Quick Scan Pro - CrowdStrike/falconpy GitHub Wiki

CrowdStrike Falcon CrowdStrike Subreddit

Using the Quick Scan Pro service collection

Uber class support Service class support Documentation Version Page Updated

Table of Contents

Operation ID Description
UploadFileQuickScanPro
PEP 8 upload_file
Uploads a file to be further analyzed with QuickScan Pro. The samples expire after 90 days.
DeleteFile
PEP 8 delete_file
Deletes file by its sha256 identifier.
GetScanResult
PEP 8 get_scan_result
Gets the result of an QuickScan Pro scan.
LaunchScan
PEP 8 launch_scan
Starts scanning a file uploaded through UploadFileQuickScanPro.
DeleteScanResult
PEP 8 delete_scan_result
Deletes the result of an QuickScan Pro scan.
QueryScanResults
PEP 8 query_scan_results
Gets QuickScan Pro scan jobs for a given FQL filter.

Passing credentials

WARNING

client_id and client_secret are keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

UploadFileQuickScanPro

Uploads a file to be further analyzed with QuickScan Pro. The samples expire after 90 days.

PEP8 method name

upload_file

Endpoint

Method Route
POST /quickscanpro/entities/files/v1

Required Scope

quick-scan-pro:write

Content-Type

  • Consumes: multipart/form-data
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
file Service Class Support Uber Class Support formData file Binary file to be uploaded. Max file size: 256 MB.
file_name Service Class Support Uber Class Support query string Name of the file being uploaded.
scan Service Class Support Uber Class Support formData boolean If True, after upload, it starts scanning immediately. Default scan mode is False.
password Service Class Support Uber Class Support formData string MULTIPART ONLY - Password for encrypted archives (use for multipart/form-data uploads). If scan is true, the value is used for the scan just starting.
x_file_password Service Class Support Uber Class Support header string OCTET-STREAM ONLY - Password for encrypted archives (use for octet-stream uploads). If scan is true, the value is used for the scan just starting.

Usage

Service class example (PEP8 syntax)
from falconpy import QuickScanPro

# Do not hardcode API credentials!
falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

scan_file = "file_to_scan.ext"

with open(scan_file, "rb") as file_upload:
    response = falcon.upload_file(file=file_upload.read(), file_name=scan_file, scan=boolean)

print(response)
Service class example (Operation ID syntax)
from falconpy import QuickScanPro

# Do not hardcode API credentials!
falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

scan_file = "file_to_scan.ext"

with open(scan_file, "rb") as file_upload:
    response = falcon.UploadFileQuickScanPro(file=file_upload.read(), file_name=scan_file, scan=boolean)

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

scan_file = "file_to_scan.ext"

form_payload = {
    "file_name": scan_file,
    "scan": boolean
}

with open(scan_file, "rb") as file_upload:
    response = falcon.command("UploadFileQuickScanPro",
                              files=[("file", ("UploadedFile", file_upload.read()))],
                              data=form_payload
                              )
print(response)

Back to Table of Contents

DeleteFile

Deletes file by its SHA256 identifier.

PEP8 method name

delete_file

Endpoint

Method Route
DELETE /quickscanpro/entities/files/v1

Required Scope

quick-scan-pro:write

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
ids Service Class Support Uber Class Support query string or list of strings File's SHA256
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import QuickScanPro

# Do not hardcode API credentials!
falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_file(ids=id_list)

print(response)
Service class example (Operation ID syntax)
from falconpy import QuickScanPro

# Do not hardcode API credentials!
falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteFile(ids=id_list)

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteFile", ids=id_list)

print(response)

Back to Table of Contents

GetScanResult

Gets the result of an QuickScan Pro scan.

