Device Control Policies - CrowdStrike/falconpy GitHub Wiki

CrowdStrike Falcon CrowdStrike Subreddit

Using the Device Control Policies service collection

Uber class support Service class support Documentation Version Page Updated

Table of Contents

Operation ID Description
queryCombinedDeviceControlPolicyMembers
PEP 8 query_combined_policy_members
Search for members of a Device Control Policy in your environment by providing a FQL filter and paging details. Returns a set of host details which match the filter criteria
queryCombinedDeviceControlPolicies
PEP 8 query_combined_policies
Search for Device Control Policies in your environment by providing a FQL filter and paging details. Returns a set of Device Control Policies which match the filter criteria
getDefaultDeviceControlPolicies
PEP 8 get_default_policies
Retrieve the configuration for the Default Device Control Policy.
updateDefaultDeviceControlPolicies
PEP 8 update_default_policies
Update the configuration for the Default Device Control Policy.
performDeviceControlPoliciesAction
PEP 8 perform_action
Perform the specified action on the Device Control Policies specified in the request
setDeviceControlPoliciesPrecedence
PEP 8 set_precedence
Sets the precedence of Device Control Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence
getDeviceControlPolicies
PEP 8 get_policies
Retrieve a set of Device Control Policies by specifying their IDs
createDeviceControlPolicies
PEP 8 create_policies
Create Device Control Policies by specifying details about the policy to create
deleteDeviceControlPolicies
PEP 8 delete_policies
Delete a set of Device Control Policies by specifying their IDs
updateDeviceControlPolicies
PEP 8 update_policies
Update Device Control Policies by specifying the ID of the policy and details to update
queryDeviceControlPolicyMembers
PEP 8 query_policy_members
Search for members of a Device Control Policy in your environment by providing a FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria
queryDeviceControlPolicies
PEP 8 query_policies
Search for Device Control Policies in your environment by providing a FQL filter and paging details. Returns a set of Device Control Policy IDs which match the filter criteria

Passing credentials

WARNING

client_id and client_secret are keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

queryCombinedDeviceControlPolicyMembers

Search for members of a Device Control Policy in your environment by providing a FQL filter and paging details. Returns a set of host details which match the filter criteria

PEP8 method name

query_combined_policy_members

Endpoint

Method Route
GET /policy/combined/device-control-members/v1

Required Scope

device-control-policies:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter
Service Class Support
Uber Class Support
 query string FQL Syntax formatted string used to limit the results.
id
Service Class Support
Uber Class Support
 query integer The ID of the Device Control Policy to search for members of.
limit
Service Class Support
Uber Class Support
 query integer Maximum number of records to return.

(Max: 5000)
offset
Service Class Support
Uber Class Support
 query integer Starting index of overall result set from which to return ids.
sort
Service Class Support
Uber Class Support
 query string The property to sort by. (Ex: modified_timestamp.desc)
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_combined_policy_members(id="string",
                                                filter="string",
                                                offset=integer,
                                                limit=integer,
                                                sort="string"
                                                )
print(response)
Service class example (Operation ID syntax)
from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryCombinedDeviceControlPolicyMembers(id="string",
                                                          filter="string",
                                                          offset=integer,
                                                          limit=integer,
                                                          sort="string"
                                                          )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryCombinedDeviceControlPolicyMembers",
                          id="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )
print(response)

queryCombinedDeviceControlPolicies

Search for Device Control Policies in your environment by providing a FQL filter and paging details. Returns a set of Device Control Policies which match the filter criteria

PEP8 method name

query_combined_policies

Endpoint

Method Route
GET /policy/combined/device-control/v1

Required Scope

device-control-policies:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter
Service Class Support
Uber Class Support
 query string FQL Syntax formatted string used to limit the results.
limit
Service Class Support
Uber Class Support
 query integer Maximum number of records to return.

(Max: 5000)
offset
Service Class Support
Uber Class Support
 query integer Starting index of overall result set from which to return ids.
sort
Service Class Support
Uber Class Support
 query string The property to sort by. (Ex: modified_timestamp.desc)
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_combined_policies(filter="string",
                                          offset=integer,
                                          limit=integer,
                                          sort="string"
                                          )
print(response)
Service class example (Operation ID syntax)
from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryCombinedDeviceControlPolicies(filter="string",
                                                     offset=integer,
                                                     limit=integer,
                                                     sort="string"
                                                     )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryCombinedDeviceControlPolicies",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )
print(response)

getDefaultDeviceControlPolicies

Retrieve the configuration for the Default Device Control Policy.

