### Get Combined Sensor Installers by Query - V1 (Rust)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/SensorDownloadApi.md

Retrieves detailed information about sensor installers based on a provided query. Supports pagination via offset and limit, sorting, and filtering using Falcon Query Language (FQL). Returns a models::DomainPeriodSensorInstallersV1 object containing the installer details. Authorization via OAuth2 is required.

```Rust
> models::DomainPeriodSensorInstallersV1 get_combined_sensor_installers_by_query(offset, limit, sort, filter)
```

--------------------------------

### Run rusty_falcon Examples Bash

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/README.md

Provides the command to execute the script that runs all ready-made examples included with the `rusty_falcon` project. This script sequentially tests the examples and reports their status.

```Bash
./scripts/run-examples.sh
```

--------------------------------

### Run Simple rusty_falcon Client Example (Bash)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/examples/README.md

Minimalist example to showcase authentication and initialization of the rusty_falcon client library. Upon successful authentication, the latest CrowdStrike Score is shown.

```bash
FALCON_CLIENT_ID="abc" FALCON_CLIENT_SECRET="XYZ" FALCON_CLOUD="us-2" \
    cargo run  --example simple
```

--------------------------------

### Running falcon_custom_ioas Example (Bash)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/examples/README.md

Executes the `falcon_custom_ioas` example script, demonstrating how to list custom IOAs. Requires setting `FALCON_CLIENT_ID`, `FALCON_CLIENT_SECRET`, and `FALCON_CLOUD` environment variables.

```bash
FALCON_CLIENT_ID="abc" FALCON_CLIENT_SECRET="XYZ" FALCON_CLOUD="us-2" \
     cargo run --example falcon_custom_ioas
```

--------------------------------

### Run Get Customer ID Example (Bash)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/examples/README.md

Stand-alone tool to derive the CrowdStrike Customer ID (CID) from an API key pair, useful for tasks like new sensor registration.

```bash
FALCON_CLIENT_ID="abc" FALCON_CLIENT_SECRET="XYZ" FALCON_CLOUD="us-2" \
    cargo run  --example falcon_get_cid
```

--------------------------------

### Download Sensor Installer by ID - V1 (Rust)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/SensorDownloadApi.md

Downloads a sensor installer file using its SHA256 ID. Requires the installer's SHA256 ID as a string parameter. Returns a serde_json::Value which likely represents the downloaded file stream or metadata upon error. Authorization via OAuth2 is required.

```Rust
> serde_json::Value download_sensor_installer_by_id(id)
```

--------------------------------

### Download Sensor Installer by ID - V2 (Rust)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/SensorDownloadApi.md

Downloads a sensor installer file using its SHA256 ID, using the V2 endpoint. Requires the installer's SHA256 ID as a string parameter. Returns a serde_json::Value, likely the file stream or error details. Authorization via OAuth2 is required.

```Rust
> serde_json::Value download_sensor_installer_by_id_v2(id)
```

--------------------------------

### Host Migration Event: queued (JSON)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/HostMigrationApi.md

Example JSON structure for the 'queued' event, emitted when the host migration process is started. Includes the action type, user who initiated the queueing, and the timestamp.

```JSON
{
  "action": "queued",
  "user": "example@example.com",
  "time": "2024-01-01T00:00:00Z"
}
```

--------------------------------

### Reading Customer Settings - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/InstallationTokensApi.md

Check current installation token settings. Requires oauth2 authorization. Accepts no specific Content-Type and expects application/json response. This endpoint does not require any parameters. Returns models::ApiPeriodCustomerSettingsResponseV1.

```Rust
> models::ApiPeriodCustomerSettingsResponseV1 customer_settings_read()
```

--------------------------------

### Get AWS Console Setup URLs - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/D4cRegistrationApi.md

Returns a URL that a customer can visit in their AWS environment to grant access. Requires oauth2 authorization. Allows specifying the region. Accepts application/json.

```Rust
models::RegistrationPeriodAwsConsoleUrlResponseV2 get_d4_c_aws_console_setup_urls(region)
```

--------------------------------

### Running falcon_zta Example (Bash)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/examples/README.md

Executes the `falcon_zta` example script to retrieve Zero Trust Assessment details for all managed endpoints. Requires setting `FALCON_CLIENT_ID`, `FALCON_CLIENT_SECRET`, and `FALCON_CLOUD` environment variables.

```bash
FALCON_CLIENT_ID="abc" FALCON_CLIENT_SECRET="XYZ" FALCON_CLOUD=us-1 \
cargo run --example falcon_zta
```

--------------------------------

### Get Total Number of Hosts with jq (Bash)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/examples/README.md

Uses the falcon_host_details example output, piped to jq, to count the total number of hosts.

```bash
FALCON_CLIENT_ID="abc" FALCON_CLIENT_SECRET="XYZ" FALCON_CLOUD="us-2" \
    cargo run  --example falcon_host_details | jq length
```

--------------------------------

### Reading Audit Events - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/InstallationTokensApi.md

Gets the details of one or more audit events by id. Requires oauth2 authorization. Accepts no specific Content-Type and expects application/json response. Takes an optional list of audit event IDs (Vec<String>). Returns models::ApiPeriodAuditEventDetailsResponseV1.

```Rust
> models::ApiPeriodAuditEventDetailsResponseV1 audit_events_read(ids)
```

--------------------------------

### Retrieving Sensor Installers (V1) - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/SensorDownloadApi.md

Retrieves details for sensor installers based on a list of SHA256 IDs. Requires OAuth2 authorization and accepts application/json.

```Rust
models::DomainPeriodSensorInstallersV1 get_sensor_installers_entities(ids)
```

