Using the Sensor Download service collection

Documentation Version

This service collection has code examples posted to the repository.

Operation ID

Description

GetCombinedSensorInstallersByQuery
PEP 8	get_combined_sensor_installers_by_query

Get sensor installer details by provided query

GetCombinedSensorInstallersByQueryV2
PEP 8	get_combined_sensor_installers_by_query_v2

Get sensor installer details by provided query

DownloadSensorInstallerById
PEP 8	download_sensor_installer

Download sensor installer by SHA256 ID

DownloadSensorInstallerByIdV2
PEP 8	download_sensor_installer_v2

Download sensor installer by SHA256 ID

GetSensorInstallersEntities
PEP 8	get_sensor_installer_entities

Get sensor installer details by provided SHA256 IDs

GetSensorInstallersEntitiesV2
PEP 8	get_sensor_installer_entities_v2

Get sensor installer details by provided SHA256 IDs

GetSensorInstallersCCIDByQuery
PEP 8	get_sensor_installer_ccid

Get CCID to use with sensor installers

GetSensorInstallersByQuery
PEP 8	get_sensor_installers_by_query

Get sensor installer IDs by provided query

GetSensorInstallersByQueryV2
PEP 8	get_sensor_installers_by_query_v2

Get sensor installer IDs by provided query

Passing credentials

WARNING

client_id and client_secret are keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

GetCombinedSensorInstallersByQuery

Get sensor installer details by provided query

PEP8 method name

get_combined_sensor_installers_by_query

Endpoint

Method	Route
	`/sensors/combined/installers/v1`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
limit	query	integer	The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
filter	query	string	Filter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include: platform:"windows" version:>"5.2"
offset	query	integer	The first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
parameters	query	dictionary	Full query string parameters payload in JSON format.
sort	query	string	Sort items using their properties. Common sort options include: version\|asc release_date\|desc

Usage

Service class example (PEP8 syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_combined_sensor_installers_by_query(offset=integer,
                                                          limit=integer,
                                                          sort="string",
                                                          filter="string"
                                                          )
print(response)

Service class example (Operation ID syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.GetCombinedSensorInstallersByQuery(offset=integer,
                                                     limit=integer,
                                                     sort="string",
                                                     filter="string"
                                                     )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetCombinedSensorInstallersByQuery",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string"
                          )
print(response)

GetCombinedSensorInstallersByQueryV2

Get sensor installer details by provided query

PEP8 method name

get_combined_sensor_installers_by_query_v2

Endpoint

Method	Route
	`/sensors/combined/installers/v2`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
limit	query	integer	The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
filter	query	string	Filter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include: platform:"windows" version:>"5.2"
offset	query	integer	The first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
parameters	query	dictionary	Full query string parameters payload in JSON format.
sort	query	string	Sort items using their properties. Common sort options include: version\|asc release_date\|desc

Usage

Service class example (PEP8 syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_combined_sensor_installers_by_query_v2(offset=integer,
                                                            limit=integer,
                                                            sort="string",
                                                            filter="string"
                                                            )
print(response)

Service class example (Operation ID syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.GetCombinedSensorInstallersByQueryV2(offset=integer,
                                                       limit=integer,
                                                       sort="string",
                                                       filter="string"
                                                       )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetCombinedSensorInstallersByQueryV2",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string"
                          )
print(response)

DownloadSensorInstallerById

Download sensor installer by SHA256 ID

PEP8 method name

download_sensor_installer

Endpoint

Method	Route
	`/sensors/entities/download-installer/v1`

Content-Type

Consumes: application/json
Produces: application/octet-stream

Keyword Arguments

Name	Type	Data type	Description
download_path	query	string	File path to use for the saved file. Must be present to trigger a file download.
id	query	string	SHA256 of the installer to download
file_name	query	string	File name to use for the saved file. Must be present to trigger a file download.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

# Also ask the service class to go ahead and download the file for us
response = falcon.download_sensor_installer(id="string",
                                            download_path="/tmp/",
                                            file_name="cs_installer.bin"
                                            )
print(response)

Service class example (Operation ID syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

# Also ask the service class to go ahead and download the file for us
response = falcon.DownloadSensorInstallerById(id="string",
                                              download_path="C:\Temp",
                                              file_name="cs_installer.exe"
                                              )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

filename = "cs_installer.exe"
response = falcon.command("DownloadSensorInstallerById", id="string")
if not isinstance(response, dict):
    # If our response is a dictionary, there is an error
    with open(filename, "wb") as download_file:
        download_file.write(response)

