workflows

CrowdStrike FalconPy
CrowdStrike FalconPy

CrowdStrike Subreddit

Workflows examples

The examples within this folder focus on leveraging CrowdStrike's Falcon Falcon Fusion SOAR API.

Workflow Manager (Terminal version)

This sample demonstrates how to leverage the Workflows API to provide the following functionality:

  • List all workflows

  • Execute a workflow

  • List all executions for a workflow

  • Print the results of a workflow execution

  • Import a workflow

  • Export a workflow

Running the program

In order to run this demonstration, you you will need access to CrowdStrike API keys with the following scopes:

Service Collection
Scope

Workflows

READ, WRITE

Required packages

In order to run this sample, you will need to have the tabulate and termcolor packages installed.

Execution syntax

This sample leverages simple command-line arguments to implement functionality.

Basic usage

Execute the default example. This will default to listing all workflows discovered in tabular format.

[!TIP] This sample supports Environment Authentication, meaning you can execute any of the command lines shown below without providing credentials if you have the values FALCON_CLIENT_ID and FALCON_CLIENT_SECRET defined in your environment.

Change the CrowdStrike region with the -b argument.

Execute a workflow using a custom payload.

List all executions of a workflow using the -le argument.

Retrieve the results of an execution with the -g argument.

Export a workflow to a local YAML file using the -ex argument.

[!NOTE] Exporting to an existing file will overwrite it's contents.

Import a workflow from a local YAML file using the -im argument.

[!NOTE] If the workflow name defined within your workflow YAML file exists within your tenant, an error will be thrown. Use the -n argument to import this file as a new workflow with a new name.

[!TIP] You can validate this workflow import without saving by providing the -v argument with the above command.

API debugging can be enabled using the -d argument.

Adjust the output table format using the -t argument.

Swap to JSON output with the -j argument.

Command-line help

Command-line help is available via the -h argument.

Example source code

The source code for this example can be found here.

Workflow Manager (GUI version)

Running the program || Authentication || Basic Usage || Advanced Usage || Command-line help || Source Code

Like the sample above, this sample demonstrates how to leverage the Workflows API to provide the following functionality:

List workflows command

  • List all workflows

  • Execute a workflow

  • List all executions for a workflow

  • Print the results of a workflow execution

  • Import a workflow

  • Export a workflow

Additional functionality provided by this sample include:

  • Full GUI interface

  • Activity logging (to a local file)

  • Exporting list results to CSV

Running the program

In order to run this demonstration, you you will need access to CrowdStrike API keys with the following scopes:

Service Collection
Scope

Workflows

READ, WRITE

This application can be started using a simple command line without arguments.

Required packages

In order to run this sample, you will need to have the Gooey, requests and tabulate packages installed.

Return to Summary

Authentication

Environment Configuration

API credentials can be specified on the Environment tab.

These will be pre-populated if provided by the command line or environment.

[!TIP] These values can be provided on the command line using the -k and -s arguments or the --client_id and --client_secret arguments. This sample also supports Environment Authentication, meaning these values will be pre-populated for you from the variables FALCON_CLIENT_ID and FALCON_CLIENT_SECRET if they are present in the execution environment.

Return to Summary

Basic Usage

The GUI workflow manager application supports all of the same command functionality provided by the terminal version.

Listing workflows

List workflows command

To retrieve a list of all workflows within the tenant, select list_workflows on the Command tab.

Listing all workflows within the tenant requires no additional parameters (beyond authentication).

[!NOTE] This is the default command when no command is specified.

Listing workflows

Results will be shown in a console window.

[!TIP] Review advanced configuration options below for more detail regarding table formatting and outputting results to CSV.

Executing a workflow

Execute workflow command

To execute a workflow, first select the execute action on the Command tab.

Workflow ID no dropdown

Provide the workflow definition ID of the workflow to execute in the id field on the Workflow tab.

Workflow ID dropdown

If authentication credentials are provided via the command line or detected within the environment, the application will attempt to display a dropdown of all available workflows.

[!TIP] Bypass this behavior by providing the -sk or --skip_preflight command line argument when starting the application.

