Device Control Policies

Using the Device Control Policies service collection

Uber class support Service class support Documentation Version Page Updated

WARNING

client_id and client_secret are keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

queryCombinedDeviceControlPolicyMembers

Search for members of a Device Control Policy in your environment by providing a FQL filter and paging details. Returns a set of host details which match the filter criteria

PEP8 method name

query_combined_policy_members

Endpoint

Method	Route
	`/policy/combined/device-control-members/v1`

Content-Type

Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
filter	query	string	FQL Syntax formatted string used to limit the results.
id	query	integer	The ID of the Device Control Policy to search for members of.
limit	query	integer	Maximum number of records to return. (Max: 5000)
offset	query	integer	Starting index of overall result set from which to return ids.
sort	query	string	The property to sort by. (Ex: modified_timestamp.desc)
parameters	query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_combined_policy_members(id="string",
                                                filter="string",
                                                offset=integer,
                                                limit=integer,
                                                sort="string"
                                                )
print(response)

Service class example (Operation ID syntax)

from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryCombinedDeviceControlPolicyMembers(id="string",
                                                          filter="string",
                                                          offset=integer,
                                                          limit=integer,
                                                          sort="string"
                                                          )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("queryCombinedDeviceControlPolicyMembers",
                          id="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )
print(response)

queryCombinedDeviceControlPolicies

Search for Device Control Policies in your environment by providing a FQL filter and paging details. Returns a set of Device Control Policies which match the filter criteria

PEP8 method name

query_combined_policies

Endpoint

Method	Route
	`/policy/combined/device-control/v1`

Content-Type

Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
filter	query	string	FQL Syntax formatted string used to limit the results.
limit	query	integer	Maximum number of records to return. (Max: 5000)
offset	query	integer	Starting index of overall result set from which to return ids.
sort	query	string	The property to sort by. (Ex: modified_timestamp.desc)
parameters	query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_combined_policies(filter="string",
                                          offset=integer,
                                          limit=integer,
                                          sort="string"
                                          )
print(response)

Service class example (Operation ID syntax)

from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryCombinedDeviceControlPolicies(filter="string",
                                                     offset=integer,
                                                     limit=integer,
                                                     sort="string"
                                                     )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("queryCombinedDeviceControlPolicies",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )
print(response)

performDeviceControlPoliciesAction

Perform the specified action on the Device Control Policies specified in the request

PEP8 method name

perform_action

Endpoint

Method	Route
	`/policy/entities/device-control-actions/v1`

Content-Type

Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
action_name	query	string	The action to perform. Allowed values: add-host-group disable enable remove-host-group
action_parameters	body	list of dictionaries	List of name / value pairs in JSON format.
body	body	dictionary	Full body payload in JSON format.
group_id	body action_parameters	string	Host Group ID to apply the policy to. String. Overridden if `action_parameters` is specified.
ids	body	string or list of strings	Device Control Policy ID(s) to perform actions against.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.perform_action(action_name="string",
                                 group_id="HOST_GROUP_ID",
                                 ids="ID_TO_UPDATE"
                                 )
print(response)

Service class example (Operation ID syntax)

from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

act_params = [{
    "name": "group_id",
    "value": "HOST_GROUP_ID"
}]

response = falcon.performDeviceControlPoliciesAction(action_name="string",
                                                     action_parameters=act_params,
                                                     ids="ID_TO_UPDATE"
                                                     )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

act_params = [{
    "name": "group_id",
    "value": "HOST_GROUP_ID"
}]

PARAMS = {
    "action_name": "string"  # Can also provide this using the `action_name` keyword
}

# Only one ID may be updated at a time
BODY = {
    "action_parameters": act_params,
    "ids": ["ID_TO_UPDATE"]
}

response = falcon.command("performDeviceControlPoliciesAction", parameters=PARAMS, body=BODY)
print(response)

setDeviceControlPoliciesPrecedence

Sets the precedence of Device Control Policies based on the order of IDs specified in the request. The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence

PEP8 method name

set_precedence

Endpoint

Method	Route
	`/policy/entities/device-control-precedence/v1`

Content-Type

Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
ids	body	string or list of strings	Device Control Policy ID(s) to adjust precedence.
platform_name	body	string	OS platform name. (Linux, Mac, Windows)

Usage

Service class example (PEP8 syntax)

from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.set_precedence(ids=id_list, platform_name="string")
print(response)

Service class example (Operation ID syntax)

from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.setDeviceControlPoliciesPrecedence(ids=id_list, platform_name="string")
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

