Skip to content

Falconx Sandbox

Joshua Hiller edited this page Nov 2, 2021 · 21 revisions

CrowdStrike Falcon Twitter URL

Using the Falconx Sandbox service collection

Uber class support Service class support Documentation Version

Table of Contents

Operation ID Description
GetArtifacts
PEP 8 get_artifacts
Download IOC packs, PCAP files, and other analysis artifacts.
GetSummaryReports
PEP 8 get_summary_reports
Get a short summary version of a sandbox report.
GetReports
PEP 8 get_reports
Get a full sandbox report.
DeleteReport
PEP 8 delete_report
Delete report based on the report ID. Operation can be checked for success by polling for the report ID on the report-summaries endpoint.
GetSubmissions
PEP 8 get_submissions
Check the status of a sandbox analysis. Time required for analysis varies but is usually less than 15 minutes.
Submit
PEP 8 submit
Submit an uploaded file or a URL for sandbox analysis. Time required for analysis varies but is usually less than 15 minutes.
QueryReports
PEP 8 query_reports
Find sandbox reports by providing a FQL filter and paging details. Returns a set of report IDs that match your criteria.
QuerySubmissions
PEP 8 query_submissions
Find submission IDs for uploaded files by providing a FQL filter and paging details. Returns a set of submission IDs that match your criteria.
GetSampleV2
PEP 8 get_sample
Retrieves the file associated with the given ID (SHA256)
UploadSampleV2
PEP 8 upload_sample
Upload a file for sandbox analysis. After uploading, use /falconx/entities/submissions/v1 to start analyzing the file.
DeleteSampleV2
PEP 8 delete_sample
Removes a sample, including file, meta and submissions from the collection
QuerySampleV1
PEP 8 query_sample
Retrieves a list with sha256 of samples that exist and customer has rights to access them, maximum number of accepted items is 200

GetArtifacts

Download IOC packs, PCAP files, and other analysis artifacts.

PEP8 method name

get_artifacts

Keyword Arguments

Name Service Uber Type Datatype Description
headers
Service Class Support

Uber Class Support
header string Format used to compress your downloaded file. Currently, you must provide the value gzip, the only valid format, as the Accept-Encoding header when using the Uber class. This keyword is not necessary when using the Service Class.
id
Service Class Support

Uber Class Support
query string ID of an artifact, such as an IOC pack, PCAP file, or actor image. Find an artifact ID in a report or summary.
name
Service Class Support

Uber Class Support
query string The name given to your downloaded file.
parameters
Service Class Support

Uber Class Support
query string Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id="API_CLIENT_ID_HERE",
                        client_secret="API_CLIENT_SECRET_HERE"
                        )

response = falcon.get_artifacts(id="string", name="string")
print(response)
Service class example (Operation ID syntax)
from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id="API_CLIENT_ID_HERE",
                        client_secret="API_CLIENT_SECRET_HERE"
                        )

response = falcon.GetArtifacts(id="string", name="string")
print(response)
Uber class example
from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

HEADERS = {
    "Accept-Encoding": "gzip"
}

response = falcon.command("GetArtifacts", id="string", name="string", headers=HEADERS)
print(response)

GetSummaryReports

Get a short summary version of a sandbox report.

PEP8 method name

get_summary_reports

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Datatype Description
ids
Service Class Support

Uber Class Support
query string or list of strings ID of a summary report. Find a summary report ID from the response when submitting a malware sample or search with query_reports.
parameters
Service Class Support

Uber Class Support
query string Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id="API_CLIENT_ID_HERE",
                        client_secret="API_CLIENT_SECRET_HERE"
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_summary_reports(ids=id_list)
print(response)
Service class example (Operation ID syntax)
from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id="API_CLIENT_ID_HERE",
                        client_secret="API_CLIENT_SECRET_HERE"
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetSummaryReports(ids=id_list)
print(response)
Uber class example
from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetSummaryReports", ids=id_list)
print(response)

GetReports

Get a full sandbox report.

