CrowdStrike Falcon FileVantage
This connector allows you to retrieve information on the changes in CrowdStrike Falcon FileVantage.
Capabilities
This connector has the following capabilities:
- Get Changes
Asset Setup
This connector supports authentication via OAuth2 and interact with detections and network containment.
- Each API endpoint requires authorization via an OAuth2 token.
- Your first API request should retrieve an OAuth2 token using the oauth2/token endpoint, such as https://api.crowdstrike.com/oauth2/token.
- For subsequent requests, include the OAuth2 token in an HTTP authorization header.
Notes
Configurations
Oauth 2.0 Client Credentials
Authenticates using oauth 2.0 client credentials
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
token_url | ο»Ώ | string | Required |
client_id | The client ID | string | Required |
client_secret | The client secret. | string | Required |
scope | Permission scopes for this action. | array | Optional |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Get Changes
This action retrieves information on changes. Retrieve key attributes of Falcon FileVantage changes for the specified ids.
Endpoint
- URL: /filevantage/entities/changes/v2
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.ids | array | Required | One or more change ids in the form of ids=ID1&ids=ID2. The maximum number of ids that can be requested at once is 500. |
Input Example
{"parameters":{"ids":["1","2"]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
meta | object | Output field: meta |
meta.pagination | object | Output field: meta.pagination |
meta.pagination.limit | number | Output field: meta.pagination.limit |
meta.pagination.offset | number | Output field: meta.pagination.offset |
meta.pagination.total | number | Output field: meta.pagination.total |
meta.powered_by | string | Output field: meta.powered_by |
meta.query_time | number | Time value |
meta.trace_id | string | Unique identifier |
meta.writes | object | Output field: meta.writes |
meta.writes.resources_affected | number | Output field: meta.writes.resources_affected |
resources | array | Output field: resources |
resources.action_timestamp | string | Output field: resources.action_timestamp |
resources.action_type | string | Type of the resource |
resources.aid | string | Unique identifier |
resources.attributes | array | Output field: resources.attributes |
resources.attributes.attribute | string | Output field: resources.attributes.attribute |
resources.attributes.change | string | Output field: resources.attributes.change |
resources.cid | string | Unique identifier |
resources.command_line | string | Output field: resources.command_line |
resources.diff | object | Output field: resources.diff |
resources.diff.after | object | Output field: resources.diff.after |
resources.diff.after.hash | object | Output field: resources.diff.after.hash |
resources.diff.after.hash.sha256 | string | Output field: resources.diff.after.hash.sha256 |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Wed, 15 Nov 2023 18:14:54 GMT","Content-Type":"application/json","Content-Length":"212","Connection":"keep-alive","Content-Encoding":"gzip","Set-Cookie":"fimstickounet=1700072095.287.613.340356|e35349c49e1306d19f343f6ed7e1d4db; Expire...","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"3d61e49f-0348-4fa8-8101-198f445fa71d","X-Ratelimit-Limit"...
Response Headers
Header | Description | Example | |
|---|---|---|---|
Connection | HTTP response header: Connection | keep-alive | |
Content-Encoding | HTTP response header: Content-Encoding | gzip | |
Content-Length | The length of the response body in bytes | 212 | |
Content-Type | The media type of the resource | application/json | |
Date | The date and time at which the message was originated | Wed, 15 Nov 2023 18:14:54 GMT | |
Server | Information about the software used by the origin server | nginx | |
Set-Cookie | HTTP response header: Set-Cookie | fimstickounet=1700072095.287.613.340356 | e35349c49e1306d19f343f6ed7e1d4db; Expires=Fri, 17-Nov-23 18:14:54 GMT; Max-Age=172800; Path=/; Secure; HttpOnly |
Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains | |
X-Cs-Region | HTTP response header: X-Cs-Region | us-1 | |
X-Cs-Traceid | HTTP response header: X-Cs-Traceid | 3d61e49f-0348-4fa8-8101-198f445fa71d | |
X-Ratelimit-Limit | The number of requests allowed in the current rate limit window | 6000 | |
X-Ratelimit-Remaining | The number of requests remaining in the current rate limit window | 5999 |