Skip to content
CrowdStrike Developer Center

ODS (On Demand Scan)

The ODS (On Demand Scan) service collection provides operations for managing on-demand malware scans across your environment. Retrieve aggregate data on scans and scan hosts, cancel active scans, get and create scans and scheduled scans, query malicious files, and manage scheduled scan configurations.

LanguageLast Update
Pythonv1.6.5
PowerShellv2.2.9
Gov0.22.0
TypeScriptv0.6.0
Rustv0.7.1
Rubyv1.4.0

Table of Contents

Section titled “Table of Contents”
OperationDescription
aggregate-query-scan-host-metadata
aggregate_scan_hosts		Get aggregates on ODS scan-hosts data.
aggregate-scans
aggregate_scans		Get aggregates on ODS scan data.
aggregate-scheduled-scans
aggregate_scheduled_scans		Get aggregates on ODS scheduled-scan data.
cancel-scans
cancel_scans		Cancel ODS scans for the given scan ids.
create-scan
create_scan		Create ODS scan and start or schedule scan for the given scan request.
delete-scheduled-scans
delete_scheduled_scans		Delete ODS scheduled-scans for the given scheduled-scan ids.
get-malicious-files-by-ids
get_malicious_files		Get malicious files by ids.
get-scan-host-metadata-by-ids
get_scan_hosts		Get scan hosts by ids.
get-scans-by-scan-ids
get_scans		Get Scans by IDs.
get-scans-by-scan-ids-v2
get_scans		Get Scans by IDs.
get-scheduled-scans-by-scan-ids
get_scheduled_scans		Get ScheduledScans by IDs.
query-malicious-files
query_malicious_files		Query malicious files.
query-scan-host-metadata
query_scan_hosts		Query scan hosts.
query-scans
query_scans		Query Scans.
query-scheduled-scans
query_scheduled_scans		Query ScheduledScans.
scans-reportLaunch a scans report creation job
schedule-scan
schedule_scan		Create ODS scan and start or schedule scan for the given scan request.

aggregate-query-scan-host-metadata

Section titled “aggregate-query-scan-host-metadata”

Get aggregates on ODS scan-hosts data.

Method POST
Route /ods/aggregates/scan-hosts/v1
Scope On-demand scans (ODS): WRITE
PEP 8 aggregate_scan_hosts

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.
exclude body · string
Fields to exclude.
extended_bounds body · object
field body · string
Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.
filter body · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
filters_spec body · object
from body · integer
include body · string
Fields to include.
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
Maximum number of documents.
min_doc_count body · integer
Minimum number of documents.
missing body · string
name body · string
Scan name.
percents body · array
q body · string
FQL syntax.
ranges body · array
size body · integer
sort body · string
FQL syntax.
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import ODS


falcon = ODS(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )


date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.aggregate_scan_hosts(date_ranges=date_ranges,
                                       exclude="string",
                                       field="string",
                                       filter="string",
                                       from=integer,
                                       include="string",
                                       interval="string",
                                       max_doc_count=integer,
                                       min_doc_count=integer,
                                       missing="string",
                                       name="string",
                                       q="string",
                                       ranges=ranges,
                                       size=integer,
                                       sort="string",
                                       sub_aggregates=["string"],
                                       time_zone="string",
                                       type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

aggregate-scans

Section titled “aggregate-scans”

Get aggregates on ODS scan data.