PEP8 method name

get_reports

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Datatype Description
ids
Service Class Support

Uber Class Support
query string or list of strings ID of a report. Find a report ID from the response when submitting a malware sample or search with query_reports.
parameters
Service Class Support

Uber Class Support
query string Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id="API_CLIENT_ID_HERE",
                        client_secret="API_CLIENT_SECRET_HERE"
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_reports(ids=id_list)
print(response)
Service class example (Operation ID syntax)
from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id="API_CLIENT_ID_HERE",
                        client_secret="API_CLIENT_SECRET_HERE"
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetReports(ids=id_list)
print(response)
Uber class example
from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetReports", ids=id_list)
print(response)

DeleteReport

Delete report based on the report ID. Operation can be checked for success by polling for the report ID on the report-summaries endpoint.

PEP8 method name

delete_report

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Datatype Description
ids
Service Class Support

Uber Class Support
query string or list of strings ID of a report. Find a report ID from the response when submitting a malware sample or search with query_reports.
parameters
Service Class Support

Uber Class Support
query string Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id="API_CLIENT_ID_HERE",
                        client_secret="API_CLIENT_SECRET_HERE"
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_report(ids=id_list)
print(response)
Service class example (Operation ID syntax)
from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id="API_CLIENT_ID_HERE",
                        client_secret="API_CLIENT_SECRET_HERE"
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteReport(ids=id_list)
print(response)
Uber class example
from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteReport", ids=id_list)
print(response)

GetSubmissions

Check the status of a sandbox analysis. Time required for analysis varies but is usually less than 15 minutes.

PEP8 method name

get_submissions

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Datatype Description
ids
Service Class Support

Uber Class Support
query string or list of strings ID of a submitted malware sample. Find a submission ID from the response when submitting a malware sample or search with query_submissions.
parameters
Service Class Support

Uber Class Support
query string Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id="API_CLIENT_ID_HERE",
                        client_secret="API_CLIENT_SECRET_HERE"
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_submissions(ids=id_list)
print(response)
Service class example (Operation ID syntax)
from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id="API_CLIENT_ID_HERE",
                        client_secret="API_CLIENT_SECRET_HERE"
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetSubmissions(ids=id_list)
print(response)
Uber class example
from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetSubmissions", ids=id_list)
print(response)

Submit

Submit an uploaded file or a URL for sandbox analysis. Time required for analysis varies but is usually less than 15 minutes.

PEP8 method name

submit

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Datatype Description
action_script
Service Class Support

Uber Class Support
body string Runtime script for sandbox analysis.

Accepted values:
  • default
  • default_randomtheme
  • default_maxantievasion
  • default_openie
  • default_randomfiles
body
Service Class Support

Uber Class Support
body string Full body payload in JSON format.
command_line
Service Class Support

Uber Class Support
body string Command line script passed to the submitted file at runtime. Max length: 2048 characters
document_password
Service Class Support

Uber Class Support
body string Auto-filled for Adobe or Office files that prompt for a password. Max length: 32 characters
enable_tor
Service Class Support

Uber Class Support
body boolean Deprecated, please use network_settings instead. If true, sandbox analysis routes network traffic via TOR.
environment_id
Service Class Support

Uber Class Support
body integer Specifies the sandbox environment used for analysis.

Accepted values:
  • 300 - Linux Ubuntu 16.04, 64-bit
  • 200 - Android (static analysis)
  • 160 - Windows 10, 64-bit
  • 110 - Windows 7, 64-bit
  • 100 - Windows 7, 32-bit
network_settings
Service Class Support

Uber Class Support
body string Specifies the sandbox network_settings used for analysis.

Accepted values:
  • default - Fully operating network
  • tor - Route network traffic via TOR
  • simulated - Simulate network traffic
  • offline - No network traffic
send_email_notification
Service Class Support

Uber Class Support
body boolean Boolean indicating if an email notification should be sent.
sha256
Service Class Support

Uber Class Support
body string ID of the sample, which is a SHA256 hash value. Find a sample ID from the response when uploading a malware sample or search with query_sample.

