--- title: CrowdStrike Falcon FileVantage slug: connectors/crowdstrike-falcon-filevantage docTags: createdAt: 2026-06-09T16:29:51.405Z --- This connector allows you to retrieve information on the changes in CrowdStrike Falcon FileVantage. ## Capabilities This connector has the following capabilities: - Get Changes ## Asset Setup This connector supports authentication via OAuth2 and interact with detections and network containment. - Each API endpoint requires authorization via an OAuth2 token. - Your first API request should retrieve an OAuth2 token using the oauth2/token endpoint, such as [https://api.crowdstrike.com/oauth2/token](https://api.crowdstrike.com/oauth2/token). - For subsequent requests, include the OAuth2 token in an HTTP authorization header. ## Notes - [CrowdStrike Falcon FileVantage API Documentation Link](https://www.falconpy.io/Service-Collections/FileVantage.html#getchanges) - [Falconpy Docs](https://www.falconpy.io/Service-Collections/Quarantine.html) # Configurations ## Oauth 2.0 Client Credentials Authenticates using oauth 2.0 client credentials ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | -------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | token\_url | | string | Required | | client\_id | The client ID | string | Required | | client\_secret | The client secret. | string | Required | | scope | Permission scopes for this action. | array | Optional | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Get Changes This action retrieves information on changes. Retrieve key attributes of Falcon FileVantage changes for the specified ids. ### Endpoint - **URL:** `/filevantage/entities/changes/v2` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------- | | `parameters.ids` | array | Required | One or more change ids in the form of ids=ID1\&ids=ID2. The maximum number of ids that can be requested at once is 500. | ### Input Example `{"parameters":{"ids":["1","2"]}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | ---------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.pagination.offset` | number | Output field: meta.pagination.offset | | `meta.pagination.total` | number | Output field: meta.pagination.total | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.query_time` | number | Time value | | `meta.trace_id` | string | Unique identifier | | `meta.writes` | object | Output field: meta.writes | | `meta.writes.resources_affected` | number | Output field: meta.writes.resources\_affected | | `resources` | array | Output field: resources | | `resources.action_timestamp` | string | Output field: resources.action\_timestamp | | `resources.action_type` | string | Type of the resource | | `resources.aid` | string | Unique identifier | | `resources.attributes` | array | Output field: resources.attributes | | `resources.attributes.attribute` | string | Output field: resources.attributes.attribute | | `resources.attributes.change` | string | Output field: resources.attributes.change | | `resources.cid` | string | Unique identifier | | `resources.command_line` | string | Output field: resources.command\_line | | `resources.diff` | object | Output field: resources.diff | | `resources.diff.after` | object | Output field: resources.diff.after | | `resources.diff.after.hash` | object | Output field: resources.diff.after.hash | | `resources.diff.after.hash.sha256` | string | Output field: resources.diff.after.hash.sha256 | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Wed, 15 Nov 2023 18:14:54 GMT","Content-Type":"application/json","Content-Length":"212","Connection":"keep-alive","Content-Encoding":"gzip","Set-Cookie":"fimstickounet=1700072095.287.613.340356|e35349c49e1306d19f343f6ed7e1d4db; Expire...","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"3d61e49f-0348-4fa8-8101-198f445fa71d","X-Ratelimit-Limit"...` # Response Headers | **Header** | **Description** | **Example** | | | ------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------- | | Connection | HTTP response header: Connection | keep-alive | | | Content-Encoding | HTTP response header: Content-Encoding | gzip | | | Content-Length | The length of the response body in bytes | 212 | | | Content-Type | The media type of the resource | application/json | | | Date | The date and time at which the message was originated | Wed, 15 Nov 2023 18:14:54 GMT | | | Server | Information about the software used by the origin server | nginx | | | Set-Cookie | HTTP response header: Set-Cookie | fimstickounet=1700072095.287.613.340356 | e35349c49e1306d19f343f6ed7e1d4db; Expires=Fri, 17-Nov-23 18:14:54 GMT; Max-Age=172800; Path=/; Secure; HttpOnly | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains | | | X-Cs-Region | HTTP response header: X-Cs-Region | us-1 | | | X-Cs-Traceid | HTTP response header: X-Cs-Traceid | 3d61e49f-0348-4fa8-8101-198f445fa71d | | | X-Ratelimit-Limit | The number of requests allowed in the current rate limit window | 6000 | | | X-Ratelimit-Remaining | The number of requests remaining in the current rate limit window | 5999 | |