Method POST
Route /ods/aggregates/scans/v1
Scope On-demand scans (ODS): READ
PEP 8 aggregate_scans

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.
exclude body · string
Fields to exclude.
extended_bounds body · object
field body · string
Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.
filter body · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
filters_spec body · object
from body · integer
include body · string
Fields to include.
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
Maximum number of documents.
min_doc_count body · integer
Minimum number of documents.
missing body · string
name body · string
Scan name.
percents body · array
q body · string
FQL syntax.
ranges body · array
size body · integer
sort body · string
FQL syntax.
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import ODS


falcon = ODS(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )


date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.aggregate_scans(date_ranges=date_ranges,
                                  exclude="string",
                                  field="string",
                                  filter="string",
                                  from=integer,
                                  include="string",
                                  interval="string",
                                  max_doc_count=integer,
                                  min_doc_count=integer,
                                  missing="string",
                                  name="string",
                                  q="string",
                                  ranges=ranges,
                                  size=integer,
                                  sort="string",
                                  sub_aggregates=["string"],
                                  time_zone="string",
                                  type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

aggregate-scheduled-scans

Section titled “aggregate-scheduled-scans”

Get aggregates on ODS scheduled-scan data.

Method POST
Route /ods/aggregates/scheduled-scans/v1
Scope On-demand scans (ODS): READ
PEP 8 aggregate_scheduled_scans

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.
exclude body · string
Fields to exclude.
extended_bounds body · object
field body · string
Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.
filter body · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
filters_spec body · object
from body · integer
include body · string
Fields to include.
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
Maximum number of documents.
min_doc_count body · integer
Minimum number of documents.
missing body · string
name body · string
Scan name.
percents body · array
q body · string
FQL syntax.
ranges body · array
size body · integer
sort body · string
FQL syntax.
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import ODS


falcon = ODS(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )


date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.aggregate_scheduled_scans(date_ranges=date_ranges,
                                            exclude="string",
                                            field="string",
                                            filter="string",
                                            from=integer,
                                            include="string",
                                            interval="string",
                                            max_doc_count=integer,
                                            min_doc_count=integer,
                                            missing="string",
                                            name="string",
                                            q="string",
                                            ranges=ranges,
                                            size=integer,
                                            sort="string",
                                            sub_aggregates=["string"],
                                            time_zone="string",
                                            type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

cancel-scans

Section titled “cancel-scans”

Cancel ODS scans for the given scan ids.

Method POST
Route /ods/entities/scan-control-actions/cancel/v1
Scope On-demand scans (ODS): WRITE
PEP 8 cancel_scans

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
ids body · array
ID(s) of the scans to cancel.
Code Examples
from falconpy import ODS


falcon = ODS(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.cancel_scans(ids=id_list)
print(response)
Responses
[
  "string"
]

create-scan

Section titled “create-scan”

Create ODS scan and start or schedule scan for the given scan request.

Method POST
Route /ods/entities/scans/v1
Scope On-demand scans (ODS): WRITE
PEP 8 create_scan

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
cloud_ml_level_detection body · integer
ML detection level.
cloud_ml_level_prevention body · integer
ML prevention level.
cloud_pup_adware_level_detection body · integer
cloud_pup_adware_level_prevention body · integer
cpu_priority body · integer
Scan host CPU priority.
description body · string
Scan description.
endpoint_notification body · boolean
Flag indicating if the endpoint should be notified.
file_paths body · array
File paths to be scanned.
host_groups body · array
Host group IDs to scan.
hosts body · array
Host AIDs to scan.
initiated_from body · string
Endpoint the scan was initiated from.
mac_cloud_ml_level_detection body · integer
mac_cloud_ml_level_prevention body · integer
mac_cloud_pup_adware_level_detection body · integer
mac_cloud_pup_adware_level_prevention body · integer
mac_scan_exclusions body · array
mac_scan_inclusions body · array
mac_sensor_ml_level_detection body · integer
mac_sensor_ml_level_prevention body · integer
mac_sensor_pup_adware_level_detection body · integer
mac_sensor_pup_adware_level_prevention body · integer
max_duration body · integer
Maximum duration in seconds for the scan.
pause_duration body · integer
Time in seconds to pause during the scan.
quarantine body · boolean
Quarantine malicious files identified by the scan.
scan_exclusions body · array
List of file path globs to exclude from the scan.
scan_inclusions body · array
sensor_ml_level_detection body · integer
Endpoint sensor ML detection level.
sensor_ml_level_prevention body · integer
Endpoint sensor ML prevention level.
ignored_by_channelfile body · dictionary
Flag indicating if this scan is ignored by channelfiles. Overrides the value specified in the schedule.
interval body · dictionary
Scan schedule interval in seconds. Overrides the value specified in the schedule.
max_file_size body · integer
Maximum file size for files scanned.
start_timestamp body · dictionary
Starting timestamp for the scan. Overrides the value specified in the schedule.
Code Examples
from falconpy import ODS


