Network Scan Scan Runs

Operations for the Network Scan Scan Runs service collection.

Language	Last Update
Python	v1.6.5
PowerShell
Go	v0.22.0
TypeScript	v0.6.0
Rust
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
aggregate-scan-runs aggregate_scan_runs	Returns “scan-runs” aggregations
create-scan-runs create_scan_runs	Create “scan-runs” using provided specifications
get-scan-runs get_scan_runs	Get “scan-runs” by their IDs
query-scan-runs query_scan_runs	Get “scan-runs IDs” by filter
update-scan-runs update_scan_runs	Update “scan-runs” using provided specifications

---

aggregate-scan-runs

Returns “scan-runs” aggregations

Method POST

Route /netscan/aggregates/scan-runs/GET/v1

Scope Network scanning: READ

PEP 8 aggregate_scan_runs

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

date_ranges body · array

exclude body · string

extended_bounds body · object

field body · string

filter body · string

filters_spec body · object

from body · integer

include body · string

interval body · string

max_doc_count body · integer

min_doc_count body · integer

missing body · string

name body · string

percents body · array

q body · string

ranges body · array

size body · integer

sort body · string

sub_aggregates body · array

time_zone body · string

type body · string

Code Examples

Python

PEP 8

from falconpy import NetworkScanScanRuns

falcon = NetworkScanScanRuns(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

extended_bounds = {
    "max": "string",
    "min": "string"
}

filters_spec = {
    "filters": {},
    "other_bucket": boolean,
    "other_bucket_key": "string"
}

ranges = [
    {
        "from": integer,
        "to": integer
    }
]

sub_aggregates = [
    {
        "date_ranges": [
            {
                "from": "string",
                "to": "string"
            }
        ],
        "exclude": "string",
        "extended_bounds": {
            "max": "string",
            "min": "string"
        },
        "field": "string",
        "filter": "string",
        "filters_spec": {
            "filters": {},
            "other_bucket": boolean,
            "other_bucket_key": "string"
        },
        "from": integer,
        "include": "string",
        "interval": "string",
        "max_doc_count": integer,
        "min_doc_count": integer,
        "missing": "string",
        "name": "string",
        "percents": ["string"],
        "q": "string",
        "ranges": [
            {
                "from": integer,
                "to": integer
            }
        ],
        "size": integer,
        "sort": "string",
        "sub_aggregates": [
            {
                "date_ranges": ["string"],
                "exclude": "string",
                "extended_bounds": {},
                "field": "string",
                "filter": "string",
                "filters_spec": {},
                "from": integer,
                "include": "string",
                "interval": "string",
                "max_doc_count": integer,
                "min_doc_count": integer,
                "missing": "string",
                "name": "string",
                "percents": ["string"],
                "q": "string",
                "ranges": ["string"],
                "size": integer,
                "sort": "string",
                "sub_aggregates": ["string"],
                "time_zone": "string",
                "type": "string"
            }
        ],
        "time_zone": "string",
        "type": "string"
    }
]

response = falcon.aggregate_scan_runs(date_ranges=date_ranges,
                                      exclude="string",
                                      extended_bounds=extended_bounds,
                                      field="string",
                                      filter="string",
                                      filters_spec=filters_spec,
                                      from=integer,
                                      include="string",
                                      interval="string",
                                      max_doc_count=integer,
                                      min_doc_count=integer,
                                      missing="string",
                                      name="string",
                                      percents=["string"],
                                      q="string",
                                      ranges=ranges,
                                      size=integer,
                                      sort="string",
                                      sub_aggregates=sub_aggregates,
                                      time_zone="string",
                                      type="string")
print(response)