Workflow ID custom values

The dropdown is editable and will accept custom values.

Workflow ID and Payload

Once your ID has been specified, provide the necessary execution payload for the workflow in the payload field.

Workflow execution

Clicking the Start button will execute the options specified and display the results to the console.

Retrieving all executions for a workflow

List executions command

Select the list_executions option on the Command tab to begin.

Workflow ID

Provide the desired workflow definition ID in the id field on the Workflow tab.

List executions

Clicking the Start button will execute the search.

Results are displayed to the console.

Getting the results of a workflow execution

Get result command

To retrieve results for a specific execution, first select the get_result option on the Command tab.

Execution ID

Provide the Workflow execution ID in the execution_id field on the Workflow tab.

JSON formatting

To return results in indented JSON format, select the json option on the Environment tab.

Get Result

Clicking the Start button will execute the request using the specified options and display the results to the console.

[!NOTE] Device IDs were redacted for this screen shot but are typically shown by the application.

Exporting a workflow to a YAML file

Export command

Select the workflow_export option on the Command tab.

Workflow ID

Provide the desired workflow definition ID in the id field on the Workflow tab.

Export configuration

Use the export_workflow field on the Export tab to specify the save file for the export.

Export file

This file will be saved in YAML format.

Export file dialog

The Browse button may be used to specify this value.

Export workflow

Clicking the Start button will export the selected workflow to the specified file.

If this file already exists, it will be overwritten.

Importing a workflow from a YAML file

Import command

Select the workflow_import option on the Command tab.

Import configuration

On the Import tab, provide the location of the workflow template YAML file in the import_workflow field.

Import file dialog

The Browse button can be used to search and select the desired workflow template to import.

New workflow name

If the workflow name defined within the YAML file already exists in your tenant, an error will be thrown.

You can specify a new name for this workflow using the workflow_name field.

Validate only

Use the validate checkbox to specify that this workflow will be validated for successful import, but no action will be taken.

Import workflow

Clicking the Start button will begin the import as specified.

Results will be displayed to the console upon completion.

Return to Summary

Advanced Usage

Environment configuration

There are several advanced options that can be specified on the Environment tab or via the command line.

Formatting output

JSON formatting

Specify the json option to output results in formatted JSON.

Table formatting

Different table formats may be selected using the table_format dropdown.

Compress output

Output can compressed in the console to display when running multiple executions with the compress_output option.

Exporting list results to CSV

CSV export

Select the csv option in the table_format dropdown field to export list results to CSV for the list_workflows and list_executions commands.

Results will be saved to workflows.csv or workflow_executions.csv depending on the operation selected.

Execution results are still displayed to the console using the simple table format when the Start button is pressed.

Providing configuration via the command line

Configuration options may be specified on the command line when starting the application. These values will be pre-populated on the configuration form. Command line provided configuration options take precedence over values specified as defaults or detected within the running environment.

Specifying the list executions command option and a workflow definition ID

Importing a workflow using the command line

Adjusting the console display font size

The font point size for the console display can be adjusted using a positional command line argument. This value should be an integer.

[!NOTE] Positional command line arguments may be mixed with named arguments.

Auto-starting execution via the command line

Execution can be triggered at runtime by providing the go positional argument.

[!NOTE] The font size and auto-execution positional arguments can be mixed together along with named arguments. When using font size and auto-execution together, the font size should be specified first.

Debugging API activity

API debugging

Select the debug option to enable API debugging.

This will show detailed information regarding interactions performed with the CrowdStrike Falcon API, listing endpoints used, payloads provided, and responses received.

Logging results

Log file

To keep a separate log file of all results produced by the application, use the logfile field.

Log file selection

The Browse button can be used to select the log file.

Log file overwrite

[!WARNING] If this file exists, you may be prompted to replace the existing file.

This is a known issue. Log files will not be overwritten. Instead, results will be appended to the bottom of the file regardless of the operating system message.

Return to Summary

Command-line help

Command-line help is available via the -h argument.

Return to Summary

Example source code

The source code for this example can be found here.

Return to Summary

Previoususer_managementNextcorrelation_rules

Last updated

Was this helpful?