Skip to content
CrowdStrike Developer Center

Quick Scan

The Quick Scan service collection provides operations for submitting files for machine learning scanning and retrieving scan results. Get scan aggregations, check scan status, submit sample volumes for ML scanning, and query submitted scans using FQL filters.

LanguageLast Update
Pythonv1.4.6
PowerShellv2.2.9
Gov0.20.0
TypeScriptv0.6.0
Rustv0.7.0
Rubyv1.2.0

This service collection has code examples posted to the repository.

Table of Contents

Section titled “Table of Contents”
OperationDescription
GetScansAggregates
get_scans_aggregates		Get scans aggregations as specified via json in request body.
GetScans
get_scans		Check the status of a volume scan. Time required for analysis increases with the number of samples in a volume but usually it should take less than 1 minute
ScanSamples
scan_samples		Submit a volume of files for ml scanning. Time required for analysis increases with the number of samples in a volume but usually it should take less than 1 minute
QuerySubmissionsMixin0
query_submissions		Find IDs for submitted scans by providing a FQL filter and paging details. Returns a set of volume IDs that match your criteria.

GetScansAggregates

Section titled “GetScansAggregates”

Get scans aggregations as specified via json in request body.

POST /scanner/aggregates/scans/GET/v1
Scope Quick Scan: READ Consumes · Produces application/json
PEP 8 get_scans_aggregates

Parameters

Section titled “Parameters”
NameTypeData typeDescription
bodybodydictionaryFull body payload in JSON format.
date_rangesbodylist of dictionariesApplies to date_range aggregations. Example: [{“from”: “2016-05-28T09:00:31Z”,“to”: “2016-05-30T09:00:31Z”},{“from”: “2016-06-01T09:00:31Z”,“to”: “2016-06-10T09:00:31Z”}]
fieldbodystringThe field on which to compute the aggregation.
filterbodystringFQL syntax formatted string to use to filter the results.
intervalbodystringTime interval for date histogram aggregations. Valid values include: year, month, week, day, hour, minute
min_doc_countbodyintegerOnly return buckets if values are greater than or equal to the value here.
missingbodystringMissing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value.
namebodystringName of the aggregate query, as chosen by the user. Used to identify the results returned to you.
qbodystringFull text search across all metadata fields.
rangesbodylist of dictionariesApplies to range aggregations. Ranges values will depend on field. For example, if max_severity is used, ranges might look like: [{“From”: 0,“To”: 70},{“From”: 70,“To”: 100}]
sizebodyintegerThe max number of term buckets to be returned.
sub_aggregatesbodylist of dictionariesA nested aggregation, such as: [{“name”: “max_first_behavior”,“type”: “max”,“field”: “first_behavior”}]. There is a maximum of 3 nested aggregations per request.
sortbodystringFQL syntax string to sort bucket results. _count - sort by document count, _term - sort by the string value alphabetically. Supports asc and desc using | format. Example: _count|desc
time_zonebodystringTime zone for bucket results.
typebodystringType of aggregation. Valid values include:
  • date_histogram - Aggregates counts on a specified time interval. Requires use of “interval” field.
  • date_range - Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
  • terms - Buckets detections by the value of a specified field. For example, if field used is scenario, then detections will be bucketed by the various detection scenario names.
  • range - Buckets detections by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the detects will be counted by the specified ranges of severity.
  • cardinality - Returns the count of distinct values in a specified field.
  • max - Returns the maximum value of a specified field.
  • min - Returns the minimum value of a specified field.
  • avg - Returns the average value of the specified field.
  • sum - Returns the total sum of all values for the specified field.
  • percentiles - Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.

Code Examples

Section titled “Code Examples”
from falconpy import QuickScan


falcon = QuickScan(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )


date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]


ranges = [
    {
        "From": 0,
        "To": 0
    }
]


response = falcon.get_scans_aggregates(date_ranges=date_ranges,
                                       field="string",
                                       filter="string",
                                       interval="string",
                                       min_doc_count=integer,
                                       missing="string",
                                       name="string",
                                       q="string",
                                       ranges=ranges,
                                       size=integer,
                                       sort="string",
                                       sub_aggregates=["string"],
                                       time_zone="string",
                                       type="string")
print(response)

GetScans

Section titled “GetScans”

Check the status of a volume scan. Time required for analysis increases with the number of samples in a volume but usually it should take less than 1 minute

GET /scanner/entities/scans/v1
Scope Quick Scan: READ Consumes · Produces application/json
PEP 8 get_scans

Parameters

Section titled “Parameters”
NameTypeData typeDescription
idsquerystring or list of stringsID of a submitted scan to retrieve.
parametersquerydictionaryFull query string parameters payload in JSON format.

Code Examples

Section titled “Code Examples”
from falconpy import NetworkScanScans


falcon = NetworkScanScans(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_scans(ids=id_list)
print(response)

ScanSamples

Section titled “ScanSamples”

Submit a volume of files for ml scanning. Time required for analysis increases with the number of samples in a volume but usually it should take less than 1 minute

POST /scanner/entities/scans/v1
Scope Quick Scan: WRITE Consumes · Produces application/json
PEP 8 scan_samples

Parameters

Section titled “Parameters”
NameTypeData typeDescription
bodybodydictionaryFull body payload in JSON format.
samplesbodystring or list of stringsSubmit a batch of SHA256s for ml scanning. The samples must have been previously uploaded through UploadSampleV3.

Code Examples

Section titled “Code Examples”
from falconpy import QuickScan


falcon = QuickScan(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )


response = falcon.scan_samples(samples="string")
print(response)

QuerySubmissionsMixin0

Section titled “QuerySubmissionsMixin0”

Find IDs for submitted scans by providing a FQL filter and paging details. Returns a set of volume IDs that match your criteria.

GET /scanner/queries/scans/v1
Scope Quick Scan: READ Consumes · Produces application/json
PEP 8 query_submissions

Parameters

Section titled “Parameters”
NameTypeData typeDescription
filterquerystringOptional filter and sort criteria in the form of an FQL query. Additional information about FQL queries can also be found in here (Customer login required).
limitqueryintegerMaximum number of volume IDs to return. Max: 5000.
offsetquerystringThe offset to start retrieving submissions from.
sortquerystringSort order: asc or desc.
parametersquerydictionaryFull query string parameters payload in JSON format.

Code Examples

Section titled “Code Examples”
from falconpy import QuickScan


falcon = QuickScan(client_id=CLIENT_ID,
                   client_secret=CLIENT_SECRET
                   )


response = falcon.query_submissions(filter="string",
                                    limit=integer,
                                    offset=integer,
                                    sort="string")
print(response)
© 2026 CrowdStrike, Inc. All rights reserved. Privacy Notice Cookie Notice Terms of Use