules/v1	Update rules
🔴 DELETE /correlation-rules/entities/rules/v1	Delete rules by IDs
🔵 GET /correlation-rules/entities/rules/v2	Retrieve rule versions by IDs
🟢 POST /correlation-rules/entities/templates/rules/v1	Create rule from template
🔵 GET /correlation-rules/entities/templates/v1	Retrieve rule templates by IDs
🔵 GET /correlation-rules/queries/rules/v1	Find all rule IDs matching the query and filter. Supported filters: customer_id,user_id,user_uuid,status,name,created_on,last_updated_on Supported range filters: created_on,last_updated_on
🔵 GET /correlation-rules/queries/rules/v2	Find all rule version IDs matching the query and filter. Supported filters: customer_id,user_id,user_uuid,status,name,created_on,last_updated_on,state,version,rule_id,executor_rule_id Supported range filters: created_on,last_updated_on
🔵 GET /correlation-rules/queries/templates/v1	Search rule template IDs matching the filter. Supported filters: name,description,vendor,outcome,mitre_attack.tactic_id,mitre_attack.technique_id,type Supported range filters: created_on,last_updated_on

Correlation Rules Admin

Endpoint	Description
🟡 PUT /correlation-rules/entities/rules/ownership/v1	Change the owner of an existing Correlation Rule
🟡 PUT /correlation-rules/entities/rules/ownership/v2	Bulk change the owner of existing Correlation Rules

Cspg Iacapi

Endpoint	Description
🔵 GET /iac/combined/detections/v1	Search IaC Detections using a query in Falcon Query Language
🔵 GET /iac/entities/image-registry-credentials/v1	Gets the registry credentials (external endpoint)

Cspm Registration

Endpoint	Description
🔵 GET /cloud-connect-cspm-aws/entities/account/v1	Returns information about the current status of an AWS account.
🟢 POST /cloud-connect-cspm-aws/entities/account/v1	Creates a new account in our system for a customer and generates a script for them to run in their AWS cloud environment to grant us access.
🟣 PATCH /cloud-connect-cspm-aws/entities/account/v1	Patches a existing account in our system for a customer.
🔴 DELETE /cloud-connect-cspm-aws/entities/account/v1	Deletes an existing AWS account or organization in our system.
🔵 GET /cloud-connect-cspm-aws/entities/console-setup-urls/v1	Return a URL for customer to visit in their cloud environment to grant us access to their AWS environment.
🔵 GET /cloud-connect-cspm-azure/entities/account/v1	Return information about Azure account registration
🟢 POST /cloud-connect-cspm-azure/entities/account/v1	Creates a new account in our system for a customer and generates a script for them to run in their cloud environment to grant us access.
🟣 PATCH /cloud-connect-cspm-azure/entities/account/v1	Patches a existing account in our system for a customer.
🔴 DELETE /cloud-connect-cspm-azure/entities/account/v1	Deletes an Azure subscription from the system.
🟣 PATCH /cloud-connect-cspm-azure/entities/client-id/v1	Update an Azure service account in our system by with the user-created client_id created with the public key we've provided
🟣 PATCH /cloud-connect-cspm-azure/entities/default-subscription-id/v1	Update an Azure default subscription_id in our system for given tenant_id
🔵 GET /cloud-connect-cspm-azure/entities/download-certificate/v1	Returns JSON object(s) that contain the base64 encoded certificate for a service principal.
🔵 GET /cloud-connect-cspm-azure/entities/management-group/v1	Return information about Azure management group registration
🟢 POST /cloud-connect-cspm-azure/entities/management-group/v1	Creates a new management group in our system for a customer.
🔴 DELETE /cloud-connect-cspm-azure/entities/management-group/v1	Deletes Azure management groups from the system.
🟢 POST /cloud-connect-cspm-azure/entities/refresh-certificate/v1	Refresh certificate and returns JSON object(s) that contain the base64 encoded certificate for a service principal.
🔵 GET /cloud-connect-cspm-azure/entities/user-scripts-download/v1	Return a script for customer to run in their cloud environment to grant us access to their Azure environment as a downloadable attachment
🔵 GET /cloud-connect-cspm-gcp/entities/account/v1	Returns information about the current status of an GCP account.
🟢 POST /cloud-connect-cspm-gcp/entities/account/v1	Creates a new account in our system for a customer and generates a new service account for them to add access to in their GCP environment to grant us access.
🟣 PATCH /cloud-connect-cspm-gcp/entities/account/v1	Patches a existing account in our system for a customer.
🔴 DELETE /cloud-connect-cspm-gcp/entities/account/v1	Deletes a GCP account from the system.
🟢 POST /cloud-connect-cspm-gcp/entities/account/v2	Creates a new GCP account with newly-uploaded service account or connects with existing service account with only the following fields: parent_id, parent_type and service_account_id
🟢 POST /cloud-connect-cspm-gcp/entities/account/validate/v1	Run a synchronous health check.
🔵 GET /cloud-connect-cspm-gcp/entities/service-accounts/v1	Returns the service account id and client email for external clients.
🟣 PATCH /cloud-connect-cspm-gcp/entities/service-accounts/v1	Patches the service account key for external clients.
🟢 POST /cloud-connect-cspm-gcp/entities/service-accounts/validate/v1	Validates credentials for a service account
🔵 GET /cloud-connect-cspm-gcp/entities/user-scripts-download/v1	Return a script for customer to run in their cloud environment to grant us access to their GCP environment as a downloadable attachment
🔵 GET /detects/entities/ioa/v1	Get list of detected behaviors
🔵 GET /detects/entities/iom/v1	Get list of active misconfigurations. This endpoint is deprecated, please use /queries/iom/v2 and /entities/iom/v2 instead
🔵 GET /detects/entities/iom/v2	Get misconfigurations based on the ID - including custom policy detections in addition to default policy detections.
🔵 GET /detects/queries/cloud-events/v1	Deprecated: use cdrapi entities/event-details/v1 'logscale_related_events_query' instead. Get list of related cloud event LogScale IDs for a given IOA.
🔵 GET /detects/queries/iom/v2	Get list of active misconfiguration ids - including custom policy detections in addition to default policy detections.
🔵 GET /settings/entities/policy-details/v1	Given a policy ID, returns detailed policy information.
🔵 GET /settings/entities/policy-details/v2	Given an array of policy IDs, returns detailed policies information.
🔵 GET /settings/entities/policy/v1	Returns information about current policy settings.
🟣 PATCH /settings/entities/policy/v1	Updates a policy setting - can be used to override policy severity or to disable a policy entirely.
🔵 GET /settings/scan-schedule/v1	Returns scan schedule configuration for one or more cloud platforms.
🟢 POST /settings/scan-schedule/v1	Updates scan schedule configuration for one or more cloud platforms.

Custom Ioa

Endpoint	Description
🔵 GET /ioarules/entities/pattern-severities/v1	Get pattern severities by ID.
🔵 GET /ioarules/entities/platforms/v1	Get platforms by ID.
🔵 GET /ioarules/entities/rule-groups/v1	Get rule groups by ID.
🟢 POST /ioarules/entities/rule-groups/v1	Create a rule group for a platform with a name and an optional description. Returns the rule group.
🟣 PATCH /ioarules/entities/rule-groups/v1	Update a rule group. The following properties can be modified: name, description, enabled.
🔴 DELETE /ioarules/entities/rule-groups/v1	Delete rule groups by ID.
🔵 GET /ioarules/entities/rule-types/v1	Get rule types by ID.
🟢 POST /ioarules/entities/rules/GET/v1	Get rules by ID and optionally with cid and/or version in the following format: [cid:]ID[:version].
🔵 GET /ioarules/entities/rules/v1	Get rules by ID and optionally with cid and/or version in the following format: [cid:]ID[:version]. The max number of IDs is constrained by URL size.
🟢 POST /ioarules/entities/rules/v1	Create a rule within a rule group. Returns the rule.
🟣 PATCH /ioarules/entities/rules/v1	Update rules within a rule group. Return the updated rules.
🔴 DELETE /ioarules/entities/rules/v1	Delete rules from a rule group by ID.
🟣 PATCH /ioarules/entities/rules/v2	Update name, description, enabled or field_values for individual rules within a rule group. The v1 flavor of this call requires the caller to specify the complete state for all the rules in the rule group, instead the v2 flavor will accept the subset of rules in the rule group and apply the attribute updates to the subset of rules in the rule group.Return the updated rules.
🟢 POST /ioarules/entities/rules/validate/v1	Validates field values and checks for matches if a test string is provided.
🔵 GET /ioarules/queries/pattern-severities/v1	Get all pattern severity IDs.
🔵 GET /ioarules/queries/platforms/v1	Get all platform IDs.
🔵 GET /ioarules/queries/rule-groups-full/v1	Find all rule groups matching the query with optional filter.
🔵 GET /ioarules/queries/rule-groups/v1	Finds all rule group IDs matching the query with optional filter.
🔵 GET /ioarules/queries/rule-types/v1	Get all rule type IDs.
🔵 GET /ioarules/queries/rules/v1	Finds all rule IDs matching the query with optional filter.

Custom Storage

Endpoint	Description
🔵 GET /customobjects/v1/collections	List available collection names in alphabetical order
🟡 PUT /customobjects/v1/collections	Fetch metadata about one or more existing collections
🔵 GET /customobjects/v1/collections/{collection_name}	Fetch metadata about an existing collection
🔵 GET /customobjects/v1/collections/{collection_name}/{collection_version}/objects	List the object keys in the specified collection in alphabetical order
🟢 POST /customobjects/v1/collections/{collection_name}/{collection_version}/objects	Search for objects that match the specified filter criteria (returns metadata, not actual objects)
🔵 GET /customobjects/v1/collections/{collection_name}/{collection_version}/objects/{object_key}	Get the bytes for the specified object
🟡 PUT /customobjects/v1/collections/{collection_name}/{collection_version}/objects/{object_key}	Put the specified new object at the given key or overwrite an existing object at the given key
🔴 DELETE /customobjects/v1/collections/{collection_name}/{collection_version}/objects/{object_key}	Delete the specified versioned object
🔵 GET /customobjects/v1/collections/{collection_name}/{collection_version}/objects/{object_key}/metadata	Get the metadata for the specified object
🔵 GET /customobjects/v1/collections/{collection_name}/objects	List the object keys in the specified collection in alphabetical order
🟢 POST /customobjects/v1/collections/{collection_name}/objects	Search for objects that match the specified filter criteria (returns metadata, not actual objects)
🔵 GET /customobjects/v1/collections/{collection_name}/objects/{object_key}	Get the bytes for the specified object
🟡 PUT /customobjects/v1/collections/{collection_name}/objects/{object_key}	Put the specified new object at the given key or overwrite an existing object at the given key
🔴 DELETE /customobjects/v1/collections/{collection_name}/objects/{object_key}	Delete the specified object
🔵 GET /customobjects/v1/collections/{collection_name}/objects/{object_key}/metadata	Get the metadata for the specified object
🔵 GET /customobjects/v1/collections/{collection_name}/schemas	Get the list of schemas for the requested collection in reverse version order (latest first)
🔵 GET /customobjects/v1/collections/{collection_name}/schemas/{schema_version}	Get the bytes of the specified schema of the requested collection
🔵 GET /customobjects/v1/collections/{collection_name}/schemas/{schema_version}/metadata	Get the metadata for the specified schema of the requested collection

D4c Registration

Endpoint	Description
🔵 GET /cloud-connect-aws/entities/account/v2	Returns information about the current status of an AWS account.
🟢 POST /cloud-connect-aws/entities/account/v2	Creates a new account in our system for a customer and generates a script for them to run in their AWS cloud environment to grant us access.
🔴 DELETE /cloud-connect-aws/entities/account/v2	Deletes an existing AWS account or organization in our system.
🔵 GET /cloud-connect-aws/entities/console-setup-urls/v1	Return a URL for customer to visit in their cloud environment to grant us access to their AWS environment.
🔵 GET /cloud-connect-aws/entities/user-scripts-download/v1	Return a script for customer to run in their cloud environment to grant us access to their AWS environment as a downloadable attachment.
🔵 GET /cloud-connect-azure/entities/account/v1	Return information about Azure account registration
🟢 POST /cloud-connect-azure/entities/account/v1	Creates a new account in our system for a customer and generates a script for them to run in their cloud environment to grant us access.
🟣 PATCH /cloud-connect-azure/entities/client-id/v1	Update an Azure service account in our system by with the user-created client_id created with the public key we've provided
🔵 GET /cloud-connect-azure/entities/tenant-id/v1	Return available tenant ids for discover for cloud
🔵 GET /cloud-connect-azure/entities/user-scripts-download/v1	Return a script for customer to run in their cloud environment to grant us access to their Azure environment as a downloadable attachment
🔵 GET /cloud-connect-azure/entities/user-scripts/v1	Return a script for customer to run in their cloud environment to grant us access to their Azure environment
🔵 GET /cloud-connect-gcp/entities/account/v1	Returns information about the current status of an GCP account.
🟢 POST /cloud-connect-gcp/entities/account/v1	Creates a new account in our system for a customer and generates a new service account for them to add access to in their GCP environment to grant us access.
🔴 DELETE /cloud-connect-gcp/entities/account/v1	Deletes a GCP account from the system.
🟢 POST /cloud-connect-gcp/entities/account/v2	Creates a new GCP account with newly-uploaded service account or connects with existing service account with only the following fields: parent_id, parent_type and service_account_id
🔵 GET /cloud-connect-gcp/entities/service-accounts/v1	Returns the service account id and client email for external clients.
🟣 PATCH /cloud-connect-gcp/entities/service-accounts/v1	Patches the service account key for external clients.
🔵 GET /cloud-connect-gcp/entities/user-scripts-download/v1	Return a script for customer to run in their cloud environment to grant us access to their GCP environment as a downloadable attachment
🔵 GET /cloud-connect-gcp/entities/user-scripts/v1	Return a script for customer to run in their cloud environment to grant us access to their GCP environment
🔵 GET /settings-discover/entities/gen/scripts/v1	Returns static install scripts for Horizon.

Data Protection Configuration

Endpoint	Description
🔵 GET /data-protection/entities/classifications/v2	Gets the classifications that match the provided ids
🟢 POST /data-protection/entities/classifications/v2	Create classifications
🟣 PATCH /data-protection/entities/classifications/v2	Update classifications
🔴 DELETE /data-protection/entities/classifications/v2	Deletes classifications that match the provided ids
🔵 GET /data-protection/entities/cloud-applications/v1	Get a particular cloud-application
🟢 POST /data-protection/entities/cloud-applications/v1	Persist the given cloud application for the provided entity instance
🟣 PATCH /data-protection/entities/cloud-applications/v1	Update a cloud application
🔴 DELETE /data-protection/entities/cloud-applications/v1	Delete cloud application
🔵 GET /data-protection/entities/content-patterns/v1	Get a particular content-pattern(s)
🟢 POST /data-protection/entities/content-patterns/v1	Persist the given content pattern for the provided entity instance
🟣 PATCH /data-protection/entities/content-patterns/v1	Update a content pattern
🔴 DELETE /data-protection/entities/content-patterns/v1	Delete content pattern
🟢 POST /data-protection/entities/data-protection-precedence/v1	Update Policy Precedence
🔵 GET /data-protection/entities/enterprise-accounts/v1	Get a particular enterprise-account(s)
🟢 POST /data-protection/entities/enterprise-accounts/v1	Persist the given enterprise account for the provided entity instance
🟣 PATCH /data-protection/entities/enterprise-accounts/v1	Update a enterprise account
🔴 DELETE /data-protection/entities/enterprise-accounts/v1	Delete enterprise account
🔵 GET /data-protection/entities/file-types/v1	Get a particular file-type
🔵 GET /data-protection/entities/labels/v2	Get sensitivity label matching the IDs (V2)
🟢 POST /data-protection/entities/labels/v2	Create new sensitivity label (V2)
🔴 DELETE /data-protection/entities/labels/v2	Delete sensitivity labels matching the IDs (V2)
🔵 GET /data-protection/entities/local-application-groups/v1	Get specific local application groups
🟢 POST /data-protection/entities/local-application-groups/v1	Persist the given local application group for the provided entity instance
🟣 PATCH /data-protection/entities/local-application-groups/v1	Update a local application group
🔴 DELETE /data-protection/entities/local-application-groups/v1	Soft Delete local application. The application won't be visible anymore, but will still be in the database
🔵 GET /data-protection/entities/local-applications/v1	Get a particular local application
🟢 POST /data-protection/entities/local-applications/v1	Persist the given local application for the provided entity instance
🟣 PATCH /data-protection/entities/local-applications/v1	Update a local application
🔴 DELETE /data-protection/entities/local-applications/v1	Soft Delete local application. The application wont be visible anymore, but will still be in the database
🔵 GET /data-protection/entities/policies/v2	Gets policies that match the provided ids
🟢 POST /data-protection/entities/policies/v2	Create policies
🟣 PATCH /data-protection/entities/policies/v2	Update policies
🔴 DELETE /data-protection/entities/policies/v2	Deletes policies that match the provided ids
🔵 GET /data-protection/entities/web-location-groups/v2	Get specific web location groups
🟢 POST /data-protection/entities/web-location-groups/v2	Create a web location group
🟣 PATCH /data-protection/entities/web-location-groups/v2	Update a web location group
🔴 DELETE /data-protection/entities/web-location-groups/v2	Soft delete web location groups
🔵 GET /data-protection/entities/web-locations/v2	Get web-location entities matching the provided ID(s)
🟢 POST /data-protection/entities/web-locations/v2	Persist the given web-locations
🟣 PATCH /data-protection/entities/web-locations/v2	Update a web-location
🔴 DELETE /data-protection/entities/web-locations/v2	Delete web-location
🔵 GET /data-protection/queries/classifications/v2	Search for classifications that match the provided criteria
🔵 GET /data-protection/queries/cloud-applications/v2	Get all cloud-application IDs matching the query with filter
🔵 GET /data-protection/queries/content-patterns/v2	Get all content-pattern IDs matching the query with filter
🔵 GET /data-protection/queries/enterprise-accounts/v2	Get all enterprise-account IDs matching the query with filter
🔵 GET /data-protection/queries/file-types/v2	Get all file-type IDs matching the query with filter
🔵 GET /data-protection/queries/labels/v2	Get all sensitivity label IDs matching the query with filter
🔵 GET /data-protection/queries/local-application-groups/v1	Get all local application group IDs matching the query with filter
🔵 GET /data-protection/queries/local-applications/v1	Get all local-application IDs matching the query with filter
🔵 GET /data-protection/queries/policies/v2	Search for policies that match the provided criteria
🔵 GET /data-protection/queries/web-location-groups/v2	Get all web location group IDs matching the query with filter
🔵 GET /data-protection/queries/web-locations/v2	Get web-location IDs matching the query with filter

Delivery Settings

Endpoint	Description
🔵 GET /delivery-settings/entities/delivery-settings/v1	Get Delivery Settings
🟢 POST /delivery-settings/entities/delivery-settings/v1	Create Delivery Settings

Deployments

Endpoint	Description
🔵 GET /deployment-coordinator/entities/deployments/external/v1	Get deployment resources by ids

Detects

Endpoint	Description
🟢 POST /detects/aggregates/detects/GET/v1	Deprecated: This endpoint will be decommissioned on September 30, 2025. Please check the Notes section below for migration guidance.
🟣 PATCH /detects/entities/detects/v2	Deprecated: This endpoint will be decommissioned on September 30, 2025. Please check the Notes section below for migration guidance.
🟢 POST /detects/entities/summaries/GET/v1	Deprecated: This endpoint will be decommissioned on September 30, 2025. Please check the Notes section below for migration guidance.
🔵 GET /detects/queries/detects/v1	Deprecated: This endpoint will be decommissioned on September 30, 2025. Please check the Notes section below for migration guidance.

