Scheduled Reports

The Scheduled Reports service collection provides operations for managing and executing scheduled reports in your CrowdStrike Falcon environment. Launch report executions, retrieve report details by ID, and query for report IDs matching filter criteria.

Language	Last Update
Python	v1.4.6
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

Operation	Description
scheduled_reports_launch `launch`	Launch scheduled report executions for the provided ID(s).
scheduled_reports_get `get_reports`	Retrieve scheduled reports for the provided report IDs.
scheduled_reports_query `query_reports`	Find all report IDs matching the query with filter

scheduled_reports_launch

Launch scheduled report executions for the provided ID(s).

POST /reports/entities/scheduled-reports/execution/v1

Scope Scheduled Reports: READ Consumes · Produces application/json

PEP 8 launch

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The report ID(s) to launch.
body	query	list of dictionaries	Full body payload in JSON format.

Code Examples

from falconpy import ScheduledReports

falcon = ScheduledReports(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.launch(ids=id_list)
print(response)

from falconpy import ScheduledReports

falcon = ScheduledReports(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.scheduled_reports_launch(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = [
    {
        "id": "string"
    }
]

response = falcon.command("scheduled_reports_launch", body=body_payload)
print(response)

Invoke-FalconScheduledReport -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/scheduled_reports"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  id := "string"

  response, err := client.ScheduledReports.Execute(
    &scheduled_reports.ExecuteParams{
      Body: []*models.DomainReportExecutionLaunchRequestV1{
        {
          ID: &id,
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.scheduledReports.execute(
  [{
    id: "string"
}]  // body
);

console.log(response);

use rusty_falcon::apis::scheduled_reports_api::scheduled_reports_launch;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainReportExecutionLaunchRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = vec![DomainReportExecutionLaunchRequestV1 {
            id: Some("string".to_string()),
            ..Default::default()
        }];

    let response = scheduled_reports_launch(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ScheduledReports.new

body = [Falcon::DomainReportExecutionLaunchRequestV1.new(
  id: 'string'
)]

response = api.scheduled_reports_launch(body)

puts response

scheduled_reports_get

Retrieve scheduled reports for the provided report IDs.

GET /reports/entities/scheduled-reports/v1

Scope Scheduled Reports: READ Consumes · Produces application/json

PEP 8 get_reports

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The scheduled_report id to get details about.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import ScheduledReports

falcon = ScheduledReports(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_reports(ids=id_list)
print(response)

from falconpy import ScheduledReports

falcon = ScheduledReports(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.scheduled_reports_get(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("scheduled_reports_get",
                          ids=id_list)
print(response)

Get-FalconScheduledReport -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/scheduled_reports"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ScheduledReports.QueryByID(
    &scheduled_reports.QueryByIDParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.scheduledReports.queryById(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::scheduled_reports_api::scheduled_reports_get;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = scheduled_reports_get(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ScheduledReports.new

response = api.scheduled_reports_get(['ID1', 'ID2', 'ID3'])

puts response

scheduled_reports_query

Find all report IDs matching the query with filter

GET /reports/queries/scheduled-reports/v1

Scope Scheduled Reports: READ Consumes · Produces application/json

PEP 8 query_reports

Parameters

Name	Type	Data type	Description
filter	query	string	FQL query specifying the filter parameters. Filter term criteria: type, trigger_reference, recipients, user_uuid, cid, trigger_params.metadata. Filter range criteria: created_on, modified_on; use any common date format, such as ‘2010-05-15T14:55:21.892315096Z’
limit	query	integer	Number of ids to return.
offset	query	string	Starting index of overall result set from which to return ids.
parameters	query	dictionary	Full query string parameters payload in JSON format.
q	query	string	Match query criteria, which includes all the filter string fields.
sort	query	string	Possible order by fields: created_on, last_updated_on, last_execution_on, next_execution_on

Code Examples

from falconpy import ScheduledReports

falcon = ScheduledReports(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.query_reports(filter="string",
                                limit="string",
                                offset=integer,
                                q="string",
                                sort="string")
print(response)

from falconpy import ScheduledReports

falcon = ScheduledReports(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.scheduled_reports_query(filter="string",
                                          limit="string",
                                          offset=integer,
                                          q="string",
                                          sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("scheduled_reports_query",
                          sort="string",
                          filter="string",
                          q="string",
                          offset="string",
                          limit=integer)
print(response)

Get-FalconScheduledReport -Filter "string" `
  -Query "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/scheduled_reports"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  sort := "string"
  filter := "string"
  q := "string"
  offset := "string"
  limit := int64(0)

  response, err := client.ScheduledReports.Query(
    &scheduled_reports.QueryParams{
      Sort: &sort,
      Filter: &filter,
      Q: &q,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.scheduledReports.query(
  "string",  // sort
  "string",  // filter
  "string",  // q
  "string",  // offset
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::scheduled_reports_api::scheduled_reports_query;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = scheduled_reports_query(
        &falcon.cfg,  // configuration
        Some("string"),  // sort
        Some("string"),  // filter
        Some("string"),  // q
        Some("string"),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ScheduledReports.new

response = api.scheduled_reports_query(sort: 'string',
                                       filter: 'string',
                                       q: 'string',
                                       offset: 'string',
                                       limit: integer)

puts response

Scheduled Reports

Table of Contents

scheduled_reports_launch

Parameters

Code Examples

scheduled_reports_get

Parameters

Code Examples

scheduled_reports_query

Parameters

Code Examples