Quick Scan Pro
The Quick Scan Pro service collection provides operations for uploading files for analysis and managing scan results. Upload files for deep analysis, launch scans, retrieve results, and query scan jobs using FQL filters.
| Language | Last Update |
|---|---|
| Python | v1.6.1 |
| PowerShell | v2.2.9 |
| Go | v0.20.0 |
| TypeScript | v0.6.0 |
| Rust | v0.7.0 |
| Ruby | v1.2.0 |
Table of Contents
Section titled “Table of Contents”| Operation | Description |
|---|---|
UploadFileQuickScanProupload_file | Uploads a file to be further analyzed with QuickScan Pro. The samples expire after 90 days. |
DeleteFiledelete_file | Deletes file by its sha256 identifier. |
GetScanResultget_scan_result | Gets the result of an QuickScan Pro scan. |
LaunchScanlaunch_scan | Starts scanning a file uploaded through UploadFileQuickScanPro. |
DeleteScanResultdelete_scan_result | Deletes the result of an QuickScan Pro scan. |
QueryScanResultsquery_scan_results | Gets QuickScan Pro scan jobs for a given FQL filter. |
UploadFileQuickScanPro
Section titled “UploadFileQuickScanPro”Uploads a file to be further analyzed with QuickScan Pro. The samples expire after 90 days.
POST /quickscanpro/entities/files/v1
PEP 8
upload_fileParameters
Section titled “Parameters”| Name | Type | Data type | Description |
|---|---|---|---|
| file | formData | file | Binary file to be uploaded. Max file size: 256 MB. |
| file_name | query | string | Name of the file being uploaded. |
| scan | formData | boolean | If True, after upload, it starts scanning immediately. Default scan mode is False. |
| password | formData | string | MULTIPART ONLY - Password for encrypted archives (use for multipart/form-data uploads). If scan is true, the value is used for the scan just starting. |
| x_file_password | header | string | OCTET-STREAM ONLY - Password for encrypted archives (use for octet-stream uploads). If scan is true, the value is used for the scan just starting. |
Code Examples
Section titled “Code Examples”from falconpy import QuickScanPro
falcon = QuickScanPro(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.upload_file(file="string", scan="string", file_name="string", password="string", x_file_password="string")print(response)from falconpy import QuickScanPro
falcon = QuickScanPro(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.UploadFileQuickScanPro(file="string", scan="string", file_name="string", password="string", x_file_password="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("UploadFileQuickScanPro", file_data=open("filename", "rb").read(), file_name="string", scan=boolean, password="string")print(response)Send-FalconQuickScanFile -Path "string"package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/quick_scan_pro")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
fileName := "string" scan := boolean password := "string"
response, err := client.QuickScanPro.UploadFileMixin0Mixin93( &quick_scan_pro.UploadFileMixin0Mixin93Params{ FileName: &fileName, Scan: &scan, Password: &password, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.quickScanPro.uploadFileQuickScanPro( "string", // uploadFileQuickScanProRequest "string", // fileName "string" // xFilePassword);
console.log(response);use rusty_falcon::apis::quick_scan_pro_api::upload_file_quick_scan_pro;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = upload_file_quick_scan_pro( &falcon.cfg, // configuration models::UploadFileQuickScanProRequest { ..Default::default() }, // upload_file_quick_scan_pro_request Some("string"), // file_name ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::QuickScanPro.new
response = api.upload_file_quick_scan_pro('string')
puts responseDeleteFile
Section titled “DeleteFile”Deletes file by its SHA256 identifier.