The url keyword must be unset if this keyword is used.
submit_name
Service Class Support

Uber Class Support
body string Name of the malware sample that's used for file type detection and analysis.
system_date
Service Class Support

Uber Class Support
body string Set a custom date in the format yyyy-MM-dd for the sandbox environment.
system_time
Service Class Support

Uber Class Support
body string Set a custom time in the format HH:mm for the sandbox environment.
url
Service Class Support

Uber Class Support
body string A web page or file URL. It can be HTTP(S) or FTP.

The sha256 keyword must be unset if this keyword is used.
user_tags
Service Class Support

Uber Class Support
body list of strings User tags.

Usage

Service class example (PEP8 syntax)
from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id="API_CLIENT_ID_HERE",
                        client_secret="API_CLIENT_SECRET_HERE"
                        )

tags = ['TAG1', 'TAG2', 'TAG3']

response = falcon.submit(action_script="string",
                         command_line="string",
                         document_password="string",
                         enable_tor=boolean,
                         environment_id=integer,
                         network_settings="string",
                         send_email_notifications=boolean,
                         sha256="string",
                         submit_name="string",
                         submit_date="string",
                         submit_time="string",
                         url="string",
                         user_tags=tags
                         )
print(response)
Service class example (Operation ID syntax)
from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id="API_CLIENT_ID_HERE",
                        client_secret="API_CLIENT_SECRET_HERE"
                        )

tags = ['TAG1', 'TAG2', 'TAG3']

response = falcon.Submit(action_script="string",
                         command_line="string",
                         document_password="string",
                         enable_tor=boolean,
                         environment_id=integer,
                         network_settings="string",
                         send_email_notifications=boolean,
                         sha256="string",
                         submit_name="string",
                         submit_date="string",
                         submit_time="string",
                         url="string",
                         user_tags=tags
                         )
print(response)
Uber class example
from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

tags = ['TAG1', 'TAG2', 'TAG3']

BODY = {
    "sandbox": [
        {
            "action_script": "string",
            "command_line": "string",
            "document_password": "string",
            "enable_tor": boolean,
            "environment_id": integer,
            "network_settings": "string",
            "sha256": "string",
            "submit_name": "string",
            "system_date": "string",
            "system_time": "string",
            "url": "string"
        }
    ],
    "send_email_notification": boolean,
    "user_tags": tags
}

response = falcon.command("Submit", body=BODY)
print(response)

QueryReports

Find sandbox reports by providing a FQL filter and paging details. Returns a set of report IDs that match your criteria.

PEP8 method name

query_reports

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Datatype Description
filter
Service Class Support

Uber Class Support
query string Optional filter and sort criteria in the form of an FQL query.
limit
Service Class Support

Uber Class Support
query integer The maximum records to return. (Max: 5000).
offset
Service Class Support

Uber Class Support
query integer Starting index of overall result set from which to return ids.
parameters
Service Class Support

Uber Class Support
query string Full query string parameters payload in JSON format.
sort
Service Class Support

Uber Class Support
query string The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc.

Usage

Service class example (PEP8 syntax)
from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id="API_CLIENT_ID_HERE",
                        client_secret="API_CLIENT_SECRET_HERE"
                        )

response = falcon.query_reports(filter="string",
                                offset="string",
                                limit=integer,
                                sort="string"
                                )
print(response)
Service class example (Operation ID syntax)
from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id="API_CLIENT_ID_HERE",
                        client_secret="API_CLIENT_SECRET_HERE"
                        )

response = falcon.QueryReports(filter="string",
                               offset="string",
                               limit=integer,
                               sort="string"
                               )
print(response)
Uber class example
from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("QueryReports",
                          filter="string",
                          offset="string",
                          limit=integer,
                          sort="string"
                          )
print(response)

QuerySubmissions

Find submission IDs for uploaded files by providing a FQL filter and paging details. Returns a set of submission IDs that match your criteria.

PEP8 method name

query_submissions

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Datatype Description
filter
Service Class Support

Uber Class Support
query string Optional filter and sort criteria in the form of an FQL query.
limit
Service Class Support

Uber Class Support
query integer The maximum records to return. (Max: 5000).
offset
Service Class Support

Uber Class Support
query integer Starting index of overall result set from which to return ids.
parameters
Service Class Support

Uber Class Support
query string Full query string parameters payload in JSON format.
sort
Service Class Support

Uber Class Support
query string The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc.