Operation ID

from falconpy import NetworkScanScanRuns

falcon = NetworkScanScanRuns(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

extended_bounds = {
    "max": "string",
    "min": "string"
}

filters_spec = {
    "filters": {},
    "other_bucket": boolean,
    "other_bucket_key": "string"
}

ranges = [
    {
        "from": integer,
        "to": integer
    }
]

sub_aggregates = [
    {
        "date_ranges": [
            {
                "from": "string",
                "to": "string"
            }
        ],
        "exclude": "string",
        "extended_bounds": {
            "max": "string",
            "min": "string"
        },
        "field": "string",
        "filter": "string",
        "filters_spec": {
            "filters": {},
            "other_bucket": boolean,
            "other_bucket_key": "string"
        },
        "from": integer,
        "include": "string",
        "interval": "string",
        "max_doc_count": integer,
        "min_doc_count": integer,
        "missing": "string",
        "name": "string",
        "percents": ["string"],
        "q": "string",
        "ranges": [
            {
                "from": integer,
                "to": integer
            }
        ],
        "size": integer,
        "sort": "string",
        "sub_aggregates": [
            {
                "date_ranges": ["string"],
                "exclude": "string",
                "extended_bounds": {},
                "field": "string",
                "filter": "string",
                "filters_spec": {},
                "from": integer,
                "include": "string",
                "interval": "string",
                "max_doc_count": integer,
                "min_doc_count": integer,
                "missing": "string",
                "name": "string",
                "percents": ["string"],
                "q": "string",
                "ranges": ["string"],
                "size": integer,
                "sort": "string",
                "sub_aggregates": ["string"],
                "time_zone": "string",
                "type": "string"
            }
        ],
        "time_zone": "string",
        "type": "string"
    }
]

response = falcon.aggregate_scan_runs(date_ranges=date_ranges,
                                      exclude="string",
                                      extended_bounds=extended_bounds,
                                      field="string",
                                      filter="string",
                                      filters_spec=filters_spec,
                                      from=integer,
                                      include="string",
                                      interval="string",
                                      max_doc_count=integer,
                                      min_doc_count=integer,
                                      missing="string",
                                      name="string",
                                      percents=["string"],
                                      q="string",
                                      ranges=ranges,
                                      size=integer,
                                      sort="string",
                                      sub_aggregates=sub_aggregates,
                                      time_zone="string",
                                      type="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = [
    {
        "date_ranges": [
            {
                "from": "string",
                "to": "string"
            }
        ],
        "exclude": "string",
        "extended_bounds": {
            "max": "string",
            "min": "string"
        },
        "field": "string",
        "filter": "string",
        "filters_spec": {
            "filters": {},
            "other_bucket": boolean,
            "other_bucket_key": "string"
        },
        "from": integer,
        "include": "string",
        "interval": "string",
        "max_doc_count": integer,
        "min_doc_count": integer,
        "missing": "string",
        "name": "string",
        "percents": ["string"],
        "q": "string",
        "ranges": [
            {
                "from": integer,
                "to": integer
            }
        ],
        "size": integer,
        "sort": "string",
        "sub_aggregates": [
            {
                "date_ranges": ["string"],
                "exclude": "string",
                "extended_bounds": {},
                "field": "string",
                "filter": "string",
                "filters_spec": {},
                "from": integer,
                "include": "string",
                "interval": "string",
                "max_doc_count": integer,
                "min_doc_count": integer,
                "missing": "string",
                "name": "string",
                "percents": ["string"],
                "q": "string",
                "ranges": ["string"],
                "size": integer,
                "sort": "string",
                "sub_aggregates": ["string"],
                "time_zone": "string",
                "type": "string"
            }
        ],
        "time_zone": "string",
        "type": "string"
    }
]

response = falcon.command("aggregate_scan_runs", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/network_scan_scan_runs"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  from := "string"
  to := "string"
  exclude := "string"
  field := "string"
  filter := "string"
  from := integer
  include := "string"
  interval := "string"
  max_doc_count := integer
  min_doc_count := integer
  missing := "string"
  name := "string"
  q := "string"
  From := integer
  To := integer
  size := integer
  sort := "string"
  time_zone := "string"
  typeVar := "string"