BODY = {
    "ids": id_list,
    "platform_name": "string"
}

response = falcon.command("setDeviceControlPoliciesPrecedence", body=BODY)
print(response)

getDeviceControlPolicies

Retrieve a set of Device Control Policies by specifying their IDs

PEP8 method name

get_policies

Endpoint

Method	Route
	`/policy/entities/device-control/v1`

Content-Type

Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	The ID(s) of the Device Control Policies to return.
parameters			query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_policies(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getDeviceControlPolicies(ids=id_list)
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getDeviceControlPolicies", ids=id_list)
print(response)

createDeviceControlPolicies

Create Device Control Policies by specifying details about the policy to create

PEP8 method name

create_policies

Endpoint

Method	Route
	`/policy/entities/device-control/v1`

Content-Type

Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
description	body	string	Device Control Policy description.
clone_id	body	string	Device Control Policy ID to clone.
name	body	string	Device Control Policy name.
platform_name	body	string	Device Control Policy platform.
settings	body	dictionary	Device Control specific settings.

Usage

Service class example (PEP8 syntax)

from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

dc_settings = {
    "classes": [
    {
        "action": "FULL_ACCESS",
        "exceptions": [
        {
            "action": "string",
            "class": "string",
            "combined_id": "string",
            "id": "string",
            "match_method": "string",
            "product_id": "string",
            "product_id_decimal": "string",
            "product_name": "string",
            "serial_number": "string",
            "vendor_id": "string",
            "vendor_id_decimal": "string",
            "vendor_name": "string"
        }
        ],
        "id": "string"
    }
    ],
    "end_user_notification": "TRUE",
    "enforcement_mode": "string",
    "id": "string"
}

response = falcon.create_policies(clone_id="string",
                                  description="string",
                                  name="string",
                                  platform_name="string",
                                  settings=dc_settings
                                  )
print(response)

Service class example (Operation ID syntax)

from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

dc_settings = {
    "classes": [
    {
        "action": "FULL_ACCESS",
        "exceptions": [
        {
            "action": "string",
            "class": "string",
            "combined_id": "string",
            "id": "string",
            "match_method": "string",
            "product_id": "string",
            "product_id_decimal": "string",
            "product_name": "string",
            "serial_number": "string",
            "vendor_id": "string",
            "vendor_id_decimal": "string",
            "vendor_name": "string"
        }
        ],
        "id": "string"
    }
    ],
    "end_user_notification": "TRUE",
    "enforcement_mode": "string",
    "id": "string"
}


response = falcon.createDeviceControlPolicies(clone_id="string",
                                              description="string",
                                              name="string",
                                              platform_name="string",
                                              settings=dc_settings
                                              )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

BODY = {
    "resources": [
        {
            "clone_id": "string",
            "description": "string",
            "name": "string",
            "platform_name": "Windows",
            "settings": {
                "classes": [
                {
                    "action": "FULL_ACCESS",
                    "exceptions": [
                    {
                        "action": "string",
                        "class": "string",
                        "combined_id": "string",
                        "id": "string",
                        "match_method": "string",
                        "product_id": "string",
                        "product_id_decimal": "string",
                        "product_name": "string",
                        "serial_number": "string",
                        "vendor_id": "string",
                        "vendor_id_decimal": "string",
                        "vendor_name": "string"
                    }
                    ],
                    "id": "string"
                }
                ],
                "end_user_notification": "TRUE",
                "enforcement_mode": "string",
                "id": "string"
            }
        }
    ]
}

response = falcon.command("createDeviceControlPolicies", body=BODY)
print(response)

deleteDeviceControlPolicies

Delete a set of Device Control Policies by specifying their IDs

PEP8 method name

delete_policies

Endpoint

Method	Route
	`/policy/entities/device-control/v1`

Content-Type

Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	The ID(s) of the Device Control Policies to delete.
parameters			query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_policies(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.deleteDeviceControlPolicies(ids=id_list)
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("deleteDeviceControlPolicies", ids=id_list)
print(response)

updateDeviceControlPolicies

Update Device Control Policies by specifying the ID of the policy and details to update

PEP8 method name

update_policies

Endpoint

Method	Route
	`/policy/entities/device-control/v1`

Content-Type

Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
description	body	string	Device Control Policy description.
id	body	string	Device Control Policy ID to update.
name	body	string	Device Control Policy name.
settings	body	dictionary	Device control specific policy settings.

