Skip to content

Sensor Download

Joshua Hiller edited this page Apr 12, 2021 · 21 revisions

CrowdStrike Falcon Twitter URL

Using the Sensor Download service collection

Uber class support Uber class support

Table of Contents

API Function Description
GetCombinedSensorInstallersByQuery Get sensor installer details by provided query
DownloadSensorInstallerById Download sensor installer by SHA256 ID
GetSensorInstallersEntities Get sensor installer details by provided SHA256 IDs
GetSensorInstallersCCIDByQuery Get CCID to use with sensor installers
GetSensorInstallersByQuery Get sensor installer IDs by provided query

GetCombinedSensorInstallersByQuery

Get sensor installer details by provided query

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
offset query integer The first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
limit query integer The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
sort query string Sort items using their properties. Common sort options include:
  • version
filter query string Filter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include:
  • platform:"windows"
  • version:>"5.2"

Usage

Service class example
from falconpy import sensor_download as FalconSensor

falcon = FalconSensor.Sensor_Download(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

PARAMS = {
    'offset': integer,
    'limit': integer,
    'sort': 'string',
    'filter': 'string'
}

response = falcon.GetCombinedSensorInstallersByQuery(parameters=PARAMS)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

PARAMS = {
    'offset': integer,
    'limit': integer,
    'sort': 'string',
    'filter': 'string'
}

response = falcon.command('GetCombinedSensorInstallersByQuery', parameters=PARAMS)
print(response)
falcon.deauthenticate()

DownloadSensorInstallerById

Download sensor installer by SHA256 ID

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
id query string SHA256 of the installer to download

Usage

Service class example
from falconpy import sensor_download as FalconSensor

falcon = FalconSensor.Sensor_Download(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

PARAMS = {
    'id': 'string'
}

response = falcon.DownloadSensorInstallerById(parameters=PARAMS)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

PARAMS = {
    'id': 'string'
}

response = falcon.command('DownloadSensorInstallerById', parameters=PARAMS)
print(response)
falcon.deauthenticate()

GetSensorInstallersEntities

Get sensor installer details by provided SHA256 IDs

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
ids query array (string) The IDs of the installers

Usage

Service class example
from falconpy import sensor_download as FalconSensor

falcon = FalconSensor.Sensor_Download(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

IDS = 'ID1,ID2,ID3'

response = falcon.GetSensorInstallersEntities(ids=IDS)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

IDS = 'ID1,ID2,ID3'

response = falcon.command('GetSensorInstallersEntities', ids=IDS)
print(response)
falcon.deauthenticate()

GetSensorInstallersCCIDByQuery

Get CCID to use with sensor installers

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

No parameters

Usage

Service class example
from falconpy import sensor_download as FalconSensor

falcon = FalconSensor.Sensor_Download(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

response = falcon.GetSensorInstallersCCIDByQuery()
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

response = falcon.command('GetSensorInstallersCCIDByQuery')
print(response)
falcon.deauthenticate()

GetSensorInstallersByQuery

Get sensor installer IDs by provided query

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
offset query integer The first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
limit query integer The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
sort query string Sort items using their properties. Common sort options include:
  • version
filter query string Filter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include:
  • platform:"windows"
  • version:>"5.2"

Usage

Service class example
from falconpy import sensor_download as FalconSensor

falcon = FalconSensor.Sensor_Download(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

PARAMS = {
    'offset': integer,
    'limit': integer,
    'sort': 'string',
    'filter': 'string'
}

response = falcon.GetSensorInstallersByQuery(parameters=PARAMS)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

PARAMS = {
    'offset': integer,
    'limit': integer,
    'sort': 'string',
    'filter': 'string'
}

response = falcon.command('GetSensorInstallersByQuery', parameters=PARAMS)
print(response)
falcon.deauthenticate()

CrowdStrike Falcon

Clone this wiki locally