Device Content

Endpoint	Description
🔵 GET /device-content/entities/states/v1	Retrieve the host content state for a number of ids between 1 and 100.
🔵 GET /device-content/queries/states/v1	Query for the content state of the host.

Device Control Policies

Endpoint	Description
🔵 GET /policy/combined/device-control-members/v1	Search for members of a Device Control Policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria
🔵 GET /policy/combined/device-control/v1	Search for Device Control Policies in your environment by providing an FQL filter and paging details. Returns a set of Device Control Policies which match the filter criteria
🔵 GET /policy/entities/default-device-control/v1	Retrieve the configuration for a Default Device Control Policy
🟣 PATCH /policy/entities/default-device-control/v1	Update the configuration for a Default Device Control Policy
🟢 POST /policy/entities/device-control-actions/v1	Perform the specified action on the Device Control Policies specified in the request
🟣 PATCH /policy/entities/device-control-classes/v1	Update device control policy's classes
🔵 GET /policy/entities/device-control-default-settings/v1	Get default device control settings
🟣 PATCH /policy/entities/device-control-default-settings/v1	Update the configuration for Default Device Control Settings
🟢 POST /policy/entities/device-control-precedence/v1	Sets the precedence of Device Control Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence
🔵 GET /policy/entities/device-control/v1	Retrieve a set of Device Control Policies by specifying their IDs
🟢 POST /policy/entities/device-control/v1	Create Device Control Policies by specifying details about the policy to create
🟣 PATCH /policy/entities/device-control/v1	Update Device Control Policies by specifying the ID of the policy and details to update
🔴 DELETE /policy/entities/device-control/v1	Delete a set of Device Control Policies by specifying their IDs
🔵 GET /policy/entities/device-control/v2	Get device control policies for the given filter criteria.
🟢 POST /policy/entities/device-control/v2	Create/clone a device control policy
🟣 PATCH /policy/entities/device-control/v2	Update device control policy base
🔵 GET /policy/queries/device-control-members/v1	Search for members of a Device Control Policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria
🔵 GET /policy/queries/device-control/v1	Search for Device Control Policies in your environment by providing an FQL filter and paging details. Returns a set of Device Control Policy IDs which match the filter criteria

Discover

Endpoint	Description
🔵 GET /discover/combined/applications/v1	Search for applications in your environment by providing an FQL filter and paging details. Returns details on applications which match the filter criteria.
🔵 GET /discover/combined/hosts/v1	Search for assets in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns details on assets which match the filter criteria.
🔵 GET /discover/entities/accounts/v1	Get details on accounts by providing one or more IDs.
🔵 GET /discover/entities/applications/v1	Get details on applications by providing one or more IDs.
🔵 GET /discover/entities/hosts/v1	Get details on assets by providing one or more IDs.
🔵 GET /discover/entities/logins/v1	Get details on logins by providing one or more IDs.
🔵 GET /discover/queries/accounts/v1	Search for accounts in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of account IDs which match the filter criteria.
🔵 GET /discover/queries/applications/v1	Search for applications in your environment by providing an FQL filter and paging details. returns a set of application IDs which match the filter criteria.
🔵 GET /discover/queries/hosts/v1	Search for assets in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.
🔵 GET /discover/queries/logins/v1	Search for logins in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of login IDs which match the filter criteria.

Discover Iot

Endpoint	Description
🔵 GET /discover/entities/iot-hosts/v1	Get details on IoT assets by providing one or more IDs.
🔵 GET /discover/queries/iot-hosts/v1	Search for IoT assets in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.
🔵 GET /discover/queries/iot-hosts/v2	Search for IoT assets in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.

Downloads Api

Endpoint	Description
🔵 GET /csdownloads/combined/files-download/v1	Get files info and pre-signed download URLs
🔵 GET /csdownloads/combined/files-download/v2	Get cloud security tools info and pre-signed download URLs
🔵 GET /csdownloads/entities/files/download/v1	Gets pre-signed URL for the file
🔵 GET /csdownloads/entities/files/enumerate/v1	Enumerates a list of files available for CID

Drift Indicators

Endpoint	Description
🔵 GET /container-security/aggregates/drift-indicators/count-by-date/v1	Returns the count of Drift Indicators by the date. by default it's for 7 days.
🔵 GET /container-security/aggregates/drift-indicators/count/v1	Returns the total count of Drift indicators over a time period
🔵 GET /container-security/combined/drift-indicators/v1	Retrieve Drift Indicators by the provided search criteria
🔵 GET /container-security/entities/drift-indicators/v1	Retrieve Drift Indicator entities identified by the provided IDs
🔵 GET /container-security/queries/drift-indicators/v1	Retrieve all drift indicators that match the given query

Event Schema

Endpoint	Description
🔵 GET /fdr/combined/schema-members/v1	Fetch combined schema
🔵 GET /fdr/entities/schema-events/v1	Fetch event schema by ID
🔵 GET /fdr/queries/schema-events/v1	Get list of event IDs given a particular query.

Event Streams

Endpoint	Description
🟢 POST /sensors/entities/datafeed-actions/v1/{partition}	Refresh an active event stream. Use the URL shown in a GET /sensors/entities/datafeed/v2 response.
🔵 GET /sensors/entities/datafeed/v2	Discover all event streams in your environment

Execution

Endpoint	Description
🔵 GET /faas-gateway/entities/execution-request-body/v2	retrieve a large request body, such as a file, that has spilled into object storage

Exposure Management

Endpoint	Description
🟢 POST /fem/aggregates/external-assets/v1	Returns external assets aggregates.
🔵 GET /fem/combined/ecosystem-subsidiaries/v1	Retrieves a list of ecosystem subsidiaries with their detailed information.
🔵 GET /fem/entities/blobs-download/v1	Download the entire contents of the blob. The relative link to this endpoint is returned in the GET /entities/external-assets/v1 request.
🔵 GET /fem/entities/blobs-preview/v1	Download a preview of the blob. The relative link to this endpoint is returned in the GET /entities/external-assets/v1 request.
🔵 GET /fem/entities/ecosystem-subsidiaries/v1	Retrieves detailed information about ecosystem subsidiaries by ID.
🟢 POST /fem/entities/external-asset-inventory/v1	Add external assets for external asset scanning.
🔵 GET /fem/entities/external-assets/v1	Get details on external assets by providing one or more IDs.
🟣 PATCH /fem/entities/external-assets/v1	Update the details of external assets.
🔴 DELETE /fem/entities/external-assets/v1	Delete multiple external assets.
🔵 GET /fem/queries/ecosystem-subsidiaries/v1	Retrieves a list of IDs for ecosystem subsidiaries. Use these IDs with the /entities/ecosystem-subsidiaries/v1 endpoints.
🔵 GET /fem/queries/external-assets/v1	Get a list of external asset IDs that match the provided filter conditions. Use these IDs with the /entities/external-assets/v1 endpoints
🔵 GET /fem/queries/external-assets/v2	Get a list of external asset IDs that match the provided filter conditions. Use these IDs with the /entities/external-assets/v1 endpoint

Falcon Complete Dashboard

Endpoint	Description
🟢 POST /falcon-complete-dashboards/aggregates/alerts/GET/v1	Retrieve aggregate epp alerts values based on the matched filter
🟢 POST /falcon-complete-dashboards/aggregates/allowlist/GET/v1	Retrieve aggregate allowlist ticket values based on the matched filter
🟢 POST /falcon-complete-dashboards/aggregates/blocklist/GET/v1	Retrieve aggregate blocklist ticket values based on the matched filter
🟢 POST /falcon-complete-dashboards/aggregates/devicecount-collections/GET/v1	Retrieve aggregate host/devices count based on the matched filter
🟢 POST /falcon-complete-dashboards/aggregates/escalations/GET/v1	Retrieve aggregate escalation ticket values based on the matched filter
🟢 POST /falcon-complete-dashboards/aggregates/prevention-policies/v1	Retrieve prevention policies aggregate values based on the matched filter
🟢 POST /falcon-complete-dashboards/aggregates/remediations/GET/v1	Retrieve aggregate remediation ticket values based on the matched filter
🟢 POST /falcon-complete-dashboards/aggregates/sensor-update-policies/v1	Retrieve sensor update policies aggregate values
🟢 POST /falcon-complete-dashboards/aggregates/support-issues/v1	Retrieve aggregate support issue ticket values based on the matched filter
🟢 POST /falcon-complete-dashboards/aggregates/total-device-counts/v1	Retrieve aggregate total host/devices based on the matched filter
🔵 GET /falcon-complete-dashboards/queries/alerts/v1	Retrieve Alerts Ids for epp that match the provided FQL filter criteria with scrolling enabled
🔵 GET /falcon-complete-dashboards/queries/alerts/v2	Retrieve Alerts Ids for epp, idp and ngsiem that match the provided FQL filter criteria with scrolling enabled
🔵 GET /falcon-complete-dashboards/queries/allowlist/v1	Retrieve allowlist tickets that match the provided filter criteria with scrolling enabled
🔵 GET /falcon-complete-dashboards/queries/blocklist/v1	Retrieve block listtickets that match the provided filter criteria with scrolling enabled
🔵 GET /falcon-complete-dashboards/queries/devicecount-collections/v1	Retrieve device count collection Ids that match the provided FQL filter, criteria with scrolling enabled
🔵 GET /falcon-complete-dashboards/queries/escalations/v1	Retrieve escalation tickets that match the provided filter criteria with scrolling enabled
🔵 GET /falcon-complete-dashboards/queries/remediations/v1	Retrieve remediation tickets that match the provided filter criteria with scrolling enabled

Falcon Container

Endpoint	Description
🔵 GET /container-security/entities/image-registry-credentials/v1	Gets the registry credentials

Falcon Container Cli

Endpoint	Description
🟢 POST /image-assessment/combined/vulnerability-lookups/v1	Retrieve known vulnerabilities for the provided image

Falcon Container Image

Endpoint	Description
🔵 GET /container-security/entities/exports/files/v1	Download an export file
🔵 GET /container-security/entities/exports/v1	Read export jobs entities
🟢 POST /container-security/entities/exports/v1	Launch an export job of a Container Security resource. Maximum of 1 job in progress per resource
🔵 GET /container-security/entities/registries/v1	Retrieves a list of registry entities by the provided UUIDs. Maximum page size: 100
🟢 POST /container-security/entities/registries/v1	Create a registry entity using the provided details
🟣 PATCH /container-security/entities/registries/v1	Update the registry entity, as identified by the entity UUID, using the provided details
🔴 DELETE /container-security/entities/registries/v1	Delete the registry entity identified by the entity UUID
🔵 GET /container-security/queries/exports/v1	Query export jobs entities
🔵 GET /container-security/queries/registries/v1	Retrieves a list of registry entities identified by the customer id. Maximum page size: 5,000
🟢 POST /image-assessment/entities/image-inventory/v1	Post image scan inventory
⚪ HEAD /image-assessment/entities/image-inventory/v1	Get headers for POST request for image scan inventory
🔵 GET /image-assessment/entities/policy-checks/v2	Check image prevention policies
🔵 GET /image-assessment/entities/reports/v2	Get image assessment scan report by image reference (v2)
🔵 GET /image-assessment/entities/reports/v2/{uuid}	Get image assessment scan report by scan UUID (v2)

Falcon Id

Endpoint	Description
🔵 GET /falcon-id/entities/third-party-passkeys/v1	Fetches third party passkey registries
🟣 PATCH /falcon-id/entities/third-party-passkeys/v1	Updates third party passkey registries
🔴 DELETE /falcon-id/entities/third-party-passkeys/v1	Deletes third party passkey registries
🔵 GET /falcon-id/queries/third-party-passkeys/v1	Query third party passkey registries

Falconx Sandbox

Endpoint	Description
🔵 GET /falconx/entities/artifacts/v1	Download IOC packs, PCAP files, memory dumps, and other analysis artifacts.
🔵 GET /falconx/entities/memory-dump/extracted-strings/v1	Get extracted strings from a memory dump
🔵 GET /falconx/entities/memory-dump/hex-dump/v1	Get hex view of a memory dump
🔵 GET /falconx/entities/memory-dump/v1	Get memory dump content, as binary
🔵 GET /falconx/entities/report-summaries/v1	Get a short summary version of a sandbox report.
🔵 GET /falconx/entities/reports/v1	Get a full sandbox report.
🔴 DELETE /falconx/entities/reports/v1	Delete report based on the report ID. Operation can be checked for success by polling for the report ID on the report-summaries endpoint.
🔵 GET /falconx/entities/submissions/v1	Check the status of a sandbox analysis. Time required for analysis varies but is usually less than 15 minutes.
🟢 POST /falconx/entities/submissions/v1	Submit an uploaded file or a URL for sandbox analysis. Time required for analysis varies but is usually less than 15 minutes.
🔵 GET /falconx/queries/reports/v1	Find sandbox reports by providing an FQL filter and paging details. Returns a set of report IDs that match your criteria.
🔵 GET /falconx/queries/submissions/v1	Find submission IDs for uploaded files by providing an FQL filter and paging details. Returns a set of submission IDs that match your criteria.
🔵 GET /samples/entities/samples/v2	Retrieves the file associated with the given ID (SHA256)
🟢 POST /samples/entities/samples/v2	Upload a file for sandbox analysis. After uploading, use /falconx/entities/submissions/v1 to start analyzing the file.
🔴 DELETE /samples/entities/samples/v2	Removes a sample, including file, meta and submissions from the collection
🟢 POST /samples/queries/samples/GET/v1	Retrieves a list with sha256 of samples that exist and customer has rights to access them, maximum number of accepted items is 200

Federated Connections

Endpoint	Description
🟢 POST /ngsiem/entities/federated-connections-config/v1	Create configuration for a federated connection
🟣 PATCH /ngsiem/entities/federated-connections-config/v1	Update configuration for a federated connection
🔴 DELETE /ngsiem/entities/federated-connections-config/v1	Delete configuration for a federated connection

Field Schema

Endpoint	Description
🔵 GET /fdr/entities/schema-fields/v1	Fetch field schema by ID
🔵 GET /fdr/queries/schema-fields/v1	Get list of field IDs given a particular query.

