QueryDetections reading Detections from deprecated API

[DanielAlt]

Documentation page topic
https://www.falconpy.io/Service-Collections/Detects.html

Describe the error or typo

Currently my team is transitioning to using the New Detections page in Crowdstrike web console (US1). We have some custom code for processing detections that are "In Progress" using falconpy. This code uses QueryDetects to read detection data. It's only reading data from the Deprecated detections page, not the new one.

Was wondering if falconpy plans to cover the "new detections" page, if an API exists for that; or if there's an existing way.

Sorry for opening this inquiry under 'docs', wasn't sure it belonged under 'bugs'

[DanielAlt]

Just as a followup; for anyone watching.
I found out that the endpoint i was looking for was the one representing the new 'unified detections' page, in the API this goes by,

/alerts/queries/alerts/v2

i still wasn't able to find any existing falconpy methods that accessed this particular api route. (will support be added?)

i used python requests module to temporarily sidestep falconpy, while I await the answer to this question.

[jshcodes]

Hi @DanielAlt -

Support for this operation (GetQueriesAlertsV2) is in flight now! This PR should merge to main today, with the production package releasing next week. 😄

[jshcodes]

Hi @DanielAlt -

The v1.3.5 package has been released! 😃

[brucelourenco]

Hello guys.
Sorry to put this question ongoing again, but just to be sure if I'm understanding well.
So, if I'm using the new UI for Detections and want to handle the detections shown there using falconpy, I wasn't able to do it using (QueryDetects) ?
In this case do I'll need to use (GetQueriesAlertsV2) instead?
Thank you guys!

[tsullivan06]

One thing to keep in mind is that alerts are somewhat different than detections. Detections were groups of related behaviors into a single dataset, with alerts those behaviors have now been broken out into individual datasets. So if you had a single detection that had 5 behaviors listed in it, in the new UI format you would see 5 alerts in the alerts UI.
The alerts API uses a field called composite_id as the unique identifier vs the detection_id that was used in detections. So make sure that you're using the right value when you query the alerts api (if it starts with 'ldt' it's a detection ID not an alert ID). They are not interchangeable so if you're using the GetQueriesAlertsV2 you need to query for and then get the details for composite_id values.

[brucelourenco]

Thank you @tsullivan06 !