Usage

Service class example (PEP8 syntax)

from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.update_policies(description="string",
                                  id="string",
                                  name="string",
                                  platform_name="string"
                                  )
print(response)

Service class example (Operation ID syntax)

from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.updateDeviceControlPolicies(description="string",
                                              id="string",
                                              name="string",
                                              platform_name="string"
                                              )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

BODY = {
    "resources": [
        {
            "clone_id": "string",
            "description": "string",
            "name": "string",
            "platform_name": "Windows",
            "settings": {
                "classes": [
                {
                    "action": "FULL_ACCESS",
                    "exceptions": [
                    {
                        "action": "string",
                        "class": "string",
                        "combined_id": "string",
                        "id": "string",
                        "match_method": "string",
                        "product_id": "string",
                        "product_id_decimal": "string",
                        "product_name": "string",
                        "serial_number": "string",
                        "vendor_id": "string",
                        "vendor_id_decimal": "string",
                        "vendor_name": "string"
                    }
                    ],
                    "id": "string"
                }
                ],
                "end_user_notification": "TRUE",
                "enforcement_mode": "string",
                "id": "string"
            }
        }
    ]
}

response = falcon.command("updateDeviceControlPolicies", body=BODY)
print(response)

queryDeviceControlPolicyMembers

Search for members of a Device Control Policy in your environment by providing a FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria

PEP8 method name

query_policy_members

Endpoint

Method	Route
	`/policy/queries/device-control-members/v1`

Content-Type

Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
filter	query	string	FQL Syntax formatted string used to limit the results.
id	query	integer	The ID of the Device Control Policy to search for members of.
limit	query	integer	Maximum number of records to return. (Max: 5000)
offset	query	integer	Starting index of overall result set from which to return ids.
sort	query	string	The property to sort by. (Ex: modified_timestamp.desc)
parameters	query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_policy_members(id="string",
                                       filter="string",
                                       offset=integer,
                                       limit=integer,
                                       sort="string"
                                       )
print(response)

Service class example (Operation ID syntax)

from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryDeviceControlPolicyMembers(id="string",
                                                  filter="string",
                                                  offset=integer,
                                                  limit=integer,
                                                  sort="string"
                                                  )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("queryDeviceControlPolicyMembers",
                          id="string",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )
print(response)

queryDeviceControlPolicies

Search for Device Control Policies in your environment by providing a FQL filter and paging details. Returns a set of Device Control Policy IDs which match the filter criteria

PEP8 method name

query_policies

Endpoint

Method	Route
	`/policy/queries/device-control/v1`

Content-Type

Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
filter	query	string	FQL Syntax formatted string used to limit the results.
limit	query	integer	Maximum number of records to return. (Max: 5000)
offset	query	integer	Starting index of overall result set from which to return ids.
sort	query	string	The property to sort by. (Ex: modified_timestamp.desc)
parameters	query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.query_policies(filter="string",
                                 offset=integer,
                                 limit=integer,
                                 sort="string"
                                 )
print(response)

Service class example (Operation ID syntax)

from falconpy import DeviceControlPolicies

# Do not hardcode API credentials!
falcon = DeviceControlPolicies(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.queryDeviceControlPolicies(filter="string",
                                             offset=integer,
                                             limit=integer,
                                             sort="string"
                                             )
print(response)

Uber class example

from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

response = falcon.command("queryDeviceControlPolicies",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )
print(response)

Home
Discussions Board
Glossary of Terms
Installation, Upgrades and Removal
Samples Collection
Using FalconPy
API Operations
Service Collections
Documentation Support
- Report broken link
- Report documentation error
CrowdStrike SDKs
- Crimson Falcon - Ruby
- FalconPy - Python 3
- FalconJS - Javascript
- goFalcon - Go
- PSFalcon - Powershell
- Rusty Falcon - Rust

CrowdStrike Falcon

Device Control Policies

Using the Device Control Policies service collection

Table of Contents

Passing credentials

queryCombinedDeviceControlPolicyMembers

PEP8 method name

Endpoint

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

queryCombinedDeviceControlPolicies

PEP8 method name

Endpoint

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

performDeviceControlPoliciesAction

PEP8 method name

Endpoint

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

setDeviceControlPoliciesPrecedence

PEP8 method name

Endpoint

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

getDeviceControlPolicies

PEP8 method name

Endpoint

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

createDeviceControlPolicies

PEP8 method name

Endpoint

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

deleteDeviceControlPolicies

PEP8 method name

Endpoint

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

updateDeviceControlPolicies

PEP8 method name

Endpoint

Content-Type

Keyword Arguments

Usage

Service class example (PEP8 syntax)

Service class example (Operation ID syntax)

Uber class example

queryDeviceControlPolicyMembers

PEP8 method name

Endpoint

Content-Type