CrowdStrike Falcon CrowdStrike Subreddit

Using the Device Content service collection

Uber class support Service class support Documentation Version Page Updated

Table of Contents

Operation IDDescription
entities_states_v1
PEP8get_states
Retrieve the host content state for a number of ids between 1 and 100.
queries_states_v1
PEP8query_states
Query for the content state of the host.

entities_states_v1

Retrieve the host content state for a number of IDs between 1 and 100.

PEP8 method name

get_states

Endpoint

MethodRoute
GET/device-content/entities/states/v1

Required Scope

device-content:read

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
idsService Class Support
Uber Class Supportqueryarray (string)The IDs of the devices to fetch the content state of.
parametersService Class Support
Uber Class SupportquerydictionaryFull query string parameters payload in JSON format. Not required if using other keywords.

Usage

Service class example (PEP8 syntax)
from falconpy import DeviceContent

falcon = DeviceContent(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_states(ids=id_list)

print(response)
Service class example (Operation ID syntax)
from falconpy import DeviceContent

falcon = DeviceContent(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_states_v1(ids=id_list)

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_states_v1", ids=id_list)

print(response)

queries_states_v1

Query for the content state of the host.

PEP8 method name

query_states

Endpoint

MethodRoute
GET/device-content/queries/states/v1

Required Scope

device-content:read

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filterService Class Support
Uber Class SupportquerystringThe FQL search filter.
limitService Class Support
Uber Class SupportqueryintegerThe max number of resource ids to return.
sortService Class Support
Uber Class SupportquerystringWhat field to sort the results on.
offsetService Class Support
Uber Class SupportqueryintegerThe offset token returned from the previous query. If none was returned, there are no more pages to the result set.
parametersService Class Support
Uber Class SupportquerydictionaryFull query string parameters payload in JSON format. Not required if using other keywords.

Usage

Service class example (PEP8 syntax)
from falconpy import DeviceContent

falcon = DeviceContent(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.query_states(limit=integer,
                               sort="string",
                               offset=integer,
                               filter="string"
                               )
print(response)
Service class example (Operation ID syntax)
from falconpy import DeviceContent

falcon = DeviceContent(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.queries_states_v1(limit=integer,
                                    sort="string",
                                    offset=integer,
                                    filter="string"
                                    )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queries_states_v1", 
                          limit=integer,
                          sort="string",
                          offset=integer,
                          filter="string"
                          )
print(response)