Sample Uploads

The Sample Uploads service collection provides operations for uploading and managing sample files for cloud analysis. Upload archives and individual samples, manage extraction operations, retrieve uploaded samples, and delete files when no longer needed.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

This service collection has code examples posted to the repository.

Operation	Description
ArchiveDeleteV1 `delete_archive`	Delete an archive that was uploaded previously
ArchiveGetV1 `get_archive`	Retrieves the archives upload operation statuses.
ArchiveListV1 `list_archive`	Retrieves the archives files in chunks.
ArchiveUploadV1 `upload_archive_v1`	Uploads an archive and extracts files list from it. deprecated
ArchiveUploadV2 `upload_archive`	Uploads an archive and extracts files list from it.
DeleteSampleV3 `delete_sample`	Removes a sample, including file, meta and submissions from the collection
ExtractionCreateV1 `create_extraction`	Extracts files from an uploaded archive and copies them to internal storage making it available for content analysis.
ExtractionGetV1 `get_extraction`	Retrieves the files extraction operation statuses.
ExtractionListV1 `list_extraction`	Retrieves the files extractions in chunks.
GetSampleV3 `get_sample`	Retrieves the file associated with the given ID (SHA256)
UploadSampleV3 `upload_sample`	Upload a file for further cloud analysis.

ArchiveDeleteV1

Delete an archive that was uploaded previously

Method DELETE

Route /archives/entities/archives/v1

Scope Sample uploads: WRITE

PEP 8 delete_archive

Parameters

id query · string

The archive SHA256.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.delete_archive(id="string")
print(response)

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.ArchiveDeleteV1(id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ArchiveDeleteV1",
                          id="string")
print(response)

Remove-FalconSampleArchive -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sample_uploads"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.SampleUploads.ArchiveDeleteV1(
    &sample_uploads.ArchiveDeleteV1Params{
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sampleUploads.archiveDeleteV1("string");  // id

console.log(response);

use rusty_falcon::apis::sample_uploads_api::archive_delete_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = archive_delete_v1(
        &falcon.cfg,  // configuration
        "string",  // id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SampleUploads.new

response = api.archive_delete_v1('string')

puts response

Responses

403 Forbidden
429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ArchiveGetV1

Retrieves the archives upload operation statuses.

Method GET

Route /archives/entities/archives/v1

Scope Sample uploads: READ

PEP 8 get_archive

Parameters

id query · string

The archive SHA256.

include_files query · boolean

If true includes processed archive files in response.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.get_archive(id="string", include_files=boolean)
print(response)

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.ArchiveGetV1(id="string", include_files=boolean)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ArchiveGetV1",
                          id="string",
                          include_files=boolean)
print(response)

Get-FalconSampleArchive -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sample_uploads"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  includeFiles := boolean

  response, err := client.SampleUploads.ArchiveGetV1(
    &sample_uploads.ArchiveGetV1Params{
      ID: "string",
      IncludeFiles: &includeFiles,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sampleUploads.archiveGetV1(
  "string",  // id
  boolean  // includeFiles
);

console.log(response);

use rusty_falcon::apis::sample_uploads_api::archive_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = archive_get_v1(
        &falcon.cfg,  // configuration
        "string",  // id
        Some(boolean),  // include_files
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SampleUploads.new

response = api.archive_get_v1('string')

puts response

Responses

[
  {
    "error": "string",
    "files": [],
    "mime_type": "string",
    "name": "string",
    "sha256": "string",
    "size": 0,
    "status": "string",
    "upload_timestamp": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "error": "string",
      "files": [],
      "mime_type": "string",
      "name": "string",
      "sha256": "string",
      "size": 0,
      "status": "string",
      "upload_timestamp": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "error": "string",
      "files": [],
      "mime_type": "string",
      "name": "string",
      "sha256": "string",
      "size": 0,
      "status": "string",
      "upload_timestamp": "string"
    }
  ]
}

ArchiveListV1

Retrieves the archives files in chunks.

