MalQuery

The MalQuery service collection provides operations for searching and downloading malware samples from Falcon’s malware repository. Check quotas, perform fuzzy or exact searches by hex patterns and strings, download files, retrieve metadata, schedule multi-sample downloads, and run YARA-based hunts.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

This service collection has code examples posted to the repository.

---

---

Table of Contents

Operation	Description
GetMalQueryDownloadV1 get_download	Download a file indexed by MalQuery.
GetMalQueryEntitiesSamplesFetchV1 get_samples	Fetch a zip archive with password ‘infected’ containing the samples.
GetMalQueryMetadataV1 get_metadata	Retrieve indexed files metadata by their hash
GetMalQueryQuotasV1 get_quotas	Get information about search and download quotas in your environment
GetMalQueryRequestV1 get_request	Check the status and results of an asynchronous request, such as hunt or exact-search.
PostMalQueryEntitiesSamplesMultidownloadV1 samples_multidownload	Schedule samples for download.
PostMalQueryExactSearchV1 exact_search	Search Falcon MalQuery for a combination of hex patterns and strings in order to identify samples based upon file content at byte level granularity.
PostMalQueryFuzzySearchV1 fuzzy_search	Search Falcon MalQuery quickly, but with more potential for false positives.
PostMalQueryHuntV1 hunt	Schedule a YARA-based search for execution.

---

GetMalQueryDownloadV1

Download a file indexed by MalQuery.

Method GET

Route /malquery/entities/download-files/v1

Scope MalQuery: READ

PEP 8 get_download

Parameters

ids query · string or list of strings

The file SHA256.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

stream body · boolean

Enable streaming download of the returned file.

Code Examples

Python

PEP 8

from falconpy import MalQuery

falcon = MalQuery(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.get_download(ids=id_list, stream=boolean, stream=boolean)
    save_file.write(response)

Operation ID

from falconpy import MalQuery

falcon = MalQuery(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.GetMalQueryDownloadV1(ids=id_list,
                                            stream=boolean,
                                            stream=boolean)
    save_file.write(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.command("GetMalQueryDownloadV1",
                              ids=id_list)
    save_file.write(response)

PowerShell

Receive-FalconMalQuerySample -Path "string" -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/malquery"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Malquery.GetMalQueryDownloadV1(
    &malquery.GetMalQueryDownloadV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.malquery.getMalQueryDownloadV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::malquery_api::get_mal_query_download_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_mal_query_download_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Malquery.new

response = api.get_mal_query_download_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

GetMalQueryEntitiesSamplesFetchV1

Fetch a zip archive with password ‘infected’ containing the samples.

Method GET

Route /malquery/entities/samples-fetch/v1

Scope MalQuery: READ

PEP 8 get_samples

Parameters

ids query · string

Multidownload job id

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

stream body · boolean

Enable streaming download of the returned file.

Code Examples

Python

PEP 8

from falconpy import MalQuery

falcon = MalQuery(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_samples(ids=id_list, stream=boolean)
print(response)

Operation ID

from falconpy import MalQuery

falcon = MalQuery(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetMalQueryEntitiesSamplesFetchV1(ids=id_list, stream=boolean)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetMalQueryEntitiesSamplesFetchV1",
                          ids="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/malquery"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Malquery.GetMalQueryEntitiesSamplesFetchV1(
    &malquery.GetMalQueryEntitiesSamplesFetchV1Params{
      Ids: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.malquery.getMalQueryEntitiesSamplesFetchV1("string");  // ids

console.log(response);

Rust

use rusty_falcon::apis::malquery_api::get_mal_query_entities_samples_fetch_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_mal_query_entities_samples_fetch_v1(
        &falcon.cfg,  // configuration
        "string",  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Malquery.new

response = api.get_mal_query_entities_samples_fetch_v1('string')

puts response

Responses

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string",
      "type": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "reqid": "string",
    "status": "string",
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "family": "string",
      "filesize": 0,
      "filetype": "string",
      "first_seen": "string",
      "ignore_reason": "string",
      "label": "string",
      "label_confidence": "string",
      "md5": "string",
      "pattern": "string",
      "pattern_type": "string",
      "samples": [],
      "sha1": "string",
      "sha256": "string",
      "tags": [],
      "yara_rule": "string",
      "yara_rules": []
    }
  ]
}

