Sample Uploads

The Sample Uploads service collection provides operations for uploading and managing sample files for cloud analysis. Upload archives and individual samples, manage extraction operations, retrieve uploaded samples, and delete files when no longer needed.

Language	Last Update
Python	v1.5.0
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

This service collection has code examples posted to the repository.

Operation	Description
ArchiveListV1 `list_archive`	Retrieves the archives files in chunks.
ArchiveGetV1 `get_archive`	Retrieves the archives upload operation statuses. Status `done` means that archive was processed successfully. Status `error` means that archive was not processed successfully.
ArchiveUploadV1 `archive_upload_v1`	Uploads an archive and extracts files list from it. Operation is asynchronous. deprecated
ArchiveDeleteV1 `delete_archive`	Delete an archive that was uploaded previously.
ArchiveUploadV2 `upload_archive`	Uploads an archive and extracts files list from it. Operation is asynchronous.
ExtractionListV1 `list_extraction`	Retrieves the files extractions in chunks.
ExtractionGetV1 `get_extraction`	Retrieves the files extraction operation statuses.
ExtractionCreateV1 `create_extraction`	Extracts files from an uploaded archive and copies them to internal storage making it available for content analysis.
GetSampleV3 `get_sample`	Retrieves the file associated with the given ID (SHA256).
UploadSampleV3 `upload_sample`	Upload a file for further cloud analysis. After uploading, call the specific analysis API endpoint.
DeleteSampleV3 `delete_sample`	Removes a sample, including file, meta and submissions from the collection.

ArchiveListV1

Retrieves the archives files in chunks.

GET /archives/entities/archive-files/v1

Scope Sample Uploads: READ Consumes · Produces application/json

PEP 8 list_archive

Parameters

Name	Type	Data type	Description
id	query	string	The archive SHA256.
parameters	query	dictionary	Full query string parameters payload in JSON format.
limit	query	integer	Maximum number of files to retrieve. (Default: 100)
offset	query	string	Offset from where to retrieve files.

Code Examples

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.list_archive(id="string", limit=integer, offset="string")
print(response)

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.ArchiveListV1(id="string", limit=integer, offset="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ArchiveListV1",
                          id="string",
                          limit=integer,
                          offset="string")
print(response)

Get-FalconSampleArchive -Id "string" -FileList $boolean

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sample_uploads"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := "string"

  response, err := client.SampleUploads.ArchiveListV1(
    &sample_uploads.ArchiveListV1Params{
      ID: "string",
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sampleUploads.archiveListV1(
  "string",  // id
  integer,  // limit
  "string"  // offset
);

console.log(response);

use rusty_falcon::apis::sample_uploads_api::archive_list_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = archive_list_v1(
        &falcon.cfg,  // configuration
        "string",  // id
        Some(integer),  // limit
        Some("string"),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SampleUploads.new

response = api.archive_list_v1('string')

puts response

ArchiveGetV1

Retrieves the archives upload operation statuses. Status done means that archive was processed successfully. Status error means that archive was not processed successfully.

GET /archives/entities/archives/v1

Scope Sample Uploads: READ Consumes · Produces application/json

PEP 8 get_archive

Parameters

Name	Type	Data type	Description
id	query	string	The archive SHA256.
parameters	query	dictionary	Full query string parameters payload in JSON format.
include_files	query	boolean	If `true` includes processed archive files in response.

Code Examples

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.get_archive(id="string", include_files=boolean)
print(response)

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.ArchiveGetV1(id="string", include_files=boolean)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ArchiveGetV1",
                          id="string",
                          include_files=boolean)
print(response)

Get-FalconSampleArchive -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sample_uploads"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  includeFiles := boolean

  response, err := client.SampleUploads.ArchiveGetV1(
    &sample_uploads.ArchiveGetV1Params{
      ID: "string",
      IncludeFiles: &includeFiles,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sampleUploads.archiveGetV1(
  "string",  // id
  boolean  // includeFiles
);

console.log(response);

use rusty_falcon::apis::sample_uploads_api::archive_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = archive_get_v1(
        &falcon.cfg,  // configuration
        "string",  // id
        Some(boolean),  // include_files
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SampleUploads.new

response = api.archive_get_v1('string')

puts response

ArchiveUploadV1

Uploads an archive and extracts files list from it. Operation is asynchronous use ArchiveGetV1 to check the status. After uploading, use ExtractionCreateV1 to copy the file to internal storage making it available for content analysis.

deprecated This method is deprecated in favor of ArchiveUploadV2.