Usage

Service class example (PEP8 syntax)
from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id="API_CLIENT_ID_HERE",
                        client_secret="API_CLIENT_SECRET_HERE"
                        )

response = falcon.query_submissions(filter="string",
                                    offset="string",
                                    limit=integer,
                                    sort="string"
                                    )
print(response)
Service class example (Operation ID syntax)
from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id="API_CLIENT_ID_HERE",
                        client_secret="API_CLIENT_SECRET_HERE"
                        )

response = falcon.QuerySubmissions(filter="string",
                                   offset="string",
                                   limit=integer,
                                   sort="string"
                                   )
print(response)
Uber class example
from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("QuerySubmissions",
                          filter="string",
                          offset="string",
                          limit=integer,
                          sort="string"
                          )
print(response)

GetSampleV2

Retrieves the file associated with the given ID (SHA256)

PEP8 method name

get_sample

Content-Type

  • Produces: application/octet-stream

Keyword Arguments

Name Service Uber Type Datatype Description
id
Service Class Support

Uber Class Support
query string The file SHA256.
parameters
Service Class Support

Uber Class Support
query string Full query string parameters payload in JSON format.
password_protected
Service Class Support

Uber Class Support
query string Flag whether the sample should be zipped and password protected with password of infected.

Usage

Service class example (PEP8 syntax)
from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id="API_CLIENT_ID_HERE",
                        client_secret="API_CLIENT_SECRET_HERE"
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

save_file = "some_file.ext"

response = falcon.get_sample(password_protected=boolean, ids=id_list)
open(save_file, 'wb').write(response)
Service class example (Operation ID syntax)
from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id="API_CLIENT_ID_HERE",
                        client_secret="API_CLIENT_SECRET_HERE"
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

save_file = "some_file.ext"

response = falcon.GetSampleV2(password_protected=boolean, ids=id_list)
open(save_file, 'wb').write(response)
Uber class example
from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

save_file = "some_file.ext"

response = falcon.command("GetSampleV2", password_protected=boolean, ids=id_list)
open(save_file, 'wb').write(response)

UploadSampleV2

Upload a file for sandbox analysis. After uploading, use /falconx/entities/submissions/v1 to start analyzing the file.

PEP8 method name

upload_sample

Content-Type

  • Consumes: multipart/form-data
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Datatype Description
comment
Service Class Support

Uber Class Support
formData string A descriptive comment to identify the file for other users.
data
Service Class Support

Uber Class Support
formData file Content of the uploaded sample in binary format. Max file size: 256 MB. Accepted file formats:
  • Portable executables: .exe, .scr, .pif, .dll, .com, .cpl, etc.
  • Office documents: .doc, .docx, .ppt, .pps, .pptx, .ppsx, .xls, .xlsx, .rtf, .pub
  • PDF
  • APK
  • Executable JAR
  • Windows script component: .sct
  • Windows shortcut: .lnk
  • Windows help: .chm
  • HTML application: .hta
  • Windows script file: .wsf
  • Javascript: .js
  • Visual Basic: .vbs, .vbe
  • Shockwave Flash: .swf
  • Perl: .pl
  • Powershell: .ps1, .psd1, .psm1
  • Scalable vector graphics: .svg
  • Python: .py
  • Linux ELF executables
  • Email files: MIME RFC 822 .eml, Outlook .msg.
file_data
or
sample
or
upfile

Service Class Support

Uber Class Support
formData string Content of the uploaded sample in binary format. Max file size: 256 MB. Accepted file formats:
  • Portable executables: .exe, .scr, .pif, .dll, .com, .cpl, etc.
  • Office documents: .doc, .docx, .ppt, .pps, .pptx, .ppsx, .xls, .xlsx, .rtf, .pub
  • PDF
  • APK
  • Executable JAR
  • Windows script component: .sct
  • Windows shortcut: .lnk
  • Windows help: .chm
  • HTML application: .hta
  • Windows script file: .wsf
  • Javascript: .js
  • Visual Basic: .vbs, .vbe
  • Shockwave Flash: .swf
  • Perl: .pl
  • Powershell: .ps1, .psd1, .psm1
  • Scalable vector graphics: .svg
  • Python: .py
  • Linux ELF executables
  • Email files: MIME RFC 822 .eml, Outlook .msg.
file_name
Service Class Support