---

---

GetMalQueryMetadataV1

Retrieve indexed files metadata by their hash

Method GET

Route /malquery/entities/metadata/v1

Scope MalQuery: READ

PEP 8 get_metadata

Parameters

ids query · string or list of strings

The file SHA256.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import MalQuery

falcon = MalQuery(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_metadata(ids=id_list)
print(response)

Operation ID

from falconpy import MalQuery

falcon = MalQuery(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetMalQueryMetadataV1(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetMalQueryMetadataV1",
                          ids=id_list)
print(response)

PowerShell

Get-FalconMalQuerySample -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/malquery"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Malquery.GetMalQueryMetadataV1(
    &malquery.GetMalQueryMetadataV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.malquery.getMalQueryMetadataV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::malquery_api::get_mal_query_metadata_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_mal_query_metadata_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Malquery.new

response = api.get_mal_query_metadata_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "family": "string",
    "filesize": 0,
    "filetype": "string",
    "first_seen": "string",
    "label": "string",
    "md5": "string",
    "sha1": "string",
    "sha256": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string",
      "type": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "status": "string",
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "family": "string",
      "filesize": 0,
      "filetype": "string",
      "first_seen": "string",
      "label": "string",
      "md5": "string",
      "sha1": "string",
      "sha256": "string"
    }
  ]
}

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string",
      "type": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "status": "string",
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "family": "string",
      "filesize": 0,
      "filetype": "string",
      "first_seen": "string",
      "label": "string",
      "md5": "string",
      "sha1": "string",
      "sha256": "string"
    }
  ]
}

---

---

GetMalQueryQuotasV1

Get information about search and download quotas in your environment

Method GET

Route /malquery/aggregates/quotas/v1

Scope MalQuery: READ

PEP 8 get_quotas

Code Examples

Python

PEP 8

from falconpy import MalQuery

falcon = MalQuery(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.get_quotas()
print(response)

Operation ID

from falconpy import MalQuery

falcon = MalQuery(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.GetMalQueryQuotasV1()
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetMalQueryQuotasV1")
print(response)

PowerShell

Get-FalconMalQueryQuota

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/malquery"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Malquery.GetMalQueryQuotasV1(
    &malquery.GetMalQueryQuotasV1Params{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.malquery.getMalQueryQuotasV1();

console.log(response);

Rust

use rusty_falcon::apis::malquery_api::get_mal_query_quotas_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_mal_query_quotas_v1(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Malquery.new

response = api.get_mal_query_quotas_v1

puts response

Responses

200 OK

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "days_left": 0,
    "download_count": 0,
    "download_counts": [],
    "download_limit": 0,
    "hunt_count": 0,
    "hunt_counts": [],
    "hunt_limit": 0,
    "monitor_count": 0,
    "monitor_limit": 0,
    "refresh_time": "string"
  }
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "days_left": 0,
    "download_count": 0,
    "download_counts": [],
    "download_limit": 0,
    "hunt_count": 0,
    "hunt_counts": [],
    "hunt_limit": 0,
    "monitor_count": 0,
    "monitor_limit": 0,
    "refresh_time": "string"
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "days_left": 0,
    "download_count": 0,
    "download_counts": [],
    "download_limit": 0,
    "hunt_count": 0,
    "hunt_counts": [],
    "hunt_limit": 0,
    "monitor_count": 0,
    "monitor_limit": 0,
    "refresh_time": "string"
  }
}

---

---

GetMalQueryRequestV1

Check the status and results of an asynchronous request, such as hunt or exact-search.

Method GET

Route /malquery/entities/requests/v1

Scope MalQuery: READ

PEP 8 get_request

Parameters

ids query · string or list of strings

Identifier of a MalQuery request

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import MalQuery

falcon = MalQuery(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_request(ids=id_list)
print(response)

Operation ID

from falconpy import MalQuery

falcon = MalQuery(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetMalQueryRequestV1(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetMalQueryRequestV1",
                          ids=id_list)
print(response)

