Skip to content

Sensor Download

The Sensor Download service collection provides operations for discovering, querying, and downloading CrowdStrike Falcon sensor installers. Retrieve combined sensor installer details, download installers by SHA256 ID, get installer entities, retrieve the CCID for sensor deployment, and query installer IDs. Multiple versioned endpoints (v1, v2, v3) are available for each operation.

LanguageLast Update
Pythonv1.6.5
PowerShellv2.2.9
Gov0.22.0
TypeScriptv0.6.0
Rustv0.7.1
Rubyv1.4.0

This service collection has code examples posted to the repository.



OperationDescription
DownloadSensorInstallerById
download_sensor_installer
Download sensor installer by SHA256 ID
DownloadSensorInstallerByIdV2
download_sensor_installer_v2
Download sensor installer by SHA256 ID
DownloadSensorInstallerByIdV3
download_sensor_installer_v3
Download sensor installer by SHA256 ID
GetCombinedSensorInstallersByQuery
get_combined_sensor_installers_by_query
Get sensor installer details by provided query
GetCombinedSensorInstallersByQueryV2
get_combined_sensor_installers_by_query_v2
Get sensor installer details by provided query
GetCombinedSensorInstallersByQueryV3
get_combined_sensor_installers_by_query_v3
Get sensor installer details by provided query
GetSensorInstallersByQuery
get_sensor_installers_by_query
Get sensor installer IDs by provided query
GetSensorInstallersByQueryV2
get_sensor_installers_by_query_v2
Get sensor installer IDs by provided query
GetSensorInstallersByQueryV3
get_sensor_installers_by_query_v3
Get sensor installer IDs by provided query
GetSensorInstallersCCIDByQuery
get_sensor_installer_ccid
Get CCID to use with sensor installers
GetSensorInstallersEntities
get_sensor_installer_entities
Get sensor installer details by provided SHA256 IDs
GetSensorInstallersEntitiesV2
get_sensor_installer_entities_v2
Get sensor installer details by provided SHA256 IDs
GetSensorInstallersEntitiesV3
get_sensor_installer_entities_v3
Get sensor installer details by provided SHA256 IDs

Download sensor installer by SHA256 ID

Method GET
Route /sensors/entities/download-installer/v1
Scope Sensor Download: READ
PEP 8 download_sensor_installer
id query · string
SHA256 of the installer to download
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
download_path body · string
Path to the folder to save installer file. Must be present to cause a file download.
file_name body · string
Name to use for saved file. Must be present to cause a file download.
stream body · boolean
Enable streaming download of the file.
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
with open("output_file", "wb") as save_file:
response = falcon.download_sensor_installer(download_path="string",
id="string",
file_name="string",
stream=boolean,
stream=boolean)
save_file.write(response)
{}


Download sensor installer by SHA256 ID

Method GET
Route /sensors/entities/download-installer/v2
Scope Sensor Download: READ
PEP 8 download_sensor_installer_v2
id query · string
SHA256 of the installer to download
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
download_path body · string
Path to the folder to save installer file. Must be present to cause a file download.
file_name body · string
Name to use for saved file. Must be present to cause a file download.
stream body · boolean
Enable streaming download of the file.
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
with open("output_file", "wb") as save_file:
response = falcon.download_sensor_installer_v2(download_path="string",
id="string",
file_name="string",
stream=boolean,
stream=boolean)
save_file.write(response)
{}


Download sensor installer by SHA256 ID

Method GET
Route /sensors/entities/download-installer/v3
Scope Sensor Download: READ
PEP 8 download_sensor_installer_v3
id query · string
SHA256 of the installer to download
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
with open("output_file", "wb") as save_file:
response = falcon.download_sensor_installer_v3(id="string", stream=boolean)
save_file.write(response)
{}


Get sensor installer details by provided query

Method GET
Route /sensors/combined/installers/v1
Scope Sensor Download: READ
PEP 8 get_combined_sensor_installers_by_query
offset query · integer
The first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
limit query · integer
The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
sort query · string
Sort items using their properties.
filter query · string
Filter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include: <ul><li>platform:“windows”</li><li>version:>“5.2”</li></ul>
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_combined_sensor_installers_by_query(filter="string",
limit=integer,
offset=integer,
sort="string")
print(response)
[
{
"description": "string",
"file_size": 0,
"file_type": "string",
"name": "string",
"os": "string",
"os_version": "string",
"platform": "string",
"release_date": "string",
"sha256": "string",
"version": "string"
}
]


Get sensor installer details by provided query

Method GET
Route /sensors/combined/installers/v2
Scope Sensor Download: READ
PEP 8 get_combined_sensor_installers_by_query_v2
offset query · integer
The first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
limit query · integer
The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
sort query · string
Sort items using their properties.
filter query · string
Filter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include: <ul><li>platform:“windows”</li><li>version:>“5.2”</li></ul>
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_combined_sensor_installers_by_query_v2(filter="string",
limit=integer,
offset=integer,
sort="string")
print(response)
[
{
"architectures": [],
"description": "string",
"file_size": 0,
"file_type": "string",
"ltv_expiry_date": "string",
"ltv_promoted_date": "string",
"name": "string",
"os": "string",
"os_version": "string",
"platform": "string",
"release_date": "string",
"sha256": "string",
"version": "string"
}
]