Filevantage

Endpoint	Description
🔵 GET /filevantage/entities/actions/v1	Retrieves the processing results for 1 or more actions.
🟢 POST /filevantage/entities/actions/v1	Initiates the specified action on the provided change ids
🔵 GET /filevantage/entities/change-content/v1	Retrieves the content captured for the provided change id
🔵 GET /filevantage/entities/changes/v2	Retrieve information on changes
🟣 PATCH /filevantage/entities/policies-host-groups/v1	Manage host groups assigned to a policy.
🟣 PATCH /filevantage/entities/policies-precedence/v1	Updates the policy precedence for all policies of a specific type.
🟣 PATCH /filevantage/entities/policies-rule-groups/v1	Manage the rule groups assigned to the policy or set the rule group precedence for all rule groups within the policy.
🔵 GET /filevantage/entities/policies/v1	Retrieves the configuration for 1 or more policies.
🟢 POST /filevantage/entities/policies/v1	Creates a new policy of the specified type. New policies are always added at the end of the precedence list for the provided policy type.
🟣 PATCH /filevantage/entities/policies/v1	Updates the general information of the provided policy.
🔴 DELETE /filevantage/entities/policies/v1	Deletes 1 or more policies.
🔵 GET /filevantage/entities/policy-scheduled-exclusions/v1	Retrieves the configuration of 1 or more scheduled exclusions from the provided policy id.
🟢 POST /filevantage/entities/policy-scheduled-exclusions/v1	Creates a new scheduled exclusion configuration for the provided policy id.
🟣 PATCH /filevantage/entities/policy-scheduled-exclusions/v1	Updates the provided scheduled exclusion configuration within the provided policy.
🔴 DELETE /filevantage/entities/policy-scheduled-exclusions/v1	Deletes 1 or more scheduled exclusions from the provided policy id.
🟣 PATCH /filevantage/entities/rule-groups-rule-precedence/v1	Updates the rule precedence for all rules in the identified rule group.
🔵 GET /filevantage/entities/rule-groups-rules/v1	Retrieves the configuration for 1 or more rules.
🟢 POST /filevantage/entities/rule-groups-rules/v1	Creates a new rule configuration within the specified rule group.
🟣 PATCH /filevantage/entities/rule-groups-rules/v1	Updates the provided rule configuration within the specified rule group.
🔴 DELETE /filevantage/entities/rule-groups-rules/v1	Deletes 1 or more rules from the specified rule group.
🔵 GET /filevantage/entities/rule-groups/v1	Retrieves the rule group details for 1 or more rule groups.
🟢 POST /filevantage/entities/rule-groups/v1	Creates a new rule group of the specified type.
🟣 PATCH /filevantage/entities/rule-groups/v1	Updates the provided rule group.
🔴 DELETE /filevantage/entities/rule-groups/v1	Deletes 1 or more rule groups
🟢 POST /filevantage/entities/workflow/v1	Initiates workflows for the provided change ids
🔵 GET /filevantage/queries/actions/v1	Returns one or more action ids
🔵 GET /filevantage/queries/changes/v2	Returns 1 or more change ids
🔵 GET /filevantage/queries/changes/v3	Returns 1 or more change ids
🔵 GET /filevantage/queries/policies/v1	Retrieve the ids of all policies that are assigned the provided policy type.
🔵 GET /filevantage/queries/policy-scheduled-exclusions/v1	Retrieve the ids of all scheduled exclusions contained within the provided policy id.
🔵 GET /filevantage/queries/rule-groups/v1	Retrieve the ids of all rule groups that are of the provided rule group type.

Firewall Management

Endpoint	Description
🟢 POST /fwmgr/aggregates/events/GET/v1	Aggregate events for customer
🟢 POST /fwmgr/aggregates/policy-rules/GET/v1	Aggregate rules within a policy for customer
🟢 POST /fwmgr/aggregates/rule-groups/GET/v1	Aggregate rule groups for customer
🟢 POST /fwmgr/aggregates/rules/GET/v1	Aggregate rules for customer
🔵 GET /fwmgr/entities/events/v1	Get events entities by ID and optionally version
🔵 GET /fwmgr/entities/firewall-fields/v1	Get the firewall field specifications by ID
🔵 GET /fwmgr/entities/network-locations-details/v1	Get network locations entities by ID
🟢 POST /fwmgr/entities/network-locations-metadata/v1	Updates the network locations metadata such as polling_intervals for the cid
🟢 POST /fwmgr/entities/network-locations-precedence/v1	Updates the network locations precedence according to the list of ids provided.
🔵 GET /fwmgr/entities/network-locations/v1	Get a summary of network locations entities by ID
🟢 POST /fwmgr/entities/network-locations/v1	Create new network locations provided, and return the ID.
🟡 PUT /fwmgr/entities/network-locations/v1	Updates the network locations provided, and return the ID.
🟣 PATCH /fwmgr/entities/network-locations/v1	Updates the network locations provided, and return the ID.
🔴 DELETE /fwmgr/entities/network-locations/v1	Delete network location entities by ID.
🔵 GET /fwmgr/entities/platforms/v1	Get platforms by ID, e.g., windows or mac or droid
🔵 GET /fwmgr/entities/policies/v1	Get policy container entities by policy ID
🟡 PUT /fwmgr/entities/policies/v1	Update an identified policy container. WARNING: This endpoint is deprecated in favor of v2, using this endpoint could disable your local logging setting.
🟡 PUT /fwmgr/entities/policies/v2	Update an identified policy container, including local logging functionality.
🔵 GET /fwmgr/entities/rule-groups/v1	Get rule group entities by ID. These groups do not contain their rule entites, just the rule IDs in precedence order.
🟢 POST /fwmgr/entities/rule-groups/v1	Create new rule group on a platform for a customer with a name and description, and return the ID
🟣 PATCH /fwmgr/entities/rule-groups/v1	Update name, description, or enabled status of a rule group, or create, edit, delete, or reorder rules
🔴 DELETE /fwmgr/entities/rule-groups/v1	Delete rule group entities by ID
🟢 POST /fwmgr/entities/rule-groups/validation/v1	Validates the request of creating a new rule group on a platform for a customer with a name and description
🟣 PATCH /fwmgr/entities/rule-groups/validation/v1	Validates the request of updating name, description, or enabled status of a rule group, or create, edit, delete, or reorder rules
🔵 GET /fwmgr/entities/rules/v1	Get rule entities by ID (64-bit unsigned int as decimal string) or Family ID (32-character hexadecimal string)
🟢 POST /fwmgr/entities/rules/validate-filepath/v1	Validates that the test pattern matches the executable filepath glob pattern.
🔵 GET /fwmgr/queries/events/v1	Find all event IDs matching the query with filter
🔵 GET /fwmgr/queries/firewall-fields/v1	Get the firewall field specification IDs for the provided platform
🔵 GET /fwmgr/queries/network-locations/v1	Get a list of network location IDs
🔵 GET /fwmgr/queries/platforms/v1	Get the list of platform names
🔵 GET /fwmgr/queries/policy-rules/v1	Find all firewall rule IDs matching the query with filter, and return them in precedence order
🔵 GET /fwmgr/queries/rule-groups/v1	Find all rule group IDs matching the query with filter
🔵 GET /fwmgr/queries/rules/v1	Find all rule IDs matching the query with filter

Firewall Policies

Endpoint	Description
🔵 GET /policy/combined/firewall-members/v1	Search for members of a Firewall Policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria
🔵 GET /policy/combined/firewall/v1	Search for Firewall Policies in your environment by providing an FQL filter and paging details. Returns a set of Firewall Policies which match the filter criteria
🟢 POST /policy/entities/firewall-actions/v1	Perform the specified action on the Firewall Policies specified in the request
🟢 POST /policy/entities/firewall-precedence/v1	Sets the precedence of Firewall Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence
🔵 GET /policy/entities/firewall/v1	Retrieve a set of Firewall Policies by specifying their IDs
🟢 POST /policy/entities/firewall/v1	Create Firewall Policies by specifying details about the policy to create
🟣 PATCH /policy/entities/firewall/v1	Update Firewall Policies by specifying the ID of the policy and details to update
🔴 DELETE /policy/entities/firewall/v1	Delete a set of Firewall Policies by specifying their IDs
🔵 GET /policy/queries/firewall-members/v1	Search for members of a Firewall Policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria
🔵 GET /policy/queries/firewall/v1	Search for Firewall Policies in your environment by providing an FQL filter and paging details. Returns a set of Firewall Policy IDs which match the filter criteria

Forensics

Endpoint	Description
🔵 GET /forensics/aggregate/collection-counts-by/v1	Get Collection counts by field names: collection_tag and state
🔵 GET /forensics/combined/collections/v1	Get Collections with given IDs, Platform, Agent/Collector IDs, States
🔵 GET /forensics/combined/collectors/v1	Get collectors for the given Customer ID
🔵 GET /forensics/combined/configurations/v1	Get Configurations for the given Customer ID
🔵 GET /forensics/combined/templates/v1	Get Templates with the given IDs
🟢 POST /forensics/entities/collections-validate/v1	Validates a configuration collection
🔵 GET /forensics/entities/collections/v1	Get Collections with given IDs, Platform, Agent/Collector IDs, States
🟢 POST /forensics/entities/collections/v1	Create Collections
🟡 PUT /forensics/entities/collections/v1	Update Collections
🔴 DELETE /forensics/entities/collections/v1	Cancel Collections
🟢 POST /forensics/entities/collectors-deploy/v1	deploy collector to managed endpoints
🟢 POST /forensics/entities/collectors-shutdown/v1	shutdown collectors with self_destruct option
🔵 GET /forensics/entities/collectors/v1	Get collectors
🔵 GET /forensics/entities/configuration-download/v1	Download offline Configuration file using ID
🟢 POST /forensics/entities/configurations-validate/v1	Validates a custom configuration
🔵 GET /forensics/entities/configurations/v1	Get Configurations with the given IDs
🟢 POST /forensics/entities/configurations/v1	Creates a new custom configuration
🟡 PUT /forensics/entities/configurations/v1	Creates or replaces an existing custom configuration
🔴 DELETE /forensics/entities/configurations/v1	Retires a custom configuration
🔵 GET /forensics/entities/templates/v1	Get Templates with the given IDs
🔵 GET /forensics/queries/collections/v1	Search Collections for the given Customer ID and/or Platform in states
🔵 GET /forensics/queries/collectors/v1	Search Collectors for the given Customer ID and Platform
🔵 GET /forensics/queries/configurations/v1	Search Configurations for the given Customer ID
🔵 GET /forensics/queries/templates/v1	Search Templates

Foundry Logscale

Endpoint	Description
🔵 GET /loggingapi/combined/repos/v1	Lists available repositories
🟢 POST /loggingapi/entities/data-ingestion/ingest-async/v1	Asynchronously ingest data into the application repository
🟢 POST /loggingapi/entities/data-ingestion/ingest/v1	Synchronously ingest data into the application repository
🟢 POST /loggingapi/entities/saved-searches-dynamic-execute/v1	Execute a dynamic saved search
🔵 GET /loggingapi/entities/saved-searches-execute/v1	Get the results of a saved search
🟢 POST /loggingapi/entities/saved-searches-execute/v1	Execute a saved search
🟢 POST /loggingapi/entities/saved-searches-ingest/v1	Populate a saved search
🔵 GET /loggingapi/entities/saved-searches-job-results-download/v1	Get the results of a saved search as a file
🟢 POST /loggingapi/entities/saved-searches/execute-dynamic/v1	Execute a dynamic saved search
🔵 GET /loggingapi/entities/saved-searches/execute/v1	Get the results of a saved search
🟢 POST /loggingapi/entities/saved-searches/execute/v1	Execute a saved search
🟢 POST /loggingapi/entities/saved-searches/ingest/v1	Populate a saved search
🔵 GET /loggingapi/entities/saved-searches/job-results-download/v1	Get the results of a saved search as a file
🔵 GET /loggingapi/entities/views/v1	List available views

Foundry Lookup Files

Endpoint	Description
🟢 POST /loggingapi/entities/lookup-files/v1	Creates a lookup file within a foundry app
🟣 PATCH /loggingapi/entities/lookup-files/v1	Updates a lookup file within a Foundry app

Host Group

Endpoint	Description
🔵 GET /devices/combined/host-group-members/v1	Search for members of a Host Group in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria
🔵 GET /devices/combined/host-groups/v1	Search for Host Groups in your environment by providing an FQL filter and paging details. Returns a set of Host Groups which match the filter criteria
🟢 POST /devices/entities/host-group-actions/v1	Perform the specified action on the Host Groups specified in the request
🔵 GET /devices/entities/host-groups/v1	Retrieve a set of Host Groups by specifying their IDs
🟢 POST /devices/entities/host-groups/v1	Create Host Groups by specifying details about the group to create
🟣 PATCH /devices/entities/host-groups/v1	Update Host Groups by specifying the ID of the group and details to update
🔴 DELETE /devices/entities/host-groups/v1	Delete a set of Host Groups by specifying their IDs
🔵 GET /devices/queries/host-group-members/v1	Search for members of a Host Group in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria
🔵 GET /devices/queries/host-groups/v1	Search for Host Groups in your environment by providing an FQL filter and paging details. Returns a set of Host Group IDs which match the filter criteria

Host Migration

Endpoint	Description
🟢 POST /host-migration/aggregates/host-migrations/v1	Get host migration aggregates as specified via json in request body.
🟢 POST /host-migration/aggregates/migrations/v1	Get migration aggregates as specified via json in request body.
🟢 POST /host-migration/entities/host-migrations-actions/v1	Perform an action on host migrations.
🟢 POST /host-migration/entities/host-migrations/GET/v1	Get host migration details.
🟢 POST /host-migration/entities/migration-destinations/GET/v1	Get destinations for a migration.
🟢 POST /host-migration/entities/migrations-actions/v1	Perform an action on a migration job.
🔵 GET /host-migration/entities/migrations/v1	Get migration job details.
🟢 POST /host-migration/entities/migrations/v1	Create a device migration job.
🔵 GET /host-migration/queries/host-migrations/v1	Query host migration IDs.
🔵 GET /host-migration/queries/migrations/v1	Query migration jobs.

Hosts

Endpoint	Description
🔵 GET /devices/combined/devices-hidden/v1	Search for hidden hosts in your environment by platform, hostname, IP, and other criteria. Returns full device records.
🟢 POST /devices/combined/devices/login-history/v1	Retrieve details about recent login sessions for a set of devices.
🟢 POST /devices/combined/devices/login-history/v2	Retrieve details about recent interactive login sessions for a set of devices powered by the Host Timeline. A max of 10 device ids can be specified
🟢 POST /devices/combined/devices/network-address-history/v1	Retrieve history of IP and MAC addresses of devices.
🔵 GET /devices/combined/devices/v1	Search for hosts in your environment by platform, hostname, IP, and other criteria. Returns full device records.
🟢 POST /devices/entities/devices-actions-delete/v1	Permanently delete hosts from the system.
🟢 POST /devices/entities/devices-actions/v2	Take various actions on the hosts in your environment. Contain or lift containment on a host. Hide or unhide a host.
🟣 PATCH /devices/entities/devices/tags/v1	Append or remove one or more Falcon Grouping Tags on one or more hosts. Tags must be of the form FalconGroupingTags/
🔵 GET /devices/entities/devices/v2	Get details on one or more hosts by providing host IDs as a query parameter. Supports up to a maximum 100 IDs.
🟢 POST /devices/entities/devices/v2	Get details on one or more hosts by providing host IDs in a POST body. Supports up to a maximum 5000 IDs.
🟢 POST /devices/entities/group-actions/v1	Performs the specified action on the provided group IDs.
🔵 GET /devices/entities/online-state/v1	Get the online status for one or more hosts by specifying each host’s unique ID. Successful requests return an HTTP 200 response and the status for each host identified by a state of online, offline, or unknown for each host, identified by host id. Make a GET request to /devices/queries/devices/v1 to get a list of host IDs.
🔵 GET /devices/queries/devices-hidden/v1	Retrieve hidden hosts that match the provided filter criteria.
🔵 GET /devices/queries/devices-scroll/v1	Search for hosts in your environment by platform, hostname, IP, and other criteria with continuous pagination capability (based on offset pointer which expires after 2 minutes with no maximum limit)
🔵 GET /devices/queries/devices/v1	Search for hosts in your environment by platform, hostname, IP, and other criteria.

Identity Entities

Endpoint	Description
🟢 POST /identity-protection/aggregates/devices/GET/v1	Get sensor aggregates as specified via json in request body.
🟢 POST /identity-protection/entities/devices/GET/v1	Get details on one or more sensors by providing device IDs in a POST body. Supports up to a maximum of 5000 IDs.
🔵 GET /identity-protection/queries/devices/v1	Search for sensors in your environment by hostname, IP, and other criteria.

