Quick Scan Pro

The Quick Scan Pro service collection provides operations for uploading files for analysis and managing scan results. Upload files for deep analysis, launch scans, retrieve results, and query scan jobs using FQL filters.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
DeleteFile delete_file	Deletes file by its sha256 identifier.
DeleteScanResult delete_scan_result	Deletes the result of an QuickScan Pro scan.
GetScanResult get_scan_result	Gets the result of an QuickScan Pro scan.
LaunchScan launch_scan	Starts scanning a file uploaded through ‘/quickscanpro/entities/files/v1’.
QueryScanResults query_scan_results	FQL query specifying the filter parameters
UploadFileMixin0Mixin94 upload_file	Uploads a file to be further analyzed with QuickScan Pro.
UploadFileQuickScanPro upload_file	Uploads a file to be further analyzed with QuickScan Pro.

---

DeleteFile

Deletes file by its sha256 identifier.

Method DELETE

Route /quickscanpro/entities/files/v1

Scope QuickScan Pro: WRITE

PEP 8 delete_file

Parameters

ids query · string or list of strings

File’s SHA256

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_file(ids=id_list)
print(response)

Operation ID

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteFile(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteFile",
                          ids=id_list)
print(response)

PowerShell

Remove-FalconQuickScanFile -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/quick_scan_pro"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.QuickScanPro.DeleteFile(
    &quick_scan_pro.DeleteFileParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.quickScanPro.deleteFile(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::quick_scan_pro_api::delete_file;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_file(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::QuickScanPro.new

response = api.delete_file(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  "string"
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

DeleteScanResult

Deletes the result of an QuickScan Pro scan.

Method DELETE

Route /quickscanpro/entities/scans/v1

Scope QuickScan Pro: WRITE

PEP 8 delete_scan_result

Parameters

ids query · string or list of strings

Scan job IDs previously created by LaunchScan

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_scan_result(ids=id_list)
print(response)

Operation ID

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteScanResult(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteScanResult",
                          ids=id_list)
print(response)

PowerShell

Remove-FalconQuickScan -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/quick_scan_pro"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.QuickScanPro.DeleteScanResult(
    &quick_scan_pro.DeleteScanResultParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.quickScanPro.deleteScanResult(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::quick_scan_pro_api::delete_scan_result;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_scan_result(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::QuickScanPro.new

response = api.delete_scan_result(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  "string"
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

GetScanResult

Gets the result of an QuickScan Pro scan.

Method GET

Route /quickscanpro/entities/scans/v1

Scope QuickScan Pro: READ

PEP 8 get_scan_result

Parameters

ids query · string or list of strings

Scan job IDs previously created by LaunchScan

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_scan_result(ids=id_list)
print(response)

Operation ID

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetScanResult(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetScanResult",
                          ids=id_list)
print(response)

PowerShell

Get-FalconQuickScan -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/quick_scan_pro"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.QuickScanPro.GetScanResult(
    &quick_scan_pro.GetScanResultParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.quickScanPro.getScanResult(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::quick_scan_pro_api::get_scan_result;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_scan_result(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::QuickScanPro.new

response = api.get_scan_result(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "id": "string",
    "result": {},
    "scan": {}
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

LaunchScan

Starts scanning a file uploaded through ‘/quickscanpro/entities/files/v1’.

Method POST

Route /quickscanpro/entities/scans/v1

Scope QuickScan Pro: WRITE

PEP 8 launch_scan

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

resources body · array

sha256 body · string

SHA256 hash of the file to be scanned.