falcon = ODS(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.create_scan(cloud_ml_level_detection=integer,
                              cloud_ml_level_prevention=integer,
                              cpu_priority=integer,
                              description="string",
                              endpoint_notification=boolean,
                              file_paths=id_list,
                              host_groups=id_list,
                              hosts=id_list,
                              ignored_by_channelfile={},
                              initiated_from="string",
                              interval={},
                              max_duration=integer,
                              max_file_size=integer,
                              pause_duration=integer,
                              quarantine=boolean,
                              scan_exclusions=id_list,
                              start_timestamp={},
                              sensor_ml_level_detection=integer,
                              sensor_ml_level_prevention=integer)
print(response)
Responses
[
  {
    "affected_hosts_count": 0,
    "cid": "string",
    "cloud_ml_level_detection": 0,
    "cloud_ml_level_prevention": 0,
    "cloud_pup_adware_level_detection": 0,
    "cloud_pup_adware_level_prevention": 0,
    "completed_host_count": 0,
    "cpu_priority": 0,
    "created_by": "string",
    "created_on": "string",
    "description": "string",
    "endpoint_notification": false,
    "file_paths": [],
    "filecount": {},
    "host_groups": [],
    "hosts": [],
    "hosts_created": false,
    "id": "string",
    "incomplete_host_count": 0,
    "initiated_from": "string",
    "last_updated": "string",
    "mac_cloud_ml_level_detection": 0,
    "mac_cloud_ml_level_prevention": 0,
    "mac_cloud_pup_adware_level_detection": 0,
    "mac_cloud_pup_adware_level_prevention": 0,
    "mac_policy_setting": [],
    "mac_scan_exclusions": [],
    "mac_scan_inclusions": [],
    "mac_sensor_ml_level_detection": 0,
    "mac_sensor_ml_level_prevention": 0,
    "mac_sensor_pup_adware_level_detection": 0,
    "mac_sensor_pup_adware_level_prevention": 0,
    "max_duration": 0,
    "metadata": [],
    "missing_host_count": 0,
    "not_started_host_count": 0,
    "pause_duration": 0,
    "policy_setting": [],
    "preemption_priority": 0,
    "profile_id": "string",
    "quarantine": false,
    "rollup_version": 0,
    "scan_completed_on": "string",
    "scan_exclusions": [],
    "scan_inclusions": [],
    "scan_scheduled_on": "string",
    "scan_started_on": "string",
    "sensor_ml_level_detection": 0,
    "sensor_ml_level_prevention": 0,
    "severity": 0,
    "started_host_count": 0,
    "status": "string",
    "targeted_host_count": 0,
    "targeted_platforms": []
  }
]

delete-scheduled-scans

Section titled “delete-scheduled-scans”

Delete ODS scheduled-scans for the given scheduled-scan ids.

Method DELETE
Route /ods/entities/scheduled-scans/v1
Scope On-demand scans (ODS): WRITE
PEP 8 delete_scheduled_scans

Parameters

Section titled “Parameters”
ids query · string or list of strings
The scan IDs to retrieve the scan entities
filter query · string
FQL compatible filter to use for selecting scan IDs.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import ODS


falcon = ODS(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.delete_scheduled_scans(filter="string", ids=id_list)
print(response)
Responses
[
  "string"
]

get-malicious-files-by-ids

Section titled “get-malicious-files-by-ids”

Get malicious files by ids.