POST /archives/entities/archives/v1

Scope Sample Uploads: WRITE Consumes application/octet-stream Produces application/json

PEP 8 archive_upload_v1

Parameters

Name	Type	Data type	Description
body	body	dictionary	Content of the uploaded archive in binary format. The keywords `file_data`, `sample`, and `upfile` will also be accepted for this argument. Max file size: 100 MB. Accepted file formats: `zip`, `7z`.
comment	query	string	A descriptive comment to identify the file for other users.
is_confidential	query	boolean	Defines visibility of this file, either via the API or the Falcon console. `true`: File is only show to users within your customer account. `false`: File can be seen by other CrowdStrike customers. Defaults to `true`.
name	query	string	Name of the archive.
parameters	query	dictionary	Full query string parameters payload in JSON format.
password	query	string	Archive password.

Code Examples

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.upload_archive_v1(comment="string",
                                    name="string",
                                    file_type="string",
                                    is_confidential="string",
                                    password="string")
print(response)

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.ArchiveUploadV1(comment="string",
                                  name="string",
                                  file_type="string",
                                  is_confidential="string",
                                  password="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ArchiveUploadV1", name="string", password="string", is_confidential=boolean, comment="string", body={})
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sample_uploads"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  password := "string"
  isConfidential := boolean
  comment := "string"

  response, err := client.SampleUploads.ArchiveUploadV1(
    &sample_uploads.ArchiveUploadV1Params{
      Body: []int64{},
      Name: "string",
      Password: &password,
      IsConfidential: &isConfidential,
      Comment: &comment,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sampleUploads.archiveUploadV1(
  "string",  // name
  [{}],  // body
  "string",  // password
  boolean,  // isConfidential
  "string"  // comment
);

console.log(response);

use rusty_falcon::apis::sample_uploads_api::archive_upload_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = archive_upload_v1(
        &falcon.cfg,  // configuration
        "string",  // name
        Default::default(),  // body
        Some("string"),  // password
        Some(boolean),  // is_confidential
        Some("string"),  // comment
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SampleUploads.new

body = {}

response = api.archive_upload_v1(body, 'string')

puts response

ArchiveDeleteV1

Delete an archive that was uploaded previously

DELETE /archives/entities/archives/v1

Scope Sample Uploads: WRITE Consumes · Produces application/json

PEP 8 delete_archive

Parameters

Name	Type	Data type	Description
id	query	string	The archive SHA256.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.delete_archive(id="string")
print(response)

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.ArchiveDeleteV1(id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ArchiveDeleteV1",
                          id="string")
print(response)

Remove-FalconSampleArchive -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sample_uploads"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.SampleUploads.ArchiveDeleteV1(
    &sample_uploads.ArchiveDeleteV1Params{
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sampleUploads.archiveDeleteV1("string");  // id

console.log(response);

use rusty_falcon::apis::sample_uploads_api::archive_delete_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = archive_delete_v1(
        &falcon.cfg,  // configuration
        "string",  // id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SampleUploads.new

response = api.archive_delete_v1('string')

puts response

ArchiveUploadV2

POST /archives/entities/archives/v2

Scope Sample Uploads: WRITE Consumes multipart/form-data Produces application/json

PEP 8 upload_archive

Parameters

Name	Type	Data type	Description
file_data	formData	dictionary	Content of the uploaded archive in binary format. The keywords `archive` and `file` will also be accepted for this argument. Max file size: 100 MB. Accepted file formats: `zip`, `7z`.
comment	formData	string	A descriptive comment to identify the file for other users.
is_confidential	formData	boolean	Defines visibility of this file, either via the API or the Falcon console. `true`: File is only show to users within your customer account. `false`: File can be seen by other CrowdStrike customers. Defaults to `true`.
file_type	query	string	Archive format, either `zip` or `7zip`. Defaults to `zip`.
name	formData	string	Name of the archive.
parameters	query	dictionary	Full query string parameters payload in JSON format.
password	formData	string	Archive password.

