Using the Sensor Download service collection

This service collection has code examples posted to the repository.

Table of Contents

Passing credentials

WARNING

client_id and client_secret are keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

GetCombinedSensorInstallersByQuery

Get sensor installer details by provided query

PEP8 method name

get_combined_sensor_installers_by_query

Endpoint

Method	Route
	/sensors/combined/installers/v1

Required Scope

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
limit			query	integer	The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
filter			query	string	Filter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include: platform:"windows" version:>"5.2"
offset			query	integer	The first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
parameters			query	dictionary	Full query string parameters payload in JSON format.
sort			query	string	Sort items using their properties. Common sort options include: version|asc release_date|desc

Usage

Service class example (PEP8 syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_combined_sensor_installers_by_query(offset=integer,
                                                          limit=integer,
                                                          sort="string",
                                                          filter="string"
                                                          )
print(response)

Service class example (Operation ID syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.GetCombinedSensorInstallersByQuery(offset=integer,
                                                     limit=integer,
                                                     sort="string",
                                                     filter="string"
                                                     )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetCombinedSensorInstallersByQuery",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string"
                          )
print(response)

Back to Table of Contents

GetCombinedSensorInstallersByQueryV2

Get sensor installer details by provided query

PEP8 method name

get_combined_sensor_installers_by_query_v2

Endpoint

Method	Route
	/sensors/combined/installers/v2

Required Scope

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
limit			query	integer	The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
filter			query	string	Filter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include: platform:"windows" version:>"5.2"
offset			query	integer	The first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
parameters			query	dictionary	Full query string parameters payload in JSON format.
sort			query	string	Sort items using their properties. Common sort options include: version|asc release_date|desc

Usage

Service class example (PEP8 syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_combined_sensor_installers_by_query_v2(offset=integer,
                                                            limit=integer,
                                                            sort="string",
                                                            filter="string"
                                                            )
print(response)

Service class example (Operation ID syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.GetCombinedSensorInstallersByQueryV2(offset=integer,
                                                       limit=integer,
                                                       sort="string",
                                                       filter="string"
                                                       )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetCombinedSensorInstallersByQueryV2",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string"
                          )
print(response)

Back to Table of Contents

GetCombinedSensorInstallersByQueryV3

Get sensor installer details by provided query

PEP8 method name

get_combined_sensor_installers_by_query_v3

Endpoint

Method	Route
	/sensors/combined/installers/v3

Required Scope

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
filter			query	string	Filter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include: platform:"windows" version:>"5.2"
limit			query	integer	The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
offset			query	integer	The first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
parameters			query	dictionary	Full query string parameters payload in JSON format.
sort			query	string	Sort items using their properties. Common sort options include: version|asc release_date|desc

Usage

Service class example (PEP8 syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_combined_sensor_installers_by_query_v3(offset=integer,
                                                             limit=integer,
                                                             sort="string",
                                                             filter="string"
                                                             )
print(response)

Service class example (Operation ID syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.GetCombinedSensorInstallersByQueryV3(offset=integer,
                                                       limit=integer,
                                                       sort="string",
                                                       filter="string"
                                                       )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetCombinedSensorInstallersByQueryV3",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string"
                          )
print(response)

Back to Table of Contents

DownloadSensorInstallerById

Download sensor installer by SHA256 ID

PEP8 method name

download_sensor_installer

Endpoint

Method	Route
	/sensors/entities/download-installer/v1

Required Scope

Content-Type

• Consumes: application/json
• Produces: application/octet-stream

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
download_path			query	string	File path to use for the saved file. Must be present to trigger a file download.
id			query	string	SHA256 of the installer to download
file_name			query	string	File name to use for the saved file. Must be present to trigger a file download.
parameters			query	dictionary	Full query string parameters payload in JSON format.
stream			query	boolean	Enable streaming download of the returned file.

