Skip to content

Event Streams

Joshua Hiller edited this page Apr 11, 2021 · 21 revisions

CrowdStrike Falcon Twitter URL

Using the Event Streams service collection

Uber class support Uber class support

Table of Contents

API Function Description
refreshActiveStreamSession Refresh an active event stream. Use the URL shown in a GET /sensors/entities/datafeed/v2 response.
listAvailableStreamsOAuth2 Discover all event streams in your environment

refreshActiveStreamSession

Refresh an active event stream. Use the URL shown in a GET /sensors/entities/datafeed/v2 response.

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
action_name query string Action name. Allowed value is refresh_active_stream_session.
appId query string Label that identifies your connection. Max: 32 alphanumeric characters (a-z, A-Z, 0-9).
partition path integer Partition to request data for.

Usage

Service class example
from falconpy import event_streams as FalconES

falcon = FalconES.Event_Streams(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

PARAMS = {
    'action_name': 'string',
    'appId': 'string'
}

PARTITION = 0   #Refresh the partition we are working with

response = falcon.refreshActiveStreamSession(parameters=PARAMS, partition=PARTITION)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

PARAMS = {
    'action_name': 'string',
    'appId': 'string'
}

PARTITION = 0   #Refresh the partition we are working with

response = falcon.command('refreshActiveStreamSession', parameters=PARAMS, partition=PARTITION)
print(response)
falcon.deauthenticate()

listAvailableStreamsOAuth2

Discover all event streams in your environment

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
appId query string Label that identifies your connection. Max: 32 alphanumeric characters (a-z, A-Z, 0-9).
format query string Format for streaming events. Valid values: json, flatjson

Usage

Service class example
from falconpy import event_streams as FalconES

falcon = FalconES.Event_Streams(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

PARAMS = {
    'appId': 'string',
    'format': 'string'
}

response = falcon.listAvailableStreamsOAuth2(parameters=PARAMS)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

PARAMS = {
    'appId': 'string',
    'format': 'string'
}

response = falcon.command('listAvailableStreamsOAuth2', parameters=PARAMS)
print(response)
falcon.deauthenticate()

CrowdStrike Falcon

Clone this wiki locally