--------------------------------

### Filtering falcon_zta Output (Bash)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/examples/README.md

Runs the `falcon_zta` example, filtering the results using a Falcon Query Language (FQL) expression provided via the `--filter` argument. This example filters for hosts seen since '2022-01-01'. Requires environment variables.

```bash
FALCON_CLIENT_ID="abc" FALCON_CLIENT_SECRET="XYZ" FALCON_CLOUD=us-1 \
cargo run --example falcon_zta -- --filter "last_seen:>='2022-01-01'"
```

--------------------------------

### List Supported Kernels (Bash)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/examples/README.md

Example showing how to list recently supported Linux kernels by the CrowdStrike Falcon Sensor for a given distribution and architecture.

```bash
FALCON_CLIENT_ID="abc" FALCON_CLIENT_SECRET="XYZ" FALCON_CLOUD="us-2" \
     cargo run --example falcon_supported_kernels -- --distro=rhel9 --arch=aarch64
```

--------------------------------

### Retrieving Sensor Installers (V2) - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/SensorDownloadApi.md

Retrieves details for sensor installers based on a list of SHA256 IDs, using the V2 API. Requires OAuth2 authorization and accepts application/json.

```Rust
models::DomainPeriodSensorInstallersV2 get_sensor_installers_entities_v2(ids)
```

--------------------------------

### Listing and Sorting Discover Hosts (Bash)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/examples/README.md

Runs the `falcon_discover_hosts` example to list all hosts on the tenant, sorting the output by hostname using the `--sort hostname` argument. Requires environment variables.

```bash
FALCON_CLIENT_ID="abc" FALCON_CLIENT_SECRET="XYZ" FALCON_CLOUD="us-2" \
     cargo run --example falcon_discover_hosts -- --sort hostname
```

--------------------------------

### Get Applications DiscoverApi GET

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Get details on applications by providing one or more IDs.

```API Documentation
GET /discover/entities/applications/v1
```

--------------------------------

### List Hostnames with jq (Bash)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/examples/README.md

Uses the falcon_host_details example output, piped to jq, to extract and list the hostnames of all hosts.

```bash
FALCON_CLIENT_ID="abc" FALCON_CLIENT_SECRET="XYZ" FALCON_CLOUD="us-2" \
    cargo run  --example falcon_host_details | jq 'map(.hostname)'
```

--------------------------------

### List Hosts and Agent Versions with jq (Bash)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/examples/README.md

Uses the falcon_host_details example output, piped to jq, to create a key-value dictionary mapping hostnames to their agent versions.

```bash
FALCON_CLIENT_ID="abc" FALCON_CLIENT_SECRET="XYZ" FALCON_CLOUD="us-2" \
    cargo run  --example falcon_host_details | jq -r ' map( { (.hostname) : .agent_version } ) | add'
```

--------------------------------

### Get Hosts DiscoverApi GET

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Get details on assets by providing one or more IDs.

```API Documentation
GET /discover/entities/hosts/v1
```

--------------------------------

### Creating Tokens - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/InstallationTokensApi.md

Creates a token. Requires oauth2 authorization. Accepts application/json Content-Type and expects application/json response. Requires a request body of type ApiPeriodTokenCreateRequestV1. Returns models::ApiPeriodTokenDetailsResponseV1.

```Rust
> models::ApiPeriodTokenDetailsResponseV1 tokens_create(body)
```

--------------------------------

### Get IoT Hosts DiscoverIotApi GET

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Get details on IoT assets by providing one or more IDs.

```API Documentation
GET /discover/entities/iot-hosts/v1
```

--------------------------------

### Get Logins DiscoverApi GET

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Get details on logins by providing one or more IDs.

```API Documentation
GET /discover/entities/logins/v1
```

--------------------------------

### Sorting falcon_custom_ioas Output (Bash)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/examples/README.md

Runs the `falcon_custom_ioas` example, sorting the results by the `created_on` field using the `--sort` command-line argument. Requires environment variables.

```bash
FALCON_CLIENT_ID="abc" FALCON_CLIENT_SECRET="XYZ" FALCON_CLOUD="us-2" \
cargo run --example falcon_custom_ioas -- --sort created_on
```

--------------------------------

### GET KubernetesProtectionApi get_helm_values_yaml

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Provides a sample Helm values.yaml file for a customer to install alongside the agent Helm chart. This endpoint is part of the Kubernetes Protection API.

```HTTP
GET /kubernetes-protection/entities/integration/agent/v1
```

--------------------------------

### Get All Host Details with jq (Bash)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/examples/README.md

Stand-alone tool using the Host API to query and output all host details in JSON format to stdout, piped to jq for pretty printing.

```bash
FALCON_CLIENT_ID="abc" FALCON_CLIENT_SECRET="XYZ" FALCON_CLOUD="us-2" \
    cargo run  --example falcon_host_details | jq
```

--------------------------------

### Get Image Registry Credentials (Rust)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/CloudSnapshotsApi.md

Retrieves the necessary credentials for accessing image registries via a GET request. This endpoint requires no parameters.

```Rust
models::ModelsPeriodRegistryCredentialsResponse get_credentials_mixin0_mixin60()

### Parameters
This endpoint does not need any parameter.

### Return type
[**models::ModelsPeriodRegistryCredentialsResponse**](models.RegistryCredentialsResponse.md)
```

--------------------------------

### Get All Open Vulnerabilities with jq (Bash)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/examples/README.md

Stand-alone tool using the Falcon Spotlight API to query and output all open vulnerabilities in JSON format to stdout, piped to jq for pretty printing.

```bash
FALCON_CLIENT_ID="abc" FALCON_CLIENT_SECRET="XYZ" FALCON_CLOUD="us-2" \
    cargo run  --example falcon_spotlight_vulnerabilities | jq
```