PowerShell

Get-FalconMalQuery -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/malquery"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Malquery.GetMalQueryRequestV1(
    &malquery.GetMalQueryRequestV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.malquery.getMalQueryRequestV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::malquery_api::get_mal_query_request_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_mal_query_request_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Malquery.new

response = api.get_mal_query_request_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "family": "string",
    "filesize": 0,
    "filetype": "string",
    "first_seen": "string",
    "ignore_reason": "string",
    "label": "string",
    "label_confidence": "string",
    "md5": "string",
    "pattern": "string",
    "pattern_type": "string",
    "samples": [],
    "sha1": "string",
    "sha256": "string",
    "tags": [],
    "yara_rule": "string",
    "yara_rules": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string",
      "type": "string"
    }
  ],
  "meta": {
    "options": {
      "app": "string",
      "filter_filetypes": [],
      "filter_meta": [],
      "limit": 0,
      "max_date": "string",
      "max_size": "string",
      "min_date": "string",
      "min_size": "string",
      "submitted_by_customer": false
    },
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "patterns": [],
    "powered_by": "string",
    "query_time": 0.0,
    "reqid": "string",
    "reqtype": "string",
    "sample": "string",
    "stats": {
      "clean_count": 0,
      "malware_count": 0,
      "pua_count": 0,
      "total_count": 0,
      "unknown_count": 0
    },
    "status": "string",
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    },
    "yara_rule": "string"
  },
  "resources": [
    {
      "family": "string",
      "filesize": 0,
      "filetype": "string",
      "first_seen": "string",
      "ignore_reason": "string",
      "label": "string",
      "label_confidence": "string",
      "md5": "string",
      "pattern": "string",
      "pattern_type": "string",
      "samples": [],
      "sha1": "string",
      "sha256": "string",
      "tags": [],
      "yara_rule": "string",
      "yara_rules": []
    }
  ]
}

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string",
      "type": "string"
    }
  ],
  "meta": {
    "options": {
      "app": "string",
      "filter_filetypes": [],
      "filter_meta": [],
      "limit": 0,
      "max_date": "string",
      "max_size": "string",
      "min_date": "string",
      "min_size": "string",
      "submitted_by_customer": false
    },
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "patterns": [],
    "powered_by": "string",
    "query_time": 0.0,
    "reqid": "string",
    "reqtype": "string",
    "sample": "string",
    "stats": {
      "clean_count": 0,
      "malware_count": 0,
      "pua_count": 0,
      "total_count": 0,
      "unknown_count": 0
    },
    "status": "string",
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    },
    "yara_rule": "string"
  },
  "resources": [
    {
      "family": "string",
      "filesize": 0,
      "filetype": "string",
      "first_seen": "string",
      "ignore_reason": "string",
      "label": "string",
      "label_confidence": "string",
      "md5": "string",
      "pattern": "string",
      "pattern_type": "string",
      "samples": [],
      "sha1": "string",
      "sha256": "string",
      "tags": [],
      "yara_rule": "string",
      "yara_rules": []
    }
  ]
}

---

---

PostMalQueryEntitiesSamplesMultidownloadV1

Schedule samples for download.

Method POST

Route /malquery/entities/samples-multidownload/v1

Scope MalQuery: WRITE

PEP 8 samples_multidownload

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

samples body · array

List of sample sha256 ids

Code Examples

Python

PEP 8

from falconpy import MalQuery

falcon = MalQuery(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.samples_multidownload(samples=id_list)
print(response)

Operation ID

from falconpy import MalQuery

falcon = MalQuery(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.PostMalQueryEntitiesSamplesMultidownloadV1(samples=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "samples": ["string"]
}

response = falcon.command("PostMalQueryEntitiesSamplesMultidownloadV1", body=body_payload)
print(response)

PowerShell

Group-FalconMalQuerySample -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/malquery"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Malquery.PostMalQueryEntitiesSamplesMultidownloadV1(
    &malquery.PostMalQueryEntitiesSamplesMultidownloadV1Params{
      Body: &models.MalqueryMultiDownloadRequestV1{
        Samples: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.malquery.postMalQueryEntitiesSamplesMultidownloadV1(
  {
    samples: []
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::malquery_api::post_mal_query_entities_samples_multidownload_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MalqueryMultiDownloadRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MalqueryMultiDownloadRequestV1 {
        samples: vec!["string".to_string()],
        ..Default::default()
    };

