diff --git a/.github/wordlist.txt b/.github/wordlist.txt index 757c0a442..e52ab9b9b 100644 --- a/.github/wordlist.txt +++ b/.github/wordlist.txt @@ -1944,4 +1944,19 @@ cancelling visualise IDEs terraform -sdmf \ No newline at end of file +sdmf +Davack +mraible +Spans +Kakudou +liyander +numpydoc +reStructuredText +lifecycle +Orchestrator +GetEventsBody +GetEventsEntities +GetRulesEntities +retargeted +loopback +TLS diff --git a/.pylintrc b/.pylintrc index e765b717e..dfe3e2110 100644 --- a/.pylintrc +++ b/.pylintrc @@ -333,7 +333,9 @@ indent-string=' ' max-line-length=127 # Maximum number of lines in a module. -max-module-lines=1000 +# Raised from 1000 to accommodate the more verbose "format friendly" docstring +# style (one line per parameter name/type plus an indented description line). +max-module-lines=1300 # Allow the body of a class to be on the same line as the declaration if body # contains single statement. diff --git a/CHANGELOG.md b/CHANGELOG.md index fac224548..880cd1d1f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,290 @@ +# Version 1.6.5 +## Added features and functionality ++ Added: Optional `session` keyword argument (a `requests.Session` instance) accepted by `OAuth2`, `APIHarnessV2`, + the legacy `APIHarness`, and every Service Class, allowing callers to reuse a single HTTP connection across + login, every API call, token renewal, and logout. FalconPy never closes a session provided this way; the + caller retains ownership of its lifecycle. Behavior is unchanged when this keyword is omitted. + - `_util/_functions.py` + - `_api_request/_request.py` + - `_api_request/_request_connection.py` + - `_auth_object/_interface_config.py` + - `_auth_object/_falcon_interface.py` + - `_auth_object/_uber_interface.py` + - `oauth2.py` + - `_util/_service.py` + - `_util/_uber.py` + - `_service_class/_base_service_class.py` + - `api_complete/_legacy.py` + > Unit testing expanded to complete code coverage. + - `tests/test_session_support.py` + - `tests/test_session_connection_reuse.py` + - Thanks to @Davack for their contribution! 🙇 + ++ Added: New __Agent Invocation__ service collection with three operations. + - _invoke_published_agent_external_v1_ + - _get_agent_invocation_v3_ + - _invoke_agent_version_external_v1_ + - `_endpoint/__init__.py` + - `_endpoint/_agent_invocation.py` + - `_payload/__init__.py` + - `_payload/_agent_invocation.py` + - `__init__.py` + - `agent_invocation.py` + > Unit testing expanded to complete code coverage. + - `tests/test_agent_invocation.py` + ++ Added: New __Agent Templates__ service collection with two operations. + - _entities_agent_templates_v1_ + - _queries_agent_templates_v1_ + - `_endpoint/__init__.py` + - `_endpoint/_agent_templates.py` + - `_payload/__init__.py` + - `_payload/_agent_templates.py` + - `__init__.py` + - `agent_templates.py` + > Unit testing expanded to complete code coverage. + - `tests/test_agent_templates.py` + ++ Added: New __Agent Versions__ service collection with two operations. + - _get_agent_versions_v1_ + - _query_agent_versions_v1_ + - `_endpoint/__init__.py` + - `_endpoint/_agent_versions.py` + - `_payload/__init__.py` + - `_payload/_agent_versions.py` + - `__init__.py` + - `agent_versions.py` + > Unit testing expanded to complete code coverage. + - `tests/test_agent_versions.py` + ++ Added: Added `entities_merge_post_v1` operation to the __Case Management__ service collection. + - _entities_merge_post_v1_ + - `_endpoint/_case_management.py` + - `case_management.py` + > Unit testing expanded to complete code coverage. + - `tests/test_case_management.py` + ++ Updated: Added `enriched` as an allowed parameter in the _GetRuleInputSchema_ operation within the __Cloud Policies__ service collection. + - `_endpoint/_cloud_policies.py` + - `cloud_policies.py` + ++ Updated: Added `sort` as an allowed parameter in the _cloud_security_assets_combined_application_findings_ operation, updated the `filter` parameter description in the _cloud_security_assets_combined_compliance_by_account_ operation, and updated the `filter` parameter description in the _cloud_security_assets_queries_ operation within the __Cloud Security Assets__ service collection. + - `_endpoint/_cloud_security_assets.py` + - `cloud_security_assets.py` + ++ Added: Added `cspm_evaluations_iom_entities_post` operation to the __Cloud Security Detections__ service collection. + - _cspm_evaluations_iom_entities_post_ + - `_endpoint/_cloud_security_detections.py` + - `cloud_security_detections.py` + > Unit testing expanded to complete code coverage. + - `tests/test_cloud_security_detections.py` + ++ Added: Added `entities_rules_ownership_put_v2` operation to the __Correlation Rules Admin__ service collection. + - _entities_rules_ownership_put_v2_ + - `_endpoint/_correlation_rules_admin.py` + - `correlation_rules_admin.py` + > Unit testing expanded to complete code coverage. + - `tests/test_correlation_rules_admin.py` + ++ Added: Added five new operations to the __Data Protection Configuration__ service collection. + - _entities_web_location_group_get_ + - _entities_web_location_group_create_ + - _entities_web_location_group_delete_ + - _entities_web_location_group_patch_ + - _queries_web_location_group_get_ + - `_endpoint/_data_protection_configuration.py` + - `data_protection_configuration.py` + > Unit testing expanded to complete code coverage. + - `tests/test_data_protection_configuration.py` + ++ Updated: Added `Authorization` as an allowed parameter to the _CombinedReleaseNotesV1_, _CombinedReleasesV1Mixin0_, _GetDeploymentsExternalV1_, _GetEntityIDsByQueryPOST_, _GetEntityIDsByQueryPOSTV2_, and _QueryReleaseNotesV1_ operations within the __Deployments__ service collection. + - `_endpoint/_deployments.py` + - `deployments.py` + ++ Updated: Added `cloud_service_compartment_id` as an allowed `sort` value for the _CombinedHiddenDevicesByFilter_ and _CombinedDevicesByFilter_ operations within the __Hosts__ service collection. + - `_endpoint/_hosts.py` + - `hosts.py` + ++ Decommissioned: Decommissioned all six operations within the __Incidents__ service collection (_CrowdScore_, _GetBehaviors_, _GetIncidents_, _PerformIncidentAction_, _QueryBehaviors_, and _QueryIncidents_). The Incidents API reached end of life and these operations were removed from the API specification. The `Incidents` Service Class and its methods remain importable and are tagged `DECOMMISSIONED` so existing code continues to load, but calls to these operations will no longer succeed. Use the __Alerts__ service collection instead. + - `_endpoint/_incidents.py` + - `_endpoint/deprecated/_incidents.py` + - `_endpoint/deprecated/_mapping.py` + - `incidents.py` + ++ Decommissioned: Decommissioned `AggregatesKnowledgeBaseAuditEventsV1` operation in the __Knowledge Base Audit Events__ service collection. + - `_endpoint/_knowledge_base_audit_events.py` + - `_endpoint/deprecated/_knowledge_base_audit_events.py` + - `_endpoint/deprecated/_mapping.py` + - `knowledge_base_audit_events.py` + ++ Decommissioned: Decommissioned `AggregatesKnowledgeBasesV1` operation in the __Knowledge Bases__ service collection. + - `_endpoint/_knowledge_bases.py` + - `_endpoint/deprecated/_knowledge_bases.py` + - `_endpoint/deprecated/_mapping.py` + - `knowledge_bases.py` + ++ Added: Added `PostAggregatesPods` operation to the __Kubernetes Protection__ service collection. + - _post_aggregates_pods_ + - `_endpoint/_kubernetes_protection.py` + - `kubernetes_protection.py` + > Unit testing expanded to complete code coverage. + - `tests/test_kubernetes_protection.py` + ++ Added: Added `exclusions_sdmf_query_v1` operation to the __Ml Exclusions__ service collection. + - _exclusions_sdmf_query_v1_ + - `_endpoint/_ml_exclusions.py` + - `ml_exclusions.py` + > Unit testing expanded to complete code coverage. + - `tests/test_ml_exclusions.py` + ++ Added: New __Models__ service collection with two operations. + - _entities_models_v1_ + - _queries_models_v1_ + - `_endpoint/__init__.py` + - `_endpoint/_models.py` + - `_payload/__init__.py` + - `_payload/_models.py` + - `__init__.py` + - `models.py` + > Unit testing expanded to complete code coverage. + - `tests/test_models.py` + ++ Added: Added 18 new operations to the __Ngsiem__ service collection. + - _bulk_add_dashboard_labels_ + - _bulk_remove_dashboard_labels_ + - _bulk_update_dashboard_labels_ + - _bulk_add_lookup_file_labels_ + - _bulk_remove_lookup_file_labels_ + - _bulk_update_lookup_file_labels_ + - _bulk_add_saved_query_labels_ + - _bulk_remove_saved_query_labels_ + - _bulk_update_saved_query_labels_ + - _update_dashboard_labels_ + - _add_dashboard_labels_ + - _remove_dashboard_labels_ + - _update_file_labels_ + - _add_file_labels_ + - _remove_file_labels_ + - _update_saved_query_labels_ + - _add_saved_query_labels_ + - _remove_saved_query_labels_ + - `_endpoint/_ngsiem.py` + - `ngsiem.py` + > Unit testing expanded to complete code coverage. + - `tests/test_ngsiem.py` + ++ Added: New __Scanning Orchestrator__ service collection with eight operations. + - _get_combined_schedules_ + - _trigger_scan_by_schedule_ + - _get_schedules_ + - _create_schedules_ + - _delete_schedules_ + - _update_schedules_ + - _get_service_types_ + - _search_schedules_ + - `_endpoint/__init__.py` + - `_endpoint/_scanning_orchestrator.py` + - `_payload/__init__.py` + - `_payload/_scanning_orchestrator.py` + - `__init__.py` + - `scanning_orchestrator.py` + > Unit testing expanded to complete code coverage. + - `tests/test_scanning_orchestrator.py` + ++ Added: New __Spans__ service collection with two operations. + - _entities_spans_v1_ + - _queries_spans_v1_ + - `_endpoint/__init__.py` + - `_endpoint/_spans.py` + - `_payload/__init__.py` + - `_payload/_spans.py` + - `__init__.py` + - `spans.py` + > Unit testing expanded to complete code coverage. + - `tests/test_spans.py` + ++ Added: New __Stream__ service collection with one operation. + - _stream_invocation_response_v1_ + - `_endpoint/__init__.py` + - `_endpoint/_stream.py` + - `_payload/__init__.py` + - `_payload/_stream.py` + - `__init__.py` + - `stream.py` + > Unit testing expanded to complete code coverage. + - `tests/test_stream.py` + ++ Updated: Added `Authorization` as an allowed parameter to the _GetEventsBody_, _GetEventsEntities_, _QueryEvents_, _GetRulesEntities_, and _QueryRules_ operations within the __Tailored Intelligence__ service collection. + - `_endpoint/_tailored_intelligence.py` + - `tailored_intelligence.py` + ++ Added: New __Tools__ service collection with two operations. + - _entities_tools_v1_ + - _queries_tools_v1_ + - `_endpoint/__init__.py` + - `_endpoint/_tools.py` + - `_payload/__init__.py` + - `_payload/_tools.py` + - `__init__.py` + - `tools.py` + > Unit testing expanded to complete code coverage. + - `tests/test_tools.py` + ++ Decommissioned: Decommissioned `WorkflowExecuteInternal` operation in the __Workflows__ service collection. + - `_endpoint/_workflows.py` + - `_endpoint/deprecated/_workflows.py` + - `_endpoint/deprecated/_mapping.py` + - `workflows.py` + ++ Updated: Added `include_mocks` and `version` as allowed parameters in the _WorkflowDefinitionsExport_ operation within the __Workflows__ service collection. + - `_endpoint/_workflows.py` + - `workflows.py` + ++ Updated: Converted method docstrings within every service collection to the "format friendly" style. Keyword arguments and return values are now typed entries beneath underlined section headers, which is valid numpydoc and reStructuredText and renders as structured documentation in editors and IDEs. Method behavior is unchanged. + - `*.py` (every service collection) + - `.pylintrc` + +## Issues resolved ++ Fixed: Fixed the documented `body` keyword argument being ignored by the _start_search_ method within the __NGSIEM__ service collection. The search payload was only built when `body` was absent, and the request was then gated on that payload, so passing `body` returned a local error result without calling the API. The `search` keyword is unaffected. Closes #1491. + - `ngsiem.py` + > Unit testing expanded to complete code coverage. + - `tests/test_ngsiem.py` + - Thanks go out to @mraible for identifying, reporting, and confirming a fix for this issue! 🙇 + ++ Fixed: Documented the timestamp format required by the `filter` keyword for the _query_malware_ and _query_malware_entities_ operations within the __Intel__ service collection. These operations return `last_updated` and `created_timestamp` as ISO 8601 strings, so filter values for those fields must be quoted (`last_updated:>='2026-01-28T10:22:34Z'`). An unquoted value is parsed as an integer, so a Unix epoch timestamp is accepted but matches no records, making the filter appear to be ignored. FalconPy passes the `filter` value to the API unmodified, so this is a documentation change only. Closes #1422. + - `intel.py` + - Thanks go out to @Kakudou for identifying and reporting this issue! 🙇 + ++ Fixed: Fixed path parameters being interpolated into operation routes without per-segment encoding. A value containing a forward slash or a dot-segment sequence altered the generated path, and since the `requests` library normalizes a path before transmission, the request could be issued against a different route than the calling method selected. The new `encode_path_segment` handler is applied at all three route construction sites: `handle_path_variables` (Service Classes), `handle_field` and `scrub_target` (the Uber Class), and the path variable handlers within the legacy `APIHarness`. Integers, UUIDs and hyphenated keys are unaffected. Closes #1488. + - `_util/__init__.py` + - `_util/_functions.py` + - `_util/_uber.py` + - `api_complete/_legacy.py` + > Unit testing expanded to complete code coverage. + - `tests/test_path_encoding.py` + - Thanks go out to @liyander for identifying and reporting this issue! 🙇 + ++ Fixed: Fixed Context Authentication discarding an explicitly provided `base_url`. The cloud region advertised by the discovered context object was applied unconditionally, replacing the base URL specified by the caller, which retargeted requests to the context `cs_cloud` value within Foundry FaaS functions. A caller-provided base URL now takes precedence, and the context is only consulted when one was not supplied. + - `_auth_object/_falcon_interface.py` + > Unit testing expanded to complete code coverage. + - `tests/test_zero_trust_assessment.py` + - Thanks go out to @mraible for identifying, reporting, and providing a reproduction for this issue! 🙇 + ++ Fixed: Added `US-3` to the list of dashed region names recognized when a base URL is specified by name. Passing `base_url="us-3"` produced `https://us-3` instead of the US-3 API URL, since the dash was only stripped for regions present in that list. All regions now resolve the same way with or without the dash. + - `_util/_functions.py` + > Unit testing expanded to complete code coverage. + - `tests/test_authentications.py` + ++ Fixed: Added the missing `US-3` and `USGOV-2` ingest base URLs. Retrieving an ingest base URL for a US-3 or USGOV-2 tenant raised a `KeyError`, making the NGSIEM HTTP Event Collector unusable in those regions. + - `_enum/_ingest_base_url.py` + ++ Fixed: Fixed an explicitly provided empty list being discarded by the exclusion payload handlers. The `groups` and `excluded_from` keywords were only added to the payload when their value evaluated as true, so `groups=[]` produced the same request body as omitting the keyword entirely, and a call intended to clear group scoping returned a success status without changing the exclusion. An empty list is now sent. Closes #1499. + - `_payload/_generic.py` + - `_payload/_ml_exclusions.py` + > Unit testing expanded to complete code coverage. + - `tests/test_ml_exclusions.py` + - `tests/test_sensor_visibility_exclusions.py` + # Version 1.6.4 ## Added features and functionality + Added: Added [PEP 561](https://peps.python.org/pep-0561/) type stub (`.pyi`) files for every service collection, along with a `py.typed` marker, so type checkers and IDEs can surface method signatures, keyword arguments, and return types. Deprecated and decommissioned methods are annotated with `@deprecated` so editors flag them at call sites. diff --git a/samples/authentication/README.md b/samples/authentication/README.md index 19e597a0e..c3ebf411c 100644 --- a/samples/authentication/README.md +++ b/samples/authentication/README.md @@ -11,6 +11,7 @@ The examples in this folder focus on authentication to CrowdStrike's APIs. - [AES File Crypt](#aes-file-crypt) - Encrypt arbitrary files with AES/CBC - [AWS Parameter Store](#aws-parameter-store) - CrowdStrike API authentication leveraging AWS Parameter Store for credential storage - [Token Authentication](#token-authentication) - Token Authentication is the original solution for authenticating to a Service Class, and is still fully supported. This example demonstrates how to use Token Authentication to interact with multiple Service Classes. +- [Session Reuse](#session-reuse) - Reuse a single `requests.Session` for connection pooling across login, every API call, token renewal, and logout. ## Azure Key Vault Authentication This application demonstrates storing CrowdStrike API credentials within the @@ -577,3 +578,29 @@ This sample does not implement command line assistance. ### Example source code Source code for this example can be found [here](token_authentication_example.py). + +--- +## Session Reuse +Every FalconPy client accepts an optional `session` keyword argument: an existing +`requests.Session` to reuse for connection pooling across login, every API call, +token renewal, and logout. This avoids repeating the TCP/TLS handshake for each +request. FalconPy never closes a session provided this way; the caller retains +full ownership of its lifecycle. + +### Running the program +In order to run this demonstration, you will need access to CrowdStrike API keys with the following scopes: +| Service Collection | Scope | +| :---- | :---- | +| Hosts | __READ__ | + +Credentials are provided via the `FALCON_CLIENT_ID` and `FALCON_CLIENT_SECRET` environment variables. + +### Execution syntax +This application does not accept command line arguments. + +```shell +python3 session_reuse.py +``` + +### Example source code +Source code for this example can be found [here](session_reuse.py). diff --git a/samples/authentication/session_reuse.py b/samples/authentication/session_reuse.py new file mode 100644 index 000000000..e399ba3d7 --- /dev/null +++ b/samples/authentication/session_reuse.py @@ -0,0 +1,56 @@ +"""CrowdStrike FalconPy Persistent Session (Connection Reuse) Example. + + _______ __ _______ __ __ __ +| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----. +|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__| +|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____| +|: 1 | |: 1 | +|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy +`-------' `-------' + +Every FalconPy client accepts an optional `session` keyword: an existing +`requests.Session` to reuse for connection pooling across login, every API +call, token renewal, and logout. This avoids repeating the TCP/TLS handshake +for each request, which matters most for workloads issuing many sequential +calls. + +FalconPy never closes a session provided this way. The caller retains full +ownership of its lifecycle, most naturally by using it as a context manager +as demonstrated below. + +If you share one session across multiple threads, you are responsible for +your own synchronization; requests.Session is not guaranteed safe for +concurrent use without care. + +This sample requires API credentials with READ access to the Hosts service +collection, provided via the FALCON_CLIENT_ID and FALCON_CLIENT_SECRET +environment variables. +""" +import os +import requests +from falconpy import OAuth2, Hosts + + +def main(): + """Demonstrate session reuse across authentication and multiple API calls.""" + client_id = os.getenv("FALCON_CLIENT_ID") + client_secret = os.getenv("FALCON_CLIENT_SECRET") + + # The session is created (and closed) entirely by the caller. + with requests.Session() as session: + # Login and every request made by this auth_object reuse `session`. + auth = OAuth2(client_id=client_id, client_secret=client_secret, session=session) + + # Service Classes constructed from a shared auth_object inherit its session. + hosts = Hosts(auth_object=auth) + + for _ in range(3): + response = hosts.query_devices_by_filter(limit=1) + print(f"Status: {response['status_code']}") + + auth.logout() + # The session is closed here, by the caller's `with` block, not by FalconPy. + + +if __name__ == "__main__": + main() diff --git a/src/falconpy/__init__.py b/src/falconpy/__init__.py index c63fc098e..38dd97c72 100644 --- a/src/falconpy/__init__.py +++ b/src/falconpy/__init__.py @@ -107,6 +107,9 @@ from ._helper import random_string, Indicator, Color, find_operation from .access_scopes import AccessScopes from .admission_control_policies import AdmissionControlPolicies +from .agent_invocation import AgentInvocation +from .agent_templates import AgentTemplates +from .agent_versions import AgentVersions from .alerts import Alerts from .api_clients import APIClients from .api_integrations import APIIntegrations @@ -189,6 +192,7 @@ from .message_center import MessageCenter from .ml_exclusions import MLExclusions from .mobile_enrollment import MobileEnrollment +from .models import Models from .mssp import FlightControl from .network_scan_global_configs import NetworkScanGlobalConfigs from .network_scan_networks import NetworkScanNetworks @@ -215,6 +219,7 @@ from .response_policies import ResponsePolicies from .saas_security import SaasSecurity from .sample_uploads import SampleUploads +from .scanning_orchestrator import ScanningOrchestrator from .scheduled_reports import ScheduledReports from .sensor_download import SensorDownload from .sensor_update_policy import SensorUpdatePolicy, SensorUpdatePolicies @@ -222,11 +227,14 @@ from .sensor_visibility_exclusions import SensorVisibilityExclusions from .serverless_exports import ServerlessExports from .serverless_vulnerabilities import ServerlessVulnerabilities +from .spans import Spans from .spotlight_vulnerabilities import SpotlightVulnerabilities from .spotlight_vulnerability_metadata import SpotlightVulnerabilityMetadata from .spotlight_evaluation_logic import SpotlightEvaluationLogic +from .stream import Stream from .tailored_intelligence import TailoredIntelligence from .threatgraph import ThreatGraph +from .tools import Tools from .unidentified_containers import UnidentifiedContainers from .user_management import UserManagement from .workflows import Workflows @@ -293,7 +301,11 @@ "FederatedConnections", "FoundryLookupFiles", "KnowledgeBaseAuditEvents", "KnowledgeBaseFiles", "KnowledgeBases", "ProfileGroups", - "FalconId" + "FalconId", "AgentInvocation", + "AgentTemplates", "AgentVersions", + "Models", "ScanningOrchestrator", + "Spans", "Stream", + "Tools" ] """ This is free and unencumbered software released into the public domain. diff --git a/src/falconpy/_api_request/_request.py b/src/falconpy/_api_request/_request.py index 223f0675b..0443bf279 100644 --- a/src/falconpy/_api_request/_request.py +++ b/src/falconpy/_api_request/_request.py @@ -37,6 +37,7 @@ """ from typing import Union, Dict, Optional, List, Any from logging import Logger +import requests from ._request_behavior import RequestBehavior from ._request_connection import RequestConnection from ._request_meta import RequestMeta @@ -69,7 +70,8 @@ def __init__(self, self._connection = RequestConnection(user_agent=initializer.get("user_agent", None), proxy=initializer.get("proxy", {}), timeout=initializer.get("timeout", None), - verify=initializer.get("verify", True) + verify=initializer.get("verify", True), + session=initializer.get("session", None) ) # Behavioral flags that alter the behavior of request processing self._behavior = RequestBehavior(expand_result=initializer.get("expand_result", False), @@ -265,6 +267,11 @@ def proxy(self) -> Optional[Dict[str, str]]: """Return the proxy dictionary.""" return self.connection.proxy + @property + def session(self) -> Optional[requests.Session]: + """Return the requests.Session to use for this request, if one was provided.""" + return self.connection.session + @property def timeout(self) -> Optional[Union[int, tuple]]: """Return the timeout from the connection object..""" diff --git a/src/falconpy/_api_request/_request_connection.py b/src/falconpy/_api_request/_request_connection.py index 39f725d4d..447dc6e3b 100644 --- a/src/falconpy/_api_request/_request_connection.py +++ b/src/falconpy/_api_request/_request_connection.py @@ -37,6 +37,7 @@ """ from dataclasses import dataclass from typing import Optional, Dict, Union +import requests @dataclass @@ -51,3 +52,4 @@ class RequestConnection: verify: bool = True timeout: Optional[Union[int, tuple]] = None proxy: Optional[Dict[str, str]] = None + session: Optional[requests.Session] = None diff --git a/src/falconpy/_auth_object/_falcon_interface.py b/src/falconpy/_auth_object/_falcon_interface.py index 00628085c..7312c58a7 100644 --- a/src/falconpy/_auth_object/_falcon_interface.py +++ b/src/falconpy/_auth_object/_falcon_interface.py @@ -44,12 +44,13 @@ from contextvars import copy_context from logging import Logger, getLogger from typing import Dict, Optional, Union +import requests from ._base_falcon_auth import BaseFalconAuth from ._bearer_token import BearerToken from .._log import LogFacility from .._constant import MIN_TOKEN_RENEW_WINDOW, MAX_TOKEN_RENEW_WINDOW from ._interface_config import InterfaceConfiguration -from .._enum import TokenFailReason +from .._enum import TokenFailReason, BaseURL from .._util import ( autodiscover_region, confirm_base_url, @@ -62,6 +63,10 @@ from .._error import InvalidCredentials, NoAuthenticationMechanism +# Default base URL, used to detect whether the caller specified one. +_DEFAULT_BASE_URL = f"https://{BaseURL.US1.value}" + + # pylint: disable=R0902,R0904 class FalconInterface(BaseFalconAuth): """Standard Falcon API interface used by Service Classes.""" @@ -89,7 +94,8 @@ def __init__(self, # noqa: C901 debug_record_count: Optional[int] = None, sanitize_log: Optional[bool] = None, pythonic: Optional[bool] = False, - environment: Optional[Dict[str, str]] = None + environment: Optional[Dict[str, str]] = None, + session: Optional[requests.Session] = None ) -> "FalconInterface": """Construct an instance of the FalconInterface class.""" # Set the pythonic behavior mode. @@ -97,12 +103,19 @@ def __init__(self, # noqa: C901 if isinstance(pythonic, bool): self._pythonic = pythonic + # A base URL specified by the caller takes precedence over any cloud + # region derived during authentication. + base_url_provided: bool = ( + base_url is not None and confirm_base_url(base_url) != _DEFAULT_BASE_URL + ) + # Setup our configuration object using the provided keywords. self._config: InterfaceConfiguration = InterfaceConfiguration(base_url=base_url, proxy=proxy, timeout=timeout, user_agent=user_agent, - ssl_verify=ssl_verify + ssl_verify=ssl_verify, + session=session ) # \ o / # ____ _ _ ___ _ _ ____ _ _ ___ _ ____ ____ ___ _ ____ _ _ | # |__| | | | |__| |___ |\ | | | | |__| | | | | |\ | / \ @@ -164,10 +177,10 @@ def __init__(self, # noqa: C901 # Attempt to retrieve the cloud region from the same object. # Fall back to our previously set default on failure. try: - if cvar.cs_cloud: + if cvar.cs_cloud and not base_url_provided: self._config.base_url = confirm_base_url(cvar.cs_cloud) except AttributeError: - if self.token_value: + if self.token_value and not base_url_provided: self._config.base_url = confirm_base_url(os.getenv("CS_CLOUD", "auto")) self._auth_style = "CONTEXT" break @@ -307,7 +320,7 @@ def _login_handler(self, stateful: bool = True) -> dict: returned = perform_request(method="POST", endpoint=target_url, data=data_payload, headers={}, verify=self.ssl_verify, proxy=self.proxy, timeout=self.timeout, user_agent=self.user_agent, - log_util=self.log, authenticating=True, + session=self.session, log_util=self.log, authenticating=True, sanitize=self.sanitize_log ) _returned_headers = returned["headers"] @@ -363,8 +376,8 @@ def _logout_handler(self, token_value: str = None, stateful: bool = True, client returned = perform_request(method="POST", endpoint=target_url, data=data_payload, headers=header_payload, verify=self.ssl_verify, proxy=self.proxy, timeout=self.timeout, - user_agent=self.user_agent, log_util=self.log, - sanitize=self.sanitize_log + user_agent=self.user_agent, session=self.session, + log_util=self.log, sanitize=self.sanitize_log ) if stateful: self.bearer_token: BearerToken = BearerToken() @@ -429,6 +442,15 @@ def proxy(self) -> Dict[str, str]: def proxy(self, value: Dict[str, str]): self.config.proxy = value + @property + def session(self) -> Optional[requests.Session]: + """Return the requests.Session in use, if one was provided.""" + return self.config.session + + @session.setter + def session(self, value: Optional[requests.Session]): + self.config.session = value + @property def user_agent(self) -> str: """Return the current user agent setting.""" diff --git a/src/falconpy/_auth_object/_interface_config.py b/src/falconpy/_auth_object/_interface_config.py index d35995ede..ea8674f5c 100644 --- a/src/falconpy/_auth_object/_interface_config.py +++ b/src/falconpy/_auth_object/_interface_config.py @@ -36,6 +36,7 @@ For more information, please refer to """ from typing import Dict, Union, Optional +import requests class InterfaceConfiguration: @@ -50,13 +51,15 @@ def __init__(self, proxy: Optional[Dict[str, str]] = None, timeout: Optional[Union[int, tuple]] = None, user_agent: Optional[str] = None, - ssl_verify: Optional[bool] = True + ssl_verify: Optional[bool] = True, + session: Optional[requests.Session] = None ): """Construct an instance of the InterfaceConfiguration class.""" self._base_url: Optional[str] = base_url self._proxy: Optional[Dict[str, str]] = proxy self._timeout: Optional[Union[int, tuple]] = timeout self._user_agent: Optional[str] = user_agent + self._session: Optional[requests.Session] = session self._ssl_verify: bool = True if isinstance(ssl_verify, bool): @@ -116,3 +119,13 @@ def ssl_verify(self) -> bool: def ssl_verify(self, value: bool): """Change the SSL verification setting.""" self._ssl_verify = value + + @property + def session(self) -> Optional[requests.Session]: + """Return the requests.Session in use, if one was provided.""" + return self._session + + @session.setter + def session(self, value: Optional[requests.Session]): + """Update or replace the requests.Session reference. Never closes the outgoing session.""" + self._session = value diff --git a/src/falconpy/_auth_object/_uber_interface.py b/src/falconpy/_auth_object/_uber_interface.py index 77c85eb6d..f61ca07f3 100644 --- a/src/falconpy/_auth_object/_uber_interface.py +++ b/src/falconpy/_auth_object/_uber_interface.py @@ -37,6 +37,7 @@ """ from traceback import extract_tb from typing import Dict, List, Optional, Union +import requests from ._falcon_interface import FalconInterface from .._constant import MAX_DEBUG_RECORDS from .._endpoint import api_endpoints @@ -79,7 +80,8 @@ def __init__(self, debug_record_count: Optional[int] = MAX_DEBUG_RECORDS, sanitize_log: Optional[bool] = None, pythonic: Optional[bool] = None, - environment: Optional[Dict[str, str]] = None + environment: Optional[Dict[str, str]] = None, + session: Optional[requests.Session] = None ): """Construct an instance of the UberInterface class. @@ -112,6 +114,12 @@ def __init__(self, Max: 5000 sanitize_log: Enable / Disable log sanitization of client IDs, secrets and tokens. Boolean. Defaults to enabled. + session: Existing requests.Session to reuse for connection pooling across login, every + API call, token renewal and logout. FalconPy never closes a session provided + this way; the caller retains ownership of its lifecycle (for example, by using + it as a context manager). A single Session is not guaranteed safe for + concurrent use across threads without external synchronization. When omitted + (default), behavior is unchanged and a new connection is used for each request. This method only accepts keywords to specify arguments. """ super().__init__(base_url=confirm_base_url(base_url), @@ -129,7 +137,8 @@ def __init__(self, debug_record_count=debug_record_count, sanitize_log=sanitize_log, pythonic=pythonic, - environment=environment + environment=environment, + session=session ) # Complete list of available API operations. @@ -190,7 +199,7 @@ def authenticate(self) -> bool: """Legacy Uber Class functionality handler. DEPRECATED - ---- + ---------- Consider updating your code to leverage the login method. """ return self.login() @@ -199,7 +208,7 @@ def deauthenticate(self) -> bool: """Legacy Uber Class functionality handler. DEPRECATED - ---- + ---------- Consider updating your code to leverage the logout method. """ return self.logout() @@ -208,7 +217,7 @@ def valid_cred_format(self) -> bool: """Legacy property to confirm credential dictionary format. DEPRECATED - ---- + ---------- Consider updating your code to leverage the cred_format_valid property. """ return self.cred_format_valid @@ -217,7 +226,7 @@ def headers(self) -> Dict[str, str]: """Legacy property getter for the current authorization headers. DEPRECATED - ---- + ---------- Consider updating your code to leverage the auth_headers property. """ return self.auth_headers @@ -245,7 +254,7 @@ def token(self) -> str: """Legacy attribute handler to return the token string. DEPRECATED - ---- + ---------- Consider updating your code to leverage the token_value property. """ return self.token_value diff --git a/src/falconpy/_endpoint/__init__.py b/src/falconpy/_endpoint/__init__.py index 32aa66db6..0ae157b5d 100644 --- a/src/falconpy/_endpoint/__init__.py +++ b/src/falconpy/_endpoint/__init__.py @@ -69,9 +69,15 @@ from .deprecated import _falcon_complete_dashboard_deprecated from .deprecated import _foundry_logscale_deprecated from .deprecated import _spotlight_vulnerabilities_deprecated +from .deprecated import _incidents_deprecated +from .deprecated import _knowledge_base_audit_events_deprecated +from .deprecated import _knowledge_bases_deprecated from ._access_scopes import _access_scopes_endpoints from ._admission_control_policies import _admission_control_policies_endpoints +from ._agent_invocation import _agent_invocation_endpoints +from ._agent_templates import _agent_templates_endpoints +from ._agent_versions import _agent_versions_endpoints from ._alerts import _alerts_endpoints from ._api_clients import _api_clients_endpoints from ._api_integrations import _api_integrations_endpoints @@ -153,6 +159,7 @@ from ._message_center import _message_center_endpoints from ._ml_exclusions import _ml_exclusions_endpoints from ._mobile_enrollment import _mobile_enrollment_endpoints +from ._models import _models_endpoints from ._mssp import _mssp_endpoints from ._network_scan_global_configs import _network_scan_global_configs_endpoints from ._network_scan_networks import _network_scan_networks_endpoints @@ -178,6 +185,7 @@ from ._response_policies import _response_policies_endpoints from ._saas_security import _saas_security_endpoints from ._sample_uploads import _sample_uploads_endpoints +from ._scanning_orchestrator import _scanning_orchestrator_endpoints from ._scheduled_reports import _scheduled_reports_endpoints from ._sensor_download import _sensor_download_endpoints from ._sensor_update_policies import _sensor_update_policies_endpoints @@ -185,11 +193,14 @@ from ._sensor_visibility_exclusions import _sensor_visibility_exclusions_endpoints from ._serverless_exports import _serverless_exports_endpoints from ._serverless_vulnerabilities import _serverless_vulnerabilities_endpoints +from ._spans import _spans_endpoints from ._spotlight_evaluation_logic import _spotlight_evaluation_logic_endpoints from ._spotlight_vulnerability_metadata import _spotlight_vulnerability_metadata_endpoints from ._spotlight_vulnerabilities import _spotlight_vulnerabilities_endpoints +from ._stream import _stream_endpoints from ._threatgraph import _threatgraph_endpoints from ._tailored_intelligence import _tailored_intelligence_endpoints +from ._tools import _tools_endpoints from ._unidentified_containers import _unidentified_containers_endpoints from ._user_management import _user_management_endpoints from ._workflows import _workflows_endpoints @@ -198,6 +209,9 @@ api_endpoints: List[Any] = [] api_endpoints.extend(_access_scopes_endpoints) api_endpoints.extend(_admission_control_policies_endpoints) +api_endpoints.extend(_agent_invocation_endpoints) +api_endpoints.extend(_agent_templates_endpoints) +api_endpoints.extend(_agent_versions_endpoints) api_endpoints.extend(_alerts_endpoints) api_endpoints.extend(_api_clients_endpoints) api_endpoints.extend(_api_integrations_endpoints) @@ -279,6 +293,7 @@ api_endpoints.extend(_message_center_endpoints) api_endpoints.extend(_ml_exclusions_endpoints) api_endpoints.extend(_mobile_enrollment_endpoints) +api_endpoints.extend(_models_endpoints) api_endpoints.extend(_mssp_endpoints) api_endpoints.extend(_network_scan_global_configs_endpoints) api_endpoints.extend(_network_scan_networks_endpoints) @@ -304,6 +319,7 @@ api_endpoints.extend(_response_policies_endpoints) api_endpoints.extend(_saas_security_endpoints) api_endpoints.extend(_sample_uploads_endpoints) +api_endpoints.extend(_scanning_orchestrator_endpoints) api_endpoints.extend(_scheduled_reports_endpoints) api_endpoints.extend(_sensor_download_endpoints) api_endpoints.extend(_sensor_update_policies_endpoints) @@ -311,11 +327,14 @@ api_endpoints.extend(_sensor_visibility_exclusions_endpoints) api_endpoints.extend(_serverless_exports_endpoints) api_endpoints.extend(_serverless_vulnerabilities_endpoints) +api_endpoints.extend(_spans_endpoints) api_endpoints.extend(_spotlight_evaluation_logic_endpoints) api_endpoints.extend(_spotlight_vulnerability_metadata_endpoints) api_endpoints.extend(_spotlight_vulnerabilities_endpoints) +api_endpoints.extend(_stream_endpoints) api_endpoints.extend(_threatgraph_endpoints) api_endpoints.extend(_tailored_intelligence_endpoints) +api_endpoints.extend(_tools_endpoints) api_endpoints.extend(_unidentified_containers_endpoints) api_endpoints.extend(_user_management_endpoints) api_endpoints.extend(_workflows_endpoints) @@ -370,6 +389,9 @@ deprecated_endpoints.extend(_falcon_complete_dashboard_deprecated) deprecated_endpoints.extend(_foundry_logscale_deprecated) deprecated_endpoints.extend(_spotlight_vulnerabilities_deprecated) +deprecated_endpoints.extend(_incidents_deprecated) +deprecated_endpoints.extend(_knowledge_base_audit_events_deprecated) +deprecated_endpoints.extend(_knowledge_bases_deprecated) # Mapping of manually deprecated endpoints operation_deprecation_mapping = _deprecated_operation_mapping diff --git a/src/falconpy/_endpoint/_agent_invocation.py b/src/falconpy/_endpoint/_agent_invocation.py new file mode 100644 index 000000000..222eed9b9 --- /dev/null +++ b/src/falconpy/_endpoint/_agent_invocation.py @@ -0,0 +1,88 @@ +"""Internal API endpoint constant library. + + _______ __ _______ __ __ __ +| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----. +|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__| +|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____| +|: 1 | |: 1 | +|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy +`-------' `-------' + +OAuth2 API - Customer SDK + +This is free and unencumbered software released into the public domain. + +Anyone is free to copy, modify, publish, use, compile, sell, or +distribute this software, either in source code form or as a compiled +binary, for any purpose, commercial or non-commercial, and by any +means. + +In jurisdictions that recognize copyright laws, the author or authors +of this software dedicate any and all copyright interest in the +software to the public domain. We make this dedication for the benefit +of the public at large and to the detriment of our heirs and +successors. We intend this dedication to be an overt act of +relinquishment in perpetuity of all present and future rights to this +software under copyright law. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR +OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, +ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR +OTHER DEALINGS IN THE SOFTWARE. + +For more information, please refer to +""" + +_agent_invocation_endpoints = [ + [ + "InvokePublishedAgentExternalV1", + "POST", + "/agentic-studio/entities/agent-invocations/v1", + "Invoke a published agent by ID with the specified input. Returns the agent's completion response.", + "agent_invocation", + [ + { + "description": "Published agent invocation request containing agent ID and input. Optional " + "deadline_seconds must be at least 90; smaller values are rejected with a 400.", + "name": "body", + "in": "body", + "required": True + } + ] + ], + [ + "GetAgentInvocationV3", + "GET", + "/agentic-studio/entities/agent-invocations/v3", + "Retrieves the list of of messages that are resulted from the specified invocation", + "agent_invocation", + [ + { + "type": "string", + "description": "Invocation ID", + "name": "id", + "in": "query", + "required": True + } + ] + ], + [ + "InvokeAgentVersionExternalV1", + "POST", + "/agentic-studio/entities/agent-version-invocations/v1", + "Invoke a specific agent version by agent ID and version ID with the specified input. Returns the agent's " + "completion response.", + "agent_invocation", + [ + { + "description": "Agent version invocation request containing agent ID, version ID and input", + "name": "body", + "in": "body", + "required": True + } + ] + ] +] diff --git a/src/falconpy/_endpoint/_agent_templates.py b/src/falconpy/_endpoint/_agent_templates.py new file mode 100644 index 000000000..30d0b04de --- /dev/null +++ b/src/falconpy/_endpoint/_agent_templates.py @@ -0,0 +1,96 @@ +"""Internal API endpoint constant library. + + _______ __ _______ __ __ __ +| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----. +|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__| +|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____| +|: 1 | |: 1 | +|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy +`-------' `-------' + +OAuth2 API - Customer SDK + +This is free and unencumbered software released into the public domain. + +Anyone is free to copy, modify, publish, use, compile, sell, or +distribute this software, either in source code form or as a compiled +binary, for any purpose, commercial or non-commercial, and by any +means. + +In jurisdictions that recognize copyright laws, the author or authors +of this software dedicate any and all copyright interest in the +software to the public domain. We make this dedication for the benefit +of the public at large and to the detriment of our heirs and +successors. We intend this dedication to be an overt act of +relinquishment in perpetuity of all present and future rights to this +software under copyright law. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR +OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, +ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR +OTHER DEALINGS IN THE SOFTWARE. + +For more information, please refer to +""" + +_agent_templates_endpoints = [ + [ + "EntitiesAgentTemplatesV1", + "GET", + "/agentic-studio/entities/agent-templates/v1", + "Retrieve agent template entities for the provided IDs", + "agent_templates", + [ + { + "type": "array", + "items": { + "type": "string" + }, + "collectionFormat": "multi", + "description": "IDs of agent templates to retrieve.", + "name": "ids", + "in": "query", + "required": True + } + ] + ], + [ + "QueriesAgentTemplatesV1", + "GET", + "/agentic-studio/queries/agent-templates/v1", + "Query agent template IDs with pagination", + "agent_templates", + [ + { + "type": "integer", + "description": "Starting index of overall result set from which to return ids.", + "name": "offset", + "in": "query" + }, + { + "type": "integer", + "default": 30, + "maximum": 500, + "minimum": 1, + "description": "Number of IDs to return.", + "name": "limit", + "in": "query" + }, + { + "type": "string", + "description": "FQL query specifying the filter parameters.", + "name": "filter", + "in": "query" + }, + { + "type": "string", + "description": "Possible order by fields: name, id, author, model, created_at, updated_at. Ex: 'name|asc'.", + "name": "sort", + "in": "query" + } + ] + ] +] diff --git a/src/falconpy/_endpoint/_agent_versions.py b/src/falconpy/_endpoint/_agent_versions.py new file mode 100644 index 000000000..c997d35fe --- /dev/null +++ b/src/falconpy/_endpoint/_agent_versions.py @@ -0,0 +1,96 @@ +"""Internal API endpoint constant library. + + _______ __ _______ __ __ __ +| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----. +|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__| +|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____| +|: 1 | |: 1 | +|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy +`-------' `-------' + +OAuth2 API - Customer SDK + +This is free and unencumbered software released into the public domain. + +Anyone is free to copy, modify, publish, use, compile, sell, or +distribute this software, either in source code form or as a compiled +binary, for any purpose, commercial or non-commercial, and by any +means. + +In jurisdictions that recognize copyright laws, the author or authors +of this software dedicate any and all copyright interest in the +software to the public domain. We make this dedication for the benefit +of the public at large and to the detriment of our heirs and +successors. We intend this dedication to be an overt act of +relinquishment in perpetuity of all present and future rights to this +software under copyright law. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR +OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, +ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR +OTHER DEALINGS IN THE SOFTWARE. + +For more information, please refer to +""" + +_agent_versions_endpoints = [ + [ + "GetAgentVersionsV1", + "GET", + "/agentic-studio/entities/agent-versions/v1", + "Retrieve agent version entities for the provided ids.", + "agent_versions", + [ + { + "type": "array", + "items": { + "type": "string" + }, + "collectionFormat": "multi", + "description": "IDs of entities to retrieve.", + "name": "ids", + "in": "query", + "required": True + } + ] + ], + [ + "QueryAgentVersionsV1", + "GET", + "/agentic-studio/queries/agent-versions/v1", + "Query agent versions based on the provided filters.", + "agent_versions", + [ + { + "type": "integer", + "description": "Starting index of overall result set from which to return ids.", + "name": "offset", + "in": "query" + }, + { + "type": "integer", + "default": 10, + "maximum": 500, + "minimum": 1, + "description": "Number of IDs to return. Offset + limit should NOT be above 10K.", + "name": "limit", + "in": "query" + }, + { + "type": "string", + "description": "Possible order by fields: created_at. Ex: 'created_at|desc'.", + "name": "sort", + "in": "query" + }, + { + "type": "string", + "description": "FQL query specifying the filter parameters.", + "name": "filter", + "in": "query" + } + ] + ] +] diff --git a/src/falconpy/_endpoint/_case_management.py b/src/falconpy/_endpoint/_case_management.py index 892d85014..926673a18 100644 --- a/src/falconpy/_endpoint/_case_management.py +++ b/src/falconpy/_endpoint/_case_management.py @@ -1153,6 +1153,20 @@ } ] ], + [ + "entities_merge_post_v1", + "POST", + "/cases/entities/merge/v1", + "Merges a source case into a destination case.", + "case_management", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], [ "queries_cases_get_v1", "GET", diff --git a/src/falconpy/_endpoint/_cloud_oci_registration.py b/src/falconpy/_endpoint/_cloud_oci_registration.py index 54a97bf33..c45d5f0a4 100644 --- a/src/falconpy/_endpoint/_cloud_oci_registration.py +++ b/src/falconpy/_endpoint/_cloud_oci_registration.py @@ -47,14 +47,15 @@ { "type": "string", "description": "FQL (Falcon Query Language) string for filtering results. Allowed filters are " - "Set{tenancy_ocid, tenancy_name, home_region, key_age, overall_status, created_at, updated_at}", + "Set{tenancy_name, home_region, key_age, overall_status, created_at, updated_at, registration_name, " + "tenancy_ocid}", "name": "filter", "in": "query" }, { "type": "string", - "description": "Field and direction for sorting results - allowed sort fields are Set{key_age, " - "overall_status, created_at, updated_at, tenancy_ocid, tenancy_name, home_region}", + "description": "Field and direction for sorting results - allowed sort fields are Set{created_at, " + "updated_at, registration_name, tenancy_ocid, tenancy_name, home_region, key_age, overall_status}", "name": "sort", "in": "query" }, diff --git a/src/falconpy/_endpoint/_cloud_policies.py b/src/falconpy/_endpoint/_cloud_policies.py index 9599cd91d..466f82fd3 100644 --- a/src/falconpy/_endpoint/_cloud_policies.py +++ b/src/falconpy/_endpoint/_cloud_policies.py @@ -76,6 +76,13 @@ "name": "resource_type", "in": "query", "required": True + }, + { + "type": "boolean", + "default": True, + "description": "When true, returns the enriched schema with inlined related resource types. Defaults to true.", + "name": "enriched", + "in": "query" } ] ], @@ -481,9 +488,9 @@ { "description": "Rule severity integer to provide maps to the following: 0=Critical, 1=High, 2=Medium " "and 3=Low.\nFor CSPM IOM Custom Rules, logic is mandatory and parent_rule_id should not be specified.\nFor " - "Runtime IOM Custom Rules (KAC), logic is mandatory. Fields controls, resource_type, and parent_rule_id should " - "not be specified.\nFor Managed Rule duplication, parent_rule_id is mandatory and logic should be not " - "specified.", + "CSPM IAC Custom Rules, logic is mandatory and description is optional.\nFor Runtime IOM Custom Rules (KAC), " + "logic is mandatory. Fields controls, resource_type, and parent_rule_id should not be specified.\nFor Managed " + "Rule duplication, parent_rule_id is mandatory and logic should be not specified.", "name": "body", "in": "body", "required": True diff --git a/src/falconpy/_endpoint/_cloud_security_assets.py b/src/falconpy/_endpoint/_cloud_security_assets.py index fdf8f73df..001ed60c9 100644 --- a/src/falconpy/_endpoint/_cloud_security_assets.py +++ b/src/falconpy/_endpoint/_cloud_security_assets.py @@ -85,6 +85,14 @@ "description": "Page size", "name": "limit", "in": "query" + }, + { + "type": "string", + "description": "Sort expression in the format field|direction (e.g. key|desc), where direction is asc " + "or desc. Sortable fields depend on the finding type. Currently supported for packages: 'key' (package name and " + "version) and 'vulnerabilities' (number of vulnerabilities).", + "name": "sort", + "in": "query" } ] ], @@ -98,11 +106,12 @@ { "type": "string", "description": "FQL string to filter on asset contents. Filterable fields include: account_id " - "account_name assessment_id business_impact cloud_group cloud_label cloud_label_id cloud_provider " - "cloud_scope compliant control.benchmark.name control.benchmark.version control.extension.status " - "control.framework control.name control.type control.version environment last_evaluated region " - "resource_gcrn resource_provider resource_type resource_type_name service service_category severities " - "tag_key tag_value tags_string", + "account_name aspm.cloud_account aspm.cloud_region aspm.cloud_tag_key aspm.cloud_tag_value aspm.cloud_tags " + " aspm.deployment_provider assessment_id business_impact cloud_group cloud_label cloud_label_id " + "cloud_provider cloud_scope compliant control.benchmark.name control.benchmark.version " + "control.extension.status control.framework control.name control.type control.version environment " + "last_evaluated region resource_gcrn resource_provider resource_type resource_type_name service " + "service_category severities tag_key tag_value tags_string", "name": "filter", "in": "query" }, @@ -205,25 +214,27 @@ { "type": "string", "description": "FQL string to filter on asset contents. Filterable fields include: " - "account_bitmap_token_64 account_id account_name active aspm.deployment_cloud_resource_id " - "aspm.deployment_provider aspm.deployment_type aspm.technologies azure.resource_group azure.vm_id " - "business_impact cloud_group cloud_label cloud_label_id cloud_provider cloud_risks.rule " - "cloud_risks.severity cloud_risks.status cloud_scope cluster_id cluster_name compartment_ocid " - "compliant.benchmark_name compliant.benchmark_version compliant.framework compliant.policy_id " - "compliant.requirement compliant.rule compliant.section configuration.id control.benchmark.name " - "control.benchmark.version control.framework control.requirement control.type control.version " - "creation_time cve_ids data_classifications.found data_classifications.label data_classifications.label_id " - " data_classifications.scanned data_classifications.tag data_classifications.tag_id environment " - "exprt_ratings first_seen highest_severity id insights.boolean_value insights.date_value insights.id " - "insights.integer_value insights.string_list_value insights.string_value instance_id instance_state " - "ioa_count iom_count legacy_resource_id legacy_uuid managed_by non_compliant.benchmark_name " - "non_compliant.benchmark_version non_compliant.framework non_compliant.policy_id non_compliant.requirement " - "non_compliant.rule non_compliant.rule_name non_compliant.section non_compliant.severity organization_Id " - "os_version platform_name publicly_exposed region resource_gcrn resource_id resource_name " - "resource_parent resource_type resource_type_name sensor_priority service service_category severity " - "snapshot_detections ssm_managed status tag_key tag_value tags tags_string tenant_id updated_at " - "vmware.guest_os_id vmware.guest_os_version vmware.host_system_name vmware.host_type vmware.instance_uuid " - "vmware.vm_host_name vmware.vm_tools_status zone", + "account_bitmap_token_64 account_id account_name active application_name aspm.cloud_account " + "aspm.cloud_region aspm.cloud_tag_key aspm.cloud_tag_value aspm.cloud_tags " + "aspm.deployment_cloud_resource_id aspm.deployment_provider aspm.deployment_type aspm.technologies " + "azure.resource_group azure.vm_id business_impact cloud_group cloud_label cloud_label_id cloud_provider " + "cloud_risks.rule cloud_risks.severity cloud_risks.status cloud_scope cluster_id cluster_name " + "compartment_ocid compliant.benchmark_name compliant.benchmark_version compliant.framework " + "compliant.policy_id compliant.requirement compliant.rule compliant.section configuration.id " + "control.benchmark.name control.benchmark.version control.framework control.requirement control.type " + "control.version creation_time cve_ids data_classifications.found data_classifications.label " + "data_classifications.label_id data_classifications.scanned data_classifications.tag " + "data_classifications.tag_id environment exprt_ratings first_seen gcp.multi_region gcp.physical_region " + "highest_severity id insights.boolean_value insights.date_value insights.id insights.integer_value " + "insights.string_list_value insights.string_value instance_id instance_state ioa_count iom_count " + "legacy_resource_id legacy_uuid managed_by non_compliant.benchmark_name non_compliant.benchmark_version " + "non_compliant.framework non_compliant.policy_id non_compliant.requirement non_compliant.rule " + "non_compliant.rule_name non_compliant.section non_compliant.severity organization_Id os_version " + "platform_name publicly_exposed region resource_gcrn resource_id resource_name resource_parent " + "resource_type resource_type_name sensor_priority service service_category severity snapshot_detections " + "ssm_managed status tag_key tag_value tags tags_string tenant_id updated_at vmware.guest_os_id " + "vmware.guest_os_version vmware.host_system_name vmware.host_type vmware.instance_uuid vmware.vm_host_name " + "vmware.vm_tools_status zone", "name": "filter", "in": "query" }, diff --git a/src/falconpy/_endpoint/_cloud_security_detections.py b/src/falconpy/_endpoint/_cloud_security_detections.py index a3cb61d62..3b72b7f1d 100644 --- a/src/falconpy/_endpoint/_cloud_security_detections.py +++ b/src/falconpy/_endpoint/_cloud_security_detections.py @@ -102,6 +102,21 @@ } ] ], + [ + "cspm_evaluations_iom_entities_post", + "POST", + "/cloud-security-evaluations/entities/ioms/v1", + "Gets IOMs based on IDs in the request body. Maximum of 500 resources can be requested.", + "cloud_security_detections", + [ + { + "description": "Body with array of 'ids' (maximum 500 IDs).", + "name": "body", + "in": "body", + "required": True + } + ] + ], [ "cspm_evaluations_iom_queries", "GET", diff --git a/src/falconpy/_endpoint/_cloud_snapshots.py b/src/falconpy/_endpoint/_cloud_snapshots.py index fde458525..438f5b4a9 100644 --- a/src/falconpy/_endpoint/_cloud_snapshots.py +++ b/src/falconpy/_endpoint/_cloud_snapshots.py @@ -47,8 +47,9 @@ { "type": "string", "description": "Search IaC detections using a query in Falcon Query Language (FQL). Supported filters: " - " detection_uuid,file_name,last_detected,platform,project_name,project_owner,project_ref,provider,resource_name " - ",rule_category,rule_name,rule_type,rule_uuid,service,severity", + " detection_uuid,file_name,is_from_module,last_detected,module_path,module_source,module_version,platform,proje " + "ct_name,project_owner,project_ref,provider,resource_name,rule_category,rule_name,rule_type,rule_uuid,service,s " + "everity", "name": "filter", "in": "query" }, @@ -67,8 +68,8 @@ { "type": "string", "description": "fields to sort the records on. Supported columns: [detection_uuid file_name " - "last_detected platform project_name project_owner project_ref provider resource_name rule_category rule_name " - "rule_type rule_uuid service severity]", + "is_from_module last_detected module_path module_source module_version platform project_name project_owner " + "project_ref provider resource_name rule_category rule_name rule_type rule_uuid service severity]", "name": "sort", "in": "query" } diff --git a/src/falconpy/_endpoint/_container_image_compliance.py b/src/falconpy/_endpoint/_container_image_compliance.py index 565dc2a0d..4a6505c20 100644 --- a/src/falconpy/_endpoint/_container_image_compliance.py +++ b/src/falconpy/_endpoint/_container_image_compliance.py @@ -46,10 +46,11 @@ [ { "type": "string", - "description": "Filter results using a query in Falcon Query Language (FQL). Supported Filters:\ncid: " - "Customer ID\ncloud_info.namespace: Kubernetes namespace\ncompliance_finding.framework: Compliance finding " - "framework (available values: CIS)\ncloud_info.cloud_provider: Cloud provider\ncloud_info.cloud_account_id: " - "Cloud account ID\ncloud_info.cloud_region: Cloud region\ncloud_info.cluster_name: Kubernetes cluster name\n", + "description": "Filter results using a query in Falcon Query Language (FQL). Supported " + "Filters:\ncloud_info.cluster_name: Kubernetes cluster name\ncompliance_finding.framework: Compliance finding " + "framework (available values: CIS)\ncloud_info.cloud_region: Cloud region\ncloud_info.cloud_account_id: Cloud " + "account ID\ncloud_info.namespace: Kubernetes namespace\ncid: Customer ID\ncloud_info.cloud_provider: Cloud " + "provider\n", "name": "filter", "in": "query" } @@ -65,14 +66,14 @@ { "type": "string", "description": "Filter results using a query in Falcon Query Language (FQL). Supported " - "Filters:\ncloud_info.cloud_region: Cloud region\nimage_digest: Image digest (sha256 " - "digest)\ncloud_info.cloud_provider: Cloud provider\nasset_type: asset type (container, " - "image)\ncloud_info.namespace: Kubernetes namespace\ncompliance_finding.framework: Compliance finding framework " - " (available values: CIS)\nimage_repository: Image repository\ncloud_info.cloud_account_id: Cloud account " - "ID\ncid: Customer ID\ncloud_info.cluster_name: Kubernetes cluster name\nimage_id: Image " - "ID\ncompliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: " - "high, 2: medium, 1:low)\nimage_registry: Image registry\ncompliance_finding.name: Compliance finding " - "Name\nimage_tag: Image tag\ncompliance_finding.id: Compliance finding ID\n", + "Filters:\ncloud_info.cloud_provider: Cloud provider\ncompliance_finding.severity: Compliance finding severity; " + " available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1:low)\ncompliance_finding.framework: " + "Compliance finding framework (available values: CIS)\ncloud_info.cloud_region: Cloud " + "region\ncloud_info.namespace: Kubernetes namespace\ncid: Customer ID\ncompliance_finding.id: Compliance " + "finding ID\nimage_id: Image ID\nimage_digest: Image digest (sha256 digest)\nimage_tag: Image tag\nasset_type: " + "asset type (container, image)\ncompliance_finding.name: Compliance finding Name\nimage_registry: Image " + "registry\nimage_repository: Image repository\ncloud_info.cloud_account_id: Cloud account " + "ID\ncloud_info.cluster_name: Kubernetes cluster name\n", "name": "filter", "in": "query" }, @@ -101,13 +102,13 @@ { "type": "string", "description": "Filter results using a query in Falcon Query Language (FQL). Supported " - "Filters:\ncloud_info.cloud_provider: Cloud provider\ncompliance_finding.id: Compliance finding " - "ID\nimage_registry: Image registry\nimage_repository: Image repository\nimage_id: Image " - "ID\ncloud_info.cloud_region: Cloud region\ncloud_info.cluster_name: Kubernetes cluster name\nimage_digest: " - "Image digest (sha256 digest)\ncloud_info.cloud_account_id: Cloud account ID\ncompliance_finding.name: " - "Compliance finding Name\ncompliance_finding.framework: Compliance finding framework (available values: " - "CIS)\nimage_tag: Image tag\ncompliance_finding.severity: Compliance finding severity; available values: 4, 3, " - "2, 1 (4: critical, 3: high, 2: medium, 1:low)\ncid: Customer ID\n", + "Filters:\ncloud_info.cloud_region: Cloud region\ncid: Customer ID\ncompliance_finding.severity: Compliance " + "finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1:low)\nimage_tag: Image " + "tag\ncompliance_finding.name: Compliance finding Name\nimage_id: Image ID\ncompliance_finding.framework: " + "Compliance finding framework (available values: CIS)\ncloud_info.cloud_provider: Cloud " + "provider\ncompliance_finding.id: Compliance finding ID\nimage_digest: Image digest (sha256 " + "digest)\ncloud_info.cluster_name: Kubernetes cluster name\nimage_repository: Image repository\nimage_registry: " + "Image registry\ncloud_info.cloud_account_id: Cloud account ID\n", "name": "filter", "in": "query" } @@ -123,13 +124,13 @@ { "type": "string", "description": "Filter results using a query in Falcon Query Language (FQL). Supported " - "Filters:\nimage_tag: Image tag\ncompliance_finding.id: Compliance finding ID\ncompliance_finding.name: " - "Compliance finding Name\ncloud_info.cloud_region: Cloud region\ncompliance_finding.framework: Compliance " - "finding framework (available values: CIS)\nimage_repository: Image repository\ncloud_info.cloud_account_id: " - "Cloud account ID\nimage_id: Image ID\ncloud_info.cloud_provider: Cloud provider\ncompliance_finding.severity: " - "Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1:low)\ncid: " - "Customer ID\ncloud_info.namespace: Kubernetes namespace\nimage_digest: Image digest (sha256 " - "digest)\nimage_registry: Image registry\ncloud_info.cluster_name: Kubernetes cluster name\n", + "Filters:\nimage_id: Image ID\ncompliance_finding.framework: Compliance finding framework (available values: " + "CIS)\nimage_repository: Image repository\nimage_tag: Image tag\ncloud_info.namespace: Kubernetes " + "namespace\ncid: Customer ID\ncloud_info.cloud_provider: Cloud provider\nimage_digest: Image digest (sha256 " + "digest)\nimage_registry: Image registry\ncompliance_finding.severity: Compliance finding severity; available " + "values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1:low)\ncloud_info.cloud_region: Cloud " + "region\ncompliance_finding.id: Compliance finding ID\ncloud_info.cloud_account_id: Cloud account " + "ID\ncompliance_finding.name: Compliance finding Name\ncloud_info.cluster_name: Kubernetes cluster name\n", "name": "filter", "in": "query" } @@ -145,13 +146,14 @@ { "type": "string", "description": "Filter results using a query in Falcon Query Language (FQL). Supported " - "Filters:\ncompliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, " - " 3: high, 2: medium, 1:low)\ncompliance_finding.name: Compliance finding Name\ncloud_info.cluster_name: " - "Kubernetes cluster name\nimage_repository: Image repository\nimage_id: Image ID\ncid: Customer " - "ID\ncloud_info.cloud_region: Cloud region\ncompliance_finding.framework: Compliance finding framework " - "(available values: CIS)\ncloud_info.cloud_provider: Cloud provider\ncloud_info.cloud_account_id: Cloud account " - " ID\ncompliance_finding.id: Compliance finding ID\nimage_registry: Image registry\ncloud_info.namespace: " - "Kubernetes namespace\nimage_digest: Image digest (sha256 digest)\nimage_tag: Image tag\n", + "Filters:\nimage_registry: Image registry\ncompliance_finding.severity: Compliance finding severity; available " + "values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1:low)\nimage_repository: Image repository\nimage_tag: " + "Image tag\ncloud_info.cloud_region: Cloud region\ncloud_info.namespace: Kubernetes " + "namespace\ncloud_info.cloud_account_id: Cloud account ID\ncloud_info.cloud_provider: Cloud " + "provider\ncompliance_finding.id: Compliance finding