Code Examples

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.upload_archive(comment="string",
                                 file_data="string",
                                 name="string",
                                 file_type="string",
                                 is_confidential="string",
                                 password="string")
print(response)

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.ArchiveUploadV2(comment="string",
                                  file_data="string",
                                  name="string",
                                  file_type="string",
                                  is_confidential="string",
                                  password="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ArchiveUploadV2",
                          file_data=open("filename", "rb").read(),
                          password="string",
                          name="string",
                          is_confidential=boolean,
                          comment="string")
print(response)

Send-FalconSampleArchive -Path "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sample_uploads"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  password := "string"
  isConfidential := boolean
  comment := "string"

  response, err := client.SampleUploads.ArchiveUploadV2(
    &sample_uploads.ArchiveUploadV2Params{
      Password: &password,
      Name: "string",
      IsConfidential: &isConfidential,
      Comment: &comment,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sampleUploads.archiveUploadV2(
  "string",  // file
  "string",  // name
  "string",  // password
  boolean,  // isConfidential
  "string"  // comment
);

console.log(response);

use rusty_falcon::apis::sample_uploads_api::archive_upload_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = archive_upload_v2(
        &falcon.cfg,  // configuration
        std::path::PathBuf::default(),  // file
        "string",  // name
        Some("string"),  // password
        Some(boolean),  // is_confidential
        Some("string"),  // comment
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SampleUploads.new

response = api.archive_upload_v2('string', 'string')

puts response

ExtractionListV1

Retrieves the files extractions in chunks. Status done means that all files were processed successfully. Status error means that at least one of the file could not be processed.

GET /archives/entities/extraction-files/v1

Scope Sample Uploads: READ Consumes · Produces application/json

PEP 8 list_extraction

Parameters

Name	Type	Data type	Description
id	query	string	The extraction operation ID.
parameters	query	dictionary	Full query string parameters payload in JSON format.
limit	query	integer	Maximum number of files to retrieve. (Default: 100)
offset	query	string	Offset from where to retrieve files.

Code Examples

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.list_extraction(id="string", limit=integer, offset="string")
print(response)

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.ExtractionListV1(id="string", limit=integer, offset="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ExtractionListV1",
                          id="string",
                          limit=integer,
                          offset="string")
print(response)

Get-FalconSampleExtraction -Id "string" -FileList $boolean

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sample_uploads"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := "string"

  response, err := client.SampleUploads.ExtractionListV1(
    &sample_uploads.ExtractionListV1Params{
      ID: "string",
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sampleUploads.extractionListV1(
  "string",  // id
  integer,  // limit
  "string"  // offset
);

console.log(response);

use rusty_falcon::apis::sample_uploads_api::extraction_list_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = extraction_list_v1(
        &falcon.cfg,  // configuration
        "string",  // id
        Some(integer),  // limit
        Some("string"),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SampleUploads.new

response = api.extraction_list_v1('string')

puts response

ExtractionGetV1

Retrieves the files extraction operation statuses. Status done means that all files were processed successfully. Status error means that at least one of the file could not be processed.

GET /archives/entities/extractions/v1

Scope Sample Uploads: READ Consumes · Produces application/json

PEP 8 get_extraction

Parameters

Name	Type	Data type	Description
id	query	string	The extraction operation ID.
include_files	query	boolean	If `true`, includes processed archive files in response.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.get_extraction(id="string", include_files=boolean)
print(response)

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.ExtractionGetV1(id="string", include_files=boolean)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ExtractionGetV1",
                          id="string",
                          include_files=boolean)
print(response)

Get-FalconSampleExtraction -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sample_uploads"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  includeFiles := boolean

  response, err := client.SampleUploads.ExtractionGetV1(
    &sample_uploads.ExtractionGetV1Params{
      ID: "string",
      IncludeFiles: &includeFiles,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sampleUploads.extractionGetV1(
  "string",  // id
  boolean  // includeFiles
);

console.log(response);

use rusty_falcon::apis::sample_uploads_api::extraction_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = extraction_get_v1(
        &falcon.cfg,  // configuration
        "string",  // id
        Some(boolean),  // include_files
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SampleUploads.new

response = api.extraction_get_v1('string')

puts response

ExtractionCreateV1

Extracts files from an uploaded archive and copies them to internal storage making it available for content analysis.

POST /archives/entities/extractions/v1

Scope Sample Uploads: WRITE Consumes · Produces application/json

PEP 8 create_extraction

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
extract_all	body	boolean	Flag indicating if all files should be extracted.
files	body	list of dictionaries	List of files to be extracted from the archive. Each dictionary will contain three keys: `comment` (string), `is_confidential` (boolean), and `name` (string).
sha256	body	string	SHA256 of the archive.

