Downloads

The Downloads API service collection provides operations for enumerating and downloading files available for your CID. Retrieve pre-signed download URLs for CrowdStrike-provided files and cloud security tools, with support for filtering by architecture, category, operating system, and platform.

Language	Last Update
Python	v1.6.5
PowerShell
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
DownloadFile download	Gets pre-signed URL for the file deprecated
EnumerateFile enumerate	Enumerates a list of files available for CID deprecated
FetchFilesDownloadInfo fetch_download_info	Get files info and pre-signed download URLs deprecated
FetchFilesDownloadInfoV2 fetch_download_info_v2	Get cloud security tools info and pre-signed download URLs

---

DownloadFile

Gets pre-signed URL for the file

Deprecated

This operation is deprecated.

Method GET

Route /csdownloads/entities/files/download/v1

Scope Infrastructure as Code (IaC): READ

PEP 8 download

Parameters

file_name query · string

Name of the file to be downloaded

file_version query · string

Version of the file to be downloaded

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import Downloads

falcon = Downloads(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.download(file_name="string", file_version="string")
print(response)

Operation ID

from falconpy import Downloads

falcon = Downloads(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.DownloadFile(file_name="string", file_version="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("DownloadFile",
                          file_name="string",
                          file_version="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/downloads_api"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.DownloadsApi.DownloadFile(
    &downloads_api.DownloadFileParams{
      FileName: "string",
      FileVersion: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.downloadsApi.downloadFile(
  "string",  // fileName
  "string"  // fileVersion
);

console.log(response);

Rust

use rusty_falcon::apis::downloads_api_api::download_file;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = download_file(
        &falcon.cfg,  // configuration
        "string",  // file_name
        "string",  // file_version
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Downloads.new

response = api.download_file('string', 'string')

puts response

Responses

200 OK

{}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

EnumerateFile

Enumerates a list of files available for CID

Deprecated

This operation is deprecated.

Method GET

Route /csdownloads/entities/files/enumerate/v1

Scope Infrastructure as Code (IaC): READ

PEP 8 enumerate

Parameters

file_name query · string

Apply filtering on file name

file_version query · string

Apply filtering on file version

platform query · string

Apply filtering on file platform

os query · string

Apply filtering on operating system

arch query · string

Apply filtering on architecture

category query · string

Apply filtering on file category

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import Downloads

falcon = Downloads(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.enumerate(arch="string",
                            file_name="string",
                            file_version="string",
                            os="string",
                            platform="string",
                            category="string")
print(response)

Operation ID

from falconpy import Downloads

falcon = Downloads(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.EnumerateFile(arch="string",
                                file_name="string",
                                file_version="string",
                                os="string",
                                platform="string",
                                category="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("EnumerateFile",
                          file_name="string",
                          file_version="string",
                          platform="string",
                          os="string",
                          arch="string",
                          category="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/downloads_api"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  fileName := "string"
  fileVersion := "string"
  platform := "string"
  os := "string"
  arch := "string"
  category := "string"

  response, err := client.DownloadsApi.EnumerateFile(
    &downloads_api.EnumerateFileParams{
      FileName: &fileName,
      FileVersion: &fileVersion,
      Platform: &platform,
      Os: &os,
      Arch: &arch,
      Category: &category,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.downloadsApi.enumerateFile(
  "string",  // fileName
  "string",  // fileVersion
  "string",  // platform
  "string",  // os
  "string",  // arch
  "string"  // category
);

console.log(response);

Rust

use rusty_falcon::apis::downloads_api_api::enumerate_file;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = enumerate_file(
        &falcon.cfg,  // configuration
        Some("string"),  // file_name
        Some("string"),  // file_version
        Some("string"),  // platform
        Some("string"),  // os
        Some("string"),  // arch
        Some("string"),  // category
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DownloadsApi.new

response = api.enumerate_file(file_name: 'string',
                              file_version: 'string',
                              platform: 'string',
                              os: 'string',
                              arch: 'string',
                              category: 'string')

puts response

Responses

200 OK

{}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

FetchFilesDownloadInfo

Get files info and pre-signed download URLs

Deprecated

This operation is deprecated.

Method GET

Route /csdownloads/combined/files-download/v1

Scope Infrastructure as Code (IaC): READ

PEP 8 fetch_download_info

Parameters

filter query · string

Search files using various filters using query in Falcon Query Language (FQL). Supported filters:

Available values (5)

arch	category	file_name
file_version	os

sort query · string

The fields to sort records on. Supported columns:

Available values (5)

arch	category	file_name
file_version	os

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import Downloads

falcon = Downloads(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.fetch_download_info(filter="string", sort="string")
print(response)

Operation ID

from falconpy import Downloads

falcon = Downloads(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.FetchFilesDownloadInfo(filter="string", sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("FetchFilesDownloadInfo",
                          filter="string",
                          sort="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/downloads_api"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"

  response, err := client.DownloadsApi.FetchFilesDownloadInfo(
    &downloads_api.FetchFilesDownloadInfoParams{
      Filter: &filter,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.downloadsApi.fetchFilesDownloadInfo(
  "string",  // filter
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::downloads_api_api::fetch_files_download_info;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = fetch_files_download_info(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DownloadsApi.new

response = api.fetch_files_download_info(filter: 'string', sort: 'string')

puts response

Responses

200 OK

{}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

FetchFilesDownloadInfoV2

Get cloud security tools info and pre-signed download URLs

Method GET

Route /csdownloads/combined/files-download/v2

Scope Cloud Security Tools Download: READ

PEP 8 fetch_download_info_v2

Parameters

filter query · string

Search files using various filters. Supported filters:

Available values (5)

arch	category	file_name
file_version	os

sort query · string

The fields to sort records on. Supported columns:

Available values (5)

arch	category	file_name
file_version	os

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 100.

offset query · integer

The offset from where to begin. Maximum offset = 1000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import Downloads

falcon = Downloads(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.fetch_download_info_v2(filter="string",
                                         sort="string",
                                         limit=integer,
                                         offset=integer)
print(response)

Operation ID

from falconpy import Downloads

falcon = Downloads(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )

response = falcon.FetchFilesDownloadInfoV2(filter="string",
                                           sort="string",
                                           limit=integer,
                                           offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("FetchFilesDownloadInfoV2",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/downloads_api"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.DownloadsApi.FetchFilesDownloadInfoV2(
    &downloads_api.FetchFilesDownloadInfoV2Params{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.downloadsApi.fetchFilesDownloadInfoV2(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::DownloadsApi.new

response = api.fetch_files_download_info_v2(filter: 'string',
                                            sort: 'string',
                                            limit: integer,
                                            offset: integer)

puts response

Responses

200 OK

[
  {
    "arch": "string",
    "category": "string",
    "download_info": {},
    "file_hash": "string",
    "file_name": "string",
    "file_type": "string",
    "file_version": "string",
    "os": "string",
    "size": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}