--------------------------------

### Get Azure Tenant Config - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/KubernetesProtectionApi.md

Gets the Azure tenant configuration. Allows filtering by tenant IDs and supports pagination with 'limit' and 'offset'.

```Rust
models::K8sregPeriodGetAzureTenantConfigResp get_azure_tenant_config(ids, limit, offset)
```

--------------------------------

### GET MalqueryApi get_mal_query_quotas_v1

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Get information about search and download quotas in your environment. This endpoint is part of the Malquery API.

```HTTP
GET /malquery/aggregates/quotas/v1
```

--------------------------------

### Filtering and Sorting falcon_zta Output with jq (Bash)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/examples/README.md

Runs the `falcon_zta` example, filtering hosts seen in the last 7 days using a calculated date and FQL, then pipes the output to `jq` to sort the results by the overall ZTA score. Requires environment variables and `jq`.

```bash
FALCON_CLIENT_ID="abc" FALCON_CLIENT_SECRET="XYZ" FALCON_CLOUD=us-1 \
week_ago=$(date -jf %s $(( $(date +%s) - 86400 * 7 )) +%Y-%m-%d)
cargo run --example falcon_zta -- --filter="last_seen:>='${week_ago}'" | jq -r 'sort_by(.assessment.overall)'
```

--------------------------------

### Fetch Combined Schema EventSchemaApi GET

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Fetch combined schema.

```API Documentation
GET /fdr/combined/schema-members/v1
```

--------------------------------

### Perform Migration Actions (Rust)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/HostMigrationApi.md

Allows performing specific actions on migration jobs, including starting, canceling, renaming, or deleting them. Each action has specific conditions under which it can be performed and may accept action-specific parameters.

```Rust
### Parameters

Name | Type | Description  | Required | Notes
------------- | ------------- | ------------- | ------------- | -------------
**id** | **String** | The migration job to perform actions on | [required] |
**action_name** | **String** | The action to perform | [required] |
**body** | [**MsaPeriodEntityActionRequestV3**](MsaPeriodEntityActionRequestV3.md) |  | [required] |

### Return type

[**models::MsaspecPeriodQueryResponse**](msaspec.QueryResponse.md)

## migrations_actions_v1

> models::MsaspecPeriodQueryResponse migrations_actions_v1(action_name, body)
Perform an action on a migration job.

The available actions are `start_migration`, `cancel_migration`, `rename_migration`, and `delete_migration`.  `start_migration` starts the selected migrations. This action only works if the migration has not started. This action does not accept any action parameters. Only one migration may be started per request.  `cancel_migration` cancels the selected migrations. This actions only works if the migration has started and not completed. This action does not accept any action parameters.  `rename_migration` renames the selected migrations. This action can be called at any time. Only 1 action parameter may be supplied. Action parameters take the form of `{"name": "migration_name": "value": "$new_migration_name"}`.  `delete_migration` deletes the selected migrations. This action only works if the migration has not started. This action does not accept any action parameters.

### Parameters

Name | Type | Description  | Required | Notes
------------- | ------------- | ------------- | ------------- | -------------
**action_name** | **String** | The action to perform | [required] |
**body** | [**MsaPeriodEntityActionRequestV3**](MsaPeriodEntityActionRequestV3.md) |  | [required] |

### Return type

[**models::MsaspecPeriodQueryResponse**](msaspec.QueryResponse.md)
```

--------------------------------

### Get Integrations List - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/AspmApi.md

Retrieves a list of all integrations, optionally filtered by type or category. Returns a ListIntegrationsResponse model.

```Rust
models::TypesPeriodListIntegrationsResponse get_integrations(integration_type, category)
```

--------------------------------

### GET KubernetesProtectionApi get_azure_install_script

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Provides the script to run for a given tenant id and subscription IDs. This endpoint is part of the Kubernetes Protection API.

```HTTP
GET /kubernetes-protection/entities/user-script/azure/v1
```

--------------------------------

### POST MalqueryApi post_mal_query_entities_samples_multidownload_v1

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Schedule samples for download. Use the result id with the /request endpoint to check if the download is ready after which you can call the /entities/samples-fetch to get the zip

```HTTP
POST /malquery/entities/samples-multidownload/v1
```

--------------------------------

### Transforming falcon_zta Output with jq (Bash)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/examples/README.md

Executes the `falcon_zta` example and pipes the output to `jq` to transform the data, extracting the overall ZTA score for each host identified by its AID. Requires environment variables and `jq`.

```bash
FALCON_CLIENT_ID="abc" FALCON_CLIENT_SECRET="XYZ" FALCON_CLOUD=us-1 \
cargo run --example falcon_zta | jq -r 'map( { (.aid) : .assessment.overall } ) | add'
```

--------------------------------

### Filtering falcon_custom_ioas Output (Bash)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/examples/README.md

Executes the `falcon_custom_ioas` example, filtering the results to include only enabled custom IOAs using the `--filter enabled:true` argument.

```bash
cargo run --example falcon_custom_ioas -- --filter enabled:true
```

--------------------------------

### Get Migration Job Details - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/HostMigrationApi.md

Retrieves detailed information for specific migration jobs.

```Rust
fn get_migrations_v1() -> models::ApiPeriodGetMigrationsResponseV1
```

--------------------------------

### Build and Serve Documentation with mdbook Bash

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/README.md

Shows the sequence of commands to build and serve the project documentation locally using `mdbook`. It involves changing directory to the `docs` folder, building the book, and then serving it.

```Bash
cd docs
mdbook build
mdbook serve
```

--------------------------------

### Get Intel Indicators with jq (Bash)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/examples/README.md

Stand-alone tool using the Falcon Intel API to query and output indicators in JSON format to stdout, with filtering and sorting options, piped to jq for pretty printing.

```bash
FALCON_CLIENT_ID="abc" FALCON_CLIENT_SECRET="XYZ" FALCON_CLOUD="us-2" \
     cargo run --example intel_indicators -- --sort published_date.asc --filter deleted:false -q abc | jq
```

