Skip to content

Sensor Download

The Sensor Download service collection provides operations for discovering, querying, and downloading CrowdStrike Falcon sensor installers. Retrieve combined sensor installer details, download installers by SHA256 ID, get installer entities, retrieve the CCID for sensor deployment, and query installer IDs. Multiple versioned endpoints (v1, v2, v3) are available for each operation.

LanguageLast Update
Pythonv1.6.1
PowerShellv2.2.9
Gov0.20.0
TypeScriptv0.6.0
Rustv0.7.0
Rubyv1.2.0
OperationDescription
GetCombinedSensorInstallersByQuery
get_combined_sensor_installers_by_query
Get sensor installer details by provided query
GetCombinedSensorInstallersByQueryV2
get_combined_sensor_installers_by_query_v2
Get sensor installer details by provided query
GetCombinedSensorInstallersByQueryV3
get_combined_sensor_installers_by_query_v3
Get sensor installer details by provided query
DownloadSensorInstallerById
download_sensor_installer
Download sensor installer by SHA256 ID
DownloadSensorInstallerByIdV2
download_sensor_installer_v2
Download sensor installer by SHA256 ID
DownloadSensorInstallerByIdV3
download_sensor_installer_v3
Download sensor installer by SHA256 ID
GetSensorInstallersEntities
get_sensor_installer_entities
Get sensor installer details by provided SHA256 IDs
GetSensorInstallersEntitiesV2
get_sensor_installer_entities_v2
Get sensor installer details by provided SHA256 IDs
GetSensorInstallersEntitiesV3
get_sensor_installer_entities_v3
Get sensor installer details by provided SHA256 IDs
GetSensorInstallersCCIDByQuery
get_sensor_installer_ccid
Get CCID to use with sensor installers
GetSensorInstallersByQuery
get_sensor_installers_by_query
Get sensor installer IDs by provided query
GetSensorInstallersByQueryV2
get_sensor_installers_by_query_v2
Get sensor installer IDs by provided query
GetSensorInstallersByQueryV3
get_sensor_installers_by_query_v3
Get sensor installer IDs by provided query

Get sensor installer details by provided query

GET /sensors/combined/installers/v1
Scope Sensor Download: READ Consumes · Produces application/json
PEP 8 get_combined_sensor_installers_by_query
NameTypeData typeDescription
limitqueryintegerThe number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
filterquerystringFilter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include: platform:“windows”, version:>“5.2”
offsetqueryintegerThe first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
parametersquerydictionaryFull query string parameters payload in JSON format.
sortquerystringSort items using their properties. Common sort options include: version|asc, release_date|desc
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_combined_sensor_installers_by_query(filter="string",
limit=integer,
offset=integer,
sort="string")
print(response)

Get sensor installer details by provided query

GET /sensors/combined/installers/v2
Scope Sensor Download: READ Consumes · Produces application/json
PEP 8 get_combined_sensor_installers_by_query_v2
NameTypeData typeDescription
limitqueryintegerThe number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
filterquerystringFilter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include: platform:“windows”, version:>“5.2”
offsetqueryintegerThe first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
parametersquerydictionaryFull query string parameters payload in JSON format.
sortquerystringSort items using their properties. Common sort options include: version|asc, release_date|desc
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_combined_sensor_installers_by_query_v2(filter="string",
limit=integer,
offset=integer,
sort="string")
print(response)

Get sensor installer details by provided query

GET /sensors/combined/installers/v3
Scope Sensor Download: READ Consumes · Produces application/json
PEP 8 get_combined_sensor_installers_by_query_v3
NameTypeData typeDescription
filterquerystringFilter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include: platform:“windows”, version:>“5.2”
limitqueryintegerThe number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
offsetqueryintegerThe first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
parametersquerydictionaryFull query string parameters payload in JSON format.
sortquerystringSort items using their properties. Common sort options include: version|asc, release_date|desc
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_combined_sensor_installers_by_query_v3(offset=integer,
limit=integer,
sort="string",
filter="string")
print(response)

Download sensor installer by SHA256 ID

GET /sensors/entities/download-installer/v1
Scope Sensor Download: READ Consumes · Produces application/json · application/octet-stream
PEP 8 download_sensor_installer
NameTypeData typeDescription
download_pathquerystringFile path to use for the saved file. Must be present to trigger a file download.
idquerystringSHA256 of the installer to download
file_namequerystringFile name to use for the saved file. Must be present to trigger a file download.
parametersquerydictionaryFull query string parameters payload in JSON format.
streamquerybooleanEnable streaming download of the returned file.
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
with open("output_file", "wb") as save_file:
response = falcon.download_sensor_installer(download_path="string",
id="string",
file_name="string",
stream=boolean,
stream=boolean)
save_file.write(response)

