Falconx Sandbox

The Falcon Intelligence Sandbox service collection provides operations for analyzing malware samples and URLs. Download artifacts, memory dumps, and analysis reports. Submit files and URLs for sandbox analysis, query reports and submissions, and manage sample files.

Language	Last Update
Python	v1.5.0
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

This service collection has code examples posted to the repository.

Operation	Description
GetArtifacts `get_artifacts`	Download IOC packs, PCAP files, and other analysis artifacts.
GetMemoryDumpExtractedStrings `get_dump_extracted_strings`	Get extracted strings from a memory dump.
GetMemoryDumpHexDump `get_hex_dump`	Get the hex view of a memory dump.
GetMemoryDump `get_memory_dump`	Get memory dump content, as a binary.
GetSummaryReports `get_summary_reports`	Get a short summary version of a sandbox report.
GetReports `get_reports`	Get a full sandbox report.
DeleteReport `delete_report`	Delete report based on the report ID. Operation can be checked for success by polling for the report ID on the report-summaries endpoint.
GetSubmissions `get_submissions`	Check the status of a sandbox analysis. Time required for analysis varies but is usually less than 15 minutes.
Submit `submit`	Submit an uploaded file or a URL for sandbox analysis. Time required for analysis varies but is usually less than 15 minutes.
QueryReports `query_reports`	Find sandbox reports by providing a FQL filter and paging details. Returns a set of report IDs that match your criteria.
QuerySubmissions `query_submissions`	Find submission IDs for uploaded files by providing a FQL filter and paging details. Returns a set of submission IDs that match your criteria.
GetSampleV2 `get_sample`	Retrieves the file associated with the given ID (SHA256)
UploadSampleV2 `upload_sample`	Upload a file for sandbox analysis. After uploading, use `/falconx/entities/submissions/v1` to start analyzing the file.
DeleteSampleV2 `delete_sample`	Removes a sample, including file, meta and submissions from the collection
QuerySampleV1 `query_sample`	Retrieves a list with sha256 of samples that exist and customer has rights to access them, maximum number of accepted items is 200

GetArtifacts

Download IOC packs, PCAP files, and other analysis artifacts.

GET /falconx/entities/artifacts/v1

Scope Sandbox (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 get_artifacts

Parameters

Name	Type	Data type	Description
headers	header	string	Format used to compress your downloaded file. Currently, you must provide the value `gzip`, the only valid format, as the Accept-Encoding header when using the Uber class. This keyword is not necessary when using the Service Class.
id	query	string	ID of an artifact, such as an IOC pack, PCAP file, or actor image. Find an artifact ID in a report or summary.
name	query	string	The name given to your downloaded file.
parameters	query	dictionary	Full query string parameters payload in JSON format.
stream	query	boolean	Enable streaming download of the returned file.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

with open("output_file", "wb") as save_file:
    response = falcon.get_artifacts(id="string",
                                    name="string",
                                    stream=boolean,
                                    stream=boolean)
    save_file.write(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

with open("output_file", "wb") as save_file:
    response = falcon.GetArtifacts(id="string",
                                   name="string",
                                   stream=boolean,
                                   stream=boolean)
    save_file.write(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

with open("output_file", "wb") as save_file:
    response = falcon.command("GetArtifacts",
                              id="string",
                              name="string")
    save_file.write(response)

Receive-FalconArtifact -Path "string" -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"

  response, err := client.FalconxSandbox.GetArtifacts(
    &falconx_sandbox.GetArtifactsParams{
      ID: "string",
      Name: &name,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.getArtifacts(
  "string",  // id
  "string",  // name
  "string"  // acceptEncoding
);

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::get_artifacts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_artifacts(
        &falcon.cfg,  // configuration
        "string",  // id
        Some("string"),  // name
        Some("string"),  // accept_encoding
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.get_artifacts('string')

puts response

GetMemoryDumpExtractedStrings

Get extracted strings from a memory dump.