Code Examples

Python

PEP 8

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.launch_scan(sha256="string")
print(response)

Operation ID

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.LaunchScan(sha256="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "password": "string",
            "sha256": "string"
        }
    ]
}

response = falcon.command("LaunchScan", body=body_payload)
print(response)

PowerShell

New-FalconQuickScan -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/quick_scan_pro"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  password := "string"
  sha256 := "string"

  response, err := client.QuickScanPro.LaunchScan(
    &quick_scan_pro.LaunchScanParams{
      Body: &models.QuickscanproLaunchScanRequest{
        Resources: []interface{}{
          {
          Password: &password,
          Sha256: &sha256,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.quickScanPro.launchScan(
  {
    resources: [{
        password: "string",
        sha256: "string"
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::quick_scan_pro_api::launch_scan;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::QuickscanproLaunchScanRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = QuickscanproLaunchScanRequest {
        resources: vec![LaunchScanRequestResource {
            sha256: Some("string".to_string()),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = launch_scan(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::QuickScanPro.new

body = Falcon::QuickscanproLaunchScanRequest.new(
  resources: [{
      password: 'string',
      sha256: 'string'
    }]
)

response = api.launch_scan(body)

puts response

Responses

200 OK

[
  {
    "created_timestamp": "string",
    "id": "string",
    "sha256": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

QueryScanResults

FQL query specifying the filter parameters

Method GET

Route /quickscanpro/queries/scans/v1

Scope QuickScan Pro: READ

PEP 8 query_scan_results

Parameters

filter query · string

Empty value means to not filter on anything Available filter fields:

Available values (51)

mitre_attacks.description	sha256	id
status	type	entity
executor	verdict	verdict_reason
verdict_reasons	verdict_source	file_size
file_type	mime_type	adversary
file_type_short	first_content_bytes_hex	first_content_bytes_ascii
artifacts.file_artifacts.sha256	artifacts.file_artifacts.filename	artifacts.file_artifacts.verdict
artifacts.file_artifacts.verdict_reasons	artifacts.url_artifacts.url	artifacts.url_artifacts.verdict
artifacts.url_artifacts.verdict_reasons	mitre_attacks.attack_id	mitre_attacks.attack_id_wiki
mitre_attacks.tactic	mitre_attacks.technique	mitre_attacks.capec_id
mitre_attacks.parent.attack_id	mitre_attacks.parent.attack_id_wiki	mitre_attacks.parent.technique
static_indicators	malware_config.url	malware_config.domain
malware_config.ip	artifacts_tree.nodes.type	artifacts_tree.nodes.value
artifacts_tree.nodes.verdict	artifacts_tree.nodes.verdict_reasons	artifacts_tree.nodes.malware_family
artifacts_tree.nodes.adversary	artifacts_tree.nodes.properties.name	artifacts_tree.nodes.properties.repository
artifacts_tree.nodes.properties.version	yara_rules.rule_name	yara_rules.sha256
updated_timestamp	file_size	yara_rules.created_at

offset query · integer

The offset to start retrieving ids from.

limit query · integer

Maximum number of IDs to return. Max: 5000.

sort query · string

Sort order: asc or desc. Sort supported fields:

Available values (1)

created_timestamp

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.query_scan_results(filter="string",
                                     offset=integer,
                                     limit=integer,
                                     sort="string")
print(response)

Operation ID

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.QueryScanResults(filter="string",
                                   offset=integer,
                                   limit=integer,
                                   sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryScanResults",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

PowerShell

Get-FalconQuickScan -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/quick_scan_pro"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.QuickScanPro.QueryScanResults(
    &quick_scan_pro.QueryScanResultsParams{
      Filter: "string",
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.quickScanPro.queryScanResults(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::quick_scan_pro_api::query_scan_results;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_scan_results(
        &falcon.cfg,  // configuration
        "string",  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::QuickScanPro.new

response = api.query_scan_results('string')

puts response

Responses

200 OK

[
  "string"
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

UploadFileMixin0Mixin94

Uploads a file to be further analyzed with QuickScan Pro.

Method POST

Route /quickscanpro/entities/files/v1

Scope QuickScan Pro: WRITE

PEP 8 upload_file

Parameters

file body · file

Binary file to be uploaded. Max file size: 256 MB.

scan body · boolean

If true, after upload, it starts scanning immediately. Default scan mode is ‘false’

file_name body · string

Name of the file uploaded. Defaults to “UploadedFile”.

password body · string

MULTIPART ONLY - Password for encrypted archives (use for multipart/form-data uploads). If ‘scan’ is true, the value is used for the scan just starting.

x_file_password body · string

OCTET-STREAM ONLY - Password for encrypted archives (use for octet-stream uploads). If ‘scan’ is true, the value is used for the scan just starting.