  response, err := client.NetworkScanScanRuns.AggregateScanRuns(
    &network_scan_scan_runs.AggregateScanRunsParams{
      Body: []*models.MsaAggregateQueryRequest{
        {
          DateRanges: []interface{}{
            {
            From: &from,
            To: &to,
            },
          },
          Exclude: &exclude,
          ExtendedBounds: &struct{}{},
          Field: &field,
          Filter: &filter,
          FiltersSpec: &struct{}{},
          From: &from,
          Include: &include,
          Interval: &interval,
          MaxDocCount: &max_doc_count,
          MinDocCount: &min_doc_count,
          Missing: &missing,
          Name: &name,
          Percents: []interface{}{},
          Q: &q,
          Ranges: []interface{}{
            {
            From: &From,
            To: &To,
            },
          },
          Size: &size,
          Sort: &sort,
          SubAggregates: []interface{}{
            {
            DateRanges: []interface{}{
              {
              From: &from,
              To: &to,
              },
            },
            Exclude: &exclude,
            ExtendedBounds: &struct{}{},
            Field: &field,
            Filter: &filter,
            FiltersSpec: &struct{}{},
            From: &from,
            Include: &include,
            Interval: &interval,
            MaxDocCount: &max_doc_count,
            MinDocCount: &min_doc_count,
            Missing: &missing,
            Name: &name,
            Percents: []interface{}{},
            Q: &q,
            Ranges: []interface{}{
              {
              From: &From,
              To: &To,
              },
            },
            Size: &size,
            Sort: &sort,
            SubAggregates: []interface{}{
              {
              DateRanges: []interface{}{},
              Exclude: &exclude,
              ExtendedBounds: &struct{}{},
              Field: &field,
              Filter: &filter,
              FiltersSpec: &struct{}{},
              From: &from,
              Include: &include,
              Interval: &interval,
              MaxDocCount: &max_doc_count,
              MinDocCount: &min_doc_count,
              Missing: &missing,
              Name: &name,
              Percents: []interface{}{},
              Q: &q,
              Ranges: []interface{}{},
              Size: &size,
              Sort: &sort,
              SubAggregates: []interface{}{},
              TimeZone: &time_zone,
              Type: &typeVar,
              },
            },
            TimeZone: &time_zone,
            Type: &typeVar,
            },
          },
          TimeZone: &time_zone,
          Type: &typeVar,
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.networkScanScanRuns.aggregateScanRuns(
  [{
    dateRanges: [{
        from: "string",
        to: "string"
      }],
    exclude: "string",
    extendedBounds: {
      max: "string",
      min: "string"
    },
    field: "string",
    filter: "string",
    filtersSpec: {
      filters: {},
      otherBucket: boolean,
      otherBucketKey: "string"
    },
    from: integer,
    include: "string",
    interval: "string",
    maxDocCount: integer,
    minDocCount: integer,
    missing: "string",
    name: "string",
    percents: [],
    q: "string",
    ranges: [{
        From: integer,
        To: integer
      }],
    size: integer,
    sort: "string",
    subAggregates: [{
        dateRanges: [{
            from: "string",
            to: "string"
          }],
        exclude: "string",
        extendedBounds: {
          max: "string",
          min: "string"
        },
        field: "string",
        filter: "string",
        filtersSpec: {
          filters: {},
          otherBucket: boolean,
          otherBucketKey: "string"
        },
        from: integer,
        include: "string",
        interval: "string",
        maxDocCount: integer,
        minDocCount: integer,
        missing: "string",
        name: "string",
        percents: [],
        q: "string",
        ranges: [{
            From: integer,
            To: integer
          }],
        size: integer,
        sort: "string",
        subAggregates: [{
            dateRanges: [],
            exclude: "string",
            extendedBounds: {},
            field: "string",
            filter: "string",
            filtersSpec: {},
            from: integer,
            include: "string",
            interval: "string",
            maxDocCount: integer,
            minDocCount: integer,
            missing: "string",
            name: "string",
            percents: [],
            q: "string",
            ranges: [],
            size: integer,
            sort: "string",
            subAggregates: [],
            timeZone: "string",
            type: "string"
          }],
        timeZone: "string",
        type: "string"
      }],
    timeZone: "string",
    type: "string"
}]  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::NetworkScanScanRuns.new

