Sensor Download - CrowdStrike/falconpy GitHub Wiki

CrowdStrike Falcon CrowdStrike Subreddit

Using the Sensor Download service collection

Uber class support Service class support Documentation Version Page Updated Samples Available

This service collection has code examples posted to the repository.

Table of Contents

Operation ID Description
GetCombinedSensorInstallersByQuery
PEP 8 get_combined_sensor_installers_by_query
Get sensor installer details by provided query
GetCombinedSensorInstallersByQueryV2
PEP 8 get_combined_sensor_installers_by_query_v2
Get sensor installer details by provided query
DownloadSensorInstallerById
PEP 8 download_sensor_installer
Download sensor installer by SHA256 ID
DownloadSensorInstallerByIdV2
PEP 8 download_sensor_installer_v2
Download sensor installer by SHA256 ID
GetSensorInstallersEntities
PEP 8 get_sensor_installer_entities
Get sensor installer details by provided SHA256 IDs
GetSensorInstallersEntitiesV2
PEP 8 get_sensor_installer_entities_v2
Get sensor installer details by provided SHA256 IDs
GetSensorInstallersCCIDByQuery
PEP 8 get_sensor_installer_ccid
Get CCID to use with sensor installers
GetSensorInstallersByQuery
PEP 8 get_sensor_installers_by_query
Get sensor installer IDs by provided query
GetSensorInstallersByQueryV2
PEP 8 get_sensor_installers_by_query_v2
Get sensor installer IDs by provided query

Passing credentials

WARNING

client_id and client_secret are keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

GetCombinedSensorInstallersByQuery

Get sensor installer details by provided query

PEP8 method name

get_combined_sensor_installers_by_query

Endpoint

Method Route
GET /sensors/combined/installers/v1

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
limit
Service Class Support
Uber Class Support
 query integer The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
filter
Service Class Support
Uber Class Support
 query string Filter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include:
  • platform:"windows"
  • version:>"5.2"
offset
Service Class Support
Uber Class Support
 query integer The first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.
sort
Service Class Support
Uber Class Support
 query string Sort items using their properties. Common sort options include:
  • version|asc
  • release_date|desc

Usage

Service class example (PEP8 syntax)
from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_combined_sensor_installers_by_query(offset=integer,
                                                          limit=integer,
                                                          sort="string",
                                                          filter="string"
                                                          )
print(response)
Service class example (Operation ID syntax)
from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.GetCombinedSensorInstallersByQuery(offset=integer,
                                                     limit=integer,
                                                     sort="string",
                                                     filter="string"
                                                     )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetCombinedSensorInstallersByQuery",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string"
                          )
print(response)

GetCombinedSensorInstallersByQueryV2

Get sensor installer details by provided query

PEP8 method name

get_combined_sensor_installers_by_query_v2

Endpoint

Method Route
GET /sensors/combined/installers/v2

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
limit
Service Class Support
Uber Class Support
 query integer The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
filter
Service Class Support
Uber Class Support
 query string Filter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include:
  • platform:"windows"
  • version:>"5.2"
offset
Service Class Support
Uber Class Support
 query integer The first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.
sort
Service Class Support
Uber Class Support
 query string Sort items using their properties. Common sort options include:
  • version|asc
  • release_date|desc

Usage

Service class example (PEP8 syntax)
from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_combined_sensor_installers_by_query_v2(offset=integer,
                                                            limit=integer,
                                                            sort="string",
                                                            filter="string"
                                                            )
print(response)
Service class example (Operation ID syntax)
from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.GetCombinedSensorInstallersByQueryV2(offset=integer,
                                                       limit=integer,
                                                       sort="string",
                                                       filter="string"
                                                       )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetCombinedSensorInstallersByQueryV2",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string"
                          )
print(response)

DownloadSensorInstallerById

Download sensor installer by SHA256 ID

PEP8 method name

download_sensor_installer

Endpoint

Method Route
GET /sensors/entities/download-installer/v1

Content-Type

  • Consumes: application/json
  • Produces: application/octet-stream

Keyword Arguments

Name Service Uber Type Data type Description
download_path
Service Class Support
Uber Class Support
 query string File path to use for the saved file. Must be present to trigger a file download.
id
Service Class Support
Uber Class Support
 query string SHA256 of the installer to download
file_name
Service Class Support
Uber Class Support
 query string File name to use for the saved file. Must be present to trigger a file download.
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

# Also ask the service class to go ahead and download the file for us
response = falcon.download_sensor_installer(id="string",
                                            download_path="/tmp/",
                                            file_name="cs_installer.bin"
                                            )
print(response)
Service class example (Operation ID syntax)
from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

# Also ask the service class to go ahead and download the file for us
response = falcon.DownloadSensorInstallerById(id="string",
                                              download_path="C:\Temp",
                                              file_name="cs_installer.exe"
                                              )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

filename = "cs_installer.exe"
response = falcon.command("DownloadSensorInstallerById", id="string")
if not isinstance(response, dict):
    # If our response is a dictionary, there is an error
    with open(filename, "wb") as download_file:
        download_file.write(response)