Method GET
Route /ods/entities/malicious-files/v1
Scope On-demand scans (ODS): READ
PEP 8 get_malicious_files

Parameters

Section titled “Parameters”
ids query · string or list of strings
The scan IDs to retrieve the scan entities
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import ODS


falcon = ODS(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_malicious_files(ids=id_list)
print(response)
Responses
[
  {
    "cid": "string",
    "filename": "string",
    "filepath": "string",
    "hash": "string",
    "host_id": "string",
    "host_scan_id": "string",
    "id": "string",
    "last_updated": "string",
    "pattern_id": 0,
    "quarantined": false,
    "scan_id": "string",
    "severity": 0
  }
]

get-scan-host-metadata-by-ids

Section titled “get-scan-host-metadata-by-ids”

Get scan hosts by ids.

Method GET
Route /ods/entities/scan-hosts/v1
Scope On-demand scans (ODS): READ
PEP 8 get_scan_hosts

Parameters

Section titled “Parameters”
ids query · string or list of strings
The scan IDs to retrieve the scan entities
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import ODS


falcon = ODS(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_scan_hosts(ids=id_list)
print(response)
Responses
[
  {
    "cid": "string",
    "completed_on": "string",
    "filecount": {},
    "host_id": "string",
    "host_scan_id": "string",
    "id": "string",
    "last_updated": "string",
    "platform_name": "string",
    "profile_id": "string",
    "scan_control_reason": "string",
    "scan_id": "string",
    "severity": 0,
    "started_on": "string",
    "status": "string"
  }
]

get-scans-by-scan-ids

Section titled “get-scans-by-scan-ids”

Get Scans by IDs.

Method GET
Route /ods/entities/scans/v1
Scope On-demand scans (ODS): READ
PEP 8 get_scans

Parameters

Section titled “Parameters”
ids query · string or list of strings
The scan IDs to retrieve the scan entities
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import ODS


falcon = ODS(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_scans(ids=id_list)
print(response)
Responses
[
  {
    "affected_hosts_count": 0,
    "cid": "string",
    "cloud_ml_level_detection": 0,
    "cloud_ml_level_prevention": 0,
    "cloud_pup_adware_level_detection": 0,
    "cloud_pup_adware_level_prevention": 0,
    "completed_host_count": 0,
    "cpu_priority": 0,
    "created_by": "string",
    "created_on": "string",
    "description": "string",
    "endpoint_notification": false,
    "file_paths": [],
    "filecount": {},
    "host_groups": [],
    "hosts": [],
    "hosts_created": false,
    "id": "string",
    "incomplete_host_count": 0,
    "initiated_from": "string",
    "last_updated": "string",
    "mac_cloud_ml_level_detection": 0,
    "mac_cloud_ml_level_prevention": 0,
    "mac_cloud_pup_adware_level_detection": 0,
    "mac_cloud_pup_adware_level_prevention": 0,
    "mac_policy_setting": [],
    "mac_scan_exclusions": [],
    "mac_scan_inclusions": [],
    "mac_sensor_ml_level_detection": 0,
    "mac_sensor_ml_level_prevention": 0,
    "mac_sensor_pup_adware_level_detection": 0,
    "mac_sensor_pup_adware_level_prevention": 0,
    "max_duration": 0,
    "metadata": [],
    "missing_host_count": 0,
    "not_started_host_count": 0,
    "pause_duration": 0,
    "policy_setting": [],
    "preemption_priority": 0,
    "profile_id": "string",
    "quarantine": false,
    "rollup_version": 0,
    "scan_completed_on": "string",
    "scan_exclusions": [],
    "scan_inclusions": [],
    "scan_scheduled_on": "string",
    "scan_started_on": "string",
    "sensor_ml_level_detection": 0,
    "sensor_ml_level_prevention": 0,
    "severity": 0,
    "started_host_count": 0,
    "status": "string",
    "targeted_host_count": 0,
    "targeted_platforms": []
  }
]

get-scans-by-scan-ids-v2

Section titled “get-scans-by-scan-ids-v2”

Get Scans by IDs.