body = [Falcon::MsaAggregateQueryRequest.new(
  date_ranges: [{
      from: 'string',
      to: 'string'
    }],
  exclude: 'string',
  extended_bounds: {
    max: 'string',
    min: 'string'
  },
  field: 'string',
  filter: 'string',
  filters_spec: {
    filters: {},
    other_bucket: boolean,
    other_bucket_key: 'string'
  },
  from: integer,
  include: 'string',
  interval: 'string',
  max_doc_count: integer,
  min_doc_count: integer,
  missing: 'string',
  name: 'string',
  percents: [],
  q: 'string',
  ranges: [{
      From: integer,
      To: integer
    }],
  size: integer,
  sort: 'string',
  sub_aggregates: [{
      date_ranges: [{
          from: 'string',
          to: 'string'
        }],
      exclude: 'string',
      extended_bounds: {
        max: 'string',
        min: 'string'
      },
      field: 'string',
      filter: 'string',
      filters_spec: {
        filters: {},
        other_bucket: boolean,
        other_bucket_key: 'string'
      },
      from: integer,
      include: 'string',
      interval: 'string',
      max_doc_count: integer,
      min_doc_count: integer,
      missing: 'string',
      name: 'string',
      percents: [],
      q: 'string',
      ranges: [{
          From: integer,
          To: integer
        }],
      size: integer,
      sort: 'string',
      sub_aggregates: [{
          date_ranges: [],
          exclude: 'string',
          extended_bounds: {},
          field: 'string',
          filter: 'string',
          filters_spec: {},
          from: integer,
          include: 'string',
          interval: 'string',
          max_doc_count: integer,
          min_doc_count: integer,
          missing: 'string',
          name: 'string',
          percents: [],
          q: 'string',
          ranges: [],
          size: integer,
          sort: 'string',
          sub_aggregates: [],
          time_zone: 'string',
          type: 'string'
        }],
      time_zone: 'string',
      type: 'string'
    }],
  time_zone: 'string',
  type: 'string'
)]

response = api.aggregate_scan_runs(body)

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

create-scan-runs

Create “scan-runs” using provided specifications

Method POST

Route /netscan/entities/scan-runs/v1

Scope Network scanning: WRITE

PEP 8 create_scan_runs

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

config body · object

The scan run configuration

scan_id body · string

The scan ID based on which to create a scan run

Code Examples

Python

PEP 8

from falconpy import NetworkScanScanRuns

falcon = NetworkScanScanRuns(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

config = {
    "additional_tcp_ports": [
        "string"
    ],
    "additional_udp_ports": [
        "string"
    ],
    "auto_include_new_detections": "boolean",
    "detections": [
        "string"
    ],
    "fragile_device_detection": "boolean",
    "ignore_tcp_resets": "boolean",
    "ports_scan_level": "string",
    "scan_exclusion": {
        "cidrs": [
            {
                "active": "boolean",
                "value": "string"
            }
        ],
        "host_groups": [
            "string"
        ],
        "hosts": [
            "string"
        ],
        "ip_ranges": [
            {
                "active": "boolean",
                "from": "string",
                "to": "string"
            }
        ],
        "ips": [
            {
                "active": "boolean",
                "value": "string"
            }
        ]
    },
    "scan_intensity": "string",
    "target_asset": {
        "ids": [
            "string"
        ]
    },
    "target_asset_filter": {
        "fql_filter": "string"
    },
    "target_asset_vuln": {
        "asset_ids": [
            "string"
        ],
        "cve_ids": [
            "string"
        ]
    },
    "target_external_ip": {
        "ip_specs": [
            "string"
        ]
    },
    "target_ip": {
        "ip_specs": [
            "string"
        ],
        "zone_id": "string"
    },
    "target_type": "string",
    "type": "string"
}

response = falcon.create_scan_runs(config=config, scan_id="string")
print(response)