Uber Class Support
formData string Name to use for the file. Uses current file name if not specified.
is_confidential
Service Class Support

Uber Class Support
formData boolean Defines the visibility of this file in Falcon MalQuery, either via the API or the Falcon console.
  • true - File is only shown to users within your customer account.
  • false - File can be seen by other CrowdStrike customers.
Defaults to true.
parameters
Service Class Support

Uber Class Support
formData string Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id="API_CLIENT_ID_HERE",
                        client_secret="API_CLIENT_SECRET_HERE"
                        )

FILENAME = 'test_file.ext'
PAYLOAD = open(FILENAME, 'rb').read()

response = falcon.upload_sample(sample=PAYLOAD,
                                file_name="string",
                                comment='string',
                                is_confidential=boolean
                                )
print(response)
Service class example (Operation ID syntax)
from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id="API_CLIENT_ID_HERE",
                        client_secret="API_CLIENT_SECRET_HERE"
                        )

FILENAME = 'test_file.ext'
PAYLOAD = open(FILENAME, 'rb').read()

response = falcon.UploadSampleV2(file_data=PAYLOAD,
                                 file_name="string",
                                 comment='string',
                                 is_confidential=boolean
                                 )
print(response)
Uber class example
from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

FILENAME = 'test_file.ext'
PAYLOAD = open(FILENAME, 'rb').read()

response = falcon.command("UploadSampleV2",
                          data=PAYLOAD,
                          file_name="string",
                          comment="string",
                          is_confidential=boolean,
                          content_type="application/octet-stream"
                          )
print(response)

DeleteSampleV2

Removes a sample, including file, meta and submissions from the collection

PEP8 method name

delete_sample

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Datatype Description
id
Service Class Support

Uber Class Support
query string The file SHA256.
parameters
Service Class Support

Uber Class Support
query string Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id="API_CLIENT_ID_HERE",
                        client_secret="API_CLIENT_SECRET_HERE"
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_sample(ids=id_list)
print(response)
Service class example (Operation ID syntax)
from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id="API_CLIENT_ID_HERE",
                        client_secret="API_CLIENT_SECRET_HERE"
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteSampleV2(ids=id_list)
print(response)
Uber class example
from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteSampleV2", ids=id_list)
print(response)

QuerySampleV1

Retrieves a list with sha256 of samples that exist and customer has rights to access them, maximum number of accepted items is 200

PEP8 method name

query_sample

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

Name Service Uber Type Datatype Description
body
Service Class Support

Uber Class Support
body string Full body payload in JSON format.
sha256s
Service Class Support

Uber Class Support
body string or list of strings Pass a list of sha256s to check if the exist. You will be returned the list of existing hashes.

Usage

Service class example (PEP8 syntax)
from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id="API_CLIENT_ID_HERE",
                        client_secret="API_CLIENT_SECRET_HERE"
                        )

id_list = 'SHA1,SHA2,SHA3'  # Can also pass a list here: ['SHA1', 'SHA2', 'SHA3']

response = falcon.query_sample(sha256s=id_list)
print(response)
Service class example (Operation ID syntax)
from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id="API_CLIENT_ID_HERE",
                        client_secret="API_CLIENT_SECRET_HERE"
                        )

id_list = 'SHA1,SHA2,SHA3'  # Can also pass a list here: ['SHA1', 'SHA2', 'SHA3']

response = falcon.QuerySampleV1(sha256s=id_list)
print(response)
Uber class example
from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
    "sha256s": [
        "string"
    ]
}

response = falcon.command("QuerySampleV1", body=BODY)
print(response)

CrowdStrike Falcon

Clone this wiki locally