--------------------------------

### Get Integration Tasks - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/AspmApi.md

Retrieves all integration tasks, optionally filtered by type or category. Returns a ListIntegrationTasksResponse model.

```Rust
models::TypesPeriodListIntegrationTasksResponse get_integration_tasks(integration_task_type, category)
```

--------------------------------

### Host Migration Event: completed (JSON)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/HostMigrationApi.md

Example JSON structure for the 'completed' event, emitted when a host successfully completes migration. Includes the action type and the timestamp.

```JSON
{
  "action": "completed",
  "time": "2024-01-01T00:00:00Z"
}
```

--------------------------------

### Get Accounts DiscoverApi GET

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Get details on accounts by providing one or more IDs.

```API Documentation
GET /discover/entities/accounts/v1
```

--------------------------------

### Provisioning System Definition (Rust)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/WorkflowsApi.md

Documents the API endpoint to provision a system definition onto the target CID using a template and provided parameters supplied via the `body` parameter (type `ClientPeriodSystemDefinitionProvisionRequest`). Returns `models::ClientPeriodSystemDefinitionCreateResponse`. Requires `oauth2` authorization. Accepts and returns `application/json`.

```Rust
models::ClientPeriodSystemDefinitionCreateResponse workflow_system_definitions_provision(body)
```

--------------------------------

### GET MalqueryApi get_mal_query_entities_samples_fetch_v1

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Fetch a zip archive with password 'infected' containing the samples. Call this once the /entities/samples-multidownload request has finished processing. This endpoint is part of the Malquery API.

```HTTP
GET /malquery/entities/samples-fetch/v1
```

--------------------------------

### Getting CSPM AWS Account Provisioning Script (Rust)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/CspmRegistrationApi.md

This function generates and returns a script as a downloadable attachment. Customers can run this script in their AWS environment to grant the necessary access for CSPM.

```Rust
models::RegistrationPeriodAwsProvisionGetAccountScriptResponseV2 get_cspm_aws_account_scripts_attachment(ids, template, account_type, accounts, behavior_assessment_enabled, sensor_management_enabled, use_existing_cloudtrail, organization_id, aws_profile, custom_role_name)
```

--------------------------------

### Query Applications DiscoverApi GET

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Search for applications in your environment by providing an FQL filter and paging details. returns a set of application IDs which match the filter criteria.

```API Documentation
GET /discover/queries/applications/v1
```

--------------------------------

### Get Delivery Settings (Rust)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/DeliverySettingsApi.md

Retrieves the current delivery settings. This endpoint requires no parameters and returns a ModelsPeriodDeliverySettingsEntityResponse object. Authorization via oauth2 is required.

```Rust
models::ModelsPeriodDeliverySettingsEntityResponse get_delivery_settings()
```

--------------------------------

### GET MlExclusionsApi get_ml_exclusions_v1

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Get a set of ML Exclusions by specifying their IDs

```HTTP
GET /policy/entities/ml-exclusions/v1
```

--------------------------------

### Promoting System Definition Version (Rust)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/WorkflowsApi.md

Documents the API endpoint to promote a specific version of a system definition for a customer. Requires the customer to be provisioned and expects all parameters supplied via the `body` parameter (type `ClientPeriodSystemDefinitionPromoteRequest`). Returns `models::ClientPeriodSystemDefinitionCreateResponse`. Requires `oauth2` authorization. Accepts and returns `application/json`.

```Rust
models::ClientPeriodSystemDefinitionCreateResponse workflow_system_definitions_promote(body)
```

--------------------------------

### Host Migration Event: added (JSON)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/HostMigrationApi.md

Example JSON structure for the 'added' event, emitted when a host migration entity is initially created. Includes the action type, user who performed the action, and the timestamp.

```JSON
{
  "action": "added",
  "user": "example@example.com",
  "time": "2024-01-01T00:00:00Z"
}
```

--------------------------------

### Host Migration Event: failed (JSON)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/HostMigrationApi.md

Example JSON structure for the 'failed' event, emitted when a host migration fails. Includes the action type, the reason for failure (e.g., unsupported version, internal error), and the timestamp.

```JSON
{
  "action": "failed",
  "reason": "unsupported_sensor_version",
  "time": "2024-01-01T00:00:00Z"
}
```

--------------------------------

### GET MalqueryApi get_mal_query_download_v1

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Download a file indexed by MalQuery. Specify the file using its SHA256. Only one file is supported at this time. This endpoint is part of the Malquery API.

```HTTP
GET /malquery/entities/download-files/v1
```

--------------------------------

### Get Sample V3 CrowdStrike Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/SampleUploadsApi.md

Retrieves the file associated with the given ID (SHA256). Requires one or more sample IDs. Returns the file content. Requires oauth2 authorization.

```Rust
> get_sample_v3(ids)
```

--------------------------------

### GET KubernetesProtectionApi get_azure_tenant_config

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Gets the Azure tenant Config. This endpoint is part of the Kubernetes Protection API.

```HTTP
GET /kubernetes-protection/entities/config/azure/v1
```

--------------------------------

### Generate Local Documentation with Cargo (Bash)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/README.md

This command uses the Cargo build tool to generate the documentation for the Rust crate and automatically opens it in your default web browser. It's useful for exploring the generated API client documentation locally.

```bash
cargo doc --open
```

--------------------------------

### Host Migration Event: cancelled (JSON)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/HostMigrationApi.md

Example JSON structure for the 'cancelled' event, emitted when a host migration is cancelled. Includes the action type, user who performed the cancellation, and the timestamp.

```JSON
{
  "action": "cancelled",
  "user": "example@example.com",
  "time": "2024-01-01T00:00:00Z"
}
```

