CrowdStrike Falcon CrowdStrike Subreddit

Using the Content Update Policies service collection

Uber class support Service class support Documentation Version Page Updated

Table of Contents

Operation IDDescription
queryCombinedContentUpdatePolicyMembers
PEP8query_policy_members_combined
Search for members of a Content Update Policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria.
queryCombinedContentUpdatePolicies
PEP8query_policies_combined
Search for Content Update Policies in your environment by providing an FQL filter and paging details. Returns a set of Content Update Policies which match the filter criteria.
performContentUpdatePoliciesAction
PEP8perform_action
Perform the specified action on the Content Update Policies specified in the request.
setContentUpdatePoliciesPrecedence
PEP8set_precedence
Sets the precedence of Content Update Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies when updating precedence.
getContentUpdatePolicies
PEP8get_policies
Retrieve a set of Content Update Policies by specifying their IDs.
createContentUpdatePolicies
PEP8create_policies
Create Content Update Policies by specifying details about the policy to create.
deleteContentUpdatePolicies
PEP8delete_policies
Delete a set of Content Update Policies by specifying their IDs.
updateContentUpdatePolicies
PEP8update_policies
Update Content Update Policies by specifying the ID of the policy and details to update.
queryContentUpdatePolicyMembers
PEP8query_policy_members
Search for members of a Content Update Policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria.
queryContentUpdatePolicies
PEP8query_policies
Search for Content Update Policies in your environment by providing an FQL filter and paging details. Returns a set of Content Update Policy IDs which match the filter criteria.

queryCombinedContentUpdatePolicyMembers

Search for members of a Content Update Policy in your environment by providing an FQL filter and paging details. Returns a set of host details which match the filter criteria.

PEP8 method name

query_policy_members_combined

Endpoint

MethodRoute
GET/policy/combined/content-update-members/v1

Required Scope

content-update-policies:read

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
idService Class SupportUber Class SupportquerystringThe ID of the Content Update Policy to search for members of.
filterService Class SupportUber Class SupportquerystringThe filter expression that should be used to limit the results.
offsetService Class SupportUber Class SupportqueryintegerThe offset to start retrieving records from.
limitService Class SupportUber Class SupportqueryintegerThe maximum records to return. [1-5000]
sortService Class SupportUber Class SupportquerystringThe property to sort by.
parametersService Class SupportUber Class SupportquerydictionaryFull set of query string parameters in a JSON formatted dictionary.

Usage

Service class example (PEP8 syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_policy_members_combined(id="string",
                                                filter="string",
                                                offset=integer,
                                                limit=integer,
                                                sort="string"
                                                )
print(response)
Service class example (Operation ID syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryCombinedContentUpdatePolicyMembers(id="string",
                                                          filter="string",
                                                          offset=integer,
                                                          limit=integer,
                                                          sort="string"
                                                          )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryCombinedContentUpdatePolicyMembers",
                          id="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )
print(response)

queryCombinedContentUpdatePolicies

Search for Content Update Policies in your environment by providing an FQL filter and paging details. Returns a set of Content Update Policies which match the filter criteria.

PEP8 method name

query_policies_combined

Endpoint

MethodRoute
GET/policy/combined/content-update/v1

Required Scope

content-update-policies:read

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filterService Class SupportUber Class SupportquerystringThe filter expression that should be used to limit the results.
offsetService Class SupportUber Class SupportqueryintegerThe offset to start retrieving records from.
limitService Class SupportUber Class SupportqueryintegerThe maximum records to return. [1-5000]
sortService Class SupportUber Class SupportquerystringThe property to sort by.
parametersService Class SupportUber Class SupportquerydictionaryFull set of query string parameters in a JSON formatted dictionary.

Usage

Service class example (PEP8 syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_policies_combined(filter="string",
                                          offset=integer,
                                          limit=integer,
                                          sort="string"
                                          )
print(response)
Service class example (Operation ID syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryCombinedContentUpdatePolicies(filter="string",
                                                     offset=integer,
                                                     limit=integer,
                                                     sort="string"
                                                     )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryCombinedContentUpdatePolicies",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )
print(response)

performContentUpdatePoliciesAction

Perform the specified action on the Content Update Policies specified in the request.