Operation ID

from falconpy import NetworkScanScanRuns

falcon = NetworkScanScanRuns(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

config = {
    "additional_tcp_ports": [
        "string"
    ],
    "additional_udp_ports": [
        "string"
    ],
    "auto_include_new_detections": "boolean",
    "detections": [
        "string"
    ],
    "fragile_device_detection": "boolean",
    "ignore_tcp_resets": "boolean",
    "ports_scan_level": "string",
    "scan_exclusion": {
        "cidrs": [
            {
                "active": "boolean",
                "value": "string"
            }
        ],
        "host_groups": [
            "string"
        ],
        "hosts": [
            "string"
        ],
        "ip_ranges": [
            {
                "active": "boolean",
                "from": "string",
                "to": "string"
            }
        ],
        "ips": [
            {
                "active": "boolean",
                "value": "string"
            }
        ]
    },
    "scan_intensity": "string",
    "target_asset": {
        "ids": [
            "string"
        ]
    },
    "target_asset_filter": {
        "fql_filter": "string"
    },
    "target_asset_vuln": {
        "asset_ids": [
            "string"
        ],
        "cve_ids": [
            "string"
        ]
    },
    "target_external_ip": {
        "ip_specs": [
            "string"
        ]
    },
    "target_ip": {
        "ip_specs": [
            "string"
        ],
        "zone_id": "string"
    },
    "target_type": "string",
    "type": "string"
}

response = falcon.create_scan_runs(config=config, scan_id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = [
    {
        "config": {
            "active_check_level": "string",
            "additional_tcp_ports": ["string"],
            "additional_udp_ports": ["string"],
            "auto_include_new_detections": boolean,
            "detections": ["string"],
            "excluded_tcp_ports": ["string"],
            "excluded_udp_ports": ["string"],
            "fragile_device_detection": boolean,
            "ignore_tcp_resets": boolean,
            "ports_scan_level": "string",
            "scan_exclusion": {},
            "scan_flags": {},
            "scan_intensity": "string",
            "target_asset": {},
            "target_asset_filter": {},
            "target_asset_vuln": {},
            "target_external_ip": {},
            "target_ip": {},
            "target_type": "string",
            "type": "string"
        },
        "scan_id": "string"
    }
]

response = falcon.command("create_scan_runs", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/network_scan_scan_runs"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  scan_id := "string"

  response, err := client.NetworkScanScanRuns.CreateScanRuns(
    &network_scan_scan_runs.CreateScanRunsParams{
      Body: []*models.DomainScanRunCreateRequest{
        {
          Config: &struct{}{},
          ScanID: &scan_id,
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.networkScanScanRuns.createScanRuns(
  [{
    config: {
      activeCheckLevel: "string",
      additionalTcpPorts: [],
      additionalUdpPorts: [],
      autoIncludeNewDetections: boolean,
      detections: [],
      excludedTcpPorts: [],
      excludedUdpPorts: [],
      fragileDeviceDetection: boolean,
      ignoreTcpResets: boolean,
      portsScanLevel: "string",
      scanExclusion: {
        cidrs: [],
        hostGroups: [],
        hosts: [],
        ipRanges: [],
        ips: []
      },
      scanFlags: {
        defeatRstRatelimit: boolean,
        hostTimeout: integer,
        ignoreTcpResets: boolean,
        initialRttTimeout: integer,
        maxParallelism: integer,
        maxRate: integer,
        maxRetries: integer,
        maxRttTimeout: integer,
        minParallelism: integer,
        minRate: integer,
        minRttTimeout: integer,
        scanDelay: integer,
        scriptTimeout: integer,
        versionIntensity: integer
      },
      scanIntensity: "string",
      targetAsset: {
        ids: []
      },
      targetAssetFilter: {
        fqlFilter: "string"
      },
      targetAssetVuln: {
        assetIds: [],
        cveIds: []
      },
      targetExternalIp: {
        ipSpecs: []
      },
      targetIp: {
        ipSpecs: [],
        zoneId: "string"
      },
      targetType: "string",
      type: "string"
    },
    scanId: "string"
}]  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::NetworkScanScanRuns.new

