Using the Quick Scan Pro service collection

Table of Contents

Passing credentials

WARNING

client_id and client_secret are keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

UploadFileQuickScanPro

Uploads a file to be further analyzed with QuickScan Pro. The samples expire after 90 days.

PEP8 method name

upload_file

Endpoint

Method	Route
	/quickscanpro/entities/files/v1

Required Scope

Content-Type

• Consumes: multipart/form-data
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
file			formData	file	Binary file to be uploaded. Max file size: 256 MB.
scan			formData	boolean	If True, after upload, it starts scanning immediately. Default scan mode is False.

Usage

Service class example (PEP8 syntax)

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

scan_file = "file_to_scan.ext"

with open(scan_file, "rb") as file_upload:
    response = falcon.upload_file(file=file_upload.read(), scan=boolean)

print(response)

Service class example (Operation ID syntax)

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

scan_file = "file_to_scan.ext"

with open(scan_file, "rb") as file_upload:
    response = falcon.UploadFileQuickScanPro(file=file_upload.read(), scan=boolean)

print(response)

Uber class example

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

form_payload = {
    "scan": boolean
}

scan_file = "file_to_scan.ext"

with open(scan_file, "rb") as file_upload:
    response = falcon.command("UploadFileQuickScanPro",
                              files=[("file", ("UploadedFile", file_upload.read()))],
                              data=form_payload
                              )
print(response)

Back to Table of Contents

DeleteFile

Deletes file by its SHA256 identifier.

PEP8 method name

delete_file

Endpoint

Method	Route
	/quickscanpro/entities/files/v1

Required Scope

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	File's SHA256
parameters			query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_file(ids=id_list)

print(response)

Service class example (Operation ID syntax)

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteFile(ids=id_list)

print(response)

Uber class example

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteFile", ids=id_list)

print(response)

Back to Table of Contents

GetScanResult

Gets the result of an QuickScan Pro scan.

PEP8 method name

get_scan_result

Endpoint

Method	Route
	/quickscanpro/entities/scans/v1

Required Scope

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	Scan job IDs previously created by LaunchScan.
parameters			query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_scan_result(ids=id_list)

print(response)

Service class example (Operation ID syntax)

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetScanResult(ids=id_list)

print(response)

Uber class example

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetScanResult", ids=id_list)

print(response)

Back to Table of Contents

LaunchScan

Starts scanning a file uploaded through '/quickscanpro/entities/files/v1'.

PEP8 method name

launch_scan

Endpoint

Method	Route
	/quickscanpro/entities/scans/v1

Required Scope

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
body			body	dictionary	Full body payload in JSON format.
sha256			body	string	Full body payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.launch_scan(sha256="string")

print(response)

Service class example (Operation ID syntax)

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.LaunchScan(sha256="string")

print(response)

Uber class example

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        "sha256": "string"
    ]
}

response = falcon.command("LaunchScan", body=body_payload)

print(response)

Back to Table of Contents

DeleteScanResult

Deletes the result of an QuickScan Pro scan.

PEP8 method name

delete_scan_result

Endpoint

Method	Route
	/quickscanpro/entities/scans/v1

Required Scope

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	Scan job IDs previously created by LaunchScan
parameters			query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_scan_result(ids=id_list)

print(response)

Service class example (Operation ID syntax)

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteScanResult(ids=id_list)

print(response)

Uber class example

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteScanResult", ids=id_list)

print(response)

Back to Table of Contents

QueryScanResults

Gets QuickScan Pro scan jobs for a given FQL filter.

PEP8 method name

query_scan_results

Endpoint

Method	Route
	/quickscanpro/queries/scans/v1

Required Scope

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
filter			query	string	FQL query which mentions the SHA256 field
offset			query	integer	The offset to start retrieving ids from.
limit			query	integer	Maximum number of IDs to return. Max: 5000.
sort			query	string	Sort order: asc or desc. Sort supported fields created_timestamp
parameters			query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.query_scan_results(filter="string",
                                     offset=integer,
                                     limit=integer,
                                     sort="string"
                                     )
print(response)

Service class example (Operation ID syntax)

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.QueryScanResults(filter="string",
                                   offset=integer,
                                   limit=integer,
                                   sort="string"
                                   )
print(response)

Uber class example

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryScanResults",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )
print(response)

Back to Table of Contents