Identity Protection

Endpoint	Description
🟢 POST /identity-protection/combined/graphql/v1	Identity Protection GraphQL API. Allows to retrieve entities, timeline activities, identity-based incidents and security assessment. Allows to perform actions on entities and identity-based incidents.
🔵 GET /identity-protection/entities/policy-rules/v1	Get policy rules
🟢 POST /identity-protection/entities/policy-rules/v1	Create policy rule
🔴 DELETE /identity-protection/entities/policy-rules/v1	Delete policy rules
🔵 GET /identity-protection/queries/policy-rules/v1	Query policy rule IDs

Image Assessment Policies

Endpoint	Description
🔵 GET /container-security/entities/image-assessment-policies/v1	Get all Image Assessment policies
🟢 POST /container-security/entities/image-assessment-policies/v1	Create Image Assessment policies
🟣 PATCH /container-security/entities/image-assessment-policies/v1	Update Image Assessment Policy entities
🔴 DELETE /container-security/entities/image-assessment-policies/v1	Delete Image Assessment Policy by policy UUID
🔵 GET /container-security/entities/image-assessment-policy-exclusions/v1	Retrieve Image Assessment Policy Exclusion entities
🟢 POST /container-security/entities/image-assessment-policy-exclusions/v1	Update Image Assessment Policy Exclusion entities
🔵 GET /container-security/entities/image-assessment-policy-groups/v1	Retrieve Image Assessment Policy Group entities
🟢 POST /container-security/entities/image-assessment-policy-groups/v1	Create Image Assessment Policy Group entities
🟣 PATCH /container-security/entities/image-assessment-policy-groups/v1	Update Image Assessment Policy Group entities
🔴 DELETE /container-security/entities/image-assessment-policy-groups/v1	Delete Image Assessment Policy Group entities
🟢 POST /container-security/entities/image-assessment-policy-precedence/v1	Update Image Assessment Policy precedence

Installation Tokens

Endpoint	Description
🔵 GET /installation-tokens/entities/audit-events/v1	Gets the details of one or more audit events by id.
🔵 GET /installation-tokens/entities/customer-settings/v1	Check current installation token settings.
🔵 GET /installation-tokens/entities/tokens/v1	Gets the details of one or more tokens by id.
🟢 POST /installation-tokens/entities/tokens/v1	Creates a token.
🟣 PATCH /installation-tokens/entities/tokens/v1	Updates one or more tokens. Use this endpoint to edit labels, change expiration, revoke, or restore.
🔴 DELETE /installation-tokens/entities/tokens/v1	Deletes a token immediately. To revoke a token, use PATCH /installation-tokens/entities/tokens/v1 instead.
🔵 GET /installation-tokens/queries/audit-events/v1	Search for audit events by providing an FQL filter and paging details.
🔵 GET /installation-tokens/queries/tokens/v1	Search for tokens by providing an FQL filter and paging details.

Installation Tokens Settings

Endpoint	Description
🟣 PATCH /installation-tokens/entities/customer-settings/v1	Update installation token settings.

Intel

Endpoint	Description
🟢 POST /intel/aggregates/incidents/v1	Perform statistical aggregations over incident data. Available aggregation properties: TargetIndustries.Name, MitreAttack.TacticId, MitreAttack.TechniqueId, MitreAttack.TechniqueName, PublishDate, ActivityStart, ActivityEnd, Id, Motivations.Slug, InvolvesAdversaries.Slug, TargetRegions.Slug, Objectives.Slug, InvolvesAdversaries.AnimalClassifier, InvolvesThreats.FamilyName, TargetCountries.Slug, TargetCountries.Name, TargetIndustries.Slug, TargetRegions.Name, MitreAttack.TacticName.
🔵 GET /intel/combined/actors/v1	Get info about actors that match provided FQL filters.
🔵 GET /intel/combined/indicators/v1	Get info about indicators that match provided FQL filters.
🔵 GET /intel/combined/malware/v1	Get malware entities that match provided FQL filters.
🔵 GET /intel/combined/reports/v1	Get info about reports that match provided FQL filters.
🔵 GET /intel/entities/actors/v1	Retrieve specific actors using their actor IDs.
🟢 POST /intel/entities/incidents/GET/v1	Retrieve full details for one or more adversary incidents by their IDs. Returns complete incident data including adversary activity, timestamps, and associated metadata.
🟢 POST /intel/entities/indicators/GET/v1	Retrieve specific indicators using their indicator IDs.
🔵 GET /intel/entities/malware-mitre-reports/v1	Export Mitre ATT&CK information for a given malware family.
🔵 GET /intel/entities/malware/v1	Get malware entities for specified ids.
🔵 GET /intel/entities/mitre-reports/v1	Export Mitre ATT&CK information for a given actor.
🟢 POST /intel/entities/mitre/v1	Retrieves report and observable IDs associated with the given actor and attacks
🔵 GET /intel/entities/report-files/v1	Return a Report PDF attachment
🔵 GET /intel/entities/reports/v1	Retrieve specific reports using their report IDs.
🔵 GET /intel/entities/rules-files/v1	Download earlier rule sets.
🔵 GET /intel/entities/rules-latest-files/v1	Download the latest rule set.
🔵 GET /intel/entities/rules/v1	Retrieve details for rule sets for the specified ids.
🟢 POST /intel/entities/vulnerabilities/GET/v1	Get vulnerabilities
🔵 GET /intel/queries/actors/v1	Get actor IDs that match provided FQL filters.
🔵 GET /intel/queries/incidents/v1	Search for adversary incidents using FQL criteria and return a paginated list of matching incident IDs. Use the returned IDs with the entities endpoint to retrieve full incident details.
🔵 GET /intel/queries/indicators/v1	Get indicators IDs that match provided FQL filters.
🔵 GET /intel/queries/malware/v1	Get malware family names that match provided FQL filters.
🔵 GET /intel/queries/mitre-malware/v1	Gets MITRE tactics and techniques for the given malware
🔵 GET /intel/queries/mitre/v1	Gets MITRE tactics and techniques for the given actor, returning concatenation of id and tactic and technique ids, example: fancy-bear_TA0011_T1071
🔵 GET /intel/queries/reports/v1	Get report IDs that match provided FQL filters.
🔵 GET /intel/queries/rules/v1	Search for rule IDs that match provided filter criteria.
🔵 GET /intel/queries/vulnerabilities/v1	Get vulnerabilities IDs

Intelligence Feeds

Endpoint	Description
🔵 GET /indicator-feed/entities/feed-download/v1	Downloads the content as a zip archive for a given feed item ID
🔵 GET /indicator-feed/entities/feed/v1	Lists the accessible feed types for a given customer
🔵 GET /indicator-feed/queries/feed/v1	Queries the accessible feed types for a customer. Returns a list of feed item IDs which can be later downloaded

Intelligence Indicator Graph

Endpoint	Description
🟢 POST /intelligence/combined/indicators/v1	Search indicators based on FQL filter.
🟢 POST /intelligence/combined/lookup-indicators/v1	Get indicators based on their value.

Ioa Exclusions

Endpoint	Description
🟢 POST /exclusions/aggregates/ss-ioa-exclusions/GET/v2	Get Self Service IOA Exclusion aggregates as specified via json in the request body.
🟢 POST /exclusions/entities/ss-ioa-exclusions/reports/v2	Create a report of Self Service IOA Exclusions scoped by the given filters
🔵 GET /exclusions/entities/ss-ioa-exclusions/v2	Get the Self Service IOA Exclusions rules by id.
🟢 POST /exclusions/entities/ss-ioa-exclusions/v2	Create new Self Service IOA Exclusions.
🟣 PATCH /exclusions/entities/ss-ioa-exclusions/v2	Update the Self Service IOA Exclusions rule by id.
🔴 DELETE /exclusions/entities/ss-ioa-exclusions/v2	Delete the Self Service IOA Exclusions rule by id.
🟢 POST /exclusions/entities/ss-ioa-matched-rules/v2	Get Self Service IOA Exclusions rules for matched IFN/CLI for child, parent and grandparent
🟢 POST /exclusions/entities/ss-ioa-new-rules/v2	Get defaults for Self Service IOA Exclusions based on provided IFN/CLI for child, parent and grandparent.
🔵 GET /exclusions/queries/ss-ioa-exclusions/v2	Search for Self Service IOA Exclusions.
🔵 GET /policy/entities/ioa-exclusions/v1	Get a set of IOA Exclusions by specifying their IDs
🟢 POST /policy/entities/ioa-exclusions/v1	Create the IOA exclusions
🟣 PATCH /policy/entities/ioa-exclusions/v1	Update the IOA exclusions
🔴 DELETE /policy/entities/ioa-exclusions/v1	Delete the IOA exclusions by id
🔵 GET /policy/queries/ioa-exclusions/v1	Search for IOA exclusions.

Ioc

Endpoint	Description
🔵 GET /iocs/aggregates/indicators/device-count/v1	Get the number of devices the indicator has run on
🟢 POST /iocs/aggregates/indicators/v1	Get Indicators aggregates as specified via json in the request body.
🔵 GET /iocs/combined/indicator/v1	Get Combined for Indicators.
🔵 GET /iocs/entities/actions/v1	Get Actions by ids.
🟢 POST /iocs/entities/indicators-reports/v1	Launch an indicators report creation job
🔵 GET /iocs/entities/indicators/v1	Get Indicators by ids.
🟢 POST /iocs/entities/indicators/v1	Create Indicators.
🟣 PATCH /iocs/entities/indicators/v1	Update Indicators.
🔴 DELETE /iocs/entities/indicators/v1	Delete Indicators by ids.
🔵 GET /iocs/queries/actions/v1	Query Actions.
🔵 GET /iocs/queries/indicators/devices/v1	Get the IDs of devices the indicator has run on
🔵 GET /iocs/queries/indicators/processes/v1	Get the number of processes the indicator has run on
🔵 GET /iocs/queries/indicators/v1	Search for Indicators.
🔵 GET /iocs/queries/ioc-types/v1	Query IOC Types.
🔵 GET /iocs/queries/platforms/v1	Query Platforms.
🔵 GET /iocs/queries/severities/v1	Query Severities.
🟢 POST /iocs/sdmf/query/v1	Executes an SDMF data frame query against IOC indicators

Iocs

Endpoint	Description
🔵 GET /indicators/aggregates/devices-count/v1	Number of hosts in your customer account that have observed a given custom IOC
🔵 GET /indicators/queries/devices/v1	Find hosts that have observed a given custom IOC. For details about those hosts, use GET /devices/entities/devices/v1
🔵 GET /indicators/queries/processes/v1	Search for processes associated with a custom IOC
🔵 GET /processes/entities/processes/v1	For the provided ProcessID retrieve the process details

It Automation

Endpoint	Description
🔵 GET /it-automation/combined/associated-tasks/v1	Retrieve tasks associated with the provided file id
🔵 GET /it-automation/combined/scheduled-tasks/v1	Returns full details of scheduled tasks matching the filter query parameter.
🔵 GET /it-automation/combined/task-executions/v1	Returns the list of task executions (and their details) matching the filter query parameter. This endpoint will return the same output as if you ran ITAutomationSearchTaskExecutions and ITAutomationGetTaskExecution
🔵 GET /it-automation/combined/task-groups/v1	Returns full details of task groups matching the filter query parameter.
🔵 GET /it-automation/combined/tasks/v1	Returns full details of tasks matching the filter query parameter.
🔵 GET /it-automation/entities/it-user-groups/v1	Returns user groups for each provided id
🟢 POST /it-automation/entities/it-user-groups/v1	Creates a user group from the given request
🟣 PATCH /it-automation/entities/it-user-groups/v1	Update a user group for a given id
🔴 DELETE /it-automation/entities/it-user-groups/v1	Deletes user groups for each provided ids
🟢 POST /it-automation/entities/live-query-execution/v1	Starts a new task execution from the provided query data in the request and returns the initiated task executions
🟣 PATCH /it-automation/entities/policies-host-groups/v1	Manage host groups assigned to a policy.
🟣 PATCH /it-automation/entities/policies-precedence/v1	Updates the policy precedence for all policies of a specific platform.
🔵 GET /it-automation/entities/policies/v1	Retrieves the configuration for 1 or more policies.
🟢 POST /it-automation/entities/policies/v1	Creates a new policy of the specified type. New policies are always added at the end of the precedence list for the provided policy type.
🟣 PATCH /it-automation/entities/policies/v1	Updates a new policy of the specified type.
🔴 DELETE /it-automation/entities/policies/v1	Deletes 1 or more policies.
🔵 GET /it-automation/entities/scheduled-tasks/v1	Returns scheduled tasks for each provided id
🟢 POST /it-automation/entities/scheduled-tasks/v1	Creates a scheduled task from the given request
🟣 PATCH /it-automation/entities/scheduled-tasks/v1	Update an existing scheduled task with the supplied info
🔴 DELETE /it-automation/entities/scheduled-tasks/v1	Delete one or more scheduled tasks by providing the scheduled tasks IDs
🟢 POST /it-automation/entities/task-execution-cancel/v1	Cancel a task execution specified in the request
🔵 GET /it-automation/entities/task-execution-host-status/v1	Get the status of host executions by providing the execution IDs
🟢 POST /it-automation/entities/task-execution-rerun/v1	Rerun the task execution specified in the request
🔵 GET /it-automation/entities/task-execution-results-search/v1	Get the status of an async task execution results. Look for is_pending: false to know search is complete.
🟢 POST /it-automation/entities/task-execution-results-search/v1	Starts an async task execution results search. Poll ITAutomationGetExecutionResultsSearchStatus to check if the search is complete. You must retrieve the results using ITAutomationGetExecutionResults within 30 seconds of completion, or the job will be deleted.
🔵 GET /it-automation/entities/task-execution-results/v1	Get the task execution results from an async search. Use the ITAutomationStartExecutionResultsSearch command to start the async search. You can retrieve the results again for up to 24 hours, after which they will be deleted.
🔵 GET /it-automation/entities/task-executions/v1	Get the task execution for the provided task execution IDs
🟢 POST /it-automation/entities/task-executions/v1	Starts a new task execution from an existing task provided in the request and returns the initiated task executions
🔵 GET /it-automation/entities/task-groups/v1	Returns task groups for each provided id
🟢 POST /it-automation/entities/task-groups/v1	Creates a task group from the given request
🟣 PATCH /it-automation/entities/task-groups/v1	Update a task group for a given id
🔴 DELETE /it-automation/entities/task-groups/v1	Delete one or more task groups by providing the task group IDs
🔵 GET /it-automation/entities/tasks/v1	Returns tasks for each provided ID
🟢 POST /it-automation/entities/tasks/v1	Creates a task with details from the given request.
🟣 PATCH /it-automation/entities/tasks/v1	Update a task with details from the given request.
🔴 DELETE /it-automation/entities/tasks/v1	Deletes tasks for each provided ID
🔵 GET /it-automation/queries/it-user-groups/v1	Returns the list of user group ids matching the filter query parameter. It can be used together with the entities endpoint to retrieve full information on user groups
🔵 GET /it-automation/queries/policies/v1	Returns the list of policy ids matching the filter query parameter.
🔵 GET /it-automation/queries/scheduled-tasks/v1	Returns the list of scheduled task IDs matching the filter query parameter
🔵 GET /it-automation/queries/task-executions/v1	Returns the list of task execution IDs matching the filter query parameter. Can be used together with the entities endpoint to retrieve full information on executions
🔵 GET /it-automation/queries/task-groups/v1	Returns the list of task group ids matching the filter query parameter
🔵 GET /it-automation/queries/tasks/v1	Returns the list of task IDs matching the filter query parameter.

Knowledge Base Audit Events

Endpoint	Description
🔵 GET /agentic-studio/combined/knowledge_base_audit_events/v1	Get knowledge base audit events with full event details and pagination.
🔵 GET /agentic-studio/entities/knowledge_base_audit_events/v1	Retrieve knowledge base audit event entities by their IDs.
🔵 GET /agentic-studio/queries/knowledge_base_audit_events/v1	Query knowledge base audit event IDs with pagination and filtering.

Knowledge Base Files

Endpoint	Description
🔵 GET /agentic-studio/entities/knowledge_base_files/download/v1	Download knowledge base file entities for the provided id.
🔵 GET /agentic-studio/entities/knowledge_base_files/v1	Retrieve knowledge base file entities for the provided id.
🟢 POST /agentic-studio/entities/knowledge_base_files/v1	Upload a file to a knowledge base.
🟡 PUT /agentic-studio/entities/knowledge_base_files/v1	Update an existing file in a knowledge base. Supports updating file content and optionally its description.
🔴 DELETE /agentic-studio/entities/knowledge_base_files/v1	Delete document from knowledge base.
🔵 GET /agentic-studio/queries/knowledge_base_files/v1	Query knowledge base files based on the provided filters.

Knowledge Bases

Endpoint	Description
🔵 GET /agentic-studio/combined/knowledge_bases/v1	Search for knowledge bases with filtering and return full entity details in a single response.
🔵 GET /agentic-studio/entities/knowledge_bases/v1	Retrieve knowledge base entities for the provided id.
🟢 POST /agentic-studio/entities/knowledge_bases/v1	Create or update a knowledge base. For deletion, provide knowledge base with IsDeleted=true.
🟣 PATCH /agentic-studio/entities/knowledge_bases/v1	Update an existing knowledge base.
🔵 GET /agentic-studio/queries/knowledge_bases/v1	Query knowledge bases based on the provided filters.

Kubernetes Container Compliance

Endpoint	Description
🔵 GET /container-compliance/aggregates/clusters/v2	Returns cluster details along with aggregated assessment results organized by cluster, including pass/fail assessment counts for various asset types.
🔵 GET /container-compliance/aggregates/compliance-by-asset-type/v2	Provides aggregated compliance assessment metrics and rule status information, organized by asset type.
🔵 GET /container-compliance/aggregates/compliance-by-cluster-type/v2	Provides aggregated compliance assessment metrics and rule status information, organized by Kubernetes cluster type.
🔵 GET /container-compliance/aggregates/compliance-by-framework/v2	Provides aggregated compliance assessment metrics and rule status information, organized by compliance framework.
🔵 GET /container-compliance/aggregates/failed-rules-by-clusters/v3	Retrieves the most non-compliant clusters, ranked in descending order based on the number of failed compliance rules across severity levels (critical, high, medium, and low).
🔵 GET /container-compliance/aggregates/rules/v2	Returns rule details along with aggregated assessment results organized by compliance rule, including pass/fail assessment counts.
🔵 GET /container-compliance/aggregates/top-failed-images/v2	Retrieves the most non-compliant container images, ranked in descending order based on the number of failed assessments across severity levels (critical, high, medium, and low).
🔵 GET /container-compliance/combined/findings-by-images/v2	Returns detailed compliance assessment results for container images, providing the information needed to identify compliance violations.
🔵 GET /container-compliance/combined/findings-by-nodes/v2	Returns detailed compliance assessment results for kubernetes nodes, providing the information needed to identify compliance violations.
🔵 GET /container-compliance/combined/rule-details-by-rule-ids/v1	Retrieve detailed compliance rule information including descriptions, remediation steps, and audit procedures by specifying rule identifiers.

