Skip to content

Cloud Connect AWS

Jump to bottom
Joshua Hiller edited this page Apr 17, 2021 · 20 revisions

CrowdStrike Falcon Twitter URL

Using the Cloud Connect AWS service collection

Uber class support Uber class support

Table of Contents

API Function Description
QueryAWSAccounts Search for provisioned AWS Accounts by providing an FQL filter and paging details. Returns a set of AWS accounts which match the filter criteria
GetAWSSettings Retrieve a set of Global Settings which are applicable to all provisioned AWS accounts
GetAWSAccounts Retrieve a set of AWS Accounts by specifying their IDs
ProvisionAWSAccounts Provision AWS Accounts by specifying details about the accounts to provision
DeleteAWSAccounts Delete a set of AWS Accounts by specifying their IDs
UpdateAWSAccounts Update AWS Accounts by specifying the ID of the account and details to update
CreateOrUpdateAWSSettings Create or update Global Settings which are applicable to all provisioned AWS accounts
VerifyAWSAccountAccess Performs an Access Verification check on the specified AWS Account IDs
QueryAWSAccountsForIDs Search for provisioned AWS Accounts by providing an FQL filter and paging details. Returns a set of AWS account IDs which match the filter criteria

QueryAWSAccounts

Search for provisioned AWS Accounts by providing an FQL filter and paging details. Returns a set of AWS accounts which match the filter criteria

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
limit query integer The maximum records to return. [1-500]. Defaults to 100.
offset query integer The offset to start retrieving records from
sort query string The property to sort by (e.g. alias.desc or state.asc)
filter query string The filter expression that should be used to limit the results

Usage

Service class example
from falconpy import cloud_connect_aws as FalconAWS

falcon = FalconAWS.Cloud_Connect_AWS(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

PARAMS = {
    'limit': integer,
    'offset': integer,
    'sort': 'string',
    'filter': 'string'
}

response = falcon.QueryAWSAccounts(parameters=PARAMS)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

PARAMS = {
    'limit': integer,
    'offset': integer,
    'sort': 'string',
    'filter': 'string'
}

response = falcon.command('QueryAWSAccounts', parameters=PARAMS)
print(response)
falcon.deauthenticate()

GetAWSSettings

Retrieve a set of Global Settings which are applicable to all provisioned AWS accounts

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

No parameters

Usage

Service class example
from falconpy import cloud_connect_aws as FalconAWS

falcon = FalconAWS.Cloud_Connect_AWS(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

response = falcon.GetAWSSettings()
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

response = falcon.command('GetAWSSettings')
print(response)
falcon.deauthenticate()

GetAWSAccounts

Retrieve a set of AWS Accounts by specifying their IDs

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ ids query array (string) IDs of accounts to retrieve details

Usage

Service class example
from falconpy import cloud_connect_aws as FalconAWS

falcon = FalconAWS.Cloud_Connect_AWS(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

IDS = 'ID1,ID2,ID3'

response = falcon.GetAWSAccounts(ids=IDS)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

IDS = 'ID1,ID2,ID3'

response = falcon.command('GetAWSAccounts', ids=IDS)
print(response)
falcon.deauthenticate()

ProvisionAWSAccounts

Provision AWS Accounts by specifying details about the accounts to provision

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
mode query string Mode for provisioning. Allowed values are manual or cloudformation. Defaults to manual if not defined.
✅ body body string

Usage

Service class example
from falconpy import cloud_connect_aws as FalconAWS

falcon = FalconAWS.Cloud_Connect_AWS(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

PARAMS = {
    'mode': 'string'
}

BODY = {
    'Body Payload': 'See body description above'
}

response = falcon.ProvisionAWSAccounts(parameters=PARAMS, body=BODY)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

PARAMS = {
    'mode': 'string'
}

BODY = {
    'Body Payload': 'See body description above'
}

response = falcon.command('ProvisionAWSAccounts', parameters=PARAMS, body=BODY)
print(response)
falcon.deauthenticate()

DeleteAWSAccounts

Delete a set of AWS Accounts by specifying their IDs

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ ids query array (string) IDs of accounts to remove

Usage

Service class example
from falconpy import cloud_connect_aws as FalconAWS

falcon = FalconAWS.Cloud_Connect_AWS(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

IDS = 'ID1,ID2,ID3'

response = falcon.DeleteAWSAccounts(ids=IDS)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

IDS = 'ID1,ID2,ID3'

response = falcon.command('DeleteAWSAccounts', ids=IDS)
print(response)
falcon.deauthenticate()

UpdateAWSAccounts

Update AWS Accounts by specifying the ID of the account and details to update

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ body body string

Usage

Service class example
from falconpy import cloud_connect_aws as FalconAWS

falcon = FalconAWS.Cloud_Connect_AWS(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

BODY = {
    'Body Payload': 'See body description above'
}

response = falcon.UpdateAWSAccounts(body=BODY)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

BODY = {
    'Body Payload': 'See body description above'
}

response = falcon.command('UpdateAWSAccounts', body=BODY)
print(response)
falcon.deauthenticate()

CreateOrUpdateAWSSettings

Create or update Global Settings which are applicable to all provisioned AWS accounts

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ body body string

Usage

Service class example
from falconpy import cloud_connect_aws as FalconAWS

falcon = FalconAWS.Cloud_Connect_AWS(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

BODY = {
    'Body Payload': 'See body description above'
}

response = falcon.CreateOrUpdateAWSSettings(body=BODY)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

BODY = {
    'Body Payload': 'See body description above'
}

response = falcon.command('CreateOrUpdateAWSSettings', body=BODY)
print(response)
falcon.deauthenticate()

VerifyAWSAccountAccess

Performs an Access Verification check on the specified AWS Account IDs

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ ids query array (string) IDs of accounts to verify access on

Usage

Service class example
from falconpy import cloud_connect_aws as FalconAWS

falcon = FalconAWS.Cloud_Connect_AWS(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

IDS = 'ID1,ID2,ID3'

response = falcon.VerifyAWSAccountAccess(ids=IDS)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

IDS = 'ID1,ID2,ID3'

response = falcon.command('VerifyAWSAccountAccess', ids=IDS)
print(response)
falcon.deauthenticate()

QueryAWSAccountsForIDs

Search for provisioned AWS Accounts by providing an FQL filter and paging details. Returns a set of AWS account IDs which match the filter criteria

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
limit query integer The maximum records to return. [1-500]. Defaults to 100.
offset query integer The offset to start retrieving records from
sort query string The property to sort by (e.g. alias.desc or state.asc)
filter query string The filter expression that should be used to limit the results

Usage

Service class example
from falconpy import cloud_connect_aws as FalconAWS

falcon = FalconAWS.Cloud_Connect_AWS(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

PARAMS = {
    'limit': integer,
    'offset': integer,
    'sort': 'string',
    'filter': 'string'
}

response = falcon.QueryAWSAccountsForIDs(parameters=PARAMS)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

PARAMS = {
    'limit': integer,
    'offset': integer,
    'sort': 'string',
    'filter': 'string'
}

response = falcon.command('QueryAWSAccountsForIDs', parameters=PARAMS)
print(response)
falcon.deauthenticate()

CrowdStrike Falcon

Clone this wiki locally