Falconx Sandbox

The Falcon Intelligence Sandbox service collection provides operations for analyzing malware samples and URLs. Download artifacts, memory dumps, and analysis reports. Submit files and URLs for sandbox analysis, query reports and submissions, and manage sample files.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

This service collection has code examples posted to the repository.

Operation	Description
DeleteReport `delete_report`	Delete report based on the report ID.
DeleteSampleV2 `delete_sample`	Removes a sample, including file, meta and submissions from the collection
GetArtifacts `get_artifacts`	Download IOC packs, PCAP files, memory dumps, and other analysis artifacts.
GetMemoryDump `get_memory_dump`	Get memory dump content, as binary
GetMemoryDumpExtractedStrings `get_dump_extracted_strings`	Get extracted strings from a memory dump
GetMemoryDumpHexDump `get_hex_dump`	Get hex view of a memory dump
GetReports `get_reports`	Get a full sandbox report.
GetSampleV2 `get_sample`	Retrieves the file associated with the given ID (SHA256)
GetSubmissions `get_submissions`	Check the status of a sandbox analysis.
GetSummaryReports `get_summary_reports`	Get a short summary version of a sandbox report.
QueryReports `query_reports`	Find sandbox reports by providing an FQL filter and paging details.
QuerySampleV1 `query_sample`	Retrieves a list with sha256 of samples that exist and customer has rights to access them, maximum number of accepted items is 200
QuerySubmissions `query_submissions`	Find submission IDs for uploaded files by providing an FQL filter and paging details.
Submit `submit`	Submit an uploaded file or a URL for sandbox analysis.
UploadSampleV2 `upload_sample`	Upload a file for sandbox analysis.

DeleteReport

Delete report based on the report ID.

Method DELETE

Route /falconx/entities/reports/v1

Scope Sandbox (Falcon Intelligence): WRITE

PEP 8 delete_report

Parameters

ids query · string

ID of a report.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_report(ids=id_list)
print(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteReport(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteReport",
                          ids="string")
print(response)

Remove-FalconReport -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.FalconxSandbox.DeleteReport(
    &falconx_sandbox.DeleteReportParams{
      Ids: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.deleteReport("string");  // ids

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::delete_report;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_report(
        &falcon.cfg,  // configuration
        "string",  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.delete_report('string')

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "MetaInfo": {
      "pagination": {},
      "powered_by": "string",
      "query_time": 0.0,
      "trace_id": "string",
      "writes": {}
    },
    "quota": {
      "in_progress": 0,
      "total": 0,
      "used": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "MetaInfo": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "quota": {
    "in_progress": 0,
    "total": 0,
    "used": 0
  }
}

{
  "MetaInfo": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "quota": {
    "in_progress": 0,
    "total": 0,
    "used": 0
  }
}

{
  "MetaInfo": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "quota": {
    "in_progress": 0,
    "total": 0,
    "used": 0
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "MetaInfo": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "quota": {
    "in_progress": 0,
    "total": 0,
    "used": 0
  }
}

DeleteSampleV2

Removes a sample, including file, meta and submissions from the collection

Method DELETE

Route /samples/entities/samples/v2

Scope Sandbox (Falcon Intelligence): WRITE

PEP 8 delete_sample

Parameters

ids query · string

The file SHA256.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_sample(ids=id_list)
print(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteSampleV2(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteSampleV2",
                          ids="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.FalconxSandbox.DeleteSampleV2(
    &falconx_sandbox.DeleteSampleV2Params{
      Ids: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.deleteSampleV2("string");  // ids

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::delete_sample_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_sample_v2(
        &falcon.cfg,  // configuration
        "string",  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.delete_sample_v2('string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

GetArtifacts

Download IOC packs, PCAP files, memory dumps, and other analysis artifacts.

Method GET

Route /falconx/entities/artifacts/v1

Scope Sandbox (Falcon Intelligence): READ

PEP 8 get_artifacts

Parameters

id query · string

ID of an artifact, such as an IOC pack, PCAP file, memory dump, or actor image. Find an artifact ID in a report or summary.

name query · string

The name given to your downloaded file.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

stream body · boolean

Enable streaming download of the returned file.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

with open("output_file", "wb") as save_file:
    response = falcon.get_artifacts(id="string",
                                    name="string",
                                    stream=boolean,
                                    stream=boolean)
    save_file.write(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

with open("output_file", "wb") as save_file:
    response = falcon.GetArtifacts(id="string",
                                   name="string",
                                   stream=boolean,
                                   stream=boolean)
    save_file.write(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

with open("output_file", "wb") as save_file:
    response = falcon.command("GetArtifacts",
                              id="string",
                              name="string")
    save_file.write(response)

