The FalconPy SDK contains a collection of Python classes that abstract CrowdStrike Falcon OAuth2 API interaction, removing duplicative code and allowing developers to focus on just the logic of their solution requirements.

• Overview
  • Service classes
  • The Uber class
• Installation & Removal
• Contributing
• Support & Community Forums
• Documentation & Collateral

This SDK provides two distinct methods for interacting with CrowdStrike's Falcon OAuth2 APIs, Service classes and the Uber class.

Representing a single API service collection, each service class has a method defined for every operation available in that service collection.

OAuth2-Based API Documentation requires a CrowdStrike customer login	Code Location
CrowdStrike Device Control API	device_control_policies.py
CrowdStrike Sensor Policy Management API	sensor_update_policy.py
CrowdStrike Custom Indicators of Attack (IOAs) APIs	custom_ioa.py ioa_exclusions.py
CrowdStrike Custom Indicators of Compromise (IOCs) API	ioc.py iocs.py Deprecated
CrowdStrike Detections API	detects.py
CrowdStrike Event Streams API	event_streams.py
CrowdStrike Falcon Container	falcon_container.py
CrowdStrike Falcon Horizon API	cspm_registration.py
CrowdStrike Falcon X APIs	sample_uploads.py falconx_sandbox.py quick_scan.py
CrowdStrike Firewall Management API	firewall_management.py
CrowdStrike Firewall Policy Management API	firewall_policies.py
CrowdStrike Falcon Complete Dashboard API	falcon_complete_dashboard.py
CrowdStrike Falcon Flight Control API	mssp.py
CrowdStrike Host Groups API	host_group.py
CrowdStrike Hosts API	hosts.py
CrowdStrike Incident and Detection Monitoring API	incidents.py
CrowdStrike Installation Tokens API	installation_tokens.py
CrowdStrike Intel API	intel.py
CrowdStrike Kubernetes Protection API	kubernetes_protection.py
CrowdStrike MalQuery API	malquery.py
CrowdStrike ML Exclusions APIs	ml_exclusions.py
CrowdStrike OAuth2 Auth Token API	oauth2.py
CrowdStrike Overwatch Dashboard API	overwatch_dashboard.py
CrowdStrike Prevention Policy API	prevention_policy.py
CrowdStrike Quarantine API	quarantine.py
CrowdStrike Real Time Response (RTR) API	real_time_response.py
CrowdStrike Realtime Response (RTR) Administration API	real_time_response_admin.py
CrowdStrike Realtime Response (RTR) Policies API	response_policies.py
CrowdStrike Sensor Download API	sensor_download.py
CrowdStrike Sensor Visibility Exclusions API	sensor_visibility_exclusions.py
CrowdStrike Spotlight API	spotlight_vulnerabilities.py
CrowdStrike User and Roles API	user_management.py
Falcon Discover for Cloud and Containers - AWS Accounts API	cloud_connect_aws.py
Falcon Discover for Cloud and Containers - Azure Subscriptions API	d4c_registration.py
Falcon Discover for Cloud and Containers - GCP Projects API	d4c_registration.py
CrowdStrike Falcon Zero Trust Assessment API	zero_trust_assessment.py

Provides a single harness for interacting with the entire API, covering every available operation within every API service collection.

api_complete.py - The Uber class provides an interface to all CrowdStrike APIs with a single handler. This solution supports communicating with API endpoints that do not have an available Service Class or are recently released.

Stable releases of FalconPy are available on the Python Package Index:

python3 -m pip install crowdstrike-falconpy

If you'd like to try the absolute bleeding edge, an automated GitHub action releases a test package with every merged pull request containing the string [DEPLOY] in the head of the commit.

To install this testing version of the package, use the command:

python3 -m pip install -i https://test.pypi.org/simple crowdstrike-falconpy

To uninstall and remove FalconPy:

python3 -m pip uninstall crowdstrike-falconpy

There are many ways you can contribute to the FalconPy project!

• Providing feedback by opening a GitHub ticket. Even a fly-by "Hey, this worked!" is appreciated and helps validate approaches. Ideas on improving the project are most welcome.
• Documenting, blogging, or creating videos, of how you've used FalconPy! This type of content is invaluable and helps communities grow. Open a pull request for inclusion in the Documentation and Collateral section.
• Fix a bug or implement a new feature. Check out our open issues on GitHub for inspiration.
• Review pull requests by going through the queue of open pull requests on GitHub and giving feedback to the authors

Review CONTRIBUTING.md for more details regarding contributing to the FalconPy project.

Open to do something else but not sure where to start? Try opening an issue, or posting a topic in our discussion board, to introduce yourself and your interests. We look forward to chatting with you!

FalconPy is an open source project, not a formal CrowdStrike product, to assist developers implement CrowdStrike's APIs within their applications. As such it carries no formal support, express or implied.

🔥 Is something going wrong? 🔥
GitHub Issues are used to report bugs. Submit a ticket here:
https://github.com/CrowdStrike/falconpy/issues/new/choose

GitHub Discussions provide the community with means to communicate. There are four discussion categories:

• 💬 General : Catch all for general discussions.
• 💡 Ideas: Have a suggestion for a feature request? Is there something the community or project could improve upon? Let us know here.
• 🙏 Q&A: Have a question about how to accomplish something? A usability question? Submit them here!
• 🙌 Show and Tell: Share with the community what you're up to! Perhaps this is letting everyone know about your upcoming conference talk, share a project that has embedded FalconPy, or your recent blog.

See the wiki for extended documentation: https://github.com/CrowdStrike/falconpy/wiki.

Coming soon.

Coming soon.