Code Examples

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

files = [
    {
        "comment": "string",
        "is_confidential": true,
        "name": "string"
    }
]

response = falcon.create_extraction(extract_all=boolean,
                                    files=files,
                                    sha256="string")
print(response)

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

files = [
    {
        "comment": "string",
        "is_confidential": true,
        "name": "string"
    }
]

response = falcon.ExtractionCreateV1(extract_all=boolean,
                                     files=files,
                                     sha256="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "extract_all": boolean,
    "files": [
        {
            "comment": "string",
            "is_confidential": boolean,
            "name": "string"
        }
    ],
    "sha256": "string"
}

response = falcon.command("ExtractionCreateV1", body=body_payload)
print(response)

Expand-FalconSampleArchive -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sample_uploads"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  extract_all := boolean
  comment := "string"
  is_confidential := boolean
  name := "string"
  sha256 := "string"

  response, err := client.SampleUploads.ExtractionCreateV1(
    &sample_uploads.ExtractionCreateV1Params{
      Body: &models.ClientExtractionCreateRequestV1{
        ExtractAll: &extract_all,
        Files: []interface{}{
          {
          Comment: &comment,
          IsConfidential: &is_confidential,
          Name: &name,
          },
        },
        Sha256: &sha256,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sampleUploads.extractionCreateV1(
  {
    extractAll: boolean,
    files: [{
        comment: "string",
        isConfidential: boolean,
        name: "string"
      }],
    sha256: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::sample_uploads_api::extraction_create_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ClientExtractionCreateRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ClientExtractionCreateRequestV1 {
        ..Default::default()
    };

    let response = extraction_create_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SampleUploads.new

body = Falcon::ClientExtractionCreateRequestV1.new(
  extract_all: boolean,
  files: [{
      comment: 'string',
      is_confidential: boolean,
      name: 'string'
    }],
  sha256: 'string'
)

response = api.extraction_create_v1(body)

puts response

GetSampleV3

Retrieves the file associated with the given ID (SHA256).

GET /samples/entities/samples/v3

Scope Sample Uploads: READ Consumes · Produces application/octet-stream

PEP 8 get_sample

Parameters

Name	Type	Data type	Description
ids	query	string	The file SHA256.
parameters	query	dictionary	Full query string parameters payload in JSON format.
password_protected	query	boolean	Flag whether the sample should be zipped and password protected with the password `infected`.
stream	query	boolean	Enable streaming download of the returned file.

Code Examples

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.get_sample(ids=id_list,
                                 password_protected="string",
                                 stream=boolean,
                                 stream=boolean)
    save_file.write(response)

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.GetSampleV3(ids=id_list,
                                  password_protected="string",
                                  stream=boolean,
                                  stream=boolean)
    save_file.write(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.command("GetSampleV3",
                              ids="string",
                              password_protected=boolean)
    save_file.write(response)

Receive-FalconSample -Path "string" -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sample_uploads"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  passwordProtected := boolean

  response, err := client.SampleUploads.GetSampleV3(
    &sample_uploads.GetSampleV3Params{
      Ids: "string",
      PasswordProtected: &passwordProtected,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sampleUploads.getSampleV3(
  "string",  // ids
  boolean  // passwordProtected
);

console.log(response);

use rusty_falcon::apis::sample_uploads_api::get_sample_v3;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_sample_v3(
        &falcon.cfg,  // configuration
        "string",  // ids
        Some(boolean),  // password_protected
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SampleUploads.new

response = api.get_sample_v3('string')

puts response

UploadSampleV3

Upload a file for further cloud analysis. After uploading, call the specific analysis API endpoint.