Receive-FalconArtifact -Path "string" -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"

  response, err := client.FalconxSandbox.GetArtifacts(
    &falconx_sandbox.GetArtifactsParams{
      ID: "string",
      Name: &name,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.getArtifacts(
  "string",  // id
  "string",  // name
  "string"  // acceptEncoding
);

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::get_artifacts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_artifacts(
        &falcon.cfg,  // configuration
        "string",  // id
        Some("string"),  // name
        Some("string"),  // accept_encoding
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.get_artifacts('string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

GetMemoryDump

Get memory dump content, as binary

Method GET

Route /falconx/entities/memory-dump/v1

Scope Sandbox (Falcon Intelligence): READ

PEP 8 get_memory_dump

Parameters

id query · string

Memory dump id

name query · string

The name given to your downloaded file.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

stream body · boolean

Enable streaming download of the returned file.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

with open("output_file", "wb") as save_file:
    response = falcon.get_memory_dump(id="string",
                                      name="string",
                                      stream=boolean,
                                      stream=boolean)
    save_file.write(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

with open("output_file", "wb") as save_file:
    response = falcon.GetMemoryDump(id="string",
                                    name="string",
                                    stream=boolean,
                                    stream=boolean)
    save_file.write(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

with open("output_file", "wb") as save_file:
    response = falcon.command("GetMemoryDump",
                              id="string",
                              name="string")
    save_file.write(response)

Receive-FalconMemoryDump -BinaryId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"

  response, err := client.FalconxSandbox.GetMemoryDump(
    &falconx_sandbox.GetMemoryDumpParams{
      ID: "string",
      Name: &name,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.getMemoryDump(
  "string",  // id
  "string",  // name
  "string"  // acceptEncoding
);

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::get_memory_dump;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_memory_dump(
        &falcon.cfg,  // configuration
        "string",  // id
        Some("string"),  // name
        Some("string"),  // accept_encoding
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.get_memory_dump('string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

GetMemoryDumpExtractedStrings

Get extracted strings from a memory dump

Method GET

Route /falconx/entities/memory-dump/extracted-strings/v1

Scope Sandbox (Falcon Intelligence): READ

PEP 8 get_dump_extracted_strings

Parameters

id query · string

Extracted strings id

name query · string

The name given to your downloaded file.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

stream body · boolean

Enable streaming download of the returned file.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

with open("output_file", "wb") as save_file:
    response = falcon.get_dump_extracted_strings(id="string",
                                                 name="string",
                                                 stream=boolean,
                                                 stream=boolean)
    save_file.write(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

with open("output_file", "wb") as save_file:
    response = falcon.GetMemoryDumpExtractedStrings(id="string",
                                                    name="string",
                                                    stream=boolean,
                                                    stream=boolean)
    save_file.write(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

with open("output_file", "wb") as save_file:
    response = falcon.command("GetMemoryDumpExtractedStrings",
                              id="string",
                              name="string")
    save_file.write(response)

Receive-FalconMemoryDump -ExtractId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"

  response, err := client.FalconxSandbox.GetMemoryDumpExtractedStrings(
    &falconx_sandbox.GetMemoryDumpExtractedStringsParams{
      ID: "string",
      Name: &name,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.getMemoryDumpExtractedStrings(
  "string",  // id
  "string",  // name
  "string"  // acceptEncoding
);

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::get_memory_dump_extracted_strings;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_memory_dump_extracted_strings(
        &falcon.cfg,  // configuration
        "string",  // id
        Some("string"),  // name
        Some("string"),  // accept_encoding
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.get_memory_dump_extracted_strings('string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

GetMemoryDumpHexDump

Get hex view of a memory dump

Method GET

Route /falconx/entities/memory-dump/hex-dump/v1

Scope Sandbox (Falcon Intelligence): READ

PEP 8 get_hex_dump

Parameters

id query · string

Hex dump id

name query · string

The name given to your downloaded file.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

stream body · boolean

Enable streaming download of the returned file.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

with open("output_file", "wb") as save_file:
    response = falcon.get_hex_dump(id="string",
                                   name="string",
                                   stream=boolean,
                                   stream=boolean)
    save_file.write(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

with open("output_file", "wb") as save_file:
    response = falcon.GetMemoryDumpHexDump(id="string",
                                           name="string",
                                           stream=boolean,
                                           stream=boolean)
    save_file.write(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

with open("output_file", "wb") as save_file:
    response = falcon.command("GetMemoryDumpHexDump",
                              id="string",
                              name="string")
    save_file.write(response)

Receive-FalconMemoryDump -HexId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"

  response, err := client.FalconxSandbox.GetMemoryDumpHexDump(
    &falconx_sandbox.GetMemoryDumpHexDumpParams{
      ID: "string",
      Name: &name,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.getMemoryDumpHexDump(
  "string",  // id
  "string",  // name
  "string"  // acceptEncoding
);

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::get_memory_dump_hex_dump;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_memory_dump_hex_dump(
        &falcon.cfg,  // configuration
        "string",  // id
        Some("string"),  // name
        Some("string"),  // accept_encoding
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.get_memory_dump_hex_dump('string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

GetReports

Get a full sandbox report.