Get sensor installer details by provided query

Method GET
Route /sensors/combined/installers/v3
Scope Sensor Download: READ
PEP 8 get_combined_sensor_installers_by_query_v3
offset query · integer
The first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
limit query · integer
The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
sort query · string
Sort items using their properties.
filter query · string
Filter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include: <ul><li>platform:“windows”</li><li>version:>“5.2”</li></ul>
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_combined_sensor_installers_by_query_v3(offset=integer,
limit=integer,
sort="string",
filter="string")
print(response)
[
{
"architectures": [],
"description": "string",
"file_size": 0,
"file_type": "string",
"is_lts": false,
"lts_expiry_date": "string",
"ltv_expiry_date": "string",
"ltv_promoted_date": "string",
"name": "string",
"os": "string",
"os_version": "string",
"platform": "string",
"release_date": "string",
"sha256": "string",
"version": "string"
}
]


Get sensor installer IDs by provided query

Method GET
Route /sensors/queries/installers/v1
Scope Sensor Download: READ
PEP 8 get_sensor_installers_by_query
offset query · integer
The first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
limit query · integer
The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
sort query · string
Sort items using their properties.
filter query · string
Filter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include: <ul><li>platform:“windows”</li><li>version:>“5.2”</li></ul>
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_sensor_installers_by_query(filter="string",
limit=integer,
offset=integer,
sort="string")
print(response)
[
"string"
]


Get sensor installer IDs by provided query

Method GET
Route /sensors/queries/installers/v2
Scope Sensor Download: READ
PEP 8 get_sensor_installers_by_query_v2
offset query · integer
The first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
limit query · integer
The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
sort query · string
Sort items using their properties.
filter query · string
Filter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include: <ul><li>platform:“windows”</li><li>version:>“5.2”</li></ul>
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_sensor_installers_by_query_v2(filter="string",
limit=integer,
offset=integer,
sort="string")
print(response)
[
"string"
]


Get sensor installer IDs by provided query

Method GET
Route /sensors/queries/installers/v3
Scope Sensor Download: READ
PEP 8 get_sensor_installers_by_query_v3
offset query · integer
The first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results.
limit query · integer
The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to manage pagination of results.
sort query · string
Sort items using their properties.
filter query · string
Filter items using a query in Falcon Query Language (FQL). An asterisk wildcard * includes all results. Common filter options include: <ul><li>platform:“windows”</li><li>version:>“5.2”</li></ul>
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_sensor_installers_by_query_v3(offset=integer,
limit=integer,
sort="string",
filter="string")
print(response)
[
"string"
]


Get CCID to use with sensor installers

Method GET
Route /sensors/queries/installers/ccid/v1
Scope Sensor Download: READ
PEP 8 get_sensor_installer_ccid
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.get_sensor_installer_ccid()
print(response)
[
"string"
]


Get sensor installer details by provided SHA256 IDs

Method GET
Route /sensors/entities/installers/v1
Scope Sensor Download: READ
PEP 8 get_sensor_installer_entities
ids query · string or list of strings
The IDs of the installers
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_sensor_installer_entities(ids=id_list)
print(response)
[
{
"description": "string",
"file_size": 0,
"file_type": "string",
"name": "string",
"os": "string",
"os_version": "string",
"platform": "string",
"release_date": "string",
"sha256": "string",
"version": "string"
}
]


Get sensor installer details by provided SHA256 IDs

Method GET
Route /sensors/entities/installers/v2
Scope Sensor Download: READ
PEP 8 get_sensor_installer_entities_v2
ids query · string or list of strings
The IDs of the installers
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_sensor_installer_entities_v2(ids=id_list)
print(response)
[
{
"architectures": [],
"description": "string",
"file_size": 0,
"file_type": "string",
"ltv_expiry_date": "string",
"ltv_promoted_date": "string",
"name": "string",
"os": "string",
"os_version": "string",
"platform": "string",
"release_date": "string",
"sha256": "string",
"version": "string"
}
]


Get sensor installer details by provided SHA256 IDs

Method GET
Route /sensors/entities/installers/v3
Scope Sensor Download: READ
PEP 8 get_sensor_installer_entities_v3
ids query · string or list of strings
The IDs of the installers
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
from falconpy import SensorDownload
falcon = SensorDownload(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_sensor_installer_entities_v3(ids=id_list)
print(response)
[
{
"architectures": [],
"description": "string",
"file_size": 0,
"file_type": "string",
"is_lts": false,
"lts_expiry_date": "string",
"ltv_expiry_date": "string",
"ltv_promoted_date": "string",
"name": "string",
"os": "string",
"os_version": "string",
"platform": "string",
"release_date": "string",
"sha256": "string",
"version": "string"
}
]