Download sensor installer by SHA256 ID

GET /sensors/entities/download-installer/v2
Scope Sensor Download: READ Consumes · Produces application/json · application/octet-stream
PEP 8 download_sensor_installer_v2
NameTypeData typeDescription
download_pathquerystringFile path to use for the saved file. Must be present to trigger a file download.
idquerystringSHA256 of the installer to download
file_namequerystringFile name to use for the saved file. Must be present to trigger a file download.
parametersquerydictionaryFull query string parameters payload in JSON format.
streamquerybooleanEnable streaming download of the returned file.
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
with open("output_file", "wb") as save_file:
response = falcon.download_sensor_installer_v2(download_path="string",
id="string",
file_name="string",
stream=boolean,
stream=boolean)
save_file.write(response)

Download sensor installer by SHA256 ID

GET /sensors/entities/download-installer/v3
Scope Sensor Download: READ Consumes · Produces application/json · application/octet-stream
PEP 8 download_sensor_installer_v3
NameTypeData typeDescription
idquerystringSHA256 of the installer to download.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
with open("output_file", "wb") as save_file:
response = falcon.download_sensor_installer_v3(id="string", stream=boolean)
save_file.write(response)

Get sensor installer details by provided SHA256 IDs

GET /sensors/entities/installers/v1
Scope Sensor Download: READ Consumes · Produces application/json
PEP 8 get_sensor_installer_entities
NameTypeData typeDescription
idsquerystring or list of stringsThe IDs of the installers to retrieve details for.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_sensor_installer_entities(ids=id_list)
print(response)

Get sensor installer details by provided SHA256 IDs

GET /sensors/entities/installers/v2
Scope Sensor Download: READ Consumes · Produces application/json
PEP 8 get_sensor_installer_entities_v2
NameTypeData typeDescription
idsquerystring or list of stringsThe IDs of the installers to retrieve details for.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_sensor_installer_entities_v2(ids=id_list)
print(response)

Get sensor installer details by provided SHA256 IDs

GET /sensors/entities/installers/v3
Scope Sensor Download: READ Consumes · Produces application/json
PEP 8 get_sensor_installer_entities_v3
NameTypeData typeDescription
idsquerystring or list of stringsThe IDs of the installers.
parametersquerydictionaryFull query string parameters payload in JSON format.
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_sensor_installer_entities_v3(ids=id_list)
print(response)

Get CCID to use with sensor installers

GET /sensors/queries/installers/ccid/v1
Scope Sensor Download: READ Consumes · Produces application/json
PEP 8 get_sensor_installer_ccid

No keywords or arguments accepted.

from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_sensor_installer_ccid()
print(response)

Get sensor installer IDs by provided query

GET /sensors/queries/installers/v1
Scope Sensor Download: READ Consumes · Produces application/json
PEP 8 get_sensor_installers_by_query
NameTypeData typeDescription
filterquerystringFilter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include: platform:“windows”, version:>“5.2”
limitqueryintegerThe number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
offsetqueryintegerThe first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
parametersquerydictionaryFull query string parameters payload in JSON format.
sortquerystringSort items using their properties. Common sort options include: version|asc, release_date|desc
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_sensor_installers_by_query(filter="string",
limit=integer,
offset=integer,
sort="string")
print(response)

Get sensor installer IDs by provided query

GET /sensors/queries/installers/v2
Scope Sensor Download: READ Consumes · Produces application/json
PEP 8 get_sensor_installers_by_query_v2
NameTypeData typeDescription
filterquerystringFilter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include: platform:“windows”, version:>“5.2”
limitqueryintegerThe number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
offsetqueryintegerThe first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
parametersquerydictionaryFull query string parameters payload in JSON format.
sortquerystringSort items using their properties. Common sort options include: version|asc, release_date|desc
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_sensor_installers_by_query_v2(filter="string",
limit=integer,
offset=integer,
sort="string")
print(response)

Get sensor installer IDs by provided query

GET /sensors/queries/installers/v3
Scope Sensor Download: READ Consumes · Produces application/json
PEP 8 get_sensor_installers_by_query_v3
NameTypeData typeDescription
filterquerystringFilter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include: platform:“windows”, version:>“5.2”
limitqueryintegerThe number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
offsetqueryintegerThe first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
parametersquerydictionaryFull query string parameters payload in JSON format.
sortquerystringSort items using their properties. Common sort options include: version|asc, release_date|desc
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_sensor_installers_by_query_v3(offset=integer,
limit=integer,
sort="string",
filter="string")
print(response)
Sensor Download samples