PEP8 method name

perform_action

Endpoint

MethodRoute
POST/policy/entities/content-update-actions/v1

Required Scope

content-update-policies:write

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
action_nameService Class SupportUber Class SupportquerystringThe action to perform.
action_parametersService Class SupportUber Class Supportquerydictionary or list of dictionariesAction specific parameter options.
bodyService Class SupportUber Class SupportbodydictionaryFull body payload as JSON formatted dictionary.
idsService Class SupportUber Class Supportbodystring or list of stringsContent update policy IDs to perform action against.
parametersService Class SupportUber Class SupportquerydictionaryFull set of query string parameters in a JSON formatted dictionary.

Usage

Service class example (PEP8 syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

act_params = {
    "name": "string",
    "value": "string"
}

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.perform_action(action_name="string",
                                 action_parameters=act_params,
                                 ids=id_list
                                 )
print(response)
Service class example (Operation ID syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

act_params = {
    "name": "string",
    "value": "string"
}

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.performContentUpdatePoliciesAction(action_name="string",
                                                     action_parameters=act_params,
                                                     ids=id_list
                                                     )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
  "action_parameters": [
    {
      "name": "string",
      "value": "string"
    }
  ],
  "ids": [
    "string"
  ]
}

response = falcon.command("performContentUpdatePoliciesAction",
                          action_name="string",
                          body=body_payload
                          )
print(response)

setContentUpdatePoliciesPrecedence

Sets the precedence of Content Update Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies when updating precedence.

PEP8 method name

set_precedence

Endpoint

MethodRoute
POST/policy/entities/content-update-precedence/v1

Required Scope

content-update-policies:write

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
bodyService Class SupportUber Class SupportbodydictionaryFull body payload as JSON formatted dictionary.
idsService Class SupportUber Class Supportbodystring or list of stringsID list in precedence order.

Usage

Service class example (PEP8 syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.set_precedence(ids=id_list)

print(response)
Service class example (Operation ID syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.setContentUpdatePoliciesPrecedence(ids=id_list)

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
  "ids": [
    "string"
  ]
}

response = falcon.command("setContentUpdatePoliciesPrecedence", body=body_payload)

print(response)

getContentUpdatePolicies

Retrieve a set of Content Update Policies by specifying their IDs.

PEP8 method name

get_policies

Endpoint

MethodRoute
GET/policy/entities/content-update/v1

Required Scope

content-update-policies:read

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
idsService Class SupportUber Class Supportquerystring or list of stringsContent update policy IDs to return.
parametersService Class SupportUber Class SupportquerydictionaryFull set of query string parameters in a JSON formatted dictionary.

Usage

Service class example (PEP8 syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_policies(ids=id_list)

print(response)
Service class example (Operation ID syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getContentUpdatePolicies(ids=id_list)

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getContentUpdatePolicies", ids=id_list)

print(response)

createContentUpdatePolicies

Create Content Update Policies by specifying details about the policy to create.

PEP8 method name

create_policies

Endpoint

MethodRoute
POST/policy/entities/content-update/v1

Required Scope

content-update-policies:write

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
bodyService Class SupportUber Class SupportbodydictionaryFull body payload as JSON formatted dictionary.
descriptionService Class SupportUber Class SupportbodystringContent Update policy description.
nameService Class SupportUber Class SupportbodystringContent Update policy name.
settingsService Class SupportUber Class SupportbodydictionaryContent Update policy settings.

Usage

Service class example (PEP8 syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

policy_settings = {
    "ring_assignment_settings": [
        {
            "delay_hours": "string",
            "id": "string",
            "ring_assignment": "string"
        }
    ]
}

response = falcon.create_policies(description="string", name="string", settings=policy_settings)

print(response)
Service class example (Operation ID syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

policy_settings = {
    "ring_assignment_settings": [
        {
            "delay_hours": "string",
            "id": "string",
            "ring_assignment": "string"
        }
    ]
}

response = falcon.createContentUpdatePolicies(description="string",
                                              name="string",
                                              settings=policy_settings
                                              )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
  "resources": [
    {
      "description": "string",
      "name": "string",
      "settings": {
        "ring_assignment_settings": [
          {
            "delay_hours": "string",
            "id": "string",
            "ring_assignment": "string"
          }
        ]
      }
    }
  ]
}

response = falcon.command("createContentUpdatePolicies", body=body_payload)

print(response)

deleteContentUpdatePolicies

Delete a set of Content Update Policies by specifying their IDs.

PEP8 method name

delete_policies

Endpoint

MethodRoute
DELETE/policy/entities/content-update/v1

Required Scope

content-update-policies:write

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
idsService Class SupportUber Class Supportquerystring or list of stringsContent update policy IDs to remove.
parametersService Class SupportUber Class SupportquerydictionaryFull set of query string parameters in a JSON formatted dictionary.