Method GET

Route /falconx/entities/reports/v1

Scope Sandbox (Falcon Intelligence): READ

PEP 8 get_reports

Parameters

ids query · string or list of strings

ID of a report. Find a report ID from the response when submitting a malware sample or search with /falconx/queries/reports/v1.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_reports(ids=id_list)
print(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetReports(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetReports",
                          ids=id_list)
print(response)

Get-FalconReport -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.FalconxSandbox.GetReports(
    &falconx_sandbox.GetReportsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.getReports(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::get_reports;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_reports(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.get_reports(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "ai_summary": {},
    "aid": "string",
    "cid": "string",
    "created_timestamp": "string",
    "has_recording": false,
    "id": "string",
    "index_timestamp": "string",
    "intel": [],
    "ioc_report_broad_csv_artifact_id": "string",
    "ioc_report_broad_json_artifact_id": "string",
    "ioc_report_broad_maec_artifact_id": "string",
    "ioc_report_broad_stix_artifact_id": "string",
    "ioc_report_strict_csv_artifact_id": "string",
    "ioc_report_strict_json_artifact_id": "string",
    "ioc_report_strict_maec_artifact_id": "string",
    "ioc_report_strict_stix_artifact_id": "string",
    "origin": "string",
    "sandbox": [],
    "tags": [],
    "threat_graph": {},
    "user_id": "string",
    "user_name": "string",
    "user_tags": [],
    "user_uuid": "string",
    "verdict": "string",
    "verdict_source": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "MetaInfo": {
      "pagination": {},
      "powered_by": "string",
      "query_time": 0.0,
      "trace_id": "string",
      "writes": {}
    },
    "quota": {
      "in_progress": 0,
      "total": 0,
      "used": 0
    }
  },
  "resources": [
    {
      "ai_summary": {},
      "aid": "string",
      "cid": "string",
      "created_timestamp": "string",
      "has_recording": false,
      "id": "string",
      "index_timestamp": "string",
      "intel": [],
      "ioc_report_broad_csv_artifact_id": "string",
      "ioc_report_broad_json_artifact_id": "string",
      "ioc_report_broad_maec_artifact_id": "string",
      "ioc_report_broad_stix_artifact_id": "string",
      "ioc_report_strict_csv_artifact_id": "string",
      "ioc_report_strict_json_artifact_id": "string",
      "ioc_report_strict_maec_artifact_id": "string",
      "ioc_report_strict_stix_artifact_id": "string",
      "origin": "string",
      "sandbox": [],
      "tags": [],
      "threat_graph": {},
      "user_id": "string",
      "user_name": "string",
      "user_tags": [],
      "user_uuid": "string",
      "verdict": "string",
      "verdict_source": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "MetaInfo": {
      "pagination": {},
      "powered_by": "string",
      "query_time": 0.0,
      "trace_id": "string",
      "writes": {}
    },
    "quota": {
      "in_progress": 0,
      "total": 0,
      "used": 0
    }
  },
  "resources": [
    {
      "ai_summary": {},
      "aid": "string",
      "cid": "string",
      "created_timestamp": "string",
      "has_recording": false,
      "id": "string",
      "index_timestamp": "string",
      "intel": [],
      "ioc_report_broad_csv_artifact_id": "string",
      "ioc_report_broad_json_artifact_id": "string",
      "ioc_report_broad_maec_artifact_id": "string",
      "ioc_report_broad_stix_artifact_id": "string",
      "ioc_report_strict_csv_artifact_id": "string",
      "ioc_report_strict_json_artifact_id": "string",
      "ioc_report_strict_maec_artifact_id": "string",
      "ioc_report_strict_stix_artifact_id": "string",
      "origin": "string",
      "sandbox": [],
      "tags": [],
      "threat_graph": {},
      "user_id": "string",
      "user_name": "string",
      "user_tags": [],
      "user_uuid": "string",
      "verdict": "string",
      "verdict_source": "string"
    }
  ]
}

GetSampleV2

Retrieves the file associated with the given ID (SHA256)