PEP8 method name

get_scan_result

Endpoint

Method Route
GET /quickscanpro/entities/scans/v1

Required Scope

quick-scan-pro:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
ids Service Class Support Uber Class Support query string or list of strings Scan job IDs previously created by LaunchScan.
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import QuickScanPro

# Do not hardcode API credentials!
falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_scan_result(ids=id_list)

print(response)
Service class example (Operation ID syntax)
from falconpy import QuickScanPro

# Do not hardcode API credentials!
falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetScanResult(ids=id_list)

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetScanResult", ids=id_list)

print(response)

Back to Table of Contents

LaunchScan

Starts scanning a file uploaded through '/quickscanpro/entities/files/v1'.

PEP8 method name

launch_scan

Endpoint

Method Route
POST /quickscanpro/entities/scans/v1

Required Scope

quick-scan-pro:write

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
body Service Class Support Uber Class Support body dictionary Full body payload in JSON format.
sha256 Service Class Support Uber Class Support body string Full body payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import QuickScanPro

# Do not hardcode API credentials!
falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.launch_scan(sha256="string")

print(response)
Service class example (Operation ID syntax)
from falconpy import QuickScanPro

# Do not hardcode API credentials!
falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.LaunchScan(sha256="string")

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "sha256": "string"
        }
    ]
}

response = falcon.command("LaunchScan", body=body_payload)

print(response)

Back to Table of Contents

DeleteScanResult

Deletes the result of an QuickScan Pro scan.

PEP8 method name

delete_scan_result

Endpoint

Method Route
DELETE /quickscanpro/entities/scans/v1

Required Scope

quick-scan-pro:write

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
ids Service Class Support Uber Class Support query string or list of strings Scan job IDs previously created by LaunchScan
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import QuickScanPro

# Do not hardcode API credentials!
falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_scan_result(ids=id_list)

print(response)
Service class example (Operation ID syntax)
from falconpy import QuickScanPro

# Do not hardcode API credentials!
falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteScanResult(ids=id_list)

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteScanResult", ids=id_list)

print(response)

Back to Table of Contents

QueryScanResults

Gets QuickScan Pro scan jobs for a given FQL filter.

PEP8 method name

query_scan_results

Endpoint

Method Route
GET /quickscanpro/queries/scans/v1

Required Scope

quick-scan-pro:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support Uber Class Support query string Required. FQL query which mentions the SHA256 field. Empty value means to not filter on anything. Available filter fields that support match (~): _all, mitre_attacks.description. Available filter fields that support exact match: cid, sha256, id, status, type, entity, executor, verdict, verdict_reason, verdict_source, file_size, file_type_short, artifacts.file_artifacts.sha256, artifacts.file_artifacts.filename, artifacts.file_artifacts.verdict, artifacts.file_artifacts.verdict_reasons, artifacts.url_artifacts.url, artifacts.url_artifacts.verdict, artifacts.url_artifacts.verdict_reasons, mitre_attacks.attack_id, mitre_attacks.attack_id_wiki, mitre_attacks.tactic, mitre_attacks.technique, mitre_attacks.capec_id, mitre_attacks.parent.attack_id, mitre_attacks.parent.attack_id_wiki, mitre_attacks.parent.technique. Available filter fields that support wildcard (*): mitre_attacks.description. Available filter fields that support range comparisons (>, <, >=, <=): created_timestamp, updated_timestamp, file_size. All filter fields and operations support negation (!). _all field is used to search between all fields.
offset Service Class Support Uber Class Support query integer The offset to start retrieving ids from.
limit Service Class Support Uber Class Support query integer Maximum number of IDs to return. Max: 5000. Default: 50.
sort Service Class Support Uber Class Support query string Sort order: asc or desc. Sort supported fields created_timestamp
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import QuickScanPro

# Do not hardcode API credentials!
falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.query_scan_results(filter="string",
                                     offset=integer,
                                     limit=integer,
                                     sort="string"
                                     )
print(response)
Service class example (Operation ID syntax)
from falconpy import QuickScanPro

# Do not hardcode API credentials!
falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.QueryScanResults(filter="string",
                                   offset=integer,
                                   limit=integer,
                                   sort="string"
                                   )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryScanResults",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )

print(response)

Back to Table of Contents

⚠️ **GitHub.com Fallback** ⚠️