--------------------------------

### GET KubernetesProtectionApi get_static_scripts

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Gets static bash scripts that are used during registration. This endpoint is part of the Kubernetes Protection API.

```HTTP
GET /kubernetes-protection/entities/gen/scripts/v1
```

--------------------------------

### Create Cloud Snapshot Deployment (Rust)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/CloudSnapshotsApi.md

Launches a snapshot scan for a specified cloud asset by sending a POST request with the deployment input body.

```Rust
models::DeploymentsPeriodEntityResponse create_deployment_entity(body)

### Parameters
Name | Type | Description  | Required | Notes
------------- | ------------- | ------------- | ------------- | -------------
**body** | [**ModelsPeriodCreateDeploymentInput**](ModelsPeriodCreateDeploymentInput.md) |  | [required] |

### Return type
[**models::DeploymentsPeriodEntityResponse**](deployments.EntityResponse.md)
```

--------------------------------

### Getting Behavior Detections - Registration API (Rust)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/CspmRegistrationApi.md

Retrieves a list of detected behaviors from the system. Allows filtering by various parameters including cloud provider, service, account IDs, state, time, severity, and resource IDs. Returns an external IOA event response.

```Rust
models::RegistrationPeriodExternalIoaEventResponse get_behavior_detections(cloud_provider, service, account_id, aws_account_id, azure_subscription_id, azure_tenant_id, state, date_time_since, since, severity, next_token, limit, resource_id, resource_uuid)
```

--------------------------------

### Query Hosts DiscoverApi GET

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Search for assets in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.

```API Documentation
GET /discover/queries/hosts/v1
```

--------------------------------

### Download Lookup File in Namespaced Package - HumioAuthProxyApi

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/HumioAuthProxyApi.md

This endpoint facilitates downloading a lookup file from a namespaced package within an NGSIEM repository. It requires the repository name, namespace, package name, and filename.

```API Documentation
GET /humio/api/v1/repositories/{repository}/files/{namespace}/{package}/{filename}
```

--------------------------------

### Get Detect Summaries - CrowdStrike Falcon - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/DetectsApi.md

Views detailed information about specific detections by providing their IDs. Accepts a `MsaPeriodIdsRequest` containing up to 1000 detection IDs. Returns `models::DomainPeriodMsaDetectSummariesResponse`. Authorization is via oauth2. Content-Type is application/json, Accept is application/json.

```Rust
> models::DomainPeriodMsaDetectSummariesResponse get_detect_summaries(body)
```

--------------------------------

### Query IoT Host IDs (v1) - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/DiscoverIotApi.md

Searches for IoT assets in your environment using an FQL (Falcon Query Language) filter and returns a paginated list of matching asset IDs. Supports pagination using offset and limit parameters, sorting, and filtering via FQL.

```Rust
models::MsaspecPeriodQueryResponse query_iot_hosts(offset, limit, sort, filter)
```

--------------------------------

### Download Lookup File in Package - HumioAuthProxyApi

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/HumioAuthProxyApi.md

This endpoint allows downloading a specific lookup file located within a package in a specified NGSIEM repository. It requires the repository name, package name, and filename.

```API Documentation
GET /humio/api/v1/repositories/{repository}/files/{package}/{filename}
```

--------------------------------

### Download Lookup File - HumioAuthProxyApi

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/HumioAuthProxyApi.md

This endpoint is used to download a lookup file directly from a specified NGSIEM repository. It requires the repository name and the filename.

```API Documentation
GET /humio/api/v1/repositories/{repository}/files/{filename}
```

--------------------------------

### Get Rules (GET) - CustomIoaApi

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Retrieves details for specific custom IOA rules based on their unique identifiers, optionally including CID and version. The number of IDs is limited by URL size.

```API Endpoint
GET /ioarules/entities/rules/v1
```

--------------------------------

### Get Azure Bash Script - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/KubernetesProtectionApi.md

Retrieves a bash script for registering Azure tenants, optionally filtered by tenant or subscription IDs. Requires 'id' or 'subscription_id' parameters.

```Rust
models::K8sregPeriodGetAzureBashScriptResp get_azure_bash_script(id, subscription_id)
```

--------------------------------

### Query IoT Hosts DiscoverIotApi GET

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Search for IoT assets in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria.

```API Documentation
GET /discover/queries/iot-hosts/v1
```

--------------------------------

### Query IoT Host IDs (v2) - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/DiscoverIotApi.md

Searches for IoT assets in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria. This version likely uses cursor-based pagination ('after').

```Rust
models::DomainPeriodDiscoverApiResponse query_iot_hosts_v2(after, limit, sort, filter)
```

--------------------------------

### Getting Executor Nodes API Documentation (Rust)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/AspmApi.md

Documents the API endpoint for retrieving all relay nodes. It takes `node_type` and `integration_type` as parameters and returns a `TypesPeriodListExecutorNodesResponse`. Note that parameter details, authorization, and HTTP headers are not fully provided in the source text.

```Rust
models::TypesPeriodListExecutorNodesResponse get_executor_nodes(node_type, integration_type)

Parameters:
- node_type: (details missing)
- integration_type: (details missing)

Return Type: models::TypesPeriodListExecutorNodesResponse
Authorization: (details missing)
HTTP Headers: (details missing)
```

--------------------------------

### GET MlExclusionsApi query_ml_exclusions_v1

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Search for ML exclusions.

```HTTP
GET /policy/queries/ml-exclusions/v1
```

--------------------------------

### Get Migration Destinations - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/HostMigrationApi.md

Fetches the possible destination targets for a migration operation based on the request body.

```Rust
fn get_migration_destinations_v1(body: models::ApiPeriodGetMigrationDestinationsResponseV1)
```

--------------------------------

### Query Logins DiscoverApi GET

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Search for logins in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of login IDs which match the filter criteria.

```API Documentation
GET /discover/queries/logins/v1
```