Usage

Service class example (PEP8 syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

# Also ask the service class to go ahead and download the file for us
response = falcon.download_sensor_installer(id="string",
                                            download_path="/tmp/",
                                            file_name="cs_installer.bin",
                                            stream=boolean
                                            )
print(response)

Service class example (Operation ID syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

# Also ask the service class to go ahead and download the file for us
response = falcon.DownloadSensorInstallerById(id="string",
                                              download_path="C:\Temp",
                                              file_name="cs_installer.exe",
                                              stream=boolean
                                              )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

filename = "cs_installer.exe"
response = falcon.command("DownloadSensorInstallerById", id="string", stream=boolean)
if not isinstance(response, dict):
    # If our response is a dictionary, there is an error
    with open(filename, "wb") as download_file:
        download_file.write(response)

Back to Table of Contents

DownloadSensorInstallerByIdV2

Download sensor installer by SHA256 ID

PEP8 method name

download_sensor_installer_v2

Endpoint

Method	Route
	/sensors/entities/download-installer/v2

Required Scope

Content-Type

• Consumes: application/json
• Produces: application/octet-stream

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
download_path			query	string	File path to use for the saved file. Must be present to trigger a file download.
id			query	string	SHA256 of the installer to download
file_name			query	string	File name to use for the saved file. Must be present to trigger a file download.
parameters			query	dictionary	Full query string parameters payload in JSON format.
stream			query	boolean	Enable streaming download of the returned file.

Usage

Service class example (PEP8 syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

# Also ask the service class to go ahead and download the file for us
response = falcon.download_sensor_installer_v2(id="string",
                                               download_path="/tmp/",
                                               file_name="cs_installer.bin",
                                               stream=boolean
                                               )
print(response)

Service class example (Operation ID syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

# Also ask the service class to go ahead and download the file for us
response = falcon.DownloadSensorInstallerByIdV2(id="string",
                                                download_path="C:\Temp",
                                                file_name="cs_installer.exe",
                                                stream=boolean
                                                )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

filename = "cs_installer.exe"
response = falcon.command("DownloadSensorInstallerByIdV2", id="string", stream=boolean)
if not isinstance(response, dict):
    # If our response is a dictionary, there is an error
    with open(filename, "wb") as download_file:
        download_file.write(response)

Back to Table of Contents

DownloadSensorInstallerByIdV3

Download sensor installer by SHA256 ID

PEP8 method name

download_sensor_installer_v3

Endpoint

Method	Route
	/sensors/entities/download-installer/v3

Required Scope

Content-Type

• Consumes: application/json
• Produces: application/octet-stream

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
id			query	string	SHA256 of the installer to download.
parameters			query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.download_sensor_installer_v3(id="string")
print(response)

Service class example (Operation ID syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.DownloadSensorInstallerByIdV3(id="string")
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("DownloadSensorInstallerByIdV3", id="string")
print(response)

Back to Table of Contents

GetSensorInstallersEntities

Get sensor installer details by provided SHA256 IDs

PEP8 method name

get_sensor_installer_entities

Endpoint

Method	Route
	/sensors/entities/installers/v1

Required Scope

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	The IDs of the installers to retrieve details for.
parameters			query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_sensor_installer_entities(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetSensorInstallersEntities(ids=id_list)
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetSensorInstallersEntities", ids=id_list)
print(response)

Back to Table of Contents

GetSensorInstallersEntitiesV2

Get sensor installer details by provided SHA256 IDs

PEP8 method name

get_sensor_installer_entities_v2

Endpoint

Method	Route
	/sensors/entities/installers/v2

Required Scope

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	The IDs of the installers to retrieve details for.
parameters			query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_sensor_installer_entities_v2(ids=id_list)

print(response)

Service class example (Operation ID syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetSensorInstallersEntitiesV2(ids=id_list)

print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetSensorInstallersEntitiesV2", ids=id_list)

print(response)

Back to Table of Contents

GetSensorInstallersEntitiesV3

Get sensor installer details by provided SHA256 IDs

PEP8 method name

get_sensor_installer_entities_v3

Endpoint

Method	Route
	/sensors/entities/installers/v3

Required Scope

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
ids			query	string or list of strings	The IDs of the installers.
parameters			query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_sensor_installer_entities_v3(ids=id_list)

print(response)