POST /samples/entities/samples/v3

Scope Sample Uploads: WRITE Consumes · Produces multipart/form-data

PEP 8 upload_sample

Parameters

Name	Type	Data type	Description
comment	formData	string	A descriptive comment to identify the file for other users.
data	formData	file	Content of the uploaded sample in binary format (Uber class). Max file size: 256 MB. Accepted file formats: Portable executables: `.exe`, `.scr`, `.pif`, `.dll`, `.com`, `.cpl`, etc. Office documents: `.doc`, `.docx`, `.ppt`, `.pps`, `.pptx`, `.ppsx`, `.xls`, `.xlsx`, `.rtf`, `.pub` PDF APK Executable JAR Windows script component: `.sct` Windows shortcut: `.lnk` Windows help: `.chm` HTML application: `.hta` Windows script file: `.wsf` Javascript: `.js` Visual Basic: `.vbs`, `.vbe` Shockwave Flash: `.swf` Perl: `.pl` Powershell: `.ps1`, `.psd1`, `.psm1` Scalable vector graphics: `.svg` Python: `.py` Linux ELF executables Email files: MIME RFC 822 `.eml`, Outlook `.msg`.
is_confidential	formData	boolean	Defines visibility of this file in Falcon MalQuery. `true`: File is only shown to users within your customer account. `false`: File can be seen by other CrowdStrike customers. Default: `true`.
file_data or sample or upfile	formData	file	Content of the uploaded sample in binary format (Service class). Max file size: 256 MB. Accepted file formats: Portable executables: `.exe`, `.scr`, `.pif`, `.dll`, `.com`, `.cpl`, etc. Office documents: `.doc`, `.docx`, `.ppt`, `.pps`, `.pptx`, `.ppsx`, `.xls`, `.xlsx`, `.rtf`, `.pub` PDF APK Executable JAR Windows script component: `.sct` Windows shortcut: `.lnk` Windows help: `.chm` HTML application: `.hta` Windows script file: `.wsf` Javascript: `.js` Visual Basic: `.vbs`, `.vbe` Shockwave Flash: `.swf` Perl: `.pl` Powershell: `.ps1`, `.psd1`, `.psm1` Scalable vector graphics: `.svg` Python: `.py` Linux ELF executables Email files: MIME RFC 822 `.eml`, Outlook `.msg`.
file_name	formData	string	Name to use for the file. Uses current file name if not specified.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.upload_sample(comment="string",
                                file_data="string",
                                file_name="string",
                                is_confidential="string")
print(response)

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.UploadSampleV3(comment="string",
                                 file_data="string",
                                 file_name="string",
                                 is_confidential="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("UploadSampleV3",
                          file_data=open("filename", "rb").read(),
                          file_name="string",
                          comment="string",
                          is_confidential=boolean)
print(response)

Send-FalconSample -Path "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sample_uploads"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  isConfidential := boolean

  response, err := client.SampleUploads.UploadSampleV3(
    &sample_uploads.UploadSampleV3Params{
      FileName: "string",
      Comment: &comment,
      IsConfidential: &isConfidential,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sampleUploads.uploadSampleV3(
  "string",  // sample
  "string",  // fileName
  "string",  // comment
  boolean  // isConfidential
);

console.log(response);

use rusty_falcon::apis::sample_uploads_api::upload_sample_v3;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = upload_sample_v3(
        &falcon.cfg,  // configuration
        std::path::PathBuf::default(),  // sample
        "string",  // file_name
        Some("string"),  // comment
        Some(boolean),  // is_confidential
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SampleUploads.new

response = api.upload_sample_v3('string', 'string')

puts response

DeleteSampleV3

Removes a sample, including file, meta and submissions from the collection.

DELETE /samples/entities/samples/v3

Scope Sample Uploads: WRITE Consumes · Produces application/json

PEP 8 delete_sample

Parameters

Name	Type	Data type	Description
ids	query	string	The file SHA256 of the file to delete.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_sample(ids=id_list)
print(response)

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteSampleV3(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteSampleV3",
                          ids="string")
print(response)

Remove-FalconSample -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sample_uploads"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.SampleUploads.DeleteSampleV3(
    &sample_uploads.DeleteSampleV3Params{
      Ids: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sampleUploads.deleteSampleV3("string");  // ids

console.log(response);

use rusty_falcon::apis::sample_uploads_api::delete_sample_v3;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_sample_v3(
        &falcon.cfg,  // configuration
        "string",  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SampleUploads.new

response = api.delete_sample_v3('string')

puts response

Sample Uploads

Table of Contents

ArchiveListV1

Parameters

Code Examples

ArchiveGetV1

Parameters

Code Examples

ArchiveUploadV1

Parameters

Code Examples

ArchiveDeleteV1

Parameters

Code Examples

ArchiveUploadV2

Parameters

Code Examples

ExtractionListV1

Parameters

Code Examples

ExtractionGetV1

Parameters

Code Examples

ExtractionCreateV1

Parameters

Code Examples

GetSampleV3

Parameters

Code Examples

UploadSampleV3

Parameters

Code Examples

DeleteSampleV3

Parameters

Code Examples