GET /falconx/entities/memory-dump/extracted-strings/v1

Scope Sandbox (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 get_dump_extracted_strings

Parameters

Name	Type	Data type	Description
headers	header	string	Format used to compress your downloaded file. Currently, you must provide the value `gzip`, the only valid format, as the Accept-Encoding header when using the Uber class. This keyword is not necessary when using the Service Class.
id	query	string	Extracted strings ID.
name	query	string	The name given to your downloaded file.
parameters	query	dictionary	Full query string parameters payload in JSON format.
stream	query	boolean	Enable streaming download of the returned file.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

with open("output_file", "wb") as save_file:
    response = falcon.get_dump_extracted_strings(id="string",
                                                 name="string",
                                                 stream=boolean,
                                                 stream=boolean)
    save_file.write(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

with open("output_file", "wb") as save_file:
    response = falcon.GetMemoryDumpExtractedStrings(id="string",
                                                    name="string",
                                                    stream=boolean,
                                                    stream=boolean)
    save_file.write(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

with open("output_file", "wb") as save_file:
    response = falcon.command("GetMemoryDumpExtractedStrings",
                              id="string",
                              name="string")
    save_file.write(response)

Receive-FalconMemoryDump -ExtractId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"

  response, err := client.FalconxSandbox.GetMemoryDumpExtractedStrings(
    &falconx_sandbox.GetMemoryDumpExtractedStringsParams{
      ID: "string",
      Name: &name,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.getMemoryDumpExtractedStrings(
  "string",  // id
  "string",  // name
  "string"  // acceptEncoding
);

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::get_memory_dump_extracted_strings;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_memory_dump_extracted_strings(
        &falcon.cfg,  // configuration
        "string",  // id
        Some("string"),  // name
        Some("string"),  // accept_encoding
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.get_memory_dump_extracted_strings('string')

puts response

GetMemoryDumpHexDump

Get the hex view of a memory dump.

GET /falconx/entities/memory-dump/hex-dump/v1

Scope Sandbox (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 get_hex_dump

Parameters

Name	Type	Data type	Description
headers	header	string	Format used to compress your downloaded file. Currently, you must provide the value `gzip`, the only valid format, as the Accept-Encoding header when using the Uber class. This keyword is not necessary when using the Service Class.
id	query	string	Hex dump ID.
name	query	string	The name given to your downloaded file.
parameters	query	dictionary	Full query string parameters payload in JSON format.
stream	query	boolean	Enable streaming download of the returned file.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

with open("output_file", "wb") as save_file:
    response = falcon.get_hex_dump(id="string",
                                   name="string",
                                   stream=boolean,
                                   stream=boolean)
    save_file.write(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

with open("output_file", "wb") as save_file:
    response = falcon.GetMemoryDumpHexDump(id="string",
                                           name="string",
                                           stream=boolean,
                                           stream=boolean)
    save_file.write(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

with open("output_file", "wb") as save_file:
    response = falcon.command("GetMemoryDumpHexDump",
                              id="string",
                              name="string")
    save_file.write(response)

Receive-FalconMemoryDump -HexId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"

  response, err := client.FalconxSandbox.GetMemoryDumpHexDump(
    &falconx_sandbox.GetMemoryDumpHexDumpParams{
      ID: "string",
      Name: &name,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.getMemoryDumpHexDump(
  "string",  // id
  "string",  // name
  "string"  // acceptEncoding
);

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::get_memory_dump_hex_dump;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_memory_dump_hex_dump(
        &falcon.cfg,  // configuration
        "string",  // id
        Some("string"),  // name
        Some("string"),  // accept_encoding
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.get_memory_dump_hex_dump('string')

puts response

GetMemoryDump

Get memory dump content, as a binary.