PEP8 method name

get_default_policies

Endpoint

Method Route
GET /policy/entities/default-device-control/v1

Required Scope

device-control-policies:read

Content-Type

  • Produces: application/json

Keyword Arguments

No keywords or arguments accepted.

Usage

Service class example (PEP8 syntax)
from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.get_default_policies()
print(response)
Service class example (Operation ID syntax)
from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.getDefaultDeviceControlPolicies()
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("getDefaultDeviceControlPolicies")
print(response)

Back to Table of Contents

updateDefaultDeviceControlPolicies

Retrieve the configuration for the Default Device Control Policy.

PEP8 method name

update_default_policies

Endpoint

Method Route
PATCH /policy/entities/default-device-control/v1

Required Scope

device-control-policies:write

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
blocked_custom_message
Service Class Support
Uber Class Support
 body string String containing the blocked notification custom message. When this keyword is provided, you do not need to provide the blocked_notification or body keywords.
blocked_notification
Service Class Support
Uber Class Support
 body dictionary Dictionary containing the blocked notification message.
{
    "custom_message": "string",
    "use_custom": true
}
body
Service Class Support
Uber Class Support
 body dictionary Full body payload in JSON format.
restricted_custom_message
Service Class Support
Uber Class Support
 body string String containing the restricted notification custom message. When this keyword is provided, you do not need to provide the restricted_notification or body keywords.
restricted_notification
Service Class Support
Uber Class Support
 body dictionary Dictionary containing the restricted notification message.
{
    "custom_message": "string",
    "use_custom": true
}

Usage

Service class example (PEP8 syntax)
from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

blocked = {
    "custom_message": "string",
    "use_custom": True
}
restricted = {
    "custom_message": "string",
    "use_custom": True
}

response = falcon.update_default_policies(blocked_custom_message="string",
                                          blocked_notification=blocked,
                                          restricted_custom_message="string",
                                          restricted_notification=restricted
                                          )
print(response)
Service class example (Operation ID syntax)
from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

blocked = {
    "custom_message": "string",
    "use_custom": True
}
restricted = {
    "custom_message": "string",
    "use_custom": True
}

response = falcon.updateDefaultDeviceControlPolicies(blocked_custom_message="string",
                                                     blocked_notification=blocked,
                                                     restricted_custom_message="string",
                                                     restricted_notification=restricted
                                                     )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

blocked = {
    "custom_message": "string",
    "use_custom": True
}
restricted = {
    "custom_message": "string",
    "use_custom": True
}

response = falcon.command("updateDefaultDeviceControlPolicies",
                          blocked_custom_message="string",
                          blocked_notification=blocked,
                          restricted_custom_message="string",
                          restricted_notification=restricted
                          )
print(response)

Back to Table of Contents

performDeviceControlPoliciesAction

Perform the specified action on the Device Control Policies specified in the request

PEP8 method name

perform_action

Endpoint

Method Route
POST /policy/entities/device-control-actions/v1

Required Scope

device-control-policies:write

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
action_name
Service Class Support
Uber Class Support
 query string The action to perform. Allowed values:
  • add-host-group
  • add-rule-group
  • disable
  • enable
  • remove-host-group
  • remove-rule-group
action_parameters
Service Class Support
Uber Class Support
 body list of dictionaries List of name / value pairs in JSON format.
body
Service Class Support
Uber Class Support
 body dictionary Full body payload in JSON format.
group_id
Service Class Support
Uber Class Support
 body
action_parameters 		string Host Group ID to apply the policy to. String. Overridden if action_parameters is specified.
ids
Service Class Support
Uber Class Support
 body string or list of strings Device Control Policy ID(s) to perform actions against.
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.perform_action(action_name="string",
                                 group_id="HOST_GROUP_ID",
                                 ids="ID_TO_UPDATE"
                                 )
print(response)
Service class example (Operation ID syntax)
from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

act_params = [{
    "name": "group_id",
    "value": "HOST_GROUP_ID"
}]

response = falcon.performDeviceControlPoliciesAction(action_name="string",
                                                     action_parameters=act_params,
                                                     ids="ID_TO_UPDATE"
                                                     )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

act_params = [{
    "name": "group_id",
    "value": "HOST_GROUP_ID"
}]

PARAMS = {
    "action_name": "string"  # Can also provide this using the `action_name` keyword
}

# Only one ID may be updated at a time
BODY = {
    "action_parameters": act_params,
    "ids": ["ID_TO_UPDATE"]
}

response = falcon.command("performDeviceControlPoliciesAction", parameters=PARAMS, body=BODY)
print(response)

setDeviceControlPoliciesPrecedence

Sets the precedence of Device Control Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence

PEP8 method name

set_precedence

Endpoint

Method Route
POST /policy/entities/device-control-precedence/v1

Required Scope

device-control-policies:write

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body
Service Class Support
Uber Class Support
 body dictionary Full body payload in JSON format.
ids
Service Class Support
Uber Class Support
 body string or list of strings Device Control Policy ID(s) to adjust precedence.
platform_name
Service Class Support
Uber Class Support
 body string OS platform name. (Linux, Mac, Windows)

Usage

Service class example (PEP8 syntax)
from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.set_precedence(ids=id_list, platform_name="string")
print(response)
Service class example (Operation ID syntax)
from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.setDeviceControlPoliciesPrecedence(ids=id_list, platform_name="string")
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

BODY = {
    "ids": id_list,
    "platform_name": "string"
}

response = falcon.command("setDeviceControlPoliciesPrecedence", body=BODY)
print(response)

getDeviceControlPolicies

Retrieve a set of Device Control Policies by specifying their IDs

PEP8 method name

get_policies

Endpoint

Method Route
GET /policy/entities/device-control/v1

Required Scope

device-control-policies:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
ids
Service Class Support
Uber Class Support
 query string or list of strings The ID(s) of the Device Control Policies to return.
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_policies(ids=id_list)
print(response)
Service class example (Operation ID syntax)
from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getDeviceControlPolicies(ids=id_list)
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getDeviceControlPolicies", ids=id_list)
print(response)

createDeviceControlPolicies

Create Device Control Policies by specifying details about the policy to create

PEP8 method name

create_policies

Endpoint

Method Route
POST /policy/entities/device-control/v1

Required Scope

device-control-policies:write

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body
Service Class Support
Uber Class Support
 body dictionary Full body payload in JSON format.
description
Service Class Support
Uber Class Support
 body string Device Control Policy description.
clone_id
Service Class Support
Uber Class Support
 body string Device Control Policy ID to clone.
name
Service Class Support
Uber Class Support
 body string Device Control Policy name.
platform_name
Service Class Support
Uber Class Support
 body string Device Control Policy platform.
settings
Service Class Support
Uber Class Support
 body dictionary Device Control specific settings.

Usage

Service class example (PEP8 syntax)
from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

dc_settings = {
    "classes": [
    {
        "action": "FULL_ACCESS",
        "exceptions": [
        {
            "action": "string",
            "class": "string",
            "combined_id": "string",
            "id": "string",
            "match_method": "string",
            "product_id": "string",
            "product_id_decimal": "string",
            "product_name": "string",
            "serial_number": "string",
            "vendor_id": "string",
            "vendor_id_decimal": "string",
            "vendor_name": "string"
        }
        ],
        "id": "string"
    }
    ],
    "end_user_notification": "TRUE",
    "enforcement_mode": "string",
    "id": "string"
}

response = falcon.create_policies(clone_id="string",
                                  description="string",
                                  name="string",
                                  platform_name="string",
                                  settings=dc_settings
                                  )
print(response)
Service class example (Operation ID syntax)
from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

dc_settings = {
    "classes": [
    {
        "action": "FULL_ACCESS",
        "exceptions": [
        {
            "action": "string",
            "class": "string",
            "combined_id": "string",
            "id": "string",
            "match_method": "string",
            "product_id": "string",
            "product_id_decimal": "string",
            "product_name": "string",
            "serial_number": "string",
            "vendor_id": "string",
            "vendor_id_decimal": "string",
            "vendor_name": "string"
        }
        ],
        "id": "string"
    }
    ],
    "end_user_notification": "TRUE",
    "enforcement_mode": "string",
    "id": "string"
}


response = falcon.createDeviceControlPolicies(clone_id="string",
                                              description="string",
                                              name="string",
                                              platform_name="string",
                                              settings=dc_settings
                                              )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

BODY = {
    "resources": [
        {
            "clone_id": "string",
            "description": "string",
            "name": "string",
            "platform_name": "Windows",
            "settings": {
                "classes": [
                {
                    "action": "FULL_ACCESS",
                    "exceptions": [
                    {
                        "action": "string",
                        "class": "string",
                        "combined_id": "string",
                        "id": "string",
                        "match_method": "string",
                        "product_id": "string",
                        "product_id_decimal": "string",
                        "product_name": "string",
                        "serial_number": "string",
                        "vendor_id": "string",
                        "vendor_id_decimal": "string",
                        "vendor_name": "string"
                    }
                    ],
                    "id": "string"
                }
                ],
                "end_user_notification": "TRUE",
                "enforcement_mode": "string",
                "id": "string"
            }
        }
    ]
}

response = falcon.command("createDeviceControlPolicies", body=BODY)
print(response)

deleteDeviceControlPolicies

Delete a set of Device Control Policies by specifying their IDs

PEP8 method name

delete_policies

Endpoint

Method Route
DELETE /policy/entities/device-control/v1

Required Scope

device-control-policies:write

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
ids
Service Class Support
Uber Class Support
 query string or list of strings The ID(s) of the Device Control Policies to delete.
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_policies(ids=id_list)
print(response)
Service class example (Operation ID syntax)
from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteDeviceControlPolicies(ids=id_list)
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteDeviceControlPolicies", ids=id_list)
print(response)

updateDeviceControlPolicies

Update Device Control Policies by specifying the ID of the policy and details to update