Method GET

Route /samples/entities/samples/v2

Scope Sandbox (Falcon Intelligence): READ

PEP 8 get_sample

Parameters

ids query · string

The file SHA256.

password_protected query · boolean

Flag whether the sample should be zipped and password protected with pass=‘infected’

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

stream body · boolean

Enable streaming download of the returned file.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.get_sample(ids=id_list,
                                 password_protected=boolean,
                                 stream=boolean,
                                 stream=boolean)
    save_file.write(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.GetSampleV2(ids=id_list,
                                  password_protected=boolean,
                                  stream=boolean,
                                  stream=boolean)
    save_file.write(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.command("GetSampleV2",
                              ids="string",
                              password_protected=boolean)
    save_file.write(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  passwordProtected := boolean

  response, err := client.FalconxSandbox.GetSampleV2(
    &falconx_sandbox.GetSampleV2Params{
      Ids: "string",
      PasswordProtected: &passwordProtected,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.getSampleV2(
  "string",  // ids
  boolean  // passwordProtected
);

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::get_sample_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_sample_v2(
        &falcon.cfg,  // configuration
        "string",  // ids
        Some(boolean),  // password_protected
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.get_sample_v2('string')

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

GetSubmissions

Check the status of a sandbox analysis.

Method GET

Route /falconx/entities/submissions/v1

Scope Sandbox (Falcon Intelligence): READ

PEP 8 get_submissions

Parameters

ids query · string or list of strings

ID of a submitted malware sample. Find a submission ID from the response when submitting a malware sample or search with /falconx/queries/submissions/v1.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_submissions(ids=id_list)
print(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetSubmissions(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetSubmissions",
                          ids=id_list)
print(response)

Get-FalconSubmission -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.FalconxSandbox.GetSubmissions(
    &falconx_sandbox.GetSubmissionsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.getSubmissions(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::get_submissions;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_submissions(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.get_submissions(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "auto_detect_environment": false,
    "cid": "string",
    "created_timestamp": "string",
    "error_message": "string",
    "error_origin": "string",
    "error_type": "string",
    "id": "string",
    "index_timestamp": "string",
    "interactive_phase": "string",
    "origin": "string",
    "sandbox": [],
    "send_email_notification": false,
    "state": "string",
    "user_id": "string",
    "user_name": "string",
    "user_tags": [],
    "user_uuid": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "MetaInfo": {
      "pagination": {},
      "powered_by": "string",
      "query_time": 0.0,
      "trace_id": "string",
      "writes": {}
    },
    "quota": {
      "in_progress": 0,
      "total": 0,
      "used": 0
    }
  },
  "resources": [
    {
      "auto_detect_environment": false,
      "cid": "string",
      "created_timestamp": "string",
      "error_message": "string",
      "error_origin": "string",
      "error_type": "string",
      "id": "string",
      "index_timestamp": "string",
      "interactive_phase": "string",
      "origin": "string",
      "sandbox": [],
      "send_email_notification": false,
      "state": "string",
      "user_id": "string",
      "user_name": "string",
      "user_tags": [],
      "user_uuid": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "MetaInfo": {
      "pagination": {},
      "powered_by": "string",
      "query_time": 0.0,
      "trace_id": "string",
      "writes": {}
    },
    "quota": {
      "in_progress": 0,
      "total": 0,
      "used": 0
    }
  },
  "resources": [
    {
      "auto_detect_environment": false,
      "cid": "string",
      "created_timestamp": "string",
      "error_message": "string",
      "error_origin": "string",
      "error_type": "string",
      "id": "string",
      "index_timestamp": "string",
      "interactive_phase": "string",
      "origin": "string",
      "sandbox": [],
      "send_email_notification": false,
      "state": "string",
      "user_id": "string",
      "user_name": "string",
      "user_tags": [],
      "user_uuid": "string"
    }
  ]
}

GetSummaryReports

Get a short summary version of a sandbox report.

Method GET

Route /falconx/entities/report-summaries/v1

Scope Sandbox (Falcon Intelligence): READ

PEP 8 get_summary_reports

Parameters

ids query · string or list of strings

ID of a summary. Find a summary ID from the response when submitting a malware sample or search with /falconx/queries/reports/v1.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_summary_reports(ids=id_list)
print(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetSummaryReports(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetSummaryReports",
                          ids=id_list)
print(response)