Method GET

Route /archives/entities/archive-files/v1

Scope Sample uploads: READ

PEP 8 list_archive

Parameters

id query · string

The archive SHA256.

limit query · integer

Max number of files to retrieve.

offset query · string

Offset from where to get files.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.list_archive(id="string", limit=integer, offset="string")
print(response)

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.ArchiveListV1(id="string", limit=integer, offset="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ArchiveListV1",
                          id="string",
                          limit=integer,
                          offset="string")
print(response)

Get-FalconSampleArchive -Id "string" -FileList $boolean

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sample_uploads"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := "string"

  response, err := client.SampleUploads.ArchiveListV1(
    &sample_uploads.ArchiveListV1Params{
      ID: "string",
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sampleUploads.archiveListV1(
  "string",  // id
  integer,  // limit
  "string"  // offset
);

console.log(response);

use rusty_falcon::apis::sample_uploads_api::archive_list_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = archive_list_v1(
        &falcon.cfg,  // configuration
        "string",  // id
        Some(integer),  // limit
        Some("string"),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SampleUploads.new

response = api.archive_list_v1('string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

ArchiveUploadV1

Uploads an archive and extracts files list from it.

Method POST

Route /archives/entities/archives/v1

Scope Sample uploads: WRITE

PEP 8 upload_archive_v1

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

name query · string

Name of the archive.

password query · string

Archive password.

is_confidential query · boolean

Defines visibility of this file, either via the API or the Falcon console. - true: File is only shown to users within your customer account - false: File can be seen by other CrowdStrike customers Default: true.

Available values (2)

comment query · string

A descriptive comment to identify the file for other users.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

file_type body · string

Archive file format. “zip”, “7zip”. Defaults to “zip”.

Code Examples

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.upload_archive_v1(comment="string",
                                    name="string",
                                    file_type="string",
                                    is_confidential=boolean,
                                    password="string")
print(response)

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.ArchiveUploadV1(comment="string",
                                  name="string",
                                  file_type="string",
                                  is_confidential=boolean,
                                  password="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ArchiveUploadV1", name="string", password="string", is_confidential=boolean, comment="string", body={})
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sample_uploads"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  password := "string"
  isConfidential := boolean
  comment := "string"

  response, err := client.SampleUploads.ArchiveUploadV1(
    &sample_uploads.ArchiveUploadV1Params{
      Body: []int64{},
      Name: "string",
      Password: &password,
      IsConfidential: &isConfidential,
      Comment: &comment,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sampleUploads.archiveUploadV1(
  "string",  // name
  [{}],  // body
  "string",  // password
  boolean,  // isConfidential
  "string"  // comment
);

console.log(response);

use rusty_falcon::apis::sample_uploads_api::archive_upload_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = archive_upload_v1(
        &falcon.cfg,  // configuration
        "string",  // name
        Default::default(),  // body
        Some("string"),  // password
        Some(boolean),  // is_confidential
        Some("string"),  // comment
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SampleUploads.new

body = {}

response = api.archive_upload_v1(body, 'string')

puts response

Responses

[
  {
    "error": "string",
    "files": [],
    "mime_type": "string",
    "name": "string",
    "sha256": "string",
    "size": 0,
    "status": "string",
    "upload_timestamp": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "error": "string",
      "files": [],
      "mime_type": "string",
      "name": "string",
      "sha256": "string",
      "size": 0,
      "status": "string",
      "upload_timestamp": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "error": "string",
      "files": [],
      "mime_type": "string",
      "name": "string",
      "sha256": "string",
      "size": 0,
      "status": "string",
      "upload_timestamp": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "error": "string",
      "files": [],
      "mime_type": "string",
      "name": "string",
      "sha256": "string",
      "size": 0,
      "status": "string",
      "upload_timestamp": "string"
    }
  ]
}

ArchiveUploadV2

Uploads an archive and extracts files list from it.