Method GET
Route /ods/entities/scans/v2
Scope On-demand scans (ODS): READ
PEP 8 get_scans

Parameters

Section titled “Parameters”
ids query · string or list of strings
The scan IDs to retrieve the scan entities
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import ODS


falcon = ODS(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_scans(ids=id_list)
print(response)
Responses
[
  {
    "affected_hosts_count": 0,
    "cid": "string",
    "cloud_ml_level_detection": 0,
    "cloud_ml_level_prevention": 0,
    "cloud_pup_adware_level_detection": 0,
    "cloud_pup_adware_level_prevention": 0,
    "completed_host_count": 0,
    "cpu_priority": 0,
    "created_by": "string",
    "created_on": "string",
    "description": "string",
    "endpoint_notification": false,
    "file_paths": [],
    "filecount": {},
    "host_groups": [],
    "hosts": [],
    "id": "string",
    "incomplete_host_count": 0,
    "initiated_from": "string",
    "last_updated": "string",
    "mac_cloud_ml_level_detection": 0,
    "mac_cloud_ml_level_prevention": 0,
    "mac_cloud_pup_adware_level_detection": 0,
    "mac_cloud_pup_adware_level_prevention": 0,
    "mac_file_paths": [],
    "mac_policy_setting": [],
    "mac_scan_exclusions": [],
    "mac_scan_inclusions": [],
    "mac_sensor_ml_level_detection": 0,
    "mac_sensor_ml_level_prevention": 0,
    "mac_sensor_pup_adware_level_detection": 0,
    "mac_sensor_pup_adware_level_prevention": 0,
    "max_duration": 0,
    "metadata": [],
    "missing_host_count": 0,
    "not_started_host_count": 0,
    "pause_duration": 0,
    "policy_setting": [],
    "preemption_priority": 0,
    "profile_id": "string",
    "quarantine": false,
    "scan_completed_on": "string",
    "scan_exclusions": [],
    "scan_inclusions": [],
    "scan_started_on": "string",
    "sensor_ml_level_detection": 0,
    "sensor_ml_level_prevention": 0,
    "severity": 0,
    "started_host_count": 0,
    "status": "string",
    "targeted_host_count": 0,
    "targeted_platforms": []
  }
]

get-scheduled-scans-by-scan-ids

Section titled “get-scheduled-scans-by-scan-ids”

Get ScheduledScans by IDs.

Method GET
Route /ods/entities/scheduled-scans/v1
Scope On-demand scans (ODS): READ
PEP 8 get_scheduled_scans

Parameters

Section titled “Parameters”
ids query · string or list of strings
The scan IDs to retrieve the scan entities
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import ODS


falcon = ODS(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_scheduled_scans(ids=id_list)
print(response)
Responses
[
  {
    "channel_file_status": 0,
    "cid": "string",
    "cloud_ml_level_detection": 0,
    "cloud_ml_level_prevention": 0,
    "cloud_pup_adware_level_detection": 0,
    "cloud_pup_adware_level_prevention": 0,
    "cpu_priority": 0,
    "created_by": "string",
    "created_on": "string",
    "deleted": false,
    "description": "string",
    "endpoint_notification": false,
    "file_paths": [],
    "host_groups": [],
    "hosts": [],
    "id": "string",
    "initiated_from": "string",
    "last_updated": "string",
    "mac_cloud_ml_level_detection": 0,
    "mac_cloud_ml_level_prevention": 0,
    "mac_cloud_pup_adware_level_detection": 0,
    "mac_cloud_pup_adware_level_prevention": 0,
    "mac_policy_setting": [],
    "mac_scan_exclusions": [],
    "mac_scan_inclusions": [],
    "mac_sensor_ml_level_detection": 0,
    "mac_sensor_ml_level_prevention": 0,
    "mac_sensor_pup_adware_level_detection": 0,
    "mac_sensor_pup_adware_level_prevention": 0,
    "max_duration": 0,
    "max_file_size": 0,
    "metadata": [],
    "pause_duration": 0,
    "policy_setting": [],
    "preemption_priority": 0,
    "quarantine": false,
    "scan_exclusions": [],
    "scan_inclusions": [],
    "schedule": {},
    "sensor_ml_level_detection": 0,
    "sensor_ml_level_prevention": 0,
    "status": "string",
    "targeted_host_count": 0,
    "targeted_platforms": []
  }
]

