FalconPy

FalconPy is CrowdStrike’s officially maintained Python SDK for the Falcon platform, abstracting OAuth2 token management, request signing, and response handling behind a set of Service Classes — one per CrowdStrike API service collection (Hosts, Detects, Alerts, Incidents, Spotlight, and well over a hundred more). Developers building security automation, SOAR integrations, or custom tooling on top of CrowdStrike Falcon get a consistent, typed interface instead of hand-rolling HTTP calls and token refresh logic against a large and evolving API surface.

Beyond the per-collection Service Classes, FalconPy also ships an Uber Class that exposes every operation across every service collection through a single object, useful for scripts that touch many endpoints without importing dozens of classes. Both approaches share the same authentication layer, support automatic cloud-region autodiscovery across CrowdStrike’s US-1, US-2, EU-1, and GovCloud environments, and include parameter/body payload abstraction so callers can pass keyword arguments instead of constructing raw JSON bodies by hand.

What You Get

• A dedicated Service Class for each CrowdStrike Falcon API service collection (Hosts, Detects, Alerts, Incidents, Spotlight Vulnerabilities, and 100+ others), each with methods matching the documented API operations
• An Uber Class that provides single-import access to every operation across every service collection, including newly released operations via an override escape hatch
• Automatic OAuth2 token management with transparent refresh, so credentials are handled once at client construction
• Cloud region autodiscovery and explicit region selection across CrowdStrike’s US-1, US-2, EU-1, and GovCloud environments
• Parameter and body payload abstraction, letting callers pass keyword arguments instead of building raw request bodies
• Type stub (.pyi) files alongside every module for IDE autocompletion and static type checking

Common Use Cases

• Building SOAR playbooks or automation scripts that query and remediate hosts, detections, and incidents in Falcon
• Writing custom integrations that sync CrowdStrike alert and vulnerability data into a SIEM, ticketing system, or data warehouse
• Automating device control, IOA/IOC management, and policy configuration across a fleet from CI/CD or scheduled jobs
• Prototyping against newly released CrowdStrike API operations before a dedicated Service Class method exists, via the Uber Class override method

Under The Hood

Architecture FalconPy is organized around a shared authentication layer (_auth_object, with FalconInterface and UberInterface abstractions) that every Service Class and the Uber Class construct against, so credential handling, token refresh, and region selection live in one place rather than being duplicated per endpoint. Each API service collection gets a thin ServiceClass subclass built on a common BaseServiceClass, with request/response shaping delegated to shared _util, _payload, and _result modules and endpoint definitions kept in a separate _endpoint package. This separation means adding support for a new CrowdStrike API collection is largely a matter of adding an endpoint definition and a class, not touching the auth or request-dispatch code, and the Uber Class reuses the same interfaces to expose every operation through one object.

Tech Stack The SDK is pure Python (3.8-3.14), built with Hatchling and versioned from a single _version.py source of truth, depending on only requests and urllib3 at runtime — a deliberately minimal dependency footprint for something distributed widely into security tooling. Packaging metadata in pyproject.toml restricts the wheel to the src/falconpy package, and development dependencies (bandit, flake8, pydocstyle, pylint, pytest, pytest-cov) are isolated under an optional dev extra.

Code Quality The test suite spans roughly 150 test files covering nearly every Service Class individually, backed by CI workflows for flake8, pylint, pydocstyle, bandit (security linting), CodeQL, and unit tests run separately across Ubuntu, macOS, Windows, and multiple CrowdStrike cloud regions (US-1, US-2, GovCloud). Every implementation module ships alongside a matching .pyi type-stub file, giving static type checkers and IDEs full signatures without runtime typing overhead, and docstrings are enforced via pydocstyle in CI rather than left optional.

API Design The dual surface — one class per service collection versus a single Uber Class — lets callers choose between discoverable, IDE-friendly typed methods and a compact single-import client for scripts touching many operations at once. Parameter and body-payload abstraction removes the need to hand-build JSON request bodies, and the Uber Class’s override method gives a documented escape hatch for calling brand-new API operations before a typed method exists for them, avoiding the common SDK problem of lagging behind the API it wraps.