Method POST

Route /archives/entities/archives/v2

Scope Sample uploads: WRITE

PEP 8 upload_archive

Parameters

file body · file

Content of the uploaded archive. For example, use —form file=@$FILE_PATH;type= when using cURL. Supported file types are application/zip and application/x-7z-compressed.

password body · string

Archive password. For example, use —form password= when using cURL.

name body · string

Name of the archive. For example, use —form name= when using cURL.

is_confidential body · boolean

Defines visibility of this file in Falcon MalQuery, either via the API or the Falcon console. For example, use —form is_confidential= when using cURL. - true: File is only shown to users within your customer account - false: File can be seen by other CrowdStrike customers Default: true.

Available values (2)

comment body · string

A descriptive comment to identify the file for other users. For example, use —form comment= when using cURL.

file_data body · string

Content of the uploaded archive in binary format. ‘archive’ and ‘file’ are also accepted as this parameter.

file_type body · string

Archive file format. “zip”, “7zip”. Defaults to “zip”.

Code Examples

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.upload_archive(comment="string",
                                 file_data="string",
                                 name="string",
                                 file_type="string",
                                 is_confidential="string",
                                 password="string")
print(response)

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.ArchiveUploadV2(comment="string",
                                  file_data="string",
                                  name="string",
                                  file_type="string",
                                  is_confidential="string",
                                  password="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ArchiveUploadV2",
                          file_data=open("filename", "rb").read(),
                          password="string",
                          name="string",
                          is_confidential=boolean,
                          comment="string")
print(response)

Send-FalconSampleArchive -Path "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sample_uploads"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  password := "string"
  isConfidential := boolean
  comment := "string"

  response, err := client.SampleUploads.ArchiveUploadV2(
    &sample_uploads.ArchiveUploadV2Params{
      Password: &password,
      Name: "string",
      IsConfidential: &isConfidential,
      Comment: &comment,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sampleUploads.archiveUploadV2(
  "string",  // file
  "string",  // name
  "string",  // password
  boolean,  // isConfidential
  "string"  // comment
);

console.log(response);

use rusty_falcon::apis::sample_uploads_api::archive_upload_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = archive_upload_v2(
        &falcon.cfg,  // configuration
        std::path::PathBuf::default(),  // file
        "string",  // name
        Some("string"),  // password
        Some(boolean),  // is_confidential
        Some("string"),  // comment
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SampleUploads.new

response = api.archive_upload_v2('string', 'string')

puts response

Responses

[
  {
    "error": "string",
    "files": [],
    "mime_type": "string",
    "name": "string",
    "sha256": "string",
    "size": 0,
    "status": "string",
    "upload_timestamp": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "error": "string",
      "files": [],
      "mime_type": "string",
      "name": "string",
      "sha256": "string",
      "size": 0,
      "status": "string",
      "upload_timestamp": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "error": "string",
      "files": [],
      "mime_type": "string",
      "name": "string",
      "sha256": "string",
      "size": 0,
      "status": "string",
      "upload_timestamp": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "error": "string",
      "files": [],
      "mime_type": "string",
      "name": "string",
      "sha256": "string",
      "size": 0,
      "status": "string",
      "upload_timestamp": "string"
    }
  ]
}

DeleteSampleV3

Removes a sample, including file, meta and submissions from the collection

Method DELETE

Route /samples/entities/samples/v3

Scope Sample uploads: WRITE

PEP 8 delete_sample

Parameters

ids query · string

The file SHA256.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_sample(ids=id_list)
print(response)

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteSampleV3(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteSampleV3",
                          ids="string")
print(response)

Remove-FalconSample -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sample_uploads"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.SampleUploads.DeleteSampleV3(
    &sample_uploads.DeleteSampleV3Params{
      Ids: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sampleUploads.deleteSampleV3("string");  // ids

console.log(response);

use rusty_falcon::apis::sample_uploads_api::delete_sample_v3;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_sample_v3(
        &falcon.cfg,  // configuration
        "string",  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SampleUploads.new

response = api.delete_sample_v3('string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    "string"
  ]
}

ExtractionCreateV1

Extracts files from an uploaded archive and copies them to internal storage making it available for content analysis.