Service class example (Operation ID syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetSensorInstallersEntitiesV3(ids=id_list)

print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetSensorInstallersEntitiesV3", ids=id_list)

print(response)

Back to Table of Contents

GetSensorInstallersCCIDByQuery

Get CCID to use with sensor installers

PEP8 method name

get_sensor_installer_ccid

Endpoint

Method	Route
	/sensors/queries/installers/ccid/v1

Required Scope

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

No keywords or arguments accepted.

Usage

Service class example (PEP8 syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_sensor_installer_ccid()
print(response)

Service class example (Operation ID syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.GetSensorInstallersCCIDByQuery()
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetSensorInstallersCCIDByQuery")
print(response)

Back to Table of Contents

GetSensorInstallersByQuery

Get sensor installer IDs by provided query

PEP8 method name

get_sensor_installers_by_query

Endpoint

Method	Route
	/sensors/queries/installers/v1

Required Scope

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
filter			query	string	Filter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include: platform:"windows" version:>"5.2"
limit			query	integer	The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
offset			query	integer	The first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
parameters			query	dictionary	Full query string parameters payload in JSON format.
sort			query	string	Sort items using their properties. Common sort options include: version|asc release_date|desc

Usage

Service class example (PEP8 syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_sensor_installers_by_query(offset=integer,
                                                 limit=integer,
                                                 sort="string",
                                                 filter="string"
                                                 )
print(response)

Service class example (Operation ID syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.GetSensorInstallersByQuery(offset=integer,
                                             limit=integer,
                                             sort="string",
                                             filter="string"
                                             )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetSensorInstallersByQuery",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string"
                          )
print(response)

Back to Table of Contents

GetSensorInstallersByQueryV2

Get sensor installer IDs by provided query

PEP8 method name

get_sensor_installers_by_query_v2

Endpoint

Method	Route
	/sensors/queries/installers/v2

Required Scope

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
filter			query	string	Filter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include: platform:"windows" version:>"5.2"
limit			query	integer	The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
offset			query	integer	The first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
parameters			query	dictionary	Full query string parameters payload in JSON format.
sort			query	string	Sort items using their properties. Common sort options include: version|asc release_date|desc

Usage

Service class example (PEP8 syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_sensor_installers_by_query_v2(offset=integer,
                                                    limit=integer,
                                                    sort="string",
                                                    filter="string"
                                                    )
print(response)

Service class example (Operation ID syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.GetSensorInstallersByQueryV2(offset=integer,
                                               limit=integer,
                                               sort="string",
                                               filter="string"
                                               )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetSensorInstallersByQueryV2",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string"
                          )

print(response)

Back to Table of Contents

GetSensorInstallersByQueryV3

Get sensor installer IDs by provided query

PEP8 method name

get_sensor_installers_by_query_v3

Endpoint

Method	Route
	/sensors/queries/installers/v3

Required Scope

Content-Type

• Consumes: application/json
• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
filter			query	string	Filter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include: platform:"windows" version:>"5.2"
limit			query	integer	The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
offset			query	integer	The first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
parameters			query	dictionary	Full query string parameters payload in JSON format.
sort			query	string	Sort items using their properties. Common sort options include: version|asc release_date|desc

Usage

Service class example (PEP8 syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_sensor_installers_by_query_v3(offset=integer,
                                                    limit=integer,
                                                    sort="string",
                                                    filter="string"
                                                    )
print(response)

Service class example (Operation ID syntax)

from falconpy import SensorDownload

# Do not hardcode API credentials!
falcon = SensorDownload(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.GetSensorInstallersByQueryV3(offset=integer,
                                               limit=integer,
                                               sort="string",
                                               filter="string"
                                               )
print(response)

Uber class example

from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetSensorInstallersByQueryV3",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string"
                          )

print(response)

Back to Table of Contents