Scheduled Reports

The Scheduled Reports service collection provides operations for managing and executing scheduled reports in your CrowdStrike Falcon environment. Launch report executions, retrieve report details by ID, and query for report IDs matching filter criteria.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
scheduled-reports.get get_reports	Retrieve scheduled reports for the provided report IDs.
scheduled-reports.launch launch	Launch scheduled reports executions for the provided report IDs.
scheduled-reports.query query_reports	Find all report IDs matching the query with filter

---

scheduled-reports.get

Retrieve scheduled reports for the provided report IDs.

Method GET

Route /reports/entities/scheduled-reports/v1

Scope Scheduled Reports: READ

PEP 8 get_reports

Parameters

ids query · string or list of strings

The scheduled_report id to get details about.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ScheduledReports

falcon = ScheduledReports(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_reports(ids=id_list)
print(response)

Operation ID

from falconpy import ScheduledReports

falcon = ScheduledReports(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.scheduled_reports_get(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("scheduled_reports_get",
                          ids=id_list)
print(response)

PowerShell

Get-FalconScheduledReport -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/scheduled_reports"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ScheduledReports.QueryByID(
    &scheduled_reports.QueryByIDParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.scheduledReports.queryById(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::scheduled_reports_api::scheduled_reports_get;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = scheduled_reports_get(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ScheduledReports.new

response = api.scheduled_reports_get(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "api_client_id": "string",
    "can_write": false,
    "created_on": "string",
    "customer_id": "string",
    "description": "string",
    "expiration_on": "string",
    "id": "string",
    "last_execution": {},
    "last_updated_on": "string",
    "name": "string",
    "next_execution_on": "string",
    "notifications": [],
    "owned_by_cs": false,
    "report_metadata": {},
    "report_params": {},
    "schedule": {},
    "schedule_type": "string",
    "secret_references": {},
    "shared_with": [],
    "start_on": "string",
    "status": "string",
    "stop_on": "string",
    "stopped_by_cs": false,
    "tracking": "string",
    "trigger_reference": "string",
    "type": "string",
    "user_id": "string",
    "user_uuid": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

scheduled-reports.launch

Launch scheduled reports executions for the provided report IDs.

Method POST

Route /reports/entities/scheduled-reports/execution/v1

Scope Scheduled Reports: READ

PEP 8 launch

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

id body · string

ids body · string or list of strings

ID of the report to launch.

Code Examples

Python

PEP 8

from falconpy import ScheduledReports

falcon = ScheduledReports(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.launch(ids=id_list)
print(response)

Operation ID

from falconpy import ScheduledReports

falcon = ScheduledReports(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.scheduled_reports_launch(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = [
    {
        "id": "string"
    }
]

response = falcon.command("scheduled_reports_launch", body=body_payload)
print(response)

PowerShell

Invoke-FalconScheduledReport -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/scheduled_reports"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  id := "string"

  response, err := client.ScheduledReports.Execute(
    &scheduled_reports.ExecuteParams{
      Body: []*models.DomainReportExecutionLaunchRequestV1{
        {
          ID: &id,
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.scheduledReports.execute(
  [{
    id: "string"
}]  // body
);

console.log(response);

Rust

use rusty_falcon::apis::scheduled_reports_api::scheduled_reports_launch;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainReportExecutionLaunchRequestV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = vec![DomainReportExecutionLaunchRequestV1 {
            id: Some("string".to_string()),
            ..Default::default()
        }];

    let response = scheduled_reports_launch(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ScheduledReports.new

body = [Falcon::DomainReportExecutionLaunchRequestV1.new(
  id: 'string'
)]

response = api.scheduled_reports_launch(body)

puts response

Responses

200 OK

[
  {
    "can_write": false,
    "created_on": "string",
    "customer_id": "string",
    "execution_metadata": {},
    "expiration_on": "string",
    "id": "string",
    "job_reference": "string",
    "last_updated_on": "string",
    "report_file_reference": "string",
    "report_params": {},
    "result_metadata": {},
    "scheduled_report_id": "string",
    "secret_references": {},
    "shared_with": [],
    "status": "string",
    "status_display": "string",
    "status_msg": "string",
    "tracking": "string",
    "trigger_reference": "string",
    "type": "string",
    "user_id": "string",
    "user_uuid": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

scheduled-reports.query

Find all report IDs matching the query with filter

Method GET

Route /reports/queries/scheduled-reports/v1

Scope Scheduled Reports: READ

PEP 8 query_reports

Parameters

sort query · string

Possible order by fields:

Available values (4)

created_on	last_updated_on	last_execution_on
next_execution_on

filter query · string

FQL query specifying the filter parameters. Filter term criteria:

Available values (7)

type	trigger_reference	recipients
user_uuid	cid	trigger_params.metadata
created_on

q query · string

Match query criteria, which includes all the filter string fields

offset query · string

Starting index of overall result set from which to return ids.

limit query · integer

Number of ids to return.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ScheduledReports

falcon = ScheduledReports(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.query_reports(filter="string",
                                limit=integer,
                                offset="string",
                                q="string",
                                sort="string")
print(response)

Operation ID

from falconpy import ScheduledReports

falcon = ScheduledReports(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.scheduled_reports_query(filter="string",
                                          limit=integer,
                                          offset="string",
                                          q="string",
                                          sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("scheduled_reports_query",
                          sort="string",
                          filter="string",
                          q="string",
                          offset="string",
                          limit=integer)
print(response)

PowerShell

Get-FalconScheduledReport -Filter "string" `
  -Query "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/scheduled_reports"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  sort := "string"
  filter := "string"
  q := "string"
  offset := "string"
  limit := int64(0)

  response, err := client.ScheduledReports.Query(
    &scheduled_reports.QueryParams{
      Sort: &sort,
      Filter: &filter,
      Q: &q,
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.scheduledReports.query(
  "string",  // sort
  "string",  // filter
  "string",  // q
  "string",  // offset
  integer  // limit
);

console.log(response);

Rust

use rusty_falcon::apis::scheduled_reports_api::scheduled_reports_query;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = scheduled_reports_query(
        &falcon.cfg,  // configuration
        Some("string"),  // sort
        Some("string"),  // filter
        Some("string"),  // q
        Some("string"),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ScheduledReports.new

response = api.scheduled_reports_query(sort: 'string',
                                       filter: 'string',
                                       q: 'string',
                                       offset: 'string',
                                       limit: integer)

puts response

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}