Method POST

Route /archives/entities/extractions/v1

Scope Sample uploads: WRITE

PEP 8 create_extraction

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

extract_all body · boolean

Flag indicating if all files should be extracted.

files body · array

List of files to be extracted from the archive.

sha256 body · string

SHA256 Archive ID of the archive.

Code Examples

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

files = [
    {
        "comment": "string",
        "is_confidential": True,
        "name": "string"
    }
]

response = falcon.create_extraction(extract_all=boolean,
                                    files=files,
                                    sha256="string")
print(response)

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

files = [
    {
        "comment": "string",
        "is_confidential": True,
        "name": "string"
    }
]

response = falcon.ExtractionCreateV1(extract_all=boolean,
                                     files=files,
                                     sha256="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "extract_all": boolean,
    "files": [
        {
            "comment": "string",
            "is_confidential": boolean,
            "name": "string"
        }
    ],
    "sha256": "string"
}

response = falcon.command("ExtractionCreateV1", body=body_payload)
print(response)

Expand-FalconSampleArchive -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sample_uploads"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  extract_all := boolean
  comment := "string"
  is_confidential := boolean
  name := "string"
  sha256 := "string"

  response, err := client.SampleUploads.ExtractionCreateV1(
    &sample_uploads.ExtractionCreateV1Params{
      Body: &models.ClientExtractionCreateRequestV1{
        ExtractAll: &extract_all,
        Files: []interface{}{
          {
          Comment: &comment,
          IsConfidential: &is_confidential,
          Name: &name,
          },
        },
        Sha256: &sha256,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sampleUploads.extractionCreateV1(
  {
    extractAll: boolean,
    files: [{
        comment: "string",
        isConfidential: boolean,
        name: "string"
      }],
    sha256: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::sample_uploads_api::extraction_create_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ClientExtractionCreateRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ClientExtractionCreateRequestV1 {
        ..Default::default()
    };

    let response = extraction_create_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SampleUploads.new

body = Falcon::ClientExtractionCreateRequestV1.new(
  extract_all: boolean,
  files: [{
      comment: 'string',
      is_confidential: boolean,
      name: 'string'
    }],
  sha256: 'string'
)

response = api.extraction_create_v1(body)

puts response

Responses

[
  {
    "error": "string",
    "extract_timestamp": "string",
    "files": [],
    "id": "string",
    "status": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "error": "string",
      "extract_timestamp": "string",
      "files": [],
      "id": "string",
      "status": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "error": "string",
      "extract_timestamp": "string",
      "files": [],
      "id": "string",
      "status": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "error": "string",
      "extract_timestamp": "string",
      "files": [],
      "id": "string",
      "status": "string"
    }
  ]
}

ExtractionGetV1

Retrieves the files extraction operation statuses.

Method GET

Route /archives/entities/extractions/v1

Scope Sample uploads: READ

PEP 8 get_extraction

Parameters

id query · string

The extraction operation ID.

include_files query · boolean

If true includes processed archive files in response.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.get_extraction(id="string", include_files=boolean)
print(response)

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.ExtractionGetV1(id="string", include_files=boolean)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ExtractionGetV1",
                          id="string",
                          include_files=boolean)
print(response)

