[CrowdStrike Falcon] Create new Certificate Based Exclusions. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Delete the exclusions by id. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Find all exclusion IDs matching the query with filter. Discover IDs with falcon_cb_exclusions_query_v1. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for cert-based exclusions. This returns matching IDs only, not the records themselves — pass the IDs to falcon_cb_exclusions_get_v1 to read the detail. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Updates existing Certificate Based Exclusions. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Retrieves certificate signing information for a file. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Create Content Update Policies by specifying details about the policy to create. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Delete a set of Content Update Policies by specifying their IDs. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Retrieve a set of Content Update Policies by specifying their IDs. Discover IDs with falcon_query_content_update_policies. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Perform the specified action on the Content Update Policies specified in the request. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for Content Update Policies in your environment by providing an FQL filter and paging details. Returns a set of Content Update Policies which match the filter criteria. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for members of a Content Update Policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for Content Update Policies in your environment by providing an FQL filter and paging details. Returns a set of Content Update Policy IDs which match the filter criteria. This returns matching IDs only, not the records themselves — pass the IDs to falcon_get_content_update_policies to read the detail. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for members of a Content Update Policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria. This returns matching IDs only, not the records themselves. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for content versions available for pinning given the category. This returns matching IDs only, not the records themselves. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Sets the precedence of Content Update Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies when updating precedence. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Update Content Update Policies by specifying the ID of the policy and details to update. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Queries for release-notes resources and returns details. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Queries for releases resources and returns details. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get deployment resources by ids. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] returns the release notes for the IDs in the request. Discover IDs with falcon_query_release_notes_v1. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] returns the release notes for the IDs in the request with EA and GA dates in ISO 8601 format. Discover IDs with falcon_query_release_notes_v1. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Queries for release-notes resources and returns ids. This returns matching IDs only, not the records themselves — pass the IDs to falcon_get_entity_i_ds_by_query_post to read the detail. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Retrieve the host content state for a number of ids between 1 and 100. Discover IDs with falcon_queries_states_v1. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Query for the content state of the host. This returns matching IDs only, not the records themselves — pass the IDs to falcon_entities_states_v1 to read the detail. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Create Device Control Policies by specifying details about the policy to create. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Delete a set of Device Control Policies by specifying their IDs. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Retrieve the configuration for a Default Device Control Policy. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get default device control settings (USB and Bluetooth). Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Retrieve a set of Device Control Policies by specifying their IDs. Discover IDs with falcon_query_device_control_policies. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get device control policies for the given filter criteria. (USB and Bluetooth). Discover IDs with falcon_query_device_control_policies. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Weakens or changes which USB and Bluetooth device classes this policy blocks, for every host in its scope. Opening a class removes the block that was stopping those devices from being used. This is a partial merge, so classes you omit keep their current settings. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Weakens or changes USB and Bluetooth enforcement for every host in this device control policy's scope. Updates the policy's base settings; this is a partial merge, so settings you omit keep their current values. The v1 twin of this tool is falcon_update_device_control_policies. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Perform the specified action on the Device Control Policies specified in the request. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Create/clone a device control policy (USB and Bluetooth). Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for Device Control Policies in your environment by providing an FQL filter and paging details. Returns a set of Device Control Policies which match the filter criteria. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for members of a Device Control Policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for Device Control Policies in your environment by providing an FQL filter and paging details. Returns a set of Device Control Policy IDs which match the filter criteria. This returns matching IDs only, not the records themselves — pass the IDs to falcon_get_device_control_policies to read the detail. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for members of a Device Control Policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria. This returns matching IDs only, not the records themselves. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Sets the precedence of Device Control Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Update the configuration for a Default Device Control Policy. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Update the configuration for Default Device Control Settings. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Update Device Control Policies by specifying the ID of the policy and details to update. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Aggregate events for customer. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Aggregate rules within a policy for customer. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Aggregate rule groups for customer. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Aggregate rules for customer. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Create new network locations provided, and return the ID. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Create new rule group on a platform for a customer with a name and description, and return the ID. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Validates the request of creating a new rule group on a platform for a customer with a name and description. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Delete network location entities by ID. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Delete rule group entities by ID. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get rule group entities by ID. These groups do not contain their rule entites, just the rule IDs in precedence order. Discover IDs with falcon_firewall_query_rule_groups. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get rule entities by ID (64-bit unsigned int as decimal string) or Family ID (32-character hexadecimal string). Discover IDs with falcon_firewall_query_rules. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Find all event IDs matching the query with filter. This returns matching IDs only, not the records themselves — pass the IDs to falcon_get_events to read the detail. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with an after cursor taken from meta.pagination.after on the previous response. Prefer the cursor over offset — it is the only paging model that reaches past 10,000 records. This endpoint also accepts a legacy offset parameter, which is bound by CrowdStrike's 10,000-record window (offset + limit); the cursor is not, so prefer the cursor for anything that might run long. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Find all rule group IDs matching the query with filter. This returns matching IDs only, not the records themselves — pass the IDs to falcon_firewall_get_rule_groups to read the detail. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with an after cursor taken from meta.pagination.after on the previous response. Prefer the cursor over offset — it is the only paging model that reaches past 10,000 records. This endpoint also accepts a legacy offset parameter, which is bound by CrowdStrike's 10,000-record window (offset + limit); the cursor is not, so prefer the cursor for anything that might run long. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Find all rule IDs matching the query with filter. This returns matching IDs only, not the records themselves — pass the IDs to falcon_firewall_get_rules to read the detail. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with an after cursor taken from meta.pagination.after on the previous response. Prefer the cursor over offset — it is the only paging model that reaches past 10,000 records. This endpoint also accepts a legacy offset parameter, which is bound by CrowdStrike's 10,000-record window (offset + limit); the cursor is not, so prefer the cursor for anything that might run long. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get events entities by ID and optionally version. Discover IDs with falcon_firewall_query_events. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get the firewall field specifications by ID. Discover IDs with falcon_query_firewall_fields. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get a summary of network locations entities by ID. Discover IDs with falcon_query_network_locations. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get network locations entities by ID. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get platforms by ID, e.g., windows or mac or droid. Discover IDs with falcon_query_platforms. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get policy container entities by policy ID. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get the firewall field specification IDs for the provided platform. This returns matching IDs only, not the records themselves — pass the IDs to falcon_get_firewall_fields to read the detail. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get a list of network location IDs. This returns matching IDs only, not the records themselves — pass the IDs to falcon_get_network_locations to read the detail. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with an after cursor taken from meta.pagination.after on the previous response. Prefer the cursor over offset — it is the only paging model that reaches past 10,000 records. This endpoint also accepts a legacy offset parameter, which is bound by CrowdStrike's 10,000-record window (offset + limit); the cursor is not, so prefer the cursor for anything that might run long. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get the list of platform names. This returns matching IDs only, not the records themselves — pass the IDs to falcon_get_platforms to read the detail. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Find all firewall rule IDs matching the query with filter, and return them in precedence order. This returns matching IDs only, not the records themselves. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Updates the network locations provided, and return the ID. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Updates the network locations metadata such as polling_intervals for the cid. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Updates the network locations precedence according to the list of ids provided. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Update an identified policy container, including local logging functionality. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Update name, description, or enabled status of a rule group, or create, edit, delete, or reorder rules. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Validates the request of updating name, description, or enabled status of a rule group, or create, edit, delete, or reorder rules. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Updates the network locations provided, and return the ID. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Validates that the test pattern matches the executable filepath glob pattern. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Create Firewall Policies by specifying details about the policy to create. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Delete a set of Firewall Policies by specifying their IDs. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Retrieve a set of Firewall Policies by specifying their IDs. Discover IDs with falcon_query_firewall_policies. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Perform the specified action on the Firewall Policies specified in the request. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for Firewall Policies in your environment by providing an FQL filter and paging details. Returns a set of Firewall Policies which match the filter criteria. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for members of a Firewall Policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for Firewall Policies in your environment by providing an FQL filter and paging details. Returns a set of Firewall Policy IDs which match the filter criteria. This returns matching IDs only, not the records themselves — pass the IDs to falcon_get_firewall_policies to read the detail. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for members of a Firewall Policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria. This returns matching IDs only, not the records themselves. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Sets the precedence of Firewall Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Update Firewall Policies by specifying the ID of the policy and details to update. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Create Host Groups by specifying details about the group to create. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Delete a set of Host Groups by specifying their IDs. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Retrieve a set of Host Groups by specifying their IDs. Discover IDs with falcon_query_host_groups. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Perform the specified action on the Host Groups specified in the request. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for members of a Host Group in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for Host Groups in your environment by providing an FQL filter and paging details. Returns a set of Host Groups which match the filter criteria. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for members of a Host Group in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria. This returns matching IDs only, not the records themselves. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for Host Groups in your environment by providing an FQL filter and paging details. Returns a set of Host Group IDs which match the filter criteria. This returns matching IDs only, not the records themselves — pass the IDs to falcon_get_host_groups to read the detail. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Edits a host group in place. Host group membership drives policy assignment, so a change here can move hosts out of the policy scope that was protecting them. Creating a new group with falcon_create_host_groups is additive and is not gated this way. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Create a device migration job. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Query host migration IDs. This returns matching IDs only, not the records themselves — pass the IDs to falcon_get_host_migrations_v1 to read the detail. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get host migration details. Discover IDs with falcon_get_host_migration_i_ds_v1. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get destinations for a migration. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Query migration jobs. This returns matching IDs only, not the records themselves — pass the IDs to falcon_get_migrations_v1 to read the detail. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get migration job details. Discover IDs with falcon_get_migration_i_ds_v1. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get host migration aggregates as specified via json in request body. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Perform an action on host migrations. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get migration aggregates as specified via json in request body. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Perform an action on a migration job. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for hosts in your environment by platform, hostname, IP, and other criteria. Returns full device records. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for hidden hosts in your environment by platform, hostname, IP, and other criteria. Returns full device records. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Permanently delete hosts from the system. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Performs the specified action on the provided group IDs. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get details on one or more hosts by providing host IDs in a POST body. Supports up to a maximum 5000 IDs. Discover IDs with falcon_query_devices_by_filter. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get details on one or more hosts by providing agent IDs (AID). You can get a host's agent IDs (AIDs) from the QueryDevicesByFilter endpoint, the Falcon console or the Streaming API. Discover IDs with falcon_query_devices_by_filter. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get details on one or more hosts by providing host IDs as a query parameter. Supports up to a maximum 100 IDs. Discover IDs with falcon_query_devices_by_filter. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get the online status for one or more hosts by specifying each host’s unique ID. Successful requests return an HTTP 200 response and the status for each host identified by a `state` of `online`, `offline`, or `unknown` for each host, identified by host `id`. QueryDevicesByFilter to get a list of host IDs. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Take various actions on the hosts in your environment. Contain or lift containment on a host. Hide or unhide a host. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get details on one or more hosts by providing host IDs in a POST body. Supports up to a maximum 5000 IDs. Discover IDs with falcon_query_devices_by_filter. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Retrieve details about recent login sessions for a set of devices. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Retrieve details about recent interactive login sessions for a set of devices powered by the Host Timeline. A max of 10 device ids can be specified. Use limit to bound the response size. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for hosts in your environment by platform, hostname, IP, and other criteria. This returns matching IDs only, not the records themselves — pass the IDs to falcon_get_device_details to read the detail. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for hosts in your environment by platform, hostname, IP, and other criteria with continuous pagination capability (based on offset pointer which expires after 2 minutes with no maximum limit). This returns matching IDs only, not the records themselves. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Retrieve history of IP and MAC addresses of devices. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Retrieve hidden hosts that match the provided filter criteria. This returns matching IDs only, not the records themselves. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Append or remove one or more Falcon Grouping Tags on one or more hosts. Tags must be of the form FalconGroupingTags/. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for audit events by providing an FQL filter and paging details. This returns matching IDs only, not the records themselves — pass the IDs to falcon_audit_events_read to read the detail. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Gets the details of one or more audit events by id. Discover IDs with falcon_audit_events_query. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Check current installation token settings. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Update installation token settings. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Creates a token. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Deletes a token immediately. To revoke a token, use tokens_update instead. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for tokens by providing an FQL filter and paging details. This returns matching IDs only, not the records themselves — pass the IDs to falcon_tokens_read to read the detail. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Gets the details of one or more tokens by id. Discover IDs with falcon_tokens_query. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Updates one or more tokens. Use this endpoint to edit labels, change expiration, revoke, or restore. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Create the IOA exclusions. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Delete the IOA exclusions by id. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get a set of IOA Exclusions by specifying their IDs. Discover IDs with falcon_query_ioa_exclusions_v1. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for IOA exclusions. This returns matching IDs only, not the records themselves — pass the IDs to falcon_get_ioa_exclusions_v1 to read the detail. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get Self Service IOA Exclusion aggregates as specified via json in the request body. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Create new Self Service IOA Exclusions. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Delete the Self Service IOA Exclusions rule by id. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Create a report of Self Service IOA Exclusions scoped by the given filters. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get the Self Service IOA Exclusions rules by id. Discover IDs with falcon_ss_ioa_exclusions_search_v2. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get Self Service IOA Exclusions rules for matched IFN/CLI for child, parent and grandparent. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get defaults for Self Service IOA Exclusions based on provided IFN/CLI for child, parent and grandparent. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for Self Service IOA Exclusions. This returns matching IDs only, not the records themselves — pass the IDs to falcon_ss_ioa_exclusions_get_v2 to read the detail. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Update the Self Service IOA Exclusions rule by id. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Update the IOA exclusions. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Create the ML exclusions. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Delete the ML exclusions by id. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get exclusion aggregates as specified via json in request body. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Create the exclusions, with ancestor fields. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Delete the exclusions by id, with ancestor fields. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get all exclusions. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Create a report of ML exclusions scoped by the given filters. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get the exclusions by id, with ancestor fields. Discover IDs with falcon_exclusions_search_v2. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Actions used to manipulate the content of exclusions, with ancestor fields. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Executes an SDMF data frame query against exclusion entities. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for exclusions, with ancestor fields. This returns matching IDs only, not the records themselves — pass the IDs to falcon_exclusions_get_v2 to read the detail. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Update the exclusions by id, with ancestor fields. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get a set of ML Exclusions by specifying their IDs. Discover IDs with falcon_query_ml_exclusions_v1. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for ML exclusions. This returns matching IDs only, not the records themselves — pass the IDs to falcon_get_ml_exclusions_v1 to read the detail. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Update the ML exclusions. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Trigger on-boarding process for a mobile device. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Trigger on-boarding process for a mobile device. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Create Prevention Policies by specifying details about the policy to create. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Delete a set of Prevention Policies by specifying their IDs. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Retrieve a set of Prevention Policies by specifying their IDs. Discover IDs with falcon_query_prevention_policies. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Perform the specified action on the Prevention Policies specified in the request. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for Prevention Policies in your environment by providing an FQL filter and paging details. Returns a set of Prevention Policies which match the filter criteria. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for members of a Prevention Policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for Prevention Policies in your environment by providing an FQL filter and paging details. Returns a set of Prevention Policy IDs which match the filter criteria. This returns matching IDs only, not the records themselves — pass the IDs to falcon_get_prevention_policies to read the detail. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Search for members of a Prevention Policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria. This returns matching IDs only, not the records themselves. The filter parameter uses CrowdStrike FQL (Falcon Query Language), not OData or JMESPath: property:'value', joined with + for AND and , for OR, and comparison via :> :< :>= :<= (for example platform_name:'Windows'+last_seen:>'now-7d'). Quote string values with single quotes. Paged with offset and limit. CrowdStrike caps classic offset paging at a 10,000-record window (offset + limit), so narrow the filter rather than paging past it. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Sets the precedence of Prevention Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Update Prevention Policies by specifying the ID of the policy and details to update. Supply bodyJson as a JSON object matching the Falcon request body for this operation. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Create a new profile group. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Delete profile groups by IDs. THIS CHANGES A LIVE CUSTOMER ENVIRONMENT and requires explicit confirmation before use. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Write tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.

[CrowdStrike Falcon] Get a list of groups with users that belong to them. Supply bodyJson as a JSON object matching the Falcon request body for this operation. Returns the raw Falcon envelope: meta, resources and errors. The errors array can be populated even on a successful call when part of a batch fails, so check it as well as the records in resources. A 403 means this API client was created without the Read tick on this service collection — scopes are fixed when the key is made, so the key must be re-issued in the Falcon console.