CrowdStrike Falcon CrowdStrike Subreddit

Using the Quick Scan Pro service collection

Uber class support Service class support Documentation Version Page Updated

Table of Contents

Operation IDDescription
UploadFileMixin0Mixin93
PEP8upload_file
Uploads a file to be further analyzed with QuickScan Pro. The samples expire after 90 days.
DeleteFile
PEP8delete_file
Deletes file by its sha256 identifier.
GetScanResult
PEP8get_scan_result
Gets the result of an QuickScan Pro scan.
LaunchScan
PEP8launch_scan
Starts scanning a file uploaded through UploadFileMixin0Mixin93.
DeleteScanResult
PEP8delete_scan_result
Deletes the result of an QuickScan Pro scan.
QueryScanResults
PEP8query_scan_results
Gets QuickScan Pro scan jobs for a given FQL filter.

UploadFileMixin0Mixin93

Uploads a file to be further analyzed with QuickScan Pro. The samples expire after 90 days.

PEP8 method name

upload_file

Endpoint

MethodRoute
POST/quickscanpro/entities/files/v1

Required Scope

quick-scan-pro:write

Content-Type

  • Consumes: multipart/form-data
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
fileService Class SupportUber Class SupportformDatafileBinary file to be uploaded. Max file size: 256 MB.
scanService Class SupportUber Class SupportformDatabooleanIf True, after upload, it starts scanning immediately. Default scan mode is False.

Usage

Service class example (PEP8 syntax)
from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

scan_file = "file_to_scan.ext"

with open(scan_file, "rb") as upload_file:
    response = falcon.upload_file(file=file_upload.read(), scan=boolean)

print(response)
Service class example (Operation ID syntax)
from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

scan_file = "file_to_scan.ext"

with open(scan_file, "rb") as upload_file:
    response = falcon.UploadFileMixin0Mixin93(file=upload_file.read(), scan=boolean)

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

form_payload = {
    "scan": boolean
}

scan_file = "file_to_scan.ext"

with open(scan_file, "rb") as upload_file:
    response = falcon.command("UploadFileMixin0Mixin93",
                              files=[("file", ("UploadedFile", upload_file.read()))],
                              data=form_payload
                              )
print(response)

Back to Table of Contents

DeleteFile

Deletes file by its SHA256 identifier.

PEP8 method name

delete_file

Endpoint

MethodRoute
DELETE/quickscanpro/entities/files/v1

Required Scope

quick-scan-pro:write

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
idsService Class SupportUber Class Supportquerystring or list of stringsFile's SHA256
parametersService Class SupportUber Class SupportquerydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_file(ids=id_list)

print(response)
Service class example (Operation ID syntax)
from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteFile(ids=id_list)

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteFile", ids=id_list)

print(response)

Back to Table of Contents

GetScanResult

Gets the result of an QuickScan Pro scan.

PEP8 method name

get_scan_result

Endpoint

MethodRoute
GET/quickscanpro/entities/scans/v1

Required Scope

quick-scan-pro:read

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
idsService Class SupportUber Class Supportquerystring or list of stringsScan job IDs previously created by LaunchScan.
parametersService Class SupportUber Class SupportquerydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_scan_result(ids=id_list)

print(response)
Service class example (Operation ID syntax)
from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetScanResult(ids=id_list)

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetScanResult", ids=id_list)

print(response)

Back to Table of Contents

LaunchScan

Starts scanning a file uploaded through '/quickscanpro/entities/files/v1'.

PEP8 method name

launch_scan

Endpoint

MethodRoute
POST/quickscanpro/entities/scans/v1

Required Scope

quick-scan-pro:write

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
bodyService Class SupportUber Class SupportbodydictionaryFull body payload in JSON format.
sha256Service Class SupportUber Class SupportbodystringFull body payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.launch_scan(sha256="string")

print(response)
Service class example (Operation ID syntax)
from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.LaunchScan(sha256="string")

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        "sha256": "string"
    ]
}

response = falcon.command("LaunchScan", body=body_payload)

print(response)

Back to Table of Contents

DeleteScanResult

Deletes the result of an QuickScan Pro scan.

PEP8 method name

delete_scan_result

Endpoint

MethodRoute
DELETE/quickscanpro/entities/scans/v1

Required Scope

quick-scan-pro:write

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
idsService Class SupportUber Class Supportquerystring or list of stringsScan job IDs previously created by LaunchScan
parametersService Class SupportUber Class SupportquerydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_scan_result(ids=id_list)

print(response)
Service class example (Operation ID syntax)
from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteScanResult(ids=id_list)

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteScanResult", ids=id_list)

print(response)

Back to Table of Contents

QueryScanResults

Gets QuickScan Pro scan jobs for a given FQL filter.

PEP8 method name

query_scan_results

Endpoint

MethodRoute
GET/quickscanpro/queries/scans/v1

Required Scope

quick-scan-pro:read

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filterService Class SupportUber Class SupportquerystringFQL query which mentions the SHA256 field
offsetService Class SupportUber Class SupportqueryintegerThe offset to start retrieving ids from.
limitService Class SupportUber Class SupportqueryintegerMaximum number of IDs to return. Max: 5000.
sortService Class SupportUber Class SupportquerystringSort order: asc or desc. Sort supported fields created_timestamp
parametersService Class SupportUber Class SupportquerydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.query_scan_results(filter="string",
                                     offset=integer,
                                     limit=integer,
                                     sort="string"
                                     )
print(response)
Service class example (Operation ID syntax)
from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.QueryScanResults(filter="string",
                                   offset=integer,
                                   limit=integer,
                                   sort="string"
                                   )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryScanResults",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string"
                          )
print(response)

Back to Table of Contents