Get-FalconReport -Id @("ID1", "ID2") -Summary $boolean

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.FalconxSandbox.GetSummaryReports(
    &falconx_sandbox.GetSummaryReportsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.getSummaryReports(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::get_summary_reports;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_summary_reports(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.get_summary_reports(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "cid": "string",
    "created_timestamp": "string",
    "has_recording": false,
    "id": "string",
    "intel": [],
    "ioc_report_broad_csv_artifact_id": "string",
    "ioc_report_broad_json_artifact_id": "string",
    "ioc_report_broad_maec_artifact_id": "string",
    "ioc_report_broad_stix_artifact_id": "string",
    "ioc_report_strict_csv_artifact_id": "string",
    "ioc_report_strict_json_artifact_id": "string",
    "ioc_report_strict_maec_artifact_id": "string",
    "ioc_report_strict_stix_artifact_id": "string",
    "origin": "string",
    "sandbox": [],
    "tags": [],
    "user_id": "string",
    "user_name": "string",
    "user_tags": [],
    "verdict": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "MetaInfo": {
      "pagination": {},
      "powered_by": "string",
      "query_time": 0.0,
      "trace_id": "string",
      "writes": {}
    },
    "quota": {
      "in_progress": 0,
      "total": 0,
      "used": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_timestamp": "string",
      "has_recording": false,
      "id": "string",
      "intel": [],
      "ioc_report_broad_csv_artifact_id": "string",
      "ioc_report_broad_json_artifact_id": "string",
      "ioc_report_broad_maec_artifact_id": "string",
      "ioc_report_broad_stix_artifact_id": "string",
      "ioc_report_strict_csv_artifact_id": "string",
      "ioc_report_strict_json_artifact_id": "string",
      "ioc_report_strict_maec_artifact_id": "string",
      "ioc_report_strict_stix_artifact_id": "string",
      "origin": "string",
      "sandbox": [],
      "tags": [],
      "user_id": "string",
      "user_name": "string",
      "user_tags": [],
      "verdict": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "MetaInfo": {
      "pagination": {},
      "powered_by": "string",
      "query_time": 0.0,
      "trace_id": "string",
      "writes": {}
    },
    "quota": {
      "in_progress": 0,
      "total": 0,
      "used": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "created_timestamp": "string",
      "has_recording": false,
      "id": "string",
      "intel": [],
      "ioc_report_broad_csv_artifact_id": "string",
      "ioc_report_broad_json_artifact_id": "string",
      "ioc_report_broad_maec_artifact_id": "string",
      "ioc_report_broad_stix_artifact_id": "string",
      "ioc_report_strict_csv_artifact_id": "string",
      "ioc_report_strict_json_artifact_id": "string",
      "ioc_report_strict_maec_artifact_id": "string",
      "ioc_report_strict_stix_artifact_id": "string",
      "origin": "string",
      "sandbox": [],
      "tags": [],
      "user_id": "string",
      "user_name": "string",
      "user_tags": [],
      "verdict": "string"
    }
  ]
}

QueryReports

Find sandbox reports by providing an FQL filter and paging details.

Method GET

Route /falconx/queries/reports/v1

Scope Sandbox (Falcon Intelligence): READ

PEP 8 query_reports

Parameters

filter query · string

Optional filter and sort criteria in the form of an FQL query.

offset query · string

The offset to start retrieving reports from.

limit query · integer

Maximum number of report IDs to return. Max: 5000.

sort query · string

The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.query_reports(filter="string",
                                limit=integer,
                                offset="string",
                                sort="string")
print(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.QueryReports(filter="string",
                               limit=integer,
                               offset="string",
                               sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryReports",
                          filter="string",
                          offset="string",
                          limit=integer,
                          sort="string")
print(response)

Get-FalconReport -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := "string"
  limit := int64(0)
  sort := "string"

  response, err := client.FalconxSandbox.QueryReports(
    &falconx_sandbox.QueryReportsParams{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.queryReports(
  "string",  // filter
  "string",  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::query_reports;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_reports(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.query_reports(filter: 'string',
                             offset: 'string',
                             limit: integer,
                             sort: 'string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

QuerySampleV1

Retrieves a list with sha256 of samples that exist and customer has rights to access them, maximum number of accepted items is 200

Method POST

Route /samples/queries/samples/GET/v1

Scope Sandbox (Falcon Intelligence): READ

PEP 8 query_sample

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

sha256s body · array

List of SHA256s to confirm existence for. You will be returned a list of existing hashes.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.query_sample(sha256s=id_list)
print(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.QuerySampleV1(sha256s=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "sha256s": ["string"]
}

response = falcon.command("QuerySampleV1", body=body_payload)
print(response)

Get-FalconSample -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.FalconxSandbox.QuerySampleV1(
    &falconx_sandbox.QuerySampleV1Params{
      Body: &models.ClientQuerySamplesRequest{
        Sha256s: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.querySampleV1(
  {
    sha256s: []
}  // body
);

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::query_sample_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ClientQuerySamplesRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ClientQuerySamplesRequest {
        ..Default::default()
    };

    let response = query_sample_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

body = Falcon::ClientQuerySamplesRequest.new(
  sha256s: []
)

response = api.query_sample_v1(body)

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

QuerySubmissions

Find submission IDs for uploaded files by providing an FQL filter and paging details.