GET /falconx/entities/memory-dump/v1

Scope Sandbox (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 get_memory_dump

Parameters

Name	Type	Data type	Description
headers	header	string	Format used to compress your downloaded file. Currently, you must provide the value `gzip`, the only valid format, as the Accept-Encoding header when using the Uber class. This keyword is not necessary when using the Service Class.
id	query	string	Memory dump ID.
name	query	string	The name given to your downloaded file.
parameters	query	dictionary	Full query string parameters payload in JSON format.
stream	query	boolean	Enable streaming download of the returned file.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

with open("output_file", "wb") as save_file:
    response = falcon.get_memory_dump(id="string",
                                      name="string",
                                      stream=boolean,
                                      stream=boolean)
    save_file.write(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

with open("output_file", "wb") as save_file:
    response = falcon.GetMemoryDump(id="string",
                                    name="string",
                                    stream=boolean,
                                    stream=boolean)
    save_file.write(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

with open("output_file", "wb") as save_file:
    response = falcon.command("GetMemoryDump",
                              id="string",
                              name="string")
    save_file.write(response)

Receive-FalconMemoryDump -BinaryId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"

  response, err := client.FalconxSandbox.GetMemoryDump(
    &falconx_sandbox.GetMemoryDumpParams{
      ID: "string",
      Name: &name,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.getMemoryDump(
  "string",  // id
  "string",  // name
  "string"  // acceptEncoding
);

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::get_memory_dump;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_memory_dump(
        &falcon.cfg,  // configuration
        "string",  // id
        Some("string"),  // name
        Some("string"),  // accept_encoding
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.get_memory_dump('string')

puts response

GetSummaryReports

Get a short summary version of a sandbox report.

GET /falconx/entities/report-summaries/v1

Scope Sandbox (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 get_summary_reports

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	ID of a summary report. Find a summary report ID from the response when submitting a malware sample or search with `query_reports`.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_summary_reports(ids=id_list)
print(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetSummaryReports(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetSummaryReports",
                          ids=id_list)
print(response)

Get-FalconReport -Id @("ID1", "ID2") -Summary $boolean

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.FalconxSandbox.GetSummaryReports(
    &falconx_sandbox.GetSummaryReportsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.getSummaryReports(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::get_summary_reports;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_summary_reports(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.get_summary_reports(['ID1', 'ID2', 'ID3'])

puts response

GetReports

Get a full sandbox report.

GET /falconx/entities/reports/v1

Scope Sandbox (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 get_reports

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	ID of a report. Find a report ID from the response when submitting a malware sample or search with `query_reports`.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_reports(ids=id_list)
print(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetReports(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetReports",
                          ids=id_list)
print(response)

Get-FalconReport -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.FalconxSandbox.GetReports(
    &falconx_sandbox.GetReportsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.getReports(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::get_reports;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_reports(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.get_reports(['ID1', 'ID2', 'ID3'])

puts response

DeleteReport

Delete report based on the report ID. Operation can be checked for success by polling for the report ID on the report-summaries endpoint.

DELETE /falconx/entities/reports/v1

Scope Sandbox (Falcon Intelligence): WRITE Consumes · Produces application/json

PEP 8 delete_report

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	ID of a report. Find a report ID from the response when submitting a malware sample or search with `query_reports`.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_report(ids=id_list)
print(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteReport(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteReport",
                          ids="string")
print(response)

Remove-FalconReport -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.FalconxSandbox.DeleteReport(
    &falconx_sandbox.DeleteReportParams{
      Ids: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.deleteReport("string");  // ids

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::delete_report;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_report(
        &falcon.cfg,  // configuration
        "string",  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.delete_report('string')

puts response

GetSubmissions

Check the status of a sandbox analysis. Time required for analysis varies but is usually less than 15 minutes.

GET /falconx/entities/submissions/v1

Scope Sandbox (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 get_submissions

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	ID of a submitted malware sample. Find a submission ID from the response when submitting a malware sample or search with `query_submissions`.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_submissions(ids=id_list)
print(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetSubmissions(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetSubmissions",
                          ids=id_list)
print(response)

Get-FalconSubmission -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.FalconxSandbox.GetSubmissions(
    &falconx_sandbox.GetSubmissionsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.getSubmissions(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::get_submissions;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_submissions(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.get_submissions(['ID1', 'ID2', 'ID3'])

puts response

Submit

Submit an uploaded file or a URL for sandbox analysis. Time required for analysis varies but is usually less than 15 minutes.

