repository·main·Indexed 19 days ago
https://github.com/crowdstrike/falconpyThe official CrowdStrike Falcon SDK for Python. FalconPy abstracts OAuth2 API interactions and simplifies the management of CrowdStrike Falcon service collections through Service Classes and a comprehensive Uber Class. It supports Python 3.8 through 3.14, providing features such as automatic token refreshing, cloud region autodiscovery, and proxy routing.
The ODS Manager is a wxPython desktop application designed to manage CrowdStrike Falcon On-Demand Scans (ODS). It allows users to:
Note on Deletion: Because the Falcon ODS API lacks a deletion endpoint, the application's 'Delete Selected' functionality is designed to cancel active scans instead of removing records from the API.
The samples/detects/ directory contains implementation examples for interacting with CrowdStrike's Detects API. These examples demonstrate how to programmatically manage and triage alerts generated by the CrowdStrike Falcon sensor.
Key focus areas include:
You can find detailed information about FalconPy through several channels:
help() function.Samples are organized into the following functional areas:
The samples/rtr/ directory contains various Python examples for leveraging the CrowdStrike Real Time Response (RTR) API to respond to security events. Key capabilities demonstrated include:
Endpoint module in FalconPy provides a complete mapping of all endpoints available within the CrowdStrike Falcon API. It includes the necessary parameter definitions and method signatures required to interact with these endpoints programmatically using Python. Use this module to perform operations related to endpoint management and visibility within the Falcon platform.The FalconPy sample library uses specific indicators to categorize the type of implementation used in each example:
Uber class to perform tasks._payload module provides a collection of helper utilities designed to assist in the creation and formatting of JSON BODY payloads for API requests. Use these helpers to ensure your request bodies conform to the expected structure required by the CrowdStrike Falcon APIs.The Uber Class (FalconComplete) acts as a single harness to interact with the entire CrowdStrike Falcon API. Instead of importing individual service classes, you can use this class to access operations across all services using operation IDs.
Key Features:
override keyword.# Example concept of using the Uber Class (referencing api_complete.py)
# Use operation IDs to interact with the API
# Use the 'override' keyword for operations not yet explicitly defined in submodulesToken Authentication (also known as legacy authentication) involves providing a previously assigned bearer token directly to the auth_token keyword when instantiating a FalconPy Service Class.
⚠️ Warning: Token Authentication creates an instance of a FalconPy Service Class that cannot reauthenticate itself because it does not have access to your API credentials. If you are implementing a long-running process, you must manually regenerate your bearer token before it expires and update the credentials dictionary within the Service Class.
While Direct and Object authentication are often preferred, Token Authentication is still the best option in specific scenarios where you already possess a valid bearer token and do not wish to provide client IDs/secrets to the class instance.
To use this method, you pass the token during class instantiation:
# Conceptual usage pattern
service_class = ServiceClass(auth_token='YOUR_BEARER_TOKEN')When searching for hosts, you can choose between two pagination methods depending on your requirements for continuous data retrieval.
| Operation | Description |
| :--- | : |
| QueryDevicesByFilter | Search for hosts by platform, hostname, IP, etc. Uses standard pagination (offsets).
| QueryDevicesByFilterScroll | Search for hosts with continuous pagination capability. It uses an offset pointer that expires after 2 minutes but has no maximum limit on the number of results retrieved.