Method GET

Route /falconx/queries/submissions/v1

Scope Sandbox (Falcon Intelligence): READ

PEP 8 query_submissions

Parameters

filter query · string

Optional filter and sort criteria in the form of an FQL query.

offset query · string

The offset to start retrieving submissions from.

limit query · integer

Maximum number of submission IDs to return. Max: 5000.

sort query · string

The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.query_submissions(filter="string",
                                    limit=integer,
                                    offset="string",
                                    sort="string")
print(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.QuerySubmissions(filter="string",
                                   limit=integer,
                                   offset="string",
                                   sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QuerySubmissions",
                          filter="string",
                          offset="string",
                          limit=integer,
                          sort="string")
print(response)

Get-FalconSubmissionQuota

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := "string"
  limit := int64(0)
  sort := "string"

  response, err := client.FalconxSandbox.QuerySubmissions(
    &falconx_sandbox.QuerySubmissionsParams{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.querySubmissions(
  "string",  // filter
  "string",  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::query_submissions;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_submissions(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.query_submissions(filter: 'string',
                                 offset: 'string',
                                 limit: integer,
                                 sort: 'string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

Submit

Submit an uploaded file or a URL for sandbox analysis.

Method POST

Route /falconx/entities/submissions/v1

Scope Sandbox (Falcon Intelligence): WRITE

PEP 8 submit

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

auto_detect_environment body · boolean

sandbox body · array

send_email_notification body · boolean

Boolean indicating if an email notification should be sent.

user_tags body · array

aid query · string

Agent ID

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

action_script body · string

Runtime script for sandbox analysis. Accepted values:

Available values (5)

`default`	`default_randomtheme`	`default_maxantievasion`
`default_openie`	`default_randomfiles`

command_line body · string

Command line script passed to the submitted file at runtime. Max length: 2048 characters

document_password body · string

Auto-filled for Adobe or Office files that prompt for a password. Max length: 32 characters

enable_tor body · string

Deprecated, please use network_settings instead. If true, sandbox analysis routes network traffic via TOR.

environment_id body · string

Specifies the sandbox environment used for analysis. Accepted values: 400 - macOS Catalina 10.15 300 - Linux Ubuntu 16.04, 64-bit 200 - Android (static analysis) 160 - Windows 10, 64-bit 140 - Windows 11, 64-bit 110 - Windows 7, 64-bit 100 - Windows 7, 32-bit

network_settings body · string

Specifies the sandbox network_settings used for analysis. Accepted values: default - Fully operating network tor - Route network traffic via TOR simulated - Simulate network traffic offline - No network traffic

sha256 body · string

ID of the sample, which is a SHA256 hash value. Find a sample ID from the response when uploading a malware sample or search with query_sample. The url keyword must be unset if this keyword is used.

submit_name body · string

Name of the malware sample that’s used for file type detection and analysis.

system_date body · string

Set a custom date in the format yyyy-MM-dd for the sandbox environment.

system_time body · string

Set a custom time in the format HH:mm for the sandbox environment.

url body · string

A web page or file URL. It can be HTTP(S) or FTP. The sha256 keyword must be unset if url is used.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.submit(action_script="string",
                         aid="string",
                         command_line="string",
                         document_password="string",
                         enable_tor="string",
                         environment_id="string",
                         network_settings="string",
                         send_email_notification=boolean,
                         sha256="string",
                         submit_name="string",
                         system_date="string",
                         system_time="string",
                         url="string",
                         user_tags=id_list)
print(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.Submit(action_script="string",
                         aid="string",
                         command_line="string",
                         document_password="string",
                         enable_tor="string",
                         environment_id="string",
                         network_settings="string",
                         send_email_notification=boolean,
                         sha256="string",
                         submit_name="string",
                         system_date="string",
                         system_time="string",
                         url="string",
                         user_tags=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "auto_detect_environment": boolean,
    "sandbox": [
        {
            "action_script": "string",
            "browser": "string",
            "command_line": "string",
            "document_password": "string",
            "enable_tor": boolean,
            "environment_id": integer,
            "interactivity": boolean,
            "network_settings": "string",
            "sha256": "string",
            "submit_name": "string",
            "system_date": "string",
            "system_time": "string",
            "url": "string"
        }
    ],
    "send_email_notification": boolean,
    "user_tags": ["string"]
}

response = falcon.command("Submit",
                          aid="string",
                          body=body_payload)
print(response)