DownloadSensorInstallerByIdV2

Download sensor installer by SHA256 ID

PEP8 method name

download_sensor_installer_v2

Endpoint

Method Route
GET /sensors/entities/download-installer/v2

Content-Type

  • Consumes: application/json
  • Produces: application/octet-stream

Keyword Arguments

Name Service Uber Type Data type Description
download_path
Service Class Support
Uber Class Support
 query string File path to use for the saved file. Must be present to trigger a file download.
id
Service Class Support
Uber Class Support
 query string SHA256 of the installer to download
file_name
Service Class Support
Uber Class Support
 query string File name to use for the saved file. Must be present to trigger a file download.
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

# Also ask the service class to go ahead and download the file for us
response = falcon.download_sensor_installer_v2(id="string",
                                               download_path="/tmp/",
                                               file_name="cs_installer.bin"
                                               )
print(response)
Service class example (Operation ID syntax)
from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

# Also ask the service class to go ahead and download the file for us
response = falcon.DownloadSensorInstallerByIdV2(id="string",
                                                download_path="C:\Temp",
                                                file_name="cs_installer.exe"
                                                )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

filename = "cs_installer.exe"
response = falcon.command("DownloadSensorInstallerByIdV2", id="string")
if not isinstance(response, dict):
    # If our response is a dictionary, there is an error
    with open(filename, "wb") as download_file:
        download_file.write(response)

GetSensorInstallersEntities

Get sensor installer details by provided SHA256 IDs

PEP8 method name

get_sensor_installer_entities

Endpoint

Method Route
GET /sensors/entities/installers/v1

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
ids
Service Class Support
Uber Class Support
 query string or list of strings The IDs of the installers to retrieve details for.
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_sensor_installer_entities(ids=id_list)
print(response)
Service class example (Operation ID syntax)
from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetSensorInstallersEntities(ids=id_list)
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetSensorInstallersEntities", ids=id_list)
print(response)

GetSensorInstallersEntitiesV2

Get sensor installer details by provided SHA256 IDs

PEP8 method name

get_sensor_installer_entities_v2

Endpoint

Method Route
GET /sensors/entities/installers/v2

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
ids
Service Class Support
Uber Class Support
 query string or list of strings The IDs of the installers to retrieve details for.
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_sensor_installer_entities_v2(ids=id_list)

print(response)
Service class example (Operation ID syntax)
from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetSensorInstallersEntitiesV2(ids=id_list)

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetSensorInstallersEntitiesV2", ids=id_list)

print(response)

GetSensorInstallersCCIDByQuery

Get CCID to use with sensor installers

PEP8 method name

get_sensor_installer_ccid

Endpoint

Method Route
GET /sensors/queries/installers/ccid/v1

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

No keywords or arguments accepted.

Usage

Service class example (PEP8 syntax)
from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_sensor_installer_ccid()
print(response)
Service class example (Operation ID syntax)
from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.GetSensorInstallersCCIDByQuery()
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetSensorInstallersCCIDByQuery")
print(response)

GetSensorInstallersByQuery

Get sensor installer IDs by provided query

PEP8 method name

get_sensor_installers_by_query

Endpoint

Method Route
GET /sensors/queries/installers/v1

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter
Service Class Support
Uber Class Support
 query string Filter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include:
  • platform:"windows"
  • version:>"5.2"
limit
Service Class Support
Uber Class Support
 query integer The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
offset
Service Class Support
Uber Class Support
 query integer The first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.
sort
Service Class Support
Uber Class Support
 query string Sort items using their properties. Common sort options include:
  • version|asc
  • release_date|desc

Usage

Service class example (PEP8 syntax)
from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_sensor_installers_by_query(offset=integer,
                                                 limit=integer,
                                                 sort="string",
                                                 filter="string"
                                                 )
print(response)
Service class example (Operation ID syntax)
from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.GetSensorInstallersByQuery(offset=integer,
                                             limit=integer,
                                             sort="string",
                                             filter="string"
                                             )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetSensorInstallersByQuery",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string"
                          )
print(response)

GetSensorInstallersByQueryV2

Get sensor installer IDs by provided query

PEP8 method name

get_sensor_installers_by_query_v2

Endpoint

Method Route
GET /sensors/queries/installers/v2

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter
Service Class Support
Uber Class Support
 query string Filter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include:
  • platform:"windows"
  • version:>"5.2"
limit
Service Class Support
Uber Class Support
 query integer The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
offset
Service Class Support
Uber Class Support
 query integer The first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
parameters
Service Class Support
Uber Class Support
 query dictionary Full query string parameters payload in JSON format.
sort
Service Class Support
Uber Class Support
 query string Sort items using their properties. Common sort options include:
  • version|asc
  • release_date|desc

Usage

Service class example (PEP8 syntax)
from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_sensor_installers_by_query_v2(offset=integer,
                                                    limit=integer,
                                                    sort="string",
                                                    filter="string"
                                                    )
print(response)
Service class example (Operation ID syntax)
from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.GetSensorInstallersByQueryV2(offset=integer,
                                               limit=integer,
                                               sort="string",
                                               filter="string"
                                               )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetSensorInstallersByQueryV2",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string"
                          )
print(response)

⚠️ **GitHub.com Fallback** ⚠️