    let response = post_mal_query_entities_samples_multidownload_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Malquery.new

body = Falcon::MalqueryMultiDownloadRequestV1.new(
  samples: []
)

response = api.post_mal_query_entities_samples_multidownload_v1(body)

puts response

Responses

200 OK

[
  {
    "family": "string",
    "filesize": 0,
    "filetype": "string",
    "first_seen": "string",
    "ignore_reason": "string",
    "label": "string",
    "label_confidence": "string",
    "md5": "string",
    "pattern": "string",
    "pattern_type": "string",
    "samples": [],
    "sha1": "string",
    "sha256": "string",
    "tags": [],
    "yara_rule": "string",
    "yara_rules": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string",
      "type": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "reqid": "string",
    "status": "string",
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "family": "string",
      "filesize": 0,
      "filetype": "string",
      "first_seen": "string",
      "ignore_reason": "string",
      "label": "string",
      "label_confidence": "string",
      "md5": "string",
      "pattern": "string",
      "pattern_type": "string",
      "samples": [],
      "sha1": "string",
      "sha256": "string",
      "tags": [],
      "yara_rule": "string",
      "yara_rules": []
    }
  ]
}

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string",
      "type": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "reqid": "string",
    "status": "string",
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "family": "string",
      "filesize": 0,
      "filetype": "string",
      "first_seen": "string",
      "ignore_reason": "string",
      "label": "string",
      "label_confidence": "string",
      "md5": "string",
      "pattern": "string",
      "pattern_type": "string",
      "samples": [],
      "sha1": "string",
      "sha256": "string",
      "tags": [],
      "yara_rule": "string",
      "yara_rules": []
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string",
      "type": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "reqid": "string",
    "status": "string",
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "family": "string",
      "filesize": 0,
      "filetype": "string",
      "first_seen": "string",
      "ignore_reason": "string",
      "label": "string",
      "label_confidence": "string",
      "md5": "string",
      "pattern": "string",
      "pattern_type": "string",
      "samples": [],
      "sha1": "string",
      "sha256": "string",
      "tags": [],
      "yara_rule": "string",
      "yara_rules": []
    }
  ]
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string",
      "type": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "reqid": "string",
    "status": "string",
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "family": "string",
      "filesize": 0,
      "filetype": "string",
      "first_seen": "string",
      "ignore_reason": "string",
      "label": "string",
      "label_confidence": "string",
      "md5": "string",
      "pattern": "string",
      "pattern_type": "string",
      "samples": [],
      "sha1": "string",
      "sha256": "string",
      "tags": [],
      "yara_rule": "string",
      "yara_rules": []
    }
  ]
}

---

---

PostMalQueryExactSearchV1

Search Falcon MalQuery for a combination of hex patterns and strings in order to identify samples based upon file content at byte level granularity.

Method POST

Route /malquery/queries/exact-search/v1

Scope MalQuery: WRITE

PEP 8 exact_search

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

options body · object

Additional search options

patterns body · array

Patterns to search for

filter_filetypes body · list of strings

File types to filter on.

filter_meta body · list of strings

File metadata to filter on.

limit body · string

Integer representing maximum number of matches to return.

max_date body · string

Maximum date to match. UTC formatted.

min_date body · string

Minimum date to match. UTC formatted.

max_size body · string

Maximum size in bytes to match.

min_size body · string

Minumum size in bytes to match.

Code Examples

Python

PEP 8

from falconpy import MalQuery

falcon = MalQuery(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

patterns = [
    {
        "type": "string",
        "value": "string"
    }
]

response = falcon.exact_search(filter_filetypes=["string"],
                               filter_meta=["string"],
                               limit="string",
                               max_date="string",
                               min_date="string",
                               max_size="string",
                               min_size="string",
                               patterns=patterns)
print(response)

Operation ID

from falconpy import MalQuery

falcon = MalQuery(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

patterns = [
    {
        "type": "string",
        "value": "string"
    }
]

response = falcon.PostMalQueryExactSearchV1(filter_filetypes=["string"],
                                            filter_meta=["string"],
                                            limit="string",
                                            max_date="string",
                                            min_date="string",
                                            max_size="string",
                                            min_size="string",
                                            patterns=patterns)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "options": {
        "app": "string",
        "filter_filetypes": ["string"],
        "filter_meta": ["string"],
        "limit": integer,
        "max_date": "string",
        "max_size": "string",
        "min_date": "string",
        "min_size": "string",
        "submitted_by_customer": boolean
    },
    "patterns": [
        {
            "type": "string",
            "value": "string"
        }
    ]
}

response = falcon.command("PostMalQueryExactSearchV1", body=body_payload)
print(response)