PEP8 method name

update_policies

Endpoint

Method Route
PATCH /policy/entities/device-control/v1

Required Scope

device-control-policies:write

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body
Service Class Support
Uber Class Support
 body dictionary Full body payload in JSON format.
description
Service Class Support
Uber Class Support
 body string Device Control Policy description.
id
Service Class Support
Uber Class Support
 body string Device Control Policy ID to update.
name
Service Class Support
Uber Class Support
 body string Device Control Policy name.
settings
Service Class Support
Uber Class Support
 body dictionary Device control specific policy settings.

Usage

Service class example (PEP8 syntax)
from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.update_policies(description="string",
                                  id="string",
                                  name="string",
                                  platform_name="string"
                                  )
print(response)
Service class example (Operation ID syntax)
from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.updateDeviceControlPolicies(description="string",
                                              id="string",
                                              name="string",
                                              platform_name="string"
                                              )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

BODY = {
    "resources": [
        {
            "clone_id": "string",
            "description": "string",
            "name": "string",
            "platform_name": "Windows",
            "settings": {
                "classes": [
                {
                    "action": "FULL_ACCESS",
                    "exceptions": [
                    {
                        "action": "string",
                        "class": "string",
                        "combined_id": "string",
                        "id": "string",
                        "match_method": "string",
                        "product_id": "string",
                        "product_id_decimal": "string",
                        "product_name": "string",
                        "serial_number": "string",
                        "vendor_id": "string",
                        "vendor_id_decimal": "string",
                        "vendor_name": "string"
                    }
                    ],
                    "id": "string"
                }
                ],
                "end_user_notification": "TRUE",
                "enforcement_mode": "string",
                "id": "string"
            }
        }
    ]
}

response = falcon.command("updateDeviceControlPolicies", body=BODY)
print(response)

queryDeviceControlPolicyMembers

Search for members of a Device Control Policy in your environment by providing a FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria

PEP8 method name

query_policy_members

Endpoint

Method Route
GET /policy/queries/device-control-members/v1

Required Scope

device-control-policies:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter
Service Class Support
Uber Class Support
 query string FQL Syntax formatted string used to limit the results.
id
Service Class Support
Uber Class Support
 query integer The ID of the Device Control Policy to search for members of.
limit
Service Class Support
Uber Class Support
 query integer Maximum number of records to return.

(Max: 5000)
offset
Service Class Support
Uber Class Support
 query integer Starting index of overall result set from which to return ids.
sort
Service Class Support
Uber Class Support
 query string The property to sort by. (Ex: modified_timestamp.desc)
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_policy_members(id="string",
                                       filter="string",
                                       offset=integer,
                                       limit=integer,
                                       sort="string"
                                       )
print(response)
Service class example (Operation ID syntax)
from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryDeviceControlPolicyMembers(id="string",
                                                  filter="string",
                                                  offset=integer,
                                                  limit=integer,
                                                  sort="string"
                                                  )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryDeviceControlPolicyMembers",
                          id="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )
print(response)

queryDeviceControlPolicies

Search for Device Control Policies in your environment by providing a FQL filter and paging details. Returns a set of Device Control Policy IDs which match the filter criteria

PEP8 method name

query_policies

Endpoint

Method Route
GET /policy/queries/device-control/v1

Required Scope

device-control-policies:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter
Service Class Support
Uber Class Support
 query string FQL Syntax formatted string used to limit the results.
limit
Service Class Support
Uber Class Support
 query integer Maximum number of records to return.

(Max: 5000)
offset
Service Class Support
Uber Class Support
 query integer Starting index of overall result set from which to return ids.
sort
Service Class Support
Uber Class Support
 query string The property to sort by. (Ex: modified_timestamp.desc)
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_policies(filter="string",
                                 offset=integer,
                                 limit=integer,
                                 sort="string"
                                 )
print(response)
Service class example (Operation ID syntax)
from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryDeviceControlPolicies(filter="string",
                                             offset=integer,
                                             limit=integer,
                                             sort="string"
                                             )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryDeviceControlPolicies",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )
print(response)

⚠️ **GitHub.com Fallback** ⚠️