POST /falconx/entities/submissions/v1

Scope Sandbox (Falcon Intelligence): WRITE Consumes · Produces application/json

PEP 8 submit

Parameters

Name	Type	Data type	Description
action_script	body	string	Runtime script for sandbox analysis. Accepted values: default default_randomtheme default_maxantievasion default_openie default_randomfiles
aid	query	string	Device AID.
body	body	dictionary	Full body payload in JSON format.
command_line	body	string	Command line script passed to the submitted file at runtime. Max length: 2048 characters
document_password	body	string	Auto-filled for Adobe or Office files that prompt for a password. Max length: 32 characters
enable_tor	body	boolean	Deprecated, please use network_settings instead. If true, sandbox analysis routes network traffic via TOR.
environment_id	body	integer	Specifies the sandbox environment used for analysis. Accepted values: `410` - macOS Sonoma ARM 64 bit, `400` - macOS Catalina 10.15, `300` - Linux Ubuntu 16.04, 64-bit, `200` - Android (static analysis), `160` - Windows 10, 64-bit, `140` - Windows 11, 64-bit, `110` - Windows 7, 64-bit, `100` - Windows 7, 32-bit
network_settings	body	string	Specifies the sandbox network_settings used for analysis. Accepted values: `default` - Fully operating network, `tor` - Route network traffic via TOR, `simulated` - Simulate network traffic, `offline` - No network traffic
parameters	query	dictionary	Full query string parameters payload in JSON format.
send_email_notification	body	boolean	Boolean indicating if an email notification should be sent.
sha256	body	string	ID of the sample, which is a SHA256 hash value. Find a sample ID from the response when uploading a malware sample or search with `query_sample`. The `url` keyword must be unset if this keyword is used.
submit_name	body	string	Name of the malware sample that’s used for file type detection and analysis.
system_date	body	string	Set a custom date in the format yyyy-MM-dd for the sandbox environment.
system_time	body	string	Set a custom time in the format HH:mm for the sandbox environment.
url	body	string	A web page or file URL. It can be HTTP(S) or FTP. The `sha256` keyword must be unset if this keyword is used.
user_tags	body	list of strings	User tags.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.submit(action_script="string",
                         aid="string",
                         command_line="string",
                         document_password="string",
                         enable_tor="string",
                         environment_id="string",
                         network_settings="string",
                         send_email_notification=boolean,
                         sha256="string",
                         submit_name="string",
                         system_date="string",
                         system_time="string",
                         url="string",
                         user_tags=["string"])
print(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.Submit(action_script="string",
                         aid="string",
                         command_line="string",
                         document_password="string",
                         enable_tor="string",
                         environment_id="string",
                         network_settings="string",
                         send_email_notification=boolean,
                         sha256="string",
                         submit_name="string",
                         system_date="string",
                         system_time="string",
                         url="string",
                         user_tags=["string"])
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "auto_detect_environment": boolean,
    "sandbox": [
        {
            "action_script": "string",
            "browser": "string",
            "command_line": "string",
            "document_password": "string",
            "enable_tor": boolean,
            "environment_id": integer,
            "interactivity": boolean,
            "network_settings": "string",
            "sha256": "string",
            "submit_name": "string",
            "system_date": "string",
            "system_time": "string",
            "url": "string"
        }
    ],
    "send_email_notification": boolean,
    "user_tags": ["string"]
}

response = falcon.command("Submit",
                          aid="string",
                          body=body_payload)
print(response)

New-FalconSubmission

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  auto_detect_environment := boolean
  action_script := "string"
  browser := "string"
  command_line := "string"
  document_password := "string"
  enable_tor := boolean
  environment_id := integer
  interactivity := boolean
  network_settings := "string"
  sha256 := "string"
  submit_name := "string"
  system_date := "string"
  system_time := "string"
  url := "string"
  send_email_notification := boolean
  aid := "string"