Kubernetes Protection

Endpoint	Description
🔵 GET /container-security/aggregates/clusters/count-by-date/v1	Retrieve clusters by date range counts
🔵 GET /container-security/aggregates/clusters/count-by-kubernetes-version/v1	Bucket clusters by kubernetes version
🔵 GET /container-security/aggregates/clusters/count-by-status/v1	Bucket clusters by status
🔵 GET /container-security/aggregates/clusters/count/v1	Retrieve cluster counts
🔵 GET /container-security/aggregates/containers/count-by-date/v1	Retrieve containers by date range counts
🔵 GET /container-security/aggregates/containers/count-by-registry/v1	Retrieves a list with the top container image registries. Maximum page size: 200
🔵 GET /container-security/aggregates/containers/count-by-zero-day/v1	Retrieve containers count affected by zero day vulnerabilities
🔵 GET /container-security/aggregates/containers/count-vulnerable-images/v1	Retrieve count of vulnerable images running on containers
🔵 GET /container-security/aggregates/containers/count/v1	Retrieve container counts
🔵 GET /container-security/aggregates/containers/find-by-runtimeversion/v1	Retrieve containers by container_runtime_version
🔵 GET /container-security/aggregates/containers/group-by-managed/v1	Group the containers by Managed
🔵 GET /container-security/aggregates/containers/image-detections-count-by-date/v1	Retrieve count of image assessment detections on running containers over a period of time
🔵 GET /container-security/aggregates/containers/images-by-state/v1	Retrieve count of image states running on containers
🔵 GET /container-security/aggregates/containers/sensor-coverage/v1	Bucket containers by agent type and calculate sensor coverage
🔵 GET /container-security/aggregates/containers/vulnerability-count-by-severity/v1	Retrieve container vulnerabilities by severity counts
🔵 GET /container-security/aggregates/deployments/count-by-date/v1	Retrieve deployments by date range counts
🔵 GET /container-security/aggregates/deployments/count/v1	Retrieve deployment counts
🔵 GET /container-security/aggregates/enrichment/clusters/entities/v1	Retrieve cluster enrichment data
🔵 GET /container-security/aggregates/enrichment/containers/entities/v1	Retrieve container enrichment data
🔵 GET /container-security/aggregates/enrichment/deployments/entities/v1	Retrieve deployment enrichment data
🔵 GET /container-security/aggregates/enrichment/nodes/entities/v1	Retrieve node enrichment data
🔵 GET /container-security/aggregates/enrichment/pods/entities/v1	Retrieve pod enrichment data
🔵 GET /container-security/aggregates/images/count-by-distinct/v1	Retrieve count of distinct images running on containers
🔵 GET /container-security/aggregates/images/most-used/v1	Bucket container by image-digest
🔵 GET /container-security/aggregates/kubernetes-ioms/count-by-date/v1	Returns the count of Kubernetes IOMs by the date. by default it's for 7 days.
🔵 GET /container-security/aggregates/kubernetes-ioms/count/v1	Returns the total count of Kubernetes IOMs over the past seven days
🔵 GET /container-security/aggregates/namespaces/count-by-date/v1	Retrieve namespaces by date range counts
🔵 GET /container-security/aggregates/namespaces/count/v1	Retrieve namespace counts
🔵 GET /container-security/aggregates/nodes/count-by-cloud/v1	Bucket nodes by cloud providers
🔵 GET /container-security/aggregates/nodes/count-by-container-engine-version/v1	Bucket nodes by their container engine version
🔵 GET /container-security/aggregates/nodes/count-by-date/v1	Retrieve nodes by date range counts
🔵 GET /container-security/aggregates/nodes/count/v1	Retrieve node counts
🔵 GET /container-security/aggregates/pods/count-by-date/v1	Retrieve pods by date range counts
🔵 GET /container-security/aggregates/pods/count/v1	Retrieve pod counts
🟢 POST /container-security/aggregates/pods/v1	Get aggregate query result for pods
🔵 GET /container-security/combined/clusters/v1	Retrieve kubernetes clusters identified by the provided filter criteria
🔵 GET /container-security/combined/clusters/v2	Retrieve Kubernetes cluster data
🔵 GET /container-security/combined/container-images/v1	Retrieve images on running containers
🔵 GET /container-security/combined/containers/v1	Retrieves a paginated list of containers identified by the provided filter criteria. Maximum page size: 200. Maximum available containers: 10,000
🔵 GET /container-security/combined/deployments/v1	Retrieve kubernetes deployments identified by the provided filter criteria
🟢 POST /container-security/combined/kubernetes-ioms/search/v1	Search for Kubernetes IOMs with filtering options.Pagination is supported via Elasticsearch's search_after search param and point in time. Assets are sorted by unique ID in ascending direction.
🔵 GET /container-security/combined/kubernetes-ioms/v1	Retrieves a list of Kubernetes IOMs identified by the provided search criteria. Maximum page size: 100. Maximum available Kubernetes IOMs: 10,000
🔵 GET /container-security/combined/nodes/v1	Retrieve kubernetes nodes identified by the provided filter criteria
🔵 GET /container-security/combined/pods/v1	Retrieve kubernetes pods identified by the provided filter criteria
🔵 GET /container-security/entities/kubernetes-ioms/v1	Retrieve Kubernetes IOM entities identified by the provided IDs
🔵 GET /container-security/queries/kubernetes-ioms/v1	Search Kubernetes IOMs by the provided search criteria. this endpoint returns a list of Kubernetes IOM UUIDs matching the query
🔵 GET /kubernetes-protection/entities/accounts/aws/v1	Provides a list of AWS accounts.
🟢 POST /kubernetes-protection/entities/accounts/aws/v1	Creates a new AWS account in our system for a customer and generates the installation script
🟣 PATCH /kubernetes-protection/entities/accounts/aws/v1	Updates the AWS account per the query parameters provided
🔴 DELETE /kubernetes-protection/entities/accounts/aws/v1	Delete AWS accounts.
🔵 GET /kubernetes-protection/entities/accounts/azure/v1	Provides the azure subscriptions registered to Kubernetes Protection
🟢 POST /kubernetes-protection/entities/accounts/azure/v1	Creates a new Azure Subscription in our system
🔴 DELETE /kubernetes-protection/entities/accounts/azure/v1	Deletes a new Azure Subscription in our system
🔵 GET /kubernetes-protection/entities/cloud_cluster/v1	Returns a combined list of provisioned cloud accounts and known kubernetes clusters
🔵 GET /kubernetes-protection/entities/cloud-locations/v1	Provides the cloud locations acknowledged by the Kubernetes Protection service
🔵 GET /kubernetes-protection/entities/config/azure/v1	Gets the Azure tenant Config
🔵 GET /kubernetes-protection/entities/gen/scripts/v1	Gets static bash scripts that are used during registration
🔵 GET /kubernetes-protection/entities/integration/agent/v1	Provides a sample Helm values.yaml file for a customer to install alongside the agent Helm chart
🟢 POST /kubernetes-protection/entities/integration/api-key/v1	Regenerate API key for docker registry integrations
🔵 GET /kubernetes-protection/entities/kubernetes/clusters/v1	Provides the clusters acknowledged by the Kubernetes Protection service
🟢 POST /kubernetes-protection/entities/scan/trigger/v1	Triggers a dry run or a full scan of a customer's kubernetes footprint
🟣 PATCH /kubernetes-protection/entities/service-principal/azure/v1	Adds the client ID for the given tenant ID to our system
🔵 GET /kubernetes-protection/entities/tenants/azure/v1	Provides all the azure subscriptions and tenants
🔵 GET /kubernetes-protection/entities/user-script/azure/v1	Provides the script to run for a given tenant id and subscription IDs

Maintenance Token

Endpoint	Description
🟢 POST /policy/combined/increment-uninstall-token/v1	Increments a bulk maintenance token.

Malquery

Endpoint	Description
🔵 GET /malquery/aggregates/quotas/v1	Get information about search and download quotas in your environment
🟢 POST /malquery/combined/fuzzy-search/v1	Search Falcon MalQuery quickly, but with more potential for false positives. Search for a combination of hex patterns and strings in order to identify samples based upon file content at byte level granularity.
🔵 GET /malquery/entities/download-files/v1	Download a file indexed by MalQuery. Specify the file using its SHA256. Only one file is supported at this time
🔵 GET /malquery/entities/metadata/v1	Retrieve indexed files metadata by their hash
🔵 GET /malquery/entities/requests/v1	Check the status and results of an asynchronous request, such as hunt or exact-search. Supports a single request id at this time.
🔵 GET /malquery/entities/samples-fetch/v1	Fetch a zip archive with password 'infected' containing the samples. Call this once the /entities/samples-multidownload request has finished processing
🟢 POST /malquery/entities/samples-multidownload/v1	Schedule samples for download. Use the result id with the /request endpoint to check if the download is ready after which you can call the /entities/samples-fetch to get the zip
🟢 POST /malquery/queries/exact-search/v1	Search Falcon MalQuery for a combination of hex patterns and strings in order to identify samples based upon file content at byte level granularity. You can filter results on criteria such as file type, file size and first seen date. Returns a request id which can be used with the /request endpoint
🟢 POST /malquery/queries/hunt/v1	Schedule a YARA-based search for execution. Returns a request id which can be used with the /request endpoint

Message Center

Endpoint	Description
🟢 POST /message-center/aggregates/cases/GET/v1	Retrieve aggregate case values based on the matched filter
🟢 POST /message-center/entities/case-activities/GET/v1	Retrieve activities for given id's
🟢 POST /message-center/entities/case-activity/v1	Add an activity to case. Only activities of type comment are allowed via API
🔵 GET /message-center/entities/case-attachment/v1	retrieves an attachment for the case, given the attachment id
🟢 POST /message-center/entities/case-attachment/v1	Upload an attachment for the case.
🟢 POST /message-center/entities/case/v2	create a new case
🟢 POST /message-center/entities/cases/GET/v1	Retrieve message center cases
🔵 GET /message-center/queries/case-activities/v1	Retrieve activities id's for a case
🔵 GET /message-center/queries/cases/v1	Retrieve case id's that match the provided filter criteria

Ml Exclusions

Endpoint	Description
🟢 POST /exclusions/aggregates/exclusions/GET/v2	Get exclusion aggregates as specified via json in request body.
🔵 GET /exclusions/entities/all-exclusions/v2	Get all exclusions.
🟢 POST /exclusions/entities/exclusion-actions/v2	Actions used to manipulate the content of exclusions, with ancestor fields.
🟢 POST /exclusions/entities/exclusions/reports/v2	Create a report of ML exclusions scoped by the given filters
🔵 GET /exclusions/entities/exclusions/v2	Get the exclusions by id, with ancestor fields.
🟢 POST /exclusions/entities/exclusions/v2	Create the exclusions, with ancestor fields.
🟣 PATCH /exclusions/entities/exclusions/v2	Update the exclusions by id, with ancestor fields.
🔴 DELETE /exclusions/entities/exclusions/v2	Delete the exclusions by id, with ancestor fields.
🔵 GET /exclusions/queries/exclusions/v2	Search for exclusions, with ancestor fields.
🟢 POST /exclusions/sdmf/query/v1	Executes an SDMF data frame query against exclusion entities
🔵 GET /policy/entities/ml-exclusions/v1	Get a set of ML Exclusions by specifying their IDs
🟢 POST /policy/entities/ml-exclusions/v1	Create the ML exclusions
🟣 PATCH /policy/entities/ml-exclusions/v1	Update the ML exclusions
🔴 DELETE /policy/entities/ml-exclusions/v1	Delete the ML exclusions by id
🔵 GET /policy/queries/ml-exclusions/v1	Search for ML exclusions.

Mobile Enrollment

Endpoint	Description
🟢 POST /enrollments/entities/details/v3	Trigger on-boarding process for a mobile device
🟢 POST /enrollments/entities/details/v4	Trigger on-boarding process for a mobile device

Models

Endpoint	Description
🔵 GET /agentic-studio/entities/models/v1	Get Model Entities by IDs
🔵 GET /agentic-studio/queries/models/v1	Query models based on the provided filters. TBD what the available filters are.

Mssp

Endpoint	Description
🟢 POST /mssp/entities/children/GET/v2	Get link to child customer by child CID(s)
🔵 GET /mssp/entities/children/v1	Get link to child customer by child CID(s)
🔵 GET /mssp/entities/cid-group-members/v1	Deprecated : Please use GET /mssp/entities/cid-group-members/v2. Get CID group members by CID group ID.
🟢 POST /mssp/entities/cid-group-members/v1	Add new CID group member.
🔴 DELETE /mssp/entities/cid-group-members/v1	Deprecated : Please use DELETE /entities/cid-group-members/v2. Delete CID group members.
🔵 GET /mssp/entities/cid-group-members/v2	Get CID group members by CID Group ID.
🔴 DELETE /mssp/entities/cid-group-members/v2	Delete CID group members. Prevents removal of a cid group a cid group if it is only part of one cid group.
🔵 GET /mssp/entities/cid-groups/v1	Deprecated : Please use GET /mssp/entities/cid-groups/v2. Get CID groups by ID.
🟢 POST /mssp/entities/cid-groups/v1	Create new CID groups. Name is a required field but description is an optional field. Maximum 500 CID groups allowed.
🟣 PATCH /mssp/entities/cid-groups/v1	Update existing CID groups. CID group ID is expected for each CID group definition provided in request body. Name is a required field but description is an optional field. Empty description will override existing value. CID group member(s) remain unaffected.
🔴 DELETE /mssp/entities/cid-groups/v1	Delete CID groups by ID.
🔵 GET /mssp/entities/cid-groups/v2	Get CID Groups by ID.
🔵 GET /mssp/entities/mssp-roles/v1	Get link between user group and CID group by ID. Link ID is a string consisting of multiple components, but should be treated as opaque.
🟢 POST /mssp/entities/mssp-roles/v1	Create a link between user group and CID group, with zero or more additional roles. The call does not replace any existing link between them. User group ID and CID group ID have to be specified in request.
🔴 DELETE /mssp/entities/mssp-roles/v1	Delete links or additional roles between user groups and CID groups. User group ID and CID group ID have to be specified in request. Only specified roles are removed if specified in request payload, else association between User Group and CID group is dissolved completely (if no roles specified).
🔵 GET /mssp/entities/user-group-members/v1	Deprecated : Please use GET /mssp/entities/user-group-members/v2. Get user group members by user group ID.
🟢 POST /mssp/entities/user-group-members/v1	Add new user group member. Maximum 500 members allowed per user group.
🔴 DELETE /mssp/entities/user-group-members/v1	Delete user group members entry.
🔵 GET /mssp/entities/user-group-members/v2	Get user group members by user group ID.
🔵 GET /mssp/entities/user-groups/v1	Deprecated : Please use GET /entities/user-groups/v2. Get user groups by ID.
🟢 POST /mssp/entities/user-groups/v1	Create new user groups. Name is a required field but description is an optional field. Maximum 500 user groups allowed per customer.
🟣 PATCH /mssp/entities/user-groups/v1	Update existing user group(s). User group ID is expected for each user group definition provided in request body. Name is a required field but description is an optional field. Empty description will override existing value. User group member(s) remain unaffected.
🔴 DELETE /mssp/entities/user-groups/v1	Delete user groups by ID.
🔵 GET /mssp/entities/user-groups/v2	Get user groups by ID.
🔵 GET /mssp/queries/children/v1	Query for customers linked as children
🔵 GET /mssp/queries/cid-group-members/v1	Query a CID groups members by associated CID.
🔵 GET /mssp/queries/cid-groups/v1	Query CID groups.
🔵 GET /mssp/queries/mssp-roles/v1	Query links between user groups and CID groups. At least one of CID group ID or user group ID should also be provided. Role ID is optional.
🔵 GET /mssp/queries/user-group-members/v1	Query user group member by user UUID.
🔵 GET /mssp/queries/user-groups/v1	Query user groups.