PowerShell

Invoke-FalconMalQuery -Type "string" `
  -Value "string" `
  -Limit integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/malquery"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  typeVar := "string"
  value := "string"

  response, err := client.Malquery.PostMalQueryExactSearchV1(
    &malquery.PostMalQueryExactSearchV1Params{
      Body: &models.MalqueryExternalExactSearchParametersV1{
        Options: &struct{}{},
        Patterns: []interface{}{
          {
          Type: &typeVar,
          Value: &value,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.malquery.postMalQueryExactSearchV1(
  {
    options: {
      app: "string",
      filterFiletypes: [],
      filterMeta: [],
      limit: integer,
      maxDate: "string",
      maxSize: "string",
      minDate: "string",
      minSize: "string",
      submittedByCustomer: boolean
    },
    patterns: [{
        type: "string",
        value: "string"
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::malquery_api::post_mal_query_exact_search_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MalqueryExternalExactSearchParametersV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MalqueryExternalExactSearchParametersV1 {
        patterns: vec![SearchParameter {
            type: Some("string".to_string()),
            value: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = post_mal_query_exact_search_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Malquery.new

body = Falcon::MalqueryExternalExactSearchParametersV1.new(
  options: {
    app: 'string',
    filter_filetypes: [],
    filter_meta: [],
    limit: integer,
    max_date: 'string',
    max_size: 'string',
    min_date: 'string',
    min_size: 'string',
    submitted_by_customer: boolean
  },
  patterns: [{
      type: 'string',
      value: 'string'
    }]
)

response = api.post_mal_query_exact_search_v1(body)

puts response

Responses

200 OK

[
  {
    "family": "string",
    "filesize": 0,
    "filetype": "string",
    "first_seen": "string",
    "ignore_reason": "string",
    "label": "string",
    "label_confidence": "string",
    "md5": "string",
    "pattern": "string",
    "pattern_type": "string",
    "samples": [],
    "sha1": "string",
    "sha256": "string",
    "tags": [],
    "yara_rule": "string",
    "yara_rules": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string",
      "type": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "reqid": "string",
    "status": "string",
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "family": "string",
      "filesize": 0,
      "filetype": "string",
      "first_seen": "string",
      "ignore_reason": "string",
      "label": "string",
      "label_confidence": "string",
      "md5": "string",
      "pattern": "string",
      "pattern_type": "string",
      "samples": [],
      "sha1": "string",
      "sha256": "string",
      "tags": [],
      "yara_rule": "string",
      "yara_rules": []
    }
  ]
}

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string",
      "type": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "reqid": "string",
    "status": "string",
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "family": "string",
      "filesize": 0,
      "filetype": "string",
      "first_seen": "string",
      "ignore_reason": "string",
      "label": "string",
      "label_confidence": "string",
      "md5": "string",
      "pattern": "string",
      "pattern_type": "string",
      "samples": [],
      "sha1": "string",
      "sha256": "string",
      "tags": [],
      "yara_rule": "string",
      "yara_rules": []
    }
  ]
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string",
      "type": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "reqid": "string",
    "status": "string",
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "family": "string",
      "filesize": 0,
      "filetype": "string",
      "first_seen": "string",
      "ignore_reason": "string",
      "label": "string",
      "label_confidence": "string",
      "md5": "string",
      "pattern": "string",
      "pattern_type": "string",
      "samples": [],
      "sha1": "string",
      "sha256": "string",
      "tags": [],
      "yara_rule": "string",
      "yara_rules": []
    }
  ]
}

---

---

PostMalQueryFuzzySearchV1

Search Falcon MalQuery quickly, but with more potential for false positives.

Method POST

Route /malquery/combined/fuzzy-search/v1

Scope MalQuery: WRITE

PEP 8 fuzzy_search

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

options body · object

patterns body · array

List of dictionaries containing patterns to match.

filter_meta body · list of strings

limit body · string

Integer representing maximum number of matches to return.