DELETE /quickscanpro/entities/files/v1
PEP 8
delete_fileParameters
Section titled “Parameters”| Name | Type | Data type | Description |
|---|---|---|---|
| ids | query | string or list of strings | File’s SHA256. |
| parameters | query | dictionary | Full query string parameters payload in JSON format. |
Code Examples
Section titled “Code Examples”from falconpy import QuickScanPro
falcon = QuickScanPro(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.delete_file(ids=id_list)print(response)from falconpy import QuickScanPro
falcon = QuickScanPro(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.DeleteFile(ids=id_list)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("DeleteFile", ids=id_list)print(response)Remove-FalconQuickScanFile -Id "string"package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/quick_scan_pro")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.QuickScanPro.DeleteFile( &quick_scan_pro.DeleteFileParams{ Ids: []string{"ID1", "ID2", "ID3"}, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.quickScanPro.deleteFile(["ID1", "ID2", "ID3"]); // ids
console.log(response);use rusty_falcon::apis::quick_scan_pro_api::delete_file;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = delete_file( &falcon.cfg, // configuration vec!["string".to_string()], // ids ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::QuickScanPro.new
response = api.delete_file(['ID1', 'ID2', 'ID3'])
puts responseGetScanResult
Section titled “GetScanResult”Gets the result of an QuickScan Pro scan.
GET /quickscanpro/entities/scans/v1
PEP 8
get_scan_resultParameters
Section titled “Parameters”| Name | Type | Data type | Description |
|---|---|---|---|
| ids | query | string or list of strings | Scan job IDs previously created by LaunchScan. |
| parameters | query | dictionary | Full query string parameters payload in JSON format. |
Code Examples
Section titled “Code Examples”from falconpy import QuickScanPro
falcon = QuickScanPro(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_scan_result(ids=id_list)print(response)from falconpy import QuickScanPro
falcon = QuickScanPro(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.GetScanResult(ids=id_list)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("GetScanResult", ids=id_list)print(response)Get-FalconQuickScan -Id @("ID1", "ID2")package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/quick_scan_pro")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.QuickScanPro.GetScanResult( &quick_scan_pro.GetScanResultParams{ Ids: []string{"ID1", "ID2", "ID3"}, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.quickScanPro.getScanResult(["ID1", "ID2", "ID3"]); // ids
console.log(response);use rusty_falcon::apis::quick_scan_pro_api::get_scan_result;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = get_scan_result( &falcon.cfg, // configuration vec!["string".to_string()], // ids ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::QuickScanPro.new
response = api.get_scan_result(['ID1', 'ID2', 'ID3'])
puts responseLaunchScan
Section titled “LaunchScan”Starts scanning a file uploaded through ‘/quickscanpro/entities/files/v1’.
POST /quickscanpro/entities/scans/v1
PEP 8
launch_scanParameters
Section titled “Parameters”| Name | Type | Data type | Description |
|---|---|---|---|
| body | body | dictionary | Full body payload in JSON format. |
| sha256 | body | string | Full body payload in JSON format. |
Code Examples
Section titled “Code Examples”from falconpy import QuickScanPro
falcon = QuickScanPro(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.launch_scan(sha256="string")print(response)from falconpy import QuickScanPro
falcon = QuickScanPro(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.LaunchScan(sha256="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
body_payload = { "resources": [ { "password": "string", "sha256": "string" } ]}
response = falcon.command("LaunchScan", body=body_payload)print(response)New-FalconQuickScan -Id "string"package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/quick_scan_pro" "github.com/crowdstrike/gofalcon/falcon/models")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
password := "string" sha256 := "string"
response, err := client.QuickScanPro.LaunchScan( &quick_scan_pro.LaunchScanParams{ Body: &models.QuickscanproLaunchScanRequest{ Resources: []interface{}{ { Password: &password, Sha256: &sha256, }, }, }, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.quickScanPro.launchScan( { resources: [{ password: "string", sha256: "string" }]} // body);
console.log(response);use rusty_falcon::apis::quick_scan_pro_api::launch_scan;use rusty_falcon::easy::client::FalconHandle;use rusty_falcon::models::QuickscanproLaunchScanRequest;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let body = QuickscanproLaunchScanRequest { resources: vec![LaunchScanRequestResource { sha256: Some("string".to_string()), ..Default::default() }], ..Default::default() };
let response = launch_scan( &falcon.cfg, // configuration body, // body ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::QuickScanPro.new
body = Falcon::QuickscanproLaunchScanRequest.new( resources: [{ password: 'string', sha256: 'string' }])
response = api.launch_scan(body)
puts responseDeleteScanResult
Section titled “DeleteScanResult”Deletes the result of an QuickScan Pro scan.