Network Scan Global Configs

Endpoint	Description
🔵 GET /netscan/entities/global-configs/v1	Get "global-configs" for the CID
🟣 PATCH /netscan/entities/global-configs/v1	Update "global-configs" using provided specifications

Network Scan Networks

Endpoint	Description
🟢 POST /netscan/aggregates/networks/GET/v1	Returns "networks" aggregations
🔵 GET /netscan/entities/networks/v1	Get "networks" by their IDs
🟢 POST /netscan/entities/networks/v1	Create "networks" using provided specifications
🟣 PATCH /netscan/entities/networks/v1	Update "networks" using provided specifications
🔴 DELETE /netscan/entities/networks/v1	Delete "networks" by their IDs
🔵 GET /netscan/queries/networks/v1	Get "networks IDs" by filter

Network Scan Scan Run Reports

Endpoint	Description
🔵 GET /netscan/entities/scan-run-reports/v1	Downloads scan run report in CSV format

Network Scan Scan Runs

Endpoint	Description
🟢 POST /netscan/aggregates/scan-runs/GET/v1	Returns "scan-runs" aggregations
🔵 GET /netscan/entities/scan-runs/v1	Get "scan-runs" by their IDs
🟢 POST /netscan/entities/scan-runs/v1	Create "scan-runs" using provided specifications
🟣 PATCH /netscan/entities/scan-runs/v1	Update "scan-runs" using provided specifications
🔵 GET /netscan/queries/scan-runs/v1	Get "scan-runs IDs" by filter

Network Scan Scanners

Endpoint	Description
🟢 POST /netscan/aggregates/scanners/GET/v1	Returns "scanners" aggregations
🔵 GET /netscan/entities/scanners/v1	Get "scanners" by their IDs
🟣 PATCH /netscan/entities/scanners/v1	Update "scanners" using provided specifications
🔵 GET /netscan/queries/scanners/v1	Get "scanners IDs" by filter

Network Scan Scans

Endpoint	Description
🟢 POST /netscan/aggregates/scans/GET/v1	Returns "scans" aggregations
🔵 GET /netscan/entities/scans/v1	Get "scans" by their IDs
🟢 POST /netscan/entities/scans/v1	Create "scans" using provided specifications
🟣 PATCH /netscan/entities/scans/v1	Update "scans" using provided specifications
🔴 DELETE /netscan/entities/scans/v1	Delete "scans" by their IDs
🔵 GET /netscan/queries/scans/v1	Get "scans IDs" by filter

Network Scan Templates

Endpoint	Description
🔵 GET /netscan/entities/template-configs/v1	Get details on the network scan template configurations
🔵 GET /netscan/entities/templates/v1	Get "templates" by their IDs
🟢 POST /netscan/entities/templates/v1	Create "templates" using provided specifications
🟣 PATCH /netscan/entities/templates/v1	Update "templates" using provided specifications
🔴 DELETE /netscan/entities/templates/v1	Delete "templates" by their IDs
🔵 GET /netscan/queries/templates/v1	Get "templates IDs" by filter

Network Scan Zones

Endpoint	Description
🟢 POST /netscan/aggregates/zones/GET/v1	Returns "zones" aggregations
🔵 GET /netscan/combined/zones/v1	Get "zones" by filter
🔵 GET /netscan/entities/zones/v1	Get "zones" by their IDs
🟢 POST /netscan/entities/zones/v1	Create "zones" using provided specifications
🟣 PATCH /netscan/entities/zones/v1	Update "zones" using provided specifications
🔴 DELETE /netscan/entities/zones/v1	Delete "zones" by their IDs
🔵 GET /netscan/queries/zones/v1	Get "zones IDs" by filter

Ngsiem

Endpoint	Description
🟢 POST /humio/api/v1/repositories/{repository}/files	Upload file to NGSIEM
🔵 GET /humio/api/v1/repositories/{repository}/files/{filename}	Download lookup file from NGSIEM
🔵 GET /humio/api/v1/repositories/{repository}/files/{namespace}/{package}/{filename}	Download lookup file in namespaced package from NGSIEM
🔵 GET /humio/api/v1/repositories/{repository}/files/{package}/{filename}	Download lookup file in package from NGSIEM
🟢 POST /humio/api/v1/repositories/{repository}/queryjobs	Initiate search
🔵 GET /humio/api/v1/repositories/{repository}/queryjobs/{id}	Get status of search
🔴 DELETE /humio/api/v1/repositories/{repository}/queryjobs/{id}	Stop search
🟢 POST /ngsiem-content/entities/bulk-dashboard-labels-add/v1	Add labels to multiple dashboards (max 100 items, non-transactional)
🟢 POST /ngsiem-content/entities/bulk-dashboard-labels-remove/v1	Remove labels from multiple dashboards (max 100 items, non-transactional)
🟢 POST /ngsiem-content/entities/bulk-dashboard-labels-replace/v1	Replace all labels on multiple dashboards (max 100 items, non-transactional)
🟢 POST /ngsiem-content/entities/bulk-dashboards-template/v1	Create Multiple Dashboards from YAML Templates. Processes all items and returns per-item success/failure results. Failed items are included in the errors array with appropriate HTTP status codes.
🟣 PATCH /ngsiem-content/entities/bulk-dashboards-template/v1	Update Multiple Dashboards from YAML Templates. Processes all items and returns per-item success/failure results. Failed items are included in the errors array with appropriate HTTP status codes.
🟢 POST /ngsiem-content/entities/bulk-lookupfile-labels-add/v1	Add labels to multiple lookup files (max 100 items, non-transactional)
🟢 POST /ngsiem-content/entities/bulk-lookupfile-labels-remove/v1	Remove labels from multiple lookup files (max 100 items, non-transactional)
🟢 POST /ngsiem-content/entities/bulk-lookupfile-labels-replace/v1	Replace all labels on multiple lookup files (max 100 items, non-transactional)
🔵 GET /ngsiem-content/entities/bulk-lookupfiles/v1	Retrieve Multiple Lookup Files by Filenames in NGSIEM.
🟢 POST /ngsiem-content/entities/bulk-lookupfiles/v1	Create Multiple Lookup Files. Processes all items and returns per-item success/failure results. Failed items are included in the errors array with appropriate HTTP status codes.
🟣 PATCH /ngsiem-content/entities/bulk-lookupfiles/v1	Update Multiple Lookup Files. Processes all items and returns per-item success/failure results. Failed items are included in the errors array with appropriate HTTP status codes.
🟢 POST /ngsiem-content/entities/bulk-savedqueries-template/v1	Create Multiple Saved Queries from LogScale YAML Templates. Processes all items and returns per-item success/failure results. Failed items are included in the errors array with appropriate HTTP status codes.
🟣 PATCH /ngsiem-content/entities/bulk-savedqueries-template/v1	Update Multiple Saved Queries from LogScale YAML Templates. Processes all items and returns per-item success/failure results. Failed items are included in the errors array with appropriate HTTP status codes.
🟢 POST /ngsiem-content/entities/bulk-savedquery-labels-add/v1	Add labels to multiple saved queries (max 100 items, non-transactional)
🟢 POST /ngsiem-content/entities/bulk-savedquery-labels-remove/v1	Remove labels from multiple saved queries (max 100 items, non-transactional)
🟢 POST /ngsiem-content/entities/bulk-savedquery-labels-replace/v1	Replace all labels on multiple saved queries (max 100 items, non-transactional)
🟢 POST /ngsiem-content/entities/dashboard-labels/v1	Add multiple labels to a single dashboard
🟡 PUT /ngsiem-content/entities/dashboard-labels/v1	Replace all labels on a single dashboard
🔴 DELETE /ngsiem-content/entities/dashboard-labels/v1	Remove multiple labels from a single dashboard
🔵 GET /ngsiem-content/entities/dashboards-template/v1	Retrieve Dashboard(s) in NGSIEM as LogScale YAML Template. Supports single or multiple IDs.
🟢 POST /ngsiem-content/entities/dashboards-template/v1	Create Dashboard from LogScale YAML Template in NGSIEM
🟣 PATCH /ngsiem-content/entities/dashboards-template/v1	Update Dashboard from LogScale YAML Template in NGSIEM.
🔴 DELETE /ngsiem-content/entities/dashboards/v1	Delete Dashboard in NGSIEM
🟢 POST /ngsiem-content/entities/lookupfile-labels/v1	Add multiple labels to a single file
🟡 PUT /ngsiem-content/entities/lookupfile-labels/v1	Replace all labels on a single file
🔴 DELETE /ngsiem-content/entities/lookupfile-labels/v1	Remove multiple labels from a single file
🟣 PATCH /ngsiem-content/entities/lookupfiles-entries/v1	Update entries in an existing Lookup File in NGSIEM
🔵 GET /ngsiem-content/entities/lookupfiles/v1	Retrieve Lookup File in NGSIEM
🟢 POST /ngsiem-content/entities/lookupfiles/v1	Create Lookup File in NGSIEM
🟣 PATCH /ngsiem-content/entities/lookupfiles/v1	Update an entire Lookup File in NGSIEM
🔴 DELETE /ngsiem-content/entities/lookupfiles/v1	Delete Lookup File in NGSIEM
🟢 POST /ngsiem-content/entities/parsers-clone/v1	Clone an existing parser with a new name
🟢 POST /ngsiem-content/entities/parsers-extensions/v1	Create a Parser extension in NGSIEM for the provided base parser.
🟣 PATCH /ngsiem-content/entities/parsers-extensions/v1	Update an existing Parser extension in NGSIEM. At least one field must be provided for update.
🟢 POST /ngsiem-content/entities/parsers-template-test/v1	Test Parser from LogScale YAML Template in NGSIEM
🔵 GET /ngsiem-content/entities/parsers-template/v1	Retrieve Parser in NGSIEM as LogScale YAML Template
🟢 POST /ngsiem-content/entities/parsers-template/v1	Create Parser from LogScale YAML Template in NGSIEM
🟣 PATCH /ngsiem-content/entities/parsers-template/v1	Update Parser in NGSIEM from YAML Template. Please note that name changes are not supported, but rather should be created as a new parser.
🟡 PUT /ngsiem-content/entities/parsers/autoupdate/v1	Updates a parser auto update policy - 'on' enables auto-updates, 'off' disables them
🟢 POST /ngsiem-content/entities/parsers/bulk-install/v1	Installs multiple CrowdStrike-managed out-of-the-box (OOTB) parsers into the customer's repository in a single operation. This endpoint provisions multiple pre-built parsers with their specific versions for the requesting customer ID (CID). The parsers are installed as-is and cannot be modified by the customer. Requires an array of parsers with parser_id and version in the request body. Maximum 100 parsers per request.
🟢 POST /ngsiem-content/entities/parsers/install/v1	Installs a CrowdStrike-managed out-of-the-box (OOTB) parser into the customer's repository. This endpoint provisions a pre-built parser with a specific version for the requesting customer ID (CID). The parser is installed as-is and cannot be modified by the customer. Requires parser_id and version in the request body.
🔵 GET /ngsiem-content/entities/parsers/v1	Retrieve Parser in NGSIEM. This endpoint has been deprecated in favour of the GET /entities/parsers-template/v1 API.
🟢 POST /ngsiem-content/entities/parsers/v1	Create Parser in NGSIEM. This endpoint has been deprecated in favour of the POST /entities/parsers-template/v1 API.
🟣 PATCH /ngsiem-content/entities/parsers/v1	Update Parser in NGSIEM. Please note that name changes are not supported, but rather should be created as a new parser. This endpoint has been deprecated in favour of the PATCH /entities/parsers-template/v1 API.
🔴 DELETE /ngsiem-content/entities/parsers/v1	Delete Parser in NGSIEM
🔵 GET /ngsiem-content/entities/savedqueries-template/v1	Retrieve Saved Quer(ies) in NGSIEM as LogScale YAML Template. Supports single or multiple IDs.
🟢 POST /ngsiem-content/entities/savedqueries-template/v1	Create Saved Query from LogScale YAML Template in NGSIEM
🟣 PATCH /ngsiem-content/entities/savedqueries-template/v1	Update Saved Query from LogScale YAML Template in NGSIEM.
🔴 DELETE /ngsiem-content/entities/savedqueries/v1	Delete Saved Query in NGSIEM
🟢 POST /ngsiem-content/entities/savedquery-labels/v1	Add multiple labels to a saved query
🟡 PUT /ngsiem-content/entities/savedquery-labels/v1	Replace all labels on a single saved query
🔴 DELETE /ngsiem-content/entities/savedquery-labels/v1	Remove multiple labels from a saved query
🔵 GET /ngsiem-content/queries/dashboards/v1	List Dashboards in NGSIEM with Pagination and Filtering. Returns dashboard ID and name. Supports pagination (default limit: 50) and optional name filtering.
🔵 GET /ngsiem-content/queries/lookupfiles/v1	List Lookup Files in NGSIEM with Pagination and Filtering. Supports bulk listing with pagination (default limit: 50) and optional name filtering.
🔵 GET /ngsiem-content/queries/parsers/v1	List Parsers in NGSIEM
🔵 GET /ngsiem-content/queries/savedqueries/v1	List Saved Queries in NGSIEM with Pagination and Filtering. Supports bulk listing with pagination (default limit: 50) and optional name filtering.
🔵 GET /ngsiem/combined/connections/v1	List and search data connections
🔵 GET /ngsiem/combined/connectors/v1	List available data connectors
🔵 GET /ngsiem/entities/connections/status/v1	Get data connection provisioning status
🟣 PATCH /ngsiem/entities/connections/status/v1	Update data connection status
🔵 GET /ngsiem/entities/connections/token/v1	Get Ingest token for data connection
🟢 POST /ngsiem/entities/connections/token/v1	Regenerate Ingest token for data connection
🔵 GET /ngsiem/entities/connections/v1	Get data connection by ID
🟢 POST /ngsiem/entities/connections/v1	Create a new data connection
🟣 PATCH /ngsiem/entities/connections/v1	Update a data connection
🔴 DELETE /ngsiem/entities/connections/v1	Delete a data connection
🔵 GET /ngsiem/entities/connectors/configs/v1	List configurations for a data connector
🟢 POST /ngsiem/entities/connectors/configs/v1	Create a new configuration for a data connector
🟣 PATCH /ngsiem/entities/connectors/configs/v1	Patch configurations for a data connector
🔴 DELETE /ngsiem/entities/connectors/configs/v1	Delete data connection config

Oauth2

Endpoint	Description
🟢 POST /oauth2/revoke	Revoke a previously issued OAuth2 access token before the end of its standard 30-minute lifespan.
🟢 POST /oauth2/token	Generate an OAuth2 access token

Ods

Endpoint	Description
🟢 POST /ods/aggregates/scan-hosts/v1	Get aggregates on ODS scan-hosts data.
🟢 POST /ods/aggregates/scans/v1	Get aggregates on ODS scan data.
🟢 POST /ods/aggregates/scheduled-scans/v1	Get aggregates on ODS scheduled-scan data.
🔵 GET /ods/entities/malicious-files/v1	Get malicious files by ids.
🟢 POST /ods/entities/scan-control-actions/cancel/v1	Cancel ODS scans for the given scan ids.
🔵 GET /ods/entities/scan-hosts/v1	Get scan hosts by ids.
🔵 GET /ods/entities/scans/v1	Get Scans by IDs.
🟢 POST /ods/entities/scans/v1	Create ODS scan and start or schedule scan for the given scan request.
🔵 GET /ods/entities/scans/v2	Get Scans by IDs.
🔵 GET /ods/entities/scheduled-scans/v1	Get ScheduledScans by IDs.
🟢 POST /ods/entities/scheduled-scans/v1	Create ODS scan and start or schedule scan for the given scan request.
🔴 DELETE /ods/entities/scheduled-scans/v1	Delete ODS scheduled-scans for the given scheduled-scan ids.
🔵 GET /ods/queries/malicious-files/v1	Query malicious files.
🔵 GET /ods/queries/scan-hosts/v1	Query scan hosts.
🔵 GET /ods/queries/scans/v1	Query Scans.
🔵 GET /ods/queries/scheduled-scans/v1	Query ScheduledScans.

Pluginsonprem

Endpoint	Description
🔵 GET /pluginsonprem/entities/host-configs/v1	Fetches the host configs within the provided host group.
🟢 POST /pluginsonprem/entities/host-configs/v1	Configures all hosts in the provided host group to be ready to accept an execute API call

Prevention Policies

Endpoint	Description
🔵 GET /policy/combined/prevention-members/v1	Search for members of a Prevention Policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria
🔵 GET /policy/combined/prevention/v1	Search for Prevention Policies in your environment by providing an FQL filter and paging details. Returns a set of Prevention Policies which match the filter criteria
🟢 POST /policy/entities/prevention-actions/v1	Perform the specified action on the Prevention Policies specified in the request
🟢 POST /policy/entities/prevention-precedence/v1	Sets the precedence of Prevention Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence
🔵 GET /policy/entities/prevention/v1	Retrieve a set of Prevention Policies by specifying their IDs
🟢 POST /policy/entities/prevention/v1	Create Prevention Policies by specifying details about the policy to create
🟣 PATCH /policy/entities/prevention/v1	Update Prevention Policies by specifying the ID of the policy and details to update
🔴 DELETE /policy/entities/prevention/v1	Delete a set of Prevention Policies by specifying their IDs
🔵 GET /policy/queries/prevention-members/v1	Search for members of a Prevention Policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria
🔵 GET /policy/queries/prevention/v1	Search for Prevention Policies in your environment by providing an FQL filter and paging details. Returns a set of Prevention Policy IDs which match the filter criteria

Profile Groups

Endpoint	Description
🟢 POST /user-management/entities/group-actions/v1	Perform actions on profile groups (add/remove roles, user groups, FGA objects)
🟢 POST /user-management/entities/group-users-actions/v1	Add or remove users from profile groups
🟢 POST /user-management/entities/group-users/GET/v1	Get a list of groups with users that belong to them
🟢 POST /user-management/entities/groups/GET/v1	Get profile groups by IDs with full details
🟢 POST /user-management/entities/groups/v1	Create a new profile group
🟣 PATCH /user-management/entities/groups/v1	Update profile group metadata (name, description)
🔴 DELETE /user-management/entities/groups/v1	Delete profile groups by IDs
🟢 POST /user-management/entities/user-groups/GET/v1	Get a list of users with the groups that they belong to
🔵 GET /user-management/queries/groups/v1	Query profile group IDs with FQL filtering, pagination, and sorting

Quarantine

Endpoint	Description
🔵 GET /quarantine/aggregates/action-update-count/v1	Returns count of potentially affected quarantined files for each action.
🟢 POST /quarantine/aggregates/quarantined-files/GET/v1	Get quarantine file aggregates as specified via json in request body.
🟢 POST /quarantine/entities/quarantined-files/GET/v1	Get quarantine file metadata for specified ids.
🟣 PATCH /quarantine/entities/quarantined-files/v1	Apply action by quarantine file ids
🔵 GET /quarantine/queries/quarantined-files/v1	Get quarantine file ids that match the provided filter criteria.
🟣 PATCH /quarantine/queries/quarantined-files/v1	Apply quarantine file actions by query.