Code Examples

Python

PEP 8

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.upload_file(file="string",
                              scan="string",
                              file_name="string",
                              password="string",
                              x_file_password="string")
print(response)

Operation ID

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.UploadFileMixin0Mixin94(file="string",
                                          scan="string",
                                          file_name="string",
                                          password="string",
                                          x_file_password="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("UploadFileMixin0Mixin94",
                          file_data=open("filename", "rb").read(),
                          scan=boolean)
print(response)

PowerShell

Send-FalconQuickScanFile -Path "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/quick_scan_pro"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  scan := boolean

  response, err := client.QuickScanPro.UploadFileMixin0Mixin93(
    &quick_scan_pro.UploadFileMixin0Mixin93Params{
      Scan: &scan,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.quickScanPro.uploadFileQuickScanPro(
  "string",  // uploadFileQuickScanProRequest
  "string",  // fileName
  "string"  // xFilePassword
);

console.log(response);

Rust

use rusty_falcon::apis::quick_scan_pro_api::upload_file_quick_scan_pro;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = upload_file_quick_scan_pro(
        &falcon.cfg,  // configuration
        models::UploadFileQuickScanProRequest { ..Default::default() },  // upload_file_quick_scan_pro_request
        Some("string"),  // file_name
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

Examples coming soon.

---

---

UploadFileQuickScanPro

Uploads a file to be further analyzed with QuickScan Pro.

Method POST

Route /quickscanpro/entities/files/v1

Scope QuickScan Pro: WRITE

PEP 8 upload_file

Parameters

file body · file

Binary file to be uploaded. Max file size: 256 MB. Use —data-binary @$FILE_PATH for octet-stream/cURL uploads

file_name query · string

OCTET-STREAM ONLY - Name of the file (required for octet-stream uploads).

scan body · boolean

If true, after upload, it starts scanning immediately. Default scan mode is ‘false’

password body · string

MULTIPART ONLY - Password for encrypted archives (use for multipart/form-data uploads). If ‘scan’ is true, the value is used for the scan just starting.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

x_file_password body · string

OCTET-STREAM ONLY - Password for encrypted archives (use for octet-stream uploads). If ‘scan’ is true, the value is used for the scan just starting.

Code Examples

Python

PEP 8

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.upload_file(file="string",
                              scan="string",
                              file_name="string",
                              password="string",
                              x_file_password="string")
print(response)

Operation ID

from falconpy import QuickScanPro

falcon = QuickScanPro(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.UploadFileQuickScanPro(file="string",
                                         scan="string",
                                         file_name="string",
                                         password="string",
                                         x_file_password="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("UploadFileQuickScanPro",
                          file_data=open("filename", "rb").read(),
                          file_name="string",
                          scan=boolean,
                          password="string")
print(response)

PowerShell

Send-FalconQuickScanFile -Path "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/quick_scan_pro"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  fileName := "string"
  scan := boolean
  password := "string"

  response, err := client.QuickScanPro.UploadFileMixin0Mixin93(
    &quick_scan_pro.UploadFileMixin0Mixin93Params{
      FileName: &fileName,
      Scan: &scan,
      Password: &password,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.quickScanPro.uploadFileQuickScanPro(
  "string",  // uploadFileQuickScanProRequest
  "string",  // fileName
  "string"  // xFilePassword
);

console.log(response);

Rust

use rusty_falcon::apis::quick_scan_pro_api::upload_file_quick_scan_pro;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = upload_file_quick_scan_pro(
        &falcon.cfg,  // configuration
        models::UploadFileQuickScanProRequest { ..Default::default() },  // upload_file_quick_scan_pro_request
        Some("string"),  // file_name
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::QuickScanPro.new

response = api.upload_file_quick_scan_pro('string')

puts response

Responses

200 OK

[
  {
    "scan_id": "string",
    "sha256": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}