DownloadSensorInstallerByIdV2

Download sensor installer by SHA256 ID

PEP8 method name

download_sensor_installer_v2

Endpoint

Method	Route
	`/sensors/entities/download-installer/v2`

Content-Type

Consumes: application/json
Produces: application/octet-stream

Keyword Arguments

Name	Type	Data type	Description
download_path	query	string	File path to use for the saved file. Must be present to trigger a file download.
id	query	string	SHA256 of the installer to download
file_name	query	string	File name to use for the saved file. Must be present to trigger a file download.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

# Also ask the service class to go ahead and download the file for us
response = falcon.download_sensor_installer_v2(id="string",
                                               download_path="/tmp/",
                                               file_name="cs_installer.bin"
                                               )
print(response)

Service class example (Operation ID syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

# Also ask the service class to go ahead and download the file for us
response = falcon.DownloadSensorInstallerByIdV2(id="string",
                                                download_path="C:\Temp",
                                                file_name="cs_installer.exe"
                                                )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

filename = "cs_installer.exe"
response = falcon.command("DownloadSensorInstallerByIdV2", id="string")
if not isinstance(response, dict):
    # If our response is a dictionary, there is an error
    with open(filename, "wb") as download_file:
        download_file.write(response)

GetSensorInstallersEntities

Get sensor installer details by provided SHA256 IDs

PEP8 method name

get_sensor_installer_entities

Endpoint

Method	Route
	`/sensors/entities/installers/v1`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	The IDs of the installers to retrieve details for.
parameters			query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_sensor_installer_entities(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetSensorInstallersEntities(ids=id_list)
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetSensorInstallersEntities", ids=id_list)
print(response)

GetSensorInstallersEntitiesV2

Get sensor installer details by provided SHA256 IDs

PEP8 method name

get_sensor_installer_entities_v2

Endpoint

Method	Route
	`/sensors/entities/installers/v2`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	The IDs of the installers to retrieve details for.
parameters			query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_sensor_installer_entities_v2(ids=id_list)

print(response)

Service class example (Operation ID syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetSensorInstallersEntitiesV2(ids=id_list)

print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetSensorInstallersEntitiesV2", ids=id_list)

print(response)

GetSensorInstallersCCIDByQuery

Get CCID to use with sensor installers

PEP8 method name

get_sensor_installer_ccid

Endpoint

Method	Route
	`/sensors/queries/installers/ccid/v1`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

No keywords or arguments accepted.

Usage

Service class example (PEP8 syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_sensor_installer_ccid()
print(response)

Service class example (Operation ID syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.GetSensorInstallersCCIDByQuery()
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetSensorInstallersCCIDByQuery")
print(response)

GetSensorInstallersByQuery

Get sensor installer IDs by provided query

PEP8 method name

get_sensor_installers_by_query

Endpoint

Method	Route
	`/sensors/queries/installers/v1`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
filter	query	string	Filter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include: platform:"windows" version:>"5.2"
limit	query	integer	The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
offset	query	integer	The first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
parameters	query	dictionary	Full query string parameters payload in JSON format.
sort	query	string	Sort items using their properties. Common sort options include: version\|asc release_date\|desc

Usage

Service class example (PEP8 syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_sensor_installers_by_query(offset=integer,
                                                 limit=integer,
                                                 sort="string",
                                                 filter="string"
                                                 )
print(response)

Service class example (Operation ID syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.GetSensorInstallersByQuery(offset=integer,
                                             limit=integer,
                                             sort="string",
                                             filter="string"
                                             )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetSensorInstallersByQuery",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string"
                          )
print(response)

GetSensorInstallersByQueryV2

Get sensor installer IDs by provided query

PEP8 method name

get_sensor_installers_by_query_v2

Endpoint

Method	Route
	`/sensors/queries/installers/v2`

Content-Type

Consumes: application/json
Produces: application/json

Keyword Arguments

Name	Type	Data type	Description
filter	query	string	Filter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include: platform:"windows" version:>"5.2"
limit	query	integer	The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
offset	query	integer	The first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
parameters	query	dictionary	Full query string parameters payload in JSON format.
sort	query	string	Sort items using their properties. Common sort options include: version\|asc release_date\|desc

Usage

Service class example (PEP8 syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_sensor_installers_by_query_v2(offset=integer,
                                                    limit=integer,
                                                    sort="string",
                                                    filter="string"
                                                    )
print(response)

Service class example (Operation ID syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.GetSensorInstallersByQueryV2(offset=integer,
                                               limit=integer,
                                               sort="string",
                                               filter="string"
                                               )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetSensorInstallersByQueryV2",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string"
                          )
print(response)

The CrowdStrike Falcon Wiki for Python