Code Examples

Python

PEP 8

from falconpy import MalQuery

falcon = MalQuery(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

patterns = [
    {
        "type": "string",
        "value": "string"
    }
]

response = falcon.fuzzy_search(filter_meta=["string"],
                               limit="string",
                               patterns=patterns)
print(response)

Operation ID

from falconpy import MalQuery

falcon = MalQuery(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

patterns = [
    {
        "type": "string",
        "value": "string"
    }
]

response = falcon.PostMalQueryFuzzySearchV1(filter_meta=["string"],
                                            limit="string",
                                            patterns=patterns)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "options": {
        "filter_meta": ["string"],
        "limit": integer
    },
    "patterns": [
        {
            "type": "string",
            "value": "string"
        }
    ]
}

response = falcon.command("PostMalQueryFuzzySearchV1", body=body_payload)
print(response)

PowerShell

Invoke-FalconMalQuery -Type "string" `
  -Value "string" `
  -Limit integer `
  -Fuzzy $boolean

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/malquery"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  typeVar := "string"
  value := "string"

  response, err := client.Malquery.PostMalQueryFuzzySearchV1(
    &malquery.PostMalQueryFuzzySearchV1Params{
      Body: &models.MalqueryFuzzySearchParametersV1{
        Options: &struct{}{},
        Patterns: []interface{}{
          {
          Type: &typeVar,
          Value: &value,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.malquery.postMalQueryFuzzySearchV1(
  {
    options: {
      filterMeta: [],
      limit: integer
    },
    patterns: [{
        type: "string",
        value: "string"
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::malquery_api::post_mal_query_fuzzy_search_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MalqueryFuzzySearchParametersV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MalqueryFuzzySearchParametersV1 {
        patterns: vec![SearchParameter {
            type: Some("string".to_string()),
            value: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = post_mal_query_fuzzy_search_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Malquery.new

body = Falcon::MalqueryFuzzySearchParametersV1.new(
  options: {
    filter_meta: [],
    limit: integer
  },
  patterns: [{
      type: 'string',
      value: 'string'
    }]
)

response = api.post_mal_query_fuzzy_search_v1(body)

puts response

Responses

200 OK

[
  {
    "family": "string",
    "filesize": 0,
    "filetype": "string",
    "first_seen": "string",
    "label": "string",
    "md5": "string",
    "sha1": "string",
    "sha256": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string",
      "type": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "reqid": "string",
    "stats": {
      "clean_count": 0,
      "malware_count": 0,
      "pua_count": 0,
      "total_count": 0,
      "unknown_count": 0
    },
    "status": "string",
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "family": "string",
      "filesize": 0,
      "filetype": "string",
      "first_seen": "string",
      "label": "string",
      "md5": "string",
      "sha1": "string",
      "sha256": "string"
    }
  ]
}

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string",
      "type": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "reqid": "string",
    "stats": {
      "clean_count": 0,
      "malware_count": 0,
      "pua_count": 0,
      "total_count": 0,
      "unknown_count": 0
    },
    "status": "string",
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "family": "string",
      "filesize": 0,
      "filetype": "string",
      "first_seen": "string",
      "label": "string",
      "md5": "string",
      "sha1": "string",
      "sha256": "string"
    }
  ]
}

---

---

PostMalQueryHuntV1

Schedule a YARA-based search for execution.

Method POST

Route /malquery/queries/hunt/v1

Scope MalQuery: WRITE

PEP 8 hunt

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

options body · object

Optional advanced searching parameters

yara_rule body · string

A YARA rule that defines your search

filter_filetypes body · list of strings

File types to filter on.

filter_meta body · list of strings

File metadata to filter on.

limit body · string

Integer representing maximum number of matches to return.

max_date body · string

Maximum date to match. UTC formatted.

min_date body · string

Minimum date to match. UTC formatted.

max_size body · string

Maximum size in bytes to match.

min_size body · string

Minumum size in bytes to match.