--------------------------------

### Get Tags - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/AspmApi.md

Retrieves all tags, with optional filtering, limiting, and offset. Returns a TagsDataResponse model.

```Rust
models::TypesPeriodTagsDataResponse get_tags(is_unique, tag_name, limit, offset, name)
```

--------------------------------

### Querying Audit Events - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/InstallationTokensApi.md

Search for audit events by providing an FQL filter and paging details. Requires oauth2 authorization. Accepts no specific Content-Type and expects application/json response. Parameters include optional offset (i32), limit (i32, default 50), sort (String), and filter (String). Returns models::MsaspecPeriodQueryResponse.

```Rust
> models::MsaspecPeriodQueryResponse audit_events_query(offset, limit, sort, filter)
```

--------------------------------

### Get IoT Hosts by ID - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/DiscoverIotApi.md

Retrieves details for specific IoT assets by providing one or more asset IDs. A maximum of 100 IDs can be provided per request. The method returns a response object containing the details of the requested hosts.

```Rust
models::DomainPeriodDiscoverApiioTHostEntitiesResponse get_iot_hosts(ids)
```

--------------------------------

### GET MessageCenterApi query_activity_by_case_id

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Retrieve activities id's for a case

```HTTP
GET /message-center/queries/case-activities/v1
```

--------------------------------

### Get Artifacts - FalconX Sandbox API - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/FalconxSandboxApi.md

Downloads various analysis artifacts generated during the sandbox analysis, such as IOC packs, PCAP files, and memory dumps. Specific artifacts are requested using parameters like ID and name.

```Rust
models::MsaspecPeriodQueryResponse get_artifacts(id, name, accept_encoding)
```

--------------------------------

### Get Migration Aggregates - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/HostMigrationApi.md

Retrieves aggregated data for migration jobs based on the JSON specification provided in the request body.

```Rust
fn migration_aggregates_v1(body: models::MsaPeriodAggregateQueryRequest) -> models::MsaPeriodAggregatesResponse
```

--------------------------------

### Schedule MalQuery Samples Multidownload Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/MalqueryApi.md

Schedules a list of samples for download from the MalQuery service. The endpoint accepts a MalqueryPeriodMultiDownloadRequestV1 body detailing the download request. It returns a request ID that should be used with the /request endpoint to check readiness, followed by /entities/samples-fetch to retrieve the zip file. Requires OAuth2 authorization and uses application/json for both content type and accept headers.

```Rust
models::MalqueryPeriodExternalQueryResponse post_mal_query_entities_samples_multidownload_v1(body)
```

--------------------------------

### Get Host Migration Details - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/HostMigrationApi.md

Retrieves detailed information for specific host migrations based on the provided request body.

```Rust
fn get_host_migrations_v1(body: models::ApiPeriodGetHostMigrationResponseV1)
```

--------------------------------

### Get Migration Aggregates (Rust)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/HostMigrationApi.md

Retrieves migration aggregates based on criteria specified in the request body. Supports 'terms' and 'date_range' query types with various FQL filter properties like name, id, status, created_by, and created_time.

```Rust
## migration_aggregates_v1

> models::MsaPeriodAggregatesResponse migration_aggregates_v1(body)
Get migration aggregates as specified via json in request body.

Get migration aggregates as specified via json in request body.  # Supported Types  Both types support the following FQL filter props: `name`, `id`, `migration_id`, `target_cid`, `status`, `migration_status`, `created_by`, `created_time`.  The value `migration_status` is an alias for `status`.  The value `migration_id` is an alias for `id`.  ## Terms `"type": "terms"`  Supported `field` values: `name`, `id`, `migration_id,` `target_cid`, `status`, `migration_status`, `created_by`.  `sort` on `terms` type must be done on the same value as `field` and include a direction (`asc` or `desc`). Supports all supported FQL fields.  Examples sort value: `status|asc` or `created_by|desc`.   ## Date Range `"type": "date_range"`  Supported `field` fields: `created_time`.  Does not support `sort`, `size`, or `from`.

### Parameters

Name | Type | Description  | Required | Notes
------------- | ------------- | ------------- | ------------- | -------------
**body** | [**Vec<models::MsaPeriodAggregateQueryRequest>**](msa.AggregateQueryRequest.md) |  | [required] |

### Return type

[**models::MsaPeriodAggregatesResponse**](msa.AggregatesResponse.md)
```

--------------------------------

### Get CSPM Policy Settings - Rusty Falcon Rust API

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/CspmRegistrationApi.md

Retrieves current policy settings, optionally filtered by service type, policy ID, or cloud platform. Requires oauth2 authorization.

```Rust
models::RegistrationPeriodPolicySettingsResponseV1 get_cspm_policy_settings(service, policy_id, cloud_platform)
```

--------------------------------

### Getting Child Customers by CID (Rust)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/MsspApi.md

Retrieves links to child customers based on their CID(s). Requires a vector of child CIDs as input. Returns a response containing child customer information. Requires oauth2 authorization and accepts application/json.

```Rust
models::DomainPeriodChildrenResponseV1 get_children(ids)
```

--------------------------------

### Get Integration Types - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/AspmApi.md

Retrieves all available integration types. This endpoint requires no parameters. Returns a ListIntegrationTypesResponse model.

```Rust
models::TypesPeriodListIntegrationTypesResponse get_integration_types()
```

--------------------------------

### Creating Integration (ASPM API, Rust)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/AspmApi.md

Creates a new integration via the ASPM API. This endpoint uses the POST method at `/aspm-api-gateway/api/v1/integrations`. It requires a `body` parameter of type `TypesPeriodCreateIntegrationRequest` and returns a `models::TypesPeriodIntegrationResponse` object upon success. Authorization via `oauth2` is required.

```Rust
> models::TypesPeriodIntegrationResponse create_integration(body)
```