query-malicious-files

Section titled “query-malicious-files”

Query malicious files.

Method GET
Route /ods/queries/malicious-files/v1
Scope On-demand scans (ODS): READ
PEP 8 query_malicious_files

Parameters

Section titled “Parameters”
filter query · string
A FQL compatible query string. Terms:
Available values (11)
idscan_idhost_id
host_scan_idfilepathfilename
hashpattern_idseverity
quarantinedlast_updated
offset query · integer
Index of the starting resource
limit query · integer
The max number of resources to return
sort query · string
The property to sort by. (Ex: created_timestamp.desc)
Available values (18)
id|ascid|descscan_id|asc
scan_id|deschost_id|aschost_id|desc
host_scan_id|aschost_scan_id|descfilename|asc
filename|deschash|aschash|desc
pattern_id|ascpattern_id|descseverity|asc
severity|desclast_updated|asclast_updated|desc
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import ODS


falcon = ODS(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )


response = falcon.query_malicious_files(filter="string",
                                        limit=integer,
                                        offset=integer,
                                        sort="string")
print(response)
Responses
[
  "string"
]

query-scan-host-metadata

Section titled “query-scan-host-metadata”

Query scan hosts.

Method GET
Route /ods/queries/scan-hosts/v1
Scope On-demand scans (ODS): READ
PEP 8 query_scan_hosts

Parameters

Section titled “Parameters”
filter query · string
A FQL compatible query string. Terms:
Available values (16)
idprofile_idhost_id
scan_idhost_scan_idfilecount.scanned
filecount.maliciousfilecount.quarantinedfilecount.skipped
affected_hosts_countstatusseverity
completed_onstarted_onlast_updated
scan_control_reason
offset query · integer
Index of the starting resource
limit query · integer
The max number of resources to return
sort query · string
The property to sort by. (Ex: created_timestamp.desc)
Available values (26)
id|ascid|descscan_id|asc
scan_id|deschost_id|aschost_id|desc
filecount.scanned|ascfilecount.scanned|descfilecount.malicious|asc
filecount.malicious|descfilecount.quarantined|ascfilecount.quarantined|desc
filecount.skipped|ascfilecount.skipped|descstatus|asc
status|descseverity|ascseverity|desc
started_on|ascstarted_on|desccompleted_on|asc
completed_on|desclast_updated|asclast_updated|desc
scan_control_reason.keyword|ascscan_control_reason.keyword|desc
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import ODS


falcon = ODS(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )


response = falcon.query_scan_hosts(filter="string",
                                   limit=integer,
                                   offset=integer,
                                   sort="string")
print(response)
Responses
[
  "string"
]

query-scans

Section titled “query-scans”

Query Scans.