New-FalconSubmission

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  auto_detect_environment := boolean
  action_script := "string"
  browser := "string"
  command_line := "string"
  document_password := "string"
  enable_tor := boolean
  environment_id := integer
  interactivity := boolean
  network_settings := "string"
  sha256 := "string"
  submit_name := "string"
  system_date := "string"
  system_time := "string"
  url := "string"
  send_email_notification := boolean
  aid := "string"

  response, err := client.FalconxSandbox.Submit(
    &falconx_sandbox.SubmitParams{
      Body: &models.FalconxSubmissionParametersV1{
        AutoDetectEnvironment: &auto_detect_environment,
        Sandbox: []interface{}{
          {
          ActionScript: &action_script,
          Browser: &browser,
          CommandLine: &command_line,
          DocumentPassword: &document_password,
          EnableTor: &enable_tor,
          EnvironmentID: &environment_id,
          Interactivity: &interactivity,
          NetworkSettings: &network_settings,
          Sha256: &sha256,
          SubmitName: &submit_name,
          SystemDate: &system_date,
          SystemTime: &system_time,
          URL: &url,
          },
        },
        SendEmailNotification: &send_email_notification,
        UserTags: []string{"string"},
      },
      Aid: &aid,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.submit(
  {  // body
      autoDetectEnvironment: boolean,
      sandbox: [{
          actionScript: "string",
          browser: "string",
          commandLine: "string",
          documentPassword: "string",
          enableTor: boolean,
          environmentId: integer,
          interactivity: boolean,
          networkSettings: "string",
          sha256: "string",
          submitName: "string",
          systemDate: "string",
          systemTime: "string",
          url: "string"
        }],
      sendEmailNotification: boolean,
      userTags: []
  },
  "string"  // aid
);

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::submit;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::FalconxSubmissionParametersV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = FalconxSubmissionParametersV1 {
        ..Default::default()
    };

    let response = submit(
        &falcon.cfg,  // configuration
        body,  // body
        Some("string"),  // aid
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

body = {
  auto_detect_environment: boolean,
  sandbox: [{
      action_script: 'string',
      browser: 'string',
      command_line: 'string',
      document_password: 'string',
      enable_tor: boolean,
      environment_id: integer,
      interactivity: boolean,
      network_settings: 'string',
      sha256: 'string',
      submit_name: 'string',
      system_date: 'string',
      system_time: 'string',
      url: 'string'
    }],
  send_email_notification: boolean,
  user_tags: []
}

response = api.submit(body)

puts response

Responses

[
  {
    "auto_detect_environment": false,
    "cid": "string",
    "created_timestamp": "string",
    "error_message": "string",
    "error_origin": "string",
    "error_type": "string",
    "id": "string",
    "index_timestamp": "string",
    "interactive_phase": "string",
    "origin": "string",
    "sandbox": [],
    "send_email_notification": false,
    "state": "string",
    "user_id": "string",
    "user_name": "string",
    "user_tags": [],
    "user_uuid": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "MetaInfo": {
      "pagination": {},
      "powered_by": "string",
      "query_time": 0.0,
      "trace_id": "string",
      "writes": {}
    },
    "quota": {
      "in_progress": 0,
      "total": 0,
      "used": 0
    }
  },
  "resources": [
    {
      "auto_detect_environment": false,
      "cid": "string",
      "created_timestamp": "string",
      "error_message": "string",
      "error_origin": "string",
      "error_type": "string",
      "id": "string",
      "index_timestamp": "string",
      "interactive_phase": "string",
      "origin": "string",
      "sandbox": [],
      "send_email_notification": false,
      "state": "string",
      "user_id": "string",
      "user_name": "string",
      "user_tags": [],
      "user_uuid": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "MetaInfo": {
      "pagination": {},
      "powered_by": "string",
      "query_time": 0.0,
      "trace_id": "string",
      "writes": {}
    },
    "quota": {
      "in_progress": 0,
      "total": 0,
      "used": 0
    }
  },
  "resources": [
    {
      "auto_detect_environment": false,
      "cid": "string",
      "created_timestamp": "string",
      "error_message": "string",
      "error_origin": "string",
      "error_type": "string",
      "id": "string",
      "index_timestamp": "string",
      "interactive_phase": "string",
      "origin": "string",
      "sandbox": [],
      "send_email_notification": false,
      "state": "string",
      "user_id": "string",
      "user_name": "string",
      "user_tags": [],
      "user_uuid": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "MetaInfo": {
      "pagination": {},
      "powered_by": "string",
      "query_time": 0.0,
      "trace_id": "string",
      "writes": {}
    },
    "quota": {
      "in_progress": 0,
      "total": 0,
      "used": 0
    }
  },
  "resources": [
    {
      "auto_detect_environment": false,
      "cid": "string",
      "created_timestamp": "string",
      "error_message": "string",
      "error_origin": "string",
      "error_type": "string",
      "id": "string",
      "index_timestamp": "string",
      "interactive_phase": "string",
      "origin": "string",
      "sandbox": [],
      "send_email_notification": false,
      "state": "string",
      "user_id": "string",
      "user_name": "string",
      "user_tags": [],
      "user_uuid": "string"
    }
  ]
}