body = [Falcon::DomainScanRunCreateRequest.new(
  config: {
    active_check_level: 'string',
    additional_tcp_ports: [],
    additional_udp_ports: [],
    auto_include_new_detections: boolean,
    detections: [],
    excluded_tcp_ports: [],
    excluded_udp_ports: [],
    fragile_device_detection: boolean,
    ignore_tcp_resets: boolean,
    ports_scan_level: 'string',
    scan_exclusion: {
      cidrs: [],
      host_groups: [],
      hosts: [],
      ip_ranges: [],
      ips: []
    },
    scan_flags: {
      defeat_rst_ratelimit: boolean,
      host_timeout: integer,
      ignore_tcp_resets: boolean,
      initial_rtt_timeout: integer,
      max_parallelism: integer,
      max_rate: integer,
      max_retries: integer,
      max_rtt_timeout: integer,
      min_parallelism: integer,
      min_rate: integer,
      min_rtt_timeout: integer,
      scan_delay: integer,
      script_timeout: integer,
      version_intensity: integer
    },
    scan_intensity: 'string',
    target_asset: {
      ids: []
    },
    target_asset_filter: {
      fql_filter: 'string'
    },
    target_asset_vuln: {
      asset_ids: [],
      cve_ids: []
    },
    target_external_ip: {
      ip_specs: []
    },
    target_ip: {
      ip_specs: [],
      zone_id: 'string'
    },
    target_type: 'string',
    type: 'string'
  },
  scan_id: 'string'
)]

response = api.create_scan_runs(body)

puts response

Responses

201 Created

[
  {
    "cid": "string",
    "config": {},
    "created_by": "string",
    "created_timestamp": "string",
    "credentialed_asset_summary": {},
    "end_timestamp": "string",
    "error_code": 0,
    "error_reason": "string",
    "id": "string",
    "progress_pct": 0,
    "scan_id": "string",
    "scanners": [],
    "start_timestamp": "string",
    "status": "string",
    "target_type": "string",
    "targets_configured": 0,
    "targets_found": 0,
    "targets_scanned": 0,
    "template_id": "string",
    "template_name": "string",
    "trigger_type": "string",
    "type": "string",
    "updated_by": "string",
    "updated_timestamp": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

409 Conflict

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

413 Request Entity Too Large

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

get-scan-runs

Get “scan-runs” by their IDs

Method GET

Route /netscan/entities/scan-runs/v1

Scope Network scanning: READ

PEP 8 get_scan_runs

Parameters

ids query · string or list of strings

IDs of “scan-runs” to be retrieved (Min: 1, Max: 100)

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import NetworkScanScanRuns

falcon = NetworkScanScanRuns(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_scan_runs(ids=id_list)
print(response)