--------------------------------

### Get Combined Cloud Clusters - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/KubernetesProtectionApi.md

Returns a combined list of provisioned cloud accounts and known Kubernetes clusters. Supports filtering by location, account IDs, cluster service, and status, with pagination.

```Rust
models::K8sregPeriodListClusterCloudResp get_combined_cloud_clusters(locations, ids, cluster_service, cluster_status, limit, offset)
```

--------------------------------

### Authenticate and Call API with rusty_falcon Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/README.md

Demonstrates how to use `rusty_falcon` to authenticate with the CrowdStrike Falcon API using environment variables (`FALCON_CLIENT_ID`, `FALCON_CLIENT_SECRET`, `FALCON_CLOUD`) and make an API call (specifically `get_sensor_installers_ccidby_query`). Shows how to handle the API response and check for errors.

```Rust
use rusty_falcon::apis::sensor_download_api;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    // Fetch credentials from environment variables and establish OAuth2 connection
    let falcon = FalconHandle::from_env()
        .await
        .expect("Could not authenticate with CrowdStrike API");

    // Call one particular API end-point using the authenticated client
    let response = sensor_download_api::get_sensor_installers_ccidby_query(&falcon.cfg)
        .await
        .expect("Could not fetch CCID");

    // Response objects returned from APIs usually follow the same pattern of having
    // 'errors', 'meta', and 'resources' fields. It is recommended to check for possible
    // application errors:
    if !response.errors.is_empty() {
        eprintln!("Errors occurred while getting Falcon CCID: {:?}", response.errors);
    }

    // Print response from the API:
    println!("{:?}", response.resources)
}
```

--------------------------------

### GET MessageCenterApi case_download_attachment

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

retrieves an attachment for the case, given the attachment id

```HTTP
GET /message-center/entities/case-attachment/v1
```

--------------------------------

### Execute Batch RTR Command (Rust)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/RealTimeResponseAdminApi.md

Executes a specified Real Time Response command on a batch of hosts. This endpoint supports a variety of RTR commands like `get`, `put`, `runscript`, etc. It requires a batch ID obtained from a session initialization.

```Rust
> models::DomainPeriodMultiCommandExecuteResponseWrapper r_tr_batch_execute_command(body, timeout, timeout_duration, host_timeout_duration)
```

--------------------------------

### Retrieving Sample File CrowdStrike Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/SampleUploadsApi.md

Downloads a sample file using its SHA256 hash (`ids`). Optionally zips and password-protects the sample with 'infected' if `password_protected` is true. Requires an `oauth2` token and returns the file content as a `String` (binary data) with `application/octet-stream` accept header.

```Rust
String get_sample_v3(ids, password_protected)
```

--------------------------------

### Get Host Migration Aggregates - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/HostMigrationApi.md

Retrieves aggregated data for host migrations based on the JSON specification provided in the request body.

```Rust
fn host_migration_aggregates_v1(body: models::MsaPeriodAggregateQueryRequest) -> models::MsaPeriodAggregatesResponse
```

--------------------------------

### Query Accounts DiscoverApi GET

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Search for accounts in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of account IDs which match the filter criteria.

```API Documentation
GET /discover/queries/accounts/v1
```

--------------------------------

### Initializing RTR Batch Session (Rust)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/RealTimeResponseApi.md

Initializes a Real-Time Response batch session on multiple hosts. It supports adding new hosts, joining an existing batch, and queuing sessions for offline hosts. Requires host IDs in the body and supports various timeout parameters. Returns a DomainPeriodBatchInitSessionResponse.

```Rust
models::DomainPeriodBatchInitSessionResponse batch_init_session(body, timeout, timeout_duration, host_timeout_duration)
```

--------------------------------

### Find Devices that Ran on IOC

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/IocsApi.md

Finds hosts that have observed a given custom IOC. Use GET /devices/entities/devices/v1 for host details. Requires the indicator `type` and `value`. Optional parameters include `limit` and `offset` for pagination. Returns `models::IocapiPeriodMsaReplyDevicesRanOn`.

```Rust
models::IocapiPeriodMsaReplyDevicesRanOn devices_ran_on(r#type, value, limit, offset)
```

--------------------------------

### Uploading Sample File CrowdStrike Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/SampleUploadsApi.md

Uploads a file for further cloud analysis. Requires an `oauth2` token and file details including the `sample` data, `file_name`, `comment`, and `is_confidential` flag. After uploading, a specific analysis API endpoint should be called. Returns `models::ClientPeriodSampleMetadataResponseV2` with metadata about the uploaded sample.

```Rust
models::ClientPeriodSampleMetadataResponseV2 upload_sample_v3(sample, file_name, comment, is_confidential)
```

--------------------------------

### Get Service Violation Types - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/AspmApi.md

Retrieves the different types of service violations. Requires a GenericUserFacingRequest body. Returns a GetViolationTypesResponse model.

```Rust
models::TypesPeriodGetViolationTypesResponse get_service_violation_types(body)
```

--------------------------------

### GET MessageCenterApi query_cases_ids_by_filter

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Retrieve case id's that match the provided filter criteria

```HTTP
GET /message-center/queries/cases/v1
```

--------------------------------

### Upload Lookup File - HumioAuthProxyApi

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/HumioAuthProxyApi.md

This endpoint allows uploading a file to a specified NGSIEM repository. It requires the repository name as a path parameter.

```API Documentation
POST /humio/api/v1/repositories/{repository}/files
```

--------------------------------

### GET MalqueryApi get_mal_query_metadata_v1

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Retrieve indexed files metadata by their hash. This endpoint is part of the Malquery API.

```HTTP
GET /malquery/entities/metadata/v1
```