Quick Scan

Endpoint	Description
🟢 POST /scanner/aggregates/scans/GET/v1	Get scans aggregations as specified via json in request body.
🔵 GET /scanner/entities/scans/v1	Check the status of a volume scan. Time required for analysis increases with the number of samples in a volume but usually it should take less than 1 minute
🟢 POST /scanner/entities/scans/v1	Submit a volume of files for ml scanning. Time required for analysis increases with the number of samples in a volume but usually it should take less than 1 minute
🔵 GET /scanner/queries/scans/v1	Find IDs for submitted scans by providing an FQL filter and paging details. Returns a set of volume IDs that match your criteria.

Quick Scan Pro

Endpoint	Description
🟢 POST /quickscanpro/entities/files/v1	Uploads a file to be further analyzed with QuickScan Pro. Supports both multipart/form-data and application/octet-stream uploads. The samples expire according to the Retention Policies set. See parameter descriptions for usage per content type.
🔴 DELETE /quickscanpro/entities/files/v1	Deletes file by its sha256 identifier.
🔵 GET /quickscanpro/entities/scans/v1	Gets the result of an QuickScan Pro scan.
🟢 POST /quickscanpro/entities/scans/v1	Starts scanning a file uploaded through '/quickscanpro/entities/files/v1'.
🔴 DELETE /quickscanpro/entities/scans/v1	Deletes the result of an QuickScan Pro scan.
🔵 GET /quickscanpro/queries/scans/v1	FQL query specifying the filter parameters

Real Time Response

Endpoint	Description
🟢 POST /real-time-response/aggregates/sessions/GET/v1	Get aggregates on session data.
🟢 POST /real-time-response/combined/batch-active-responder-command/v1	Batch executes a RTR active-responder command across the hosts mapped to the given batch ID.
🟢 POST /real-time-response/combined/batch-command/v1	Batch executes a RTR read-only command across the hosts mapped to the given batch ID.
🔵 GET /real-time-response/combined/batch-get-command/v1	Retrieves the status of the specified batch get command. Will return successful files when they are finished processing.
🟢 POST /real-time-response/combined/batch-get-command/v1	Batch executes get command across hosts to retrieve files. After this call is made GET /real-time-response/combined/batch-get-command/v1 is used to query for the results.
🟢 POST /real-time-response/combined/batch-init-session/v1	Batch initialize a RTR session on multiple hosts. Before any RTR commands can be used, an active session is needed on the host.
🟢 POST /real-time-response/combined/batch-refresh-session/v1	Batch refresh a RTR session on multiple hosts. RTR sessions will expire after 10 minutes unless refreshed.
🔵 GET /real-time-response/entities/active-responder-command/v1	Get status of an executed active-responder command on a single host.
🟢 POST /real-time-response/entities/active-responder-command/v1	Execute an active responder command on a single host.
🔵 GET /real-time-response/entities/command/v1	Get status of an executed command on a single host.
🟢 POST /real-time-response/entities/command/v1	Execute a command on a single host.
🔵 GET /real-time-response/entities/extracted-file-contents/v1	Get RTR extracted file contents for specified session and sha256.
🔵 GET /real-time-response/entities/file/v1	Get a list of files for the specified RTR session.
🔴 DELETE /real-time-response/entities/file/v1	Delete a RTR session file.
🔵 GET /real-time-response/entities/file/v2	Get a list of files for the specified RTR session.
🔴 DELETE /real-time-response/entities/file/v2	Delete a RTR session file.
🔴 DELETE /real-time-response/entities/queued-sessions/command/v1	Delete a queued session command
🟢 POST /real-time-response/entities/queued-sessions/GET/v1	Get queued session metadata by session ID.
🟢 POST /real-time-response/entities/refresh-session/v1	Refresh a session timeout on a single host.
🟢 POST /real-time-response/entities/sessions/GET/v1	Get session metadata by session id.
🟢 POST /real-time-response/entities/sessions/v1	Initialize a new session with the RTR cloud.
🔴 DELETE /real-time-response/entities/sessions/v1	Delete a session.
🔵 GET /real-time-response/queries/sessions/v1	Get a list of session_ids.

Real Time Response Admin

Endpoint	Description
🟢 POST /real-time-response/combined/batch-admin-command/v1	Batch executes a RTR administrator command across the hosts mapped to the given batch ID.
🔵 GET /real-time-response/entities/admin-command/v1	Get status of an executed RTR administrator command on a single host.
🟢 POST /real-time-response/entities/admin-command/v1	Execute a RTR administrator command on a single host.
🔵 GET /real-time-response/entities/falcon-scripts/v1	Get Falcon scripts with metadata and content of script
🔵 GET /real-time-response/entities/put-file-contents/v1	Get RTR put file contents for a given file ID
🔵 GET /real-time-response/entities/put-files/v1	Get put-files based on the ID's given. These are used for the RTR put command.
🟢 POST /real-time-response/entities/put-files/v1	Upload a new put-file to use for the RTR put command.
🔴 DELETE /real-time-response/entities/put-files/v1	Delete a put-file based on the ID given. Can only delete one file at a time.
🔵 GET /real-time-response/entities/put-files/v2	Get put-files based on the ID's given. These are used for the RTR put command.
🟢 POST /real-time-response/entities/put-files/v2	Upload a new put-file to use for the RTR put command.
🔵 GET /real-time-response/entities/scripts/v1	Get custom-scripts based on the ID's given. These are used for the RTR runscript command.
🟢 POST /real-time-response/entities/scripts/v1	Upload a new custom-script to use for the RTR runscript command.
🟣 PATCH /real-time-response/entities/scripts/v1	Upload a new scripts to replace an existing one.
🔴 DELETE /real-time-response/entities/scripts/v1	Delete a custom-script based on the ID given. Can only delete one script at a time.
🔵 GET /real-time-response/entities/scripts/v2	Get custom-scripts based on the ID's given. These are used for the RTR runscript command.
🟢 POST /real-time-response/entities/scripts/v2	Upload a new custom-script to use for the RTR runscript command.
🟣 PATCH /real-time-response/entities/scripts/v2	Upload a new scripts to replace an existing one.
🔵 GET /real-time-response/queries/falcon-scripts/v1	Get a list of Falcon script IDs available to the user to run
🔵 GET /real-time-response/queries/put-files/v1	Get a list of put-file ID's that are available to the user for the put command.
🔵 GET /real-time-response/queries/scripts/v1	Get a list of custom-script ID's that are available to the user for the runscript command.

Real Time Response Audit

Endpoint	Description
🔵 GET /real-time-response-audit/combined/sessions/v1	Get all the RTR sessions created for a customer in a specified duration

Recon

Endpoint	Description
🟢 POST /recon/aggregates/notifications-exposed-data-records/GET/v1	Get notification exposed data record aggregates as specified via JSON in request body. The valid aggregation fields are: [cid notification_id notification_group_id created_date rule.id rule.name rule.topic source_category site author file.name credential_status bot.operating_system.hardware_id bot.bot_id]
🟢 POST /recon/aggregates/notifications/GET/v1	Get notification aggregates as specified via JSON in request body.
🟢 POST /recon/aggregates/rules-preview/GET/v1	Preview rules notification count and distribution. This will return aggregations on: channel, count, site.
🔵 GET /recon/entities/actions/v1	Get actions based on their IDs. IDs can be retrieved using the GET /queries/actions/v1 endpoint.
🟢 POST /recon/entities/actions/v1	Create actions for a monitoring rule. Accepts a list of actions that will be attached to the monitoring rule.
🟣 PATCH /recon/entities/actions/v1	Update an action for a monitoring rule.
🔴 DELETE /recon/entities/actions/v1	Delete an action from a monitoring rule based on the action ID.
🔵 GET /recon/entities/export-files/v1	Download the file associated with a job ID.
🔵 GET /recon/entities/exports/v1	Get the status of export jobs based on their IDs. Export jobs can be launched by calling POST /entities/exports/v1. When a job is complete, use the job ID to download the file(s) associated with it using GET entities/export-files/v1.
🟢 POST /recon/entities/exports/v1	Launch asynchronous export job. Use the job ID to poll the status of the job using GET /entities/exports/v1.
🔴 DELETE /recon/entities/exports/v1	Delete export jobs (and their associated file(s)) based on their IDs.
🔵 GET /recon/entities/notifications-detailed-translated/v1	Get detailed notifications based on their IDs. These include the translated raw intelligence content that generated the match or part of it.
🔵 GET /recon/entities/notifications-detailed/v1	Get detailed notifications based on their IDs. These include the raw intelligence content that generated the match or part of it.
🔵 GET /recon/entities/notifications-exposed-data-records/v1	Get notifications exposed data records based on their IDs. IDs can be retrieved using the GET /queries/notifications-exposed-data-records/v1 endpoint. The associate notification can be fetched using the /entities/notifications/v* endpoints
🔵 GET /recon/entities/notifications-translated/v1	Get notifications based on their IDs. IDs can be retrieved using the GET /queries/notifications/v1 endpoint. This endpoint will return translated notification content. The only target language available is English.
🔵 GET /recon/entities/notifications/v1	Get notifications based on their IDs. IDs can be retrieved using the GET /queries/notifications/v1 endpoint.
🟣 PATCH /recon/entities/notifications/v1	Update notification status or assignee. Accepts bulk requests
🔴 DELETE /recon/entities/notifications/v1	Delete notifications based on IDs. Notifications cannot be recovered after they are deleted.
🔵 GET /recon/entities/rules/v1	Get monitoring rules based on their IDs. IDs can be retrieved using the GET /queries/rules/v1 endpoint.
🟢 POST /recon/entities/rules/v1	Create monitoring rules.
🟣 PATCH /recon/entities/rules/v1	Update monitoring rules.
🔴 DELETE /recon/entities/rules/v1	Delete monitoring rules.
🔵 GET /recon/queries/actions/v1	Query actions based on provided criteria. Use the IDs from this response to get the action entities on GET /entities/actions/v1.
🔵 GET /recon/queries/notifications-exposed-data-records/v1	Query notifications exposed data records based on provided criteria. Use the IDs from this response to get the notification +entities on GET /entities/notifications-exposed-data-records/v1
🔵 GET /recon/queries/notifications/v1	Query notifications based on provided criteria. Use the IDs from this response to get the notification +entities on GET /entities/notifications/v1, GET /entities/notifications-detailed/v1, +GET /entities/notifications-translated/v1 or GET /entities/notifications-detailed-translated/v1.
🔵 GET /recon/queries/rules/v1	Query monitoring rules based on provided criteria. Use the IDs from this response to fetch the rules on /entities/rules/v1.

Release Notes

Endpoint	Description
🔵 GET /deployment-coordinator/combined/release-notes/v1	Queries for release-notes resources and returns details
🟢 POST /deployment-coordinator/entities/release-notes/GET/v1	returns the release notes for the IDs in the request
🟢 POST /deployment-coordinator/entities/release-notes/GET/v2	returns the release notes for the IDs in the request with EA and GA dates in ISO 8601 format
🔵 GET /deployment-coordinator/queries/release-notes/v1	Queries for release-notes resources and returns ids

Releases

Endpoint	Description
🔵 GET /deployment-coordinator/combined/releases/v1	Queries for releases resources and returns details

Report Executions

Endpoint	Description
🔵 GET /reports/entities/report-executions-download/v1	Get report entity download
🟢 POST /reports/entities/report-executions-retry/v1	This endpoint will be used to retry report executions
🔵 GET /reports/entities/report-executions/v1	Retrieve report details for the provided report IDs.
🔵 GET /reports/queries/report-executions/v1	Find all report execution IDs matching the query with filter

Response Policies

Endpoint	Description
🔵 GET /policy/combined/response-members/v1	Search for members of a Response policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria
🔵 GET /policy/combined/response/v1	Search for Response Policies in your environment by providing an FQL filter and paging details. Returns a set of Response Policies which match the filter criteria
🟢 POST /policy/entities/response-actions/v1	Perform the specified action on the Response Policies specified in the request
🟢 POST /policy/entities/response-precedence/v1	Sets the precedence of Response Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence
🔵 GET /policy/entities/response/v1	Retrieve a set of Response Policies by specifying their IDs
🟢 POST /policy/entities/response/v1	Create Response Policies by specifying details about the policy to create
🟣 PATCH /policy/entities/response/v1	Update Response Policies by specifying the ID of the policy and details to update
🔴 DELETE /policy/entities/response/v1	Delete a set of Response Policies by specifying their IDs
🔵 GET /policy/queries/response-members/v1	Search for members of a Response policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria
🔵 GET /policy/queries/response/v1	Search for Response Policies in your environment by providing an FQL filter with sort and/or paging details. This returns a set of Response Policy IDs that match the given criteria.

Runtime Detections

Endpoint	Description
🔵 GET /container-security/combined/runtime-detections/v2	Retrieve container runtime detections by the provided search criteria

Saas Security

Endpoint	Description
🔵 GET /saas-security/aggregates/check-metrics/v3	GET Metrics
🔵 GET /saas-security/entities/alerts/v3	GET Alert by ID or GET Alerts
🔵 GET /saas-security/entities/app-users/v3	GET Application Users
🔵 GET /saas-security/entities/apps/v3	GET Applications Inventory
🔵 GET /saas-security/entities/check-affected/v3	GET Security Check Affected
🟢 POST /saas-security/entities/check-dismiss-affected/v3	POST Dismiss Affected Entity
🟢 POST /saas-security/entities/check-dismiss/v3	POST Dismiss Security Check by ID
🔵 GET /saas-security/entities/checks/v3	GET Security Check by ID or GET List Security Checks
🔵 GET /saas-security/entities/compliance/v3	GET Compliance
🟢 POST /saas-security/entities/custom-integration-close/v3	POST Data Upload Transaction Completion
🟢 POST /saas-security/entities/custom-integration-reset/v3	Reset
🔵 GET /saas-security/entities/custom-integration-status/v3	GET Status
🟢 POST /saas-security/entities/custom-integration-upload/v3	POST Upload
🔵 GET /saas-security/entities/data/v3	GET Data Inventory
🔵 GET /saas-security/entities/devices/v3	GET Device Inventory
🔵 GET /saas-security/entities/integrations/v3	GET Integrations
🔵 GET /saas-security/entities/monitor/v3	GET Activity Monitor
🔵 GET /saas-security/entities/supported-saas/v3	GET Supported SaaS
🔵 GET /saas-security/entities/system-logs/v3	GET System Logs
🔵 GET /saas-security/entities/system-users/v3	GET System Users
🔵 GET /saas-security/entities/users/v3	GET User Inventory

Sample Uploads

Endpoint	Description
🔵 GET /archives/entities/archive-files/v1	Retrieves the archives files in chunks.
🔵 GET /archives/entities/archives/v1	Retrieves the archives upload operation statuses. Status done means that archive was processed successfully. Status error means that archive was not processed successfully.
🟢 POST /archives/entities/archives/v1	Uploads an archive and extracts files list from it. Operation is asynchronous use /archives/entities/archives/v1 to check the status. After uploading, use /archives/entities/extractions/v1 to copy the file to internal storage making it available for content analysis. This method is deprecated in favor of /archives/entities/archives/v2
🔴 DELETE /archives/entities/archives/v1	Delete an archive that was uploaded previously
🟢 POST /archives/entities/archives/v2	Uploads an archive and extracts files list from it. Operation is asynchronous use /archives/entities/archives/v1 to check the status. After uploading, use /archives/entities/extractions/v1 to copy the file to internal storage making it available for content analysis.
🔵 GET /archives/entities/extraction-files/v1	Retrieves the files extractions in chunks. Status done means that all files were processed successfully. Status error means that at least one of the file could not be processed.
🔵 GET /archives/entities/extractions/v1	Retrieves the files extraction operation statuses. Status done means that all files were processed successfully. Status error means that at least one of the file could not be processed.
🟢 POST /archives/entities/extractions/v1	Extracts files from an uploaded archive and copies them to internal storage making it available for content analysis.
🔵 GET /samples/entities/samples/v3	Retrieves the file associated with the given ID (SHA256)
🟢 POST /samples/entities/samples/v3	Upload a file for further cloud analysis. After uploading, call the specific analysis API endpoint.
🔴 DELETE /samples/entities/samples/v3	Removes a sample, including file, meta and submissions from the collection

