Golang-based SDK to CrowdStrike's Falcon APIs.
Detailed API documentation is available on pkg.go.dev. The easiest way to learn about the SDK is to consult the set of examples built on top of the SDK. What follows is a subset of these examples that can be found useful as stand-alone programs.
| Example | Description |
|---|---|
| falcon_sensor_download | stand-alone tool that can be used to download CrowdStrike Falcon Sensor |
| falcon_event_stream | stand-alone tool that can be used to stream events as they happen in CrowdStrike Falcon Console |
| falcon_cleanup_pods | stand-alone tool that can be used to clean-up inactive pods from CrowdStrike Falcon Console |
| falcon_iocs | stand-alone tool that can be used to add, delete or list Custom IOCs in the CrowdStrike Falcon Console |
| falcon_host_details | stand-alone tool that outputs inventory of hosts registered to CrowdStrike Falcon platform |
| falcon_registry_token | helper to generate container registry logic information for docker login |
Gofalcon is an open source project, not a CrowdStrike product. As such, it carries no formal support, expressed or implied.
Gofalcon is periodically refreshed to reflect the newest additions to the CrowdStrike API. Users of the SDK are advised to track the latest releases rather closely to ensure proper function in the unlikely event of an incompatible change to a CrowdStrike API.
go get github.com/CrowdStrike/gofalcon/falcon
Various real-life examples can be found in the examples/ directory. The bare minimum example follows.
package main
import (
"context"
"fmt"
"github.com/crowdstrike/gofalcon/falcon"
"github.com/crowdstrike/gofalcon/falcon/client/incidents"
)
func main() {
client, err := falcon.NewClient(&falcon.ApiConfig{
ClientId: "FILL-IN-HERE",
ClientSecret: "FILL-IN-HERE",
Context: context.Background(),
})
if err != nil {
panic(err)
}
desc := "timestamp.desc"
res, err := client.Incidents.CrowdScore(&incidents.CrowdScoreParams{
Context: context.Background(),
Sort: &desc,
})
if err != nil {
panic(err)
}
payload := res.GetPayload()
fmt.Printf("As of %s your CrowdScore is %d.\n",
payload.Resources[0].Timestamp.String(), *payload.Resources[0].Score)
}