CrowdStrike Falcon Twitter URL

Using the Sample Uploads service collection

Uber class support Service class support Documentation Version Page Updated Samples Available

This service collection has code examples posted to the repository.

Table of Contents

Operation IDDescription
GetSampleV3
PEP 8get_sample
Retrieves the file associated with the given ID (SHA256).
UploadSampleV3
PEP 8upload_sample
Upload a file for further cloud analysis. After uploading, call the specific analysis API endpoint.
DeleteSampleV3
PEP 8delete_sample
Removes a sample, including file, meta and submissions from the collection.

Passing credentials

WARNING

client_id and client_secret are input variables that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

GetSampleV3

Retrieves the file associated with the given ID (SHA256)

PEP8 method name

get_sample

Content-Type

  • Produces: application/octet-stream

Keyword Arguments

NameServiceUberTypeData typeDescription
ids
Service Class Support

Uber Class Support
querystringThe file SHA256.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.
password_protected
Service Class Support

Uber Class Support
querybooleanFlag whether the sample should be zipped and password protected with the password infected.

Usage

Service class example (PEP8 syntax)
from falconpy import SampleUploads

# Do not hardcode API credentials!
falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

file_sha = "50d858e0985ecc7f60418aaf0cc5ab587f42c2570a884095a9e8ccacd0f6545c"

save_file = "some_file.ext"

response = falcon.get_sample(password_protected=boolean, ids=file_sha)
open(save_file, 'wb').write(response)
Service class example (Operation ID syntax)
from falconpy import SampleUploads

# Do not hardcode API credentials!
falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

file_sha = "50d858e0985ecc7f60418aaf0cc5ab587f42c2570a884095a9e8ccacd0f6545c"

save_file = "some_file.ext"

response = falcon.GetSampleV3(password_protected=boolean, ids=file_sha)
open(save_file, 'wb').write(response)
Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

file_sha = "50d858e0985ecc7f60418aaf0cc5ab587f42c2570a884095a9e8ccacd0f6545c"

save_file = "some_file.ext"

response = falcon.command("GetSampleV3", password_protected=boolean, ids=file_sha)
open(save_file, 'wb').write(response)

UploadSampleV3

Upload a file for further cloud analysis. After uploading, call the specific analysis API endpoint.

PEP8 method name

upload_sample

Content-Type

  • Consumes: multipart/form-data
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
comment
Service Class Support

Uber Class Support
formDatastringA descriptive comment to identify the file for other users.
data
Service Class Support

Uber Class Support
formDatafileContent of the uploaded sample in binary format. Max file size: 256 MB. Accepted file formats:
  • Portable executables: .exe, .scr, .pif, .dll, .com, .cpl, etc.
  • Office documents: .doc, .docx, .ppt, .pps, .pptx, .ppsx, .xls, .xlsx, .rtf, .pub
  • PDF
  • APK
  • Executable JAR
  • Windows script component: .sct
  • Windows shortcut: .lnk
  • Windows help: .chm
  • HTML application: .hta
  • Windows script file: .wsf
  • Javascript: .js
  • Visual Basic: .vbs, .vbe
  • Shockwave Flash: .swf
  • Perl: .pl
  • Powershell: .ps1, .psd1, .psm1
  • Scalable vector graphics: .svg
  • Python: .py
  • Linux ELF executables
  • Email files: MIME RFC 822 .eml, Outlook .msg.
is_confidential
Service Class Support

Uber Class Support
formDatabooleanDefines visibility of this file in Falcon MalQuery, either via the API or the Falcon console.
  • true: File is only shown to users within your customer account
  • false: File can be seen by other CrowdStrike customers
Default: true.
file_data
or
sample
or
upfile

Service Class Support

Uber Class Support
formDatafileContent of the uploaded sample in binary format. Max file size: 256 MB. Accepted file formats:
  • Portable executables: .exe, .scr, .pif, .dll, .com, .cpl, etc.
  • Office documents: .doc, .docx, .ppt, .pps, .pptx, .ppsx, .xls, .xlsx, .rtf, .pub
  • PDF
  • APK
  • Executable JAR
  • Windows script component: .sct
  • Windows shortcut: .lnk
  • Windows help: .chm
  • HTML application: .hta
  • Windows script file: .wsf
  • Javascript: .js
  • Visual Basic: .vbs, .vbe
  • Shockwave Flash: .swf
  • Perl: .pl
  • Powershell: .ps1, .psd1, .psm1
  • Scalable vector graphics: .svg
  • Python: .py
  • Linux ELF executables
  • Email files: MIME RFC 822 .eml, Outlook .msg.
file_name
Service Class Support

Uber Class Support
formDatastringName to use for the file. Uses current file name if not specified.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import SampleUploads

# Do not hardcode API credentials!
falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

FILENAME = 'test_file.ext'
PAYLOAD = open(FILENAME, 'rb').read()

response = falcon.upload_sample(sample=PAYLOAD,
                                file_name="string",
                                comment='string',
                                is_confidential=boolean
                                )
print(response)

Service class example (Operation ID syntax)
from falconpy import SampleUploads

# Do not hardcode API credentials!
falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

FILENAME = 'test_file.ext'
PAYLOAD = open(FILENAME, 'rb').read()

response = falcon.UploadSampleV3(file_data=PAYLOAD,
                                 file_name="string",
                                 comment='string',
                                 is_confidential=boolean
                                 )
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

FILENAME = 'test_file.ext'
PAYLOAD = open(FILENAME, 'rb').read()

response = falcon.command("UploadSampleV3",
                          data=PAYLOAD,
                          file_name="string",
                          comment="string",
                          is_confidential=boolean,
                          content_type="application/octet-stream"
                          )
print(response)

DeleteSampleV3

Removes a sample, including file, meta and submissions from the collection

PEP8 method name

delete_sample

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
ids
Service Class Support

Uber Class Support
querystringThe file SHA256 of the file to delete.
parameters
Service Class Support

Uber Class Support
querydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import SampleUploads

# Do not hardcode API credentials!
falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

file_sha = "50d858e0985ecc7f60418aaf0cc5ab587f42c2570a884095a9e8ccacd0f6545c"

response = falcon.delete_sample(ids=file_sha)
print(response)

Service class example (Operation ID syntax)
from falconpy import SampleUploads

# Do not hardcode API credentials!
falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

file_sha = "50d858e0985ecc7f60418aaf0cc5ab587f42c2570a884095a9e8ccacd0f6545c"

response = falcon.DeleteSampleV3(ids=file_sha)
print(response)

Uber class example
from falconpy import APIHarness

# Do not hardcode API credentials!
falcon = APIHarness(client_id=CLIENT_ID,
                    client_secret=CLIENT_SECRET
                    )

file_sha = "50d858e0985ecc7f60418aaf0cc5ab587f42c2570a884095a9e8ccacd0f6545c"

response = falcon.command("DeleteSampleV3", ids=file_sha)
print(response)