Method GET
Route /ods/queries/scans/v1
Scope On-demand scans (ODS): READ
PEP 8 query_scans

Parameters

Section titled “Parameters”
filter query · string
A FQL compatible query string. Terms:
Available values (21)
idprofile_iddescription.keyword
descriptioninitiated_fromfilecount.scanned
filecount.maliciousfilecount.quarantinedfilecount.skipped
affected_hosts_countstatusseverity
scan_started_onscan_completed_oncreated_on
created_bylast_updatedtargeted_host_count
missing_host_counttargeted_platformstargeted_platforms.keyword
offset query · integer
Index of the starting resource
limit query · integer
The max number of resources to return
sort query · string
The property to sort by. (Ex: created_timestamp.desc)
Available values (36)
id|ascid|descinitiated_from|asc
initiated_from|descdescription.keyword|ascdescription.keyword|desc
description|ascdescription|descfilecount.scanned|asc
filecount.scanned|descfilecount.malicious|ascfilecount.malicious|desc
filecount.quarantined|ascfilecount.quarantined|descfilecount.skipped|asc
filecount.skipped|descaffected_hosts_count|ascaffected_hosts_count|desc
status|ascstatus|descseverity|asc
severity|descscan_started_on|ascscan_started_on|desc
scan_completed_on|ascscan_completed_on|desccreated_on|asc
created_on|desccreated_by|asccreated_by|desc
last_updated|asclast_updated|desctargeted_host_count|asc
targeted_host_count|descmissing_host_count|ascmissing_host_count|desc
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import ODS


falcon = ODS(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )


response = falcon.query_scans(filter="string",
                              limit=integer,
                              offset=integer,
                              sort="string")
print(response)
Responses
[
  "string"
]

query-scheduled-scans

Section titled “query-scheduled-scans”

Query ScheduledScans.

Method GET
Route /ods/queries/scheduled-scans/v1
Scope On-demand scans (ODS): READ
PEP 8 query_scheduled_scans

Parameters

Section titled “Parameters”
filter query · string
A FQL compatible query string. Terms:
Available values (13)
iddescription.keyworddescription
initiated_fromstatusschedule.start_timestamp
schedule.Intervalcreated_oncreated_by
last_updateddeletedtargeted_platforms
channel_file_status
offset query · integer
Index of the starting resource
limit query · integer
The max number of resources to return
sort query · string
The property to sort by. (Ex: created_timestamp.desc)
Available values (24)
id|ascid|descdescription.keyword|asc
description.keyword|descdescription|ascdescription|desc
status|ascstatus|descschedule.start_timestamp|asc
schedule.start_timestamp|descschedule.interval|ascschedule.interval|desc
created_on|asccreated_on|desccreated_by|asc
created_by|desclast_updated|asclast_updated|desc
targeted_host_count|asctargeted_host_count|desctargeted_platforms|asc
targeted_platforms|descchannel_file_status|ascchannel_file_status|desc
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import ODS


falcon = ODS(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )


response = falcon.query_scheduled_scans(filter="string",
                                        limit=integer,
                                        offset=integer,
                                        sort="string")
print(response)
Responses
[
  "string"
]

scans-report

Section titled “scans-report”

Launch a scans report creation job

Method POST
Route /ods/entities/scans-reports/v1
Code Examples

Examples coming soon.

schedule-scan

Section titled “schedule-scan”

Create ODS scan and start or schedule scan for the given scan request.

Method POST
Route /ods/entities/scheduled-scans/v1
Scope On-demand scans (ODS): WRITE
PEP 8 schedule_scan