Usage

Service class example (PEP8 syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_policies(ids=id_list)

print(response)
Service class example (Operation ID syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteContentUpdatePolicies(ids=id_list)

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteContentUpdatePolicies", ids=id_list)

print(response)

updateContentUpdatePolicies

Update Content Update Policies by specifying the ID of the policy and details to update.

PEP8 method name

update_policies

Endpoint

MethodRoute
PATCH/policy/entities/content-update/v1

Required Scope

content-update-policies:write

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
bodyService Class SupportUber Class SupportbodydictionaryFull body payload as JSON formatted dictionary.
descriptionService Class SupportUber Class SupportbodystringContent Update policy description.
idService Class SupportUber Class SupportbodystringContent Update policy ID to update.
nameService Class SupportUber Class SupportbodystringContent Update policy name.
settingsService Class SupportUber Class SupportbodydictionaryContent Update policy settings.

Usage

Service class example (PEP8 syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

policy_settings = {
    "ring_assignment_settings": [
        {
            "delay_hours": "string",
            "id": "string",
            "ring_assignment": "string"
        }
    ]
}

response = falcon.update_policies(description="string",
                                  id="string",
                                  name="string",
                                  settings=policy_settings
                                  )
print(response)
Service class example (Operation ID syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

policy_settings = {
    "ring_assignment_settings": [
        {
            "delay_hours": "string",
            "id": "string",
            "ring_assignment": "string"
        }
    ]
}

response = falcon.updateContentUpdatePolicies(description="string",
                                              id="string",
                                              name="string",
                                              settings=policy_settings
                                              )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
  "resources": [
    {
      "description": "string",
      "id": "string",
      "name": "string",
      "settings": {
        "ring_assignment_settings": [
          {
            "delay_hours": "string",
            "id": "string",
            "ring_assignment": "string"
          }
        ]
      }
    }
  ]
}

response = falcon.command("updateContentUpdatePolicies", body=body_payload)

print(response)

queryContentUpdatePolicyMembers

Search for members of a Content Update Policy in your environment by providing an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria.

PEP8 method name

query_policy_members

Endpoint

MethodRoute
GET/policy/queries/content-update-members/v1

Required Scope

content-update-policies:read

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
idService Class SupportUber Class SupportquerystringThe ID of the Content Update Policy to search for members of.
filterService Class SupportUber Class SupportquerystringThe filter expression that should be used to limit the results.
offsetService Class SupportUber Class SupportqueryintegerThe offset to start retrieving records from.
limitService Class SupportUber Class SupportqueryintegerThe maximum records to return. [1-5000]
sortService Class SupportUber Class SupportquerystringThe property to sort by.
parametersService Class SupportUber Class SupportquerydictionaryFull set of query string parameters in a JSON formatted dictionary.

Usage

Service class example (PEP8 syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_policy_members(id="string",
                                       filter="string",
                                       offset=integer,
                                       limit=integer,
                                       sort="string"
                                       )
print(response)
Service class example (Operation ID syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryContentUpdatePolicyMembers(id="string",
                                                  filter="string",
                                                  offset=integer,
                                                  limit=integer,
                                                  sort="string"
                                                  )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryContentUpdatePolicyMembers",
                          id="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )
print(response)

queryContentUpdatePolicies

Search for Content Update Policies in your environment by providing an FQL filter and paging details. Returns a set of Content Update Policy IDs which match the filter criteria.

PEP8 method name

query_policies

Endpoint

MethodRoute
GET/policy/queries/content-update/v1

Required Scope

content-update-policies:read

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filterService Class SupportUber Class SupportquerystringThe filter expression that should be used to limit the results.
offsetService Class SupportUber Class SupportqueryintegerThe offset to start retrieving records from.
limitService Class SupportUber Class SupportqueryintegerThe maximum records to return. [1-5000]
sortService Class SupportUber Class SupportquerystringThe property to sort by.
parametersService Class SupportUber Class SupportquerydictionaryFull set of query string parameters in a JSON formatted dictionary.

Usage

Service class example (PEP8 syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_policies(filter="string",
                                 offset=integer,
                                 limit=integer,
                                 sort="string"
                                 )
print(response)
Service class example (Operation ID syntax)
from falconpy import ContentUpdatePolicies

falcon = ContentUpdatePolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryContentUpdatePolicies(filter="string",
                                             offset=integer,
                                             limit=integer,
                                             sort="string"
                                             )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryContentUpdatePolicies",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )
print(response)