Downloads - CrowdStrike/falconpy GitHub Wiki

CrowdStrike Falcon CrowdStrike Subreddit

Using the Downloads API service collection

Uber class support Service class support Documentation Version Page Updated

Table of Contents

Operation ID Description
DownloadFile
PEP 8 download
DEPRECATED 		Gets pre-signed URL for the file.
EnumerateFile
PEP 8 enumerate
DEPRECATED 		Enumerates a list of files available for CID.
FetchFilesDownloadInfo
PEP 8 fetch_download_info
Get files info and pre-signed download URLs
FetchFilesDownloadInfoV2
PEP 8 fetch_download_info_v2
Get cloud security tools info and pre-signed download URLs

Passing credentials

WARNING

client_id and client_secret are keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

DownloadFile

Gets pre-signed URL for the file.

Deprecated operation

This operation has been deprecated in favor of the FetchFilesDownloadInfo operation. Developers should move code over to this new operation as soon as time permits.

PEP8 method name

download

Endpoint

Method Route
GET /csdownloads/entities/files/download/v1

Required Scope

infrastructure-as-code:read

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
file_name Service Class Support Uber Class Support query string Name of the file to be downloaded
file_version Service Class Support Uber Class Support query string Version of the file to be downloaded
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import Downloads

# Do not hardcode API credentials!
falcon = Downloads(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.download(file_name="string", file_version="string")
print(response)
Service class example (Operation ID syntax)
from falconpy import Downloads

# Do not hardcode API credentials!
falcon = Downloads(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.DownloadFile(file_name="string", file_version="string")
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("DownloadFile", file_name="string", file_version="string")
print(response)

Back to Table of Contents

EnumerateFile

Enumerates a list of files available for CID

Deprecated operation

This operation has been deprecated in favor of the FetchFilesDownloadInfo operation. Developers should move code over to this new operation as soon as time permits.

PEP8 method name

enumerate

Endpoint

Method Route
GET /csdownloads/entities/files/enumerate/v1

Required Scope

infrastructure-as-code:read

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
arch Service Class Support Uber Class Support query string Apply filtering on system architecture
category Service Class Support Uber Class Support query string Apply filtering on file category
file_name Service Class Support Uber Class Support query string Apply filtering on file name
file_version Service Class Support Uber Class Support query string Apply filtering on file version
os Service Class Support Uber Class Support query string Apply filtering on operating system
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.
platform Service Class Support Uber Class Support query string Apply filtering on file platform

Usage

Service class example (PEP8 syntax)
from falconpy import Downloads

# Do not hardcode API credentials!
falcon = Downloads(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.enumerate(arch="string",
                            category="string",
                            file_name="string",
                            file_version="string",
                            os="string",
                            platform="string"
                            )
print(response)
Service class example (Operation ID syntax)
from falconpy import Downloads

# Do not hardcode API credentials!
falcon = Downloads(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.EnumerateFile(arch="string",
                                category="string",
                                file_name="string",
                                file_version="string",
                                os="string",
                                platform="string"
                                )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("EnumerateFile",
                          arch="string",
                          category="string",
                          file_name="string",
                          file_version="string",
                          os="string",
                          platform="string"
                          )
print(response)

Back to Table of Contents

FetchFilesDownloadInfo

Get files info and pre-signed download URLs

PEP8 method name

fetch_download_info

Endpoint

Method Route
GET /csdownloads/combined/files-download/v1

Required Scope

infrastructure-as-code:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support Uber Class Support query string Search files using various filters using query in Falcon Query Language (FQL). Supported filters: arch,category,file_name,file_version,os
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.
sort Service Class Support Uber Class Support query string The fields to sort records on. Supported columns: arch category file_name file_version os

Usage

Service class example (PEP8 syntax)
from falconpy import Downloads

# Do not hardcode API credentials!
falcon = Downloads(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.fetch_download_info(filter="string",
                                      sort="string"
                                      )
print(response)
Service class example (Operation ID syntax)
from falconpy import Downloads

# Do not hardcode API credentials!
falcon = Downloads(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.FetchFilesDownloadInfo(filter="string",
                                         sort="string"
                                         )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("FetchFilesDownloadInfo",
                          filter="string",
                          sort="string"
                          )
print(response)

Back to Table of Contents

FetchFilesDownloadInfoV2

Get cloud security tools info and pre-signed download URLs

PEP8 method name

fetch_download_info_v2

Endpoint

Method Route
GET /csdownloads/combined/files-download/v2

Required Scope

infrastructure-as-code:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support Uber Class Support query string Search files using various filters. Supported filters: arch,category,file_name,file_version,os
limit Service Class Support Uber Class Support query integer The upper-bound on the number of records to retrieve. Maximum limit: 100.
offset Service Class Support Uber Class Support query integer The offset from where to begin. Maximum offset = 1000 - limit.
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.
sort Service Class Support Uber Class Support query string The fields to sort records on. Supported columns: arch category file_name file_version os

Usage

Service class example (PEP8 syntax)
from falconpy import Downloads

# Do not hardcode API credentials!
falcon = Downloads(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.fetch_download_info_v2(filter="string",
                                         limit=integer,
                                         offset=integer,
                                         sort="string"
                                         )
print(response)
Service class example (Operation ID syntax)
from falconpy import Downloads

# Do not hardcode API credentials!
falcon = Downloads(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.FetchFilesDownloadInfoV2(filter="string",
                                           limit=integer,
                                           offset=integer,
                                           sort="string"
                                           )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("FetchFilesDownloadInfoV2",
                          filter="string",
                          limit=integer,
                          offset=integer,
                          sort="string"
                          )
print(response)

Back to Table of Contents

⚠️ **GitHub.com Fallback** ⚠️