UploadSampleV2

Upload a file for sandbox analysis.

Method POST

Route /samples/entities/samples/v2

Scope Sandbox (Falcon Intelligence): WRITE

PEP 8 upload_sample

Parameters

sample body · file

Content of the uploaded sample in binary format. For example, use —data-binary @$FILE_PATH when using cURL. Max file size: 256 MB. Accepted file formats: - Portable executables: .exe, .scr, .pif, .dll, .com, .cpl, etc. - Office documents: .doc, .docx, .ppt, .pps, .pptx, .ppsx, .xls, .xlsx, .rtf, .pub - PDF - APK - Executable JAR - Windows script component: .sct - Windows shortcut: .lnk - Windows help: .chm - HTML application: .hta - Windows script file: .wsf - Javascript: .js - Visual Basic: .vbs, .vbe - Shockwave Flash: .swf - Perl: .pl - Powershell: .ps1, .psd1, .psm1 - Scalable vector graphics: .svg - Python: .py - Linux ELF executables - Email files: MIME RFC 822 .eml, Outlook .msg.

file_name body · string

Name of the file.

comment body · string

A descriptive comment to identify the file for other users.

is_confidential body · boolean

Defines visibility of this file in Falcon MalQuery, either via the API or the Falcon console. - true: File is only shown to users within your customer account - false: File can be seen by other CrowdStrike customers Default: true.

Available values (2)

file_data body · string

Content of the uploaded sample in binary format. Max file size is 256 MB. ‘sample’ and ‘upfile’ are also accepted as this parameter. Accepted File Formats: Portable executables: .exe, .scr, .pif, .dll, .com, .cpl, etc. Office documents: .doc, .docx, .ppt, .pps, .pptx, .ppsx, .xls, .xlsx, .rtf, .pub PDF APK Executable JAR Windows script component: .sct Windows shortcut: .lnk Windows help: .chm HTML application: .hta Windows script file: .wsf Javascript: .js Visual Basic: .vbs, .vbe Shockwave Flash: .swf Perl: .pl Powershell: .ps1, .psd1, .psm1 Scalable vector graphics: .svg Python: .py Linux ELF executables Email files: MIME RFC 822 .eml, Outlook .msg

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.upload_sample(comment="string",
                                file_data="string",
                                file_name="string",
                                is_confidential="string")
print(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.UploadSampleV2(comment="string",
                                 file_data="string",
                                 file_name="string",
                                 is_confidential="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("UploadSampleV2",
                          file_data=open("filename", "rb").read(),
                          file_name="string",
                          comment="string",
                          is_confidential=boolean)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  isConfidential := boolean

  response, err := client.FalconxSandbox.UploadSampleV2(
    &falconx_sandbox.UploadSampleV2Params{
      FileName: "string",
      Comment: &comment,
      IsConfidential: &isConfidential,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.uploadSampleV2(
  "string",  // sample
  "string",  // fileName
  "string",  // comment
  boolean  // isConfidential
);

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::upload_sample_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = upload_sample_v2(
        &falcon.cfg,  // configuration
        std::path::PathBuf::default(),  // sample
        "string",  // file_name
        Some("string"),  // comment
        Some(boolean),  // is_confidential
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.upload_sample_v2('string', 'string')

puts response

Responses

[
  {
    "file_name": "string",
    "sha256": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "file_name": "string",
      "sha256": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "file_name": "string",
      "sha256": "string"
    }
  ]
}

Falconx Sandbox

Table of Contents

DeleteReport

Parameters

DeleteSampleV2

Parameters

GetArtifacts

Parameters

GetMemoryDump

Parameters

GetMemoryDumpExtractedStrings

Parameters

GetMemoryDumpHexDump

Parameters

GetReports

Parameters

GetSampleV2

Parameters

GetSubmissions

Parameters

GetSummaryReports

Parameters

QueryReports

Parameters

QuerySampleV1

Parameters

QuerySubmissions

Parameters

Submit

Parameters

UploadSampleV2

Parameters