--------------------------------

### GET KubernetesProtectionApi get_azure_tenant_ids

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Provides all the azure subscriptions and tenants. This endpoint is part of the Kubernetes Protection API.

```HTTP
GET /kubernetes-protection/entities/tenants/azure/v1
```

--------------------------------

### GET KubernetesProtectionApi get_aws_accounts_mixin0

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Provides a list of AWS accounts. This endpoint is part of the Kubernetes Protection API.

```HTTP
GET /kubernetes-protection/entities/accounts/aws/v1
```

--------------------------------

### Get Scan Entities by IDs (Rust)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/OdsApi.md

Retrieves scan entities based on a provided list of scan IDs. Requires oauth2 authorization.

```Rust
models::EntitiesPeriodOdsScanResponseV2 get_scan_entities_by_ids(ids)
```

--------------------------------

### Create Case V2 - Message Center API - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/MessageCenterApi.md

Create a new case in the Message Center using the v2 endpoint.

```Rust
models::MsaspecPeriodResponseFields create_case_v2(body)
create a new case

### Parameters

Name | Type | Description  | Required | Notes
------------- | ------------- | ------------- | ------------- | -------------
**body** | [**DomainPeriodCaseCreationRequestV2**](DomainPeriodCaseCreationRequestV2.md) |  | [required] |

### Return type

[**models::MsaspecPeriodResponseFields**](msaspec.ResponseFields.md)
```

--------------------------------

### Fetch MalQuery Samples Zip - API Endpoint - API Documentation

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/MalqueryApi.md

Fetch a zip archive with password 'infected' containing the samples. Call this once the /entities/samples-multidownload request has finished processing.

Parameters:
- ids: String (required) - Multidownload job id.

Return type: (empty response body)

Authorization: oauth2

HTTP details: GET /malquery/entities/samples-fetch/v1

```API Documentation
get_mal_query_entities_samples_fetch_v1(ids)

### Parameters

Name | Type | Description  | Required | Notes
------------- | ------------- | ------------- | ------------- | -------------
**ids** | **String** | Multidownload job id | [required] |

### Return type

 (empty response body)

### Authorization

[oauth2](../README.md#oauth2)

### HTTP request headers

- **Content-Type**: Not defined
- **Accept**: application/zip, application/json
```

--------------------------------

### Get Services Count - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/AspmApi.md

Retrieves the total count of existing services. Requires a GetServicesRequest body. This endpoint returns an empty response body.

```Rust
get_services_count(body)
```

--------------------------------

### Get Executor Nodes - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/AspmApi.md

Retrieves a list of executor nodes. Requires node_type and optionally accepts integration_type for filtering. Returns a ListExecutorNodesResponse model.

```Rust
models::TypesPeriodListExecutorNodesResponse get_executor_nodes(node_type, integration_type)
```

--------------------------------

### Initiating Actions API Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/FilevantageApi.md

This endpoint initiates a specified action (suppress, unsuppress, or purge) on a list of provided change IDs. Only one action can be active at a time. It requires a body containing the operation type, change IDs (up to 100), and an optional comment. It returns an ActionsPeriodActionResponse model.

```Rust
> models::ActionsPeriodActionResponse start_actions(body)
```

--------------------------------

### Get Scheduled Scans by IDs (Rust)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/OdsApi.md

Retrieves scheduled scan entities based on a provided list of scan IDs. Requires oauth2 authorization.

```Rust
models::EntitiesPeriodOdsScheduleScanResponse get_scheduled_scans_by_scan_ids(ids)
```

--------------------------------

### Creating Integration Task API Documentation (Rust)

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/AspmApi.md

Documents the API endpoint for creating a new integration task. It requires a request body of type `TypesPeriodCreateIntegrationTaskRequest` and returns an object of type `TypesPeriodIntegrationTaskResponse`. Authorization is via oauth2, and both request and response use `application/json`.

```Rust
models::TypesPeriodIntegrationTaskResponse create_integration_task(body)

Parameters:
- body: TypesPeriodCreateIntegrationTaskRequest (required)

Return Type: models::TypesPeriodIntegrationTaskResponse
Authorization: oauth2
HTTP Headers: Content-Type: application/json, Accept: application/json
```

--------------------------------

### Create Firewall Policies using Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/FirewallPoliciesApi.md

Creates new firewall policies by specifying their details. Requires a request body containing policy configuration and optionally accepts a policy ID to clone from. Returns the details of the newly created policies.

```Rust
models::FirewallPeriodRespV1 create_firewall_policies(body, clone_id)
```

--------------------------------

### List Repositories and Views - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/FoundryLogscaleApi.md

Lists available repositories and views. Supports an optional `check_test_data` parameter to include information about test data presence. Returns a `models::ApidomainPeriodRepoViewListItemWrapperV1`.

```Rust
> models::ApidomainPeriodRepoViewListItemWrapperV1 list_repos_v1(check_test_data)
```

--------------------------------

### Query Applications - CrowdStrike Falcon API - Rust

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/DiscoverApi.md

Searches for applications in the environment using an FQL filter and pagination parameters. It returns a list of application IDs matching the criteria. Requires OAuth2 authorization.

```Rust
models::Msaspec.QueryResponse query_applications(offset, limit, sort, filter)
```

--------------------------------

### GET KubernetesProtectionApi list_azure_accounts

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Provides the azure subscriptions registered to Kubernetes Protection. This endpoint is part of the Kubernetes Protection API.

```HTTP
GET /kubernetes-protection/entities/accounts/azure/v1
```

--------------------------------

### GET KubernetesProtectionApi get_clusters

Source: https://github.com/crowdstrike/rusty-falcon/blob/main/docs/src/docs/README.md

Provides the clusters acknowledged by the Kubernetes Protection service. This endpoint is part of the Kubernetes Protection API.

```HTTP
GET /kubernetes-protection/entities/kubernetes/clusters/v1
```