  response, err := client.FalconxSandbox.Submit(
    &falconx_sandbox.SubmitParams{
      Body: &models.FalconxSubmissionParametersV1{
        AutoDetectEnvironment: &auto_detect_environment,
        Sandbox: []interface{}{
          {
          ActionScript: &action_script,
          Browser: &browser,
          CommandLine: &command_line,
          DocumentPassword: &document_password,
          EnableTor: &enable_tor,
          EnvironmentID: &environment_id,
          Interactivity: &interactivity,
          NetworkSettings: &network_settings,
          Sha256: &sha256,
          SubmitName: &submit_name,
          SystemDate: &system_date,
          SystemTime: &system_time,
          URL: &url,
          },
        },
        SendEmailNotification: &send_email_notification,
        UserTags: []string{"string"},
      },
      Aid: &aid,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.submit(
  {  // body
      autoDetectEnvironment: boolean,
      sandbox: [{
          actionScript: "string",
          browser: "string",
          commandLine: "string",
          documentPassword: "string",
          enableTor: boolean,
          environmentId: integer,
          interactivity: boolean,
          networkSettings: "string",
          sha256: "string",
          submitName: "string",
          systemDate: "string",
          systemTime: "string",
          url: "string"
        }],
      sendEmailNotification: boolean,
      userTags: []
  },
  "string"  // aid
);

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::submit;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::FalconxSubmissionParametersV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = FalconxSubmissionParametersV1 {
        ..Default::default()
    };

    let response = submit(
        &falcon.cfg,  // configuration
        body,  // body
        Some("string"),  // aid
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

body = {
  auto_detect_environment: boolean,
  sandbox: [{
      action_script: 'string',
      browser: 'string',
      command_line: 'string',
      document_password: 'string',
      enable_tor: boolean,
      environment_id: integer,
      interactivity: boolean,
      network_settings: 'string',
      sha256: 'string',
      submit_name: 'string',
      system_date: 'string',
      system_time: 'string',
      url: 'string'
    }],
  send_email_notification: boolean,
  user_tags: []
}

response = api.submit(body)

puts response

QueryReports

Find sandbox reports by providing a FQL filter and paging details. Returns a set of report IDs that match your criteria.

GET /falconx/queries/reports/v1

Scope Sandbox (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 query_reports

Parameters

Name	Type	Data type	Description
filter	query	string	Optional filter and sort criteria in the form of an FQL query.
limit	query	integer	The maximum records to return. (Max: 5000).
offset	query	integer	Starting index of overall result set from which to return ids.
parameters	query	dictionary	Full query string parameters payload in JSON format.
sort	query	string	The property to sort on, followed by a dot (.), followed by the sort direction, either `asc` or `desc`.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.query_reports(filter="string",
                                limit=integer,
                                offset="string",
                                sort="string")
print(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.QueryReports(filter="string",
                               limit=integer,
                               offset="string",
                               sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryReports",
                          filter="string",
                          offset="string",
                          limit=integer,
                          sort="string")
print(response)

Get-FalconReport -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := "string"
  limit := int64(0)
  sort := "string"

  response, err := client.FalconxSandbox.QueryReports(
    &falconx_sandbox.QueryReportsParams{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.queryReports(
  "string",  // filter
  "string",  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::query_reports;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_reports(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.query_reports(filter: 'string',
                             offset: 'string',
                             limit: integer,
                             sort: 'string')

puts response

QuerySubmissions

Find submission IDs for uploaded files by providing a FQL filter and paging details. Returns a set of submission IDs that match your criteria.

GET /falconx/queries/submissions/v1

Scope Sandbox (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 query_submissions

Parameters

Name	Type	Data type	Description
filter	query	string	Optional filter and sort criteria in the form of an FQL query.
limit	query	integer	The maximum records to return. (Max: 5000).
offset	query	integer	Starting index of overall result set from which to return ids.
parameters	query	dictionary	Full query string parameters payload in JSON format.
sort	query	string	The property to sort on, followed by a dot (.), followed by the sort direction, either `asc` or `desc`.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.query_submissions(filter="string",
                                    limit=integer,
                                    offset="string",
                                    sort="string")
print(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.QuerySubmissions(filter="string",
                                   limit=integer,
                                   offset="string",
                                   sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QuerySubmissions",
                          filter="string",
                          offset="string",
                          limit=integer,
                          sort="string")
print(response)

