Report Executions

The Report Executions service collection provides operations for managing scheduled report execution instances. Download generated reports, retry failed executions, retrieve execution details, and query for report execution IDs using Falcon Query Language filters.

Language	Last Update
Python	v1.4.6
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

Operation	Description
report_executions_download_get `get_download`	Get report entity download
report_executions_retry `retry_reports`	Retry the execution of a report by ID.
report_executions_get `get_reports`	Retrieve report details for the provided report IDs.
report_executions_query `query_reports`	Find all report execution IDs matching the query with filter

report_executions_download_get

Get report entity download

GET /reports/entities/report-executions-download/v1

Scope Scheduled Reports: READ Consumes · Produces application/json application/octet-stream

PEP 8 get_download

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The report_execution id to download.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import ReportExecutions

falcon = ReportExecutions(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_download(ids=id_list)
print(response)

from falconpy import ReportExecutions

falcon = ReportExecutions(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.report_executions_download_get(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("report_executions_download_get",
                          ids="string")
print(response)

Receive-FalconScheduledReport -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/report_executions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ReportExecutions.ReportExecutionsDownloadGet(
    &report_executions.ReportExecutionsDownloadGetParams{
      Ids: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.reportExecutions.reportExecutionsDownloadGet("string");  // ids

console.log(response);

use rusty_falcon::apis::report_executions_api::report_executions_download_get;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = report_executions_download_get(
        &falcon.cfg,  // configuration
        "string",  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ReportExecutions.new

response = api.report_executions_download_get('string')

puts response

report_executions_retry

Retry the execution of a report by ID.

POST /reports/entities/report-executions-retry/v1

Scope Scheduled Reports: READ Consumes · Produces application/json

PEP 8 retry_reports

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The report_execution ID(s) to retry execution.
body	query	dictionary	Full body payload in JSON format.

Code Examples

from falconpy import ReportExecutions

falcon = ReportExecutions(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.retry_reports(ids=id_list)
print(response)

from falconpy import ReportExecutions

falcon = ReportExecutions(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.report_executions_retry(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = [
    {
        "id": "string"
    }
]

response = falcon.command("report_executions_retry", body=body_payload)
print(response)

Redo-FalconScheduledReport -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/report_executions"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  id := "string"

  response, err := client.ReportExecutions.ReportExecutionsRetry(
    &report_executions.ReportExecutionsRetryParams{
      Body: []*models.DomainReportExecutionRetryRequestV1{
        {
          ID: &id,
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.reportExecutions.reportExecutionsRetry(
  [{
    id: "string"
}]  // body
);

console.log(response);

use rusty_falcon::apis::report_executions_api::report_executions_retry;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainReportExecutionRetryRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = vec![DomainReportExecutionRetryRequestV1 {
            id: Some("string".to_string()),
            ..Default::default()
        }];

    let response = report_executions_retry(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ReportExecutions.new

body = [Falcon::DomainReportExecutionRetryRequestV1.new(
  id: 'string'
)]

response = api.report_executions_retry(body)

puts response

report_executions_get

Retrieve report details for the provided report IDs.

GET /reports/entities/report-executions/v1

Scope Scheduled Reports: READ Consumes · Produces application/json

PEP 8 get_reports

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The report_execution id to get details about.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import ReportExecutions

falcon = ReportExecutions(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_reports(ids=id_list)
print(response)

from falconpy import ReportExecutions

falcon = ReportExecutions(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.report_executions_get(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("report_executions_get",
                          ids=id_list)
print(response)

Get-FalconScheduledReport -Id @("ID1", "ID2") -Execution $boolean

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/report_executions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ReportExecutions.ReportExecutionsGet(
    &report_executions.ReportExecutionsGetParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.reportExecutions.reportExecutionsGet(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::report_executions_api::report_executions_get;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = report_executions_get(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ReportExecutions.new

response = api.report_executions_get(['ID1', 'ID2', 'ID3'])

puts response

report_executions_query

Find all report execution IDs matching the query with filter

GET /reports/queries/report-executions/v1

Scope Scheduled Reports: READ Consumes · Produces application/json

PEP 8 query_reports

Parameters

Name	Type	Data type	Description
filter	query	string	FQL query specifying the filter parameters. Filter term criteria: type, scheduled_report_id, status. Filter range criteria: created_on, last_updated_on, expiration_on; use any common date format, such as ‘2010-05-15T14:55:21.892315096Z’.
limit	query	integer	Number of ids to return.
offset	query	string	Starting index of overall result set from which to return ids.
parameters	query	dictionary	Full query string parameters payload in JSON format.
q	query	string	Match query criteria, which includes all the filter string fields.
sort	query	string	Possible order by fields: created_on, last_updated_on.

Code Examples

from falconpy import ReportExecutions

falcon = ReportExecutions(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.query_reports(filter="string",
                                limit="string",
                                offset=integer,
                                q="string",
                                sort="string")
print(response)

from falconpy import ReportExecutions

falcon = ReportExecutions(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.report_executions_query(filter="string",
                                          limit="string",
                                          offset=integer,
                                          q="string",
                                          sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("report_executions_query",
                          sort="string",
                          filter="string",
                          q="string",
                          offset="string",
                          limit=integer)
print(response)

Get-FalconScheduledReport -Filter "string" `
  -Query "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer `
  -Execution $boolean

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/report_executions"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  sort := "string"
  filter := "string"
  q := "string"
  offset := "string"
  limit := int64(0)

  response, err := client.ReportExecutions.ReportExecutionsQuery(
    &report_executions.ReportExecutionsQueryParams{
      Sort: &sort,
      Filter: &filter,
      Q: &q,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.reportExecutions.reportExecutionsQuery(
  "string",  // sort
  "string",  // filter
  "string",  // q
  "string",  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::report_executions_api::report_executions_query;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = report_executions_query(
        &falcon.cfg,  // configuration
        Some("string"),  // sort
        Some("string"),  // filter
        Some("string"),  // q
        Some("string"),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ReportExecutions.new

response = api.report_executions_query(sort: 'string',
                                       filter: 'string',
                                       q: 'string',
                                       offset: 'string',
                                       limit: integer)

puts response

Report Executions

Table of Contents

report_executions_download_get

Parameters

Code Examples

report_executions_retry

Parameters

Code Examples

report_executions_get

Parameters

Code Examples

report_executions_query

Parameters

Code Examples