DELETE /quickscanpro/entities/scans/v1
PEP 8
delete_scan_resultParameters
Section titled “Parameters”| Name | Type | Data type | Description |
|---|---|---|---|
| ids | query | string or list of strings | Scan job IDs previously created by LaunchScan. |
| parameters | query | dictionary | Full query string parameters payload in JSON format. |
Code Examples
Section titled “Code Examples”from falconpy import QuickScanPro
falcon = QuickScanPro(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.delete_scan_result(ids=id_list)print(response)from falconpy import QuickScanPro
falcon = QuickScanPro(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.DeleteScanResult(ids=id_list)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("DeleteScanResult", ids=id_list)print(response)Remove-FalconQuickScan -Id @("ID1", "ID2")package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/quick_scan_pro")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.QuickScanPro.DeleteScanResult( &quick_scan_pro.DeleteScanResultParams{ Ids: []string{"ID1", "ID2", "ID3"}, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.quickScanPro.deleteScanResult(["ID1", "ID2", "ID3"]); // ids
console.log(response);use rusty_falcon::apis::quick_scan_pro_api::delete_scan_result;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = delete_scan_result( &falcon.cfg, // configuration vec!["string".to_string()], // ids ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::QuickScanPro.new
response = api.delete_scan_result(['ID1', 'ID2', 'ID3'])
puts responseQueryScanResults
Section titled “QueryScanResults”Gets QuickScan Pro scan jobs for a given FQL filter.
GET /quickscanpro/queries/scans/v1
PEP 8
query_scan_resultsParameters
Section titled “Parameters”| Name | Type | Data type | Description |
|---|---|---|---|
| filter | query | string | Required. FQL query which mentions the SHA256 field. Empty value means to not filter on anything. Available filter fields that support match (~): _all, mitre_attacks.description. Available filter fields that support exact match: cid, sha256, id, status, type, entity, executor, verdict, verdict_reason, verdict_source, file_size, file_type_short, artifacts.file_artifacts.sha256, artifacts.file_artifacts.filename, artifacts.file_artifacts.verdict, artifacts.file_artifacts.verdict_reasons, artifacts.url_artifacts.url, artifacts.url_artifacts.verdict, artifacts.url_artifacts.verdict_reasons, mitre_attacks.attack_id, mitre_attacks.attack_id_wiki, mitre_attacks.tactic, mitre_attacks.technique, mitre_attacks.capec_id, mitre_attacks.parent.attack_id, mitre_attacks.parent.attack_id_wiki, mitre_attacks.parent.technique. Available filter fields that support wildcard (*): mitre_attacks.description. Available filter fields that support range comparisons (>, <, >=, <=): created_timestamp, updated_timestamp, file_size. All filter fields and operations support negation (!). _all field is used to search between all fields. |
| offset | query | integer | The offset to start retrieving ids from. |
| limit | query | integer | Maximum number of IDs to return. Max: 5000. Default: 50. |
| sort | query | string | Sort order: asc or desc. Sort supported fields created_timestamp. |
| parameters | query | dictionary | Full query string parameters payload in JSON format. |
Code Examples
Section titled “Code Examples”from falconpy import QuickScanPro
falcon = QuickScanPro(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.query_scan_results(filter="string", offset=integer, limit=integer, sort="string")print(response)from falconpy import QuickScanPro
falcon = QuickScanPro(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.QueryScanResults(filter="string", offset=integer, limit=integer, sort="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("QueryScanResults", filter="string", offset=integer, limit=integer, sort="string")print(response)Get-FalconQuickScan -Filter "string" ` -Sort "string" ` -Limit integer ` -Offset integerpackage main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/quick_scan_pro")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
offset := int64(0) limit := int64(0) sort := "string"
response, err := client.QuickScanPro.QueryScanResults( &quick_scan_pro.QueryScanResultsParams{ Filter: "string", Offset: &offset, Limit: &limit, Sort: &sort, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.quickScanPro.queryScanResults( "string", // filter integer, // offset integer, // limit "string" // sort);
console.log(response);use rusty_falcon::apis::quick_scan_pro_api::query_scan_results;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = query_scan_results( &falcon.cfg, // configuration "string", // filter Some(integer), // offset Some(integer), // limit Some("string"), // sort ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::QuickScanPro.new
response = api.query_scan_results('string')
puts response