Scanning Orchestrator

Endpoint	Description
🔵 GET /agentless-scanning/combined/schedules/v1	Get combined scanning schedules
🟢 POST /agentless-scanning/entities/scan-by-schedule/v1	Trigger scan by schedule IDs
🔵 GET /agentless-scanning/entities/schedules/v1	Get scanning schedules
🟢 POST /agentless-scanning/entities/schedules/v1	Create scanning schedules
🟣 PATCH /agentless-scanning/entities/schedules/v1	Update scanning schedules
🔴 DELETE /agentless-scanning/entities/schedules/v1	Delete scanning schedules
🔵 GET /agentless-scanning/entities/supported-service-types/v1	Get allowed service types
🔵 GET /agentless-scanning/queries/schedules/v1	Search scanning schedules

Scheduled Reports

Endpoint	Description
🟢 POST /reports/entities/scheduled-reports/execution/v1	Launch scheduled reports executions for the provided report IDs.
🔵 GET /reports/entities/scheduled-reports/v1	Retrieve scheduled reports for the provided report IDs.
🔵 GET /reports/queries/scheduled-reports/v1	Find all report IDs matching the query with filter

Sensor Download

Endpoint	Description
🔵 GET /sensors/combined/installers/v1	Get sensor installer details by provided query
🔵 GET /sensors/combined/installers/v2	Get sensor installer details by provided query
🔵 GET /sensors/combined/installers/v3	Get sensor installer details by provided query
🔵 GET /sensors/entities/download-installer/v1	Download sensor installer by SHA256 ID
🔵 GET /sensors/entities/download-installer/v2	Download sensor installer by SHA256 ID
🔵 GET /sensors/entities/download-installer/v3	Download sensor installer by SHA256 ID
🔵 GET /sensors/entities/installers/v1	Get sensor installer details by provided SHA256 IDs
🔵 GET /sensors/entities/installers/v2	Get sensor installer details by provided SHA256 IDs
🔵 GET /sensors/entities/installers/v3	Get sensor installer details by provided SHA256 IDs
🔵 GET /sensors/queries/installers/ccid/v1	Get CCID to use with sensor installers
🔵 GET /sensors/queries/installers/v1	Get sensor installer IDs by provided query
🔵 GET /sensors/queries/installers/v2	Get sensor installer IDs by provided query
🔵 GET /sensors/queries/installers/v3	Get sensor installer IDs by provided query

Sensor Update Policies

Endpoint	Description
🟢 POST /policy/combined/reveal-uninstall-token/v1	Reveals an uninstall token for a specific device. To retrieve the bulk maintenance token pass the value 'MAINTENANCE' as the value for 'device_id'
🔵 GET /policy/combined/sensor-update-builds/v1	Retrieve available builds for use with Sensor Update Policies
🔵 GET /policy/combined/sensor-update-kernels/v1	Retrieve kernel compatibility info for Sensor Update Builds
🔵 GET /policy/combined/sensor-update-members/v1	Search for members of a Sensor Update Policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria
🔵 GET /policy/combined/sensor-update/v1	Search for Sensor Update Policies in your environment by providing an FQL filter and paging details. Returns a set of Sensor Update Policies which match the filter criteria
🔵 GET /policy/combined/sensor-update/v2	Search for Sensor Update Policies with additional support for uninstall protection in your environment by providing an FQL filter and paging details. Returns a set of Sensor Update Policies which match the filter criteria
🟢 POST /policy/entities/sensor-update-actions/v1	Perform the specified action on the Sensor Update Policies specified in the request
🟢 POST /policy/entities/sensor-update-precedence/v1	Sets the precedence of Sensor Update Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence
🔵 GET /policy/entities/sensor-update/v1	Retrieve a set of Sensor Update Policies by specifying their IDs
🟢 POST /policy/entities/sensor-update/v1	Create Sensor Update Policies by specifying details about the policy to create
🟣 PATCH /policy/entities/sensor-update/v1	Update Sensor Update Policies by specifying the ID of the policy and details to update
🔴 DELETE /policy/entities/sensor-update/v1	Delete a set of Sensor Update Policies by specifying their IDs
🔵 GET /policy/entities/sensor-update/v2	Retrieve a set of Sensor Update Policies with additional support for uninstall protection by specifying their IDs
🟢 POST /policy/entities/sensor-update/v2	Create Sensor Update Policies by specifying details about the policy to create with additional support for uninstall protection
🟣 PATCH /policy/entities/sensor-update/v2	Update Sensor Update Policies by specifying the ID of the policy and details to update with additional support for uninstall protection
🔵 GET /policy/queries/sensor-update-kernels/{distinct-field}/v1	Retrieve kernel compatibility info for Sensor Update Builds
🔵 GET /policy/queries/sensor-update-members/v1	Search for members of a Sensor Update Policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria
🔵 GET /policy/queries/sensor-update/v1	Search for Sensor Update Policies in your environment by providing an FQL filter and paging details. Returns a set of Sensor Update Policy IDs which match the filter criteria

Sensor Usage Api

Endpoint	Description
🔵 GET /billing-dashboards-usage/aggregates/hourly-average/v1	Fetches hourly average. Each data point represents the average of how many unique AIDs were seen per hour for the previous 28 days.
🔵 GET /billing-dashboards-usage/aggregates/weekly-average/v1	Fetches weekly average. Each data point represents the average of how many unique AIDs were seen per week for the previous 28 days.

Sensor Visibility Exclusions

Endpoint	Description
🔵 GET /policy/entities/sv-exclusions/v1	Get a set of Sensor Visibility Exclusions by specifying their IDs
🟢 POST /policy/entities/sv-exclusions/v1	Create the sensor visibility exclusions
🟣 PATCH /policy/entities/sv-exclusions/v1	Update the sensor visibility exclusions
🔴 DELETE /policy/entities/sv-exclusions/v1	Delete the sensor visibility exclusions by id
🔵 GET /policy/queries/sv-exclusions/v1	Search for sensor visibility exclusions.

Serverless Exports

Endpoint	Description
🔵 GET /lambdas/entities/exports/files/v1	Download an export file
🔵 GET /lambdas/entities/exports/v1	Read export jobs entities
🟢 POST /lambdas/entities/exports/v1	Launch an export job of a Lambda Security resource. Maximum of 1 job in progress per resource. Use expand_vulnerabilities=true to get detailed vulnerability information.
🔵 GET /lambdas/queries/exports/v1	Query export jobs entities

Serverless Vulnerabilities

Endpoint	Description
🔵 GET /lambdas/combined/vulnerabilities/sarif/v1	Retrieve all lambda vulnerabilities that match the given query and return in the SARIF format

Spans

Endpoint	Description
🔵 GET /agentic-studio/entities/spans/v1	Retrieve spans for the provided ids.
🔵 GET /agentic-studio/queries/spans/v1	Query spans based on the provided filters.

Spotlight

Endpoint	Description
🔵 GET /spotlight/combined/installed-patches/v1	Get installed patches information for hosts

Spotlight Evaluation Logic

Endpoint	Description
🔵 GET /spotlight/combined/evaluation-logic/v1	Search for evaluation logic in your environment by providing a FQL filter and paging details. Returns a set of evaluation logic entities which match the filter criteria.
🔵 GET /spotlight/entities/evaluation-logic/v1	Get details on evaluation logic items by providing one or more IDs.
🔵 GET /spotlight/queries/evaluation-logic/v1	Search for evaluation logic in your environment by providing a FQL filter and paging details. Returns a set of evaluation logic IDs which match the filter criteria.

Spotlight Supported Evaluation

Endpoint	Description
🔵 GET /spotlight/combined/supported-evaluation-external/v1	Performs a combined query and get operation for retrieving RiskSupportedEvaluation entities.

Spotlight Vulnerabilities

Endpoint	Description
🔵 GET /spotlight/combined/vulnerabilities/v1	Search for Vulnerabilities in your environment by providing an FQL filter and paging details. Returns a set of Vulnerability entities which match the filter criteria
🔵 GET /spotlight/entities/remediations/v2	Get details on remediation by providing one or more IDs
🔵 GET /spotlight/entities/vulnerabilities/v2	Get details on vulnerabilities by providing one or more IDs
🔵 GET /spotlight/queries/vulnerabilities/v1	Search for Vulnerabilities in your environment by providing an FQL filter and paging details. Returns a set of Vulnerability IDs which match the filter criteria

Spotlight Vulnerability Metadata

Endpoint	Description
🔵 GET /spotlight/combined/vulnerability-metadata-external/v1	Performs a combined query and get operation for retrieving Risk (vulnerability metadata) entities.

Stream

Endpoint	Description
🔵 GET /agentic-studio-streaming/entities/agent-invocations/v1	Retrieves the stream of results for an invocation

Threatgraph

Endpoint	Description
🔵 GET /threatgraph/combined/{vertex-type}/summary/v1	Retrieve summary for a given vertex ID
🔵 GET /threatgraph/combined/edges/v1	Retrieve edges for a given vertex id. One edge type must be specified
🔵 GET /threatgraph/combined/ran-on/v1	Look up instances of indicators such as hashes, domain names, and ip addresses that have been seen on devices in your environment.
🔵 GET /threatgraph/entities/{vertex-type}/v1	Retrieve metadata for a given vertex ID. Note: This is a legacy endpoint used by CrowdStrike Store partners prior to release of the ThreatGraph OAuth 2.0 APIs. If you’re not currently using this endpoint, use the /v2 endpoint instead.
🔵 GET /threatgraph/entities/{vertex-type}/v2	Retrieve metadata for a given vertex ID
🔵 GET /threatgraph/queries/edge-types/v1	Show all available edge types

Tools

Endpoint	Description
🔵 GET /agentic-studio/entities/tools/v1	Retrieve tools entities for the provided id.
🔵 GET /agentic-studio/queries/tools/v1	Query tools based on the provided filters. Supports filtering by type, category, and other attributes.

Unidentified Containers

Endpoint	Description
🔵 GET /container-security/aggregates/unidentified-containers/count-by-date/v1	Returns the count of Unidentified Containers over the last 7 days
🔵 GET /container-security/aggregates/unidentified-containers/count/v1	Returns the total count of Unidentified Containers over a time period
🔵 GET /container-security/combined/unidentified-containers/v1	Search Unidentified Containers by the provided search criteria

User Management

Endpoint	Description
🟢 POST /user-management/aggregates/users/v1	Get host aggregates as specified via json in request body.
🔵 GET /user-management/combined/user-roles/v1	Deprecated : Please use GET /user-management/combined/user-roles/v2. Get User Grant(s). This endpoint lists both direct as well as flight control grants between a User and a Customer.
🔵 GET /user-management/combined/user-roles/v2	Get User Grant(s). This endpoint lists both direct as well as flight control grants between a User and a Customer.
🟢 POST /user-management/entities/roles/GET/v2	Get info about a role
🔵 GET /user-management/entities/roles/v1	Get info about a role
🟢 POST /user-management/entities/user-actions/v1	Apply actions to one or more User. Available action names: reset_2fa, reset_password. User UUIDs can be provided in ids param as part of request payload.
🟢 POST /user-management/entities/user-role-actions/v1	Grant or Revoke one or more role(s) to a user against a CID. User UUID, CID and Role ID(s) can be provided in request payload. Available Action(s) : grant, revoke
🟢 POST /user-management/entities/users/GET/v1	Get info about users including their name, UID and CID by providing user UUIDs
🟢 POST /user-management/entities/users/v1	Create a new user. After creating a user, assign one or more roles with POST '/user-management/entities/user-role-actions/v1'
🟣 PATCH /user-management/entities/users/v1	Modify an existing user's first or last name.
🔴 DELETE /user-management/entities/users/v1	Delete a user permanently.
🔵 GET /user-management/queries/roles/v1	Show role IDs for all roles available in your customer account. For more information on each role, provide the role ID to /user-management/entities/roles/v1.
🔵 GET /user-management/queries/users/v1	List user IDs for all users in your customer account. For more information on each user, provide the user ID to /user-management/entities/users/GET/v1.
🔵 GET /user-roles/entities/user-roles/v1	Deprecated : Please use GET /user-management/entities/roles/v1. Get info about a role
🟢 POST /user-roles/entities/user-roles/v1	Deprecated : Please use POST /user-management/entities/user-role-actions/v1. Assign one or more roles to a user
🔴 DELETE /user-roles/entities/user-roles/v1	Deprecated : Please use POST /user-management/entities/user-role-actions/v1. Revoke one or more roles from a user
🔵 GET /user-roles/queries/user-role-ids-by-cid/v1	Deprecated : Please use GET /user-management/queries/roles/v1. Show role IDs for all roles available in your customer account. For more information on each role, provide the role ID to /customer/entities/roles/v1.
🔵 GET /user-roles/queries/user-role-ids-by-user-uuid/v1	Deprecated : Please use GET /user-management/combined/user-roles/v1. Show role IDs of roles assigned to a user. For more information on each role, provide the role ID to /customer/entities/roles/v1.
🔵 GET /users/entities/users/v1	Deprecated : Please use POST /user-management/entities/users/GET/v1. Get info about a user
🟢 POST /users/entities/users/v1	Deprecated : Please use POST /user-management/entities/users/v1. Create a new user. After creating a user, assign one or more roles with POST /user-roles/entities/user-roles/v1
🟣 PATCH /users/entities/users/v1	Deprecated : Please use PATCH /user-management/entities/users/v1. Modify an existing user's first or last name
🔴 DELETE /users/entities/users/v1	Deprecated : Please use DELETE /user-management/entities/users/v1. Delete a user permanently
🔵 GET /users/queries/emails-by-cid/v1	Deprecated : Please use POST /user-management/entities/users/GET/v1. List the usernames (usually an email address) for all users in your customer account
🔵 GET /users/queries/user-uuids-by-cid/v1	Deprecated : Please use GET /user-management/queries/users/v1. List user IDs for all users in your customer account. For more information on each user, provide the user ID to /users/entities/user/v1.
🔵 GET /users/queries/user-uuids-by-email/v1	Deprecated : Please use GET /user-management/queries/users/v1. Get a user's ID by providing a username (usually an email address)

Workflows

Endpoint	Description
🔵 GET /workflows/combined/activities/v1	Search for activities by name. Returns all supported activities if no filter specified
🔵 GET /workflows/combined/activity-content/v1	Search for activities by name. Returns all supported activities if no filter specified
🔵 GET /workflows/combined/definitions/v1	Search workflow definitions based on the provided filter. NOTE: this API has a large response payload. Click on Wait if the page is unresponsive during loading
🔵 GET /workflows/combined/executions/v1	Search workflow executions based on the provided filter
🔵 GET /workflows/combined/triggers/v1	Search for triggers by namespaced identifier, i.e. FalconAudit, Detection, or FalconAudit/Detection/Status. Returns all triggers if no filter specified
🟢 POST /workflows/entities/definition-actions/v1	Enable or disable a workflow definition, or stop all executions for a definition. When a definition is disabled it will not execute against any new trigger events.
🔵 GET /workflows/entities/definitions/export/v1	Exports a workflow definition for the given definition ID
🟢 POST /workflows/entities/definitions/import/v1	Imports a workflow definition based on the provided model
🟡 PUT /workflows/entities/definitions/v1	Updates a workflow definition based on the provided model
🔴 DELETE /workflows/entities/definitions/v1	Accepts a list of workflow definition IDs and deletes those definitions and all their associated versions.
🟢 POST /workflows/entities/execute/v1	Executes an on-demand Workflow, the body is JSON used to trigger the execution, the response the execution ID(s)
🟢 POST /workflows/entities/execution-actions/v1	Allows a user to resume/retry a failed workflow execution, or cancel/stop a currently running workflow execution
🔵 GET /workflows/entities/execution-results/v1	Get execution result of a given execution
🔵 GET /workflows/entities/human-inputs/v1	Gets one or more specific human inputs by their IDs.
🟣 PATCH /workflows/entities/human-inputs/v1	Provides an input in response to a human input action. Depending on action configuration, one or more of Approve, Decline, and/or Escalate are permitted.
🟢 POST /workflows/entities/mock-executions/v1	Executes a workflow definition with mocks
🟢 POST /workflows/entities/single-node-executions/v1	Executes a single activity node, resulting in an execution where test_mode=true and single_node_execution=true, associated with a definition ID if provided
🔵 GET /workflows/queries/child-executions/v1	Search for child executions by providing a FQL filter and paging details. Returns the set of child workflow execution IDs which match the filter criteria
🟢 POST /workflows/system-definitions/deprovision/v1	Deprovisions a system definition that was previously provisioned on the target CID
🟢 POST /workflows/system-definitions/promote/v1	Promotes a version of a system definition for a customer. The customer must already have been provisioned. This allows the caller to apply an updated template version to a specific cid and expects all parameters to be supplied. If the template supports multi-instance the customer scope definition ID must be supplied to determine which customer workflow should be updated.
🟢 POST /workflows/system-definitions/provision/v1	Provisions a system definition onto the target CID by using the template and provided parameters

Zero Trust Assessment

Endpoint	Description
🔵 GET /zero-trust-assessment/entities/assessments/v1	Get Zero Trust Assessment data for one or more hosts by providing agent IDs (AID) and a customer ID (CID).
🔵 GET /zero-trust-assessment/entities/audit/v1	Get the Zero Trust Assessment audit report for one customer ID (CID).
🔵 GET /zero-trust-assessment/queries/assessments/v1	Get Zero Trust Assessment data for one or more hosts by providing a customer ID (CID) and a range of scores.

Resources

• n8n Community Nodes Documentation
• CrowdStrike US2 API Documentation

Built with

This node was generated using Zack Roberts Node Studio, powered by @zackrobertstech/n8n-openapi-node-builder (a maintained fork of @avantguardllc/n8n-openapi-node).

License

MIT