Skip to content

Quick Scan

jshcodes edited this page Apr 11, 2021 · 30 revisions

CrowdStrike Falcon Twitter URL

Using the Quick Scan service collection

Uber class support Uber class support

Table of Contents

API Function Description
GetScansAggregates Get scans aggregations as specified via json in request body.
GetScans Check the status of a volume scan. Time required for analysis increases with the number of samples in a volume but usually it should take less than 1 minute
ScanSamples Submit a volume of files for ml scanning. Time required for analysis increases with the number of samples in a volume but usually it should take less than 1 minute
QuerySubmissionsMixin0 Find IDs for submitted scans by providing an FQL filter and paging details. Returns a set of volume IDs that match your criteria.

GetScansAggregates

Get scans aggregations as specified via json in request body.

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
body body string

Usage

Service class example
from falconpy import quick_scan as FalconScan

falcon = FalconScan.Quick_Scan(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

BODY = {
    'Body Payload': 'See body description above'
}

response = falcon.GetScansAggregates(body=BODY)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

BODY = {
    'Body Payload': 'See body description above'
}

response = falcon.command('GetScansAggregates', body=BODY)
print(response)
falcon.deauthenticate()

GetScans

Check the status of a volume scan. Time required for analysis increases with the number of samples in a volume but usually it should take less than 1 minute

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
ids query array (string) ID of a submitted scan

Usage

Service class example
from falconpy import quick_scan as FalconScan

falcon = FalconScan.Quick_Scan(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

IDS = 'ID1,ID2,ID3'

response = falcon.GetScans(ids=IDS)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

IDS = 'ID1,ID2,ID3'

response = falcon.command('GetScans', ids=IDS)
print(response)
falcon.deauthenticate()

ScanSamples

Submit a volume of files for ml scanning. Time required for analysis increases with the number of samples in a volume but usually it should take less than 1 minute

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
body body string Submit a batch of SHA256s for ml scanning. The samples must have been previously uploaded through /samples/entities/samples/v3

Usage

Service class example
from falconpy import quick_scan as FalconScan

falcon = FalconScan.Quick_Scan(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

BODY = {
    'Body Payload': 'See body description above'
}

response = falcon.ScanSamples(body=BODY)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

BODY = {
    'Body Payload': 'See body description above'
}

response = falcon.command('ScanSamples', body=BODY)
print(response)
falcon.deauthenticate()

QuerySubmissionsMixin0

Find IDs for submitted scans by providing an FQL filter and paging details. Returns a set of volume IDs that match your criteria.

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
filter query string Optional filter and sort criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
offset query string The offset to start retrieving submissions from.
limit query integer Maximum number of volume IDs to return. Max: 5000.
sort query string Sort order: asc or desc.

Usage

Service class example
from falconpy import quick_scan as FalconScan

falcon = FalconScan.Quick_Scan(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

PARAMS = {
    'filter': 'string',
    'offset': 'string',
    'limit': integer,
    'sort': 'string'
}

response = falcon.QuerySubmissionsMixin0(parameters=PARAMS)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

PARAMS = {
    'filter': 'string',
    'offset': 'string',
    'limit': integer,
    'sort': 'string'
}

response = falcon.command('QuerySubmissionsMixin0', parameters=PARAMS)
print(response)
falcon.deauthenticate()

CrowdStrike Falcon

Clone this wiki locally