Get-FalconSampleExtraction -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sample_uploads"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  includeFiles := boolean

  response, err := client.SampleUploads.ExtractionGetV1(
    &sample_uploads.ExtractionGetV1Params{
      ID: "string",
      IncludeFiles: &includeFiles,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sampleUploads.extractionGetV1(
  "string",  // id
  boolean  // includeFiles
);

console.log(response);

use rusty_falcon::apis::sample_uploads_api::extraction_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = extraction_get_v1(
        &falcon.cfg,  // configuration
        "string",  // id
        Some(boolean),  // include_files
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SampleUploads.new

response = api.extraction_get_v1('string')

puts response

Responses

[
  {
    "error": "string",
    "extract_timestamp": "string",
    "files": [],
    "id": "string",
    "status": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "error": "string",
      "extract_timestamp": "string",
      "files": [],
      "id": "string",
      "status": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "error": "string",
      "extract_timestamp": "string",
      "files": [],
      "id": "string",
      "status": "string"
    }
  ]
}

ExtractionListV1

Retrieves the files extractions in chunks.

Method GET

Route /archives/entities/extraction-files/v1

Scope Sample uploads: READ

PEP 8 list_extraction

Parameters

id query · string

The extraction operation ID.

limit query · integer

Max number of file extractions to retrieve.

offset query · string

Offset from where to get file extractions.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.list_extraction(id="string", limit=integer, offset="string")
print(response)

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.ExtractionListV1(id="string", limit=integer, offset="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ExtractionListV1",
                          id="string",
                          limit=integer,
                          offset="string")
print(response)

Get-FalconSampleExtraction -Id "string" -FileList $boolean

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sample_uploads"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := "string"

  response, err := client.SampleUploads.ExtractionListV1(
    &sample_uploads.ExtractionListV1Params{
      ID: "string",
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sampleUploads.extractionListV1(
  "string",  // id
  integer,  // limit
  "string"  // offset
);

console.log(response);

use rusty_falcon::apis::sample_uploads_api::extraction_list_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = extraction_list_v1(
        &falcon.cfg,  // configuration
        "string",  // id
        Some(integer),  // limit
        Some("string"),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SampleUploads.new

response = api.extraction_list_v1('string')

puts response

Responses

[
  {
    "error": "string",
    "extract_timestamp": "string",
    "name": "string",
    "sha256": "string",
    "status": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "error": "string",
      "extract_timestamp": "string",
      "name": "string",
      "sha256": "string",
      "status": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "error": "string",
      "extract_timestamp": "string",
      "name": "string",
      "sha256": "string",
      "status": "string"
    }
  ]
}

GetSampleV3

Retrieves the file associated with the given ID (SHA256)

Method GET

Route /samples/entities/samples/v3

Scope Sample uploads: READ

PEP 8 get_sample

Parameters

ids query · string

The file SHA256.

password_protected query · boolean

Flag whether the sample should be zipped and password protected with pass=‘infected’

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

stream body · boolean

Enable streaming download of the file.

Code Examples

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.get_sample(ids=id_list,
                                 password_protected=boolean,
                                 stream=boolean,
                                 stream=boolean)
    save_file.write(response)

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.GetSampleV3(ids=id_list,
                                  password_protected=boolean,
                                  stream=boolean,
                                  stream=boolean)
    save_file.write(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.command("GetSampleV3",
                              ids="string",
                              password_protected=boolean)
    save_file.write(response)

Receive-FalconSample -Path "string" -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sample_uploads"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  passwordProtected := boolean

  response, err := client.SampleUploads.GetSampleV3(
    &sample_uploads.GetSampleV3Params{
      Ids: "string",
      PasswordProtected: &passwordProtected,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sampleUploads.getSampleV3(
  "string",  // ids
  boolean  // passwordProtected
);

console.log(response);

use rusty_falcon::apis::sample_uploads_api::get_sample_v3;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_sample_v3(
        &falcon.cfg,  // configuration
        "string",  // ids
        Some(boolean),  // password_protected
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SampleUploads.new

response = api.get_sample_v3('string')

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

UploadSampleV3

Upload a file for further cloud analysis.