Code Examples

Python

PEP 8

from falconpy import MalQuery

falcon = MalQuery(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.hunt(filter_filetypes=["string"],
                       filter_meta=["string"],
                       limit="string",
                       max_date="string",
                       min_date="string",
                       max_size="string",
                       min_size="string",
                       yara_rule="string")
print(response)

Operation ID

from falconpy import MalQuery

falcon = MalQuery(client_id=CLIENT_ID,
                  client_secret=CLIENT_SECRET
                  )

response = falcon.PostMalQueryHuntV1(filter_filetypes=["string"],
                                     filter_meta=["string"],
                                     limit="string",
                                     max_date="string",
                                     min_date="string",
                                     max_size="string",
                                     min_size="string",
                                     yara_rule="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "options": {
        "app": "string",
        "filter_filetypes": ["string"],
        "filter_meta": ["string"],
        "limit": integer,
        "max_date": "string",
        "max_size": "string",
        "min_date": "string",
        "min_size": "string",
        "submitted_by_customer": boolean
    },
    "yara_rule": "string"
}

response = falcon.command("PostMalQueryHuntV1", body=body_payload)
print(response)

PowerShell

Invoke-FalconMalQuery -YaraRule "string" -Limit integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/malquery"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  yara_rule := "string"

  response, err := client.Malquery.PostMalQueryHuntV1(
    &malquery.PostMalQueryHuntV1Params{
      Body: &models.MalqueryExternalHuntParametersV1{
        Options: &struct{}{},
        YaraRule: &yara_rule,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.malquery.postMalQueryHuntV1(
  {
    options: {
      app: "string",
      filterFiletypes: [],
      filterMeta: [],
      limit: integer,
      maxDate: "string",
      maxSize: "string",
      minDate: "string",
      minSize: "string",
      submittedByCustomer: boolean
    },
    yaraRule: "string"
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::malquery_api::post_mal_query_hunt_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MalqueryExternalHuntParametersV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MalqueryExternalHuntParametersV1 {
        yara_rule: Some("string".to_string()),
        ..Default::default()
    };

    let response = post_mal_query_hunt_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Malquery.new

body = Falcon::MalqueryExternalHuntParametersV1.new(
  options: {
    app: 'string',
    filter_filetypes: [],
    filter_meta: [],
    limit: integer,
    max_date: 'string',
    max_size: 'string',
    min_date: 'string',
    min_size: 'string',
    submitted_by_customer: boolean
  },
  yara_rule: 'string'
)

response = api.post_mal_query_hunt_v1(body)

puts response

Responses

200 OK

[
  {
    "family": "string",
    "filesize": 0,
    "filetype": "string",
    "first_seen": "string",
    "ignore_reason": "string",
    "label": "string",
    "label_confidence": "string",
    "md5": "string",
    "pattern": "string",
    "pattern_type": "string",
    "samples": [],
    "sha1": "string",
    "sha256": "string",
    "tags": [],
    "yara_rule": "string",
    "yara_rules": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string",
      "type": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "reqid": "string",
    "status": "string",
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "family": "string",
      "filesize": 0,
      "filetype": "string",
      "first_seen": "string",
      "ignore_reason": "string",
      "label": "string",
      "label_confidence": "string",
      "md5": "string",
      "pattern": "string",
      "pattern_type": "string",
      "samples": [],
      "sha1": "string",
      "sha256": "string",
      "tags": [],
      "yara_rule": "string",
      "yara_rules": []
    }
  ]
}

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string",
      "type": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "reqid": "string",
    "status": "string",
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "family": "string",
      "filesize": 0,
      "filetype": "string",
      "first_seen": "string",
      "ignore_reason": "string",
      "label": "string",
      "label_confidence": "string",
      "md5": "string",
      "pattern": "string",
      "pattern_type": "string",
      "samples": [],
      "sha1": "string",
      "sha256": "string",
      "tags": [],
      "yara_rule": "string",
      "yara_rules": []
    }
  ]
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string",
      "type": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "reqid": "string",
    "status": "string",
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "family": "string",
      "filesize": 0,
      "filetype": "string",
      "first_seen": "string",
      "ignore_reason": "string",
      "label": "string",
      "label_confidence": "string",
      "md5": "string",
      "pattern": "string",
      "pattern_type": "string",
      "samples": [],
      "sha1": "string",
      "sha256": "string",
      "tags": [],
      "yara_rule": "string",
      "yara_rules": []
    }
  ]
}