Operation ID

from falconpy import NetworkScanScanRuns

falcon = NetworkScanScanRuns(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_scan_runs(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("get_scan_runs",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/network_scan_scan_runs"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.NetworkScanScanRuns.GetScanRuns(
    &network_scan_scan_runs.GetScanRunsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.networkScanScanRuns.getScanRuns(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::NetworkScanScanRuns.new

response = api.get_scan_runs(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "config": {},
    "created_by": "string",
    "created_timestamp": "string",
    "credentialed_asset_summary": {},
    "end_timestamp": "string",
    "error_code": 0,
    "error_reason": "string",
    "id": "string",
    "progress_pct": 0,
    "scan_id": "string",
    "scanners": [],
    "start_timestamp": "string",
    "status": "string",
    "target_type": "string",
    "targets_configured": 0,
    "targets_found": 0,
    "targets_scanned": 0,
    "template_id": "string",
    "template_name": "string",
    "trigger_type": "string",
    "type": "string",
    "updated_by": "string",
    "updated_timestamp": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

query-scan-runs

Get “scan-runs IDs” by filter

Method GET

Route /netscan/queries/scan-runs/v1

Scope Network scanning: READ

PEP 8 query_scan_runs

Parameters

offset query · integer

An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide an offset. On subsequent requests, add previous offset with the previous limit to continue from that place in the results

limit query · integer

The number of “scan-runs IDs” to return in this response (Min: 1, Max: 100, Default: 100)

sort query · string

Sort “scan-runs” by their properties. A single sort field is allowed

filter query · string

Search for “scan-runs” by providing an FQL filter

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import NetworkScanScanRuns

falcon = NetworkScanScanRuns(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.query_scan_runs(offset=integer,
                                  limit=integer,
                                  sort="string",
                                  filter="string")
print(response)

Operation ID

from falconpy import NetworkScanScanRuns

falcon = NetworkScanScanRuns(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.query_scan_runs(offset=integer,
                                  limit=integer,
                                  sort="string",
                                  filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("query_scan_runs",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/network_scan_scan_runs"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.NetworkScanScanRuns.QueryScanRuns(
    &network_scan_scan_runs.QueryScanRunsParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.networkScanScanRuns.queryScanRuns(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::NetworkScanScanRuns.new

response = api.query_scan_runs(offset: integer,
                               limit: integer,
                               sort: 'string',
                               filter: 'string')

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

update-scan-runs

Update “scan-runs” using provided specifications

Method PATCH

Route /netscan/entities/scan-runs/v1

Scope Network scanning: WRITE

PEP 8 update_scan_runs

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

action body · string

The action to be performed for the scan run

Available values (1)

stop

id body · string

The ID of the scan run

Code Examples

Python

PEP 8

from falconpy import NetworkScanScanRuns

falcon = NetworkScanScanRuns(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.update_scan_runs(action="string", id="string")
print(response)

Operation ID

from falconpy import NetworkScanScanRuns

falcon = NetworkScanScanRuns(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.update_scan_runs(action="string", id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = [
    {
        "action": "string",
        "id": "string"
    }
]

response = falcon.command("update_scan_runs", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/network_scan_scan_runs"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  action := "string"
  id := "string"

  response, err := client.NetworkScanScanRuns.UpdateScanRuns(
    &network_scan_scan_runs.UpdateScanRunsParams{
      Body: []*models.DomainScanRunUpdateRequest{
        {
          Action: &action,
          ID: &id,
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.networkScanScanRuns.updateScanRuns(
  [{
    action: "string",
    id: "string"
}]  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::NetworkScanScanRuns.new

body = [Falcon::DomainScanRunUpdateRequest.new(
  action: 'string',
  id: 'string'
)]

response = api.update_scan_runs(body)

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "config": {},
    "created_by": "string",
    "created_timestamp": "string",
    "credentialed_asset_summary": {},
    "end_timestamp": "string",
    "error_code": 0,
    "error_reason": "string",
    "id": "string",
    "progress_pct": 0,
    "scan_id": "string",
    "scanners": [],
    "start_timestamp": "string",
    "status": "string",
    "target_type": "string",
    "targets_configured": 0,
    "targets_found": 0,
    "targets_scanned": 0,
    "template_id": "string",
    "template_name": "string",
    "trigger_type": "string",
    "type": "string",
    "updated_by": "string",
    "updated_timestamp": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

409 Conflict

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

413 Request Entity Too Large

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}