Method POST

Route /samples/entities/samples/v3

Scope Sample uploads: WRITE

PEP 8 upload_sample

Parameters

sample body · file

Content of the uploaded sample in binary format. For example, use —data-binary @$FILE_PATH when using cURL. Max file size: 256 MB. Accepted file formats: - Portable executables: .exe, .scr, .pif, .dll, .com, .cpl, etc. - Office documents: .doc, .docx, .ppt, .pps, .pptx, .ppsx, .xls, .xlsx, .rtf, .pub - PDF - APK - Executable JAR - Windows script component: .sct - Windows shortcut: .lnk - Windows help: .chm - HTML application: .hta - Windows script file: .wsf - Javascript: .js - Visual Basic: .vbs, .vbe - Shockwave Flash: .swf - Perl: .pl - Powershell: .ps1, .psd1, .psm1 - Scalable vector graphics: .svg - Python: .py - Linux ELF executables - Email files: MIME RFC 822 .eml, Outlook .msg.

file_name body · string

Name of the file.

comment body · string

A descriptive comment to identify the file for other users.

is_confidential body · boolean

Defines visibility of this file in Falcon MalQuery, either via the API or the Falcon console. - true: File is only shown to users within your customer account - false: File can be seen by other CrowdStrike customers Default: true.

Available values (2)

file_data body · string

Content of the uploaded sample in binary format. Max file size is 256 MB. ‘sample’ and ‘upfile’ are also accepted as this parameter. Accepted File Formats: Portable executables: .exe, .scr, .pif, .dll, .com, .cpl, etc. Office documents: .doc, .docx, .ppt, .pps, .pptx, .ppsx, .xls, .xlsx, .rtf, .pub PDF APK Executable JAR Windows script component: .sct Windows shortcut: .lnk Windows help: .chm HTML application: .hta Windows script file: .wsf Javascript: .js Visual Basic: .vbs, .vbe Shockwave Flash: .swf Perl: .pl Powershell: .ps1, .psd1, .psm1 Scalable vector graphics: .svg Python: .py Linux ELF executables Email files: MIME RFC 822 .eml, Outlook .msg

Code Examples

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.upload_sample(comment="string",
                                file_data="string",
                                file_name="string",
                                is_confidential="string")
print(response)

from falconpy import SampleUploads

falcon = SampleUploads(client_id=CLIENT_ID,
                       client_secret=CLIENT_SECRET
                       )

response = falcon.UploadSampleV3(comment="string",
                                 file_data="string",
                                 file_name="string",
                                 is_confidential="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("UploadSampleV3",
                          file_data=open("filename", "rb").read(),
                          file_name="string",
                          comment="string",
                          is_confidential=boolean)
print(response)

Send-FalconSample -Path "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/sample_uploads"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  isConfidential := boolean

  response, err := client.SampleUploads.UploadSampleV3(
    &sample_uploads.UploadSampleV3Params{
      FileName: "string",
      Comment: &comment,
      IsConfidential: &isConfidential,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.sampleUploads.uploadSampleV3(
  "string",  // sample
  "string",  // fileName
  "string",  // comment
  boolean  // isConfidential
);

console.log(response);

use rusty_falcon::apis::sample_uploads_api::upload_sample_v3;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = upload_sample_v3(
        &falcon.cfg,  // configuration
        std::path::PathBuf::default(),  // sample
        "string",  // file_name
        Some("string"),  // comment
        Some(boolean),  // is_confidential
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SampleUploads.new

response = api.upload_sample_v3('string', 'string')

puts response

Responses

[
  {
    "file_name": "string",
    "sha256": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "file_name": "string",
      "sha256": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "file_name": "string",
      "sha256": "string"
    }
  ]
}

Sample Uploads

Table of Contents

ArchiveDeleteV1

Parameters

ArchiveGetV1

Parameters

ArchiveListV1

Parameters

ArchiveUploadV1

Parameters

ArchiveUploadV2

Parameters

DeleteSampleV3

Parameters

ExtractionCreateV1

Parameters

ExtractionGetV1

Parameters

ExtractionListV1

Parameters

GetSampleV3

Parameters

UploadSampleV3

Parameters