Get-FalconSubmissionQuota

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := "string"
  limit := int64(0)
  sort := "string"

  response, err := client.FalconxSandbox.QuerySubmissions(
    &falconx_sandbox.QuerySubmissionsParams{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.querySubmissions(
  "string",  // filter
  "string",  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::query_submissions;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_submissions(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

GetSampleV2

Retrieves the file associated with the given ID (SHA256)

GET /samples/entities/samples/v2

Scope Sandbox (Falcon Intelligence): READ Produces application/octet-stream

PEP 8 get_sample

Parameters

Name	Type	Data type	Description
ids	query	string	The file SHA256.
parameters	query	dictionary	Full query string parameters payload in JSON format.
password_protected	query	boolean	Flag whether the sample should be zipped and password protected with password of `infected`.
stream	query	boolean	Enable streaming download of the returned file.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.get_sample(ids=id_list,
                                 password_protected="string",
                                 stream=boolean,
                                 stream=boolean)
    save_file.write(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.GetSampleV2(ids=id_list,
                                  password_protected="string",
                                  stream=boolean,
                                  stream=boolean)
    save_file.write(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.command("GetSampleV2",
                              ids="string",
                              password_protected=boolean)
    save_file.write(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  passwordProtected := boolean

  response, err := client.FalconxSandbox.GetSampleV2(
    &falconx_sandbox.GetSampleV2Params{
      Ids: "string",
      PasswordProtected: &passwordProtected,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.getSampleV2(
  "string",  // ids
  boolean  // passwordProtected
);

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::get_sample_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_sample_v2(
        &falcon.cfg,  // configuration
        "string",  // ids
        Some(boolean),  // password_protected
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.get_sample_v2('string')

puts response

UploadSampleV2

Upload a file for sandbox analysis. After uploading, use /falconx/entities/submissions/v1 to start analyzing the file.

POST /samples/entities/samples/v2

Scope Sandbox (Falcon Intelligence): WRITE Consumes multipart/form-data Produces application/json

PEP 8 upload_sample

Parameters

Name	Type	Data type	Description
comment	formData	string	A descriptive comment to identify the file for other users.
data	formData	file	Content of the uploaded sample in binary format. Max file size: 256 MB. Accepted file formats: Portable executables: `.exe`, `.scr`, `.pif`, `.dll`, `.com`, `.cpl`, etc. Office documents: `.doc`, `.docx`, `.ppt`, `.pps`, `.pptx`, `.ppsx`, `.xls`, `.xlsx`, `.rtf`, `.pub` PDF APK Executable JAR Windows script component: `.sct` Windows shortcut: `.lnk` Windows help: `.chm` HTML application: `.hta` Windows script file: `.wsf` Javascript: `.js` Visual Basic: `.vbs`, `.vbe` Shockwave Flash: `.swf` Perl: `.pl` Powershell: `.ps1`, `.psd1`, `.psm1` Scalable vector graphics: `.svg` Python: `.py` Linux ELF executables Email files: MIME RFC 822 `.eml`, Outlook `.msg`.
file_data or sample or upfile	formData	string	Content of the uploaded sample in binary format. Max file size: 256 MB. Accepted file formats: Portable executables: `.exe`, `.scr`, `.pif`, `.dll`, `.com`, `.cpl`, etc. Office documents: `.doc`, `.docx`, `.ppt`, `.pps`, `.pptx`, `.ppsx`, `.xls`, `.xlsx`, `.rtf`, `.pub` PDF APK Executable JAR Windows script component: `.sct` Windows shortcut: `.lnk` Windows help: `.chm` HTML application: `.hta` Windows script file: `.wsf` Javascript: `.js` Visual Basic: `.vbs`, `.vbe` Shockwave Flash: `.swf` Perl: `.pl` Powershell: `.ps1`, `.psd1`, `.psm1` Scalable vector graphics: `.svg` Python: `.py` Linux ELF executables Email files: MIME RFC 822 `.eml`, Outlook `.msg`.
file_name	formData	string	Name to use for the file. Uses current file name if not specified.
is_confidential	formData	boolean	Defines the visibility of this file in Falcon MalQuery, either via the API or the Falcon console. `true` - File is only shown to users within your customer account. `false` - File can be seen by other CrowdStrike customers. Defaults to `true`.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.upload_sample(comment="string",
                                file_data="string",
                                file_name="string",
                                is_confidential="string")
print(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.UploadSampleV2(comment="string",
                                 file_data="string",
                                 file_name="string",
                                 is_confidential="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("UploadSampleV2",
                          file_data=open("filename", "rb").read(),
                          file_name="string",
                          comment="string",
                          is_confidential=boolean)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  isConfidential := boolean