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
cloud_ml_level_detection body · integer
ML detection level.
cloud_ml_level_prevention body · integer
ML prevention level.
cloud_pup_adware_level_detection body · integer
cloud_pup_adware_level_prevention body · integer
cpu_priority body · integer
Scan host CPU priority.
description body · string
Scan description.
endpoint_notification body · boolean
Flag indicating if the endpoint should be notified.
file_paths body · array
File paths to be scanned.
host_groups body · array
Host group IDs to scan.
initiated_from body · string
Endpoint the scan was initiated from.
mac_cloud_ml_level_detection body · integer
mac_cloud_ml_level_prevention body · integer
mac_cloud_pup_adware_level_detection body · integer
mac_cloud_pup_adware_level_prevention body · integer
mac_scan_exclusions body · array
mac_scan_inclusions body · array
mac_sensor_ml_level_detection body · integer
mac_sensor_ml_level_prevention body · integer
mac_sensor_pup_adware_level_detection body · integer
mac_sensor_pup_adware_level_prevention body · integer
max_duration body · integer
Maximum duration in seconds for the scan.
max_file_size body · integer
Maximum file size for files scanned.
pause_duration body · integer
Time in seconds to pause during the scan.
quarantine body · boolean
Quarantine malicious files identified by the scan.
scan_exclusions body · array
List of file path globs to exclude from the scan.
scan_inclusions body · array
List of file path globs to include the scan.
schedule body · object
Details related to the scan schedule.
sensor_ml_level_detection body · integer
Endpoint sensor ML detection level.
sensor_ml_level_prevention body · integer
Endpoint sensor ML prevention level.
ignored_by_channelfile body · dictionary
Flag indicating if this scan is ignored by channelfiles. Overrides the value specified in the schedule.
interval body · dictionary
Scan schedule interval in seconds. Overrides the value specified in the schedule.
start_timestamp body · dictionary
Starting timestamp for the scan. Overrides the value specified in the schedule.
Code Examples
from falconpy import ODS


falcon = ODS(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


ignored_by_channelfile = true


interval = 0


schedule = {
    "ignored_by_channelfile": True,
    "interval": 0,
    "start_timestamp": "string"
}


start_timestamp = "string"


response = falcon.schedule_scan(cloud_ml_level_detection=integer,
                                cloud_ml_level_prevention=integer,
                                cpu_priority=integer,
                                description="string",
                                endpoint_notification=boolean,
                                file_paths=id_list,
                                host_groups=id_list,
                                ignored_by_channelfile=ignored_by_channelfile,
                                initiated_from="string",
                                interval=interval,
                                max_duration=integer,
                                max_file_size=integer,
                                pause_duration=integer,
                                quarantine=boolean,
                                scan_exclusions=id_list,
                                scan_inclusions=id_list,
                                schedule=schedule,
                                start_timestamp=start_timestamp,
                                sensor_ml_level_detection=integer,
                                sensor_ml_level_prevention=integer)
print(response)
Responses
[
  {
    "channel_file_status": 0,
    "cid": "string",
    "cloud_ml_level_detection": 0,
    "cloud_ml_level_prevention": 0,
    "cloud_pup_adware_level_detection": 0,
    "cloud_pup_adware_level_prevention": 0,
    "cpu_priority": 0,
    "created_by": "string",
    "created_on": "string",
    "deleted": false,
    "description": "string",
    "endpoint_notification": false,
    "file_paths": [],
    "host_groups": [],
    "hosts": [],
    "id": "string",
    "initiated_from": "string",
    "last_updated": "string",
    "mac_cloud_ml_level_detection": 0,
    "mac_cloud_ml_level_prevention": 0,
    "mac_cloud_pup_adware_level_detection": 0,
    "mac_cloud_pup_adware_level_prevention": 0,
    "mac_policy_setting": [],
    "mac_scan_exclusions": [],
    "mac_scan_inclusions": [],
    "mac_sensor_ml_level_detection": 0,
    "mac_sensor_ml_level_prevention": 0,
    "mac_sensor_pup_adware_level_detection": 0,
    "mac_sensor_pup_adware_level_prevention": 0,
    "max_duration": 0,
    "max_file_size": 0,
    "metadata": [],
    "pause_duration": 0,
    "policy_setting": [],
    "preemption_priority": 0,
    "quarantine": false,
    "scan_exclusions": [],
    "scan_inclusions": [],
    "schedule": {},
    "sensor_ml_level_detection": 0,
    "sensor_ml_level_prevention": 0,
    "status": "string",
    "targeted_host_count": 0,
    "targeted_platforms": []
  }
]
© 2026 CrowdStrike, Inc. All rights reserved. Privacy Notice Cookie Notice Terms of Use