  response, err := client.FalconxSandbox.UploadSampleV2(
    &falconx_sandbox.UploadSampleV2Params{
      FileName: "string",
      Comment: &comment,
      IsConfidential: &isConfidential,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.uploadSampleV2(
  "string",  // sample
  "string",  // fileName
  "string",  // comment
  boolean  // isConfidential
);

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::upload_sample_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = upload_sample_v2(
        &falcon.cfg,  // configuration
        std::path::PathBuf::default(),  // sample
        "string",  // file_name
        Some("string"),  // comment
        Some(boolean),  // is_confidential
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.upload_sample_v2('string', 'string')

puts response

DeleteSampleV2

Removes a sample, including file, meta and submissions from the collection

DELETE /samples/entities/samples/v2

Scope Sandbox (Falcon Intelligence): WRITE Consumes · Produces application/json

PEP 8 delete_sample

Parameters

Name	Type	Data type	Description
ids	query	string	The file SHA256.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_sample(ids=id_list)
print(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteSampleV2(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteSampleV2",
                          ids="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.FalconxSandbox.DeleteSampleV2(
    &falconx_sandbox.DeleteSampleV2Params{
      Ids: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.deleteSampleV2("string");  // ids

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::delete_sample_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_sample_v2(
        &falcon.cfg,  // configuration
        "string",  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

response = api.delete_sample_v2('string')

puts response

QuerySampleV1

Retrieves a list with sha256 of samples that exist and customer has rights to access them, maximum number of accepted items is 200

POST /samples/queries/samples/GET/v1

Scope Sandbox (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 query_sample

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
sha256s	body	string or list of strings	Pass a list of sha256s to check if the exist. You will be returned the list of existing hashes.

Code Examples

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.query_sample(sha256s=["string"])
print(response)

from falconpy import FalconXSandbox

falcon = FalconXSandbox(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.QuerySampleV1(sha256s=["string"])
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "sha256s": ["string"]
}

response = falcon.command("QuerySampleV1", body=body_payload)
print(response)

Get-FalconSample -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/falconx_sandbox"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.FalconxSandbox.QuerySampleV1(
    &falconx_sandbox.QuerySampleV1Params{
      Body: &models.ClientQuerySamplesRequest{
        Sha256s: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.falconxSandbox.querySampleV1(
  {
    sha256s: []
}  // body
);

console.log(response);

use rusty_falcon::apis::falconx_sandbox_api::query_sample_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ClientQuerySamplesRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ClientQuerySamplesRequest {
        ..Default::default()
    };

    let response = query_sample_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::FalconxSandbox.new

body = Falcon::ClientQuerySamplesRequest.new(
  sha256s: []
)

response = api.query_sample_v1(body)

puts response

Falconx Sandbox

Table of Contents

GetArtifacts

Parameters

Code Examples

GetMemoryDumpExtractedStrings

Parameters

Code Examples

GetMemoryDumpHexDump

Parameters

Code Examples

GetMemoryDump

Parameters

Code Examples

GetSummaryReports

Parameters

Code Examples

GetReports

Parameters

Code Examples

DeleteReport

Parameters

Code Examples

GetSubmissions

Parameters

Code Examples

Submit

Parameters

Code Examples

QueryReports

Parameters

Code Examples

QuerySubmissions

Parameters

Code Examples

GetSampleV2

Parameters

Code Examples

UploadSampleV2

Parameters

Code Examples

DeleteSampleV2

Parameters

Code Examples

QuerySampleV1

Parameters

Code Examples