ID\ncompliance_finding.name: Compliance finding " + "Name\ncompliance_finding.framework: Compliance finding framework (available values: " + "CIS)\ncloud_info.cluster_name: Kubernetes cluster name\ncid: Customer ID\nimage_id: Image ID\nimage_digest: " + "Image digest (sha256 digest)\n", "name": "filter", "in": "query" } @@ -167,13 +169,14 @@ { "type": "string", "description": "Filter results using a query in Falcon Query Language (FQL). Supported " - "Filters:\nimage_id: Image ID\nimage_registry: Image registry\ncloud_info.cloud_region: Cloud " - "region\ncompliance_finding.framework: Compliance finding framework (available values: CIS)\nimage_tag: Image " - "tag\ncompliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: " - "high, 2: medium, 1:low)\ncompliance_finding.name: Compliance finding Name\ncloud_info.namespace: Kubernetes " - "namespace\ncompliance_finding.id: Compliance finding ID\nimage_digest: Image digest (sha256 " - "digest)\ncloud_info.cloud_account_id: Cloud account ID\ncloud_info.cloud_provider: Cloud provider\ncid: " - "Customer ID\ncloud_info.cluster_name: Kubernetes cluster name\nimage_repository: Image repository\n", + "Filters:\ncloud_info.cloud_account_id: Cloud account ID\ncloud_info.cloud_provider: Cloud " + "provider\ncompliance_finding.framework: Compliance finding framework (available values: " + "CIS)\ncloud_info.cloud_region: Cloud region\ncloud_info.namespace: Kubernetes namespace\ncid: Customer " + "ID\ncompliance_finding.id: Compliance finding ID\ncompliance_finding.name: Compliance finding " + "Name\ncloud_info.cluster_name: Kubernetes cluster name\nimage_repository: Image repository\nimage_id: Image " + "ID\nimage_digest: Image digest (sha256 digest)\nimage_registry: Image registry\ncompliance_finding.severity: " + "Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1:low)\nimage_tag: " + "Image tag\n", "name": "filter", "in": "query" } @@ -188,14 +191,14 @@ [ { "type": "string", - "description": "Filter results using a query in Falcon Query Language (FQL). Supported Filters:\ncid: " - "Customer ID\ncloud_info.cloud_region: Cloud region\ncompliance_finding.framework: Compliance finding framework " - " (available values: CIS)\ncloud_info.cloud_account_id: Cloud account ID\ncloud_info.namespace: Kubernetes " - "namespace\nimage_digest: Image digest (sha256 digest)\nimage_repository: Image " - "repository\ncloud_info.cloud_provider: Cloud provider\nimage_tag: Image tag\ncompliance_finding.severity: " - "Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, " - "1:low)\ncompliance_finding.name: Compliance finding Name\ncloud_info.cluster_name: Kubernetes cluster " - "name\nimage_id: Image ID\ncompliance_finding.id: Compliance finding ID\nimage_registry: Image registry\n", + "description": "Filter results using a query in Falcon Query Language (FQL). Supported " + "Filters:\ncloud_info.cloud_region: Cloud region\nimage_id: Image ID\nimage_registry: Image " + "registry\ncloud_info.cluster_name: Kubernetes cluster name\ncompliance_finding.severity: Compliance finding " + "severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1:low)\nimage_tag: Image " + "tag\ncloud_info.cloud_provider: Cloud provider\ncompliance_finding.id: Compliance finding " + "ID\ncompliance_finding.framework: Compliance finding framework (available values: CIS)\ncloud_info.namespace: " + "Kubernetes namespace\ncid: Customer ID\ncompliance_finding.name: Compliance finding Name\nimage_digest: Image " + "digest (sha256 digest)\nimage_repository: Image repository\ncloud_info.cloud_account_id: Cloud account ID\n", "name": "filter", "in": "query" } @@ -211,14 +214,13 @@ { "type": "string", "description": "Filter results using a query in Falcon Query Language (FQL). Supported " - "Filters:\ncloud_info.cloud_region: Cloud region\ncloud_info.cloud_provider: Cloud provider\nimage_tag: Image " - "tag\nimage_digest: Image digest (sha256 digest)\nimage_repository: Image repository\nimage_id: Image " - "ID\ncompliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: " - "high, 2: medium, 1:low)\nasset_type: asset type (container, image)\ncid: Customer " - "ID\ncompliance_finding.framework: Compliance finding framework (available values: " - "CIS)\ncloud_info.cloud_account_id: Cloud account ID\ncompliance_finding.name: Compliance finding " - "Name\ncloud_info.cluster_name: Kubernetes cluster name\ncompliance_finding.id: Compliance finding " - "ID\nimage_registry: Image registry\n", + "Filters:\nasset_type: asset type (container, image)\ncloud_info.cloud_provider: Cloud " + "provider\ncompliance_finding.name: Compliance finding Name\nimage_registry: Image " + "registry\ncompliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, " + " 3: high, 2: medium, 1:low)\ncloud_info.cloud_region: Cloud region\ncompliance_finding.id: Compliance finding " + "ID\nimage_id: Image ID\nimage_digest: Image digest (sha256 digest)\ncloud_info.cloud_account_id: Cloud account " + " ID\nimage_tag: Image tag\ncloud_info.cluster_name: Kubernetes cluster name\ncompliance_finding.framework: " + "Compliance finding framework (available values: CIS)\nimage_repository: Image repository\ncid: Customer ID\n", "name": "filter", "in": "query" } @@ -234,14 +236,14 @@ { "type": "string", "description": "Filter results using a query in Falcon Query Language (FQL). Supported " - "Filters:\ncloud_info.cloud_provider: Cloud provider\ncompliance_finding.id: Compliance finding ID\nasset_type: " - " asset type (container, image)\ncid: Customer ID\ncloud_info.cloud_account_id: Cloud account " - "ID\nimage_registry: Image registry\ncompliance_finding.name: Compliance finding Name\ncloud_info.cloud_region: " - " Cloud region\ncloud_info.cluster_name: Kubernetes cluster name\ncloud_info.namespace: Kubernetes " - "namespace\ncompliance_finding.framework: Compliance finding framework (available values: CIS)\nimage_id: Image " - " ID\nimage_tag: Image tag\nimage_repository: Image repository\ncompliance_finding.severity: Compliance finding " - " severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1:low)\nimage_digest: Image digest " - "(sha256 digest)\n", + "Filters:\ncompliance_finding.id: Compliance finding ID\nimage_registry: Image " + "registry\ncompliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, " + " 3: high, 2: medium, 1:low)\ncloud_info.namespace: Kubernetes namespace\ncid: Customer ID\nasset_type: asset " + "type (container, image)\nimage_tag: Image tag\ncloud_info.cloud_region: Cloud region\ncompliance_finding.name: " + " Compliance finding Name\ncloud_info.cluster_name: Kubernetes cluster name\ncompliance_finding.framework: " + "Compliance finding framework (available values: CIS)\ncloud_info.cloud_account_id: Cloud account " + "ID\ncloud_info.cloud_provider: Cloud provider\nimage_id: Image ID\nimage_digest: Image digest (sha256 " + "digest)\nimage_repository: Image repository\n", "name": "filter", "in": "query" } @@ -256,15 +258,14 @@ [ { "type": "string", - "description": "Filter results using a query in Falcon Query Language (FQL). Supported " - "Filters:\ncompliance_finding.framework: Compliance finding framework (available values: " - "CIS)\nimage_repository: Image repository\ncloud_info.cloud_provider: Cloud provider\nimage_tag: Image " - "tag\nimage_registry: Image registry\ncid: Customer ID\nimage_digest: Image digest (sha256 " - "digest)\ncloud_info.cloud_account_id: Cloud account ID\nimage_id: Image ID\ncompliance_finding.severity: " - "Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, " - "1:low)\ncompliance_finding.name: Compliance finding Name\ncloud_info.cloud_region: Cloud " - "region\ncloud_info.cluster_name: Kubernetes cluster name\nasset_type: asset type (container, " - "image)\ncompliance_finding.id: Compliance finding ID\n", + "description": "Filter results using a query in Falcon Query Language (FQL). Supported Filters:\ncid: " + "Customer ID\nimage_registry: Image registry\nimage_tag: Image tag\ncloud_info.cloud_provider: Cloud " + "provider\nimage_digest: Image digest (sha256 digest)\nimage_repository: Image " + "repository\ncompliance_finding.id: Compliance finding ID\ncompliance_finding.name: Compliance finding " + "Name\nimage_id: Image ID\ncloud_info.cloud_region: Cloud region\nasset_type: asset type (container, " + "image)\ncloud_info.cluster_name: Kubernetes cluster name\ncompliance_finding.severity: Compliance finding " + "severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1:low)\ncompliance_finding.framework: " + "Compliance finding framework (available values: CIS)\ncloud_info.cloud_account_id: Cloud account ID\n", "name": "filter", "in": "query" } @@ -280,14 +281,14 @@ { "type": "string", "description": "Filter results using a query in Falcon Query Language (FQL). Supported " - "Filters:\ncontainer_id: Container ID\ncloud_info.cloud_account_id: Cloud account ID\nimage_id: Image " - "ID\ncompliance_finding.id: Compliance finding ID\nimage_registry: Image registry\ncompliance_finding.name: " - "Compliance finding Name\ncontainer_name: Container name\ncloud_info.cloud_region: Cloud " - "region\ncompliance_finding.framework: Compliance finding framework (available values: CIS)\nimage_repository: " - "Image repository\ncloud_info.cloud_provider: Cloud provider\ncompliance_finding.severity: Compliance finding " - "severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1:low)\nasset_type: asset type " - "(container, image)\ncid: Customer ID\nimage_digest: Image digest (sha256 digest)\nimage_tag: Image " - "tag\ncloud_info.cluster_name: Kubernetes cluster name\n", + "Filters:\ncloud_info.cluster_name: Kubernetes cluster name\ncloud_info.cloud_account_id: Cloud account " + "ID\nasset_type: asset type (container, image)\ncompliance_finding.id: Compliance finding " + "ID\ncompliance_finding.name: Compliance finding Name\nimage_id: Image ID\nimage_registry: Image " + "registry\ncontainer_id: Container ID\ncompliance_finding.severity: Compliance finding severity; available " + "values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1:low)\nimage_repository: Image " + "repository\ncloud_info.cloud_region: Cloud region\ncompliance_finding.framework: Compliance finding framework " + "(available values: CIS)\nimage_digest: Image digest (sha256 digest)\nimage_tag: Image tag\ncid: Customer " + "ID\ncontainer_name: Container name\ncloud_info.cloud_provider: Cloud provider\n", "name": "filter", "in": "query" } diff --git a/src/falconpy/_endpoint/_correlation_rules_admin.py b/src/falconpy/_endpoint/_correlation_rules_admin.py index be1c388b6..005b68205 100644 --- a/src/falconpy/_endpoint/_correlation_rules_admin.py +++ b/src/falconpy/_endpoint/_correlation_rules_admin.py @@ -50,5 +50,19 @@ "required": True } ] + ], + [ + "entities_rules_ownership_put_v2", + "PUT", + "/correlation-rules/entities/rules/ownership/v2", + "Bulk change the owner of existing Correlation Rules", + "correlation_rules_admin", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] ] ] diff --git a/src/falconpy/_endpoint/_cspm_registration.py b/src/falconpy/_endpoint/_cspm_registration.py index 616ad38fa..28bcb355f 100644 --- a/src/falconpy/_endpoint/_cspm_registration.py +++ b/src/falconpy/_endpoint/_cspm_registration.py @@ -1308,7 +1308,8 @@ "getCloudEventIDs", "GET", "/detects/queries/cloud-events/v1", - "Get list of related cloud event LogScale IDs for a given IOA", + "Deprecated: use cdrapi entities/event-details/v1 'logscale_related_events_query' instead. Get list of " + "related cloud event LogScale IDs for a given IOA.", "cspm_registration", [ { diff --git a/src/falconpy/_endpoint/_data_protection_configuration.py b/src/falconpy/_endpoint/_data_protection_configuration.py index 9dc0a00eb..57e1c5578 100644 --- a/src/falconpy/_endpoint/_data_protection_configuration.py +++ b/src/falconpy/_endpoint/_data_protection_configuration.py @@ -673,6 +673,83 @@ } ] ], + [ + "entities_web_location_group_get", + "GET", + "/data-protection/entities/web-location-groups/v2", + "Get specific web location groups", + "data_protection_configuration", + [ + { + "type": "array", + "items": { + "type": "string" + }, + "collectionFormat": "multi", + "description": "The web location group id(s) to get.", + "name": "ids", + "in": "query", + "required": True + } + ] + ], + [ + "entities_web_location_group_create", + "POST", + "/data-protection/entities/web-location-groups/v2", + "Create a web location group", + "data_protection_configuration", + [ + { + "description": "The web location group definition to create", + "name": "body", + "in": "body", + "required": True + } + ] + ], + [ + "entities_web_location_group_delete", + "DELETE", + "/data-protection/entities/web-location-groups/v2", + "Soft delete web location groups", + "data_protection_configuration", + [ + { + "type": "array", + "items": { + "type": "string" + }, + "collectionFormat": "multi", + "description": "The id(s) of the web location group to delete.", + "name": "ids", + "in": "query", + "required": True + } + ] + ], + [ + "entities_web_location_group_patch", + "PATCH", + "/data-protection/entities/web-location-groups/v2", + "Update a web location group", + "data_protection_configuration", + [ + { + "type": "string", + "description": "The web location group id to update.", + "name": "id", + "in": "query", + "required": True + }, + { + "description": "The new web location group definition", + "name": "body", + "in": "body", + "required": True + } + ] + ], [ "entities_web_location_get_v2", "GET", @@ -759,10 +836,10 @@ [ { "type": "string", - "description": "Filter results by specific attributes , allowed attributes are [modified_by " - "modified_at properties.evidence_duplication_enabled properties.sensitivity_labels properties.web_sources name " - "created_at properties.content_patterns properties.content_patterns_operator properties.file_types " - "properties.protection_mode created_by]", + "description": "Filter results by specific attributes , allowed attributes are [created_by " + "properties.content_patterns_operator properties.protection_mode properties.sensitivity_labels created_at " + "modified_by modified_at properties.content_patterns properties.evidence_duplication_enabled " + "properties.file_types properties.web_sources name]", "name": "filter", "in": "query" }, @@ -1059,26 +1136,26 @@ }, { "type": "string", - "description": "Filter results by specific attributes , allowed attributes are " - "[properties.evidence_duplication_enabled_default properties.network_inspection_files_exceeding_size_limit " - "properties.be_paste_timeout_duration_milliseconds properties.be_paste_timeout_response " - "properties.be_paste_clipboard_min_size properties.evidence_storage_free_disk_perc description " - "properties.min_confidence_level properties.evidence_encrypted_enabled properties.classifications " - "properties.besplash_custom_message properties.be_paste_clipboard_max_size " - "properties.be_paste_clipboard_max_size_unit properties.be_paste_clipboard_over_size_behaviour_block created_by " - " modified_by properties.block_notifications properties.be_exclude_domains properties.euj_dialog_timeout " - "properties.screen_capture_duration_pre_event properties.custom_block_notification " - "properties.enable_network_inspection properties.enable_screen_capture is_enabled " - "properties.besplash_message_source name properties.enable_content_inspection " - "properties.max_file_size_to_inspect_unit properties.enable_clipboard_inspection " - "properties.evidence_download_enabled properties.be_upload_timeout_response " - "properties.be_paste_clipboard_min_size_unit properties.evidence_storage_max_size precedence modified_at " - "properties.browsers_without_active_extension properties.allow_notifications " - "properties.be_upload_timeout_duration_seconds properties.max_file_size_to_inspect " - "properties.screen_capture_duration_post_event is_default properties.enable_context_inspection " - "properties.inspection_depth properties.block_all_data_access properties.similarity_detection " - "properties.enable_end_user_notifications_unsupported_browser properties.custom_allow_notification " - "properties.besplash_enabled created_at properties.similarity_threshold]", + "description": "Filter results by specific attributes , allowed attributes are [precedence is_default " + "properties.evidence_encrypted_enabled properties.be_upload_timeout_duration_seconds " + "properties.enable_screen_capture description modified_by properties.evidence_download_enabled " + "properties.classifications properties.be_paste_timeout_response name is_enabled created_at modified_at " + "properties.inspection_depth properties.enable_clipboard_web_origin properties.besplash_custom_message " + "properties.be_paste_clipboard_over_size_behaviour_block properties.min_confidence_level " + "properties.enable_clipboard_inspection properties.allow_notifications properties.block_notifications " + "properties.be_upload_timeout_response properties.be_paste_clipboard_min_size_unit " + "properties.be_paste_clipboard_max_size properties.screen_capture_duration_pre_event " + "properties.max_file_size_to_inspect_unit properties.browsers_without_active_extension " + "properties.evidence_duplication_enabled_default properties.enable_network_inspection " + "properties.be_exclude_domains properties.be_paste_timeout_duration_milliseconds " + "properties.be_paste_clipboard_min_size properties.be_paste_clipboard_max_size_unit created_by " + "properties.enable_content_inspection properties.enable_context_inspection properties.custom_allow_notification " + " properties.custom_block_notification properties.besplash_enabled properties.besplash_message_source " + "properties.max_file_size_to_inspect properties.block_all_data_access properties.similarity_detection " + "properties.evidence_storage_free_disk_perc properties.evidence_storage_max_size properties.euj_dialog_timeout " + "properties.screen_capture_duration_post_event properties.enable_ocr properties.similarity_threshold " + "properties.enable_end_user_notifications_unsupported_browser " + "properties.network_inspection_files_exceeding_size_limit]", "name": "filter", "in": "query" }, @@ -1107,6 +1184,49 @@ } ] ], + [ + "queries_web_location_group_get", + "GET", + "/data-protection/queries/web-location-groups/v2", + "Get all web location group IDs matching the query with filter", + "data_protection_configuration", + [ + { + "type": "string", + "description": "Optional filter for searching web location groups. Allowed filters are 'name' " + "(string), 'deleted' (boolean), 'type' (string: 'predefined' or 'custom'), 'created' and 'last_updated'", + "name": "filter", + "in": "query" + }, + { + "type": "string", + "description": "The type of entity to query. Allowed values are 'predefined' and 'custom'", + "name": "type", + "in": "query" + }, + { + "type": "string", + "description": "The sort instructions to order by on. Allowed values are 'name', 'created' and 'last_updated'", + "name": "sort", + "in": "query" + }, + { + "type": "integer", + "default": 100, + "description": "The number of items to return in this response (default: 100, max: 500). Use with the " + "offset parameter to manage pagination of results.", + "name": "limit", + "in": "query" + }, + { + "type": "integer", + "description": "The offset to start retrieving records from. Use with the limit parameter to manage " + "pagination of results.", + "name": "offset", + "in": "query" + } + ] + ], [ "queries_web_location_get_v2", "GET", diff --git a/src/falconpy/_endpoint/_deployments.py b/src/falconpy/_endpoint/_deployments.py index 16625d1f4..517506add 100644 --- a/src/falconpy/_endpoint/_deployments.py +++ b/src/falconpy/_endpoint/_deployments.py @@ -44,6 +44,13 @@ "Queries for release-notes resources and returns details", "deployments", [ + { + "type": "string", + "description": "authorization header", + "name": "Authorization", + "in": "header", + "required": True + }, { "type": "string", "description": "FQL query specifying filter parameters.", @@ -81,6 +88,13 @@ "Queries for releases resources and returns details", "deployments", [ + { + "type": "string", + "description": "authorization header", + "name": "Authorization", + "in": "header", + "required": True + }, { "type": "string", "description": "FQL query specifying filter parameters.", @@ -118,6 +132,13 @@ "Get deployment resources by ids", "deployments", [ + { + "type": "string", + "description": "authorization header", + "name": "Authorization", + "in": "header", + "required": True + }, { "type": "array", "items": { @@ -138,6 +159,13 @@ "returns the release notes for the IDs in the request", "deployments", [ + { + "type": "string", + "description": "authorization header", + "name": "Authorization", + "in": "header", + "required": True + }, { "name": "body", "in": "body", @@ -152,6 +180,13 @@ "returns the release notes for the IDs in the request with EA and GA dates in ISO 8601 format", "deployments", [ + { + "type": "string", + "description": "authorization header", + "name": "Authorization", + "in": "header", + "required": True + }, { "name": "body", "in": "body", @@ -166,6 +201,13 @@ "Queries for release-notes resources and returns ids", "deployments", [ + { + "type": "string", + "description": "authorization header", + "name": "Authorization", + "in": "header", + "required": True + }, { "type": "string", "description": "FQL query specifying filter parameters.", diff --git a/src/falconpy/_endpoint/_host_migration.py b/src/falconpy/_endpoint/_host_migration.py index f759e9a67..9014c1e6a 100644 --- a/src/falconpy/_endpoint/_host_migration.py +++ b/src/falconpy/_endpoint/_host_migration.py @@ -216,15 +216,9 @@ { "type": "string", "enum": [ - "created_time|asc", - "created_time|desc", - "created_time", - "groups|asc", - "groups|desc", - "groups", - "hostgroups|asc", - "hostgroups|desc", - "hostgroups", + "id|asc", + "id|desc", + "id", "hostname|asc", "hostname|desc", "hostname", @@ -234,9 +228,18 @@ "source_cid|asc", "source_cid|desc", "source_cid", + "created_time|asc", + "created_time|desc", + "created_time", "host_migration_id|asc", "host_migration_id|desc", "host_migration_id", + "groups|asc", + "groups|desc", + "groups", + "hostgroups|asc", + "hostgroups|desc", + "hostgroups", "static_host_groups|asc", "static_host_groups|desc", "static_host_groups", @@ -245,10 +248,7 @@ "status", "migration_id|asc", "migration_id|desc", - "migration_id", - "id|asc", - "id|desc", - "id" + "migration_id" ], "description": "The property to sort by.", "name": "sort", @@ -256,9 +256,9 @@ }, { "type": "string", - "description": "The filter expression that should be used to limit the results. Valid fields: " - "hostname, target_cid, source_cid, host_migration_id, static_host_groups, status, migration_id, id, " - "created_time, groups, hostgroups", + "description": "The filter expression that should be used to limit the results. Valid fields: id, " + "hostname, target_cid, source_cid, created_time, host_migration_id, groups, hostgroups, static_host_groups, " + "status, migration_id", "name": "filter", "in": "query" } diff --git a/src/falconpy/_endpoint/_hosts.py b/src/falconpy/_endpoint/_hosts.py index e332d35a8..ea205c8eb 100644 --- a/src/falconpy/_endpoint/_hosts.py +++ b/src/falconpy/_endpoint/_hosts.py @@ -61,202 +61,203 @@ { "type": "string", "enum": [ - "device_policies.logscale-collector.policy_id", - "config_id_base", - "product_type", - "device_policies.fim.policy_id", - "groups", - "managed_apps.aws-verified-access.version", - "pod_annotations", - "deployment_type", - "first_login_timestamp", - "system_manufacturer", - "policy_id", - "policies.policy_type", - "device_policies.sensor_update.applied", + "device_policies.aws-verified-access.applied", + "pod_namespace", + "device_policies.application-abuse-prevention.policy_id", + "device_policies.aidr.applied", + "os_build", + "device_policies.prevention.policy_type", + "device_policies.sensor_update.policy_id", + "device_policies.netskope.policy_id", + "device_policies.data-protection.applied", + "device_policies.data-protection-cloud.policy_id", + "device_policies.mobile.policy_id", + "pod_host_ip4", + "first_login_user", + "last_login_user_sid", "device_policies.ztl.policy_id", - "device_policies.kubernetes-admission-control.applied", + "device_policies.fim.policy_type", + "device_policies.data-protection-cloud.applied", "instance_id", - "device_policies.ztl.applied", - "pod_ip6", - "k8s_cluster_id", - "device_policies.application-abuse-prevention.policy_type", - "agent_version", - "device_policies.kubernetes-admission-control.policy_type", - "device_policies.fim.applied", - "device_policies.aws-verified-access.policy_type", "device_policies.firewall.applied", - "device_policies.remote_response.policy_type", - "email", - "pod_hostname", - "external_ip", - "last_login_timestamp", - "device_policies.prevention.policy_id", - "device_policies.identity-endpoint.policy_type", - "device_policies.system-tray.applied", - "device_policies.it-automation.policy_id", - "kernel_version", - "detection_suppression_status", - "config_id_build", - "hostname", - "device_policies.jumpcloud.policy_id", - "device_policies.data-protection-cloud.applied", - "device_policies.it-automation.applied", - "zone_group", - "pod_labels", - "device_policies.logscale-collector.policy_type", - "device_policies.netskope.applied", - "device_policies.content-update.policy_id", - "local_ip.raw", - "pod_id", - "connection_ip", - "device_policies.application-abuse-prevention.policy_id", - "device_policies.application-abuse-prevention.applied", - "policies.policy_id", - "device_policies.fem-browser-extension-control.applied", - "device_policies.aidr.policy_type", - "device_policies.identity-endpoint.policy_id", - "device_policies.content-update.policy_type", - "device_policies.aws-verified-access.policy_id", - "device_policies.aws-verified-access.applied", - "mac_address", - "serial_number", - "pod_name", - "device_policies.aidr.policy_id", - "os_build", - "device_policies.automox.applied", - "device_policies.consumer-subscription.applied", - "device_policies.network-scan-content.policy_type", - "cid", + "managed_apps.netskope.version", + "safe_mode", "local_ip", - "device_policies.netskope.policy_type", - "device_policies.cloud-ml.policy_type", - "managed_apps.identity-protection.version", - "default_gateway_ip", - "device_policies.exposure-management.applied", - "agent_load_flags", - "last_login_user_sid", - "reduced_functionality_mode", + "platform_id", + "policies.policy_type", + "device_policies.automox.applied", + "device_policies.mobile.applied", + "connection_mac_address", "migration_completed_time", - "bios_manufacturer", - "last_login_uid", - "device_policies.device_control.policy_type", - "device_policies.fim.policy_type", - "managed_apps.automox.version", - "machine_domain", + "criticality", "platform_name", - "device_policies.firewall.rule_set_id", - "managed_apps.jumpcloud.version", - "device_policies.remote_response.applied", - "chassis_type_desc", - "filesystem_containment_status", - "device_id", - "product_type_desc", - "_all", - "device_policies.remote_response.policy_id", - "cpu_signature", - "device_policies.browser-extension.policy_id", - "system_product_name", - "device_policies.identity-protection.policy_id", - "device_policies.identity-endpoint.applied", - "device_policies.sca.applied", - "device_policies.data-protection-cloud.policy_id", - "managed_apps.airlock.version", + "site_name", + "device_policies.it-automation.policy_type", + "mac_address", + "reduced_functionality_mode", "cpu_vendor", + "pod_ip6", + "device_policies.sca.applied", + "device_policies.host-retention.applied", + "groups", + "pod_id", + "chassis_type", + "device_policies.exposure-management.applied", + "device_policies.logscale-collector.policy_id", "bios_version", - "first_login_user", - "last_login_user", - "major_version", - "ou", - "release_group", - "device_policies.automox.policy_id", - "device_policies.system-tray.policy_type", - "device_policies.sensor_update.policy_type", - "device_policies.device_control.policy_id", - "device_policies.airlock.policy_id", - "device_policies.kubernetes-admission-control.policy_id", + "pod_ip4", + "device_policies.network-scan-content.policy_type", + "device_policies.prevention.applied", "device_policies.vulnerability-management.policy_type", - "device_policies.consumer-subscription.policy_type", - "device_policies.cloud-ml.applied", - "device_policies.host-retention.policy_id", - "safe_mode", - "platform_id", - "device_policies.netskope.policy_id", - "device_policies.it-automation.policy_type", + "device_policies.remote_response.applied", + "os_product_name", + "device_policies.sensor_update.uninstall_protection", + "device_policies.kubernetes-admission-control.policy_id", "service_provider_account_id", - "device_policies.mobile.policy_id", - "pod_namespace", - "internet_exposure", - "last_seen", - "device_policies.jumpcloud.applied", + "device_policies.network-scan-content.policy_id", + "device_policies.fem-browser-extension-control.policy_type", + "device_policies.host-retention.policy_type", + "device_policies.firewall.policy_id", + "device_policies.remote_response.policy_type", + "config_id_build", "device_policies.data-protection.policy_id", - "service_provider", - "pod_host_ip4", - "pod_service_account_name", - "k8s_cluster_version", - "chassis_type", - "device_policies.automox.policy_type", - "device_policies.jumpcloud.policy_type", "device_policies.firewall.policy_type", - "rtr_state", - "os_product_name", - "linux_sensor_mode", - "device_policies.browser-extension.applied", - "device_policies.network-scan-content.applied", - "config_id_platform", - "device_policies.prevention.applied", - "device_policies.sensor_update.policy_id", + "pointer_size", + "chassis_type_desc", + "device_policies.ztl.policy_type", "device_policies.vulnerability-management.policy_id", + "serial_number", + "device_policies.application-abuse-prevention.applied", + "last_login_timestamp", + "device_policies.airlock.policy_id", + "device_policies.jumpcloud.applied", "device_policies.sca.policy_id", - "device_policies.browser-extension.policy_type", - "device_policies.fem-browser-extension-control.policy_type", - "device_policies.aidr.applied", - "device_policies.sensor_update.uninstall_protection", - "device_policies.airlock.policy_type", - "device_policies.identity-protection.applied", - "device_policies.vulnerability-management.applied", - "license_activation_state", - "device_policies.network-scan-content.policy_id", + "group_hash", + "k8s_cluster_version", + "last_reboot", + "last_login_user", + "device_policies.prevention.policy_id", + "device_policies.sensor_update.applied", + "managed_apps.airlock.version", + "rtr_state", + "device_policies.logscale-collector.policy_type", "device_policies.logscale-collector.applied", "policies.applied", - "device_policies.data-protection-cloud.policy_type", - "k8s_cluster_git_version", - "criticality", - "device_policies.prevention.policy_type", - "device_policies.identity-protection.policy_type", - "device_policies.ztl.policy_type", - "device_policies.host-retention.applied", - "pod_ip4", + "device_policies.airlock.applied", + "device_policies.data-protection.policy_type", + "device_policies.remote_response.policy_id", + "pod_hostname", + "device_policies.aidr.policy_id", + "agent_load_flags", + "device_policies.ztl.applied", + "device_policies.system-tray.policy_type", + "device_policies.content-update.policy_id", + "managed_apps.identity-protection.version", + "cpu_signature", + "kernel_version", + "release_group", + "device_policies.kubernetes-admission-control.policy_type", + "device_policies.system-tray.policy_id", + "connection_ip", + "default_gateway_ip", + "config_id_platform", + "hostname", + "device_policies.jumpcloud.policy_type", + "local_ip.raw", + "tags", "host_utc_offset", - "os_version", - "device_policies.consumer-subscription.policy_id", - "device_policies.mobile.policy_type", - "device_policies.mobile.applied", + "product_type_desc", + "policy_id", + "device_policies.sensor_update.policy_type", + "device_policies.device_control.applied", + "email", + "internet_exposure", + "cloud_service_compartment_id", + "device_policies.browser-extension.policy_type", + "ou", + "product_type", + "device_policies.device_control.policy_type", + "device_policies.aidr.policy_type", + "first_login_timestamp", + "system_product_name", + "modified_timestamp", + "device_policies.jumpcloud.policy_id", + "device_policies.consumer-subscription.policy_type", + "device_policies.aws-verified-access.policy_id", + "zone_group", + "device_policies.application-abuse-prevention.policy_type", + "external_ip", + "machine_domain", + "device_policies.airlock.policy_type", "device_policies.exposure-management.policy_type", + "os_version", + "_all", + "license_activation_state", + "filesystem_containment_status", "minor_version", - "pod_host_ip6", - "site_name", + "device_policies.identity-endpoint.applied", + "device_policies.consumer-subscription.policy_id", + "device_policies.data-protection-cloud.policy_type", + "device_policies.browser-extension.policy_id", + "config_id_base", + "first_seen", + "last_login_uid", + "policies.policy_id", + "device_policies.identity-protection.policy_type", + "device_policies.vulnerability-management.applied", + "device_policies.cloud-ml.applied", + "device_policies.firewall.rule_set_id", + "bios_manufacturer", + "major_version", + "device_policies.automox.policy_id", + "device_policies.netskope.policy_type", + "device_policies.netskope.applied", + "device_policies.identity-protection.applied", + "device_policies.it-automation.policy_id", + "managed_apps.automox.version", + "agent_version", + "system_manufacturer", + "device_policies.fim.applied", + "k8s_cluster_git_version", + "device_policies.browser-extension.applied", "device_policies.exposure-management.policy_id", - "device_policies.cloud-ml.policy_id", - "device_policies.data-protection.policy_type", - "device_policies.data-protection.applied", "device_policies.fem-browser-extension-control.policy_id", + "device_id", + "device_policies.cloud-ml.policy_type", "device_policies.sca.policy_type", - "managed_apps.netskope.version", - "tags", - "first_seen", + "pod_service_account_name", + "linux_sensor_mode", + "device_policies.fem-browser-extension-control.applied", + "device_policies.identity-endpoint.policy_id", + "device_policies.kubernetes-admission-control.applied", + "device_policies.host-retention.policy_id", + "service_provider", + "pod_host_ip6", + "device_policies.automox.policy_type", + "device_policies.identity-protection.policy_id", + "device_policies.cloud-ml.policy_id", + "device_policies.it-automation.applied", + "device_policies.aws-verified-access.policy_type", + "pod_labels", + "k8s_cluster_id", + "detection_suppression_status", + "last_seen", + "device_policies.identity-endpoint.policy_type", + "device_policies.system-tray.applied", + "device_policies.content-update.policy_type", + "managed_apps.jumpcloud.version", + "managed_apps.aws-verified-access.version", + "pod_annotations", + "deployment_type", + "cid", "status", - "modified_timestamp", - "device_policies.airlock.applied", - "device_policies.system-tray.policy_id", + "device_policies.consumer-subscription.applied", "device_policies.content-update.applied", - "pointer_size", - "connection_mac_address", - "device_policies.device_control.applied", - "device_policies.host-retention.policy_type", - "group_hash", - "device_policies.firewall.policy_id", - "last_reboot" + "device_policies.mobile.policy_type", + "pod_name", + "device_policies.network-scan-content.applied", + "device_policies.device_control.policy_id", + "device_policies.fim.policy_id" ], "description": "The property to sort by (e.g. status.desc or hostname.asc). If not specified, the " "default sort will be device_id.asc. This should be supplied for each consecutive call.", @@ -361,208 +362,209 @@ "type": "integer", "default": 100, "description": "The maximum records to return. [1-10000]", - "name": "limit", - "in": "query" - }, - { - "type": "string", - "enum": [ - "device_policies.logscale-collector.policy_id", - "config_id_base", - "product_type", - "device_policies.fim.policy_id", - "groups", - "managed_apps.aws-verified-access.version", - "pod_annotations", - "deployment_type", - "first_login_timestamp", - "system_manufacturer", - "policy_id", - "policies.policy_type", - "device_policies.sensor_update.applied", - "device_policies.ztl.policy_id", - "device_policies.kubernetes-admission-control.applied", - "instance_id", - "device_policies.ztl.applied", - "pod_ip6", - "k8s_cluster_id", - "device_policies.application-abuse-prevention.policy_type", - "agent_version", - "device_policies.kubernetes-admission-control.policy_type", - "device_policies.fim.applied", - "device_policies.aws-verified-access.policy_type", - "device_policies.firewall.applied", - "device_policies.remote_response.policy_type", - "email", - "pod_hostname", - "external_ip", - "last_login_timestamp", - "device_policies.prevention.policy_id", - "device_policies.identity-endpoint.policy_type", - "device_policies.system-tray.applied", - "device_policies.it-automation.policy_id", - "kernel_version", - "detection_suppression_status", - "config_id_build", - "hostname", - "device_policies.jumpcloud.policy_id", - "device_policies.data-protection-cloud.applied", - "device_policies.it-automation.applied", - "zone_group", - "pod_labels", - "device_policies.logscale-collector.policy_type", - "device_policies.netskope.applied", - "device_policies.content-update.policy_id", - "local_ip.raw", - "pod_id", - "connection_ip", - "device_policies.application-abuse-prevention.policy_id", - "device_policies.application-abuse-prevention.applied", - "policies.policy_id", - "device_policies.fem-browser-extension-control.applied", - "device_policies.aidr.policy_type", - "device_policies.identity-endpoint.policy_id", - "device_policies.content-update.policy_type", - "device_policies.aws-verified-access.policy_id", - "device_policies.aws-verified-access.applied", - "mac_address", - "serial_number", - "pod_name", - "device_policies.aidr.policy_id", - "os_build", - "device_policies.automox.applied", - "device_policies.consumer-subscription.applied", - "device_policies.network-scan-content.policy_type", - "cid", - "local_ip", - "device_policies.netskope.policy_type", - "device_policies.cloud-ml.policy_type", - "managed_apps.identity-protection.version", - "default_gateway_ip", - "device_policies.exposure-management.applied", - "agent_load_flags", - "last_login_user_sid", - "reduced_functionality_mode", - "migration_completed_time", - "bios_manufacturer", - "last_login_uid", - "device_policies.device_control.policy_type", - "device_policies.fim.policy_type", - "managed_apps.automox.version", - "machine_domain", - "platform_name", - "device_policies.firewall.rule_set_id", - "managed_apps.jumpcloud.version", - "device_policies.remote_response.applied", - "chassis_type_desc", - "filesystem_containment_status", - "device_id", - "product_type_desc", - "_all", - "device_policies.remote_response.policy_id", - "cpu_signature", - "device_policies.browser-extension.policy_id", - "system_product_name", - "device_policies.identity-protection.policy_id", - "device_policies.identity-endpoint.applied", - "device_policies.sca.applied", + "name": "limit", + "in": "query" + }, + { + "type": "string", + "enum": [ + "device_policies.aws-verified-access.applied", + "pod_namespace", + "device_policies.application-abuse-prevention.policy_id", + "device_policies.aidr.applied", + "os_build", + "device_policies.prevention.policy_type", + "device_policies.sensor_update.policy_id", + "device_policies.netskope.policy_id", + "device_policies.data-protection.applied", "device_policies.data-protection-cloud.policy_id", - "managed_apps.airlock.version", - "cpu_vendor", - "bios_version", + "device_policies.mobile.policy_id", + "pod_host_ip4", "first_login_user", - "last_login_user", - "major_version", - "ou", - "release_group", - "device_policies.automox.policy_id", - "device_policies.system-tray.policy_type", - "device_policies.sensor_update.policy_type", - "device_policies.device_control.policy_id", - "device_policies.airlock.policy_id", - "device_policies.kubernetes-admission-control.policy_id", - "device_policies.vulnerability-management.policy_type", - "device_policies.consumer-subscription.policy_type", - "device_policies.cloud-ml.applied", - "device_policies.host-retention.policy_id", + "last_login_user_sid", + "device_policies.ztl.policy_id", + "device_policies.fim.policy_type", + "device_policies.data-protection-cloud.applied", + "instance_id", + "device_policies.firewall.applied", + "managed_apps.netskope.version", "safe_mode", + "local_ip", "platform_id", - "device_policies.netskope.policy_id", + "policies.policy_type", + "device_policies.automox.applied", + "device_policies.mobile.applied", + "connection_mac_address", + "migration_completed_time", + "criticality", + "platform_name", + "site_name", "device_policies.it-automation.policy_type", + "mac_address", + "reduced_functionality_mode", + "cpu_vendor", + "pod_ip6", + "device_policies.sca.applied", + "device_policies.host-retention.applied", + "groups", + "pod_id", + "chassis_type", + "device_policies.exposure-management.applied", + "device_policies.logscale-collector.policy_id", + "bios_version", + "pod_ip4", + "device_policies.network-scan-content.policy_type", + "device_policies.prevention.applied", + "device_policies.vulnerability-management.policy_type", + "device_policies.remote_response.applied", + "os_product_name", + "device_policies.sensor_update.uninstall_protection", + "device_policies.kubernetes-admission-control.policy_id", "service_provider_account_id", - "device_policies.mobile.policy_id", - "pod_namespace", - "internet_exposure", - "last_seen", - "device_policies.jumpcloud.applied", + "device_policies.network-scan-content.policy_id", + "device_policies.fem-browser-extension-control.policy_type", + "device_policies.host-retention.policy_type", + "device_policies.firewall.policy_id", + "device_policies.remote_response.policy_type", + "config_id_build", "device_policies.data-protection.policy_id", - "service_provider", - "pod_host_ip4", - "pod_service_account_name", - "k8s_cluster_version", - "chassis_type", - "device_policies.automox.policy_type", - "device_policies.jumpcloud.policy_type", "device_policies.firewall.policy_type", - "rtr_state", - "os_product_name", - "linux_sensor_mode", - "device_policies.browser-extension.applied", - "device_policies.network-scan-content.applied", - "config_id_platform", - "device_policies.prevention.applied", - "device_policies.sensor_update.policy_id", + "pointer_size", + "chassis_type_desc", + "device_policies.ztl.policy_type", "device_policies.vulnerability-management.policy_id", + "serial_number", + "device_policies.application-abuse-prevention.applied", + "last_login_timestamp", + "device_policies.airlock.policy_id", + "device_policies.jumpcloud.applied", "device_policies.sca.policy_id", - "device_policies.browser-extension.policy_type", - "device_policies.fem-browser-extension-control.policy_type", - "device_policies.aidr.applied", - "device_policies.sensor_update.uninstall_protection", - "device_policies.airlock.policy_type", - "device_policies.identity-protection.applied", - "device_policies.vulnerability-management.applied", - "license_activation_state", - "device_policies.network-scan-content.policy_id", + "group_hash", + "k8s_cluster_version", + "last_reboot", + "last_login_user", + "device_policies.prevention.policy_id", + "device_policies.sensor_update.applied", + "managed_apps.airlock.version", + "rtr_state", + "device_policies.logscale-collector.policy_type", "device_policies.logscale-collector.applied", "policies.applied", - "device_policies.data-protection-cloud.policy_type", - "k8s_cluster_git_version", - "criticality", - "device_policies.prevention.policy_type", - "device_policies.identity-protection.policy_type", - "device_policies.ztl.policy_type", - "device_policies.host-retention.applied", - "pod_ip4", + "device_policies.airlock.applied", + "device_policies.data-protection.policy_type", + "device_policies.remote_response.policy_id", + "pod_hostname", + "device_policies.aidr.policy_id", + "agent_load_flags", + "device_policies.ztl.applied", + "device_policies.system-tray.policy_type", + "device_policies.content-update.policy_id", + "managed_apps.identity-protection.version", + "cpu_signature", + "kernel_version", + "release_group", + "device_policies.kubernetes-admission-control.policy_type", + "device_policies.system-tray.policy_id", + "connection_ip", + "default_gateway_ip", + "config_id_platform", + "hostname", + "device_policies.jumpcloud.policy_type", + "local_ip.raw", + "tags", "host_utc_offset", - "os_version", - "device_policies.consumer-subscription.policy_id", - "device_policies.mobile.policy_type", - "device_policies.mobile.applied", + "product_type_desc", + "policy_id", + "device_policies.sensor_update.policy_type", + "device_policies.device_control.applied", + "email", + "internet_exposure", + "cloud_service_compartment_id", + "device_policies.browser-extension.policy_type", + "ou", + "product_type", + "device_policies.device_control.policy_type", + "device_policies.aidr.policy_type", + "first_login_timestamp", + "system_product_name", + "modified_timestamp", + "device_policies.jumpcloud.policy_id", + "device_policies.consumer-subscription.policy_type", + "device_policies.aws-verified-access.policy_id", + "zone_group", + "device_policies.application-abuse-prevention.policy_type", + "external_ip", + "machine_domain", + "device_policies.airlock.policy_type", "device_policies.exposure-management.policy_type", + "os_version", + "_all", + "license_activation_state", + "filesystem_containment_status", "minor_version", - "pod_host_ip6", - "site_name", + "device_policies.identity-endpoint.applied", + "device_policies.consumer-subscription.policy_id", + "device_policies.data-protection-cloud.policy_type", + "device_policies.browser-extension.policy_id", + "config_id_base", + "first_seen", + "last_login_uid", + "policies.policy_id", + "device_policies.identity-protection.policy_type", + "device_policies.vulnerability-management.applied", + "device_policies.cloud-ml.applied", + "device_policies.firewall.rule_set_id", + "bios_manufacturer", + "major_version", + "device_policies.automox.policy_id", + "device_policies.netskope.policy_type", + "device_policies.netskope.applied", + "device_policies.identity-protection.applied", + "device_policies.it-automation.policy_id", + "managed_apps.automox.version", + "agent_version", + "system_manufacturer", + "device_policies.fim.applied", + "k8s_cluster_git_version", + "device_policies.browser-extension.applied", "device_policies.exposure-management.policy_id", - "device_policies.cloud-ml.policy_id", - "device_policies.data-protection.policy_type", - "device_policies.data-protection.applied", "device_policies.fem-browser-extension-control.policy_id", + "device_id", + "device_policies.cloud-ml.policy_type", "device_policies.sca.policy_type", - "managed_apps.netskope.version", - "tags", - "first_seen", + "pod_service_account_name", + "linux_sensor_mode", + "device_policies.fem-browser-extension-control.applied", + "device_policies.identity-endpoint.policy_id", + "device_policies.kubernetes-admission-control.applied", + "device_policies.host-retention.policy_id", + "service_provider", + "pod_host_ip6", + "device_policies.automox.policy_type", + "device_policies.identity-protection.policy_id", + "device_policies.cloud-ml.policy_id", + "device_policies.it-automation.applied", + "device_policies.aws-verified-access.policy_type", + "pod_labels", + "k8s_cluster_id", + "detection_suppression_status", + "last_seen", + "device_policies.identity-endpoint.policy_type", + "device_policies.system-tray.applied", + "device_policies.content-update.policy_type", + "managed_apps.jumpcloud.version", + "managed_apps.aws-verified-access.version", + "pod_annotations", + "deployment_type", + "cid", "status", - "modified_timestamp", - "device_policies.airlock.applied", - "device_policies.system-tray.policy_id", + "device_policies.consumer-subscription.applied", "device_policies.content-update.applied", - "pointer_size", - "connection_mac_address", - "device_policies.device_control.applied", - "device_policies.host-retention.policy_type", - "group_hash", - "device_policies.firewall.policy_id", - "last_reboot" + "device_policies.mobile.policy_type", + "pod_name", + "device_policies.network-scan-content.applied", + "device_policies.device_control.policy_id", + "device_policies.fim.policy_id" ], "description": "The property to sort by (e.g. status.desc or hostname.asc). If not specified, the " "default sort will be device_id.asc. This should be supplied for each consecutive call.", diff --git a/src/falconpy/_endpoint/_incidents.py b/src/falconpy/_endpoint/_incidents.py index 08e964ae1..bafcfb354 100644 --- a/src/falconpy/_endpoint/_incidents.py +++ b/src/falconpy/_endpoint/_incidents.py @@ -253,5 +253,260 @@ "in": "query" } ] + ], + [ + "CrowdScore", + "GET", + "/incidents/combined/crowdscores/v1", + "DECOMMISSIONED: DEPRECATED: the incidentapi will be removed in March 2026. Query environment wide " + + "CrowdScore and return the entity data", + + "incidents", + [ + { + "type": "string", + "description": "Optional filter and sort criteria in the form of an FQL query. For more information " + + "about FQL queries, see [our FQL documentation in " + + "Falcon](https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-feature-guide).", + + "name": "filter", + "in": "query" + }, + { + "type": "integer", + "description": "Starting index of overall result set from which to return ids.", + "name": "offset", + "in": "query" + }, + { + "type": "integer", + "description": "The maximum records to return. [1-2500]", + "name": "limit", + "in": "query" + }, + { + "enum": [ + "adjusted_score.asc", + "adjusted_score.desc", + "score.asc", + "score.desc", + "timestamp.asc", + "timestamp.desc" + ], + "type": "string", + "description": "The property to sort on, followed by a dot (.), followed by the sort direction, either " + + "\"asc\" or \"desc\".", + + "name": "sort", + "in": "query" + } + ] + ], + [ + "GetBehaviors", + "POST", + "/incidents/entities/behaviors/GET/v1", + "DECOMMISSIONED: DEPRECATED: the incidentapi will be removed in March 2026. Get details on behaviors by " + + "providing behavior IDs", + + "incidents", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], + [ + "GetIncidents", + "POST", + "/incidents/entities/incidents/GET/v1", + "DECOMMISSIONED: DEPRECATED: the incidentapi will be removed in March 2026. Get details on incidents by " + + "providing incident IDs", + + "incidents", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], + [ + "PerformIncidentAction", + "POST", + "/incidents/entities/incident-actions/v1", + "DECOMMISSIONED: DEPRECATED: the incidentapi will be removed in March 2026. Perform a set of actions on " + + "one or more incidents, such as adding tags or comments or updating the incident name or description", + + "incidents", + [ + { + "type": "boolean", + "default": False, + "description": "If true, update assigned-to-uuid and or status of detections associated with the " + + "incident(s). Defaults to false", + + "name": "update_detects", + "in": "query" + }, + { + "type": "boolean", + "default": False, + "description": "If true and update-detects is true, the assigned-to-uuid or status for ALL detections " + + "associated with the incident(s) will be overwritten. If false, only detects that have default values for " + + "assigned-to-uuid and/or status will be updated. Defaults to false. Ignored if 'update-detects' is missing or " + + "false.", + + "name": "overwrite_detects", + "in": "query" + }, + { + "description": "Incident Update request body containing minimum 1 and maximum 5000 Incident ID(s) and " + + "action param(s) to be performed action against.", + + "name": "body", + "in": "body", + "required": True + } + ] + ], + [ + "QueryBehaviors", + "GET", + "/incidents/queries/behaviors/v1", + "DECOMMISSIONED: DEPRECATED: the incidentapi will be removed in March 2026. Search for behaviors by " + + "providing an FQL filter, sorting, and paging details", + + "incidents", + [ + { + "type": "string", + "description": "Optional filter and sort criteria in the form of an FQL query. For more information " + + "about FQL queries, see [our FQL documentation in " + + "Falcon](https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-feature-guide).", + + "name": "filter", + "in": "query" + }, + { + "type": "integer", + "description": "Starting index of overall result set from which to return ids.", + "name": "offset", + "in": "query" + }, + { + "type": "integer", + "description": "The maximum records to return. [1-500]", + "name": "limit", + "in": "query" + }, + { + "enum": [ + "alert_ids.asc", + "alert_ids.desc", + "cmdline.asc", + "cmdline.desc", + "detection_ids.asc", + "detection_ids.desc", + "display_name.asc", + "display_name.desc", + "domain.asc", + "domain.desc", + "filepath.asc", + "filepath.desc", + "timestamp.asc", + "timestamp.desc" + ], + "type": "string", + "description": "The property to sort on, followed by a dot (.), followed by the sort direction, either " + + "\"asc\" or \"desc\".", + + "name": "sort", + "in": "query" + } + ] + ], + [ + "QueryIncidents", + "GET", + "/incidents/queries/incidents/v1", + "DECOMMISSIONED: DEPRECATED: the incidentapi will be removed in March 2026. Search for incidents by " + + "providing an FQL filter, sorting, and paging details", + + "incidents", + [ + { + "enum": [ + "assigned_to.asc", + "assigned_to.desc", + "assigned_to_name.asc", + "assigned_to_name.desc", + "end.asc", + "end.desc", + "modified_timestamp.asc", + "modified_timestamp.desc", + "name.asc", + "name.desc", + "sort_score.asc", + "sort_score.desc", + "start.asc", + "start.desc", + "state.asc", + "state.desc", + "status.asc", + "status.desc" + ], + "type": "string", + "description": "The property to sort on, followed by a dot (.), followed by the sort direction, either " + + "\"asc\" or \"desc\".", + + "name": "sort", + "in": "query" + }, + { + "type": "string", + "description": "Optional filter and sort criteria in the form of an FQL query. For more information " + + "about FQL queries, see [our FQL documentation in " + + "Falcon](https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-feature-guide).", + + "name": "filter", + "in": "query" + }, + { + "type": "integer", + "description": "Starting index of overall result set from which to return ids.", + "name": "offset", + "in": "query" + }, + { + "type": "integer", + "description": "The maximum records to return. [1-500]", + "name": "limit", + "in": "query" + } + ] ] ] diff --git a/src/falconpy/_endpoint/_knowledge_base_audit_events.py b/src/falconpy/_endpoint/_knowledge_base_audit_events.py index 4d6f2cfe6..99917afb5 100644 --- a/src/falconpy/_endpoint/_knowledge_base_audit_events.py +++ b/src/falconpy/_endpoint/_knowledge_base_audit_events.py @@ -37,28 +37,6 @@ """ _knowledge_base_audit_events_endpoints = [ - [ - "AggregatesKnowledgeBaseAuditEventsV1", - "POST", - "/agentic-studio/aggregates/knowledge_base_audit_events/v1", - "Aggregate knowledge base audit events based on the provided msa criteria.", - "knowledge_base_audit_events", - [ - { - "description": "Aggregate requests for knowledge base audit event data.", - "name": "body", - "in": "body", - "required": True - }, - { - "type": "boolean", - "default": False, - "description": "Include audit events for deleted knowledge bases. Defaults to false.", - "name": "include_deleted", - "in": "query" - } - ] - ], [ "CombinedKnowledgeBaseAuditEventsV1", "GET", @@ -192,5 +170,27 @@ "in": "query" } ] + ], + [ + "AggregatesKnowledgeBaseAuditEventsV1", + "POST", + "/agentic-studio/aggregates/knowledge_base_audit_events/v1", + "DECOMMISSIONED: Aggregate knowledge base audit events based on the provided msa criteria.", + "knowledge_base_audit_events", + [ + { + "description": "Aggregate requests for knowledge base audit event data.", + "name": "body", + "in": "body", + "required": True + }, + { + "type": "boolean", + "default": False, + "description": "Include audit events for deleted knowledge bases. Defaults to false.", + "name": "include_deleted", + "in": "query" + } + ] ] ] diff --git a/src/falconpy/_endpoint/_knowledge_bases.py b/src/falconpy/_endpoint/_knowledge_bases.py index ae159df5c..f8e0d0ae0 100644 --- a/src/falconpy/_endpoint/_knowledge_bases.py +++ b/src/falconpy/_endpoint/_knowledge_bases.py @@ -37,28 +37,6 @@ """ _knowledge_bases_endpoints = [ - [ - "AggregatesKnowledgeBasesV1", - "POST", - "/agentic-studio/aggregates/knowledge_bases/v1", - "Aggregate knowledge bases based on the provided msa criteria.", - "knowledge_bases", - [ - { - "type": "boolean", - "default": False, - "description": "Include deleted knowledge bases in the result. Defaults to false.", - "name": "include_deleted", - "in": "query" - }, - { - "description": "Aggregate requests for knowledge base data.", - "name": "body", - "in": "body", - "required": True - } - ] - ], [ "CombinedKnowledgeBasesV1", "GET", @@ -201,5 +179,27 @@ "in": "query" } ] + ], + [ + "AggregatesKnowledgeBasesV1", + "POST", + "/agentic-studio/aggregates/knowledge_bases/v1", + "DECOMMISSIONED: Aggregate knowledge bases based on the provided msa criteria.", + "knowledge_bases", + [ + { + "type": "boolean", + "default": False, + "description": "Include deleted knowledge bases in the result. Defaults to false.", + "name": "include_deleted", + "in": "query" + }, + { + "description": "Aggregate requests for knowledge base data.", + "name": "body", + "in": "body", + "required": True + } + ] ] ] diff --git a/src/falconpy/_endpoint/_kubernetes_protection.py b/src/falconpy/_endpoint/_kubernetes_protection.py index 4723c297d..a164ff940 100644 --- a/src/falconpy/_endpoint/_kubernetes_protection.py +++ b/src/falconpy/_endpoint/_kubernetes_protection.py @@ -729,6 +729,20 @@ } ] ], + [ + "PostAggregatesPods", + "POST", + "/container-security/aggregates/pods/v1", + "Get aggregate query result for pods", + "kubernetes_protection", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], [ "ReadClusterCombined", "GET", @@ -936,9 +950,9 @@ { "type": "string", "description": "Search Kubernetes IOMs using a query in Falcon Query Language (FQL). Supported filter " - "fields: cid cis_id cluster_id cluster_name containers_impacted_ai_related containers_impacted_count " - "containers_impacted_ids detection_type name namespace prevented resource_id resource_name resource_type" - "severity", + "fields: cid cis_id cloud_service cluster_id cluster_name containers_impacted_ai_related " + "containers_impacted_count containers_impacted_ids detection_type name namespace prevented resource_id " + "resource_name resource_type severity", "name": "filter", "in": "query" }, @@ -973,9 +987,9 @@ { "type": "string", "description": "Search Kubernetes IOMs using a query in Falcon Query Language (FQL). Supported filter " - "fields: cid cis_id cluster_id cluster_name containers_impacted_ai_related containers_impacted_count " - "containers_impacted_ids detection_type name namespace prevented resource_id resource_name resource_type" - "severity", + "fields: cid cis_id cloud_service cluster_id cluster_name containers_impacted_ai_related " + "containers_impacted_count containers_impacted_ids detection_type name namespace prevented resource_id " + "resource_name resource_type severity", "name": "filter", "in": "query" }, @@ -1105,9 +1119,9 @@ { "type": "string", "description": "Search Kubernetes IOMs using a query in Falcon Query Language (FQL). Supported filter " - "fields: cid cis_id cluster_id cluster_name containers_impacted_ai_related containers_impacted_count " - "containers_impacted_ids detection_type name namespace prevented resource_id resource_name resource_type" - "severity", + "fields: cid cis_id cloud_service cluster_id cluster_name containers_impacted_ai_related " + "containers_impacted_count containers_impacted_ids detection_type name namespace prevented resource_id " + "resource_name resource_type severity", "name": "filter", "in": "query" }, @@ -1150,38 +1164,38 @@ "in": "query" }, { - "pattern": "^(true|false)$", + "type": "string", "enum": [ "false", "true" ], - "type": "string", + "pattern": "^(true|false)$", "description": "Filter by whether an account originates from Horizon or not", "name": "is_horizon_acct", "in": "query" }, { - "pattern": "^(provisioned|operational)$", + "type": "string", "enum": [ "operational", "provisioned" ], - "type": "string", + "pattern": "^(provisioned|operational)$", "description": "Filter by account status", "name": "status", "in": "query" }, { + "type": "integer", "maximum": 1000, "minimum": 0, - "type": "integer", "description": "Limit returned accounts", "name": "limit", "in": "query" }, { - "minimum": 0, "type": "integer", + "minimum": 0, "description": "Offset returned accounts", "name": "offset", "in": "query" @@ -1203,10 +1217,10 @@ ] ], [ - "UpdateAWSAccount", - "PATCH", + "DeleteAWSAccountsMixin0", + "DELETE", "/kubernetes-protection/entities/accounts/aws/v1", - "Updates the AWS account per the query parameters provided", + "Delete AWS accounts.", "kubernetes_protection", [ { @@ -1215,25 +1229,18 @@ "type": "string" }, "collectionFormat": "csv", - "description": "AWS Account ID", + "description": "AWS Account IDs", "name": "ids", "in": "query", "required": True - }, - { - "pattern": "^[a-z\\d-]+$", - "type": "string", - "description": "Default Region for Account Automation", - "name": "region", - "in": "query" } ] ], [ - "DeleteAWSAccountsMixin0", - "DELETE", + "UpdateAWSAccount", + "PATCH", "/kubernetes-protection/entities/accounts/aws/v1", - "Delete AWS accounts.", + "Updates the AWS account per the query parameters provided", "kubernetes_protection", [ { @@ -1242,10 +1249,17 @@ "type": "string" }, "collectionFormat": "csv", - "description": "AWS Account IDs", + "description": "AWS Account ID", "name": "ids", "in": "query", "required": True + }, + { + "type": "string", + "pattern": "^[a-z\\d-]+$", + "description": "Default Region for Account Automation", + "name": "region", + "in": "query" } ] ], @@ -1277,38 +1291,38 @@ "in": "query" }, { - "pattern": "^(provisioned|operational)$", + "type": "string", "enum": [ "operational", "provisioned" ], - "type": "string", + "pattern": "^(provisioned|operational)$", "description": "Filter by account status", "name": "status", "in": "query" }, { - "pattern": "^(true|false)$", + "type": "string", "enum": [ "false", "true" ], - "type": "string", + "pattern": "^(true|false)$", "description": "Filter by whether an account originates from Horizon or not", "name": "is_horizon_acct", "in": "query" }, { + "type": "integer", "maximum": 1000, "minimum": 0, - "type": "integer", "description": "Limit returned accounts", "name": "limit", "in": "query" }, { - "minimum": 0, "type": "integer", + "minimum": 0, "description": "Offset returned accounts", "name": "offset", "in": "query" @@ -1356,16 +1370,16 @@ "kubernetes_protection", [ { - "enum": [ - "aws", - "azure", - "gcp" - ], "type": "array", "items": { "type": "string" }, "collectionFormat": "csv", + "enum": [ + "aws", + "azure", + "gcp" + ], "description": "Cloud Provider", "name": "clouds", "in": "query" @@ -1400,45 +1414,45 @@ "in": "query" }, { - "enum": [ - "aks", - "eks" - ], "type": "array", "items": { "type": "string" }, "collectionFormat": "csv", + "enum": [ + "aks", + "eks" + ], "description": "Cluster Service", "name": "cluster_service", "in": "query" }, { - "enum": [ - "Not Installed", - "Running", - "Stopped" - ], "type": "array", "items": { "type": "string" }, "collectionFormat": "csv", + "enum": [ + "Not Installed", + "Running", + "Stopped" + ], "description": "Cluster Status", "name": "cluster_status", "in": "query" }, { + "type": "integer", "maximum": 1000, "minimum": 0, - "type": "integer", "description": "Limit returned accounts", "name": "limit", "in": "query" }, { - "minimum": 0, "type": "integer", + "minimum": 0, "description": "Offset returned accounts", "name": "offset", "in": "query" @@ -1463,16 +1477,16 @@ "in": "query" }, { + "type": "integer", "maximum": 1000, "minimum": 0, - "type": "integer", "description": "Limit returned accounts", "name": "limit", "in": "query" }, { - "minimum": 0, "type": "integer", + "minimum": 0, "description": "Offset returned accounts", "name": "offset", "in": "query" @@ -1535,16 +1549,16 @@ "in": "query" }, { - "enum": [ - "Not Installed", - "Running", - "Stopped" - ], "type": "array", "items": { "type": "string" }, "collectionFormat": "csv", + "enum": [ + "Not Installed", + "Running", + "Stopped" + ], "description": "Cluster Status", "name": "status", "in": "query" @@ -1570,26 +1584,26 @@ "in": "query" }, { + "type": "string", "enum": [ "aks", "eks" ], - "type": "string", "description": "Cluster Service", "name": "cluster_service", "in": "query" }, { + "type": "integer", "maximum": 1000, "minimum": 0, - "type": "integer", "description": "Limit returned accounts", "name": "limit", "in": "query" }, { - "minimum": 0, "type": "integer", + "minimum": 0, "description": "Offset returned accounts", "name": "offset", "in": "query" @@ -1604,14 +1618,14 @@ "kubernetes_protection", [ { - "pattern": "^(dry-run|full|cluster-refresh)$", + "type": "string", + "default": "dry-run", "enum": [ "cluster-refresh", "dry-run", "full" ], - "type": "string", - "default": "dry-run", + "pattern": "^(dry-run|full|cluster-refresh)$", "description": "Scan Type to do", "name": "scan_type", "in": "query", @@ -1627,20 +1641,20 @@ "kubernetes_protection", [ { + "type": "string", "maxLength": 36, "minLength": 36, "pattern": "^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-4[0-9A-Fa-f]{3}-[89ABab][0-9A-Fa-f]{3}-[0-9A-Fa-f]{12}$", - "type": "string", "description": "Azure Tenant ID", "name": "id", "in": "query", "required": True }, { + "type": "string", "maxLength": 36, "minLength": 36, "pattern": "^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-4[0-9A-Fa-f]{3}-[89ABab][0-9A-Fa-f]{3}-[0-9A-Fa-f]{12}$", - "type": "string", "description": "Azure Client ID", "name": "client_id", "in": "query", @@ -1666,27 +1680,27 @@ "in": "query" }, { + "type": "string", "enum": [ "Not Installed", "Running", "Stopped" ], - "type": "string", "description": "Cluster Status", "name": "status", "in": "query" }, { + "type": "integer", "maximum": 1000, "minimum": 0, - "type": "integer", "description": "Limit returned accounts", "name": "limit", "in": "query" }, { - "minimum": 0, "type": "integer", + "minimum": 0, "description": "Offset returned accounts", "name": "offset", "in": "query" @@ -1701,10 +1715,10 @@ "kubernetes_protection", [ { + "type": "string", "maxLength": 36, "minLength": 36, "pattern": "^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-4[0-9A-Fa-f]{3}-[89ABab][0-9A-Fa-f]{3}-[0-9A-Fa-f]{12}$", - "type": "string", "description": "Azure Tenant ID", "name": "id", "in": "query" diff --git a/src/falconpy/_endpoint/_ml_exclusions.py b/src/falconpy/_endpoint/_ml_exclusions.py index fb6b857ff..ba13e9cf1 100644 --- a/src/falconpy/_endpoint/_ml_exclusions.py +++ b/src/falconpy/_endpoint/_ml_exclusions.py @@ -67,12 +67,12 @@ "ml_exclusions", [ { + "type": "string", "enum": [ "add_item", "remove_item", "validate_filepath" ], - "type": "string", "description": "The action to perform.", "name": "action_name", "in": "query", @@ -133,20 +133,6 @@ } ] ], - [ - "exclusions_update_v2", - "PATCH", - "/exclusions/entities/exclusions/v2", - "Update the exclusions by id, with ancestor fields.", - "ml_exclusions", - [ - { - "name": "body", - "in": "body", - "required": True - } - ] - ], [ "exclusions_delete_v2", "DELETE", @@ -173,6 +159,20 @@ } ] ], + [ + "exclusions_update_v2", + "PATCH", + "/exclusions/entities/exclusions/v2", + "Update the exclusions by id, with ancestor fields.", + "ml_exclusions", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], [ "exclusions_search_v2", "GET", @@ -199,6 +199,7 @@ "in": "query" }, { + "type": "string", "enum": [ "parent_value", "value", @@ -210,13 +211,27 @@ "modified_by", "is_descendant_process" ], - "type": "string", "description": "The sort expression that should be used to sort the results.", "name": "sort", "in": "query" } ] ], + [ + "exclusions_sdmf_query_v1", + "POST", + "/exclusions/sdmf/query/v1", + "Executes an SDMF data frame query against exclusion entities", + "ml_exclusions", + [ + { + "description": "SDMF DataFrame query", + "name": "body", + "in": "body", + "required": True + } + ] + ], [ "getMLExclusionsV1", "GET", @@ -251,20 +266,6 @@ } ] ], - [ - "updateMLExclusionsV1", - "PATCH", - "/policy/entities/ml-exclusions/v1", - "Update the ML exclusions", - "ml_exclusions", - [ - { - "name": "body", - "in": "body", - "required": True - } - ] - ], [ "deleteMLExclusionsV1", "DELETE", @@ -291,6 +292,20 @@ } ] ], + [ + "updateMLExclusionsV1", + "PATCH", + "/policy/entities/ml-exclusions/v1", + "Update the ML exclusions", + "ml_exclusions", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], [ "queryMLExclusionsV1", "GET", @@ -317,6 +332,7 @@ "in": "query" }, { + "type": "string", "enum": [ "applied_globally.asc", "applied_globally.desc", @@ -331,7 +347,6 @@ "value.asc", "value.desc" ], - "type": "string", "description": "The sort expression that should be used to sort the results.", "name": "sort", "in": "query" diff --git a/src/falconpy/_endpoint/_models.py b/src/falconpy/_endpoint/_models.py new file mode 100644 index 000000000..133f55109 --- /dev/null +++ b/src/falconpy/_endpoint/_models.py @@ -0,0 +1,90 @@ +"""Internal API endpoint constant library. + + _______ __ _______ __ __ __ +| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----. +|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__| +|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____| +|: 1 | |: 1 | +|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy +`-------' `-------' + +OAuth2 API - Customer SDK + +This is free and unencumbered software released into the public domain. + +Anyone is free to copy, modify, publish, use, compile, sell, or +distribute this software, either in source code form or as a compiled +binary, for any purpose, commercial or non-commercial, and by any +means. + +In jurisdictions that recognize copyright laws, the author or authors +of this software dedicate any and all copyright interest in the +software to the public domain. We make this dedication for the benefit +of the public at large and to the detriment of our heirs and +successors. We intend this dedication to be an overt act of +relinquishment in perpetuity of all present and future rights to this +software under copyright law. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR +OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, +ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR +OTHER DEALINGS IN THE SOFTWARE. + +For more information, please refer to +""" + +_models_endpoints = [ + [ + "EntitiesModelsV1", + "GET", + "/agentic-studio/entities/models/v1", + "Get Model Entities by IDs", + "models", + [ + { + "type": "array", + "items": { + "type": "string" + }, + "collectionFormat": "multi", + "description": "IDs of models to retrieve.", + "name": "ids", + "in": "query", + "required": True + } + ] + ], + [ + "QueriesModelsV1", + "GET", + "/agentic-studio/queries/models/v1", + "Query models based on the provided filters. TBD what the available filters are.", + "models", + [ + { + "type": "integer", + "description": "Starting index of overall result set from which to return ids.", + "name": "offset", + "in": "query" + }, + { + "type": "integer", + "default": 30, + "maximum": 500, + "minimum": 1, + "description": "Number of IDs to return. Offset + limit should NOT be above 10K.", + "name": "limit", + "in": "query" + }, + { + "type": "string", + "description": "FQL query specifying the filter parameters.", + "name": "filter", + "in": "query" + } + ] + ] +] diff --git a/src/falconpy/_endpoint/_ngsiem.py b/src/falconpy/_endpoint/_ngsiem.py index 8d4be2ba8..5fd183bad 100644 --- a/src/falconpy/_endpoint/_ngsiem.py +++ b/src/falconpy/_endpoint/_ngsiem.py @@ -219,6 +219,48 @@ } ] ], + [ + "bulkAddDashboardLabels", + "POST", + "/ngsiem-content/entities/bulk-dashboard-labels-add/v1", + "Add labels to multiple dashboards (max 100 items, non-transactional)", + "ngsiem", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], + [ + "bulkRemoveDashboardLabels", + "POST", + "/ngsiem-content/entities/bulk-dashboard-labels-remove/v1", + "Remove labels from multiple dashboards (max 100 items, non-transactional)", + "ngsiem", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], + [ + "bulkUpdateDashboardLabels", + "POST", + "/ngsiem-content/entities/bulk-dashboard-labels-replace/v1", + "Replace all labels on multiple dashboards (max 100 items, non-transactional)", + "ngsiem", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], [ "BulkCreateDashboardsFromTemplate", "POST", @@ -249,6 +291,48 @@ } ] ], + [ + "bulkAddLookupFileLabels", + "POST", + "/ngsiem-content/entities/bulk-lookupfile-labels-add/v1", + "Add labels to multiple lookup files (max 100 items, non-transactional)", + "ngsiem", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], + [ + "bulkRemoveLookupFileLabels", + "POST", + "/ngsiem-content/entities/bulk-lookupfile-labels-remove/v1", + "Remove labels from multiple lookup files (max 100 items, non-transactional)", + "ngsiem", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], + [ + "bulkUpdateLookupFileLabels", + "POST", + "/ngsiem-content/entities/bulk-lookupfile-labels-replace/v1", + "Replace all labels on multiple lookup files (max 100 items, non-transactional)", + "ngsiem", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], [ "BulkGetLookupFiles", "GET", @@ -344,6 +428,90 @@ } ] ], + [ + "bulkAddSavedQueryLabels", + "POST", + "/ngsiem-content/entities/bulk-savedquery-labels-add/v1", + "Add labels to multiple saved queries (max 100 items, non-transactional)", + "ngsiem", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], + [ + "bulkRemoveSavedQueryLabels", + "POST", + "/ngsiem-content/entities/bulk-savedquery-labels-remove/v1", + "Remove labels from multiple saved queries (max 100 items, non-transactional)", + "ngsiem", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], + [ + "bulkUpdateSavedQueryLabels", + "POST", + "/ngsiem-content/entities/bulk-savedquery-labels-replace/v1", + "Replace all labels on multiple saved queries (max 100 items, non-transactional)", + "ngsiem", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], + [ + "updateDashboardLabels", + "PUT", + "/ngsiem-content/entities/dashboard-labels/v1", + "Replace all labels on a single dashboard", + "ngsiem", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], + [ + "addDashboardLabels", + "POST", + "/ngsiem-content/entities/dashboard-labels/v1", + "Add multiple labels to a single dashboard", + "ngsiem", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], + [ + "removeDashboardLabels", + "DELETE", + "/ngsiem-content/entities/dashboard-labels/v1", + "Remove multiple labels from a single dashboard", + "ngsiem", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], [ "GetDashboardTemplate", "GET", @@ -469,6 +637,48 @@ } ] ], + [ + "updateFileLabels", + "PUT", + "/ngsiem-content/entities/lookupfile-labels/v1", + "Replace all labels on a single file", + "ngsiem", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], + [ + "addFileLabels", + "POST", + "/ngsiem-content/entities/lookupfile-labels/v1", + "Add multiple labels to a single file", + "ngsiem", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], + [ + "removeFileLabels", + "DELETE", + "/ngsiem-content/entities/lookupfile-labels/v1", + "Remove multiple labels from a single file", + "ngsiem", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], [ "UpdateLookupFileEntries", "PATCH", @@ -1050,6 +1260,48 @@ } ] ], + [ + "updateSavedQueryLabels", + "PUT", + "/ngsiem-content/entities/savedquery-labels/v1", + "Replace all labels on a single saved query", + "ngsiem", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], + [ + "addSavedQueryLabels", + "POST", + "/ngsiem-content/entities/savedquery-labels/v1", + "Add multiple labels to a saved query", + "ngsiem", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], + [ + "removeSavedQueryLabels", + "DELETE", + "/ngsiem-content/entities/savedquery-labels/v1", + "Remove multiple labels from a saved query", + "ngsiem", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], [ "ListDashboards", "GET", diff --git a/src/falconpy/_endpoint/_quick_scan_pro.py b/src/falconpy/_endpoint/_quick_scan_pro.py index 372737f59..5fbc83d6a 100644 --- a/src/falconpy/_endpoint/_quick_scan_pro.py +++ b/src/falconpy/_endpoint/_quick_scan_pro.py @@ -198,12 +198,13 @@ "erdict_reasons,mitre_attacks.attack_id,mitre_attacks.attack_id_wiki,mitre_attacks.tactic,mitre_attacks.techniq " "ue,mitre_attacks.capec_id,mitre_attacks.parent.attack_id,mitre_attacks.parent.attack_id_wiki,mitre_attacks.par " "ent.technique,static_indicators,malware_config.url,malware_config.domain,malware_config.ip,artifacts_tree.node " - "s.type,artifacts_tree.nodes.value,artifacts_tree.nodes.verdict,artifacts_tree.edges.from,artifacts_tree.edges. " - "to,artifacts_tree.edges.label,yara_rules.rule_name,yara_rules.sha256,yara_rules.tags\nAvailable filter fields " - "that supports wildcard (*): mitre_attacks.description, yara_rules.description\nAvailable filter fields that " - "supports range comparisons (>, <, >=, <=): created_timestamp, updated_timestamp, file_size, " - "yara_rules.created_at, yara_rules.updated_at\nAll filter fields and operations supports negation (!).\n_all " - "field is used to search between all fields.", + "s.type,artifacts_tree.nodes.value,artifacts_tree.nodes.verdict,artifacts_tree.nodes.verdict_reasons,artifacts_" + "tree.nodes.malware_family,artifacts_tree.nodes.adversary,artifacts_tree.nodes.properties.name,artifacts_tree.n " + "odes.properties.repository,artifacts_tree.nodes.properties.version,yara_rules.rule_name,yara_rules.sha256,yara " + "_rules.tags\nAvailable filter fields that supports wildcard (*): mitre_attacks.description, " + "yara_rules.description\nAvailable filter fields that supports range comparisons (>, <, >=, <=): " + "created_timestamp, updated_timestamp, file_size, yara_rules.created_at, yara_rules.updated_at\nAll filter " + "fields and operations supports negation (!).\n_all field is used to search between all fields.", "name": "filter", "in": "query", "required": True diff --git a/src/falconpy/_endpoint/_recon.py b/src/falconpy/_endpoint/_recon.py index db4c07333..8e69a7551 100644 --- a/src/falconpy/_endpoint/_recon.py +++ b/src/falconpy/_endpoint/_recon.py @@ -167,7 +167,7 @@ "/recon/entities/exports/v1", "Get the status of export jobs based on their IDs. Export jobs can be launched by calling " "CreateExportJobsV1 When a job is complete, use the job ID to download the file(s) associated with it using GET " - "entitiesGetFileContentForExportJobsV1.", + "entities/export-files/v1.", "recon", [ { diff --git a/src/falconpy/_endpoint/_scanning_orchestrator.py b/src/falconpy/_endpoint/_scanning_orchestrator.py new file mode 100644 index 000000000..98121ad78 --- /dev/null +++ b/src/falconpy/_endpoint/_scanning_orchestrator.py @@ -0,0 +1,281 @@ +"""Internal API endpoint constant library. + + _______ __ _______ __ __ __ +| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----. +|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__| +|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____| +|: 1 | |: 1 | +|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy +`-------' `-------' + +OAuth2 API - Customer SDK + +This is free and unencumbered software released into the public domain. + +Anyone is free to copy, modify, publish, use, compile, sell, or +distribute this software, either in source code form or as a compiled +binary, for any purpose, commercial or non-commercial, and by any +means. + +In jurisdictions that recognize copyright laws, the author or authors +of this software dedicate any and all copyright interest in the +software to the public domain. We make this dedication for the benefit +of the public at large and to the detriment of our heirs and +successors. We intend this dedication to be an overt act of +relinquishment in perpetuity of all present and future rights to this +software under copyright law. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR +OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, +ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR +OTHER DEALINGS IN THE SOFTWARE. + +For more information, please refer to +""" + +_scanning_orchestrator_endpoints = [ + [ + "get_combined_schedules", + "GET", + "/agentless-scanning/combined/schedules/v1", + "Get combined scanning schedules", + "scanning_orchestrator", + [ + { + "type": "string", + "description": "Bearer Token", + "name": "Authorization", + "in": "header", + "required": True + }, + { + "type": "integer", + "default": 100, + "maximum": 100, + "minimum": 1, + "description": "Number of results to return", + "name": "limit", + "in": "query" + }, + { + "type": "integer", + "default": 0, + "minimum": 0, + "description": "Starting offset for pagination", + "name": "offset", + "in": "query" + }, + { + "type": "string", + "description": "Sort field and direction. Available fields: scan_product, provider_type, enabled, " + "name, created_at. Example: name|asc", + "name": "sort", + "in": "query" + }, + { + "type": "string", + "description": "FQL filter expression. Available fields: scan_product, provider_type, enabled, name, " + "created_at. Example: enabled:true", + "name": "filter", + "in": "query" + } + ] + ], + [ + "trigger_scan_by_schedule", + "POST", + "/agentless-scanning/entities/scan-by-schedule/v1", + "Trigger scan by schedule IDs", + "scanning_orchestrator", + [ + { + "type": "string", + "description": "Bearer Token", + "name": "Authorization", + "in": "header", + "required": True + }, + { + "description": "Schedule IDs to trigger", + "name": "body", + "in": "body", + "required": True + } + ] + ], + [ + "get_schedules", + "GET", + "/agentless-scanning/entities/schedules/v1", + "Get scanning schedules", + "scanning_orchestrator", + [ + { + "type": "string", + "description": "Bearer Token", + "name": "Authorization", + "in": "header", + "required": True + }, + { + "type": "array", + "items": { + "type": "string" + }, + "collectionFormat": "multi", + "description": "Schedule IDs to retrieve", + "name": "ids", + "in": "query", + "required": True + } + ] + ], + [ + "create_schedules", + "POST", + "/agentless-scanning/entities/schedules/v1", + "Create scanning schedules", + "scanning_orchestrator", + [ + { + "type": "string", + "description": "Bearer Token", + "name": "Authorization", + "in": "header", + "required": True + }, + { + "description": "Schedule resources to create", + "name": "body", + "in": "body", + "required": True + } + ] + ], + [ + "delete_schedules", + "DELETE", + "/agentless-scanning/entities/schedules/v1", + "Delete scanning schedules", + "scanning_orchestrator", + [ + { + "type": "string", + "description": "Bearer Token", + "name": "Authorization", + "in": "header", + "required": True + }, + { + "type": "array", + "items": { + "type": "string" + }, + "collectionFormat": "multi", + "description": "Schedule IDs to delete", + "name": "ids", + "in": "query", + "required": True + } + ] + ], + [ + "update_schedules", + "PATCH", + "/agentless-scanning/entities/schedules/v1", + "Update scanning schedules", + "scanning_orchestrator", + [ + { + "type": "string", + "description": "Bearer Token", + "name": "Authorization", + "in": "header", + "required": True + }, + { + "description": "Schedule resources to update (ID required in each resource)", + "name": "body", + "in": "body", + "required": True + } + ] + ], + [ + "get_service_types", + "GET", + "/agentless-scanning/entities/supported-service-types/v1", + "Get allowed service types", + "scanning_orchestrator", + [ + { + "type": "string", + "description": "Bearer Token", + "name": "Authorization", + "in": "header", + "required": True + }, + { + "type": "string", + "enum": [ + "dspm_scanning", + "vulnerability_scanning" + ], + "description": "Scan product filter", + "name": "scan_product", + "in": "query", + "required": True + } + ] + ], + [ + "search_schedules", + "GET", + "/agentless-scanning/queries/schedules/v1", + "Search scanning schedules", + "scanning_orchestrator", + [ + { + "type": "string", + "description": "Bearer Token", + "name": "Authorization", + "in": "header", + "required": True + }, + { + "type": "integer", + "default": 100, + "maximum": 100, + "minimum": 1, + "description": "Number of results to return", + "name": "limit", + "in": "query" + }, + { + "type": "integer", + "default": 0, + "minimum": 0, + "description": "Starting offset for pagination", + "name": "offset", + "in": "query" + }, + { + "type": "string", + "description": "Sort field and direction. Available fields: scan_product, provider_type, enabled, " + "name, created_at. Example: name|asc", + "name": "sort", + "in": "query" + }, + { + "type": "string", + "description": "FQL filter expression. Available fields: scan_product, provider_type, enabled, name, " + "created_at. Example: enabled:true", + "name": "filter", + "in": "query" + } + ] + ] +] diff --git a/src/falconpy/_endpoint/_spans.py b/src/falconpy/_endpoint/_spans.py new file mode 100644 index 000000000..f02de1924 --- /dev/null +++ b/src/falconpy/_endpoint/_spans.py @@ -0,0 +1,96 @@ +"""Internal API endpoint constant library. + + _______ __ _______ __ __ __ +| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----. +|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__| +|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____| +|: 1 | |: 1 | +|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy +`-------' `-------' + +OAuth2 API - Customer SDK + +This is free and unencumbered software released into the public domain. + +Anyone is free to copy, modify, publish, use, compile, sell, or +distribute this software, either in source code form or as a compiled +binary, for any purpose, commercial or non-commercial, and by any +means. + +In jurisdictions that recognize copyright laws, the author or authors +of this software dedicate any and all copyright interest in the +software to the public domain. We make this dedication for the benefit +of the public at large and to the detriment of our heirs and +successors. We intend this dedication to be an overt act of +relinquishment in perpetuity of all present and future rights to this +software under copyright law. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR +OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, +ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR +OTHER DEALINGS IN THE SOFTWARE. + +For more information, please refer to +""" + +_spans_endpoints = [ + [ + "EntitiesSpansV1", + "GET", + "/agentic-studio/entities/spans/v1", + "Retrieve spans for the provided ids.", + "spans", + [ + { + "type": "array", + "items": { + "type": "string" + }, + "collectionFormat": "multi", + "description": "IDs of entities to retrieve. Maximum of 1000 ids per request.", + "name": "ids", + "in": "query", + "required": True + } + ] + ], + [ + "QueriesSpansV1", + "GET", + "/agentic-studio/queries/spans/v1", + "Query spans based on the provided filters.", + "spans", + [ + { + "type": "integer", + "description": "Starting index of overall result set from which to return ids.", + "name": "offset", + "in": "query" + }, + { + "type": "integer", + "default": 10, + "maximum": 500, + "minimum": 1, + "description": "Number of IDs to return.", + "name": "limit", + "in": "query" + }, + { + "type": "string", + "description": "Possible order by fields. E.g.: 'start_time|desc'.", + "name": "sort", + "in": "query" + }, + { + "type": "string", + "description": "FQL query specifying the filter parameters.", + "name": "filter", + "in": "query" + } + ] + ] +] diff --git a/src/falconpy/_endpoint/_stream.py b/src/falconpy/_endpoint/_stream.py new file mode 100644 index 000000000..9e4e4d3f8 --- /dev/null +++ b/src/falconpy/_endpoint/_stream.py @@ -0,0 +1,56 @@ +"""Internal API endpoint constant library. + + _______ __ _______ __ __ __ +| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----. +|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__| +|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____| +|: 1 | |: 1 | +|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy +`-------' `-------' + +OAuth2 API - Customer SDK + +This is free and unencumbered software released into the public domain. + +Anyone is free to copy, modify, publish, use, compile, sell, or +distribute this software, either in source code form or as a compiled +binary, for any purpose, commercial or non-commercial, and by any +means. + +In jurisdictions that recognize copyright laws, the author or authors +of this software dedicate any and all copyright interest in the +software to the public domain. We make this dedication for the benefit +of the public at large and to the detriment of our heirs and +successors. We intend this dedication to be an overt act of +relinquishment in perpetuity of all present and future rights to this +software under copyright law. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR +OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, +ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR +OTHER DEALINGS IN THE SOFTWARE. + +For more information, please refer to +""" + +_stream_endpoints = [ + [ + "StreamInvocationResponseV1", + "GET", + "/agentic-studio-streaming/entities/agent-invocations/v1", + "Retrieves the stream of results for an invocation", + "stream", + [ + { + "type": "string", + "description": "Invocation ID", + "name": "id", + "in": "query", + "required": True + } + ] + ] +] diff --git a/src/falconpy/_endpoint/_tailored_intelligence.py b/src/falconpy/_endpoint/_tailored_intelligence.py index d0da5de12..d61ce4993 100644 --- a/src/falconpy/_endpoint/_tailored_intelligence.py +++ b/src/falconpy/_endpoint/_tailored_intelligence.py @@ -44,6 +44,12 @@ "Get event body for the provided event ID", "tailored_intelligence", [ + { + "type": "string", + "description": "Bearer Token", + "name": "Authorization", + "in": "header" + }, { "type": "string", "description": "Return the event body for event id.", @@ -64,6 +70,12 @@ "name": "body", "in": "body", "required": True + }, + { + "type": "string", + "description": "Bearer Token", + "name": "Authorization", + "in": "header" } ] ], @@ -74,6 +86,12 @@ "Get events ids that match the provided filter criteria.", "tailored_intelligence", [ + { + "type": "string", + "description": "Bearer Token", + "name": "Authorization", + "in": "header" + }, { "type": "string", "description": "Starting index of overall result set from which to return ids.", @@ -113,6 +131,12 @@ "Get rules entities for specified ids.", "tailored_intelligence", [ + { + "type": "string", + "description": "Bearer Token", + "name": "Authorization", + "in": "header" + }, { "name": "body", "in": "body", @@ -127,6 +151,12 @@ "Get rules ids that match the provided filter criteria.", "tailored_intelligence", [ + { + "type": "string", + "description": "Bearer Token", + "name": "Authorization", + "in": "header" + }, { "type": "string", "description": "Starting index of overall result set from which to return ids.", diff --git a/src/falconpy/_endpoint/_tools.py b/src/falconpy/_endpoint/_tools.py new file mode 100644 index 000000000..48493af1b --- /dev/null +++ b/src/falconpy/_endpoint/_tools.py @@ -0,0 +1,96 @@ +"""Internal API endpoint constant library. + + _______ __ _______ __ __ __ +| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----. +|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__| +|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____| +|: 1 | |: 1 | +|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy +`-------' `-------' + +OAuth2 API - Customer SDK + +This is free and unencumbered software released into the public domain. + +Anyone is free to copy, modify, publish, use, compile, sell, or +distribute this software, either in source code form or as a compiled +binary, for any purpose, commercial or non-commercial, and by any +means. + +In jurisdictions that recognize copyright laws, the author or authors +of this software dedicate any and all copyright interest in the +software to the public domain. We make this dedication for the benefit +of the public at large and to the detriment of our heirs and +successors. We intend this dedication to be an overt act of +relinquishment in perpetuity of all present and future rights to this +software under copyright law. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR +OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, +ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR +OTHER DEALINGS IN THE SOFTWARE. + +For more information, please refer to +""" + +_tools_endpoints = [ + [ + "EntitiesToolsV1", + "GET", + "/agentic-studio/entities/tools/v1", + "Retrieve tools entities for the provided id.", + "tools", + [ + { + "type": "array", + "items": { + "type": "string" + }, + "collectionFormat": "multi", + "description": "IDs of entities to retrieve.", + "name": "ids", + "in": "query", + "required": True + } + ] + ], + [ + "QueriesToolsV1", + "GET", + "/agentic-studio/queries/tools/v1", + "Query tools based on the provided filters. Supports filtering by type, category, and other attributes.", + "tools", + [ + { + "type": "integer", + "description": "Starting index of overall result set from which to return ids.", + "name": "offset", + "in": "query" + }, + { + "type": "integer", + "default": 10, + "maximum": 500, + "minimum": 1, + "description": "Number of IDs to return. Offset + limit should NOT be above 10K.", + "name": "limit", + "in": "query" + }, + { + "type": "string", + "description": "Possible order by fields: id, name, description, category. Ex: 'name|desc'.", + "name": "sort", + "in": "query" + }, + { + "type": "string", + "description": "FQL query specifying the filter parameters.", + "name": "filter", + "in": "query" + } + ] + ] +] diff --git a/src/falconpy/_endpoint/_user_management.py b/src/falconpy/_endpoint/_user_management.py index fd9471802..ea9d0a6d9 100644 --- a/src/falconpy/_endpoint/_user_management.py +++ b/src/falconpy/_endpoint/_user_management.py @@ -412,8 +412,8 @@ { "type": "string", "description": "Filter using a query in Falcon Query Language (FQL). Supported filters: assigned_cids, " - " cid, direct_assigned_cids, factors, first_name, has_temporary_roles, last_name, name, status, " - "temporarily_assigned_cids, uid, uuid", + " cid, direct_assigned_cids, factors, first_name, has_temporary_roles, last_name, name, " + "non_ancestor_assigned_cids, status, temporarily_assigned_cids, uid, uuid", "name": "filter", "in": "query" }, diff --git a/src/falconpy/_endpoint/_workflows.py b/src/falconpy/_endpoint/_workflows.py index d717ac9c8..7c526c909 100644 --- a/src/falconpy/_endpoint/_workflows.py +++ b/src/falconpy/_endpoint/_workflows.py @@ -260,6 +260,20 @@ "description": "whether or not to sanitize PII from workflow before it's exported", "name": "sanitize", "in": "query" + }, + { + "type": "boolean", + "default": False, + "description": "when enabled, includes referenced node-mocks inline in the exported YAML. Each mock's " + "output_data field is a JSON-encoded string rather than native YAML.", + "name": "include_mocks", + "in": "query" + }, + { + "type": "integer", + "description": "version of the definition to export (e.g. 0 for draft); omit for active/published", + "name": "version", + "in": "query" } ] ], @@ -342,73 +356,6 @@ } ] ], - [ - "WorkflowExecuteInternal", - "POST", - "/workflows/entities/execute/internal/v1", - "Executes an on-demand Workflow - internal workflows permitted, the body is JSON used to trigger the " - "execution, the response the execution ID(s)", - "workflows", - [ - { - "type": "array", - "items": { - "type": "string" - }, - "collectionFormat": "csv", - "description": "CID(s) to execute on. This can be a child if this is a flight control enabled " - "definition. If unset the definition CID is used.", - "name": "execution_cid", - "in": "query" - }, - { - "type": "array", - "items": { - "type": "string" - }, - "collectionFormat": "csv", - "description": "Definition ID to execute, either a name or an ID can be specified.", - "name": "definition_id", - "in": "query" - }, - { - "type": "string", - "description": "Workflow name to execute, either a name or an ID can be specified.", - "name": "name", - "in": "query" - }, - { - "type": "string", - "description": "Key used to help deduplicate executions, if unset a new UUID is used", - "name": "key", - "in": "query" - }, - { - "type": "integer", - "description": "Used to record the execution depth to help limit execution loops when a workflow " - "triggers another. The maximum depth is 4.", - "name": "depth", - "in": "query" - }, - { - "type": "integer", - "description": "Used to set the batchSize, if unset the default batchSize is used", - "name": "batch_size", - "in": "query" - }, - { - "type": "string", - "description": "Used to record a URL to the source that led to triggering this workflow", - "name": "source_event_url", - "in": "query" - }, - { - "name": "body", - "in": "body", - "required": True - } - ] - ], [ "WorkflowExecute", "POST", @@ -788,5 +735,78 @@ "required": True } ] + ], + [ + "WorkflowExecuteInternal", + "POST", + "/workflows/entities/execute/internal/v1", + "DECOMMISSIONED: Executes an on-demand Workflow - internal workflows permitted, the body is JSON used to " + + "trigger the execution, the response the execution ID(s)", + + "workflows", + [ + { + "type": "array", + "items": { + "type": "string" + }, + "collectionFormat": "csv", + "description": "CID(s) to execute on. This can be a child if this is a flight control enabled " + + "definition. If unset the definition CID is used.", + + "name": "execution_cid", + "in": "query" + }, + { + "type": "array", + "items": { + "type": "string" + }, + "collectionFormat": "csv", + "description": "Definition ID to execute, either a name or an ID can be specified.", + "name": "definition_id", + "in": "query" + }, + { + "type": "string", + "description": "Workflow name to execute, either a name or an ID can be specified.", + "name": "name", + "in": "query" + }, + { + "type": "string", + "description": "Key used to help deduplicate executions, if unset a new UUID is used", + "name": "key", + "in": "query" + }, + { + "type": "integer", + "description": "Used to record the execution depth to help limit execution loops when a workflow " + + "triggers another. The maximum depth is 4.", + + "name": "depth", + "in": "query" + }, + { + "type": "integer", + "description": "Used to set the batchSize, if unset the default batchSize is used", + "name": "batch_size", + "in": "query" + }, + { + "type": "string", + "description": "Used to record a URL to the source that led to triggering this workflow", + "name": "source_event_url", + "in": "query" + }, + { + "name": "body", + "in": "body", + "required": True + } + ] ] ] diff --git a/src/falconpy/_endpoint/deprecated/__init__.py b/src/falconpy/_endpoint/deprecated/__init__.py index 184f74522..fda1b2c2d 100644 --- a/src/falconpy/_endpoint/deprecated/__init__.py +++ b/src/falconpy/_endpoint/deprecated/__init__.py @@ -80,6 +80,9 @@ from ._falcon_complete_dashboard import _falcon_complete_dashboard_endpoints from ._foundry_logscale import _foundry_logscale_endpoints from ._spotlight_vulnerabilities import _spotlight_vulnerabilities_endpoints +from ._incidents import _incidents_endpoints +from ._knowledge_base_audit_events import _knowledge_base_audit_events_endpoints +from ._knowledge_bases import _knowledge_bases_endpoints _admission_control_policies_deprecated = _admission_control_policies_endpoints _alerts_deprecated = _alerts_endpoints @@ -129,5 +132,8 @@ _falcon_complete_dashboard_deprecated = _falcon_complete_dashboard_endpoints _foundry_logscale_deprecated = _foundry_logscale_endpoints _spotlight_vulnerabilities_deprecated = _spotlight_vulnerabilities_endpoints +_incidents_deprecated = _incidents_endpoints +_knowledge_base_audit_events_deprecated = _knowledge_base_audit_events_endpoints +_knowledge_bases_deprecated = _knowledge_bases_endpoints _deprecated_operation_mapping = _deprecated_op_mapping _deprecated_class_mapping = _deprecated_cls_mapping diff --git a/src/falconpy/_endpoint/deprecated/_incidents.py b/src/falconpy/_endpoint/deprecated/_incidents.py new file mode 100644 index 000000000..764ccbb0e --- /dev/null +++ b/src/falconpy/_endpoint/deprecated/_incidents.py @@ -0,0 +1,250 @@ +"""Internal API endpoint constant library (deprecated operations).""" + +_incidents_endpoints = [ + [ + "CrowdScore", + "GET", + "/incidents/combined/crowdscores/v1", + "DEPRECATED: the incidentapi will be removed in March 2026. Query environment wide CrowdScore and return the entity data", + "incidents", + [ + { + "type": "string", + "description": "Optional filter and sort criteria in the form of an FQL query. For more information " + + "about FQL queries, see [our FQL documentation in " + + "Falcon](https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-feature-guide).", + + "name": "filter", + "in": "query" + }, + { + "type": "integer", + "description": "Starting index of overall result set from which to return ids.", + "name": "offset", + "in": "query" + }, + { + "type": "integer", + "description": "The maximum records to return. [1-2500]", + "name": "limit", + "in": "query" + }, + { + "enum": [ + "adjusted_score.asc", + "adjusted_score.desc", + "score.asc", + "score.desc", + "timestamp.asc", + "timestamp.desc" + ], + "type": "string", + "description": "The property to sort on, followed by a dot (.), followed by the sort direction, either " + + "\"asc\" or \"desc\".", + + "name": "sort", + "in": "query" + } + ] + ], + [ + "GetBehaviors", + "POST", + "/incidents/entities/behaviors/GET/v1", + "DEPRECATED: the incidentapi will be removed in March 2026. Get details on behaviors by providing behavior IDs", + "incidents", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], + [ + "GetIncidents", + "POST", + "/incidents/entities/incidents/GET/v1", + "DEPRECATED: the incidentapi will be removed in March 2026. Get details on incidents by providing incident IDs", + "incidents", + [ + { + "name": "body", + "in": "body", + "required": True + } + ] + ], + [ + "PerformIncidentAction", + "POST", + "/incidents/entities/incident-actions/v1", + "DEPRECATED: the incidentapi will be removed in March 2026. Perform a set of actions on one or more " + + "incidents, such as adding tags or comments or updating the incident name or description", + + "incidents", + [ + { + "type": "boolean", + "default": False, + "description": "If true, update assigned-to-uuid and or status of detections associated with the " + + "incident(s). Defaults to false", + + "name": "update_detects", + "in": "query" + }, + { + "type": "boolean", + "default": False, + "description": "If true and update-detects is true, the assigned-to-uuid or status for ALL detections " + + "associated with the incident(s) will be overwritten. If false, only detects that have default values for " + + "assigned-to-uuid and/or status will be updated. Defaults to false. Ignored if 'update-detects' is missing or " + + "false.", + + "name": "overwrite_detects", + "in": "query" + }, + { + "description": "Incident Update request body containing minimum 1 and maximum 5000 Incident ID(s) and " + + "action param(s) to be performed action against.", + + "name": "body", + "in": "body", + "required": True + } + ] + ], + [ + "QueryBehaviors", + "GET", + "/incidents/queries/behaviors/v1", + "DEPRECATED: the incidentapi will be removed in March 2026. Search for behaviors by providing an FQL " + + "filter, sorting, and paging details", + + "incidents", + [ + { + "type": "string", + "description": "Optional filter and sort criteria in the form of an FQL query. For more information " + + "about FQL queries, see [our FQL documentation in " + + "Falcon](https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-feature-guide).", + + "name": "filter", + "in": "query" + }, + { + "type": "integer", + "description": "Starting index of overall result set from which to return ids.", + "name": "offset", + "in": "query" + }, + { + "type": "integer", + "description": "The maximum records to return. [1-500]", + "name": "limit", + "in": "query" + }, + { + "enum": [ + "alert_ids.asc", + "alert_ids.desc", + "cmdline.asc", + "cmdline.desc", + "detection_ids.asc", + "detection_ids.desc", + "display_name.asc", + "display_name.desc", + "domain.asc", + "domain.desc", + "filepath.asc", + "filepath.desc", + "timestamp.asc", + "timestamp.desc" + ], + "type": "string", + "description": "The property to sort on, followed by a dot (.), followed by the sort direction, either " + + "\"asc\" or \"desc\".", + + "name": "sort", + "in": "query" + } + ] + ], + [ + "QueryIncidents", + "GET", + "/incidents/queries/incidents/v1", + "DEPRECATED: the incidentapi will be removed in March 2026. Search for incidents by providing an FQL " + + "filter, sorting, and paging details", + + "incidents", + [ + { + "enum": [ + "assigned_to.asc", + "assigned_to.desc", + "assigned_to_name.asc", + "assigned_to_name.desc", + "end.asc", + "end.desc", + "modified_timestamp.asc", + "modified_timestamp.desc", + "name.asc", + "name.desc", + "sort_score.asc", + "sort_score.desc", + "start.asc", + "start.desc", + "state.asc", + "state.desc", + "status.asc", + "status.desc" + ], + "type": "string", + "description": "The property to sort on, followed by a dot (.), followed by the sort direction, either " + + "\"asc\" or \"desc\".", + + "name": "sort", + "in": "query" + }, + { + "type": "string", + "description": "Optional filter and sort criteria in the form of an FQL query. For more information " + + "about FQL queries, see [our FQL documentation in " + + "Falcon](https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-feature-guide).", + + "name": "filter", + "in": "query" + }, + { + "type": "integer", + "description": "Starting index of overall result set from which to return ids.", + "name": "offset", + "in": "query" + }, + { + "type": "integer", + "description": "The maximum records to return. [1-500]", + "name": "limit", + "in": "query" + } + ] + ] +] diff --git a/src/falconpy/_endpoint/deprecated/_knowledge_base_audit_events.py b/src/falconpy/_endpoint/deprecated/_knowledge_base_audit_events.py new file mode 100644 index 000000000..8a67bfbc4 --- /dev/null +++ b/src/falconpy/_endpoint/deprecated/_knowledge_base_audit_events.py @@ -0,0 +1,26 @@ +"""Internal API endpoint constant library (deprecated operations).""" + +_knowledge_base_audit_events_endpoints = [ + [ + "AggregatesKnowledgeBaseAuditEventsV1", + "POST", + "/agentic-studio/aggregates/knowledge_base_audit_events/v1", + "Aggregate knowledge base audit events based on the provided msa criteria.", + "knowledge_base_audit_events", + [ + { + "description": "Aggregate requests for knowledge base audit event data.", + "name": "body", + "in": "body", + "required": True + }, + { + "type": "boolean", + "default": False, + "description": "Include audit events for deleted knowledge bases. Defaults to false.", + "name": "include_deleted", + "in": "query" + } + ] + ] +] diff --git a/src/falconpy/_endpoint/deprecated/_knowledge_bases.py b/src/falconpy/_endpoint/deprecated/_knowledge_bases.py new file mode 100644 index 000000000..be440be2b --- /dev/null +++ b/src/falconpy/_endpoint/deprecated/_knowledge_bases.py @@ -0,0 +1,26 @@ +"""Internal API endpoint constant library (deprecated operations).""" + +_knowledge_bases_endpoints = [ + [ + "AggregatesKnowledgeBasesV1", + "POST", + "/agentic-studio/aggregates/knowledge_bases/v1", + "Aggregate knowledge bases based on the provided msa criteria.", + "knowledge_bases", + [ + { + "type": "boolean", + "default": False, + "description": "Include deleted knowledge bases in the result. Defaults to false.", + "name": "include_deleted", + "in": "query" + }, + { + "description": "Aggregate requests for knowledge base data.", + "name": "body", + "in": "body", + "required": True + } + ] + ] +] diff --git a/src/falconpy/_endpoint/deprecated/_mapping.py b/src/falconpy/_endpoint/deprecated/_mapping.py index c9ebc8486..b09055f15 100644 --- a/src/falconpy/_endpoint/deprecated/_mapping.py +++ b/src/falconpy/_endpoint/deprecated/_mapping.py @@ -76,6 +76,12 @@ "CreateFileV1": "", "UpdateFileV1": "", "combinedQueryInstalledPatches": "", + + "AggregatesKnowledgeBaseAuditEventsV1": "", + + "AggregatesKnowledgeBasesV1": "", + + "WorkflowExecuteInternal": "", } _deprecated_cls_mapping = { diff --git a/src/falconpy/_endpoint/deprecated/_workflows.py b/src/falconpy/_endpoint/deprecated/_workflows.py index 8e129d57b..2376ebc7d 100644 --- a/src/falconpy/_endpoint/deprecated/_workflows.py +++ b/src/falconpy/_endpoint/deprecated/_workflows.py @@ -73,5 +73,78 @@ "in": "query" } ] + ], + [ + "WorkflowExecuteInternal", + "POST", + "/workflows/entities/execute/internal/v1", + "Executes an on-demand Workflow - internal workflows permitted, the body is JSON used to trigger the " + + "execution, the response the execution ID(s)", + + "workflows", + [ + { + "type": "array", + "items": { + "type": "string" + }, + "collectionFormat": "csv", + "description": "CID(s) to execute on. This can be a child if this is a flight control enabled " + + "definition. If unset the definition CID is used.", + + "name": "execution_cid", + "in": "query" + }, + { + "type": "array", + "items": { + "type": "string" + }, + "collectionFormat": "csv", + "description": "Definition ID to execute, either a name or an ID can be specified.", + "name": "definition_id", + "in": "query" + }, + { + "type": "string", + "description": "Workflow name to execute, either a name or an ID can be specified.", + "name": "name", + "in": "query" + }, + { + "type": "string", + "description": "Key used to help deduplicate executions, if unset a new UUID is used", + "name": "key", + "in": "query" + }, + { + "type": "integer", + "description": "Used to record the execution depth to help limit execution loops when a workflow " + + "triggers another. The maximum depth is 4.", + + "name": "depth", + "in": "query" + }, + { + "type": "integer", + "description": "Used to set the batchSize, if unset the default batchSize is used", + "name": "batch_size", + "in": "query" + }, + { + "type": "string", + "description": "Used to record a URL to the source that led to triggering this workflow", + "name": "source_event_url", + "in": "query" + }, + { + "name": "body", + "in": "body", + "required": True + } + ] ] ] diff --git a/src/falconpy/_enum/_ingest_base_url.py b/src/falconpy/_enum/_ingest_base_url.py index be73ce71b..31503b683 100644 --- a/src/falconpy/_enum/_ingest_base_url.py +++ b/src/falconpy/_enum/_ingest_base_url.py @@ -46,5 +46,7 @@ class IngestBaseURL(Enum): US1 = "ingest.us-1.crowdstrike.com" US2 = "ingest.us-2.crowdstrike.com" + US3 = "ingest.us-3.crowdstrike.com" EU1 = "ingest.eu-1.crowdstrike.com" USGOV1 = "ingest.laggar.gcw.crowdstrike.com" + USGOV2 = "ingest.us-gov-2.crowdstrike.mil" diff --git a/src/falconpy/_ngsiem/_hec.py b/src/falconpy/_ngsiem/_hec.py index b4d92aa27..1097eabda 100644 --- a/src/falconpy/_ngsiem/_hec.py +++ b/src/falconpy/_ngsiem/_hec.py @@ -88,7 +88,7 @@ def __init__(self, """Construct an instance of the HTTP event collector. Keyword arguments - ---- + ----------------- api_key: (string) [required] NGSIEM API key. api_url_key: (string) [required] diff --git a/src/falconpy/_payload/__init__.py b/src/falconpy/_payload/__init__.py index 5e5b915b6..8ceaa1440 100644 --- a/src/falconpy/_payload/__init__.py +++ b/src/falconpy/_payload/__init__.py @@ -19,8 +19,10 @@ |::.| CrowdStrike Falcon |::.| `---' OAuth2 API SDK for Python 3 `---' """ +from ._agent_invocation import invoke_agent_version_external_v1_payload, invoke_published_agent_external_v1_payload from ._api_clients import create_api_client_payload, update_api_client_payload from ._cloud_security_assets import cloud_security_assets_entities_post_payload +from ._cloud_security_detections import cspm_evaluations_iom_entities_post_payload from ._falcon_id import update_third_party_passkey_registry_payload from ._federated_connections import patch_federated_connections_config_payload, post_federated_connections_config_payload from ._generic import ( @@ -52,18 +54,19 @@ correlation_rules_template_payload ) from ._case_management import ( - case_management_notification_groups_payload, + case_evidence_payload, + case_manage_payload, case_management_create_notification_payload, - case_management_sla_payload, - case_management_template_payload, case_management_file_ids_payload, + case_management_notification_groups_payload, case_management_rtr_file_metadata_payload, case_management_rtr_file_payload, case_management_rtr_recent_file_payload, + case_management_sla_payload, + case_management_template_payload, + entities_merge_post_v1_payload, specified_case_payload, - case_manage_payload, - case_evidence_payload, - update_case_payload + update_case_payload, ) from ._host_group import host_group_create_payload, host_group_update_payload from ._hosts import devices_actions_delete_v1_payload @@ -126,19 +129,24 @@ inventory_scan_payload ) from ._content_update_policy import content_update_policy_action_payload, content_update_policy_payload -from ._correlation_rules_admin import correlation_rules_admin_payload +from ._correlation_rules_admin import ( + correlation_rules_admin_payload, + entities_rules_ownership_put_v2_payload, + ) from ._data_protection_configuration import ( data_protection_classification_payload, data_protection_cloud_app_payload, data_protection_content_pattern_payload, data_protection_enterprise_account_payload, - data_protection_sensitivity_label_payload, + data_protection_local_application_group_payload, + data_protection_local_application_payload, data_protection_policy_payload, - data_protection_web_locations_payload, data_protection_policy_precedence_payload, - data_protection_local_application_payload, - data_protection_local_application_group_payload + data_protection_sensitivity_label_payload, + data_protection_web_locations_payload, + entities_web_location_group_create_payload, + entities_web_location_group_patch_payload, ) from ._delivery_settings import delivery_settings_payload from ._detects import update_detects_payload @@ -184,12 +192,24 @@ network_scan_zone_update_payload ) from ._ngsiem import ( + add_dashboard_labels_payload, + add_file_labels_payload, + add_saved_query_labels_payload, + bulk_add_dashboard_labels_payload, + bulk_add_lookup_file_labels_payload, + bulk_add_saved_query_labels_payload, bulk_create_dashboards_from_template_payload, bulk_create_lookup_files_payload, bulk_create_saved_queries_from_template_payload, + bulk_remove_dashboard_labels_payload, + bulk_remove_lookup_file_labels_payload, + bulk_remove_saved_query_labels_payload, + bulk_update_dashboard_labels_payload, bulk_update_dashboards_from_template_payload, + bulk_update_lookup_file_labels_payload, bulk_update_lookup_files_payload, bulk_update_saved_queries_from_template_payload, + bulk_update_saved_query_labels_payload, create_parser_extension_payload, ngsiem_auto_update_policy_payload, ngsiem_bulk_install_parsers_payload, @@ -199,9 +219,13 @@ ngsiem_install_parser_payload, ngsiem_parser_payload, ngsiem_search_payload, + update_dashboard_labels_payload, + update_file_labels_payload, update_parser_extension_payload, + update_saved_query_labels_payload, ) from ._prevention_policy import prevention_policy_payload +from ._scanning_orchestrator import create_schedules_payload, trigger_scan_by_schedule_payload, update_schedules_payload from ._sensor_update_policy import sensor_policy_payload, maintenance_token_payload from ._response_policy import response_policy_payload from ._real_time_response import command_payload, data_payload @@ -241,10 +265,11 @@ filevantage_start_payload ) from ._ml_exclusions import ( + exclusions_sdmf_query_v1_payload, ml_exclusions_actions_payload, ml_exclusions_report_payload, - ml_exclusions_update_payload -) + ml_exclusions_update_payload, + ) from ._mssp import mssp_payload from ._firewall import ( firewall_policy_payload, @@ -357,5 +382,18 @@ "bulk_update_saved_queries_from_template_payload", "create_parser_extension_payload", "cloud_registration_gcp_post_terraform_script_payload", "update_third_party_passkey_registry_payload", "devices_actions_delete_v1_payload", "indicator_sdmf_query_v1_payload", - "update_parser_extension_payload" + "update_parser_extension_payload", "invoke_agent_version_external_v1_payload", + "invoke_published_agent_external_v1_payload", "entities_merge_post_v1_payload", + "cspm_evaluations_iom_entities_post_payload", "entities_rules_ownership_put_v2_payload", + "entities_web_location_group_create_payload", "entities_web_location_group_patch_payload", + "exclusions_sdmf_query_v1_payload", "add_dashboard_labels_payload", + "add_file_labels_payload", "add_saved_query_labels_payload", + "bulk_add_dashboard_labels_payload", "bulk_add_lookup_file_labels_payload", + "bulk_add_saved_query_labels_payload", "bulk_remove_dashboard_labels_payload", + "bulk_remove_lookup_file_labels_payload", "bulk_remove_saved_query_labels_payload", + "bulk_update_dashboard_labels_payload", "bulk_update_lookup_file_labels_payload", + "bulk_update_saved_query_labels_payload", "update_dashboard_labels_payload", + "update_file_labels_payload", "update_saved_query_labels_payload", + "create_schedules_payload", "trigger_scan_by_schedule_payload", + "update_schedules_payload" ] diff --git a/src/falconpy/_payload/_agent_invocation.py b/src/falconpy/_payload/_agent_invocation.py new file mode 100644 index 000000000..c78ad2b32 --- /dev/null +++ b/src/falconpy/_payload/_agent_invocation.py @@ -0,0 +1,80 @@ +"""Internal payload handling library - AgentInvocation. + + _______ __ _______ __ __ __ +| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----. +|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__| +|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____| +|: 1 | |: 1 | +|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy +`-------' `-------' + +OAuth2 API - Customer SDK + +This is free and unencumbered software released into the public domain. + +Anyone is free to copy, modify, publish, use, compile, sell, or +distribute this software, either in source code form or as a compiled +binary, for any purpose, commercial or non-commercial, and by any +means. + +In jurisdictions that recognize copyright laws, the author or authors +of this software dedicate any and all copyright interest in the +software to the public domain. We make this dedication for the benefit +of the public at large and to the detriment of our heirs and +successors. We intend this dedication to be an overt act of +relinquishment in perpetuity of all present and future rights to this +software under copyright law. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR +OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, +ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR +OTHER DEALINGS IN THE SOFTWARE. + +For more information, please refer to +""" + + +def invoke_published_agent_external_v1_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a InvokePublishedAgentExternalV1 request. + + { + "credit_cents_limit": 0, + "deadline_seconds": 0, + "id": "string", + "messages": [ + "string" + ] + } + """ + returned_payload = {} + keys = ["credit_cents_limit", "deadline_seconds", "id", "messages"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload + + +def invoke_agent_version_external_v1_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a InvokeAgentVersionExternalV1 request. + + { + "credit_cents_limit": 0, + "deadline_seconds": 0, + "id": "string", + "messages": [ + "string" + ], + "version_id": "string" + } + """ + returned_payload = {} + keys = ["credit_cents_limit", "deadline_seconds", "id", "messages", "version_id"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload diff --git a/src/falconpy/_payload/_case_management.py b/src/falconpy/_payload/_case_management.py index 393e3ed18..57710d2fd 100644 --- a/src/falconpy/_payload/_case_management.py +++ b/src/falconpy/_payload/_case_management.py @@ -402,3 +402,20 @@ def case_evidence_payload(passed_keywords: dict) -> Dict[str, List[Dict[str, Uni returned_payload[key] = provided return returned_payload + + +def entities_merge_post_v1_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a entities_merge_post_v1 request. + + { + "destination_id": "string", + "source_id": "string" + } + """ + returned_payload = {} + keys = ["destination_id", "source_id"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload diff --git a/src/falconpy/_payload/_cloud_security_detections.py b/src/falconpy/_payload/_cloud_security_detections.py new file mode 100644 index 000000000..a094a3b1d --- /dev/null +++ b/src/falconpy/_payload/_cloud_security_detections.py @@ -0,0 +1,55 @@ +"""Internal payload handling library - CloudSecurityDetections. + + _______ __ _______ __ __ __ +| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----. +|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__| +|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____| +|: 1 | |: 1 | +|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy +`-------' `-------' + +OAuth2 API - Customer SDK + +This is free and unencumbered software released into the public domain. + +Anyone is free to copy, modify, publish, use, compile, sell, or +distribute this software, either in source code form or as a compiled +binary, for any purpose, commercial or non-commercial, and by any +means. + +In jurisdictions that recognize copyright laws, the author or authors +of this software dedicate any and all copyright interest in the +software to the public domain. We make this dedication for the benefit +of the public at large and to the detriment of our heirs and +successors. We intend this dedication to be an overt act of +relinquishment in perpetuity of all present and future rights to this +software under copyright law. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR +OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, +ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR +OTHER DEALINGS IN THE SOFTWARE. + +For more information, please refer to +""" + + +def cspm_evaluations_iom_entities_post_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a cspm_evaluations_iom_entities_post request. + + { + "ids": [ + "string" + ] + } + """ + returned_payload = {} + keys = ["ids"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload diff --git a/src/falconpy/_payload/_correlation_rules_admin.py b/src/falconpy/_payload/_correlation_rules_admin.py index e4209fa81..031b12758 100644 --- a/src/falconpy/_payload/_correlation_rules_admin.py +++ b/src/falconpy/_payload/_correlation_rules_admin.py @@ -55,3 +55,24 @@ def correlation_rules_admin_payload(passed_keywords: dict) -> Dict[str, List[Dic if passed_keywords.get(key, None) is not None: returned_payload[key] = passed_keywords.get(key, None) return returned_payload + + +def entities_rules_ownership_put_v2_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a entities_rules_ownership_put_v2 request. + + { + "api_client_id": "string", + "ids": [ + "string" + ], + "user_id": "string", + "user_uuid": "string" + } + """ + returned_payload = {} + keys = ["api_client_id", "ids", "user_id", "user_uuid"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload diff --git a/src/falconpy/_payload/_data_protection_configuration.py b/src/falconpy/_payload/_data_protection_configuration.py index bb4aa3720..57bbc6226 100644 --- a/src/falconpy/_payload/_data_protection_configuration.py +++ b/src/falconpy/_payload/_data_protection_configuration.py @@ -434,3 +434,43 @@ def data_protection_policy_precedence_payload( returned_payload["resources"] = resources return returned_payload + + +def entities_web_location_group_create_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a entities_web_location_group_create request. + + { + "description": "string", + "name": "string", + "web_location_ids": [ + "string" + ] + } + """ + returned_payload = {} + keys = ["description", "name", "web_location_ids"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload + + +def entities_web_location_group_patch_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a entities_web_location_group_patch request. + + { + "description": "string", + "name": "string", + "web_location_ids": [ + "string" + ] + } + """ + returned_payload = {} + keys = ["description", "name", "web_location_ids"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload diff --git a/src/falconpy/_payload/_generic.py b/src/falconpy/_payload/_generic.py index 23b0c6309..6bace8b4e 100644 --- a/src/falconpy/_payload/_generic.py +++ b/src/falconpy/_payload/_generic.py @@ -162,12 +162,12 @@ def exclusion_payload(passed_keywords: dict) -> dict: if passed_keywords.get(key, None) is not None: returned_payload[key] = passed_keywords.get(key, None) group_list = passed_keywords.get("groups", None) - if group_list: + if group_list is not None: if isinstance(group_list, str): group_list = group_list.split(",") returned_payload["groups"] = group_list exclude_list = passed_keywords.get("excluded_from", None) - if exclude_list: + if exclude_list is not None: if isinstance(exclude_list, str): exclude_list = exclude_list.split(",") returned_payload["excluded_from"] = exclude_list diff --git a/src/falconpy/_payload/_ml_exclusions.py b/src/falconpy/_payload/_ml_exclusions.py index f7c1a4466..81d19e4a3 100644 --- a/src/falconpy/_payload/_ml_exclusions.py +++ b/src/falconpy/_payload/_ml_exclusions.py @@ -110,7 +110,7 @@ def ml_exclusions_update_payload(passed_keywords: dict) -> Dict[str, Union[str, "parent_value", "value", "is_descendant_process"] list_keys = ["excluded_from", "groups"] for key in keys: - if passed_keywords.get(key, None): + if passed_keywords.get(key, None) is not None: if key in list_keys: provided = passed_keywords.get(key, None) if isinstance(provided, str): @@ -120,3 +120,72 @@ def ml_exclusions_update_payload(passed_keywords: dict) -> Dict[str, Union[str, returned_payload[key] = passed_keywords.get(key, None) return returned_payload + + +def exclusions_sdmf_query_v1_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a exclusions_sdmf_query_v1 request. + + { + "control_info": { + "deadline": "string", + "duration": "string", + "execution_context": { + "catalog_version": "string", + "execution_options": "string", + "extensions": "string", + "queried_cids": [ + "string" + ] + }, + "execution_details": { + "driver_calls": "string" + }, + "is_export_request": true, + "pagination_info": { + "limit": 0, + "offset": "string" + }, + "partial_results": true, + "query_stats": { + "execution_stats": { + "visited_entities": 0, + "visited_relationships": 0 + }, + "total_hits": { + "relation": "string", + "total": 0 + } + }, + "store_headers": "string" + }, + "id": "string", + "nodes": [ + "string" + ], + "res_id": "string" + } + """ + returned_payload = {} + keys = ["control_info", "id", "nodes", "res_id"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + control_info_keys = [ + "deadline", + "duration", + "execution_context", + "execution_details", + "is_export_request", + "pagination_info", + "partial_results", + "query_stats", + "store_headers" + ] + if "control_info" not in returned_payload: + returned_payload["control_info"] = {} + for key in control_info_keys: + if passed_keywords.get(key, None) is not None: + returned_payload["control_info"][key] = passed_keywords.get(key) + + return returned_payload diff --git a/src/falconpy/_payload/_ngsiem.py b/src/falconpy/_payload/_ngsiem.py index b3ba52854..298eb9476 100644 --- a/src/falconpy/_payload/_ngsiem.py +++ b/src/falconpy/_payload/_ngsiem.py @@ -436,3 +436,294 @@ def update_parser_extension_payload(passed_keywords: dict) -> dict: returned_payload[key] = passed_keywords.get(key) return returned_payload + + +def add_dashboard_labels_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a addDashboardLabels request. + + { + "id": "string", + "labels": [ + "string" + ], + "search_domain": "string" + } + """ + returned_payload = {} + keys = ["id", "labels", "search_domain"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload + + +def add_file_labels_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a addFileLabels request. + + { + "filename": "string", + "labels": [ + "string" + ], + "search_domain": "string" + } + """ + returned_payload = {} + keys = ["filename", "labels", "search_domain"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload + + +def add_saved_query_labels_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a addSavedQueryLabels request. + + { + "id": "string", + "labels": [ + "string" + ], + "search_domain": "string" + } + """ + returned_payload = {} + keys = ["id", "labels", "search_domain"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload + + +def bulk_add_dashboard_labels_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a bulkAddDashboardLabels request. + + { + "items": [ + "string" + ], + "search_domain": "string" + } + """ + returned_payload = {} + keys = ["items", "search_domain"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload + + +def bulk_add_lookup_file_labels_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a bulkAddLookupFileLabels request. + + { + "items": [ + "string" + ], + "search_domain": "string" + } + """ + returned_payload = {} + keys = ["items", "search_domain"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload + + +def bulk_add_saved_query_labels_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a bulkAddSavedQueryLabels request. + + { + "items": [ + "string" + ], + "search_domain": "string" + } + """ + returned_payload = {} + keys = ["items", "search_domain"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload + + +def bulk_remove_dashboard_labels_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a bulkRemoveDashboardLabels request. + + { + "items": [ + "string" + ], + "search_domain": "string" + } + """ + returned_payload = {} + keys = ["items", "search_domain"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload + + +def bulk_remove_lookup_file_labels_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a bulkRemoveLookupFileLabels request. + + { + "items": [ + "string" + ], + "search_domain": "string" + } + """ + returned_payload = {} + keys = ["items", "search_domain"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload + + +def bulk_remove_saved_query_labels_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a bulkRemoveSavedQueryLabels request. + + { + "items": [ + "string" + ], + "search_domain": "string" + } + """ + returned_payload = {} + keys = ["items", "search_domain"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload + + +def bulk_update_dashboard_labels_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a bulkUpdateDashboardLabels request. + + { + "items": [ + "string" + ], + "search_domain": "string" + } + """ + returned_payload = {} + keys = ["items", "search_domain"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload + + +def bulk_update_lookup_file_labels_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a bulkUpdateLookupFileLabels request. + + { + "items": [ + "string" + ], + "search_domain": "string" + } + """ + returned_payload = {} + keys = ["items", "search_domain"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload + + +def bulk_update_saved_query_labels_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a bulkUpdateSavedQueryLabels request. + + { + "items": [ + "string" + ], + "search_domain": "string" + } + """ + returned_payload = {} + keys = ["items", "search_domain"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload + + +def update_dashboard_labels_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a updateDashboardLabels request. + + { + "id": "string", + "labels": [ + "string" + ], + "search_domain": "string" + } + """ + returned_payload = {} + keys = ["id", "labels", "search_domain"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload + + +def update_file_labels_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a updateFileLabels request. + + { + "filename": "string", + "labels": [ + "string" + ], + "search_domain": "string" + } + """ + returned_payload = {} + keys = ["filename", "labels", "search_domain"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload + + +def update_saved_query_labels_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a updateSavedQueryLabels request. + + { + "id": "string", + "labels": [ + "string" + ], + "search_domain": "string" + } + """ + returned_payload = {} + keys = ["id", "labels", "search_domain"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload diff --git a/src/falconpy/_payload/_scanning_orchestrator.py b/src/falconpy/_payload/_scanning_orchestrator.py new file mode 100644 index 000000000..54cd8b51f --- /dev/null +++ b/src/falconpy/_payload/_scanning_orchestrator.py @@ -0,0 +1,91 @@ +"""Internal payload handling library - ScanningOrchestrator. + + _______ __ _______ __ __ __ +| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----. +|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__| +|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____| +|: 1 | |: 1 | +|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy +`-------' `-------' + +OAuth2 API - Customer SDK + +This is free and unencumbered software released into the public domain. + +Anyone is free to copy, modify, publish, use, compile, sell, or +distribute this software, either in source code form or as a compiled +binary, for any purpose, commercial or non-commercial, and by any +means. + +In jurisdictions that recognize copyright laws, the author or authors +of this software dedicate any and all copyright interest in the +software to the public domain. We make this dedication for the benefit +of the public at large and to the detriment of our heirs and +successors. We intend this dedication to be an overt act of +relinquishment in perpetuity of all present and future rights to this +software under copyright law. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR +OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, +ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR +OTHER DEALINGS IN THE SOFTWARE. + +For more information, please refer to +""" + + +def trigger_scan_by_schedule_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a trigger_scan_by_schedule request. + + { + "ids": [ + "string" + ] + } + """ + returned_payload = {} + keys = ["ids"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload + + +def create_schedules_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a create_schedules request. + + { + "resources": [ + "string" + ] + } + """ + returned_payload = {} + keys = ["resources"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload + + +def update_schedules_payload(passed_keywords: dict) -> dict: + """Create a properly formatted payload for a update_schedules request. + + { + "resources": [ + "string" + ] + } + """ + returned_payload = {} + keys = ["resources"] + for key in keys: + if passed_keywords.get(key, None) is not None: + returned_payload[key] = passed_keywords.get(key) + + return returned_payload diff --git a/src/falconpy/_result/_expanded_result.py b/src/falconpy/_result/_expanded_result.py index 1741ebc15..82100aca4 100644 --- a/src/falconpy/_result/_expanded_result.py +++ b/src/falconpy/_result/_expanded_result.py @@ -43,7 +43,7 @@ class ExpandedResult: """Callable subsclass to handle parsing of expanded result client output. DEPRECATED - --- + ---------- This class is deprecated and maintained for backwards compatibility purposes only. Please move all code over to use Result.tupled. diff --git a/src/falconpy/_service_class/_base_service_class.py b/src/falconpy/_service_class/_base_service_class.py index 518f60feb..c85afe73c 100644 --- a/src/falconpy/_service_class/_base_service_class.py +++ b/src/falconpy/_service_class/_base_service_class.py @@ -39,6 +39,7 @@ from abc import ABC, abstractmethod from logging import Logger, getLogger from typing import Dict, Type, Union, Optional +import requests from .._constant import MAX_DEBUG_RECORDS from .._auth_object import FalconInterface, UberInterface from .._error import FunctionalityNotImplemented @@ -242,6 +243,16 @@ def user_agent(self) -> int: def user_agent(self, _): raise FunctionalityNotImplemented + @property + def session(self) -> Optional[requests.Session]: + """Provide the requests.Session from the auth_object. + + Not independently overridable per Service Class instance: session identity must + stay in lock-step with the shared auth_object so authentication and API calls + always use the same session. + """ + return self.auth_object.session + # Mutable @property def debug_record_count(self) -> int: diff --git a/src/falconpy/_service_class/_service_class.py b/src/falconpy/_service_class/_service_class.py index 5e45515ad..4b158abfe 100644 --- a/src/falconpy/_service_class/_service_class.py +++ b/src/falconpy/_service_class/_service_class.py @@ -83,7 +83,7 @@ def __init__(self: "ServiceClass", Instantiates the object, ingests authorization, and initializes attributes. Keyword arguments - ---- + ----------------- access_token : str Token string to use for all requests performed. Mutually exclusive to all other authentication elements. @@ -123,13 +123,20 @@ def __init__(self: "ServiceClass", Amount of time (in seconds) between now and the token expiration before a refresh of the token is performed. Default: 120, Max: 1200 Values over 1200 will be reset to the maximum. + session : requests.Session + Existing HTTP session to reuse for connection pooling. Forwarded to the + auth_object when one is constructed automatically from credentials; ignored + if an explicit auth_object is supplied (that object's own session is used + instead, and is not independently overridable per Service Class instance). + FalconPy never closes a session provided this way; the caller retains + ownership of its lifecycle. When omitted (default), behavior is unchanged. Arguments - ---- + --------- This method only accepts keywords to specify arguments. Returns - ---- + ------- class Instance of a ServiceClass derivative. """ diff --git a/src/falconpy/_util/__init__.py b/src/falconpy/_util/__init__.py index 59cea51ce..e84a495d1 100644 --- a/src/falconpy/_util/__init__.py +++ b/src/falconpy/_util/__init__.py @@ -59,6 +59,7 @@ deprecated_operation, deprecated_class, params_to_keywords, + encode_path_segment, _ALLOWED_METHODS ) from ._service import service_override_payload @@ -79,5 +80,5 @@ "_ALLOWED_METHODS", "login_payloads", "logout_payloads", "sanitize_dictionary", "calc_content_return", "log_class_startup", "service_override_payload", "deprecated_operation", "deprecated_class", "review_provided_credentials", - "params_to_keywords" + "params_to_keywords", "encode_path_segment" ] diff --git a/src/falconpy/_util/_functions.py b/src/falconpy/_util/_functions.py index b14aaf9d8..8602175e4 100644 --- a/src/falconpy/_util/_functions.py +++ b/src/falconpy/_util/_functions.py @@ -45,6 +45,7 @@ except (ImportError, ModuleNotFoundError): # Support import as a module SimplejsonJSONDecodeError = None # Support import as a module from json.decoder import JSONDecodeError as StdJSONDecodeError +from urllib.parse import quote from typing import Dict, Any, Union, Optional, List, TYPE_CHECKING from copy import deepcopy from logging import Logger @@ -231,6 +232,11 @@ def service_request(caller: ServiceClass = None, **kwargs) -> Union[Dict[str, Un except AttributeError: user_agent = None + try: + session: Optional[requests.Session] = caller.session + except AttributeError: + session = None + try: log_utility: Optional[Logger] = caller.log except AttributeError: @@ -256,6 +262,7 @@ def service_request(caller: ServiceClass = None, **kwargs) -> Union[Dict[str, Un return perform_request(proxy=proxy, timeout=timeout, user_agent=user_agent, + session=session, log_util=log_utility, debug_record_count=debug_count, sanitize=do_sanitize, @@ -378,6 +385,9 @@ def perform_request(endpoint: str = "", # noqa: C901 debug_record_count: int - Maximum number of records to log in debug logs authenticating: bool - This request is driving a token request stream: bool - Enabling streaming download. + session: requests.Session - Existing HTTP session to reuse for connection pooling. + FalconPy never closes a session provided this way; the caller retains ownership. + - Example: requests.Session() """ # Shortcut for now pythonic = kwargs.get("pythonic", False) @@ -420,11 +430,12 @@ def perform_request(endpoint: str = "", # noqa: C901 allow_redirects = True # Log our payloads if debugging is enabled log_api_payloads(api, headers) - response = requests.request(api.method.upper(), endpoint, params=api.param_payload, - headers=headers, json=api.body_payload, data=api.data_payload, - files=api.files, verify=api.verify, allow_redirects=allow_redirects, - proxies=api.proxy, timeout=api.timeout, stream=api.stream - ) + requester = api.session.request if api.session is not None else requests.request + response = requester(api.method.upper(), endpoint, params=api.param_payload, + headers=headers, json=api.body_payload, data=api.data_payload, + files=api.files, verify=api.verify, allow_redirects=allow_redirects, + proxies=api.proxy, timeout=api.timeout, stream=api.stream + ) api.debug_headers = response.headers @@ -746,56 +757,69 @@ def process_service_request(calling_object: ServiceClass, # pylint: disable=R09 return service_request(**new_keywords) +def encode_path_segment(value: Any) -> str: + """Percent-encode a value so it occupies exactly one URL path segment. + + Path parameters (object identifiers, collection names, object keys and the + like) are each declared as a single path segment in the endpoint tables. + Encoding with safe="" escapes every reserved character -- most importantly + the forward slash -- so a caller supplied value cannot introduce additional + path segments or dot-segment sequences that the HTTP client would later + normalize into a different, unintended API route. + """ + return quote(str(value), safe="") + + def handle_path_variables(passed: dict, route_url: str): """Review passed arguments and perform any necessary replacements to our operation route.""" passed_partition = passed.get("partition", None) if passed_partition or isinstance(passed_partition, int): - route_url = route_url.format(str(passed_partition)) + route_url = route_url.format(encode_path_segment(passed_partition)) passed_distinct_field = passed.get("distinct_field", None) if passed_distinct_field: - route_url = route_url.format(str(passed_distinct_field)) + route_url = route_url.format(encode_path_segment(passed_distinct_field)) passed_image_id = passed.get("image_id", None) if passed_image_id: - route_url = route_url.format(str(passed_image_id)) + route_url = route_url.format(encode_path_segment(passed_image_id)) passed_collection_name = passed.get("collection_name", None) if passed_collection_name: - collect_args = {"collection_name": str(passed_collection_name)} + collect_args = {"collection_name": encode_path_segment(passed_collection_name)} passed_object_key = passed.get("object_key", None) if passed_object_key: - collect_args["object_key"] = str(passed_object_key) + collect_args["object_key"] = encode_path_segment(passed_object_key) passed_collection_version = passed.get("collection_version", None) if passed_collection_version: - collect_args["collection_version"] = str(passed_collection_version) + collect_args["collection_version"] = encode_path_segment(passed_collection_version) passed_schema_version = passed.get("schema_version", None) if passed_schema_version: - collect_args["schema_version"] = str(passed_schema_version) + collect_args["schema_version"] = encode_path_segment(passed_schema_version) route_url = route_url.format(**collect_args) passed_vertex_type = passed.get("vertex_type", None) if passed_vertex_type: - route_url = route_url.format(str(passed_vertex_type)) + route_url = route_url.format(encode_path_segment(passed_vertex_type)) passed_id = passed.get("path_id", None) if "aspm-api-gateway" in route_url and passed_id: - route_url = route_url.format(passed.get("path_id")) + route_url = route_url.format(encode_path_segment(passed_id)) # Falcon Container passed_uuid = passed.get("uuid", None) if passed_uuid: - route_url = route_url.format(uuid=str(passed_uuid)) + route_url = route_url.format(uuid=encode_path_segment(passed_uuid)) # NGSIEM passed_repository = passed.get("repository", None) if passed_repository: - repo_args = {"repository": str(passed_repository)} + repo_args = {"repository": encode_path_segment(passed_repository)} passed_filename = passed.get("filename", None) if passed_filename: - repo_args["filename"] = str(passed_filename) + repo_args["filename"] = encode_path_segment(passed_filename) passed_package = passed.get("package", None) if passed_package: - repo_args["package"] = passed_package + repo_args["package"] = encode_path_segment(passed_package) passed_namespace = passed.get("namespace", None) if passed_namespace: - repo_args["namespace"] = passed_namespace + repo_args["namespace"] = encode_path_segment(passed_namespace) passed_id = passed.get("search_id", None) if passed_id: - repo_args["id"] = passed_id + repo_args["id"] = encode_path_segment(passed_id) route_url = route_url.format(**repo_args) return route_url @@ -812,7 +836,7 @@ def confirm_base_url(provided_base: Optional[str] = "https://api.crowdstrike.com try: if "://" not in provided_base: # They're passing the name instead of the URL - dashed_bases = ["US-1", "US-2", "EU-1", "US-GOV-1", "US-GOV-2"] + dashed_bases = ["US-1", "US-2", "US-3", "EU-1", "US-GOV-1", "US-GOV-2"] if provided_base.upper() in dashed_bases: provided_base = provided_base.replace("-", "") # Strip the dash try: diff --git a/src/falconpy/_util/_service.py b/src/falconpy/_util/_service.py index 0be0cefce..8919b514d 100644 --- a/src/falconpy/_util/_service.py +++ b/src/falconpy/_util/_service.py @@ -60,6 +60,7 @@ def service_override_payload(caller: object, "proxy": caller.proxy, "timeout": caller.timeout, "user_agent": caller.user_agent, + "session": caller.session, "expand_result": exp, "container": False, # Does not currently support container operations "log_util": caller.log, diff --git a/src/falconpy/_util/_uber.py b/src/falconpy/_util/_uber.py index c9e4d8ec2..4d0aeb536 100644 --- a/src/falconpy/_util/_uber.py +++ b/src/falconpy/_util/_uber.py @@ -36,7 +36,7 @@ For more information, please refer to """ from typing import Tuple -from ._functions import args_to_params, return_preferred_default +from ._functions import args_to_params, return_preferred_default, encode_path_segment from .._constant import PREFER_IDS_IN_BODY, MOCK_OPERATIONS from .._enum import BaseURL, ContainerBaseURL @@ -61,9 +61,9 @@ def handle_field(tgt: str, kwa: dict, fld: str) -> str: """Embed the distinct_field value (SensorUpdatePolicy) within the endpoint URL.""" # Could potentially be zero, handle multiple path variable endpoint module variations try: - returned = tgt.format(str(kwa.get(fld, None))) if kwa.get(fld, None) is not None else tgt + returned = tgt.format(encode_path_segment(kwa.get(fld, None))) if kwa.get(fld, None) is not None else tgt except KeyError: # pragma: no cover - targ = {fld: str(kwa.get(fld, None))} + targ = {fld: encode_path_segment(kwa.get(fld, None))} returned = tgt.format(**targ) return returned @@ -140,7 +140,7 @@ def scrub_target(oper: str, scrubbed: str, kwas: dict) -> str: else: # Handle replacements for multiple PATH variables. fnames = { - fna: kwas[fna] + fna: encode_path_segment(kwas[fna]) for fna in field_names } scrubbed = scrubbed.format(**fnames) @@ -196,6 +196,7 @@ def uber_request_keywords(caller, "proxy": caller.proxy, "timeout": caller.timeout, "user_agent": caller.user_agent, + "session": caller.session, "expand_result": kwa.get("expand_result", False), "container": do_cont, "log_util": caller.log, diff --git a/src/falconpy/_version.py b/src/falconpy/_version.py index 719e24677..cdce56db9 100644 --- a/src/falconpy/_version.py +++ b/src/falconpy/_version.py @@ -35,7 +35,7 @@ For more information, please refer to """ -_VERSION = '1.6.4' +_VERSION = '1.6.5' _HEC_VERSION = '1.0.0' _MAINTAINER = 'Joshua Hiller' _AUTHOR = 'CrowdStrike' @@ -52,7 +52,7 @@ def version(compare: str = None, agent_string: bool = None): """Provide a callable method for checking and comparing the current FalconPy version. Keyword arguments - ---- + ----------------- agent_string: bool Boolean flag indicating that the default User-Agent string should be returned instead. @@ -62,7 +62,7 @@ def version(compare: str = None, agent_string: bool = None): Examples: "1", "1.3" or "1.3.0" Returns - ---- + ------- str or bool A string containing the requested version detail or a boolean indicating the status of the requested version comparison. diff --git a/src/falconpy/access_scopes.py b/src/falconpy/access_scopes.py index 023b545e8..1ad1dbf65 100644 --- a/src/falconpy/access_scopes.py +++ b/src/falconpy/access_scopes.py @@ -63,19 +63,28 @@ def list_access_scopes_external(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """List Access Scopes By ID. - Keyword arguments: - ids -- The ids to retrieve. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/access-scopes/ListAccessScopesExternal + + Keyword arguments + ----------------- + ids : str or list[str] + The ids to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -92,21 +101,31 @@ def query_access_scopes_external(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Query Access Scopes and returns IDs. - Keyword arguments: - filter -- A valid FQL filter. Access Scope fields: name, created_by, created_at. String. - sort -- The sort value. String. - offset -- The offset value. Integer. - limit -- The limit value. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/access-scopes/QueryAccessScopesExternal + + Keyword arguments + ----------------- + filter : str + A valid FQL filter. Access Scope fields: name, created_by, created_at. + sort : str + The sort value. + offset : int + The offset value. + limit : int + The limit value. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/admission_control_policies.py b/src/falconpy/admission_control_policies.py index 2051ab839..5a717728c 100644 --- a/src/falconpy/admission_control_policies.py +++ b/src/falconpy/admission_control_policies.py @@ -64,19 +64,28 @@ def get_policies(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get admission control policies. - Keyword arguments: - ids -- The list of policies to return (maximum 100 IDs allowed). String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/admission-control-policies/admission-control-get-policies + + Keyword arguments + ----------------- + ids : str or list[str] + The list of policies to return (maximum 100 IDs allowed) + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -90,23 +99,31 @@ def get_policies(self: object, def create_policy(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create an admission control policy. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/admission-control-policies/admission-control-create-policy + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "description": "string", "name": "string" } - description -- Description for the new policy. String. - name -- Name of the new policy. String. + description : str + Description for the new policy. + name : str + Name of the new policy. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/admission-control-policies/admission-control-create-policy + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = {} @@ -131,27 +148,38 @@ def update_policy(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update an admission control policy. - Keyword arguments: - ids -- The id of the admission control policy to update. String. - body -- full body payload, not required when using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/admission-control-policies/admission-control-update-policy + + Keyword arguments + ----------------- + ids : str + The id of the admission control policy to update. + body : dict + full body payload, not required when using other keywords. { "description": "string", "is_enabled": true, "name": "string" } - description -- Description for the policy. String. - is_enabled -- Flag indicating if the policy is enabled. Boolean. - name -- Name of the policy. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + description : str + Description for the policy. + is_enabled : bool + Flag indicating if the policy is enabled. + name : str + Name of the policy. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/admission-control-policies/admission-control-update-policy + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = {} @@ -178,19 +206,28 @@ def delete_policies(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete an admission control policy. - Keyword arguments: - ids -- The ids of the policies to delete (maximum 100 IDs allowed). String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/admission-control-policies/admission-control-delete-policies + + Keyword arguments + ----------------- + ids : str or list[str] + The ids of the policies to delete (maximum 100 IDs allowed) + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -204,25 +241,33 @@ def delete_policies(self: object, def add_host_groups(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Add one or more host groups to an admission control policy. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/admission-control-policies/admission-control-add-host-groups + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "host_groups": [ "string" ], "id": "string" } - host_groups -- List of host group IDs to add to the policy. String or list of strings. - id -- The ID of the admission control policy to modify. String. + host_groups : str or list[str] + List of host group IDs to add to the policy. + id : str + The ID of the admission control policy to modify. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/admission-control-policies/admission-control-add-host-groups + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = {} @@ -245,19 +290,27 @@ def add_host_groups(self: object, body: dict = None, **kwargs) -> Union[Dict[str def remove_host_groups(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Remove one or more host groups from an admission control policy. - Keyword arguments: - policy_id -- The id of the policy to modify. String. - host_group_ids -- The ids of the host groups to remove (maximum 100 IDs allowed). String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/admission-control-policies/admission-control-remove-host-groups + + Keyword arguments + ----------------- + policy_id : str + The id of the policy to modify. + host_group_ids : str or list[str] + The ids of the host groups to remove (maximum 100 IDs allowed) + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -271,24 +324,33 @@ def remove_host_groups(self: object, parameters: dict = None, **kwargs) -> Union def update_policy_precedence(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update admission control policy precedence. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/admission-control-policies/admission-control-update-policy-precedence + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "id": "string", "precedence": 0 } - id -- The ID of the admission control policy. String. - precedence -- Policy precedence value. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + id : str + The ID of the admission control policy. + precedence : int + Policy precedence value. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/admission-control-policies/admission-control-update-policy-precedence + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = {} @@ -311,8 +373,16 @@ def add_custom_rules(self: object, body: dict = None, **kwargs) -> Union[Dict[st The requested custom rules are also added to all other unspecified rule groups in the policy with action 'Disabled'. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/admission-control-policies/admission-control-add-rule-group-custom-rule + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "id": "string", "rule_groups": [ @@ -327,17 +397,17 @@ def add_custom_rules(self: object, body: dict = None, **kwargs) -> Union[Dict[st } ] } - id -- The ID of the admission control policy. String. - rule_groups -- List of rule group definitions containing custom rules to add. List of dictionaries. + id : str + The ID of the admission control policy. + rule_groups : list[dict] + List of rule group definitions containing custom rules to add. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/admission-control-policies/admission-control-add-rule-group-custom-rule + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = acp_custom_rules_policy_payload(passed_keywords=kwargs) @@ -356,19 +426,27 @@ def delete_custom_rules(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete one or more custom Rego rules from all rule groups in an admission control policy. - Keyword arguments: - policy_id -- The id of the policy to modify. String. - custom_rule_ids -- The ids of the custom Rego rules to delete (maximum 100 IDs allowed). String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/admission-control-policies/admission-control-remove-rule-group-custom-rule + + Keyword arguments + ----------------- + policy_id : str + The id of the policy to modify. + custom_rule_ids : str or list[str] + The ids of the custom Rego rules to delete (maximum 100 IDs allowed) + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -382,8 +460,16 @@ def delete_custom_rules(self: object, def set_rule_group_precedence(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Change precedence of rule groups within an admission control policy. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: PUT + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/admission-control-policies/admission-control-set-rule-group-precedence + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "id": "string", "rule_groups": [ @@ -392,17 +478,17 @@ def set_rule_group_precedence(self: object, body: dict = None, **kwargs) -> Unio } ] } - id -- The ID of the admission control policy. String. - rule_groups -- List of rule group definitions specifying the new precedence order. List of dictionaries. + id : str + The ID of the admission control policy. + rule_groups : list[dict] + List of rule group definitions specifying the new precedence order. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PUT - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/admission-control-policies/admission-control-set-rule-group-precedence + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = acp_custom_rules_policy_payload(passed_keywords=kwargs) @@ -421,8 +507,16 @@ def replace_rule_group_selectors(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Replace labels and/or namespaces of a rule group within an admission control policy. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: PUT + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/admission-control-policies/admission-control-replace-rule-group-selectors + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "id": "string", "rule_groups": [ @@ -443,17 +537,17 @@ def replace_rule_group_selectors(self: object, } ] } - id -- The ID of the admission control policy. String. - rule_groups -- List of rule group definitions with replacement labels and namespaces. List of dictionaries. + id : str + The ID of the admission control policy. + rule_groups : list[dict] + List of rule group definitions with replacement labels and namespaces. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PUT - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/admission-control-policies/admission-control-replace-rule-group-selectors + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = acp_custom_rules_policy_payload(passed_keywords=kwargs) @@ -472,8 +566,16 @@ def create_rule_groups(self: object, body: dict = None, **kwargs) -> Union[Dict[ The list of new rule groups will be created with the last rule group having highest precedence, second to last with second highest precedence, and so on. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/admission-control-policies/admission-control-create-rule-groups + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "id": "string", "rule_groups": [ @@ -483,17 +585,17 @@ def create_rule_groups(self: object, body: dict = None, **kwargs) -> Union[Dict[ } ] } - id -- The ID of the admission control policy. String. - rule_groups -- List of rule group definitions to create. List of dictionaries. + id : str + The ID of the admission control policy. + rule_groups : list[dict] + List of rule group definitions to create. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/admission-control-policies/admission-control-create-rule-groups + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = acp_custom_rules_policy_payload(passed_keywords=kwargs) @@ -509,8 +611,16 @@ def create_rule_groups(self: object, body: dict = None, **kwargs) -> Union[Dict[ def update_rule_groups(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update a rule group. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/admission-control-policies/admission-control-update-rule-groups + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "id": "string", "rule_groups": [ @@ -540,17 +650,17 @@ def update_rule_groups(self: object, body: dict = None, **kwargs) -> Union[Dict[ } ] } - id -- The ID of the admission control policy. String. - rule_groups -- List of rule group definitions to update. List of dictionaries. + id : str + The ID of the admission control policy. + rule_groups : list[dict] + List of rule group definitions to update. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/admission-control-policies/admission-control-update-rule-groups + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = acp_custom_rules_policy_payload(passed_keywords=kwargs) @@ -566,19 +676,27 @@ def update_rule_groups(self: object, body: dict = None, **kwargs) -> Union[Dict[ def delete_rule_groups(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete rule groups. - Keyword arguments: - policy_id -- The id of the policy to modify. String. - rule_group_ids -- The ids of the rule groups to delete (maximum 100 IDs allowed). String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/admission-control-policies/admission-control-delete-rule-groups + + Keyword arguments + ----------------- + policy_id : str + The id of the policy to modify. + rule_group_ids : str or list[str] + The ids of the rule groups to delete (maximum 100 IDs allowed) + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -592,28 +710,38 @@ def delete_rule_groups(self: object, parameters: dict = None, **kwargs) -> Union def query_policies(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search admission control policies. - Keyword arguments: - filter -- FQL filter. String. - Allowed properties: - precedence created_timestamp - modified_timestamp name - description - limit -- The maximum number of resources to return. The maximum allowed is 500. Integer. - offset -- The number of results to skip before starting to return results. Integer. - sort -- Field to sort on. - Sortable fields: - precedence created_timestamp - modified_timestamp - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/admission-control-policies/admission-control-query-policies + + Keyword arguments + ----------------- + filter : str + FQL filter. String. + Allowed properties: + precedence created_timestamp + modified_timestamp name + description + limit : int + The maximum number of resources to return. The maximum allowed is 500. + offset : int + The number of results to skip before starting to return results. + sort : str + Field to sort on. + Sortable fields: + precedence created_timestamp + modified_timestamp + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/agent_invocation.py b/src/falconpy/agent_invocation.py new file mode 100644 index 000000000..729502959 --- /dev/null +++ b/src/falconpy/agent_invocation.py @@ -0,0 +1,298 @@ +"""CrowdStrike Falcon AgentInvocation API interface class. + + _______ __ _______ __ __ __ +| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----. +|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__| +|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____| +|: 1 | |: 1 | +|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy +`-------' `-------' + +OAuth2 API - Customer SDK + +This is free and unencumbered software released into the public domain. + +Anyone is free to copy, modify, publish, use, compile, sell, or +distribute this software, either in source code form or as a compiled +binary, for any purpose, commercial or non-commercial, and by any +means. + +In jurisdictions that recognize copyright laws, the author or authors +of this software dedicate any and all copyright interest in the +software to the public domain. We make this dedication for the benefit +of the public at large and to the detriment of our heirs and +successors. We intend this dedication to be an overt act of +relinquishment in perpetuity of all present and future rights to this +software under copyright law. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR +OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, +ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR +OTHER DEALINGS IN THE SOFTWARE. + +For more information, please refer to +""" +from typing import Dict, Union +from ._util import force_default, process_service_request, handle_single_argument +from ._payload import invoke_agent_version_external_v1_payload, invoke_published_agent_external_v1_payload +from ._result import Result +from ._service_class import ServiceClass +from ._endpoint._agent_invocation import _agent_invocation_endpoints as Endpoints + + +class AgentInvocation(ServiceClass): + """The only requirement to instantiate an instance of this class is one of the following. + + - a valid client_id and client_secret provided as keywords. + - a credential dictionary with client_id and client_secret containing valid API credentials + { + "client_id": "CLIENT_ID_HERE", + "client_secret": "CLIENT_SECRET_HERE" + } + - a previously-authenticated instance of the authentication service class (oauth2.py) + - a valid token provided by the authentication service class (oauth2.py) + """ + + @force_default(defaults=["body"], default_types=["dict"]) + def invoke_published_agent_external_v1(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Invoke a published agent by ID with the specified input. + + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/agent-invocation/InvokePublishedAgentExternalV1 + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "credit_cents_limit": 0, + "deadline_seconds": 0, + "id": "string", + "messages": [ + { + "content": "string", + "error": { + "code": "string", + "message": "string", + "param": "string", + "type": "string" + }, + "reasoning": "string", + "role": "string", + "tool": { + "calls": [ + { + "function": { + "arguments": "string", + "name": "string" + }, + "id": "string", + "type": "string" + } + ], + "tool_id": "string" + }, + "tool_approval": { + "external_approval": { + "external_id": "string", + "provider": "string" + }, + "id": "string", + "invocation_id": "string", + "parameters": "string", + "request_message": "string", + "requested_at": "string", + "responded_at": "string", + "responded_by": { + "customer_id": "string", + "service_id": "string", + "user_id": "string" + }, + "response_message": "string", + "source_agent_id": "string", + "source_invocation_id": "string", + "status": "string", + "tool_call_id": "string", + "tool_id": "string", + "tool_name": "string" + } + } + ] + } + credit_cents_limit : int + The credit_cents_limit value. + deadline_seconds : int + The deadline_seconds value. + id : str + The id value. + messages : list + The messages value. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = invoke_published_agent_external_v1_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="InvokePublishedAgentExternalV1", + body=body + ) + + @force_default(defaults=["parameters"], default_types=["dict"]) + def get_agent_invocation_v3(self: object, + *args, + parameters: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Retrieve the list of of messages that are resulted from the specified invocation. + + HTTP Method: GET + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/agent-invocation/GetAgentInvocationV3 + + Keyword arguments + ----------------- + id : str or list[str] + Invocation ID. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. + """ + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="GetAgentInvocationV3", + keywords=kwargs, + params=handle_single_argument(args, parameters, "id") + ) + + @force_default(defaults=["body"], default_types=["dict"]) + def invoke_agent_version_external_v1(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Invoke a specific agent version by agent ID and version ID with the specified input. + + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/agent-invocation/InvokeAgentVersionExternalV1 + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "credit_cents_limit": 0, + "deadline_seconds": 0, + "id": "string", + "messages": [ + { + "content": "string", + "error": { + "code": "string", + "message": "string", + "param": "string", + "type": "string" + }, + "reasoning": "string", + "role": "string", + "tool": { + "calls": [ + { + "function": { + "arguments": "string", + "name": "string" + }, + "id": "string", + "type": "string" + } + ], + "tool_id": "string" + }, + "tool_approval": { + "external_approval": { + "external_id": "string", + "provider": "string" + }, + "id": "string", + "invocation_id": "string", + "parameters": "string", + "request_message": "string", + "requested_at": "string", + "responded_at": "string", + "responded_by": { + "customer_id": "string", + "service_id": "string", + "user_id": "string" + }, + "response_message": "string", + "source_agent_id": "string", + "source_invocation_id": "string", + "status": "string", + "tool_call_id": "string", + "tool_id": "string", + "tool_name": "string" + } + } + ], + "version_id": "string" + } + credit_cents_limit : int + The credit_cents_limit value. + deadline_seconds : int + The deadline_seconds value. + id : str + The id value. + messages : list + The messages value. + version_id : str + The version_id value. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = invoke_agent_version_external_v1_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="InvokeAgentVersionExternalV1", + body=body + ) + InvokePublishedAgentExternalV1 = invoke_published_agent_external_v1 + GetAgentInvocationV3 = get_agent_invocation_v3 + InvokeAgentVersionExternalV1 = invoke_agent_version_external_v1 diff --git a/src/falconpy/agent_invocation.pyi b/src/falconpy/agent_invocation.pyi new file mode 100644 index 000000000..b87e1504c --- /dev/null +++ b/src/falconpy/agent_invocation.pyi @@ -0,0 +1,39 @@ +"""Type stubs for agent_invocation.""" +from typing import Dict, List, Optional, Union +from ._service_class import ServiceClass +from ._result import Result + + +class AgentInvocation(ServiceClass): + + def invoke_published_agent_external_v1( + self, + *, + credit_cents_limit: Optional[int] = None, + deadline_seconds: Optional[int] = None, + id: Optional[str] = None, + messages: Optional[list] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def get_agent_invocation_v3( + self, + *args: Union[str, List[str]], + id: Optional[str] = None, + parameters: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def invoke_agent_version_external_v1( + self, + *, + credit_cents_limit: Optional[int] = None, + deadline_seconds: Optional[int] = None, + id: Optional[str] = None, + messages: Optional[list] = None, + version_id: Optional[str] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + InvokePublishedAgentExternalV1 = invoke_published_agent_external_v1 + GetAgentInvocationV3 = get_agent_invocation_v3 + InvokeAgentVersionExternalV1 = invoke_agent_version_external_v1 diff --git a/src/falconpy/agent_templates.py b/src/falconpy/agent_templates.py new file mode 100644 index 000000000..ec21d5aa4 --- /dev/null +++ b/src/falconpy/agent_templates.py @@ -0,0 +1,138 @@ +"""CrowdStrike Falcon AgentTemplates API interface class. + + _______ __ _______ __ __ __ +| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----. +|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__| +|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____| +|: 1 | |: 1 | +|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy +`-------' `-------' + +OAuth2 API - Customer SDK + +This is free and unencumbered software released into the public domain. + +Anyone is free to copy, modify, publish, use, compile, sell, or +distribute this software, either in source code form or as a compiled +binary, for any purpose, commercial or non-commercial, and by any +means. + +In jurisdictions that recognize copyright laws, the author or authors +of this software dedicate any and all copyright interest in the +software to the public domain. We make this dedication for the benefit +of the public at large and to the detriment of our heirs and +successors. We intend this dedication to be an overt act of +relinquishment in perpetuity of all present and future rights to this +software under copyright law. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR +OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, +ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR +OTHER DEALINGS IN THE SOFTWARE. + +For more information, please refer to +""" +from typing import Dict, Union +from ._util import force_default, process_service_request, handle_single_argument +from ._result import Result +from ._service_class import ServiceClass +from ._endpoint._agent_templates import _agent_templates_endpoints as Endpoints + + +class AgentTemplates(ServiceClass): + """The only requirement to instantiate an instance of this class is one of the following. + + - a valid client_id and client_secret provided as keywords. + - a credential dictionary with client_id and client_secret containing valid API credentials + { + "client_id": "CLIENT_ID_HERE", + "client_secret": "CLIENT_SECRET_HERE" + } + - a previously-authenticated instance of the authentication service class (oauth2.py) + - a valid token provided by the authentication service class (oauth2.py) + """ + + @force_default(defaults=["parameters"], default_types=["dict"]) + def entities_agent_templates_v1(self: object, + *args, + parameters: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Retrieve agent template entities for the provided IDs. + + HTTP Method: GET + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/agent-templates/EntitiesAgentTemplatesV1 + + Keyword arguments + ----------------- + ids : str or list[str] + IDs of agent templates to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. + """ + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="EntitiesAgentTemplatesV1", + keywords=kwargs, + params=handle_single_argument(args, parameters, "ids") + ) + + @force_default(defaults=["parameters"], default_types=["dict"]) + def queries_agent_templates_v1(self: object, + parameters: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Query agent template IDs with pagination. + + HTTP Method: GET + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/agent-templates/QueriesAgentTemplatesV1 + + Keyword arguments + ----------------- + offset : int + Starting index of overall result set from which to return ids. + limit : int + Number of IDs to return. + filter : str + FQL query specifying the filter parameters. + sort : str + Possible order by fields: name, id, author, model, created_at, updated_at. Ex: 'name|asc' + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="QueriesAgentTemplatesV1", + keywords=kwargs, + params=parameters + ) + EntitiesAgentTemplatesV1 = entities_agent_templates_v1 + QueriesAgentTemplatesV1 = queries_agent_templates_v1 diff --git a/src/falconpy/agent_templates.pyi b/src/falconpy/agent_templates.pyi new file mode 100644 index 000000000..f2e5e2fe4 --- /dev/null +++ b/src/falconpy/agent_templates.pyi @@ -0,0 +1,27 @@ +"""Type stubs for agent_templates.""" +from typing import Dict, List, Optional, Union +from ._service_class import ServiceClass +from ._result import Result + + +class AgentTemplates(ServiceClass): + + def entities_agent_templates_v1( + self, + *args: Union[str, List[str]], + ids: Optional[Union[str, List[str]]] = None, + parameters: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def queries_agent_templates_v1( + self, + *, + offset: Optional[int] = None, + limit: Optional[int] = None, + filter: Optional[str] = None, + sort: Optional[str] = None, + parameters: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + EntitiesAgentTemplatesV1 = entities_agent_templates_v1 + QueriesAgentTemplatesV1 = queries_agent_templates_v1 diff --git a/src/falconpy/agent_versions.py b/src/falconpy/agent_versions.py new file mode 100644 index 000000000..60547f0bc --- /dev/null +++ b/src/falconpy/agent_versions.py @@ -0,0 +1,140 @@ +"""CrowdStrike Falcon AgentVersions API interface class. + + _______ __ _______ __ __ __ +| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----. +|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__| +|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____| +|: 1 | |: 1 | +|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy +`-------' `-------' + +OAuth2 API - Customer SDK + +This is free and unencumbered software released into the public domain. + +Anyone is free to copy, modify, publish, use, compile, sell, or +distribute this software, either in source code form or as a compiled +binary, for any purpose, commercial or non-commercial, and by any +means. + +In jurisdictions that recognize copyright laws, the author or authors +of this software dedicate any and all copyright interest in the +software to the public domain. We make this dedication for the benefit +of the public at large and to the detriment of our heirs and +successors. We intend this dedication to be an overt act of +relinquishment in perpetuity of all present and future rights to this +software under copyright law. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR +OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, +ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR +OTHER DEALINGS IN THE SOFTWARE. + +For more information, please refer to +""" +from typing import Dict, Union +from ._util import force_default, process_service_request, handle_single_argument +from ._result import Result +from ._service_class import ServiceClass +from ._endpoint._agent_versions import _agent_versions_endpoints as Endpoints + + +class AgentVersions(ServiceClass): + """The only requirement to instantiate an instance of this class is one of the following. + + - a valid client_id and client_secret provided as keywords. + - a credential dictionary with client_id and client_secret containing valid API credentials + { + "client_id": "CLIENT_ID_HERE", + "client_secret": "CLIENT_SECRET_HERE" + } + - a previously-authenticated instance of the authentication service class (oauth2.py) + - a valid token provided by the authentication service class (oauth2.py) + """ + + @force_default(defaults=["parameters"], default_types=["dict"]) + def get_agent_versions_v1(self: object, + *args, + parameters: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Retrieve agent version entities for the provided ids. + + HTTP Method: GET + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/agent-versions/GetAgentVersionsV1 + + Keyword arguments + ----------------- + ids : str or list[str] + IDs of entities to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. + """ + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="GetAgentVersionsV1", + keywords=kwargs, + params=handle_single_argument(args, parameters, "ids") + ) + + @force_default(defaults=["parameters"], default_types=["dict"]) + def query_agent_versions_v1(self: object, + parameters: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Query agent versions based on the provided filters. + + HTTP Method: GET + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/agent-versions/QueryAgentVersionsV1 + + Keyword arguments + ----------------- + offset : int + Starting index of overall result set from which to return ids. + limit : int + Number of IDs to return. Offset + limit should NOT be above 10K. + sort : str + Possible order by String. + fields: + 'created_at|desc'. Ex: + filter : str + FQL query specifying the filter parameters. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="QueryAgentVersionsV1", + keywords=kwargs, + params=parameters + ) + GetAgentVersionsV1 = get_agent_versions_v1 + QueryAgentVersionsV1 = query_agent_versions_v1 diff --git a/src/falconpy/agent_versions.pyi b/src/falconpy/agent_versions.pyi new file mode 100644 index 000000000..90d22d4c7 --- /dev/null +++ b/src/falconpy/agent_versions.pyi @@ -0,0 +1,27 @@ +"""Type stubs for agent_versions.""" +from typing import Dict, List, Optional, Union +from ._service_class import ServiceClass +from ._result import Result + + +class AgentVersions(ServiceClass): + + def get_agent_versions_v1( + self, + *args: Union[str, List[str]], + ids: Optional[Union[str, List[str]]] = None, + parameters: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def query_agent_versions_v1( + self, + *, + offset: Optional[int] = None, + limit: Optional[int] = None, + sort: Optional[str] = None, + filter: Optional[str] = None, + parameters: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + GetAgentVersionsV1 = get_agent_versions_v1 + QueryAgentVersionsV1 = query_agent_versions_v1 diff --git a/src/falconpy/alerts.py b/src/falconpy/alerts.py index cc4c8a3a4..9f400aea8 100644 --- a/src/falconpy/alerts.py +++ b/src/falconpy/alerts.py @@ -65,8 +65,16 @@ def get_aggregate_alerts_v1(self, body: list = None, **kwargs) -> Union[Dict[str DEPRECATED: Please use the get_aggregate_alerts_v2 method (PostAggregatesAlertsV2 operation) instead. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Alerts/PostAggregatesAlertsV1 + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -101,38 +109,44 @@ def get_aggregate_alerts_v1(self, body: list = None, **kwargs) -> Union[Dict[str "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Alerts/PostAggregatesAlertsV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: # Similar to 664: Alerts aggregates expects a list @@ -153,8 +167,16 @@ def get_aggregate_alerts_v2(self, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve aggregates for Alerts across all CIDs. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Alerts/PostAggregatesAlertsV2 + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -189,40 +211,48 @@ def get_aggregate_alerts_v2(self, "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - include_hidden -- Allows previously hidden alerts to be retrieved. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - parameters - full parameters payload, not required if using other keywords. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + include_hidden : bool + Allows previously hidden alerts to be retrieved. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Alerts/PostAggregatesAlertsV2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: # Similar to 664: Alerts aggregates expects a list @@ -322,18 +352,32 @@ def update_alerts_v2(self, DEPRECATED: Please use the update_alerts_v3 (PatchEntitiesAlertsV3 operation) instead. - Keyword arguments: - action_parameters -- List of dictionaries containing action specific parameter settings. - add_tag -- add a tag to 1 or more alert(s). String. Overridden by action_parameters. - append_comment -- appends new comment to existing comments. String. - Overridden by action_parameters. - assign_to_name -- assign 1 or more alert(s) to a user identified by user name. String. - Overridden by action_parameters. - assign_to_user_id -- assign 1 or more alert(s) to a user identified by user id - (eg: user1@example.com). String. Overridden by action_parameters. - assign_to_uuid -- assign 1 or more alert(s) to a user identified by UUID. String. - Overridden by action_parameters. - body -- full body payload, not required when using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Alerts/PatchEntitiesAlertsV2 + + Keyword arguments + ----------------- + action_parameters : list + List of dictionaries containing action specific parameter settings. + add_tag : str + add a tag to 1 or more alert(s). String. Overridden by action_parameters. + append_comment : str + appends new comment to existing comments. String. + Overridden by action_parameters. + assign_to_name : str + assign 1 or more alert(s) to a user identified by user name. String. + Overridden by action_parameters. + assign_to_user_id : str + assign 1 or more alert(s) to a user identified by user id + (eg: user1@example.com). String. Overridden by action_parameters. + assign_to_uuid : str + assign 1 or more alert(s) to a user identified by UUID. String. + Overridden by action_parameters. + body : dict + full body payload, not required when using other keywords. { "ids": [ "string" @@ -345,29 +389,36 @@ def update_alerts_v2(self, } ] } - ids -- ID(s) of the alert to update. String or list of strings. - new_behavior_processed -- adds a newly processed behavior to 1 or more alert(s). String. - Overridden by action_parameters. - remove_tag -- remove a tag from 1 or more alert(s). String. - Overridden by action_parameters. - remove_tags_by_prefix -- remove tags with given prefix from 1 or more alert(s). String. - Overridden by action_parameters. - show_in_ui -- shows 1 or more alert(s) on UI if set to true, hides otherwise. - An empty/nil value is also valid. Overridden by action_parameters. - unassign -- unassign an previously assigned user from 1 or more alert(s). - The value passed to this action is ignored. Overridden by action_parameters. - update_status -- update status for 1 or more alert(s). String. - Overridden by action_parameters. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Alerts/PatchEntitiesAlertsV2 + ids : str or list[str] + ID(s) of the alert to update. + new_behavior_processed : str + adds a newly processed behavior to 1 or more alert(s). String. + Overridden by action_parameters. + remove_tag : str + remove a tag from 1 or more alert(s). String. + Overridden by action_parameters. + remove_tags_by_prefix : str + remove tags with given prefix from 1 or more alert(s). String. + Overridden by action_parameters. + show_in_ui : str + shows 1 or more alert(s) on UI if set to true, hides otherwise. + An empty/nil value is also valid. Overridden by action_parameters. + unassign : str + unassign an previously assigned user from 1 or more alert(s). + The value passed to this action is ignored. Overridden by action_parameters. + update_status : str + update status for 1 or more alert(s). String. + Overridden by action_parameters. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = update_alerts_payload( @@ -398,22 +449,36 @@ def update_alerts_v3(self, ) -> Union[Dict[str, Union[int, dict]], Result]: """Perform actions on alerts identified by detection ID(s) in request. - Keyword arguments: - action_parameters -- List of dictionaries containing action specific parameter settings. - add_tag -- add a tag to 1 or more alert(s). String. Overridden by action_parameters. - append_comment -- Appends new comment to existing comments. String. - Comments are displayed with the Alert in Falcon and are usually used to - provide context or notes for other Falcon users. An Alert can have multiple - comments over time. - Overridden by action_parameters. - assign_to_name -- assign 1 or more alert(s) to a user identified by user name. String. - Overridden by action_parameters. - assign_to_user_id -- assign 1 or more alert(s) to a user identified by user id - (eg: user1@example.com). String. Overridden by action_parameters. - assign_to_uuid -- assign 1 or more alert(s) to a user identified by UUID. String. - Example: '00000000-0000-0000-0000-000000000000' - Overridden by action_parameters. - body -- full body payload, not required when using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Alerts/PatchEntitiesAlertsV3 + + Keyword arguments + ----------------- + action_parameters : list + List of dictionaries containing action specific parameter settings. + add_tag : str + add a tag to 1 or more alert(s). String. Overridden by action_parameters. + append_comment : str + Appends new comment to existing comments. String. + Comments are displayed with the Alert in Falcon and are usually used to + provide context or notes for other Falcon users. An Alert can have multiple + comments over time. + Overridden by action_parameters. + assign_to_name : str + assign 1 or more alert(s) to a user identified by user name. String. + Overridden by action_parameters. + assign_to_user_id : str + assign 1 or more alert(s) to a user identified by user id + (eg: user1@example.com). String. Overridden by action_parameters. + assign_to_uuid : str + assign 1 or more alert(s) to a user identified by UUID. String. + Example: '00000000-0000-0000-0000-000000000000' + Overridden by action_parameters. + body : dict + full body payload, not required when using other keywords. { "composite_ids": [ "string" @@ -425,33 +490,42 @@ def update_alerts_v3(self, } ] } - composite_ids -- CompositeID(s) of the alert to update. String or list of strings. - include_hidden -- Allows previously hidden alerts to be retrieved. - new_behavior_processed -- adds a newly processed behavior to 1 or more alert(s). String. - Overridden by action_parameters. - parameters - full parameters payload, not required if using other keywords. - remove_tag -- remove a tag from 1 or more alert(s). String. - Overridden by action_parameters. - remove_tags_by_prefix -- remove tags with given prefix from 1 or more alert(s). String. - Overridden by action_parameters. - show_in_ui -- shows 1 or more alert(s) on UI if set to true, hides otherwise. - An empty/nil value is also valid. Overridden by action_parameters. - unassign -- unassign an previously assigned user from 1 or more alert(s). - Unassign Alert clears out the assigned user UUID, user ID, and username. - The value passed to this action is ignored. Overridden by action_parameters. - update_status -- update status for 1 or more alert(s). String. - Allowed values: (new, in_progress, reopened, closed) - Overridden by action_parameters. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Alerts/PatchEntitiesAlertsV3 + composite_ids : str or list[str] + CompositeID(s) of the alert to update. + include_hidden : bool + Allows previously hidden alerts to be retrieved. + new_behavior_processed : str + adds a newly processed behavior to 1 or more alert(s). String. + Overridden by action_parameters. + parameters : dict + Full parameters payload. Not required if using other keywords. + remove_tag : str + remove a tag from 1 or more alert(s). String. + Overridden by action_parameters. + remove_tags_by_prefix : str + remove tags with given prefix from 1 or more alert(s). String. + Overridden by action_parameters. + show_in_ui : str + shows 1 or more alert(s) on UI if set to true, hides otherwise. + An empty/nil value is also valid. Overridden by action_parameters. + unassign : str + unassign an previously assigned user from 1 or more alert(s). + Unassign Alert clears out the assigned user UUID, user ID, and username. + The value passed to this action is ignored. Overridden by action_parameters. + update_status : str + update status for 1 or more alert(s). String. + Allowed values: (new, in_progress, reopened, closed) + Overridden by action_parameters. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = update_alerts_payload( @@ -481,67 +555,77 @@ def get_alerts_combined(self, body: dict = None, **kwargs) -> Union[Dict[str, Un This API is intended for retrieval of large amounts of Alerts(>10k) using a pagination based on a `after` token. - Keyword arguments: - after -- The after token is used for pagination of results. String. - The after token is present when more results are available on the next page. - To retrieve all Alerts: - Use the after token in subsequent requests to fetch the next page. - Continue this process until you reach a page without an after token, indicating the last page. - This value is highly dependant on the sort parameter, so if you plan to change the sort order, - you will have to re-start your search from the first page (without after parameter). - body -- Full body payload as a JSON formatted dictionary, not required when ids keyword is provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Alerts/PostCombinedAlertsV1 + + Keyword arguments + ----------------- + after : str + The after token is used for pagination of results. String. + The after token is present when more results are available on the next page. + To retrieve all Alerts: + Use the after token in subsequent requests to fetch the next page. + Continue this process until you reach a page without an after token, indicating the last page. + This value is highly dependant on the sort parameter, so if you plan to change the sort order, + you will have to re-start your search from the first page (without after parameter). + body : dict + Full body payload as a JSON formatted dictionary, not required when ids keyword is provided. { "after": "string", "filter": "string", "limit": integer, "sort": "string" } - filter -- Filter Alerts using a query in Falcon Query Language (FQL). String. - Filter fields can be any keyword field that is part of #domain.Alert - An asterisk wildcard * includes all results. - Empty value means to not filter on anything. - Most commonly used filter fields that supports exact match: - cid type - id pattern_id - aggregate_id platform - product - Most commonly used filter fields that supports wildcard (*): - assigned_to_name tactic_id - assigned_to_uuid technique - Most commonly filter fields that supports range comparisons (>, <, >=, <=): - severity timestamp - created_timestamp updated_timestamp - All filter fields and operations support negation (!). - The full list of valid filter options is extensive. - Review it in our documentation inside the Falcon console. - limit -- The maximum number of detections to return in this response. Integer. - Default: 100, Max: 1000 - Use this parameter together with the after parameter to manage pagination of the results. - sort -- Sort parameter takes the form of . String. - The sorting fields can be any keyword field that is part of #domain.Alert except for the text based fields. - Most commonly used fields for sorting are: - timestamp assigned_to_uuid - created_timestamp tactic_id - updated_timestamp tactic - status technique - aggregate_id technique_id - assigned_to_name pattern_id - assigned_to_uid product - By default all the results are sorted by the created_timestamp field in descending order. - Important: - The pagination is done on live data in the order defined by the sort field parameter, - so if you want to avoid inconsistent results where the same record might appear on multiple - pages (or none), sort only on the fields that do not change over time. - (Examples: created_timestamp, composite_id, etc.) + filter : str + Filter Alerts using a query in Falcon Query Language (FQL). String. + Filter fields can be any keyword field that is part of #domain.Alert + An asterisk wildcard * includes all results. + Empty value means to not filter on anything. + Most commonly used filter fields that supports exact match: + cid type + id pattern_id + aggregate_id platform + product + Most commonly used filter fields that supports wildcard (*): + assigned_to_name tactic_id + assigned_to_uuid technique + Most commonly filter fields that supports range comparisons (>, <, >=, <=): + severity timestamp + created_timestamp updated_timestamp + All filter fields and operations support negation (!). + The full list of valid filter options is extensive. + Review it in our documentation inside the Falcon console. + limit : int + The maximum number of detections to return in this response. Integer. + Default: 100, Max: 1000 + Use this parameter together with the after parameter to manage pagination of the results. + sort : str + Sort parameter takes the form of . String. + The sorting fields can be any keyword field that is part of #domain.Alert except for the text based fields. + Most commonly used fields for sorting are: + timestamp assigned_to_uuid + created_timestamp tactic_id + updated_timestamp tactic + status technique + aggregate_id technique_id + assigned_to_name pattern_id + assigned_to_uid product + By default all the results are sorted by the created_timestamp field in descending order. + Important: + The pagination is done on live data in the order defined by the sort field parameter, + so if you want to avoid inconsistent results where the same record might appear on multiple + pages (or none), sort only on the fields that do not change over time. + (Examples: created_timestamp, composite_id, etc.) This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Alerts/PostCombinedAlertsV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = combined_alerts_payload(kwargs) @@ -559,24 +643,33 @@ def get_alerts_v1(self, *args, body: dict = None, **kwargs) -> Union[Dict[str, U DEPRECATED: Please use the get_alerts_v2 method (PostEntitiesAlertsV1 operation) instead. - Keyword arguments: - body -- full body payload, not required when ids keyword is provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Alerts/PostEntitiesAlertsV1 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when ids keyword is provided. { "ids": [ "string" ] } - ids -- ID(s) of the detections to retrieve. String or list of strings. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Alerts/PostEntitiesAlertsV1 + ids : str or list[str] + ID(s) of the detections to retrieve. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_arguments=args, @@ -602,26 +695,37 @@ def get_alerts_v2(self, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve all Alerts given their IDs. - Keyword arguments: - body -- full body payload, not required when ids keyword is provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Alerts/PostEntitiesAlertsV2 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when ids keyword is provided. { "composite_ids": [ "string" ] } - composite_ids -- ID(s) of the detections to retrieve. String or list of strings. - include_hidden -- Allows previously hidden alerts to be retrieved. - parameters - full parameters payload, not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'composite_ids'. - All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Alerts/PostEntitiesAlertsV2 + composite_ids : str or list[str] + ID(s) of the detections to retrieve. + include_hidden : bool + Allows previously hidden alerts to be retrieved. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'composite_ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_arguments=args, @@ -646,29 +750,38 @@ def query_alerts_v1(self, parameters: dict = None, **kwargs) -> Union[Dict[str, DEPRECATED: Please use the query_alerts_v2 method (GetQueriesAlertsV2 operation) intead. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. + HTTP Method: GET - For more detail regarding filtering options, please review: - https://falcon.crowdstrike.com/documentation/86/detections-monitoring-apis#find-detections + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Alerts/GetQueriesAlertsV1 - limit -- The maximum number of detections to return in this response. - [Integer, default: 10000; max: 10000] - Use with the offset parameter to manage pagination of results. - offset -- The first detection to return, where 0 is the latest detection. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - q -- Search all detection metadata for the provided string. - sort -- The property to sort by. FQL syntax (e.g. status|asc). + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + For more detail regarding filtering options, please review: + https://falcon.crowdstrike.com/documentation/86/detections-monitoring-apis#find-detections + limit : int + The maximum number of detections to return in this response. + [Integer, default: 10000; max: 10000] + Use with the offset parameter to manage pagination of results. + offset : int + The first detection to return, where 0 is the latest detection. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Search all detection metadata for the provided. + sort : str + The property to sort by. FQL syntax (e.g. status|asc). This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: GET - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Alerts/GetQueriesAlertsV1 + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -682,30 +795,40 @@ def query_alerts_v1(self, parameters: dict = None, **kwargs) -> Union[Dict[str, def query_alerts_v2(self, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search for detection IDs that match a given query. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. + HTTP Method: GET - For more detail regarding filtering options, please review: - https://falcon.crowdstrike.com/documentation/86/detections-monitoring-apis#find-detections + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Alerts/GetQueriesAlertsV2 - include_hidden -- Allows previously hidden alerts to be retrieved. - limit -- The maximum number of detections to return in this response. - [Integer, default: 10000; max: 10000] - Use with the offset parameter to manage pagination of results. - offset -- The first detection to return, where 0 is the latest detection. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - q -- Search all detection metadata for the provided string. - sort -- The property to sort by. FQL syntax (e.g. status|asc). + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + For more detail regarding filtering options, please review: + https://falcon.crowdstrike.com/documentation/86/detections-monitoring-apis#find-detections + include_hidden : bool + Allows previously hidden alerts to be retrieved. + limit : int + The maximum number of detections to return in this response. + [Integer, default: 10000; max: 10000] + Use with the offset parameter to manage pagination of results. + offset : int + The first detection to return, where 0 is the latest detection. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Search all detection metadata for the provided. + sort : str + The property to sort by. FQL syntax (e.g. status|asc). This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: GET - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Alerts/GetQueriesAlertsV2 + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/api_clients.py b/src/falconpy/api_clients.py index 7bad35b14..b978b7308 100644 --- a/src/falconpy/api_clients.py +++ b/src/falconpy/api_clients.py @@ -63,17 +63,23 @@ def get_accessible_scopes(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get all available scopes for customer. - Keyword arguments: - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/api-clients/GetAccessibleScopes + + Keyword arguments + ----------------- + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -90,19 +96,27 @@ def reset_api_client_secret(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Reset existing API Client(s)'s secret based on API Client ID(s) provided as request parameter(s) 'ids'. - Keyword arguments: - ids -- The API Client ID(s) for which to perform action on API Client(s). List. - action_name -- Action to perform as part of API Client update. Only allowed value is 'reset_secret'. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/api-clients/ResetAPIClientSecret + + Keyword arguments + ----------------- + ids : str or list[str] + The API Client ID(s) for which to perform action on API Client(s) + action_name : str + Action to perform as part of API Client update. Only allowed value is 'reset_secret' + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -120,19 +134,28 @@ def get_api_clients(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get API Client(s) based on API Client ID(s) provided as request parameter(s) 'ids'. - Keyword arguments: - ids -- The API Client ID(s) for which to obtain API Client definition(s). String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/api-clients/GetAPIClients + + Keyword arguments + ----------------- + ids : str or list[str] + The API Client ID(s) for which to obtain API Client definition(s) + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -149,8 +172,16 @@ def create_api_client(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create new API Client. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/api-clients/CreateAPIClient + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "description": "string", "name": "string", @@ -158,18 +189,19 @@ def create_api_client(self: object, "string" ] } - description -- The description value. String. - name -- The name value. String. - scopes -- The scopes value. List. + description : str + The description value. + name : str + The name value. + scopes : str or list[str] + The scopes value. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/api-clients/CreateAPIClient + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = create_api_client_payload(passed_keywords=kwargs) @@ -189,19 +221,28 @@ def delete_api_clients(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete existing API Client(s) based on API Client ID(s) provided as request parameter(s) 'ids'. - Keyword arguments: - ids -- The API Client ID(s) for which API Client(s) have to be deleted. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/api-clients/DeleteAPIClients + + Keyword arguments + ----------------- + ids : str or list[str] + The API Client ID(s) for which API Client(s) have to be deleted. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -219,9 +260,18 @@ def update_api_client(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update existing API Client based on API Client ID provided as request parameter 'ids'. - Keyword arguments: - ids -- The API Client ID for which to update the API Client definition. String. - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/api-clients/UpdateAPIClient + + Keyword arguments + ----------------- + ids : str + The API Client ID for which to update the API Client definition. + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "description": "string", "name": "string", @@ -229,19 +279,21 @@ def update_api_client(self: object, "string" ] } - description -- The description value. String. - name -- The name value. String. - scopes -- The scopes value. List. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + description : str + The description value. + name : str + The name value. + scopes : str or list[str] + The scopes value. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/api-clients/UpdateAPIClient + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = update_api_client_payload(passed_keywords=kwargs) @@ -262,21 +314,30 @@ def get_all_api_client_ids_for_customer(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get All API client ID(s) for customer. - Keyword arguments: - offset -- Starting index of overall result set from which to return ids. Integer. - limit -- Number of ids to return. Integer. - sort -- Possible values for sort by field includes id, name, created_by, updated_by, created_timestamp, last_modified. - Ex: 'name|asc', 'name|desc', etc. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/api-clients/GetAllAPIClientIdsForCustomer + + Keyword arguments + ----------------- + offset : int + Starting index of overall result set from which to return ids. + limit : int + Number of ids to return. + sort : str + Possible values for sort by field includes id, name, created_by, updated_by, created_timestamp, last_modified. + Ex: 'name|asc', 'name|desc', etc. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/api_complete/_advanced.py b/src/falconpy/api_complete/_advanced.py index f9c8bb271..3d83af8e6 100644 --- a/src/falconpy/api_complete/_advanced.py +++ b/src/falconpy/api_complete/_advanced.py @@ -104,6 +104,15 @@ class that encapsulates the FalconAuth class. This allows the Uber Class to Uber Class usage scenarios. This one does it all. It's like the One Ring with significantly fewer orcs. + + Provide a `session` keyword to reuse an existing `requests.Session` for connection + pooling across login, every command and token revocation. FalconPy never closes a + session provided this way; the caller retains ownership of its lifecycle. Example: + + with requests.Session() as session: + falcon = APIHarnessV2(client_id=client_id, client_secret=client_secret, session=session) + response = falcon.command("query_devices_by_filter") + # session is closed here by the caller's `with` block, not by FalconPy """ # `-. @@ -134,11 +143,11 @@ def command(self, *args, **kwargs) -> Union[Dict[str, Union[str, int, dict]], by HTTP Method: Any Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html Keyword arguments - ---- + ----------------- api_operation : str (Default: None) API Operation ID to perform Please note: The keyword "action" will also be accepted but @@ -175,11 +184,11 @@ def command(self, *args, **kwargs) -> Union[Dict[str, Union[str, int, dict]], by Enable streaming download Arguments - ---- + --------- The first argument passed to this method is assumed to be 'api_operation'. All others are ignored. Returns - ---- + ------- dict or bytes Dictionary or binary object containing API response depending on requested operation. """ diff --git a/src/falconpy/api_complete/_legacy.py b/src/falconpy/api_complete/_legacy.py index 8cbb4ee40..c1747fa1e 100644 --- a/src/falconpy/api_complete/_legacy.py +++ b/src/falconpy/api_complete/_legacy.py @@ -45,6 +45,7 @@ """ import time from logging import Logger, getLogger +import requests from .._util import ( _ALLOWED_METHODS, perform_request, @@ -54,6 +55,7 @@ args_to_params, return_preferred_default, autodiscover_region, + encode_path_segment, ) from .._enum import BaseURL, ContainerBaseURL, TokenFailReason from .._constant import PREFER_IDS_IN_BODY, MOCK_OPERATIONS @@ -86,7 +88,8 @@ def __init__(self: object, # pylint: disable=R0913 access_token: str = None, # pylint: disable=W0613 # Not supported pythonic: bool = False, # New functionality sanitize_log: bool = True, # New functionality - debug_record_count: int = None # New functionality + debug_record_count: int = None, # New functionality + session: requests.Session = None # New functionality ) -> object: """Uber class constructor. @@ -116,6 +119,13 @@ def __init__(self: object, # pylint: disable=R0913 renew_window: Amount of time (in seconds) between now and the token expiration before a refresh of the token is performed. Default: 120, Max: 1200 Values over 1200 will be reset to the maximum. + session: Existing requests.Session to reuse for connection pooling across + authenticate, every command and deauthenticate. FalconPy never closes + a session provided this way; the caller retains ownership of its + lifecycle (for example, by using it as a context manager). A single + Session is not guaranteed safe for concurrent use across threads + without external synchronization. When omitted (default), behavior + is unchanged and a new connection is used for each request. This method only accepts keywords to specify arguments. """ @@ -137,6 +147,7 @@ def __init__(self: object, # pylint: disable=R0913 self.ssl_verify = ssl_verify self.proxy = proxy self.timeout = timeout + self.session = session self.token = False self.token_expiration = 0 self.token_time = time.time() @@ -202,6 +213,7 @@ def authenticate(self: object) -> bool: proxy=self.proxy, timeout=self.timeout, user_agent=self.user_agent, + session=self.session, authenticating=True, log_util=self.log, pythonic=self.pythonic @@ -238,7 +250,7 @@ def deauthenticate(self: object) -> bool: if perform_request(method="POST", endpoint=target, data=data_payload, headers=header_payload, verify=self.ssl_verify, proxy=self.proxy, timeout=self.timeout, user_agent=self.user_agent, - log_util=self.log, pythonic=self.pythonic + session=self.session, log_util=self.log, pythonic=self.pythonic )["status_code"] == 200: self.authenticated = False self.token = False @@ -266,21 +278,21 @@ def _create_header_payload(self: object, passed_arguments: dict) -> dict: def _handle_partition(tgt: str, kwa: dict): if kwa.get("partition", None) is not None: # Partition needs to be embedded into the endpoint URL - tgt = tgt.format(str(kwa.get("partition", None))) + tgt = tgt.format(encode_path_segment(kwa.get("partition", None))) return tgt @staticmethod def _handle_distinct_field(tgt: str, kwa: dict): if kwa.get("distinct_field", None) is not None: # distinct_field also needs to be embedded into the endpoint URL - tgt = tgt.format(str(kwa.get("distinct_field", None))) + tgt = tgt.format(encode_path_segment(kwa.get("distinct_field", None))) return tgt @staticmethod def _handle_container_image_id(tgt: str, kwa: dict): if kwa.get("image_id", None) is not None: # container image ID also needs to be embedded into the endpoint URL - tgt = tgt.format(str(kwa.get("image_id", None))) + tgt = tgt.format(encode_path_segment(kwa.get("image_id", None))) return tgt @staticmethod @@ -396,6 +408,7 @@ def command(self: object, *args, **kwargs) -> dict or bytes: proxy=self.proxy, timeout=self.timeout, user_agent=self.user_agent, + session=self.session, expand_result=kwargs.get("expand_result", False), container=container, log_util=self.log, diff --git a/src/falconpy/api_integrations.py b/src/falconpy/api_integrations.py index 7bad00d22..83a41b0f0 100644 --- a/src/falconpy/api_integrations.py +++ b/src/falconpy/api_integrations.py @@ -60,23 +60,33 @@ class APIIntegrations(ServiceClass): def get_plugin_configs(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query for config resources and returns details. - Keyword arguments: - filter -- Filter items using a query in Falcon Query Language (FQL). String. - limit -- The number of items to return in this response (default: 100, max: 500). - Use with the offset parameter to manage pagination of results. Integer. - offset -- The first item to return, where 0 is the latest item. - Use with the limit parameter to manage pagination of results. Integer. - sort -- Sort items using their properties. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/api-integrations/GetCombinedPluginConfigs + + Keyword arguments + ----------------- + filter : str + Filter items using a query in Falcon Query Language (FQL) + limit : int + The number of items to return in this response (default: 100, max: 500). + Use with the offset parameter to manage pagination of results. + offset : int + The first item to return, where 0 is the latest item. + Use with the limit parameter to manage pagination of results. + sort : str + Sort items using their properties. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -90,8 +100,16 @@ def get_plugin_configs(self: object, parameters: dict = None, **kwargs) -> Union def execute_command_proxy(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Execute a command and proxy the response directly. - Keyword arguments: - body -- Full body payload as a dictionary. Not required if other keywords are provided. + HTTP Method: GET + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/api-integrations/ExecuteCommandProxy + + Keyword arguments + ----------------- + body : dict + Full body payload as a dictionary. Not required if other keywords are provided. { "resources": [ { @@ -114,31 +132,41 @@ def execute_command_proxy(self: object, body: dict = None, **kwargs) -> Union[Di } ] } - config_auth_type -- Configuration authorization type for plugin to execute. - Only application for security scheme plugins. If not - provided, execution will use the default authorization type. String. - config_id -- Configuration ID. If omitted, the oldest configuration ID will be used. String. - cookie -- Request cookies. Part of the request parameters dictionary. Dictionary. - data -- Request data. String. - definition_id -- ID of the definition containing the operation to execute. String. - header -- Request headers. Part of the request parameters dictionary. Dictionary. - id -- ID of the specific plugin to execute provided in "definition_name.operation_name" - format. String. - operation_id -- The specific operation to execute. String. - path -- Request path. Part of the request parameters dictionary. Dictionary. - params -- Request parameters. Not required if using other request parameter keywords. - Can be overridden by values specified using individual keywords. Dictionary. - query -- Request query. Part of the request parameters dictionary. Dictionary. - version -- The version of the definition to execute. Integer. + config_auth_type : str + Configuration authorization type for plugin to execute. + Only application for security scheme plugins. If not + provided, execution will use the default authorization type. + config_id : str + Configuration ID. If omitted, the oldest configuration ID will be used. + cookie : dict + Request cookies. Part of the request parameters. + data : str + Request data. + definition_id : str + ID of the definition containing the operation to execute. + header : dict + Request headers. Part of the request parameters. + id : str + ID of the specific plugin to execute provided in "definition_name.operation_name" + format. + operation_id : str + The specific operation to execute. + path : dict + Request path. Part of the request parameters. + params : dict + Request parameters. Not required if using other request parameter keywords. + Can be overridden by values specified using individual keywords. + query : dict + Request query. Part of the request parameters. + version : int + The version of the definition to execute. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: GET - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/api-integrations/ExecuteCommandProxy + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = api_plugin_command_payload(kwargs) @@ -155,8 +183,16 @@ def execute_command_proxy(self: object, body: dict = None, **kwargs) -> Union[Di def execute_command(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Execute a command. - Keyword arguments: - body -- Full body payload as a dictionary. Not required if other keywords are provided. + HTTP Method: GET + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/api-integrations/ExecuteCommand + + Keyword arguments + ----------------- + body : dict + Full body payload as a dictionary. Not required if other keywords are provided. { "resources": [ { @@ -172,25 +208,30 @@ def execute_command(self: object, body: dict = None, **kwargs) -> Union[Dict[str } ] } - config_auth_type -- Configuration authorization type for plugin to execute. - Only application for security scheme plugins. If not - provided, execution will use the default authorization type. String. - config_id -- Configuration ID. If omitted, the oldest configuration ID will be used. String. - definition_id -- ID of the definition containing the operation to execute. String. - id -- ID of the specific plugin to execute provided in "definition_name.operation_name" - format. String. - operation_id -- The specific operation to execute. String. - description -- Command description. String. - version -- The version of the definition to execute. Integer. + config_auth_type : str + Configuration authorization type for plugin to execute. + Only application for security scheme plugins. If not + provided, execution will use the default authorization type. + config_id : str + Configuration ID. If omitted, the oldest configuration ID will be used. + definition_id : str + ID of the definition containing the operation to execute. + id : str + ID of the specific plugin to execute provided in "definition_name.operation_name" + format. + operation_id : str + The specific operation to execute. + description : str + Command description. + version : int + The version of the definition to execute. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: GET - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/api-integrations/ExecuteCommand + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = api_plugin_command_payload(kwargs) diff --git a/src/falconpy/aspm.py b/src/falconpy/aspm.py index bc068df32..7cc227023 100644 --- a/src/falconpy/aspm.py +++ b/src/falconpy/aspm.py @@ -79,29 +79,42 @@ def execute_function_data_count(self: object, Request and response are in MSA format. - Keyword arguments: - aws_lambda_arn -- ARN for the lambda. Required when using the aws cloud provider. String. - azure_function_app_name -- Azure function name. Required when using the azure cloud provider. String. - azure_site_resource_group -- Azure resource group ID. Required when using the azure cloud provider. String. - azure_site_subscription_id -- Azure site ID. Required when using the azure cloud provider. String. - cloud_provider -- Cloud provider name. String. Available values: aws, azure, gcp - gcp_cloud_function_url -- GCP cloud function URL. Required when using the gcp cloud provider. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - query_name -- Query name. String. - Available values: - sensitive_data vulnerable_libraries - reachable risk_severity - sensitive_datasources sensitive_data_tags - dependencies - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/ExecuteFunctionDataCount + + Keyword arguments + ----------------- + aws_lambda_arn : str + ARN for the lambda. Required when using the aws cloud provider. + azure_function_app_name : str + Azure function name. Required when using the azure cloud provider. + azure_site_resource_group : str + Azure resource group ID. Required when using the azure cloud provider. + azure_site_subscription_id : str + Azure site ID. Required when using the azure cloud provider. + cloud_provider : str + Cloud provider name. String. Available values: aws, azure, gcp + gcp_cloud_function_url : str + GCP cloud function URL. Required when using the gcp cloud provider. + parameters : dict + Full parameters payload. Not required if using other keywords. + query_name : str + Query name. String. + Available values: + sensitive_data vulnerable_libraries + reachable risk_severity + sensitive_datasources sensitive_data_tags + dependencies + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -120,27 +133,38 @@ def execute_functions_count(self: object, Request and response are in MSA format. - Keyword arguments: - cid -- Customer ID. String or list of strings. Required when using the azure cloud provider. - cloud_account_id -- AWS cloud account ID. String or list of strings. - Required when using the aws cloud provider. - cloud_provider -- Cloud provider name. String or list of strings. Available values: aws, azure, gcp - parameters -- Full parameters payload dictionary. Not required if using other keywords. - query_name -- Query name. String. - Available values: - sensitive_data dependencies - reachable vulnerable_libraries - sensitive_datasources - region -- GCP region. String or list of string. Required when using the gcp cloud provider. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/ExecuteFunctionsCount + + Keyword arguments + ----------------- + cid : str or list[str] + Customer ID. String or list of strings. Required when using the azure cloud provider. + cloud_account_id : str or list[str] + AWS cloud account ID. String or list of strings. + Required when using the aws cloud provider. + cloud_provider : str or list[str] + Cloud provider name. String or list of strings. Available values: aws, azure, gcp + parameters : dict + Full parameters payload. Not required if using other keywords. + query_name : str + Query name. String. + Available values: + sensitive_data dependencies + reachable vulnerable_libraries + sensitive_datasources + region : str or list[str] + GCP region. String or list of string. Required when using the gcp cloud provider. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -159,18 +183,25 @@ def execute_function_data_query_count(self: object, Request and response are in MSA format. - Keyword arguments: - field -- Field to retrieve. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/ExecuteFunctionDataQueryCount + + Keyword arguments + ----------------- + field : str + Field to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -189,18 +220,25 @@ def execute_functions_query_count(self: object, Request and response are in MSA format. - Keyword arguments: - field -- Field to retrieve. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/ExecuteFunctionsQueryCount + + Keyword arguments + ----------------- + field : str + Field to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -216,18 +254,25 @@ def execute_function_data(self: object, parameters: dict = None, **kwargs) -> Un Request and response are in MSA format. - Keyword arguments: - field -- Field to retrieve. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/ExecuteFunctionData + + Keyword arguments + ----------------- + field : str + Field to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -246,18 +291,25 @@ def execute_functions_over_time(self: object, Request and response are in MSA format. - Keyword arguments: - field -- Field to retrieve. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/ExecuteFunctionsOvertime + + Keyword arguments + ----------------- + field : str + Field to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -273,18 +325,25 @@ def execute_functions(self: object, parameters: dict = None, **kwargs) -> Union[ Request and response are in MSA format. - Keyword arguments: - field -- Field to retrieve. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/ExecuteFunctions + + Keyword arguments + ----------------- + field : str + Field to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -303,18 +362,25 @@ def execute_function_data_query(self: object, Request and response are in MSA format. - Keyword arguments: - field -- Field to retrieve. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/ExecuteFunctionDataQuery + + Keyword arguments + ----------------- + field : str + Field to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -333,18 +399,25 @@ def execute_functions_query_over_time(self: object, Request and response are in MSA format. - Keyword arguments: - field -- Field to retrieve. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/ExecuteFunctionsQueryOvertime + + Keyword arguments + ----------------- + field : str + Field to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -363,18 +436,25 @@ def execute_functions_query(self: object, Request and response are in MSA format. - Keyword arguments: - field -- Field to retrieve. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/ExecuteFunctionsQuery + + Keyword arguments + ----------------- + field : str + Field to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -388,24 +468,37 @@ def execute_functions_query(self: object, def get_service_artifacts(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve service artifacts. - Keyword arguments: - persistent_signature -- Persistent signature. String. - optional_time -- Optional time. String. - revision_id -- Revision ID. String. - limit -- Upper bound for records returned. Integer. - offset -- Starting position for records returned. Integer. - order_by -- Sort order field. String or list of strings. - direction -- Sort order direction. String. Available values: asc, desc - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/getServiceArtifacts + + Keyword arguments + ----------------- + persistent_signature : str + Persistent signature. + optional_time : str + Optional time. + revision_id : str + Revision ID. + limit : int + Upper bound for records returned. + offset : int + Starting position for records returned. + order_by : str or list[str] + Sort order field. + direction : str + Sort order direction. String. Available values: asc, desc + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("persistent_signature", None): kwargs["persistentSignature"] = kwargs.get("persistent_signature", None) @@ -437,25 +530,33 @@ def get_service_artifacts(self: object, parameters: dict = None, **kwargs) -> Un def update_business_applications(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create or Update Business Applications. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PUT + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/UpsertBusinessApplications + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "name": "string", "persistentSignatures": [ "string" ] } - name -- Application name. String. - persistent_signatures -- Signatures. List of strings. + name : str + Application name. + persistent_signatures : list[str] + Signatures. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PUT - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/UpsertBusinessApplications + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = aspm_application_payload(passed_keywords=kwargs) @@ -475,17 +576,21 @@ def get_cloud_security_integration_state(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get Cloud Security integration state. - Keyword arguments: - This method does not support keyword arguments. - - This method does not support positional arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/GetCloudSecurityIntegrationState + + Keyword arguments + ----------------- + This method does not support keyword arguments. + This method does not support positional arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -502,18 +607,25 @@ def set_cloud_security_integration_state(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Set Cloud Security integration state. - Keyword arguments: - body -- Full body payload in JSON format. Not required if using other keywords. - is_enabled -- Flag indicating if the state should be enabled. Boolean - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/SetCloudSecurityIntegrationState + + Keyword arguments + ----------------- + body : dict + Full body payload in JSON format. Not required if using other keywords. + is_enabled : bool + Flag indicating if the state should be enabled. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("is_enabled", None) is not None: body["isEnabled"] = kwargs.get("is_enabled", None) @@ -534,27 +646,43 @@ def set_cloud_security_integration_state(self: object, def get_executor_nodes(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get all the relay nodes. - Keyword arguments: - direction -- Sort order direction. String. Allowed values: asc, desc - executor_node_ids -- Executor node IDs. String or list of strings. - executor_node_names -- Executor node names. String or list of strings. - executor_node_states -- Executor node states. String or list of strings. - executor_node_types -- Executor node types. String or list of strings. - node_type -- Node type. String. - integration_type -- Integration type. String. - limit -- Maximum number of records to return. Integer. - offset -- Starting position for records returned. Integer. - order_by -- Field to use for sorting results. String. Allowed values: name, id, state, type - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/GetExecutorNodes + + Keyword arguments + ----------------- + direction : str + Sort order direction. String. Allowed values: asc, desc + executor_node_ids : str or list[str] + Executor node IDs. + executor_node_names : str or list[str] + Executor node names. + executor_node_states : str or list[str] + Executor node states. + executor_node_types : str or list[str] + Executor node types. + node_type : str + Node type. + integration_type : int + Integration type. + limit : int + Maximum number of records to return. + offset : int + Starting position for records returned. + order_by : str + Field to use for sorting results. String. Allowed values: name, id, state, type + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -568,8 +696,16 @@ def get_executor_nodes(self: object, parameters: dict = None, **kwargs) -> Union def update_executor_node(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update an existing relay node. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PUT + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/UpdateExecutorNode + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "additional_header": "string", "current_aws_arn": "string", @@ -596,27 +732,25 @@ def update_executor_node(self: object, body: dict = None, **kwargs) -> Union[Dic "useJobs": boolean, "username": "string" } - current_aws_arn -- - dashboard_url -- - id -- - last_health_check -- - name -- - node_type -- - password -- - pod_settings -- - proxy_address -- - type -- - use_jobs -- - username -- + current_aws_arn : str + dashboard_url : str + id : str + last_health_check : int + name : str + node_type : str + password : str + pod_settings : dict + proxy_address : str + type : str + use_jobs : str + username : str This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PUT - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/UpdateExecutorNode + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = aspm_node_payload(passed_keywords=kwargs) @@ -633,9 +767,17 @@ def update_executor_node(self: object, body: dict = None, **kwargs) -> Union[Dic def create_executor_node(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create a new relay node. - Keyword arguments: - additional_header -- - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/CreateExecutorNode + + Keyword arguments + ----------------- + additional_header : str + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "additional_header": "string", "current_aws_arn": "string", @@ -662,27 +804,25 @@ def create_executor_node(self: object, body: dict = None, **kwargs) -> Union[Dic "useJobs": boolean, "username": "string" } - current_aws_arn -- - dashboard_url -- - id -- - last_health_check -- - name -- - node_type -- - password -- - pod_settings -- - proxy_address -- - type -- - use_jobs -- - username -- + current_aws_arn : str + dashboard_url : str + id : str + last_health_check : int + name : str + node_type : str + password : str + pod_settings : dict + proxy_address : str + type : str + use_jobs : str + username : str This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/CreateExecutorNode + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = aspm_node_payload(passed_keywords=kwargs) @@ -702,21 +842,31 @@ def get_executor_nodes_metadata(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get metadata about all executor nodes. - Keyword arguments: - executor_node_ids -- Executor node ids. String or list of strings. - executor_node_names -- Executor node names. String or list of strings. - executor_node_states -- Executor node states. Integer or list of integers. - executor_node_types -- Executor node types. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/GetExecutorNodesMetadata + + Keyword arguments + ----------------- + executor_node_ids : str or list[str] + Executor node ids. + executor_node_names : str or list[str] + Executor node names. + executor_node_states : str or list[str] + Executor node states. + executor_node_types : str or list[str] + Executor node types. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -730,18 +880,25 @@ def get_executor_nodes_metadata(self: object, def delete_node(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a relay node. - Keyword arguments: - id -- ID of the node to remove. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/DeleteExecutorNode + + Keyword arguments + ----------------- + id : int + ID of the node to remove. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ target_id = kwargs.get("id", parameters.get("id", None)) if not target_id: @@ -761,9 +918,18 @@ def delete_node(self: object, parameters: dict = None, **kwargs) -> Union[Dict[s def retrieve_relay_instances(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve the relay instance in CSV format. - Keyword arguments: - additional_header -- Additional header to provide. String. - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: DELETE + + Swagger URL + ----------- + Swagger unavailable + + Keyword arguments + ----------------- + additional_header : str + Additional header to provide. + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "additional_header": "string", "current_aws_arn": "string", @@ -795,27 +961,37 @@ def retrieve_relay_instances(self: object, body: dict = None, **kwargs) -> Union "useJobs": true, "username": "string" } - current_aws_arn -- Current AWS ARN. String. - dashboard_url -- URL for the related dashboard. String. - id -- ID of the node to remove. Integer. - last_health_check -- Last health check. Integer. - name -- Name. String. - node_type -- Node type. String. - pod_settings -- Related pod settings. Dictionary. - proxy_address -- Address of the proxy. String. - status -- Current status. Dictionary. - type -- Relay type. String. - use_jobs -- Flag indicating if jobs should be used. Boolean. - username -- Account username. String. + current_aws_arn : str + Current AWS ARN. + dashboard_url : str + URL for the related dashboard. + id : str + ID of the node to remove. + last_health_check : int + Last health check. + name : str + Name. + node_type : str + Node type. + pod_settings : dict + Related pod settings. + proxy_address : str + Address of the proxy. + status : dict + Current status. + type : str + Relay type. + use_jobs : bool + Flag indicating if jobs should be used. + username : str + Account username. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: DELETE - - Swagger URL - Swagger unavailable + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = retrieve_relay_node_payload(kwargs) @@ -838,26 +1014,41 @@ def retrieve_relay_instances(self: object, body: dict = None, **kwargs) -> Union def get_integration_tasks(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get all integration tasks. - Keyword arguments: - integration_task_type -- Integration task type. Integer. - category -- Integration category. String. - offset -- Starting position to returned records. Integer. - limit -- Total number of records to return. Integer. - order_by -- Field to use for sort order. String. Available values: name, id, integrationTask - direction -- Sort direction. String. Allowed values: asc, desc - integration_task_types -- Integration task types. Integer. - ids -- Integration IDs. Integer. - names -- Integration names. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/GetIntegrationTasks + + Keyword arguments + ----------------- + integration_task_type : int + Integration task type. + category : str + Integration category. + offset : int + Starting position to returned records. + limit : int + Total number of records to return. + order_by : str + Field to use for sort order. String. Available values: name, id, integrationTask + direction : str + Sort direction. String. Allowed values: asc, desc + integration_task_types : int + Integration task types. + ids : int + Integration IDs. + names : str + Integration names. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("order_by", None): kwargs["orderBy"] = kwargs.get("order_by", None) @@ -877,8 +1068,16 @@ def get_integration_tasks(self: object, parameters: dict = None, **kwargs) -> Un def create_integration_task(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create new integration task. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/CreateIntegrationTask + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "integration_task": { "access_token": "string", @@ -1226,14 +1425,14 @@ def create_integration_task(self: object, body: dict = None, **kwargs) -> Union[ } } - This method only supports keywords for providing arguments. - Returns: dict object containing API response. - HTTP Method: POST + This method only supports keywords for providing arguments. - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/CreateIntegrationTask + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = aspm_integration_task_payload(passed_keywords=kwargs) @@ -1253,26 +1452,41 @@ def get_integration_tasks_admin(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get all the integration tasks, requires admin scope. - Keyword arguments: - integration_task_type -- Integration task type. Integer. - category -- Integration task category. String. - offset -- Offset from which to start returning records. Integer. - limit -- Maximum number of records to return. Integer. - order_by -- Fields to use for sort order. String. - direction -- Sort order direction. String. Allowed values: asc or desc - integration_task_types -- Integration task types. Integer. - ids -- Integration task ID. Integer. - names -- Integration task name. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/GetIntegrationTasksAdmin + + Keyword arguments + ----------------- + integration_task_type : int + Integration task type. + category : str + Integration task category. + offset : int + Offset from which to start returning records. + limit : int + Maximum number of records to return. + order_by : str + Fields to use for sort order. + direction : str + Sort order direction. String. Allowed values: asc or desc + integration_task_types : int + Integration task types. + ids : int + Integration task ID. + names : str + Integration task name. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("order_by", None): kwargs["orderBy"] = kwargs.get("order_by", None) @@ -1295,21 +1509,31 @@ def get_integration_tasks_metadata(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get metadata about all integration tasks. - Keyword arguments: - category -- Integration category. String. Allowed values: collection, exporting - integration_task_types -- Integration task types. Integer. - ids -- Integration IDs. Integer. - names -- Integration names. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/GetIntegrationTasksMetadata + + Keyword arguments + ----------------- + category : str + Integration category. String. Allowed values: collection, exporting + integration_task_types : int + Integration task types. + ids : int + Integration IDs. + names : str + Integration names. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1326,26 +1550,41 @@ def get_integration_tasks_v2(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get all the integration tasks. - Keyword arguments: - integration_task_type -- Integration task type. Integer. - category -- Integration category. String. - offset -- Starting position to returned records. Integer. - limit -- Total number of records to return. Integer. - order_by -- Field to use for sort order. String. Available values: name, id, integrationTask - direction -- Sort direction. String. Allowed values: asc, desc - integration_task_types -- Integration task types. Integer. - ids -- Integration IDs. Integer. - names -- Integration names. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/GetIntegrationTasksV2 + + Keyword arguments + ----------------- + integration_task_type : int + Integration task type. + category : str + Integration category. + offset : int + Starting position to returned records. + limit : int + Total number of records to return. + order_by : str + Field to use for sort order. String. Available values: name, id, integrationTask + direction : str + Sort direction. String. Allowed values: asc, desc + integration_task_types : int + Integration task types. + ids : int + Integration IDs. + names : str + Integration names. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("order_by", None): kwargs["orderBy"] = kwargs.get("order_by", None) @@ -1369,9 +1608,18 @@ def update_integration_task(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update an existing integration task by its ID. - Keyword arguments: - ID -- ID of the integration task to update. Integer. - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PUT + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/UpdateIntegrationTask + + Keyword arguments + ----------------- + ID : int + ID of the integration task to update. + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "integration_task": { "access_token": "string", @@ -1718,16 +1966,15 @@ def update_integration_task(self: object, } } } - parameters -- Full parameters payload dictionary. Not required if using other keywords. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PUT - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/UpdateIntegrationTask + Returns + ------- + dict + Dictionary object containing API response. """ target_id = kwargs.get("id", parameters.get("id", None)) if not target_id: @@ -1756,18 +2003,25 @@ def delete_integration_task(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete an existing integration task by its ID. - Keyword arguments: - ID -- ID of the integration task to remove. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/DeleteIntegrationTask + + Keyword arguments + ----------------- + ID : int + ID of the integration task to remove. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ target_id = kwargs.get("id", parameters.get("id", None)) if not target_id: @@ -1791,9 +2045,18 @@ def run_integration_task(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Run an integration task by its ID. - Keyword arguments: - access_token -- Integration access token. String. - body -- Full body payload dictionary in JSON format. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/RunIntegrationTask + + Keyword arguments + ----------------- + access_token : str + Integration access token. + body : dict + Full body payload dictionary in JSON format. Not required if using other keywords. { "access_token": "string", "category": "string", @@ -1802,22 +2065,27 @@ def run_integration_task(self: object, "scheduled": boolean, "task_id": integer } - category -- Integration task category. String. - data -- Integration task data. String. - ID -- ID of the integration task to execute. Integer. - override -- Override previous task. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - scheduled -- Schedule task. Boolean. - task_id -- Integration task ID. Integer. + category : str + Integration task category. + data : str + Integration task data. + ID : int + ID of the integration task to execute. + override : bool + Override previous task. + parameters : dict + Full parameters payload. Not required if using other keywords. + scheduled : bool + Schedule task. + task_id : int + Integration task ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/RunIntegrationTask + Returns + ------- + dict + Dictionary object containing API response. """ target_id = kwargs.get("id", parameters.get("id", None)) if not target_id: @@ -1847,10 +2115,20 @@ def run_integration_task_admin(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Run an integration task by its ID - for admin scope. - Keyword arguments: - ID -- Integration task ID. Integer. - category -- Integration task category. String. - body -- Full body payload in JSON format. Not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/RunIntegrationTaskAdmin + + Keyword arguments + ----------------- + ID : int + Integration task ID. + category : str + Integration task category. + body : dict + Full body payload in JSON format. Not required when using other keywords. { "access_token": "string", "category": "string", @@ -1859,16 +2137,15 @@ def run_integration_task_admin(self: object, "scheduled": boolean, "task_id": integer } - parameters -- Full parameters payload dictionary. Not required if using other keywords. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/RunIntegrationTaskAdmin + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = aspm_integration_task_payload(kwargs) @@ -1890,10 +2167,20 @@ def run_integration_task_v2(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Run an integration task by its ID. - Keyword arguments: - ID -- Integration task ID. Integer. - category -- Integration task category. String. - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/RunIntegrationTaskV2 + + Keyword arguments + ----------------- + ID : int + Integration task ID. + category : str + Integration task category. + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "access_token": "string", "category": "string", @@ -1902,16 +2189,15 @@ def run_integration_task_v2(self: object, "scheduled": bolean, "task_id": integer } - parameters -- Full parameters payload dictionary. Not required if using other keywords. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/RunIntegrationTaskV2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = aspm_integration_task_payload(kwargs) @@ -1927,18 +2213,24 @@ def run_integration_task_v2(self: object, def get_integration_types(self: object) -> Union[Dict[str, Union[int, dict]], Result]: """Get all the integration types. - Keyword arguments: - This operation does not accept keyword arguments. - - Arguments: - This operation does not accept arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/GetIntegrationTypes + + Keyword arguments + ----------------- + This operation does not accept keyword arguments. + + Arguments + --------- + This operation does not accept arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1950,19 +2242,27 @@ def get_integration_types(self: object) -> Union[Dict[str, Union[int, dict]], Re def get_integrations(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get a list of all the integrations. - Keyword arguments: - integration_type -- Type of integration. String. - category -- Integration category. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/GetIntegrations + + Keyword arguments + ----------------- + integration_type : int + Type of integration. + category : str + Integration category. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1976,8 +2276,16 @@ def get_integrations(self: object, parameters: dict = None, **kwargs) -> Union[D def create_integration(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create a new integration. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/CreateIntegration + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "integration": { "data": "string", @@ -2027,16 +2335,15 @@ def create_integration(self: object, body: dict = None, **kwargs) -> Union[Dict[ "update_time": integer } } - integration -- Integration details. Dictionary. + integration : dict + Integration details. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/CreateIntegration + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = aspm_integration_payload(passed_keywords=kwargs) @@ -2053,19 +2360,27 @@ def create_integration(self: object, body: dict = None, **kwargs) -> Union[Dict[ def get_integrations_v2(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get a list of all the integrations. - Keyword arguments: - integration_type -- Integration type. Integer. - category -- Integration category. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/GetIntegrationsV2 + + Keyword arguments + ----------------- + integration_type : int + Integration type. + category : str + Integration category. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2083,9 +2398,18 @@ def update_integration(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update an existing integration by its ID. - Keyword arguments: - id -- ID of the integration to update. Integer. - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PUT + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/UpdateIntegration + + Keyword arguments + ----------------- + id : int + ID of the integration to update. + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "integration": { "data": "string", @@ -2138,18 +2462,19 @@ def update_integration(self: object, "string" ] } - integration -- Integration details. Dictionary. - overwrite_fields -- Fields to overwrite. List of strings. - parameters -- Full parameters payload dictionary. Not required if using the 'id' keyword. + integration : dict + Integration details. + overwrite_fields : list[str] + Fields to overwrite. + parameters : dict + Full parameters payload dictionary. Not required if using the 'id' keyword. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PUT - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/UpdateIntegration + Returns + ------- + dict + Dictionary object containing API response. """ target_id = kwargs.get("id", parameters.get("id", None)) if not target_id: @@ -2173,18 +2498,25 @@ def update_integration(self: object, def delete_integration(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete an existing integration by its ID. - Keyword arguments: - id -- ID of the integration to remove. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/DeleteIntegration + + Keyword arguments + ----------------- + id : int + ID of the integration to remove. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ target_id = kwargs.get("id", parameters.get("id", None)) if not target_id: @@ -2204,8 +2536,16 @@ def delete_integration(self: object, parameters: dict = None, **kwargs) -> Union def execute_query(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Execute a query. The syntax used is identical to that of the query page. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/ExecuteQuery + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "paginate": { "direction": "string", @@ -2227,27 +2567,30 @@ def execute_query(self: object, body: dict = None, **kwargs) -> Union[Dict[str, }, "timestamp": integer } - paginate -- Pagination detail. Dictionary. - query -- Query to perform. String. - select_fields -- Field selection detail. Dictionary. - Dictionary contents: - fields - For filtering relevant fields only. - withoutServices - Default is set to True, - you will not receive information about the services. - If you want to get the relevant service, set to False. - serviceFields - For filtering relevant fields of the service - (if you chose to get it) - parameters -- Full parameters payload dictionary. Not required if using other keywords. - timestamp -- Timestamp. Integer. + paginate : dict + Pagination detail. + query : str + Query to perform. + select_fields : str + Field selection detail. Dictionary. + Dictionary contents: + fields - For filtering relevant fields only. + withoutServices - Default is set to True, + you will not receive information about the services. + If you want to get the relevant service, set to False. + serviceFields - For filtering relevant fields of the service + (if you chose to get it) + parameters : dict + Full parameters payload. Not required if using other keywords. + timestamp : int + Timestamp. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/ExecuteQuery + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = aspm_query_payload(passed_keywords=kwargs) @@ -2267,22 +2610,33 @@ def get_servicenow_deployments(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve ServiceNow deployments. - Keyword arguments: - ql_filters -- Query filter. String. - limit -- Maximum number of records to return. Integer. - offset -- Starting position of return records. Integer. - orderBy -- Sort order field. String. - direction -- Sort direction. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/ServiceNowGetDeployments + + Keyword arguments + ----------------- + ql_filters : str + Query filter. + limit : int + Maximum number of records to return. + offset : int + Starting position of return records. + orderBy : str + Sort order field. + direction : str + Sort direction. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2299,23 +2653,35 @@ def get_servicenow_services(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve ServiceNow services. - Keyword arguments: - exclude_artifacts -- Flag indicating if artifacts should be excluded. Boolean. - ql_filters -- Query filter. String. - limit -- Maximum number of records to return. Integer. - offset -- Starting position of return records. Integer. - orderBy -- Sort order field. String. - direction -- Sort direction. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/ServiceNowGetServices + + Keyword arguments + ----------------- + exclude_artifacts : bool + Flag indicating if artifacts should be excluded. + ql_filters : str + Query filter. + limit : int + Maximum number of records to return. + offset : int + Starting position of return records. + orderBy : str + Sort order field. + direction : str + Sort direction. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("order_by", None): kwargs["orderBy"] = kwargs.get("order_by") @@ -2332,8 +2698,16 @@ def get_servicenow_services(self: object, def get_services_count(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get the total amount of existing services. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/GetServicesCount + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "deploymentTupleFilters": [ { @@ -2385,25 +2759,24 @@ def get_services_count(self: object, body: dict = None, **kwargs) -> Union[Dict[ "revisionId": integer, "rolesSignature": "string" } - deployment_tuple_filters -- - nesting-level -- - only_count -- - optional_time -- - pagination -- - persistent_signatures -- - ql_filters -- - related_entities -- - revision_id -- - roles_signatures -- + deployment_tuple_filters : str + nesting : str + level -- + only_count : str + optional_time : str + pagination : dict + persistent_signatures : str + ql_filters : str + related_entities : str + revision_id : str + roles_signatures : str This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/GetServicesCount + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = aspm_get_services_count_payload(passed_keywords=kwargs) @@ -2420,8 +2793,16 @@ def get_services_count(self: object, body: dict = None, **kwargs) -> Union[Dict[ def get_service_violation_types(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get the different types of violation. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: GET + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/GetServiceViolationTypes + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "filter": { "order_by": { @@ -2440,18 +2821,18 @@ def get_service_violation_types(self: object, body: dict = None, **kwargs) -> Un "optionalTime": integer, "revisionId": integer } - filter -- Query filter. Dictionary. - optional_time -- Integer. - revision_id -- Revision ID. Integer. + filter : dict + Query filter. + optional_time : int + revision_id : int + Revision ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: GET - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/GetServiceViolationTypes + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = aspm_violations_search_payload(passed_keywords=kwargs) @@ -2468,22 +2849,32 @@ def get_service_violation_types(self: object, body: dict = None, **kwargs) -> Un def get_tags(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get all the tags. - Keyword arguments: - is_unique -- Flag indicating if the tag is unique. Boolean. - tag_name -- Tag name. String. - limit -- Total number of tags to return. Integer. - offset -- Starting position from which to return records. Integer. - name -- String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/GetTags + + Keyword arguments + ----------------- + is_unique : bool + Flag indicating if the tag is unique. + tag_name : str + Tag name. + limit : int + Total number of tags to return. + offset : int + Starting position from which to return records. + name : str or list[str] + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ keymap = {"is_unique": "isUnique", "tag_name": "tagName"} for key, camelkey in keymap.items(): @@ -2502,8 +2893,16 @@ def get_tags(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, def update_tags(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create new or update existing tag. You can update unique tags table or regular tags table. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PUT + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/UpsertTags + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "entries": [ { @@ -2514,21 +2913,24 @@ def update_tags(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Un } ] } - entries -- Tag entries. List of dictionaries. - Overrides the is_sensitive, persistent_signature, and value keywords. - is_sensitive -- Sensitive. Boolean. - name -- Tag name. String. - tag_type -- Tag type. String. - value -- Tag value. String. + entries : list + Tag entries. List of dictionaries. + Overrides the is_sensitive, persistent_signature, and value keywords. + is_sensitive : bool + Sensitive. + name : str + Tag name. + tag_type : str + Tag type. + value : str + Tag value. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PUT - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/UpsertTags + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = aspm_update_tag_payload(passed_keywords=kwargs) @@ -2545,8 +2947,16 @@ def update_tags(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Un def delete_tags(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Remove existing tags. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/DeleteTags + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "entries": [ { @@ -2557,21 +2967,24 @@ def delete_tags(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Un ], "name": "string" } - entries -- Tag entries. List of dictionaries. - Overrides the is_sensitive, persistent_signature, and value keywords. - is_sensitive -- Sensitive. Boolean. - name -- Tag name. String. - persistent_signature -- Persistent signature. String. - value -- Tag value. String. + entries : list + Tag entries. List of dictionaries. + Overrides the is_sensitive, persistent_signature, and value keywords. + is_sensitive : bool + Sensitive. + name : str + Tag name. + persistent_signature : str + Persistent signature. + value : str + Tag value. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/DeleteTags + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = aspm_delete_tag_payload(passed_keywords=kwargs) @@ -2591,18 +3004,25 @@ def get_users_v2(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """List users. - Keyword arguments: - pagination -- URL encoded pagination JSON - limit, offset, direction, orderBy. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/get_%2Fusers%2Fv2 + + Keyword arguments + ----------------- + pagination : str + URL encoded pagination JSON - limit, offset, direction, orderBy. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2616,8 +3036,16 @@ def get_users_v2(self: object, def post_group_v2(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create group. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/post_%2Fgroup%2Fv2 + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "children": [ 0 @@ -2629,20 +3057,25 @@ def post_group_v2(self: object, body: dict = None, **kwargs) -> Union[Dict[str, "parentId": 0, "scope": "string" } - children -- IDs of child groups. List of Integers. - description -- Description of the group. String. - group_type -- Type of the group. String. - is_default -- Flag indicating if this is the default group. Boolean. - name -- Name of the group. String. - parent_id -- ID of the parent group. Integer. - scope -- Scope of the group. String. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/post_%2Fgroup%2Fv2 + children : list[int] + IDs of child groups. + description : str + Description of the group. + group_type : str + Type of the group. + is_default : bool + Flag indicating if this is the default group. + name : str + Name of the group. + parent_id : int + ID of the parent group. + scope : str + Scope of the group. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = aspm_group_payload(passed_keywords=kwargs) @@ -2658,18 +3091,25 @@ def post_group_v2(self: object, body: dict = None, **kwargs) -> Union[Dict[str, def delete_group(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete group. - Keyword arguments: - id -- Group ID. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/delete_%2Fgroup%2F%7BID%3A%5B0-9%5D%2B%7D + + Keyword arguments + ----------------- + id : int + Group ID. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ target_id = kwargs.get("id", parameters.get("id", None)) if not target_id: @@ -2689,18 +3129,25 @@ def delete_group(self: object, parameters: dict = None, **kwargs) -> Union[Dict[ def update_default_group(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update default group. - Keyword arguments: - id -- Group ID. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/post_%2Fgroup%2F%7BID%3A%5B0-9%5D%2B%7D%2Fupdate_default + + Keyword arguments + ----------------- + id : int + Group ID. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ target_id = kwargs.get("id", parameters.get("id", None)) if not target_id: @@ -2720,18 +3167,25 @@ def update_default_group(self: object, parameters: dict = None, **kwargs) -> Uni def get_group_v2(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get group details. - Keyword arguments: - id -- Group ID. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/get_%2Fgroup%2F%7BID%3A%5B0-9%5D%2B%7D%2Fv2 + + Keyword arguments + ----------------- + id : int + Group ID. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ target_id = kwargs.get("id", parameters.get("id", None)) if not target_id: @@ -2755,9 +3209,18 @@ def update_group(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update group. - Keyword arguments: - id -- Group ID. Integer. - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/post_%2Fgroup%2F%7BID%3A%5B0-9%5D%2B%7D%2Fv2 + + Keyword arguments + ----------------- + id : int + Group ID. + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "children": [ 0 @@ -2769,20 +3232,25 @@ def update_group(self: object, "parentId": 0, "scope": "string" } - children -- IDs of child groups. List of Integers. - description -- Description of the group. String. - group_type -- Type of the group. String. - is_default -- Flag indicating if this is the default group. Boolean. - name -- Name of the group. String. - parent_id -- ID of the parent group. Integer. - scope -- Scope of the group. String. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/post_%2Fgroup%2F%7BID%3A%5B0-9%5D%2B%7D%2Fv2 + children : list[int] + IDs of child groups. + description : str + Description of the group. + group_type : str + Type of the group. + is_default : bool + Flag indicating if this is the default group. + name : str + Name of the group. + parent_id : int + ID of the parent group. + scope : str + Scope of the group. + + Returns + ------- + dict + Dictionary object containing API response. """ target_id = kwargs.get("id", parameters.get("id", None)) if not target_id: @@ -2806,17 +3274,23 @@ def update_group(self: object, def get_group_hierarchy(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get group hierarchy. - Keyword arguments: - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/get_%2Fgroups%2Fhier%2Fv2 + + Keyword arguments + ----------------- + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2830,18 +3304,25 @@ def get_group_hierarchy(self: object, parameters: dict = None, **kwargs) -> Unio def get_groups_v2(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get groups V2. - Keyword arguments: - type -- Group types to query - can either be empty (all), parents, children. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ASPM/get_%2Fgroups%2Flist%2Fv2 + + Keyword arguments + ----------------- + type : str + Group types to query - can either be empty (all), parents, children. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/cao_hunting.py b/src/falconpy/cao_hunting.py index 0ba18df7d..331c3c013 100644 --- a/src/falconpy/cao_hunting.py +++ b/src/falconpy/cao_hunting.py @@ -60,8 +60,16 @@ class CAOHunting(ServiceClass): def aggregate_guides(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Aggregate Hunting Guides. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cao-hunting/AggregateHuntingGuides + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -113,14 +121,14 @@ def aggregate_guides(self: object, body: dict = None, **kwargs) -> Union[Dict[st } ] - This method only supports keywords for providing arguments. - Returns: dict object containing API response. - HTTP Method: POST + This method only supports keywords for providing arguments. - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cao-hunting/AggregateHuntingGuides + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -139,8 +147,16 @@ def aggregate_queries(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Aggregate intelligence queries. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cao-hunting/AggregateIntelligenceQueries + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -179,39 +195,46 @@ def aggregate_queries(self: object, "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - extended_bounds -- Extended bounds. Dictionary containing "min" and "max" as strings. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + extended_bounds : dict + Extended bounds. Dictionary containing "min" and "max" as strings. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cao-hunting/AggregateIntelligenceQueries + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -230,25 +253,34 @@ def create_export_archive(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create an Archive Export. - Keyword arguments: - archive_type -- The Archive Type. String. Can be one of 'zip' and 'gzip'. Defaults to 'zip'. - filter -- The FQL Filter used to limit results. String. - language -- The Query Language used. String. - Accepted Values: - cql SPL - snort AI translated - suricata __all__ - yara - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cao-hunting/GetArchiveExport + + Keyword arguments + ----------------- + archive_type : str + The Archive Type. String. Can be one of 'zip' and 'gzip'. Defaults to 'zip'. + filter : str + The FQL Filter used to limit results. + language : str + The Query Language used. String. + Accepted Values: + cql SPL + snort AI translated + suricata __all__ + yara + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -262,19 +294,28 @@ def create_export_archive(self: object, def get_guides(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve a list of Hunting Guides. - Keyword arguments: - ids -- Hunting Guides IDs. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cao-hunting/GetHuntingGuides + + Keyword arguments + ----------------- + ids : str or list[str] + Hunting Guides IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -291,20 +332,28 @@ def get_queries(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve a list of Intelligence queries. - Keyword arguments: - ids -- Intelligence queries IDs. String or list of strings. - include_translated_content -- The AI translated language that should be returned if it exists. - Allowed values: SPL, __all__ - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cao-hunting/GetIntelligenceQueries + + Keyword arguments + ----------------- + ids : str or list[str] + Intelligence queries IDs. + include_translated_content : str or list[str] + The AI translated language that should be returned if it exists. + Allowed values: SPL, __all__ + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -318,22 +367,33 @@ def get_queries(self: object, def search_queries(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search intelligence queries that match the provided conditions. - Keyword arguments: - filter -- FQL query specifying the filter parameters. String. - limit -- Number of IDs to return. Integer. - sort -- Order by fields. FQL formatted string. - offset -- Starting index of result set from which to return IDs. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - q -- Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cao-hunting/SearchIntelligenceQueries + + Keyword arguments + ----------------- + filter : str + FQL query specifying the filter parameters. + limit : int + Number of IDs to return. + sort : str + Order by fields. + offset : str + Starting index of result set from which to return IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -347,22 +407,33 @@ def search_queries(self: object, parameters: dict = None, **kwargs) -> Union[Dic def search_guides(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search for Hunting Guides that match the provided conditions. - Keyword arguments: - offset -- Starting index of result set from which to return IDs. Integer. - limit -- Number of IDs to return. Integer. - sort -- Order by fields. String. - filter -- FQL query specifying the filter parameters. String. - q -- Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed). String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cao-hunting/SearchHuntingGuides + + Keyword arguments + ----------------- + offset : str + Starting index of result set from which to return IDs. + limit : int + Number of IDs to return. + sort : str + Order by fields. + filter : str + FQL query specifying the filter parameters. + q : str + Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed) + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/case_management.py b/src/falconpy/case_management.py index bec139d17..394c311ea 100644 --- a/src/falconpy/case_management.py +++ b/src/falconpy/case_management.py @@ -40,6 +40,7 @@ from ._result import Result from ._service_class import ServiceClass from ._util import force_default, process_service_request, generate_error_result, handle_single_argument +from ._payload import entities_merge_post_v1_payload from ._endpoint._case_management import _case_management_endpoints as Endpoints from ._payload._case_management import ( case_management_notification_groups_payload, @@ -78,20 +79,29 @@ def aggregates_file_details_post_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get file details aggregates as specified via json in the request body. - Keyword arguments: - ids -- Resource IDs. String or a list of strings. - body -- Full body payload provided as a dictionary. Not required if using other keywords. - filter -- FQL filter expression. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-files/aggregates.file-details.post.v1 + + Keyword arguments + ----------------- + ids : str or list[str] + Resource IDs. String or a. + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. + filter : str + FQL filter expression. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -106,20 +116,29 @@ def aggregates_file_details_post_v1(self: object, def query_file_details(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query file details. - Keyword arguments: - filter -- FQL filter expression. String. - limit -- Page size. Integer. - offset -- Page offset. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-files/combined.file-details.get.v1 + + Keyword arguments + ----------------- + filter : str + FQL filter expression. + limit : int + Page size. + offset : int + Page offset. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -133,19 +152,28 @@ def query_file_details(self: object, parameters: dict = None, **kwargs) -> Union def get_file_details(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get file details by id. - Keyword arguments: - ids -- Resource IDs. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-files/entities.file-details.get.v1 + + Keyword arguments + ----------------- + ids : str or list[str] + Resource IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -159,23 +187,31 @@ def get_file_details(self: object, *args, parameters: dict = None, **kwargs) -> def update_file_details(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update file details. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-files/entities.file-details.patch.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "description": "string", "id": "string" } - description -- File details update desecription. String. - id -- File details ID. String. + description : str + File details update desecription. + id : str + File details ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-files/entities.file-details.patch.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: keys = ["description", "id"] @@ -194,23 +230,30 @@ def update_file_details(self: object, body: dict = None, **kwargs) -> Union[Dict def bulk_download_files(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Download multiple existing file from case as a ZIP. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-files/entities.files_bulk-download.post.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "ids": [ "string" ] } - ids -- List of files to download. List of strings. + ids : str or list[str] + List of files to download. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-files/entities.files_bulk-download.post.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = case_management_file_ids_payload(passed_keywords=kwargs) @@ -230,19 +273,28 @@ def download_existing_files(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Download existing file from case. - Keyword arguments: - id -- Resource ID. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-files/entities.files_download.get.v1 + + Keyword arguments + ----------------- + id : str + Resource ID. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -256,20 +308,29 @@ def download_existing_files(self: object, def upload_file(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Upload file for case. - Keyword arguments: - file -- Local file to Upload. String. - description -- Description of the file. String. - case_id -- Case ID for the file. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-files/entities.files_upload.post.v1 + + Keyword arguments + ----------------- + file : str + Local file to Upload. + description : str + Description of the file. + case_id : str + Case ID for the file. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ file = kwargs.get("file", None) if file: @@ -307,19 +368,28 @@ def delete_file_details(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete file details by id. - Keyword arguments: - ids -- Resource IDs. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-files/entities.files.delete.v1 + + Keyword arguments + ----------------- + ids : str or list[str] + Resource IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -333,20 +403,29 @@ def delete_file_details(self: object, def query_file_detail_ids(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query for ids of file details. - Keyword arguments: - filter -- FQL filter expression. String. - limit -- Page size. Integer. - offset -- Page offset. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-files/queries.file-details.get.v1 + + Keyword arguments + ----------------- + filter : str + FQL filter expression. + limit : int + Page size. + offset : int + Page offset. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -360,23 +439,31 @@ def query_file_detail_ids(self: object, parameters: dict = None, **kwargs) -> Un def get_rtr_file_metadata(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get metadata for a file via RTR without retrieving it. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-files/entities.get-rtr-file-metadata.post.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "aid": "string", "file_path": "string" } - aid -- The agent ID of the host to retrieve file metadata from. String. - file_path -- The path to the file on the host. String. + aid : str + The agent ID of the host to retrieve file metadata from. + file_path : str + The path to the file on the host. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-files/entities.get-rtr-file-metadata.post.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = case_management_rtr_file_metadata_payload(passed_keywords=kwargs) @@ -392,27 +479,37 @@ def get_rtr_file_metadata(self: object, body: dict = None, **kwargs) -> Union[Di def retrieve_rtr_file(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve a file from host using RTR and add it to a case. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-files/entities.retrieve-rtr-file.post.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "aid": "string", "case_id": "string", "description": "string", "file_path": "string" } - aid -- The agent ID of the host to retrieve the file from. String. - case_id -- The ID of the case to add the file to. String. - description -- A description of the file being retrieved. String. - file_path -- The path to the file on the host. String. + aid : str + The agent ID of the host to retrieve the file from. + case_id : str + The ID of the case to add the file to. + description : str + A description of the file being retrieved. + file_path : str + The path to the file on the host. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-files/entities.retrieve-rtr-file.post.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = case_management_rtr_file_payload(passed_keywords=kwargs) @@ -428,8 +525,16 @@ def retrieve_rtr_file(self: object, body: dict = None, **kwargs) -> Union[Dict[s def retrieve_rtr_recent_file(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve a recently fetched RTR file and add it to a case. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-files/entities.retrieve-rtr-recent-file.post.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "aid": "string", "case_id": "string", @@ -437,20 +542,23 @@ def retrieve_rtr_recent_file(self: object, body: dict = None, **kwargs) -> Union "session_id": "string", "sha256": "string" } - aid -- The agent ID of the host. String. - case_id -- The ID of the case to add the file to. String. - description -- A description of the file being retrieved. String. - session_id -- The RTR session ID for the file retrieval. String. - sha256 -- The SHA256 hash of the file to retrieve. String. + aid : str + The agent ID of the host. + case_id : str + The ID of the case to add the file to. + description : str + A description of the file being retrieved. + session_id : str + The RTR session ID for the file retrieval. + sha256 : str + The SHA256 hash of the file to retrieve. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-files/entities.retrieve-rtr-recent-file.post.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = case_management_rtr_recent_file_payload(passed_keywords=kwargs) @@ -469,8 +577,16 @@ def get_notification_groups_aggregation(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get notification groups aggregations. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/aggregates.notification-groups.post.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. [ { "date_ranges": [ @@ -488,23 +604,29 @@ def get_notification_groups_aggregation(self: object, "type": "terms" } ] - date_ranges -- Date range timeframe. List of dictionaries. - field -- Field to aggregate on. String. - filter -- Filter criteria in the form of an FQL query. String. - from -- Starting index of overall result set. Integer. - name -- Name of the aggregation. String. - size -- Maximum number of records to return. Integer. - sort -- The field to sort on. String. - type -- Type of aggregation to perform. String. + date_ranges : list[dict] + Date range timeframe. + field : str + Field to aggregate on. + filter : str + Filter criteria in the form of an FQL query. + from : int + Starting index of overall result set. + name : str + Name of the aggregation. + size : int + Maximum number of records to return. + sort : str + The field to sort on. + type : str + Type of aggregation to perform. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/aggregates.notification-groups.post.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = case_management_notification_groups_payload(passed_keywords=kwargs) @@ -523,8 +645,16 @@ def get_notification_groups_aggregation_v2(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get notification groups aggregations. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/aggregates.notification-groups.post.v2 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. [ { "date_ranges": [ @@ -542,23 +672,29 @@ def get_notification_groups_aggregation_v2(self: object, "type": "terms" } ] - date_ranges -- Date range timeframe. List of dictionaries. - field -- Field to aggregate on. String. - filter -- Filter criteria in the form of an FQL query. String. - from -- Starting index of overall result set. Integer. - name -- Name of the aggregation. String. - size -- Maximum number of records to return. Integer. - sort -- The field to sort on. String. - type -- Type of aggregation to perform. String. + date_ranges : list[dict] + Date range timeframe. + field : str + Field to aggregate on. + filter : str + Filter criteria in the form of an FQL query. + from : int + Starting index of overall result set. + name : str + Name of the aggregation. + size : int + Maximum number of records to return. + sort : str + The field to sort on. + type : str + Type of aggregation to perform. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/aggregates.notification-groups.post.v2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = case_management_notification_groups_payload(passed_keywords=kwargs) @@ -574,8 +710,16 @@ def get_notification_groups_aggregation_v2(self: object, def get_sla_aggregations(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get SLA aggregations. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/aggregates.slas.post.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. [ { "date_ranges": [ @@ -593,23 +737,29 @@ def get_sla_aggregations(self: object, body: dict = None, **kwargs) -> Union[Dic "type": "terms" } ] - date_ranges -- Date range timeframe. List of dictionaries. - field -- Field to aggregate on. String. - filter -- Filter criteria in the form of an FQL query. String. - from -- Starting index of overall result set. Integer. - name -- Name of the aggregation. String. - size -- Maximum number of records to return. Integer. - sort -- The field to sort on. String. - type -- Type of aggregation to perform. String. + date_ranges : list[dict] + Date range timeframe. + field : str + Field to aggregate on. + filter : str + Filter criteria in the form of an FQL query. + from : int + Starting index of overall result set. + name : str + Name of the aggregation. + size : int + Maximum number of records to return. + sort : str + The field to sort on. + type : str + Type of aggregation to perform. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/aggregates.slas.post.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = case_management_notification_groups_payload(passed_keywords=kwargs) @@ -625,8 +775,16 @@ def get_sla_aggregations(self: object, body: dict = None, **kwargs) -> Union[Dic def get_template_aggregations(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get templates aggregations. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/aggregates.templates.post.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. [ { "date_ranges": [ @@ -644,23 +802,29 @@ def get_template_aggregations(self: object, body: dict = None, **kwargs) -> Unio "type": "terms" } ] - date_ranges -- Date range timeframe. List of dictionaries. - field -- Field to aggregate on. String. - filter -- Filter criteria in the form of an FQL query. String. - from -- Starting index of overall result set. Integer. - name -- Name of the aggregation. String. - size -- Maximum number of records to return. Integer. - sort -- The field to sort on. String. - type -- Type of aggregation to perform. String. + date_ranges : list[dict] + Date range timeframe. + field : str + Field to aggregate on. + filter : str + Filter criteria in the form of an FQL query. + from : int + Starting index of overall result set. + name : str + Name of the aggregation. + size : int + Maximum number of records to return. + sort : str + The field to sort on. + type : str + Type of aggregation to perform. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/aggregates.templates.post.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = case_management_notification_groups_payload(passed_keywords=kwargs) @@ -676,8 +840,16 @@ def get_template_aggregations(self: object, body: dict = None, **kwargs) -> Unio def get_access_tag_aggregations(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get access tag aggregates. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/aggregates.access-tags.post.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. [ { "date_ranges": [ @@ -695,23 +867,29 @@ def get_access_tag_aggregations(self: object, body: dict = None, **kwargs) -> Un "type": "terms" } ] - date_ranges -- Date range timeframe. List of dictionaries. - field -- Field to aggregate on. String. - filter -- Filter criteria in the form of an FQL query. String. - from -- Starting index of overall result set. Integer. - name -- Name of the aggregation. String. - size -- Maximum number of records to return. Integer. - sort -- The field to sort on. String. - type -- Type of aggregation to perform. String. + date_ranges : list[dict] + Date range timeframe. + field : str + Field to aggregate on. + filter : str + Filter criteria in the form of an FQL query. + from : int + Starting index of overall result set. + name : str + Name of the aggregation. + size : int + Maximum number of records to return. + sort : str + The field to sort on. + type : str + Type of aggregation to perform. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/aggregates.access-tags.post.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = case_management_notification_groups_payload(passed_keywords=kwargs) @@ -731,20 +909,30 @@ def get_access_tags(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get access tags. - Keyword arguments: - ids -- Resource IDs. String or list of strings. - with_has_access -- Evaluate FGAC and return has_access property. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.access-tags.get.v1 + + Keyword arguments + ----------------- + ids : str or list[str] + Resource IDs. + with_has_access : bool + Evaluate FGAC and return has_access property. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -758,19 +946,28 @@ def get_access_tags(self: object, def get_fields(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get fields by ID. - Keyword arguments: - ids -- Resource IDs. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.fields.get.v1 + + Keyword arguments + ----------------- + ids : str or list[str] + Resource IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -788,19 +985,28 @@ def get_notification_groups(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get notification groups by ID. - Keyword arguments: - ids -- Resource IDs. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.notification-groups.get.v1 + + Keyword arguments + ----------------- + ids : str or list[str] + Resource IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -814,8 +1020,16 @@ def get_notification_groups(self: object, def create_notification_group(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create notification group. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.notification-groups.post.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "channels": [ { @@ -831,18 +1045,19 @@ def create_notification_group(self: object, body: dict = None, **kwargs) -> Unio "description": "string", "name": "string" } - channels -- The notification group channel configuration parameters. List of dictionaries. - description -- Notification group description. String. - name -- Notification group name. String. + channels : list[dict] + The notification group channel configuration parameters. + description : str + Notification group description. + name : str + Notification group name. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.notification-groups.post.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = case_management_create_notification_payload(passed_keywords=kwargs) @@ -858,37 +1073,47 @@ def create_notification_group(self: object, body: dict = None, **kwargs) -> Unio def update_notification_group(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update notification group. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. - { - "channels": [ + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.notification-groups.patch.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { - "config_id": "string", - "config_name": "string", - "recipients": [ - "string" - ], - "severity": "string", - "type": "email" + "channels": [ + { + "config_id": "string", + "config_name": "string", + "recipients": [ + "string" + ], + "severity": "string", + "type": "email" + } + ], + "description": "string", + "id": "string", + "name": "string" } - ], - "description": "string", - "id": "string", - "name": "string" - } - channels -- The notification group channel configuration parameters. List of dictionaries. - description -- Notification group description. String. - id -- The ID of the notification group. String. - name -- Notification group name. String. + channels : list[dict] + The notification group channel configuration parameters. + description : str + Notification group description. + id : str + The ID of the notification group. + name : str + Notification group name. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.notification-groups.patch.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = case_management_create_notification_payload(passed_keywords=kwargs) @@ -907,18 +1132,25 @@ def delete_notification_group(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete notification groups by ID. - Keyword arguments: - ids -- Resource IDs. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.notification-groups.delete.v1 + + Keyword arguments + ----------------- + ids : str or list[str] + Resource IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -936,19 +1168,28 @@ def get_notification_groups_v2(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get notification groups by ID. - Keyword arguments: - ids -- Resource IDs. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.notification-groups.get.v2 + + Keyword arguments + ----------------- + ids : str or list[str] + Resource IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -962,32 +1203,41 @@ def get_notification_groups_v2(self: object, def create_notification_group_v2(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create notification group. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. - { - "channels": [ + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.notification-groups.post.v2 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { - "config_id": "string", - "config_name": "string", - "params": {}, - "type": "email" + "channels": [ + { + "config_id": "string", + "config_name": "string", + "params": {}, + "type": "email" + } + ], + "description": "string", + "name": "string" } - ], - "description": "string", - "name": "string" - } - channels -- The notification group channel configuration parameters. List of dictionaries. - description -- Notification group description. String. - name -- Notification group name. String. + channels : list[dict] + The notification group channel configuration parameters. + description : str + Notification group description. + name : str + Notification group name. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.notification-groups.post.v2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = case_management_create_notification_payload(passed_keywords=kwargs) @@ -1003,33 +1253,44 @@ def create_notification_group_v2(self: object, body: dict = None, **kwargs) -> U def update_notification_group_v2(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update notification group. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. - { - "channels": [ - { - "config_id": "string", - "config_name": "string", - "params": {}, - "type": "email" - } - ], - "description": "string", - "id": "string", - "name": "string" - } - This method only supports keywords for providing arguments. - channels -- The notification group channel configuration parameters. List of dictionaries. - description -- Notification group description. String. - id -- The ID of the notification group. String. - name -- Notification group name. String. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.notification-groups.patch.v2 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. + { + "channels": [ + { + "config_id": "string", + "config_name": "string", + "params": {}, + "type": "email" + } + ], + "description": "string", + "id": "string", + "name": "string" + } + channels : list[dict] + The notification group channel configuration parameters. + description : str + Notification group description. + id : str + The ID of the notification group. + name : str + Notification group name. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = case_management_create_notification_payload(passed_keywords=kwargs) @@ -1049,19 +1310,28 @@ def delete_notification_group_v2(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete notification groups by ID. - Keyword arguments: - ids -- Resource IDs. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.notification-groups.delete.v2 + + Keyword arguments + ----------------- + ids : str or list[str] + Resource IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1075,19 +1345,28 @@ def delete_notification_group_v2(self: object, def get_slas(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get SLAs by ID. - Keyword arguments: - ids -- Resource IDs. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.slas.get.v1 + + Keyword arguments + ----------------- + ids : str or list[str] + Resource IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1101,38 +1380,47 @@ def get_slas(self: object, *args, parameters: dict = None, **kwargs) -> Union[Di def create_sla(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create SLA. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. - { - "description": "string", - "goals": [ + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.slas.post.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { - "duration_seconds": 0, - "escalation_policy": { - "steps": [ - { - "escalate_after_seconds": 0, - "notification_group_id": "string" - } - ] - }, - "type": "string" + "description": "string", + "goals": [ + { + "duration_seconds": 0, + "escalation_policy": { + "steps": [ + { + "escalate_after_seconds": 0, + "notification_group_id": "string" + } + ] + }, + "type": "string" + } + ], + "name": "string" } - ], - "name": "string" - } - description -- The description of the SLA. String. - goals -- The SLA goals. List of dictionaries. - name -- The name of the SLA. String. + description : str + The description of the SLA. + goals : list[dict] + The SLA goals. + name : str + The name of the SLA. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.slas.post.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = case_management_sla_payload(passed_keywords=kwargs) @@ -1148,38 +1436,47 @@ def create_sla(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Uni def update_sla(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update SLA. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. - { - "description": "string", - "goals": [ + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.slas.patch.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { - "duration_seconds": 0, - "escalation_policy": { - "steps": [ - { - "escalate_after_seconds": 0, - "notification_group_id": "string" - } - ] - }, - "type": "string" + "description": "string", + "goals": [ + { + "duration_seconds": 0, + "escalation_policy": { + "steps": [ + { + "escalate_after_seconds": 0, + "notification_group_id": "string" + } + ] + }, + "type": "string" + } + ], + "name": "string" } - ], - "name": "string" - } - description -- The description of the SLA. String. - goals -- The SLA goals. List of dictionaries. - name -- The name of the SLA. String. + description : str + The description of the SLA. + goals : list[dict] + The SLA goals. + name : str + The name of the SLA. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.slas.patch.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = case_management_sla_payload(passed_keywords=kwargs) @@ -1195,19 +1492,28 @@ def update_sla(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Uni def delete_sla(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete SLAs. - Keyword arguments: - ids -- Resource IDs. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.slas.delete.v1 + + Keyword arguments + ----------------- + ids : str or list[str] + Resource IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1221,21 +1527,30 @@ def delete_sla(self: object, *args, parameters: dict = None, **kwargs) -> Union[ def get_template_snapshots(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get template snapshots. - Keyword arguments: - ids -- Snapshot IDs. String or list of strings. - template_ids -- Retrieves the latest snapshot for all Template IDs. String or list of strings. - versions -- Retrieve a specific version of the template from the parallel array `template_ids`. - A value of zero will return the latest snapshot. Integer or list of Integers. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.template-snapshots.get.v1 + + Keyword arguments + ----------------- + ids : str or list[str] + Snapshot IDs. + template_ids : str or list[str] + Retrieves the latest snapshot for all Template IDs. + versions : str or list[str] + Retrieve a specific version of the template from the parallel array `template_ids`. + A value of zero will return the latest snapshot. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1249,20 +1564,29 @@ def get_template_snapshots(self: object, parameters: dict = None, **kwargs) -> U def export_templates(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Export templates to files in a zip archive. - Keyword arguments: - ids -- Template IDs. String or list of strings. - filter -- FQL filter expression. String. - format -- Export file format. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.templates_export.get.v1 + + Keyword arguments + ----------------- + ids : str or list[str] + Template IDs. + filter : str + FQL filter expression. + format : str + Export file format. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1276,19 +1600,27 @@ def export_templates(self: object, parameters: dict = None, **kwargs) -> Union[D def import_template(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Import a template from a file. - Keyword arguments: - file -- Local file. formData. - dry_run -- Run validation only. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.templates_import.post.v1 + + Keyword arguments + ----------------- + file : bytes + Local file. + dry_run : bool + Run validation only. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ file = kwargs.get("file", None) if file: @@ -1317,20 +1649,30 @@ def import_template(self: object, parameters: dict = None, **kwargs) -> Union[Di def get_templates(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get templates by ID. - Keyword arguments: - ids -- Resource IDs. String or list of strings. - with_has_access -- Evaluate FGAC and return has_access property. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.templates.get.v1 + + Keyword arguments + ----------------- + ids : str or list[str] + Resource IDs. + with_has_access : bool + Evaluate FGAC and return has_access property. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1344,41 +1686,51 @@ def get_templates(self: object, *args, parameters: dict = None, **kwargs) -> Uni def create_template(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create template. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. - { - "description": "string", - "fields": [ + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.templates.post.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { - "data_type": "string", - "default_value": "string", - "input_type": "string", - "multivalued": true, - "name": "string", - "options": [ - { - "value": "string" - } - ], - "required": true + "description": "string", + "fields": [ + { + "data_type": "string", + "default_value": "string", + "input_type": "string", + "multivalued": true, + "name": "string", + "options": [ + { + "value": "string" + } + ], + "required": true + } + ], + "name": "string", + "sla_id": "string" } - ], - "name": "string", - "sla_id": "string" - } - description -- The description of the template. String. - fields -- The fields required to create a template. List of dictionaries. - name -- The name of the template. String. - sla_id -- The ID of the SLA. String. + description : str + The description of the template. + fields : list[dict] + The fields required to create a template. + name : str + The name of the template. + sla_id : str + The ID of the SLA. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.templates.post.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = case_management_template_payload(passed_keywords=kwargs) @@ -1394,45 +1746,56 @@ def create_template(self: object, body: dict = None, **kwargs) -> Union[Dict[str def update_template(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update template. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. - { - "description": "string", - "fields": [ + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.templates.patch.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { - "data_type": "string", - "default_value": "string", - "id": "string", - "input_type": "string", - "multivalued": true, - "name": "string", - "options": [ - { + "description": "string", + "fields": [ + { + "data_type": "string", + "default_value": "string", + "id": "string", + "input_type": "string", + "multivalued": true, + "name": "string", + "options": [ + { + "id": "string", + "value": "string" + } + ], + "required": true + } + ], "id": "string", - "value": "string" - } - ], - "required": true + "name": "string", + "sla_id": "string" } - ], - "id": "string", - "name": "string", - "sla_id": "string" - } - description -- The description of the template. String. - fields -- The fields required to create a template. List of dictionaries. - id -- The ID of the template to update. String. - name -- The name of the template. String. - sla_id -- The ID of the SLA. String. + description : str + The description of the template. + fields : list[dict] + The fields required to create a template. + id : str + The ID of the template to update. + name : str + The name of the template. + sla_id : str + The ID of the SLA. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.templates.patch.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = case_management_template_payload(passed_keywords=kwargs) @@ -1448,19 +1811,28 @@ def update_template(self: object, body: dict = None, **kwargs) -> Union[Dict[str def delete_templates(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete templates. - Keyword arguments: - ids -- Resource IDs. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities.templates.delete.v1 + + Keyword arguments + ----------------- + ids : str or list[str] + Resource IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1474,21 +1846,31 @@ def delete_templates(self: object, *args, parameters: dict = None, **kwargs) -> def query_access_tags(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query access tags. - Keyword arguments: - filter -- FQL filter expression. String. - sort -- Sort expression. String. - limit -- Page size. Integer. - after -- Pagination token. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/queries.access-tags.get.v1 + + Keyword arguments + ----------------- + filter : str + FQL filter expression. + sort : str + Sort expression. + limit : int + Page size. + after : str + Pagination token. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1502,20 +1884,29 @@ def query_access_tags(self: object, parameters: dict = None, **kwargs) -> Union[ def query_fields(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query fields. - Keyword arguments: - filter -- FQL filter expression. String. - limit -- Page size. Integer. - offset -- Page offset. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/queries.fields.get.v1 + + Keyword arguments + ----------------- + filter : str + FQL filter expression. + limit : int + Page size. + offset : int + Page offset. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1532,21 +1923,31 @@ def query_notification_groups(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Query notification groups. - Keyword arguments: - filter -- FQL filter expression. String. - sort -- Sort expression. String. - limit -- Page size. Integer. - offset -- Page offset. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/queries.notification-groups.get.v1 + + Keyword arguments + ----------------- + filter : str + FQL filter expression. + sort : str + Sort expression. + limit : int + Page size. + offset : int + Page offset. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1563,21 +1964,31 @@ def query_notification_groups_v2(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Query notification groups. - Keyword arguments: - filter -- FQL filter expression. String. - sort -- Sort expression. String. - limit -- Page size. Integer. - offset -- Page offset. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/queries.notification-groups.get.v2 + + Keyword arguments + ----------------- + filter : str + FQL filter expression. + sort : str + Sort expression. + limit : int + Page size. + offset : int + Page offset. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1591,21 +2002,31 @@ def query_notification_groups_v2(self: object, def query_slas(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query SLAs. - Keyword arguments: - filter -- FQL filter expression. String. - sort -- Sort expression. String. - limit -- Page size. Integer. - offset -- Page offset. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/queries.slas.get.v1 + + Keyword arguments + ----------------- + filter : str + FQL filter expression. + sort : str + Sort expression. + limit : int + Page size. + offset : int + Page offset. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1622,20 +2043,29 @@ def query_template_snapshots(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Query template snapshots. - Keyword arguments: - filter -- FQL filter expression. String. - limit -- Page size. Integer. - offset -- Page offset. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/queries.template-snapshots.get.v1 + + Keyword arguments + ----------------- + filter : str + FQL filter expression. + limit : int + Page size. + offset : int + Page offset. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1649,21 +2079,31 @@ def query_template_snapshots(self: object, def query_templates(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query templates. - Keyword arguments: - filter -- FQL filter expression. String. - sort -- Sort expression. String. - limit -- Page size. Integer. - offset -- Page offset. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/queries.templates.get.v1 + + Keyword arguments + ----------------- + filter : str + FQL filter expression. + sort : str + Sort expression. + limit : int + Page size. + offset : int + Page offset. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1677,8 +2117,16 @@ def query_templates(self: object, parameters: dict = None, **kwargs) -> Union[Di def add_case_alert_evidence(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Add the given list of alert evidence to the specified case. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cases/entities.alert-evidence.post.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "alerts": [ { @@ -1687,17 +2135,17 @@ def add_case_alert_evidence(self: object, body: dict = None, **kwargs) -> Union[ ], "id": "string" } - alerts -- The alert IDs. String. - id -- The specified case ID. String. + alerts : list + The alert IDs. + id : str + The specified case ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cases/entities.alert-evidence.post.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = specified_case_payload(passed_keywords=kwargs) @@ -1713,25 +2161,33 @@ def add_case_alert_evidence(self: object, body: dict = None, **kwargs) -> Union[ def add_case_tags(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Add the given list of tags to the specified case. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cases/entities.case-tags.post.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "id": "string", "tags": [ "string" ] } - id -- The specified case ID. String. - tags -- The given list of tags. List of strings. + id : str + The specified case ID. + tags : str or list[str] + The given list of tags. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cases/entities.case-tags.post.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = specified_case_payload(passed_keywords=kwargs) @@ -1747,19 +2203,27 @@ def add_case_tags(self: object, body: dict = None, **kwargs) -> Union[Dict[str, def delete_case_tags(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Remove the specified tags from the specified case. - Keyword arguments: - id -- The ID of the case to remove tags from. String. - tag -- The tag to remove from the case. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cases/entities.case-tags.delete.v1 + + Keyword arguments + ----------------- + id : str + The ID of the case to remove tags from. + tag : str or list[str] + The tag to remove from the case. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1773,8 +2237,16 @@ def delete_case_tags(self: object, parameters: dict = None, **kwargs) -> Union[D def create_case(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create the given Case. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: PUT + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cases/entities.cases.put.v2 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "assigned_to_user_uuid": "string", "description": "string", @@ -1805,23 +2277,29 @@ def create_case(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Un "id": "string" } } - assigned_to_user_uuid -- UUID of the user to assign the case to. String. - description -- The description of the case. String. - evidence -- The case evidence info. Dictionary. - name -- The name of the case. String. - severity -- The severity level of the case. Integer. - status -- The current status of the case. String. - tags -- The tags to be attached to the case. List of strings. - template -- The template case to utilize. Dictionary. + assigned_to_user_uuid : str + UUID of the user to assign the case to. + description : str + The description of the case. + evidence : dict + The case evidence info. + name : str + The name of the case. + severity : int + The severity level of the case. + status : str + The current status of the case. + tags : str or list[str] + The tags to be attached to the case. + template : dict + The template case to utilize. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PUT - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cases/entities.cases.put.v2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = case_manage_payload(passed_keywords=kwargs) @@ -1837,22 +2315,30 @@ def create_case(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Un def get_cases(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve all Cases given their IDs. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cases/entities.cases.post.v2 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "ids": [ "string" ] } - This method only supports keywords for providing arguments. - Returns: dict object containing API response. - HTTP Method: POST + This method only supports keywords for providing arguments. - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cases/entities.cases.post.v2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = case_management_file_ids_payload(passed_keywords=kwargs) @@ -1868,8 +2354,16 @@ def get_cases(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Unio def update_case_fields(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update given fields on the specified case. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cases/entities.cases.patch.v2 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "expected_consistency_version": 0, "expected_version": 0, @@ -1895,21 +2389,23 @@ def update_case_fields(self: object, body: dict = None, **kwargs) -> Union[Dict[ }, "id": "string" } - expected_consistency_version -- The consistency version. Integer. - expected_version -- The version. Integer. - fields -- The updated given fields for the specified case. Dictionary. - id -- The specified case ID. String. - - parameters -- Full parameters payload dictionary. Not required if using other keywords. + expected_consistency_version : int + The consistency version. + expected_version : int + The version. + fields : dict + The updated given fields for the specified case. + id : str + The specified case ID. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cases/entities.cases.patch.v2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = update_case_payload(passed_keywords=kwargs) @@ -1925,8 +2421,16 @@ def update_case_fields(self: object, body: dict = None, **kwargs) -> Union[Dict[ def add_case_event_evidence(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Add the given list of event evidence to the specified case. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cases/entities.event-evidence.post.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "events": [ { @@ -1935,18 +2439,19 @@ def add_case_event_evidence(self: object, body: dict = None, **kwargs) -> Union[ ], "id": "string" } - events -- The event evidence field . List of dictionaries. - id -- The specified case ID. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + events : list[dict] + The event evidence field. + id : str + The specified case ID. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cases/entities.event-evidence.post.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = case_evidence_payload(passed_keywords=kwargs) @@ -1962,27 +2467,38 @@ def add_case_event_evidence(self: object, body: dict = None, **kwargs) -> Union[ def query_case_ids(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve all Cases IDs that match a given query. - Keyword arguments: - limit -- The maximum number of Cases to return in this response (default: 100; max: 10000). Integer. - Use this parameter together with the `offset` parameter to manage pagination of the results. - offset -- The first case to return, where `0` is the latest case. Integer. - Use with the `offset` parameter to manage pagination of results. - sort -- The field to sort on. Sort parameter takes the form . String. - The sorting fields can be any keyword field that is part of #domain.Case except for the text based fields. - If the fields are missing from the Cases, the service will fallback to its default ordering. - filter -- FQL filter expression. String. - Filter fields can be any keyword field that is part of #domain.Case. - q -- Search all Case metadata for the provided string. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cases/queries.cases.get.v1 + + Keyword arguments + ----------------- + limit : int + The maximum number of Cases to return in this response (default: 100; max: 10000). Integer. + Use this parameter together with the `offset` parameter to manage pagination of the results. + offset : int + The first case to return, where `0` is the latest case. Integer. + Use with the `offset` parameter to manage pagination of results. + sort : str + The field to sort on. Sort parameter takes the form . String. + The sorting fields can be any keyword field that is part of #domain.Case except for the text based fields. + If the fields are missing from the Cases, the service will fallback to its default ordering. + filter : str + FQL filter expression. String. + Filter fields can be any keyword field that is part of #domain.Case. + q : str + Search all Case metadata for the provided. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1992,6 +2508,49 @@ def query_case_ids(self: object, parameters: dict = None, **kwargs) -> Union[Dic params=parameters ) + @force_default(defaults=["body"], default_types=["dict"]) + def entities_merge_post_v1(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Merge a source case into a destination case. + + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/case-management/entities_merge_post_v1 + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "destination_id": "string", + "source_id": "string" + } + destination_id : str + The destination_id value. + source_id : str + The source_id value. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = entities_merge_post_v1_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="entities_merge_post_v1", + body=body + ) + aggregates_file_details_post_v1 = aggregates_file_details_post_v1 combined_file_details_get_v1 = query_file_details entities_file_details_get_v1 = get_file_details diff --git a/src/falconpy/case_management.pyi b/src/falconpy/case_management.pyi index a4d2de359..afce4d7f3 100644 --- a/src/falconpy/case_management.pyi +++ b/src/falconpy/case_management.pyi @@ -494,6 +494,14 @@ class CaseManagement(ServiceClass): parameters: Optional[dict] = None, ) -> Union[Dict[str, Union[int, dict]], Result]: ... + def entities_merge_post_v1( + self, + *, + destination_id: Optional[str] = None, + source_id: Optional[str] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + combined_file_details_get_v1 = query_file_details entities_file_details_get_v1 = get_file_details entities_file_details_patch_v1 = update_file_details diff --git a/src/falconpy/certificate_based_exclusions.py b/src/falconpy/certificate_based_exclusions.py index 1a659af20..5b14e89d3 100644 --- a/src/falconpy/certificate_based_exclusions.py +++ b/src/falconpy/certificate_based_exclusions.py @@ -61,19 +61,28 @@ class CertificateBasedExclusions(ServiceClass): def get_exclusions(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Find all exclusion IDs matching the query with filter. - Keyword arguments: - ids -- One or more exclusion IDs . String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/certificate-based-exclusions/cb-exclusions.get.v1 + + Keyword arguments + ----------------- + ids : str or list[str] + One or more exclusion IDs. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -87,8 +96,16 @@ def get_exclusions(self: object, *args, parameters: dict = None, **kwargs) -> Un def create_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create new Certificate Based Exclusions. - Keyword arguments: - body -- full body payload, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/certificate-based-exclusions/cb-exclusions.create.v1 + + Keyword arguments + ----------------- + body : dict + full body payload, not required if using other keywords. { "exclusions": [ { @@ -119,12 +136,11 @@ def create_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[s ] } - Returns: dict object containing API response. - - HTTP Method: POST - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/certificate-based-exclusions/cb-exclusions.create.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = certificate_based_exclusions_payload(passed_keywords=kwargs) @@ -145,20 +161,30 @@ def delete_exclusions(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a set of exclusions by specifying their IDs. - Keyword arguments: - ids -- List of exclusion IDs to delete. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - comment - The comment why these exclusions were deleted. String. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/certificate-based-exclusions/cb-exclusions.delete.v1 + + Keyword arguments + ----------------- + ids : str or list[str] + List of exclusion IDs to delete. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + comment : str + The comment why these exclusions were deleted. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -172,8 +198,16 @@ def delete_exclusions(self: object, def update_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update Certificate Based Exclusions. - Keyword arguments: - body -- full body payload, not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/certificate-based-exclusions/cb-exclusions.update.v1 + + Keyword arguments + ----------------- + body : dict + full body payload, not required if using other keywords. { "exclusions": [ { @@ -204,12 +238,11 @@ def update_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[s ] } - Returns: dict object containing API response. - - HTTP Method: PATCH - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/certificate-based-exclusions/cb-exclusions.update.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = certificate_based_exclusions_payload(passed_keywords=kwargs) @@ -225,18 +258,25 @@ def update_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[s def get_certificates(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve vulnerability and package related info for this customer. - Keyword arguments: - ids - The SHA256 Hash of the file to retrieve certificate signing info for. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/certificate-based-exclusions/certificates.get.v1 + + Keyword arguments + ----------------- + ids : str + The SHA256 Hash of the file to retrieve certificate signing info for. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -250,23 +290,33 @@ def get_certificates(self: object, parameters: dict = None, **kwargs) -> Union[D def query_certificates(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search for cert-based exclusions. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum records to return. [1-500]. Defaults to 100. - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by (e.g. alias.desc or state.asc). FQL syntax. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/certificate-based-exclusions/cb-exclusions.query.v1 + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum records to return. [1-500]. Defaults to 100. + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by (e.g. alias.desc or state.asc). FQL syntax. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/cloud_aws_registration.py b/src/falconpy/cloud_aws_registration.py index c574bff68..6c2251480 100644 --- a/src/falconpy/cloud_aws_registration.py +++ b/src/falconpy/cloud_aws_registration.py @@ -60,19 +60,27 @@ class CloudAWSRegistration(ServiceClass): def trigger_health_check(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Trigger health check scan for AWS accounts. - Keyword arguments: - account_ids -- AWS Account IDs. String or list of strings. - organization_ids -- Organization IDs. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-aws-registration/cloud-registration-aws-trigger-health-check + + Keyword arguments + ----------------- + account_ids : str or list[str] + AWS Account IDs. + organization_ids : str or list[str] + Organization IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ kwargs["organization-ids"] = kwargs.get("organization_ids", None) kwargs["account-ids"] = kwargs.get("account_ids", None) @@ -89,19 +97,27 @@ def trigger_health_check(self: object, parameters: dict = None, **kwargs) -> Uni def get_accounts(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve existing AWS accounts by account IDs OR organization IDs. - Keyword arguments: - ids -- AWS account IDs to filter. String or list of strings. - organization_ids -- AWS organization IDs to filter. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-aws-registration/cloud-registration-aws-get-accounts + + Keyword arguments + ----------------- + ids : str or list[str] + AWS account IDs to filter. + organization_ids : str or list[str] + AWS organization IDs to filter. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ kwargs["organization-ids"] = kwargs.get("organization_ids", None) @@ -117,8 +133,16 @@ def get_accounts(self: object, parameters: dict = None, **kwargs) -> Union[Dict[ def create_account(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create a new account. - Keyword arguments: - body -- Full body payload as a JSON dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-aws-registration/cloud-registration-aws-create-account + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON dictionary. Not required if using other keywords. { "resources": [ { @@ -138,29 +162,33 @@ def create_account(self: object, body: dict = None, **kwargs) -> Union[Dict[str, } ] } - account_id -- AWS account ID. String. - account_type -- AWS account type. String. - csp_events -- Flag indicating if CSP events should be included. Boolean. - is_master -- Flag indicating if this is a master account. Boolean. - organization_id -- AWS organization ID. String. - products -- List of included products and features. List of dictionaries. - [ - { - "features": [ - "string" - ], - "product": "string" - } - ] + account_id : str + AWS account ID. + account_type : str + AWS account type. + csp_events : bool + Flag indicating if CSP events should be included. + is_master : bool + Flag indicating if this is a master account. + organization_id : str + AWS organization ID. + products : list + List of included products and features. List of dictionaries. + [ + { + "features": [ + "string" + ], + "product": "string" + } + ] This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-aws-registration/cloud-registration-aws-create-account + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_aws_registration_payload(kwargs) @@ -176,8 +204,16 @@ def create_account(self: object, body: dict = None, **kwargs) -> Union[Dict[str, def update_account(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update an existing account. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-aws-registration/cloud-registration-aws-update-account + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "resources": [ { @@ -197,29 +233,33 @@ def update_account(self: object, body: dict = None, **kwargs) -> Union[Dict[str, } ] } - account_id -- AWS account ID. String. - account_type -- AWS account type. String. - csp_events -- Flag indicating if CSP events should be included. Boolean. - is_master -- Flag indicating if this is a master account. Boolean. - organization_id -- AWS organization ID. String. - products -- List of included products and features. List of dictionaries. - [ - { - "features": [ - "string" - ], - "product": "string" - } - ] + account_id : str + AWS account ID. + account_type : str + AWS account type. + csp_events : bool + Flag indicating if CSP events should be included. + is_master : bool + Flag indicating if this is a master account. + organization_id : str + AWS organization ID. + products : list + List of included products and features. List of dictionaries. + [ + { + "features": [ + "string" + ], + "product": "string" + } + ] This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-aws-registration/cloud-registration-aws-update-account + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_aws_registration_payload(kwargs) @@ -235,19 +275,27 @@ def update_account(self: object, body: dict = None, **kwargs) -> Union[Dict[str, def delete_account(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete an existing AWS account or organization. - Keyword arguments: - ids -- AWS account IDs to remove. String or list of strings. - organization_ids -- AWS organization IDs to remove. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-aws-registration/cloud-registration-aws-delete-account + + Keyword arguments + ----------------- + ids : str or list[str] + AWS account IDs to remove. + organization_ids : str or list[str] + AWS organization IDs to remove. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ kwargs["organization-ids"] = kwargs.get("organization_ids", None) return process_service_request( @@ -262,21 +310,30 @@ def delete_account(self: object, parameters: dict = None, **kwargs) -> Union[Dic def validate_accounts(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Validate the AWS account registration status, and discover organization child accounts if organization is specified. - Keyword arguments: - account_id -- AWS Account ID. organization-id shouldn't be specified if this is specified. String. - iam_role_arn -- IAM Role ARN. String. - organization_id -- AWS organization ID to validate master account. - account_id shouldn't be specified if this is specified. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-aws-registration/cloud-registration-aws-validate-accounts + + Keyword arguments + ----------------- + account_id : str + AWS Account ID. organization-id shouldn't be specified if this is specified. + iam_role_arn : str + IAM Role ARN. + organization_id : str + AWS organization ID to validate master account. + account_id shouldn't be specified if this is specified. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ kwargs["iam-role-arn"] = kwargs.get("iam_role_arn", None) kwargs["organization-id"] = kwargs.get("organization_id", None) @@ -293,25 +350,38 @@ def validate_accounts(self: object, parameters: dict = None, **kwargs) -> Union[ def query_accounts(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve existing AWS accounts by account IDs. - Keyword arguments: - organization_ids -- Organization IDs used to filter accounts. String or list of string. - products -- Products registered for an account. String or list of string. Required. - features -- Features registered for an account. String or list of string. Required. - account_status -- Account status to filter results by. String. - limit -- The maximum number of items to return. When not specified or 0, 100 is used. - When larger than 500, 500 is used. Integer. - offset -- The offset to start retrieving records from. Integer. - group_by -- Field to group by. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-aws-registration/cloud-registration-aws-query-accounts + + Keyword arguments + ----------------- + organization_ids : str or list[str] + Organization IDs used to filter accounts. + products : str or list[str] (required) + Products registered for an account. + features : str or list[str] (required) + Features registered for an account. + account_status : str + Account status to filter results by. + limit : int + The maximum number of items to return. When not specified or 0, 100 is used. + When larger than 500, 500 is used. + offset : int + The offset to start retrieving records from. + group_by : str + Field to group by. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ kwargs["organization-ids"] = kwargs.get("organization_ids", None) kwargs["account-status"] = kwargs.get("account_status", None) diff --git a/src/falconpy/cloud_azure_registration.py b/src/falconpy/cloud_azure_registration.py index 2565dc8e1..ca000cb77 100644 --- a/src/falconpy/cloud_azure_registration.py +++ b/src/falconpy/cloud_azure_registration.py @@ -67,8 +67,16 @@ class CloudAzureRegistration(ServiceClass): def delete_legacy_subscription(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete existing legacy Azure subscriptions. - Keyword arguments: - body -- Full body payload as a dictionary. Not required if using other keywords. + HTTP Method: DELETE + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-azure-registration/cloud-registration-azure-delete-legacy-subscription + + Keyword arguments + ----------------- + body : dict + Full body payload as a dictionary. Not required if using other keywords. { "resources": [ { @@ -78,18 +86,16 @@ def delete_legacy_subscription(self: object, body: dict = None, **kwargs) -> Uni } ] } - retain_client -- Boolean. - subscription_id -- String. - tenant_id -- String. + retain_client : bool + subscription_id : str + tenant_id : str This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: DELETE - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-azure-registration/cloud-registration-azure-delete-legacy-subscription + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_azure_registration_legacy_payload(passed_keywords=kwargs) @@ -105,19 +111,28 @@ def delete_legacy_subscription(self: object, body: dict = None, **kwargs) -> Uni def health_check(self: object, *args, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Trigger health check scan for Azure registrations. - Keyword arguments: - tenant_ids -- Azure tenant IDs. String or list of string. - body -- Full body payload as a dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'tenant_ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-azure-registration/cloud-registration-azure-trigger-health-check + + Keyword arguments + ----------------- + tenant_ids : str or list[str] + Azure tenant IDs. + body : dict + Full body payload as a dictionary. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'tenant_ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ kwargs = handle_single_argument(args, kwargs, "tenant_ids") if not body: @@ -134,19 +149,27 @@ def health_check(self: object, *args, body: dict = None, **kwargs) -> Union[Dict def get_registration(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve existing Azure registration for a tenant. - Keyword arguments: - tenant_id -- Tenant ID to retrieve. String. - registration_id -- Registration ID. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-azure-registration/cloud-registration-azure-get-registration + + Keyword arguments + ----------------- + tenant_id : str + Tenant ID to retrieve. + registration_id : str + Registration ID. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -163,8 +186,16 @@ def create_registration(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create an Azure registration for a tenant. - Keyword arguments: - body -- Full body payload as a JSON dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-azure-registration/cloud-registration-azure-create-registration + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON dictionary. Not required if using other keywords. { "resource": { "account_type": "string", @@ -228,40 +259,62 @@ def create_registration(self: object, "tenant_id": "string" } } - account_type -- Azure account type. String. - additional_features -- Additional features. List of dictionaries. - additional_properties -- Additional properties. Dictionary. - api_client_key_id -- Azure API client key ID. String. - api_client_key_type -- Azure API client key type. String. - cs_infra_region -- CrowdStrike infrastructure region. String. - cs_infra_subscription_id -- CrowdStrike infrastructure subscription ID. String. - deployment_method -- Deployment method. String. - deployment_stack_host_id -- Azure deployment stack host ID. String. - deployment_stack_name -- Azure deployment stack name. String. - dspm_regions -- DSPM regions. String or list of strings. - environment -- Azure environment. String. - event_hub_settings -- Azure Event Hub settings. List of dictionaries. - management_group_ids -- Azure management group IDs. String or list of strings. - microsoft_graph_permission_ids -- Microsoft Graph permission IDs. String or list of strings. - microsoft_graph_permissions_ids_readonly -- Flag indicating if Microsoft Graph permission IDs - are read-only. Boolean. - products -- Products. List of dictionaries. - resource_name_prefix -- Resource naming prefix. String. - resource_name_suffix -- Resource naming suffix. String. - status -- Registration status. String. - subscription_ids -- Azure subscription IDs. String or list of strings. - tags -- Additional tags. Dictionary. - template_version -- Deployment template version. String. - tenant_id -- Azure tenant ID. String. + account_type : str + Azure account type. + additional_features : list[dict] + Additional features. + additional_properties : dict + Additional properties. + api_client_key_id : str + Azure API client key ID. + api_client_key_type : str + Azure API client key type. + cs_infra_region : str + CrowdStrike infrastructure region. + cs_infra_subscription_id : str + CrowdStrike infrastructure subscription ID. + deployment_method : str + Deployment method. + deployment_stack_host_id : str + Azure deployment stack host ID. + deployment_stack_name : str + Azure deployment stack name. + dspm_regions : str or list[str] + DSPM regions. + environment : str + Azure environment. + event_hub_settings : list[dict] + Azure Event Hub settings. + management_group_ids : str or list[str] + Azure management group IDs. + microsoft_graph_permission_ids : str or list[str] + Microsoft Graph permission IDs. + microsoft_graph_permissions_ids_readonly : bool + Flag indicating if Microsoft Graph permission IDs + are read-only. + products : list[dict] + Products. + resource_name_prefix : str + Resource naming prefix. + resource_name_suffix : str + Resource naming suffix. + status : str + Registration status. + subscription_ids : str or list[str] + Azure subscription IDs. + tags : dict + Additional tags. + template_version : str + Deployment template version. + tenant_id : str + Azure tenant ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-azure-registration/cloud-registration-azure-create-registration + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_azure_registration_create_payload(passed_keywords=kwargs) @@ -277,8 +330,16 @@ def create_registration(self: object, def update_registration(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update an existing Azure registration for a tenant. - Keyword arguments: - body -- Full body payload as a JSON dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-azure-registration/cloud-registration-azure-delete-registration + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON dictionary. Not required if using other keywords. { "resource": { "account_type": "string", @@ -342,40 +403,62 @@ def update_registration(self: object, body: dict = None, **kwargs) -> Union[Dict "tenant_id": "string" } } - account_type -- Azure account type. String. - additional_features -- Additional features. List of dictionaries. - additional_properties -- Additional properties. Dictionary. - api_client_key_id -- Azure API client key ID. String. - api_client_key_type -- Azure API client key type. String. - cs_infra_region -- CrowdStrike infrastructure region. String. - cs_infra_subscription_id -- CrowdStrike infrastructure subscription ID. String. - deployment_method -- Deployment method. String. - deployment_stack_host_id -- Azure deployment stack host ID. String. - deployment_stack_name -- Azure deployment stack name. String. - dspm_regions -- DSPM regions. String or list of strings. - environment -- Azure environment. String. - event_hub_settings -- Azure Event Hub settings. List of dictionaries. - management_group_ids -- Azure management group IDs. String or list of strings. - microsoft_graph_permission_ids -- Microsoft Graph permission IDs. String or list of strings. - microsoft_graph_permissions_ids_readonly -- Flag indicating if Microsoft Graph permission IDs - are read-only. Boolean. - products -- Products. List of dictionaries. - resource_name_prefix -- Resource naming prefix. String. - resource_name_suffix -- Resource naming suffix. String. - status -- Registration status. String. - subscription_ids -- Azure subscription IDs. String or list of strings. - tags -- Additional tags. Dictionary. - template_version -- Deployment template version. String. - tenant_id -- Azure tenant ID. String. + account_type : str + Azure account type. + additional_features : list[dict] + Additional features. + additional_properties : dict + Additional properties. + api_client_key_id : str + Azure API client key ID. + api_client_key_type : str + Azure API client key type. + cs_infra_region : str + CrowdStrike infrastructure region. + cs_infra_subscription_id : str + CrowdStrike infrastructure subscription ID. + deployment_method : str + Deployment method. + deployment_stack_host_id : str + Azure deployment stack host ID. + deployment_stack_name : str + Azure deployment stack name. + dspm_regions : str or list[str] + DSPM regions. + environment : str + Azure environment. + event_hub_settings : list[dict] + Azure Event Hub settings. + management_group_ids : str or list[str] + Azure management group IDs. + microsoft_graph_permission_ids : str or list[str] + Microsoft Graph permission IDs. + microsoft_graph_permissions_ids_readonly : bool + Flag indicating if Microsoft Graph permission IDs + are read-only. + products : list[dict] + Products. + resource_name_prefix : str + Resource naming prefix. + resource_name_suffix : str + Resource naming suffix. + status : str + Registration status. + subscription_ids : str or list[str] + Azure subscription IDs. + tags : dict + Additional tags. + template_version : str + Deployment template version. + tenant_id : str + Azure tenant ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-azure-registration/cloud-registration-azure-delete-registration + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_azure_registration_create_payload(passed_keywords=kwargs) @@ -391,18 +474,25 @@ def update_registration(self: object, body: dict = None, **kwargs) -> Union[Dict def delete_registration(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete existing Azure registrations. - Keyword arguments: - tenant_ids -- Azure tenant IDs to be removed. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-azure-registration/cloud-registration-azure-delete-registration + + Keyword arguments + ----------------- + tenant_ids : str or list[str] + Azure tenant IDs to be removed. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -419,19 +509,25 @@ def deployment_script(self: object, parameters: dict = None, **kwargs) -> Union[ DECOMMISSIONED: This operation is no longer available in CrowdStrike's API. Calling this method will result in an error from the API. - - Keyword arguments: - tenant_id -- Azure tenant ID to retrieve deployment scripts for. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-azure-registration/download_azure_script + + Keyword arguments + ----------------- + tenant_id : str + Azure tenant ID to retrieve deployment scripts for. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -445,8 +541,16 @@ def deployment_script(self: object, parameters: dict = None, **kwargs) -> Union[ def download_script(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve script to create resources. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-azure-registration/cloud-registration-azure-download-script + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "resources": [ { @@ -454,16 +558,15 @@ def download_script(self: object, body: dict = None, **kwargs) -> Union[Dict[str } ] } - tenant_id -- Azure Tenant ID. String. + tenant_id : str + Azure Tenant ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-azure-registration/cloud-registration-azure-download-script + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_azure_registration_payload(kwargs) @@ -479,19 +582,27 @@ def download_script(self: object, body: dict = None, **kwargs) -> Union[Dict[str def validate_registration(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Validate an Azure registration by checking service principal, role assignments and deployment stack. - Keyword arguments: - tenant_id -- Azure tenant ID to be validated. String. - stack_name -- Azure deployment stack name to be validated. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-azure-registration/cloud-registration-azure-validate-registration + + Keyword arguments + ----------------- + tenant_id : str + Azure tenant ID to be validated. + stack_name : str + Azure deployment stack name to be validated. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -508,8 +619,16 @@ def cloud_registration_azure_create_suppressions(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create new issue suppression rules. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-azure-registration/cloud_registration_azure_create_suppressions + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "resources": [ { @@ -524,16 +643,15 @@ def cloud_registration_azure_create_suppressions(self: object, } ] } - resources -- The resources value. List. + resources : list + The resources value. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-azure-registration/cloud_registration_azure_create_suppressions + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_registration_azure_create_suppressions_payload(passed_keywords=kwargs) @@ -552,17 +670,23 @@ def cloud_registration_azure_delete_suppressions(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Remove/revoke suppression rules. - Keyword arguments: - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-azure-registration/cloud_registration_azure_delete_suppressions + + Keyword arguments + ----------------- + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -579,19 +703,27 @@ def cloud_registration_azure_get_issue_suppression_values_by_field(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve distinct filterable values for issue suppression fields. - Keyword arguments: - registration_id -- Registration ID to filter values by. String. - field -- Field to get values for. Available values: issue_name, entity_id, suppressed_by, created_at, reason. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-azure-registration/cloud_registration_azure_get_issue_suppression_values_by_field + + Keyword arguments + ----------------- + registration_id : str + Registration ID to filter values by. + field : str + Field to get values for. Available values: issue_name, entity_id, suppressed_by, created_at, reason. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -608,22 +740,31 @@ def cloud_registration_azure_get_issue_values_by_field(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve distinct filterable values for issue fields. - Keyword arguments: - registration_id -- Registration ID to filter values by. String. - filter -- FQL (Falcon Query Language) string for filtering results. Allowed filters are - name,issue,severity,category,impact,entity_type,entity_id,entity_name,status. String. - field -- Field to get values for. Available values: issue, name, severity, category, impact, entity_type, entity_id, - entity_name, status, feature. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-azure-registration/cloud_registration_azure_get_issue_values_by_field + + Keyword arguments + ----------------- + registration_id : str + Registration ID to filter values by. + filter : str + FQL (Falcon Query Language) string for filtering results. Allowed filters are + name,issue,severity,category,impact,entity_type,entity_id,entity_name,status. + field : str + Field to get values for. Available values: issue, name, severity, category, impact, entity_type, entity_id, + entity_name, status, feature. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -640,25 +781,37 @@ def cloud_registration_azure_get_issues(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve issues for Azure registrations. - Keyword arguments: - registration_id -- Registration ID. String. - filter -- FQL (Falcon Query Language) string for filtering results. Allowed filters are - name,issue,severity,category,impact,entity_type,entity_id,entity_name,status. String. - sort -- Field and direction for sorting results - allowed sort fields are - issue,name,severity,category,impact,entity_type,entity_id,entity_name,impacted_entities. String. - group_by -- Grouping method: 'name' (optional, default: ungrouped). Available values: name. String. - limit -- Maximum number of records to return (default: 100, max: 1000). Integer. - offset -- Starting index of result. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-azure-registration/cloud_registration_azure_get_issues + + Keyword arguments + ----------------- + registration_id : str + Registration ID. + filter : str + FQL (Falcon Query Language) string for filtering results. Allowed filters are + name,issue,severity,category,impact,entity_type,entity_id,entity_name,status. + sort : str + Field and direction for sorting results - allowed sort fields are + issue,name,severity,category,impact,entity_type,entity_id,entity_name,impacted_entities. + group_by : str + Grouping method: 'name' (optional, default: ungrouped). Available values: name. + limit : int + Maximum number of records to return (default: 100, max: 1000) + offset : int + Starting index of result. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -675,18 +828,25 @@ def cloud_registration_azure_get_script(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Download Azure deployment script (Terraform or Bicep). - Keyword arguments: - tenant_id -- Azure tenant ID. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-azure-registration/cloud_registration_azure_get_script + + Keyword arguments + ----------------- + tenant_id : str + Azure tenant ID. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -703,22 +863,31 @@ def cloud_registration_azure_get_script_versions(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve all available script versions with filtering and sorting. - Keyword arguments: - deployment_method -- Filter by deployment method (e.g., 'bicep-legacy', 'bicep-deployment-stack'). String. - sort -- Field and direction for sorting results - allowed sort fields are version,deployment_method,published_date - String. - limit -- Maximum number of records to return (default: 100, max: 1000). Integer. - offset -- Starting index of result. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-azure-registration/cloud_registration_azure_get_script_versions + + Keyword arguments + ----------------- + deployment_method : str + Filter by deployment method (e.g., 'bicep-legacy', 'bicep-deployment-stack') + sort : str + Field and direction for sorting results - allowed sort fields are version,deployment_method,published_date. + limit : int + Maximum number of records to return (default: 100, max: 1000) + offset : int + Starting index of result. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -735,24 +904,35 @@ def cloud_registration_azure_get_suppressions(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve existing suppression rules with filtering. - Keyword arguments: - registration_id -- Registration ID. String. - filter -- FQL (Falcon Query Language) string for filtering results. Allowed filters are - issue_name,entity_id,suppressed_by,created_at,reason. String. - sort -- Field and direction for sorting results - allowed sort fields are - issue_name,entity_id,suppressed_by,created_at,reason. String. - limit -- Maximum number of records to return (default: 100, max: 1000). Integer. - offset -- Starting index of result. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-azure-registration/cloud_registration_azure_get_suppressions + + Keyword arguments + ----------------- + registration_id : str + Registration ID. + filter : str + FQL (Falcon Query Language) string for filtering results. Allowed filters are + issue_name,entity_id,suppressed_by,created_at,reason. + sort : str + Field and direction for sorting results - allowed sort fields are + issue_name,entity_id,suppressed_by,created_at,reason. + limit : int + Maximum number of records to return (default: 100, max: 1000) + offset : int + Starting index of result. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -769,8 +949,16 @@ def cloud_registration_azure_update_suppressions(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update existing suppression rules. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-azure-registration/cloud_registration_azure_update_suppressions + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "resources": [ { @@ -779,16 +967,15 @@ def cloud_registration_azure_update_suppressions(self: object, } ] } - resources -- The resources value. List. + resources : list + The resources value. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-azure-registration/cloud_registration_azure_update_suppressions + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_registration_azure_update_suppressions_payload(passed_keywords=kwargs) diff --git a/src/falconpy/cloud_connect_aws.py b/src/falconpy/cloud_connect_aws.py index bee480ab8..51952c68a 100644 --- a/src/falconpy/cloud_connect_aws.py +++ b/src/falconpy/cloud_connect_aws.py @@ -62,23 +62,33 @@ def query_aws_accounts(self: object, parameters: dict = None, **kwargs) -> Union Returns a set of AWS accounts which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum records to return. [1-500]. Defaults to 100. - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by (e.g. alias.desc or state.asc). FQL syntax. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-connect-aws/QueryAWSAccounts + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum records to return. [1-500]. Defaults to 100. + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by (e.g. alias.desc or state.asc). FQL syntax. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -93,12 +103,20 @@ def get_aws_settings(self: object) -> Union[Dict[str, Union[int, dict]], Result] This method does not accept arguments or keywords. - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-connect-aws/GetAWSSettings + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -114,19 +132,28 @@ def get_aws_accounts(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve a set of AWS Accounts by specifying their IDs. - Keyword arguments: - ids -- List of AWS Account IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-connect-aws/GetAWSAccounts + + Keyword arguments + ----------------- + ids : str or list[str] + List of AWS Account IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -144,8 +171,16 @@ def provision_aws_accounts(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Provision AWS Accounts by specifying details about the accounts to provision. - Keyword arguments: - body -- full body payload, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-connect-aws/ProvisionAWSAccounts + + Keyword arguments + ----------------- + body : dict + full body payload, not required if using other keywords. { "resources": [ { @@ -159,25 +194,30 @@ def provision_aws_accounts(self: object, } ] } - cloudtrail_bucket_owner_id -- AWS IAM ID for bucket owner. String. - cloudtrail_bucket_region -- AWS region for bucket. String. - external_id -- AWS cross-account role secret. String. - iam_role_arn -- ARN used for cross-account role. String. - id -- AWS account ID. String. - mode -- Mode for provisioning. Allowed values are `manual` or `cloudformation`. - Defaults to `manual` if not defined. - parameters -- full parameters payload, not required if mode is provided as a keyword. - rate_limit_reqs -- Integer. - rate_limit_time -- Integer. + cloudtrail_bucket_owner_id : str + AWS IAM ID for bucket owner. + cloudtrail_bucket_region : str + AWS region for bucket. + external_id : str + AWS cross-account role secret. + iam_role_arn : str + ARN used for cross-account role. + id : str + AWS account ID. + mode : str + Mode for provisioning. Allowed values are `manual` or `cloudformation`. + Defaults to `manual` if not defined. + parameters : dict + full parameters payload, not required if mode is provided as a keyword. + rate_limit_reqs : int + rate_limit_time : int This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-connect-aws/ProvisionAWSAccounts + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = aws_registration_payload(passed_keywords=kwargs) @@ -199,19 +239,28 @@ def delete_aws_accounts(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a set of AWS Accounts by specifying their IDs. - Keyword arguments: - ids -- List of AWS Account IDs to delete. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-connect-aws/DeleteAWSAccounts + + Keyword arguments + ----------------- + ids : str or list[str] + List of AWS Account IDs to delete. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -225,8 +274,16 @@ def delete_aws_accounts(self: object, def update_aws_accounts(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update AWS Accounts by specifying the ID of the account and details to update. - Keyword arguments: - body -- full body payload, not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-connect-aws/UpdateAWSAccounts + + Keyword arguments + ----------------- + body : dict + full body payload, not required if using other keywords. { "resources": [ { @@ -240,22 +297,25 @@ def update_aws_accounts(self: object, body: dict = None, **kwargs) -> Union[Dict } ] } - cloudtrail_bucket_owner_id -- AWS IAM ID for bucket owner. String. - cloudtrail_bucket_region -- AWS region for bucket. String. - external_id -- AWS cross-account role secret. String. - iam_role_arn -- ARN used for cross-account role. String. - id -- AWS account ID. String. - rate_limit_reqs -- Integer. - rate_limit_time -- Integer. + cloudtrail_bucket_owner_id : str + AWS IAM ID for bucket owner. + cloudtrail_bucket_region : str + AWS region for bucket. + external_id : str + AWS cross-account role secret. + iam_role_arn : str + ARN used for cross-account role. + id : str + AWS account ID. + rate_limit_reqs : int + rate_limit_time : int This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-connect-aws/UpdateAWSAccounts + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = aws_registration_payload(passed_keywords=kwargs) @@ -274,8 +334,16 @@ def create_or_update_aws_settings(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create or update Global Settings which are applicable to all provisioned AWS accounts. - Keyword arguments: - body -- full body payload, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-connect-aws/CreateOrUpdateAWSSettings + + Keyword arguments + ----------------- + body : dict + full body payload, not required if using other keywords. { "resources": [ { @@ -284,17 +352,17 @@ def create_or_update_aws_settings(self: object, } ] } - cloudtrail_bucket_owner_id -- AWS IAM ID for bucket owner. String. - static_external_id -- AWS cross-account role secret. String. + cloudtrail_bucket_owner_id : str + AWS IAM ID for bucket owner. + static_external_id : str + AWS cross-account role secret. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-connect-aws/CreateOrUpdateAWSSettings + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = aws_registration_payload(passed_keywords=kwargs) @@ -315,20 +383,30 @@ def verify_aws_account_access(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Perform an Access Verification check on the specified AWS Account IDs. - Keyword arguments: - body -- full body payload, ignored by API. - ids -- List of AWS Account IDs to delete. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-connect-aws/VerifyAWSAccountAccess + + Keyword arguments + ----------------- + body : dict + full body payload, ignored by API. + ids : str or list[str] + List of AWS Account IDs to delete. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -348,23 +426,33 @@ def query_aws_accounts_for_ids(self: object, Returns a set of AWS account IDs which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum records to return. [1-500]. Defaults to 100. - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by (e.g. alias.desc or state.asc). FQL syntax. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-connect-aws/QueryAWSAccountsForIDs + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum records to return. [1-500]. Defaults to 100. + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by (e.g. alias.desc or state.asc). FQL syntax. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/cloud_google_cloud_registration.py b/src/falconpy/cloud_google_cloud_registration.py index 5b4b737bb..20aa9557b 100644 --- a/src/falconpy/cloud_google_cloud_registration.py +++ b/src/falconpy/cloud_google_cloud_registration.py @@ -62,29 +62,40 @@ def get_entities(self: object, parameters: dict = None, **kwargs) -> Union[Dict[ Supports FQL filtering, sorting, and pagination. - Keyword arguments: - ids -- Google Cloud Registration IDs to filter by. String or list of strings. - filter -- FQL (Falcon Query Language) string for filtering results. String. - Allowed filters: - entity_type entity_id entity_name - registration_id registration_name registration_scope - parent_id ioa_status iom_status - created updated - sort -- Field and direction for sorting results (e.g., 'created|desc'). String. - Sorting applies across all entity types before grouping. - limit -- Maximum number of records to return (default: 100, max: 500). Integer. - Limit applies across all entity types. - offset -- Starting index of result. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-google-cloud-registration/cloud-registration-gcp-get-entities + + Keyword arguments + ----------------- + ids : str or list[str] + Google Cloud Registration IDs to filter by. + filter : str + FQL (Falcon Query Language) string for filtering results. String. + Allowed filters: + entity_type entity_id entity_name + registration_id registration_name registration_scope + parent_id ioa_status iom_status + created updated + sort : str + Field and direction for sorting results (e.g., 'created|desc'). String. + Sorting applies across all entity types before grouping. + limit : int + Maximum number of records to return (default: 100, max: 500). Integer. + Limit applies across all entity types. + offset : int + Starting index of result. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -102,19 +113,28 @@ def trigger_health_check(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Trigger health check scan for GCP registrations. - Keyword arguments: - ids -- GCP Registration IDs. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-google-cloud-registration/cloud-registration-gcp-trigger-health-check + + Keyword arguments + ----------------- + ids : str or list[str] + GCP Registration IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -128,19 +148,28 @@ def trigger_health_check(self: object, def get_registration(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve a Google Cloud Registration. - Keyword arguments: - ids -- Google Cloud Registration ID. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-google-cloud-registration/cloud-registration-gcp-get-registration + + Keyword arguments + ----------------- + ids : str + Google Cloud Registration ID. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -154,8 +183,16 @@ def get_registration(self: object, *args, parameters: dict = None, **kwargs) -> def update_registration(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create a new Google Cloud Registration if one doesnt exist or update the existing Google Cloud Registration. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: PUT + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-google-cloud-registration/cloud-registration-gcp-put-registration + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "resources": [ { @@ -196,26 +233,35 @@ def update_registration(self: object, body: dict = None, **kwargs) -> Union[Dict } ] } - deployment_method -- The method of deployment. String. - entity_id -- The ID of the entity. String. - excluded_project_patterns -- Project patterns that should be excluded. List of Strings. - falcon_client_key_id -- API client key ID. String. - falcon_client_key_type -- API client key type. String. - infra_project_id -- Infrastructure project ID. String. - labels -- Prop labels. Dictionary. - products -- Products. List of dictionaries. - registration_name -- Registration name. String. - registration_scope -- Registration scope. String. - resource_name_prefix -- Resource name prefix. String. + deployment_method : str + The method of deployment. + entity_id : str or list[str] + The ID of the entity. + excluded_project_patterns : str or list[str] + Project patterns that should be excluded. + falcon_client_key_id : str + API client key ID. + falcon_client_key_type : str + API client key type. + infra_project_id : str + Infrastructure project ID. + labels : dict + Prop labels. + products : list[dict] + Products. + registration_name : str + Registration name. + registration_scope : str + Registration scope. + resource_name_prefix : str + Resource name prefix. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PUT - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-google-cloud-registration/cloud-registration-gcp-put-registration + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_google_registration_create_payload(passed_keywords=kwargs) @@ -234,8 +280,16 @@ def create_registration(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: # noqa: E501, pylint: disable=C0301 """Create a Google Cloud Registration. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-google-cloud-registration/cloud-registration-gcp-create-registration + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "resources": [ { @@ -276,26 +330,35 @@ def create_registration(self: object, } ] } - deployment_method -- The method of deployment. String. - entity_id -- The ID of the entity. String. - excluded_project_patterns -- Project patterns that should be excluded. List of Strings. - falcon_client_key_id -- API client key ID. String. - falcon_client_key_type -- API client key type. String. - infra_project_id -- Infrastructure project ID. String. - labels -- Prop labels. Dictionary. - products -- Products. List of dictionaries. - registration_name -- Registration name. String. - registration_scope -- Registration scope. String. - resource_name_prefix -- Resource name prefix. String. + deployment_method : str + The method of deployment. + entity_id : str or list[str] + The ID of the entity. + excluded_project_patterns : str or list[str] + Project patterns that should be excluded. + falcon_client_key_id : str + API client key ID. + falcon_client_key_type : str + API client key type. + infra_project_id : str + Infrastructure project ID. + labels : dict + Prop labels. + products : list[dict] + Products. + registration_name : str + Registration name. + registration_scope : str + Registration scope. + resource_name_prefix : str + Resource name prefix. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-google-cloud-registration/cloud-registration-gcp-create-registration + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_google_registration_create_payload(passed_keywords=kwargs) @@ -315,9 +378,18 @@ def cloud_registration_gcp_update_registration(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update a Google Cloud Registration. - Keyword arguments: - ids -- Google Cloud Registration ID. String. - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-google-cloud-registration/cloud-registration-gcp-update-registration + + Keyword arguments + ----------------- + ids : str + Google Cloud Registration ID. + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "resources": [ { @@ -358,27 +430,37 @@ def cloud_registration_gcp_update_registration(self: object, } ] } - deployment_method -- The method of deployment. String. - entity_id -- The ID of the entity. String. - excluded_project_patterns -- Project patterns that should be excluded. List of Strings. - falcon_client_key_id -- API client key ID. String. - falcon_client_key_type -- API client key type. String. - infra_project_id -- Infrastructure project ID. String. - labels -- Prop labels. Dictionary. - products -- Products. List of dictionaries. - registration_name -- Registration name. String. - registration_scope -- Registration scope. String. - resource_name_prefix -- Resource name prefix. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + deployment_method : str + The method of deployment. + entity_id : str or list[str] + The ID of the entity. + excluded_project_patterns : str or list[str] + Project patterns that should be excluded. + falcon_client_key_id : str + API client key ID. + falcon_client_key_type : str + API client key type. + infra_project_id : str + Infrastructure project ID. + labels : dict + Prop labels. + products : list[dict] + Products. + registration_name : str + Registration name. + registration_scope : str + Registration scope. + resource_name_prefix : str + Resource name prefix. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-google-cloud-registration/cloud-registration-gcp-update-registration + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_google_registration_create_payload(passed_keywords=kwargs) @@ -396,18 +478,24 @@ def cloud_registration_gcp_update_registration(self: object, def delete_registration(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a Google Cloud Registration and return the deleted registration in the response body. - Keyword arguments: - ids -- Google Cloud Registration ID. String - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- + + Keyword arguments + ----------------- + ids : str + Google Cloud Registration ID. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -424,8 +512,16 @@ def cloud_registration_gcp_post_terraform_script(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Generate Google Cloud Terraform deployment scripts (zip files). - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-google-cloud-registration/cloud_registration_gcp_post_terraform_script + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "resources": [ { @@ -450,16 +546,15 @@ def cloud_registration_gcp_post_terraform_script(self: object, } ] } - resources -- The resources value. List. + resources : list + The resources value. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-google-cloud-registration/cloud_registration_gcp_post_terraform_script + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_registration_gcp_post_terraform_script_payload(passed_keywords=kwargs) diff --git a/src/falconpy/cloud_google_cloud_registration.pyi b/src/falconpy/cloud_google_cloud_registration.pyi index 1c5ce5728..4a19bfb1f 100644 --- a/src/falconpy/cloud_google_cloud_registration.pyi +++ b/src/falconpy/cloud_google_cloud_registration.pyi @@ -126,6 +126,7 @@ class CloudGoogleCloudRegistration(ServiceClass): def cloud_registration_gcp_post_terraform_script( self, *, + dspm_settings: Optional[dict] = None, entity_id: Optional[Union[str, List[str]]] = None, excluded_project_patterns: Optional[Union[str, List[str]]] = None, falcon_client_key_id: Optional[str] = None, @@ -139,6 +140,7 @@ class CloudGoogleCloudRegistration(ServiceClass): resource_name_suffix: Optional[str] = None, tags: Optional[str] = None, vars_only: Optional[bool] = None, + vulnerability_scanning_settings: Optional[dict] = None, wif_project_id: Optional[str] = None, body: Optional[dict] = None, ) -> Union[Dict[str, Union[int, dict]], Result]: ... diff --git a/src/falconpy/cloud_oci_registration.py b/src/falconpy/cloud_oci_registration.py index 5982fb7f2..4f5579424 100644 --- a/src/falconpy/cloud_oci_registration.py +++ b/src/falconpy/cloud_oci_registration.py @@ -60,32 +60,43 @@ class CloudOCIRegistration(ServiceClass): def get_account(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve a list of OCI tenancies with support for FQL filtering, sorting, and pagination. - Keyword arguments: - filter -- FQL (Falcon Query Language) string for filtering results. String. - Allowed filters: - tenancy_name created_at - home_region updated_at - key_age tenancy_ocid - overall_status - sort -- Field and direction for sorting results. String. - Allowed sort fields: - tenancy_name created_at - home_region updated_at - key_age tenancy_ocid - overall_status - next_token -- Token for cursor-based pagination. String. Currently unsupported. - limit -- Maximum number of records to return. Integer. (default: 100, max: 10000) - offset -- Starting index of result. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-oci-registration/cloud-security-registration-oci-get-account + + Keyword arguments + ----------------- + filter : str + FQL (Falcon Query Language) string for filtering results. String. + Allowed filters: + tenancy_name created_at + home_region updated_at + key_age tenancy_ocid + overall_status + sort : str + Field and direction for sorting results. String. + Allowed sort fields: + tenancy_name created_at + home_region updated_at + key_age tenancy_ocid + overall_status + next_token : str + Token for cursor-based pagination. String. Currently unsupported. + limit : int + Maximum number of records to return. Integer. (default: 100, max: 10000) + offset : int + Starting index of result. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -99,8 +110,16 @@ def get_account(self: object, parameters: dict = None, **kwargs) -> Union[Dict[s def rotate_key(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Refresh key for the OCI tenancy. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-oci-registration/cloud-security-registration-oci-rotate-key + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "resources": [ { @@ -108,16 +127,15 @@ def rotate_key(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Uni } ] } - tenancy_ocid -- OCI tenancy ID. String. + tenancy_ocid : str + OCI tenancy ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-oci-registration/cloud-security-registration-oci-rotate-key + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_oci_refresh_payload(kwargs) @@ -133,8 +151,16 @@ def rotate_key(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Uni def validate_tenancy(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Validate the OCI account in CSPM for a provided CID. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-oci-registration/cloud-security-registration-oci-validate-tenancy + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "resources": [ { @@ -150,17 +176,17 @@ def validate_tenancy(self: object, body: dict = None, **kwargs) -> Union[Dict[st } ] } - products -- OCI products to validate. List of dictionaries. - tenancy_ocid -- OCI tenancy ID. String. + products : list[dict] + OCI products to validate. + tenancy_ocid : str + OCI tenancy ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-oci-registration/cloud-security-registration-oci-validate-tenancy + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_oci_validate_payload(kwargs) @@ -176,8 +202,16 @@ def validate_tenancy(self: object, body: dict = None, **kwargs) -> Union[Dict[st def create_account(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create an OCI tenancy account. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-oci-registration/cloud-security-registration-oci-create-account + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "resources": [ { @@ -204,22 +238,27 @@ def create_account(self: object, body: dict = None, **kwargs) -> Union[Dict[str, } ] } - group_name -- OCI group name. String. - home_region -- OCI home region. String. - policy_name -- Policy name. String. - products -- OCI products. List of dictionaries. - tenancy_ocid -- OCI tenancy ID. String. - user_email -- User email address. String. - user_name -- OCI user name. String. + group_name : str + OCI group name. + home_region : str + OCI home region. + policy_name : str + Policy name. + products : list[dict] + OCI products. + tenancy_ocid : str + OCI tenancy ID. + user_email : str + User email address. + user_name : str + OCI user name. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-oci-registration/cloud-security-registration-oci-create-account + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_oci_create_payload(kwargs) @@ -235,8 +274,16 @@ def create_account(self: object, body: dict = None, **kwargs) -> Union[Dict[str, def update_account(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update an existing OCI account. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-oci-registration/cloud-security-registration-oci-update-account + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "resources": [ { @@ -265,24 +312,31 @@ def update_account(self: object, body: dict = None, **kwargs) -> Union[Dict[str, } ] } - group_name -- OCI group name. String. - home_region -- OCI home region. String. - policy_name -- Policy name. String. - products -- OCI products. List of dictionaries. - stack_ocid -- OCI stack ID. String. - tenancy_ocid -- OCI tenancy ID. String. - user_email -- User email address. String. - user_name -- OCI user name. String. - user_ocid -- OCI user ID. String. + group_name : str + OCI group name. + home_region : str + OCI home region. + policy_name : str + Policy name. + products : list[dict] + OCI products. + stack_ocid : str + OCI stack ID. + tenancy_ocid : str + OCI tenancy ID. + user_email : str + User email address. + user_name : str + OCI user name. + user_ocid : str + OCI user ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-oci-registration/cloud-security-registration-oci-update-account + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_oci_create_payload(kwargs) @@ -302,19 +356,28 @@ def delete_account(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete an existing OCI tenancy. - Keyword arguments: - ids -- OCI tenancy OCIDs to remove. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-oci-registration/cloud-security-registration-oci-delete-account + + Keyword arguments + ----------------- + ids : str or list[str] + OCI tenancy OCIDs to remove. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -328,8 +391,16 @@ def delete_account(self: object, def download_script(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve script to create resources in tenancy OCID. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-oci-registration/cloud-security-registration-oci-download-script + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "resources": [ { @@ -339,18 +410,19 @@ def download_script(self: object, body: dict = None, **kwargs) -> Union[Dict[str } ] } - deployment_method -- Deployment method. String. - is_download -- Flag indicating if the script is intended for download. Boolean. - tenancy_ocid -- OCI tenancy ID. String. + deployment_method : str + Deployment method. + is_download : bool + Flag indicating if the script is intended for download. + tenancy_ocid : str + OCI tenancy ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-oci-registration/cloud-security-registration-oci-download-script + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_oci_refresh_payload(kwargs) diff --git a/src/falconpy/cloud_policies.py b/src/falconpy/cloud_policies.py index 8ec175da5..92d40029a 100644 --- a/src/falconpy/cloud_policies.py +++ b/src/falconpy/cloud_policies.py @@ -69,21 +69,33 @@ class CloudPolicies(ServiceClass): def get_rule_input_schema(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get rule input schema for given resource type. - Keyword arguments: - domain -- domain. String. - subdomain -- subdomain. String. - cloud_provider -- Cloud service provider for the resource type. String. - resource_type -- Selects the resource type for which to retrieve the rule input schema. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/GetRuleInputSchema + + Keyword arguments + ----------------- + domain : str + domain. + subdomain : str + subdomain. + cloud_provider : str + Cloud service provider for the resource type. + resource_type : str + Selects the resource type for which to retrieve the rule input schema. + enriched : bool + When true, returns the enriched schema with inlined related resource types. Defaults to true. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -101,24 +113,34 @@ def replace_control_rules(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Assign rules to a compliance control (full replace). - Keyword arguments: - ids -- The UUID of the compliance control to assign rules to. String or list of strings. - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PUT + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/ReplaceControlRules + + Keyword arguments + ----------------- + ids : str + The UUID of the compliance control to assign rules to. + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "rule_ids": [ "string" ] } - parameters -- Full parameters payload dictionary. Not required if using other keywords. - rule_ids -- The ids of the rules to replace. List of strings. - This method only supports keywords for providing arguments. + parameters : dict + Full parameters payload. Not required if using other keywords. + rule_ids : str or list[str] + The ids of the rules to replace. - Returns: dict object containing API response. - - HTTP Method: PUT + This method only supports keywords for providing arguments. - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/ReplaceControlRules + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_policies_rule_assign_payload(passed_keywords=kwargs) @@ -140,19 +162,28 @@ def get_compliance_controls(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get compliance controls by ID. - Keyword arguments: - ids -- The uuids of compliance controls to retrieve. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/GetComplianceControls + + Keyword arguments + ----------------- + ids : str or list[str] + The uuids of compliance controls to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -166,27 +197,37 @@ def get_compliance_controls(self: object, def create_compliance_control(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create a new custom compliance control. - Keyword arguments: - body -- Full body payload dictionary in JSON format. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/CreateComplianceControl + + Keyword arguments + ----------------- + body : dict + Full body payload dictionary in JSON format. Not required if using other keywords. { "description": "string", "framework_id": "string", "name": "string", "section_name": "string" } - description -- The description of hte custom compliance control. String. - framework_id -- The framework ID of the custom compliance control. String. - name -- The name of the custom compliance control. String. - section_name -- The section name of the custom compliance control. String. + description : str + The description of hte custom compliance control. + framework_id : str + The framework ID of the custom compliance control. + name : str + The name of the custom compliance control. + section_name : str + The section name of the custom compliance control. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/CreateComplianceControl + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_policies_compliance_control_payload(passed_keywords=kwargs) @@ -206,25 +247,35 @@ def update_compliance_control(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update a custom compliance control. - Keyword arguments: - ids -- The uuid of compliance control to update. String or list of strings. - body -- Full body payload dictionary in JSON format. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/UpdateComplianceControl + + Keyword arguments + ----------------- + ids : str + The uuid of compliance control to update. + body : dict + Full body payload dictionary in JSON format. Not required if using other keywords. { "description": "string", "name": "string" } - description -- The description of hte custom compliance control. String. - name -- The name of the custom compliance control. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + description : str + The description of hte custom compliance control. + name : str + The name of the custom compliance control. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/UpdateComplianceControl + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_policies_compliance_control_payload(passed_keywords=kwargs) @@ -246,19 +297,28 @@ def delete_compliance_control(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete custom compliance controls. - Keyword arguments: - ids -- The uuids of compliance control to delete. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/DeleteComplianceControl + + Keyword arguments + ----------------- + ids : str or list[str] + The uuids of compliance control to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -276,24 +336,34 @@ def rename_section_compliance_framework(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Rename a section in a custom compliance framework. - Keyword arguments: - ids -- The uuid of compliance framework containing the section to rename. String or list of strings. - sectionName -- The current name of the section to rename. String. - body -- Full body payload dictionary in JSON format. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/RenameSectionComplianceFramework + + Keyword arguments + ----------------- + ids : str + The uuid of compliance framework containing the section to rename. + sectionName : str + The current name of the section to rename. + body : dict + Full body payload dictionary in JSON format. Not required if using other keywords. { "section_name": "string" } - section_name -- The new section name of the custom compliance control. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + section_name : str + The new section name of the custom compliance control. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/RenameSectionComplianceFramework + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_policies_compliance_control_payload(passed_keywords=kwargs) @@ -315,19 +385,28 @@ def get_compliance_frameworks(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get compliance frameworks by ID. - Keyword arguments: - ids -- The uuids of compliance frameworks to retrieve. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/GetComplianceFrameworks + + Keyword arguments + ----------------- + ids : str or list[str] + The uuids of compliance frameworks to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -341,25 +420,34 @@ def get_compliance_frameworks(self: object, def create_compliance_framework(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create a new custom compliance framework. - Keyword arguments: - body -- Full body payload dictionary in JSON format. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/CreateComplianceFramework + + Keyword arguments + ----------------- + body : dict + Full body payload dictionary in JSON format. Not required if using other keywords. { "active": true, "description": "string", "name": "string" } - active -- Value to determine if the compliance framework will be active. Boolean. - description -- The description of the new compliance framework. String. - name -- The name of the new compliance framework. String. + active : bool + Value to determine if the compliance framework will be active. + description : str + The description of the new compliance framework. + name : str + The name of the new compliance framework. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/CreateComplianceFramework + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_policies_compliance_control_payload(passed_keywords=kwargs) @@ -379,27 +467,38 @@ def update_compliance_framework(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update a custom compliance framework. - Keyword arguments: - ids -- The uuids of compliance framework to update. String or list of strings. - body -- Full body payload dictionary in JSON format. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/UpdateComplianceFramework + + Keyword arguments + ----------------- + ids : str + The uuids of compliance framework to update. + body : dict + Full body payload dictionary in JSON format. Not required if using other keywords. { "active": true, "description": "string", "name": "string" } - active -- Value to determine if the compliance framework will be active. Boolean. - description -- The description of the new compliance framework. String. - name -- The name of the new compliance framework. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + active : bool + Value to determine if the compliance framework will be active. + description : str + The description of the new compliance framework. + name : str + The name of the new compliance framework. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/UpdateComplianceFramework + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_policies_compliance_control_payload(passed_keywords=kwargs) @@ -421,19 +520,28 @@ def delete_compliance_framework(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a custom compliance framework and all associated controls and rule assignments. - Keyword arguments: - ids -- The uuids of compliance framework to delete. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/DeleteComplianceFramework + + Keyword arguments + ----------------- + ids : str + The uuids of compliance framework to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -451,26 +559,38 @@ def get_enriched_asset(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get enriched assets that combine a primary resource with all its related resources. - Keyword arguments: - ids -- List of asset IDs (maximum 100 IDs allowed). String or list of strings. - domain -- Rule domain (Currently only used for KAC Rego rules). String. - subdomain -- Rule subdomain (Currently only used for KAC Rego rules). String. - resource_type -- Currently the Resource type field is only used when KAC Rules are specified vai Domain: Runtime & - Subdomain: IOM. For KAC rules, we return static sample data instead of real - assets b/c we don't have KAC payloads stored for customers. This field valued - selects what sample data resource type we return which the UI shows in the - Rego Editor to do test evaluations. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/GetEnrichedAsset + + Keyword arguments + ----------------- + ids : str or list[str] + List of asset IDs (maximum 100 IDs allowed) + domain : str + Rule domain (Currently only used for KAC Rego rules) + subdomain : str + Rule subdomain (Currently only used for KAC Rego rules) + resource_type : str + Currently the Resource type field is only used when KAC Rules are specified vai Domain: Runtime & + Subdomain: IOM. For KAC rules, we return static sample data instead of real + assets b/c we don't have KAC payloads stored for customers. This field valued + selects what sample data resource type we return which the UI shows in the + Rego Editor to do test evaluations. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -488,27 +608,39 @@ def get_evaluation_result(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get evaluation results based on the provided rule. - Keyword arguments: - cloud_provider -- Cloud Service Provider of the provided IDs. String. - resource_type -- Resource Type of the provided IDs. String. - ids -- List of assets to evaluate (maximum 100 IDs allowed). String or list of strings. - body -- Full body payload dictionary in JSON format. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/GetEvaluationResult + + Keyword arguments + ----------------- + cloud_provider : str + Cloud Service Provider of the provided IDs. + resource_type : str + Resource Type of the provided IDs. + ids : str or list[str] + List of assets to evaluate (maximum 100 IDs allowed) + body : dict + Full body payload dictionary in JSON format. Not required if using other keywords. { "input": {}, "logic": "string" } - input -- The input for the provided rule. Dictionary. - logic - The logic of the provided rule. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + input : dict + The input for the provided rule. + logic : str + The logic of the provided rule. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/GetEvaluationResult + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_policies_evaluation_payload(passed_keywords=kwargs) @@ -530,19 +662,28 @@ def get_rule_override(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get a rule override. - Keyword arguments: - ids -- The uuids of rule overrides to retrieve. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/GetRuleOverride + + Keyword arguments + ----------------- + ids : str or list[str] + The uuids of rule overrides to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -556,8 +697,16 @@ def get_rule_override(self: object, def create_rule_override(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create a new rule override. - Keyword arguments: - body -- Full body payload dictionary in JSON format. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/CreateRuleOverride + + Keyword arguments + ----------------- + body : dict + Full body payload dictionary in JSON format. Not required if using other keywords. { "overrides": [ { @@ -572,16 +721,15 @@ def create_rule_override(self: object, body: dict = None, **kwargs) -> Union[Dic } ] } - overrides -- The new rule override. List of dictionaries. + overrides : list[dict] + The new rule override. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/CreateRuleOverride + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_policies_rule_override_payload(passed_keywords=kwargs) @@ -597,8 +745,16 @@ def create_rule_override(self: object, body: dict = None, **kwargs) -> Union[Dic def update_rule_override(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update a rule override. - Keyword arguments: - body -- Full body payload dictionary in JSON format. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/UpdateRuleOverride + + Keyword arguments + ----------------- + body : dict + Full body payload dictionary in JSON format. Not required if using other keywords. { "overrides": [ { @@ -613,16 +769,15 @@ def update_rule_override(self: object, body: dict = None, **kwargs) -> Union[Dic } ] } - overrides -- The new rule override. List of dictionaries. + overrides : list[dict] + The new rule override. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/UpdateRuleOverride + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_policies_rule_override_payload(passed_keywords=kwargs) @@ -642,19 +797,28 @@ def delete_rule_override(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a rule override. - Keyword arguments: - ids -- The uuids of rule overrides to delete. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/DeleteRuleOverride + + Keyword arguments + ----------------- + ids : str or list[str] + The uuids of rule overrides to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -672,19 +836,28 @@ def get_rule(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get a rule by id. - Keyword arguments: - ids -- The uuids of rules to retrieve. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/GetRule + + Keyword arguments + ----------------- + ids : str or list[str] + The uuids of rules to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -698,16 +871,24 @@ def get_rule(self: object, def create_rule(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create a new rule. - Keyword arguments: - body -- Full body payload dictionary in JSON format. Not required if using other keywords. - Rule severity integer to provide maps to the following: - 0=Critical, 1=High, 2=Medium and 3=Low. - For CSPM IOM Custom Rules, logic is mandatory and - parent_rule_id should not be specified. - For Runtime IOM Custom Rules (KAC), logic is mandatory. - Fields controls, resource_type, and parent_rule_id should not be specified. - For Managed Rule duplication, parent_rule_id is mandatory - and logic should be not specified. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/CreateRuleMixin0 + + Keyword arguments + ----------------- + body : dict + Full body payload dictionary in JSON format. Not required if using other keywords. + Rule severity integer to provide maps to the following: + 0=Critical, 1=High, 2=Medium and 3=Low. + For CSPM IOM Custom Rules, logic is mandatory and + parent_rule_id should not be specified. + For Runtime IOM Custom Rules (KAC), logic is mandatory. + Fields controls, resource_type, and parent_rule_id should not be specified. + For Managed Rule duplication, parent_rule_id is mandatory + and logic should be not specified. { "alert_info": "string", "attack_types": "string", @@ -730,30 +911,43 @@ def create_rule(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Un "severity": 0, "subdomain": "string" } - alert_info -- The info of the alert. String. - attack_types -- The type of attacks. String. - controls -- The authority and code of the rule. List of dictionaries. - description -- The description of the rule. String. - domain -- The domain of the rule. String. - logic -- The logic for the rule. String. - name -- The name of the rule. String. - parent_rule_id -- The id of the parent. String. - platform -- The platform covered by the rule. String. - provider -- The provider for the rule. String. - remediation_info -- The remediation info provided by the rule. String. - remediation_url -- The URL providing the remediation. String. - resource_type -- The type of the resource. String. - severity -- The severity level. Integer. - subdomain -- The subdomain for the rule. String. + alert_info : str + The info of the alert. + attack_types : str + The type of attacks. + controls : list[dict] + The authority and code of the rule. + description : str + The description of the rule. + domain : str + The domain of the rule. + logic : str + The logic for the rule. + name : str + The name of the rule. + parent_rule_id : str + The id of the parent. + platform : str + The platform covered by the rule. + provider : str + The provider for the rule. + remediation_info : str + The remediation info provided by the rule. + remediation_url : str + The URL providing the remediation. + resource_type : str + The type of the resource. + severity : int + The severity level. + subdomain : str + The subdomain for the rule. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/CreateRuleMixin0 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_policies_rule_create_payload(passed_keywords=kwargs) @@ -769,8 +963,16 @@ def create_rule(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Un def update_rule(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update a rule. - Keyword arguments: - body -- Full body payload dictionary in JSON format. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/UpdateRule + + Keyword arguments + ----------------- + body : dict + Full body payload dictionary in JSON format. Not required if using other keywords. { "alert_info": "string", "attack_types": [ @@ -796,23 +998,29 @@ def update_rule(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Un "severity": 0, "uuid": "string" } - alert_info -- The info of the alert. String. - attack_types -- The type of attacks. List of strings. - controls -- The authority and code of the rule. List of dictionaries. - description -- The description of the rule. String. - name -- The name of the rule. String. - rule_logic_list -- The logic list data. List of dictionaries. - severity -- The severity level. Integer. - uuid -- The uuid of the rule to update. String. + alert_info : str + The info of the alert. + attack_types : str or list[str] + The type of attacks. + controls : list[dict] + The authority and code of the rule. + description : str + The description of the rule. + name : str + The name of the rule. + rule_logic_list : list[dict] + The logic list data. + severity : int + The severity level. + uuid : str + The uuid of the rule to update. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/UpdateRule + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_policies_rule_update_payload(passed_keywords=kwargs) @@ -832,19 +1040,28 @@ def delete_rule(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a rule. - Keyword arguments: - ids -- The uuids of rules to delete. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/DeleteRuleMixin0 + + Keyword arguments + ----------------- + ids : str or list[str] + The uuids of rules to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -861,31 +1078,41 @@ def query_compliance_controls(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Query for compliance controls by various parameters. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. String. - Allowed filter fields: - compliance_control_name compliance_control_authority - compliance_control_type compliance_control_section - compliance_control_requirement compliance_control_benchmark_name - compliance_control_benchmark_version - limit -- The maximum number of resources to return. The maximum allowed is 500. Integer. - offset -- The number of results to skip before starting to return results. Integer. - sort -- The sort expression that should be used to sort the results. String. - Use the '|asc' or '|desc' suffix to specify sort direction. - Sortable fields: - compliance_control_authority compliance_control_type - compliance_control_section compliance_control_requirement - compliance_control_benchmark_name compliance_control_benchmark_version - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/QueryComplianceControls + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. String. + Allowed filter fields: + compliance_control_name compliance_control_authority + compliance_control_type compliance_control_section + compliance_control_requirement compliance_control_benchmark_name + compliance_control_benchmark_version + limit : int + The maximum number of resources to return. The maximum allowed is 500. + offset : int + The number of results to skip before starting to return results. + sort : str + The sort expression that should be used to sort the results. String. + Use the '|asc' or '|desc' suffix to specify sort direction. + Sortable fields: + compliance_control_authority compliance_control_type + compliance_control_section compliance_control_requirement + compliance_control_benchmark_name compliance_control_benchmark_version + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -902,28 +1129,38 @@ def query_compliance_frameworks(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Query for compliance frameworks by various parameters. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. String. - Allowed filter fields: - compliance_framework_name compliance_framework_version - compliance_framework_authority - limit -- The maximum number of resources to return. The maximum allowed is 500. - offset -- The number of results to skip before starting to return results. - sort -- The sort expression that should be used to sort the results. String. - Use the '|asc' or '|desc' suffix to specify sort direction. - Sortable fields: - compliance_framework_name compliance_framework_version - compliance_framework_authority - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/QueryComplianceFrameworks + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. String. + Allowed filter fields: + compliance_framework_name compliance_framework_version + compliance_framework_authority + limit : int + The maximum number of resources to return. The maximum allowed is 500. + offset : int + The number of results to skip before starting to return results. + sort : str + The sort expression that should be used to sort the results. String. + Use the '|asc' or '|desc' suffix to specify sort direction. + Sortable fields: + compliance_framework_name compliance_framework_version + compliance_framework_authority + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -937,52 +1174,62 @@ def query_compliance_frameworks(self: object, def query_rule(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query for rules by various parameters. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. String. - Allowed filter fields: - rule_auto_remediable rule_mitre_tactic - rule_category rule_mitre_technique - rule_cloneable rule_name - rule_compliance_benchmark rule_origin - rule_compliance_benchmark_uuid rule_parent_uuid - rule_compliance_framework rule_provider - rule_control_requirement rule_resource_type - rule_control_section rule_resource_type_name - rule_created_at rule_risk_factor - rule_description rule_service - rule_domain rule_severity - rule_short_code rule_status - rule_subdomain rule_updated_at - rule_updated_by - limit -- The maximum number of resources to return. The maximum allowed is 500. - offset -- The number of results to skip before starting to return results. - sort -- The sort expression that should be used to sort the results. String. - Use the '|asc' or '|desc' suffix to specify sort direction. - Sortable fields: - rule_auto_remediable rule_mitre_tactic - rule_category rule_mitre_technique - rule_cloneable rule_name - rule_compliance_benchmark rule_origin - rule_compliance_benchmark_uuid rule_parent_uuid - rule_compliance_framework rule_provider - rule_control_requirement rule_resource_type - rule_control_section rule_resource_type_name - rule_created_at rule_risk_factor - rule_description rule_service - rule_domain rule_severity - rule_short_code rule_status - rule_subdomain rule_updated_at - rule_updated_by - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/QueryRule + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. String. + Allowed filter fields: + rule_auto_remediable rule_mitre_tactic + rule_category rule_mitre_technique + rule_cloneable rule_name + rule_compliance_benchmark rule_origin + rule_compliance_benchmark_uuid rule_parent_uuid + rule_compliance_framework rule_provider + rule_control_requirement rule_resource_type + rule_control_section rule_resource_type_name + rule_created_at rule_risk_factor + rule_description rule_service + rule_domain rule_severity + rule_short_code rule_status + rule_subdomain rule_updated_at + rule_updated_by + limit : int + The maximum number of resources to return. The maximum allowed is 500. + offset : int + The number of results to skip before starting to return results. + sort : str + The sort expression that should be used to sort the results. String. + Use the '|asc' or '|desc' suffix to specify sort direction. + Sortable fields: + rule_auto_remediable rule_mitre_tactic + rule_category rule_mitre_technique + rule_cloneable rule_name + rule_compliance_benchmark rule_origin + rule_compliance_benchmark_uuid rule_parent_uuid + rule_compliance_framework rule_provider + rule_control_requirement rule_resource_type + rule_control_section rule_resource_type_name + rule_created_at rule_risk_factor + rule_description rule_service + rule_domain rule_severity + rule_short_code rule_status + rule_subdomain rule_updated_at + rule_updated_by + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1000,19 +1247,28 @@ def get_suppression_rules(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get Suppression Rules by ID. - Keyword arguments: - ids -- The uuids of the suppression rules to retrieve. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/GetSuppressionRules + + Keyword arguments + ----------------- + ids : str or list[str] + The uuids of the suppression rules to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1026,8 +1282,16 @@ def get_suppression_rules(self: object, def create_suppression_rule(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create a new suppression rule. - Keyword arguments: - body -- Full body payload dictionary in JSON format. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/CreateSuppressionRule + + Keyword arguments + ----------------- + body : dict + Full body payload dictionary in JSON format. Not required if using other keywords. { "description": "string", "id": "string", @@ -1087,24 +1351,33 @@ def create_suppression_rule(self: object, body: dict = None, **kwargs) -> Union[ "suppression_expiration_date": "string", "suppression_reason": "string" } - description -- Description of the suppression rule. String. - domain -- Policy domain for the rule. String. - name -- Name of the suppression rule. String. - rule_selection_filter -- Filter criteria for selecting rules. Dictionary of lists. - rule_selection_type -- Type of rule selection. String. - scope_asset_filter -- Filter criteria for scoping assets. Dictionary of lists. - scope_type -- Type of scope for the rule. String. - subdomain -- Policy subdomain for the rule. String. - suppression_comment -- Comment explaining the suppression. String. - suppression_expiration_date -- Expiration date for the suppression. String. - suppression_reason -- Reason for the suppression. String. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/CreateSuppressionRule + description : str + Description of the suppression rule. + domain : str + Policy domain for the rule. + name : str + Name of the suppression rule. + rule_selection_filter : dict + Filter criteria for selecting rules. Dictionary of lists. + rule_selection_type : str + Type of rule selection. + scope_asset_filter : dict + Filter criteria for scoping assets. Dictionary of lists. + scope_type : str + Type of scope for the rule. + subdomain : str + Policy subdomain for the rule. + suppression_comment : str + Comment explaining the suppression. + suppression_expiration_date : str + Expiration date for the suppression. + suppression_reason : str + Reason for the suppression. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_policies_suppression_rule_payload(passed_keywords=kwargs) @@ -1120,8 +1393,16 @@ def create_suppression_rule(self: object, body: dict = None, **kwargs) -> Union[ def update_suppression_rule(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update a suppression rule. - Keyword arguments: - body -- Full body payload dictionary in JSON format. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/UpdateSuppressionRule + + Keyword arguments + ----------------- + body : dict + Full body payload dictionary in JSON format. Not required if using other keywords. { "description": "string", "id": "string", @@ -1181,23 +1462,31 @@ def update_suppression_rule(self: object, body: dict = None, **kwargs) -> Union[ "suppression_expiration_date": "string", "suppression_reason": "string" } - description -- Description of the suppression rule. String. - id -- Identifier of the suppression rule to update. String. - name -- Name of the suppression rule. String. - rule_selection_filter -- Filter criteria for selecting rules. Dictionary of lists. - rule_selection_type -- Type of rule selection. String. - scope_asset_filter -- Filter criteria for scoping assets. Dictionary of lists. - scope_type -- Type of scope for the rule. String. - suppression_comment -- Comment explaining the suppression. String. - suppression_expiration_date -- Expiration date for the suppression. String. - suppression_reason -- Reason for the suppression. String. - - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/UpdateSuppressionRule + description : str + Description of the suppression rule. + id : str + Identifier of the suppression rule to update. + name : str + Name of the suppression rule. + rule_selection_filter : dict + Filter criteria for selecting rules. Dictionary of lists. + rule_selection_type : str + Type of rule selection. + scope_asset_filter : dict + Filter criteria for scoping assets. Dictionary of lists. + scope_type : str + Type of scope for the rule. + suppression_comment : str + Comment explaining the suppression. + suppression_expiration_date : str + Expiration date for the suppression. + suppression_reason : str + Reason for the suppression. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_policies_suppression_rule_payload(passed_keywords=kwargs) @@ -1217,19 +1506,28 @@ def delete_suppression_rules(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete Suppression Rules by ID. - Keyword arguments: - ids -- The uuids of the suppression rules to delete. A maximum of 10 IDs can be provided. String or array of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/DeleteSuppressionRules + + Keyword arguments + ----------------- + ids : str or list[str] + The uuids of the suppression rules to delete. A maximum of 10 IDs can be provided. String or array of strings. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1243,33 +1541,42 @@ def delete_suppression_rules(self: object, def query_suppression_rules(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query suppression rules with filtering, sorting and pagination. - Keyword arguments: - filter -- FQL expression to filter suppression rules. String. - The allowed properties are: - name description domain - subdomain suppression_reason suppression_expiration_date - create_by created_at last_modified_at - disabled groups - - limit -- The maximum number of resources to return. The maximum allowed is 50. Integer. - offset -- The number of results to skip before starting to return results. Integer. - sort -- Field to sort on. String. - Sortable fields: - name description domain - subdomain suppression_reason suppression_expiration_date - create_by created_at last_modified_at - disabled groups - Use the `.asc` or `.desc` suffix to specify sort direction. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/QuerySuppressionRules + + Keyword arguments + ----------------- + filter : str + FQL expression to filter suppression rules. String. + The allowed properties are: + name description domain + subdomain suppression_reason suppression_expiration_date + create_by created_at last_modified_at + disabled groups + limit : int + The maximum number of resources to return. The maximum allowed is 50. + offset : int + The number of results to skip before starting to return results. + sort : str + Field to sort on. String. + Sortable fields: + name description domain + subdomain suppression_reason suppression_expiration_date + create_by created_at last_modified_at + disabled groups + Use the `.asc` or `.desc` suffix to specify sort direction. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1286,18 +1593,25 @@ def clone_compliance_framework(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Clone an existing compliance framework to create a custom copy. - Keyword arguments: - ids -- The uuid of the compliance framework to clone. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-policies/CloneComplianceFramework + + Keyword arguments + ----------------- + ids : str + The uuid of the compliance framework to clone. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/cloud_policies.pyi b/src/falconpy/cloud_policies.pyi index 4757e859c..6981bce78 100644 --- a/src/falconpy/cloud_policies.pyi +++ b/src/falconpy/cloud_policies.pyi @@ -13,6 +13,7 @@ class CloudPolicies(ServiceClass): subdomain: Optional[str] = None, cloud_provider: Optional[str] = None, resource_type: Optional[str] = None, + enriched: Optional[bool] = None, parameters: Optional[dict] = None, ) -> Union[Dict[str, Union[int, dict]], Result]: ... diff --git a/src/falconpy/cloud_security.py b/src/falconpy/cloud_security.py index 30e316d5a..1573a8fef 100644 --- a/src/falconpy/cloud_security.py +++ b/src/falconpy/cloud_security.py @@ -60,8 +60,16 @@ class CloudSecurity(ServiceClass): def combined_cloud_risks(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get cloud risks with full details based on filters and sort criteria. - Keyword arguments: - filter -- FQL string to filter results in Falcon Query Language (FQL). String. + HTTP Method: GET + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/%2Fcloud-security-risks/combined-cloud-risks + + Keyword arguments + ----------------- + filter : str + FQL string to filter results in Falcon Query Language (FQL). String. Supported fields: account_id account_name adversary asset_gcrn @@ -77,27 +85,28 @@ def combined_cloud_risks(self: object, parameters: dict = None, **kwargs) -> Uni status suppressed_by suppressed_reason tags threat_actors - - sort -- The field to sort on. Use |asc or |desc suffix to specify sort direction. String. + sort : str + The field to sort on. Use |asc or |desc suffix to specify sort direction. String. Supported fields: account_id account_name asset_id asset_name asset_region asset_type cloud_provider first_seen last_seen resolved_at rule_name service_category severity status - limit -- The maximum number of items to return. When not specified or 0, 500 is used. - When larger than 1000, 1000 is used. Integer. - offset -- Offset returned risks. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + limit : int + The maximum number of items to return. When not specified or 0, 500 is used. + When larger than 1000, 1000 is used. + offset : int + Offset returned risks. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: GET - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/%2Fcloud-security-risks/combined-cloud-risks + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -111,36 +120,44 @@ def combined_cloud_risks(self: object, parameters: dict = None, **kwargs) -> Uni def list_cloud_groups(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query Cloud Groups and returns entities. - Keyword arguments: - filter -- A valid FQL filter. String. Supports filtering groups by: - Group properties: - name description - created_at updated_at - - Selector properties: - cloud_provider account_id - region cloud_provider_tag - image_registry image_repository - image_tag - selector.kubernetes_resource.cluster - selector.kubernetes_resource.namespace - - Group tags: - business_unit business_impact - environment - sort -- A valid sort string. String. - offset -- The starting position of the list operation. Integer. - limit -- The maximum number of cloud groups to retrieve. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-security/ListCloudGroupsExternal + + Keyword arguments + ----------------- + filter : str + A valid FQL filter. String. Supports filtering groups by: + Group properties: + name description + created_at updated_at + Selector properties: + cloud_provider account_id + region cloud_provider_tag + image_registry image_repository + image_tag + selector.kubernetes_resource.cluster + selector.kubernetes_resource.namespace + Group tags: + business_unit business_impact + environment + sort : str + A valid sort. + offset : str + The starting position of the list operation. + limit : str + The maximum number of cloud groups to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -158,19 +175,28 @@ def list_cloud_groups_by_id(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """List Cloud Groups By ID. - Keyword arguments: - ids -- Cloud Groups UUIDs. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-security/ListCloudGroupsByIDExternal + + Keyword arguments + ----------------- + ids : str or list[str] + Cloud Groups UUIDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -187,65 +213,71 @@ def create_cloud_group(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create a Cloud Group. The created_by field will be set to the API client ID. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. - { - "business_impact": "high", - "business_unit": "string", - "description": "string", - "environment": "dev", - "name": "string", - "owners": [ - "string" - ], - "selectors": { - "cloud_resources": [ - { - "account_ids": [ - "string" - ], - "cloud_provider": "aws", - "filters": { - "region": [ - "string" - ], - "tags": [ - "string" - ] - } - } - ], - "images": [ - { - "filters": { - "repository": [ - "string" - ], - "tag": [ - "string" - ] - }, - "registry": "string" - } - ] - } - } - business_impact -- String. - business_unit -- String. - description -- String. - environment -- String. - name -- String. - owners -- List of strings. - selectors -- Dictionary. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-security/CreateCloudGroupExternal + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "business_impact": "high", + "business_unit": "string", + "description": "string", + "environment": "dev", + "name": "string", + "owners": [ + "string" + ], + "selectors": { + "cloud_resources": [ + { + "account_ids": [ + "string" + ], + "cloud_provider": "aws", + "filters": { + "region": [ + "string" + ], + "tags": [ + "string" + ] + } + } + ], + "images": [ + { + "filters": { + "repository": [ + "string" + ], + "tag": [ + "string" + ] + }, + "registry": "string" + } + ] + } + } + business_impact : str + business_unit : str + description : str + environment : str + name : str + owners : str or list[str] + selectors : dict + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_security_create_group_payload(passed_keywords=kwargs) @@ -264,65 +296,71 @@ def update_cloud_group(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update Cloud Group. - Keyword arguments: - group -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. - { - "business_impact": "high", - "business_unit": "string", - "description": "string", - "environment": "dev", - "name": "string", - "owners": [ + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-security/UpdateCloudGroupExternal + + Keyword arguments + ----------------- + group : str + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "business_impact": "high", + "business_unit": "string", + "description": "string", + "environment": "dev", + "name": "string", + "owners": [ + "string" + ], + "selectors": { + "cloud_resources": [ + { + "account_ids": [ "string" - ], - "selectors": { - "cloud_resources": [ - { - "account_ids": [ - "string" - ], - "cloud_provider": "aws", - "filters": { - "region": [ - "string" - ], - "tags": [ - "string" - ] - } - } ], - "images": [ - { - "filters": { - "repository": [ - "string" - ], - "tag": [ - "string" - ] - }, - "registry": "string" + "cloud_provider": "aws", + "filters": { + "region": [ + "string" + ], + "tags": [ + "string" + ] } - ] } + ], + "images": [ + { + "filters": { + "repository": [ + "string" + ], + "tag": [ + "string" + ] + }, + "registry": "string" + } + ] } - business_impact -- String. - business_unit -- String. - description -- String. - environment -- String. - name -- String. - owners -- List of strings. - selectors -- Dictionary. + } + business_impact : str + business_unit : str + description : str + environment : str + name : str + owners : str or list[str] + selectors : dict This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-security/UpdateCloudGroupExternal + Returns + ------- + dict + Dictionary object containing API response. """ if not group: group = cloud_security_create_group_payload(passed_keywords=kwargs) @@ -342,19 +380,28 @@ def delete_cloud_groups(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete Cloud Groups in batch. - Keyword arguments: - ids -- Cloud Groups UUIDs to delete. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-security/DeleteCloudGroupsExternal + + Keyword arguments + ----------------- + ids : str or list[str] + Cloud Groups UUIDs to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -368,36 +415,44 @@ def delete_cloud_groups(self: object, def list_group_ids(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query Cloud Groups and returns IDs. - Keyword arguments: - filter -- A valid FQL filter. String. Supports filtering groups by: - Group properties: - name description - created_at updated_at - - Selector properties: - cloud_provider account_id - region cloud_provider_tag - image_registry image_repository - image_tag - selector.kubernetes_resource.cluster - selector.kubernetes_resource.namespace - - Group tags: - business_unit business_impact - environment - sort -- A valid sort string. String. - offset -- The starting position of the list operation. Integer. - limit -- The maximum number of cloud groups to retrieve. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-security/ListCloudGroupIDsExternal + + Keyword arguments + ----------------- + filter : str + A valid FQL filter. String. Supports filtering groups by: + Group properties: + name description + created_at updated_at + Selector properties: + cloud_provider account_id + region cloud_provider_tag + image_registry image_repository + image_tag + selector.kubernetes_resource.cluster + selector.kubernetes_resource.namespace + Group tags: + business_unit business_impact + environment + sort : str + A valid sort. + offset : str + The starting position of the list operation. + limit : str + The maximum number of cloud groups to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/cloud_security_assets.py b/src/falconpy/cloud_security_assets.py index 5a1f7a9ee..b0eb6e597 100644 --- a/src/falconpy/cloud_security_assets.py +++ b/src/falconpy/cloud_security_assets.py @@ -63,23 +63,40 @@ def combined_application_findings(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get findings for an application resource with pagination. - Keyword arguments: - crn -- Deprecated: Use 'gcrn' instead. Application CRN. String. - gcrn -- Application GCRN. String. - type -- Finding type. String. - filter -- FQL string to filter findings. String. - offset -- Pagination offset. Integer. - limit -- Page size. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-security-assets/cloud-security-assets-combined-application-findings + + Keyword arguments + ----------------- + crn : str + Deprecated: Use 'gcrn' instead. Application CRN. + gcrn : str + Application GCRN. + type : str + Finding type. + filter : str + FQL string to filter findings. + offset : int + Pagination offset. + limit : int + Page size. + sort : str + Sort expression in the format field|direction (e.g. key|desc), where direction is + asc or desc. Sortable fields depend on the finding type. Currently supported for + packages: 'key' (package name and version) and 'vulnerabilities' (number of + vulnerabilities). + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -98,58 +115,70 @@ def get_combined_compliance_by_account(self: object, Results can be filtered and sorted. - Keyword arguments: - filter -- FQL string to filter on asset contents. String. - Filterable fields include: - account_id account_name - assessment_id business_impact - cloud_group cloud_label - cloud_label_id cloud_provider - cloud_scope compliant - control.benchmark.name control.benchmark.version - control.extension.status control.framework - control.name control.type - control.version environment - last_evaluated region - resource_gcrn resource_provider - resource_type resource_type_name - service service_category - severities tag_key - tag_value tags_string - sort -- FQL formatted sort expression. String. - Sort expression in format: field|direction (e.g., last_evaluated|desc). - Allowed sort fields: - account_id last_evaluated - account_name region - assessment_id resource_counts.compliant - cloud_provider resource_counts.non_compliant - control.benchmark.name resource_counts.total - control.benchmark.version resource_provider - control.framework resource_type - control.name resource_type_name - control.type service - control.version service_category - limit -- The maximum number of items to return. Integer. - When not specified or 0, 20 is used. When larger than 10000, 10000 is used. - offset -- Offset returned controls. Integer. - Use only one of 'offset' and 'after' parameter for paginating. - 'offset' can only be used on offsets < 10,000. - For paginating through the entire result set, use 'after' parameter. - after -- Token-based pagination position. String. - Use for paginating through an entire result set. - Use only one of 'offset' and 'after' parameters for paginating. - include_failing_iom_severity_counts -- Include counts of failing IOMs by severity level. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /cloud-security-assets/cloud-security-assets-combined-compliance-by-account-region-and-resource-type-get + /cloud-security-assets/cloud-security-assets-combined-compliance-by-account-region-and-resource-type-get + + Keyword arguments + ----------------- + filter : str + FQL string to filter on asset contents. String. + Filterable fields include: + account_id account_name + assessment_id business_impact + cloud_group cloud_label + cloud_label_id cloud_provider + cloud_scope compliant + control.benchmark.name control.benchmark.version + control.extension.status control.framework + control.name control.type + control.version environment + last_evaluated region + resource_gcrn resource_provider + resource_type resource_type_name + service service_category + severities tag_key + tag_value tags_string + sort : str + FQL formatted sort expression. String. + Sort expression in format: field|direction (e.g., last_evaluated|desc). + Allowed sort fields: + account_id last_evaluated + account_name region + assessment_id resource_counts.compliant + cloud_provider resource_counts.non_compliant + control.benchmark.name resource_counts.total + control.benchmark.version resource_provider + control.framework resource_type + control.name resource_type_name + control.type service + control.version service_category + limit : int + The maximum number of items to return. Integer. + When not specified or 0, 20 is used. When larger than 10000, 10000 is used. + offset : int + Offset returned controls. Integer. + Use only one of 'offset' and 'after' parameter for paginating. + 'offset' can only be used on offsets < 10,000. + For paginating through the entire result set, use 'after' parameter. + after : str + Token-based pagination position. String. + Use for paginating through an entire result set. + Use only one of 'offset' and 'after' parameters for paginating. + include_failing_iom_severity_counts : bool + Include counts of failing IOMs by severity level. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -163,20 +192,29 @@ def get_combined_compliance_by_account(self: object, def get_assets(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get raw resources based on the provided IDs. - Keyword arguments: - ids -- List of assets to return (maximum 100 IDs allowed). String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /cloud-security-assets/cloud-security-assets-entities-get + /cloud-security-assets/cloud-security-assets-entities-get + + Keyword arguments + ----------------- + ids : str or list[str] + List of assets to return (maximum 100 IDs allowed) + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -190,108 +228,119 @@ def get_assets(self: object, *args, parameters: dict = None, **kwargs) -> Union[ def query_assets(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get a list of resource IDs for the given parameters, filters and sort criteria. - Keyword arguments: - after -- Token-based pagination. Use for paginating through an entire result set. String. - Use only one of 'offset' and 'after' parameters for paginating. - filter -- FQL string to filter on asset contents. String. - Filterable fields include: - account_bitmap_token_64 account_id - account_name active - aspm.deployment_cloud_resource_id aspm.deployment_provider - aspm.deployment_type aspm.technologies - azure.resource_group azure.vm_id - business_impact cloud_group - cloud_label cloud_label_id - cloud_provider cloud_risks.rule - cloud_risks.severity cloud_risks.status - cloud_scope cluster_id - cluster_name compartment_ocid - compliant.benchmark_name compliant.benchmark_version - compliant.framework compliant.policy_id - compliant.requirement compliant.rule - compliant.section configuration.id - control.benchmark.name control.benchmark.version - control.framework control.requirement - control.type control.version - creation_time cve_ids - data_classifications.found data_classifications.label - data_classifications.label_id data_classifications.scanned - data_classifications.tag data_classifications.tag_id - environment exprt_ratings - first_seen highest_severity - id insights.boolean_value - insights.date_value insights.id - insights.integer_value insights.string_list_value - insights.string_value instance_id - instance_state ioa_count - iom_count legacy_resource_id - legacy_uuid managed_by - non_compliant.benchmark_name non_compliant.benchmark_version - non_compliant.framework non_compliant.policy_id - non_compliant.requirement non_compliant.rule - non_compliant.rule_name non_compliant.section - non_compliant.severity organization_Id - os_version platform_name - publicly_exposed region - resource_gcrn resource_id - resource_name resource_parent - resource_type resource_type_name - sensor_priority service - service_category severity - snapshot_detections ssm_managed - status tag_key - tag_value tags - tags_string tenant_id - updated_at vmware.guest_os_id - vmware.guest_os_version vmware.host_system_name - vmware.host_type vmware.instance_uuid - vmware.vm_host_name vmware.vm_tools_status - zone - sort -- The field to sort on. String. - Use `|asc` or `|desc` suffix to specify sort direction. - Sortable fields include: - account_id publicly_exposed - account_name region - active resource_id - cloud_provider resource_name - cloud_risks.open_risk_count resource_type - cluster_id resource_type_name - cluster_name service - creation_time service_category - data_classifications.found ssm_managed - data_classifications.scanned status - first_seen tenant_id - id updated_at - instance_id vmware.guest_os_id - instance_state vmware.guest_os_version - ioa_count vmware.host_system_name - iom_count vmware.host_type - managed_by vmware.instance_uuid - organization_Id vmware.vm_host_name - os_version vmware.vm_tools_status - platform_name zone - service_category tenancy_name - compartment_name tenancy_ocid - compartment_ocid tenancy_type - compartment_path aspm.deployment_cloud_resource_id - aspm.deployment_provider aspm.deployment_type - aspm.technologies publiclyExposedToTheInternet - publiclyExposedAccessRange publiclyExposedExposureMethod - limit -- The maximum number of items to return. Integer. - When not specified or 0, 500 is used. When larger than 1000, 1000 is used. - offset -- Offset returned assets. Use only one of 'offset' and 'after' parameter for paginating. Integer. - 'offset' can only be used on offsets < 10,000. - For paginating through the entire result set, use 'after' parameter. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-security-assets/cloud-security-assets-queries + + Keyword arguments + ----------------- + after : str + Token-based pagination. Use for paginating through an entire result set. String. + Use only one of 'offset' and 'after' parameters for paginating. + filter : str + FQL string to filter on asset contents. String. + Filterable fields include: + account_bitmap_token_64 account_id + account_name active + aspm.deployment_cloud_resource_id aspm.deployment_provider + aspm.deployment_type aspm.technologies + azure.resource_group azure.vm_id + business_impact cloud_group + cloud_label cloud_label_id + cloud_provider cloud_risks.rule + cloud_risks.severity cloud_risks.status + cloud_scope cluster_id + cluster_name compartment_ocid + compliant.benchmark_name compliant.benchmark_version + compliant.framework compliant.policy_id + compliant.requirement compliant.rule + compliant.section configuration.id + control.benchmark.name control.benchmark.version + control.framework control.requirement + control.type control.version + creation_time cve_ids + data_classifications.found data_classifications.label + data_classifications.label_id data_classifications.scanned + data_classifications.tag data_classifications.tag_id + environment exprt_ratings + first_seen highest_severity + id insights.boolean_value + insights.date_value insights.id + insights.integer_value insights.string_list_value + insights.string_value instance_id + instance_state ioa_count + iom_count legacy_resource_id + legacy_uuid managed_by + non_compliant.benchmark_name non_compliant.benchmark_version + non_compliant.framework non_compliant.policy_id + non_compliant.requirement non_compliant.rule + non_compliant.rule_name non_compliant.section + non_compliant.severity organization_Id + os_version platform_name + publicly_exposed region + resource_gcrn resource_id + resource_name resource_parent + resource_type resource_type_name + sensor_priority service + service_category severity + snapshot_detections ssm_managed + status tag_key + tag_value tags + tags_string tenant_id + updated_at vmware.guest_os_id + vmware.guest_os_version vmware.host_system_name + vmware.host_type vmware.instance_uuid + vmware.vm_host_name vmware.vm_tools_status + zone + sort : str + The field to sort on. String. + Use `|asc` or `|desc` suffix to specify sort direction. + Sortable fields include: + account_id publicly_exposed + account_name region + active resource_id + cloud_provider resource_name + cloud_risks.open_risk_count resource_type + cluster_id resource_type_name + cluster_name service + creation_time service_category + data_classifications.found ssm_managed + data_classifications.scanned status + first_seen tenant_id + id updated_at + instance_id vmware.guest_os_id + instance_state vmware.guest_os_version + ioa_count vmware.host_system_name + iom_count vmware.host_type + managed_by vmware.instance_uuid + organization_Id vmware.vm_host_name + os_version vmware.vm_tools_status + platform_name zone + service_category tenancy_name + compartment_name tenancy_ocid + compartment_ocid tenancy_type + compartment_path aspm.deployment_cloud_resource_id + aspm.deployment_provider aspm.deployment_type + aspm.technologies publiclyExposedToTheInternet + publiclyExposedAccessRange publiclyExposedExposureMethod + limit : int + The maximum number of items to return. Integer. + When not specified or 0, 500 is used. When larger than 1000, 1000 is used. + offset : int + Offset returned assets. Use only one of 'offset' and 'after' parameter for paginating. Integer. + 'offset' can only be used on offsets < 10,000. + For paginating through the entire result set, use 'after' parameter. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -308,23 +357,30 @@ def cloud_security_assets_entities_post(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get raw resources based on IDs in the request body. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-security-assets/cloud_security_assets_entities_post + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "ids": [ "string" ] } - ids -- The ids value. List. + ids : str or list[str] + The ids value. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-security-assets/cloud_security_assets_entities_post + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cloud_security_assets_entities_post_payload(passed_keywords=kwargs) diff --git a/src/falconpy/cloud_security_assets.pyi b/src/falconpy/cloud_security_assets.pyi index 2b68b80f0..25bcc7348 100644 --- a/src/falconpy/cloud_security_assets.pyi +++ b/src/falconpy/cloud_security_assets.pyi @@ -15,6 +15,7 @@ class CloudSecurityAssets(ServiceClass): filter: Optional[str] = None, offset: Optional[int] = None, limit: Optional[int] = None, + sort: Optional[str] = None, parameters: Optional[dict] = None, ) -> Union[Dict[str, Union[int, dict]], Result]: ... diff --git a/src/falconpy/cloud_security_compliance.py b/src/falconpy/cloud_security_compliance.py index aacc5d633..24c3e96cc 100644 --- a/src/falconpy/cloud_security_compliance.py +++ b/src/falconpy/cloud_security_compliance.py @@ -63,29 +63,39 @@ def framework_posture_summaries(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get sections and requirements with scores for benchmarks. - Keyword arguments: - filter -- FQL formatted filter to limit returned results. String. - Allowed values: - account_id account_name - business_impact cloud_label - cloud_label_id cloud_provider - environment groups - region resource_type - resource_type_name tag_key - tag_value tags_string - ids -- The UUIDs of compliance frameworks to retrieve (maximum 20 IDs allowed). String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /cloud-security-compliance/cloud-compliance-framework-posture-summaries + /cloud-security-compliance/cloud-compliance-framework-posture-summaries + + Keyword arguments + ----------------- + filter : str + FQL formatted filter to limit returned results. String. + Allowed values: + account_id account_name + business_impact cloud_label + cloud_label_id cloud_provider + environment groups + region resource_type + resource_type_name tag_key + tag_value tags_string + ids : str or list[str] + The UUIDs of compliance frameworks to retrieve (maximum 20 IDs allowed) + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -103,29 +113,39 @@ def rule_posture_summaries(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get compliance score and counts for rules. - Keyword arguments: - filter -- FQL formatted filter to limit returned results. String. - Allowed values: - account_id account_name - business_impact cloud_label - cloud_label_id cloud_provider - environment groups - region resource_type - resource_type_name tag_key - tag_value tags_string - ids -- The uuids of compliance rules to retrieve (maximum 350 IDs allowed). - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /cloud-security-compliance/cloud-compliance-rule-posture-summaries + /cloud-security-compliance/cloud-compliance-rule-posture-summaries + + Keyword arguments + ----------------- + filter : str + FQL formatted filter to limit returned results. String. + Allowed values: + account_id account_name + business_impact cloud_label + cloud_label_id cloud_provider + environment groups + region resource_type + resource_type_name tag_key + tag_value tags_string + ids : str or list[str] + The uuids of compliance rules to retrieve (maximum 350 IDs allowed). + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/cloud_security_detections.py b/src/falconpy/cloud_security_detections.py index 06199b909..b5e075a12 100644 --- a/src/falconpy/cloud_security_detections.py +++ b/src/falconpy/cloud_security_detections.py @@ -37,6 +37,7 @@ """ from typing import Dict, Union from ._util import force_default, process_service_request, handle_single_argument +from ._payload import cspm_evaluations_iom_entities_post_payload from ._result import Result from ._service_class import ServiceClass from ._endpoint._cloud_security_detections import _cloud_security_detections_endpoints as Endpoints @@ -62,53 +63,63 @@ def get_combined_iom_by_rule(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Return IOMs grouped by rule. - Keyword arguments: - filter -- FQL string to filter results. String. - Supported fields: - account_id account_name - applicable_profile attack_type - benchmark_name benchmark_version - business_impact cid - cloud_group cloud_label - cloud_label_id cloud_provider - cloud_scope created_at - environment extension_status - first_detected framework - last_detected policy_id - policy_name region - requirement resource_gcrn - resource_id resource_parent - resource_status resource_type - resource_type_name rule_group - rule_id rule_name - rule_origin section - service service_category - severity status - suppressed_by tactic_id - tactic_name tag_key - tag_value tags - tags_string technique_id - technique_name tenant_id - zone - sort -- The field to sort on. String. - Sortable fields: - assessed_assets cloud_provider - misconfigurations rule_id - severity - Use |asc or |desc suffix to specify sort direction. - limit -- The maximum number of items to return. When not specified or 0, 500 is used. - When larger than 1000, 1000 is used. Integer. - offset -- Offset returned assets. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-security-detections/cspm-evaluations-combined-iom-by-rule + + Keyword arguments + ----------------- + filter : str + FQL string to filter results. String. + Supported fields: + account_id account_name + applicable_profile attack_type + benchmark_name benchmark_version + business_impact cid + cloud_group cloud_label + cloud_label_id cloud_provider + cloud_scope created_at + environment extension_status + first_detected framework + last_detected policy_id + policy_name region + requirement resource_gcrn + resource_id resource_parent + resource_status resource_type + resource_type_name rule_group + rule_id rule_name + rule_origin section + service service_category + severity status + suppressed_by tactic_id + tactic_name tag_key + tag_value tags + tags_string technique_id + technique_name tenant_id + zone + sort : str + The field to sort on. String. + Sortable fields: + assessed_assets cloud_provider + misconfigurations rule_id + severity + Use |asc or |desc suffix to specify sort direction. + limit : int + The maximum number of items to return. When not specified or 0, 500 is used. + When larger than 1000, 1000 is used. + offset : int + Offset returned assets. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -126,20 +137,29 @@ def get_iom_entities(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get IOMs based on the provided IDs. - Keyword arguments: - ids -- List of IOMs to return (maximum 100 IDs allowed). - Use POST method with same path if more entities are required. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-security-detections/cspm-evaluations-iom-entities + + Keyword arguments + ----------------- + ids : str or list[str] (required) + List of IOMs to return (maximum 100 IDs allowed). + Use POST method with same path if more entities are. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -153,79 +173,88 @@ def get_iom_entities(self: object, def query_iom_entities(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get a list of IOM IDs for the given parameters, filters and sort criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. String. - Allowed filter fields: - account_id account_name - applicable_profile attack_type - benchmark_name benchmark_version - business_impact cid - cloud_group cloud_label - cloud_label_id cloud_provider - cloud_scope created_at - environment extension_status - first_detected framework - last_detected policy_id - policy_name policy_uuid - region requirement - requirement_name resource_gcrn - resource_id resource_parent - resource_status resource_type - resource_type_name rule_group - rule_id rule_name - rule_origin rule_remediation - section service - service_category severity - status suppressed_by - suppression_reason tactic_id - tactic_name tag_key - tag_value tags - tags_string technique_id - technique_name tenant_id - - sort -- The field to sort on. Use |asc or |desc suffix to specify sort direction. String. Supported fields: - account_id account_name - applicable_profile attack_type - benchmark_name benchmark_version - business_impact cid - cloud_group cloud_label - cloud_label_id cloud_provider - cloud_scope created_at - environment extension_status - first_detected framework - last_detected policy_id - policy_name policy_uuid - region requirement - requirement_name resource_gcrn - resource_id resource_parent - resource_status resource_type - resource_type_name rule_group - rule_id rule_name - rule_origin rule_remediation - section service - service_category severity - status suppressed_by - suppression_reason tactic_id - tactic_name tag_key - tag_value tags - tags_string technique_id - technique_name tenant_id - - limit -- The maximum number of items to return. When not specified or 0, 500 is used. - When larger than 1000, 1000 is used. Integer. - offset -- Offset returned assets. Integer. - after -- token-based pagination. Use for paginating through an entire result set. - Use only one of 'offset' and 'after' parameters for paginating. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-security-detections/cspm-evaluations-iom-queries + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. String. + Allowed filter fields: + account_id account_name + applicable_profile attack_type + benchmark_name benchmark_version + business_impact cid + cloud_group cloud_label + cloud_label_id cloud_provider + cloud_scope created_at + environment extension_status + first_detected framework + last_detected policy_id + policy_name policy_uuid + region requirement + requirement_name resource_gcrn + resource_id resource_parent + resource_status resource_type + resource_type_name rule_group + rule_id rule_name + rule_origin rule_remediation + section service + service_category severity + status suppressed_by + suppression_reason tactic_id + tactic_name tag_key + tag_value tags + tags_string technique_id + technique_name tenant_id + sort : str + The field to sort on. Use |asc or |desc suffix to specify sort direction. String. Supported fields: + account_id account_name + applicable_profile attack_type + benchmark_name benchmark_version + business_impact cid + cloud_group cloud_label + cloud_label_id cloud_provider + cloud_scope created_at + environment extension_status + first_detected framework + last_detected policy_id + policy_name policy_uuid + region requirement + requirement_name resource_gcrn + resource_id resource_parent + resource_status resource_type + resource_type_name rule_group + rule_id rule_name + rule_origin rule_remediation + section service + service_category severity + status suppressed_by + suppression_reason tactic_id + tactic_name tag_key + tag_value tags + tags_string technique_id + technique_name tenant_id + limit : int + The maximum number of items to return. When not specified or 0, 500 is used. + When larger than 1000, 1000 is used. + offset : int + Offset returned assets. + after : str + token-based pagination. Use for paginating through an entire result set. + Use only one of 'offset' and 'after' parameters for paginating. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -235,6 +264,48 @@ def query_iom_entities(self: object, parameters: dict = None, **kwargs) -> Union params=parameters ) + @force_default(defaults=["body"], default_types=["dict"]) + def cspm_evaluations_iom_entities_post(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Get IOMs based on IDs in the request body. + + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-security-detections/cspm_evaluations_iom_entities_post + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "ids": [ + "string" + ] + } + ids : list + The ids value. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = cspm_evaluations_iom_entities_post_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="cspm_evaluations_iom_entities_post", + body=body + ) + cspm_evaluations_combined_iom_by_rule = get_combined_iom_by_rule cspm_evaluations_iom_entities = get_iom_entities cspm_evaluations_iom_queries = query_iom_entities diff --git a/src/falconpy/cloud_security_detections.pyi b/src/falconpy/cloud_security_detections.pyi index 7a4c7c9cd..beb2946d6 100644 --- a/src/falconpy/cloud_security_detections.pyi +++ b/src/falconpy/cloud_security_detections.pyi @@ -34,6 +34,13 @@ class CloudSecurityDetections(ServiceClass): parameters: Optional[dict] = None, ) -> Union[Dict[str, Union[int, dict]], Result]: ... + def cspm_evaluations_iom_entities_post( + self, + *, + ids: Optional[Union[str, List[str]]] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + cspm_evaluations_combined_iom_by_rule = get_combined_iom_by_rule cspm_evaluations_iom_entities = get_iom_entities cspm_evaluations_iom_queries = query_iom_entities diff --git a/src/falconpy/cloud_security_registration_combined.py b/src/falconpy/cloud_security_registration_combined.py index e45823e54..cce5d45cb 100644 --- a/src/falconpy/cloud_security_registration_combined.py +++ b/src/falconpy/cloud_security_registration_combined.py @@ -63,8 +63,16 @@ def cloud_registration_cross_provider_get_account_aggregates(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Return cross-provider account aggregates by status. - Keyword arguments: - body -- Full body payload as a JSON formatted list. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-security-registration-combined/cloud_registration_cross_provider_get_account_aggregates + + Keyword arguments + ----------------- + body : list + Full body payload as a JSON formatted list. Not required if using other keywords. [ { "date_ranges": [ @@ -99,29 +107,41 @@ def cloud_registration_cross_provider_get_account_aggregates(self: object, "type": "string" } ] - date_ranges -- List of date range objects. List of dictionaries. - field -- The field to aggregate on. String. - filter -- FQL filter expression. String. - interval -- Time interval for aggregation. String. - min_doc_count -- Minimum document count threshold. Integer. - missing -- Missing value handling. String. - name -- Name of the aggregation. String. - q -- Full text search across all metadata fields. String. - ranges -- List of range objects. List of dictionaries. - size -- Maximum number of results. Integer. - sort -- Sort expression. String. - sub_aggregates -- List of sub-aggregate expressions. List of strings. - time_zone -- Time zone for date operations. String. - type -- Type of aggregation (terms, date_histogram, etc.). String. + date_ranges : list[dict] + List of date range objects. + field : str + The field to aggregate on. + filter : str + FQL filter expression. + interval : str + Time interval for aggregation. + min_doc_count : int + Minimum document count threshold. + missing : str + Missing value handling. + name : str + Name of the aggregation. + q : str + Full text search across all metadata fields. + ranges : list[dict] + List of range objects. + size : int + Maximum number of results. + sort : str + Sort expression. + sub_aggregates : list[str] + List of sub-aggregate expressions. + time_zone : str + Time zone for date operations. + type : str + Type of aggregation (terms, date_histogram, etc.) This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-security-registration-combined/cloud_registration_cross_provider_get_account_aggregates + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] diff --git a/src/falconpy/cloud_security_risks.py b/src/falconpy/cloud_security_risks.py index b02bd44ce..767b1d82e 100644 --- a/src/falconpy/cloud_security_risks.py +++ b/src/falconpy/cloud_security_risks.py @@ -63,19 +63,28 @@ def cloud_security_timeline_risks_enriched(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Return the enriched asset timeline. - Keyword arguments: - id -- The GCRN (Global Cloud Resource Name) of the asset String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-security-risks/cloud_security_timeline_risks_enriched + + Keyword arguments + ----------------- + id : str + The GCRN (Global Cloud Resource Name) of the asset. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/cloud_snapshots.py b/src/falconpy/cloud_snapshots.py index c3a0be89a..c4b6dca31 100644 --- a/src/falconpy/cloud_snapshots.py +++ b/src/falconpy/cloud_snapshots.py @@ -63,39 +63,49 @@ class CloudSnapshots(ServiceClass): def search_detections(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search IaC Detections using a query in Falcon Query Language. - Keyword arguments: - filter -- Search IaC detections using a query in Falcon Query Language (FQL). String. - Supported filters: - detection_uuid file_name - last_detected platform - project_name project_owner - project_ref provider - resource_name rule_category - rule_name rule_type - rule_uuid service - severity - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - sort -- Fields to sort the records on. String - Supported columns: - detection_uuid file_name - last_detected platform - project_name project_owner - project_ref provider - resource_name rule_category - rule_name rule_type - rule_uuid service - severity - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspg-iacapi/CombinedDetections + + Keyword arguments + ----------------- + filter : str + Search IaC detections using a query in Falcon Query Language (FQL). String. + Supported filters: + detection_uuid file_name + last_detected platform + project_name project_owner + project_ref provider + resource_name rule_category + rule_name rule_type + rule_uuid service + severity + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + sort : str + Fields to sort the records on. String + Supported columns: + detection_uuid file_name + last_detected platform + project_name project_owner + project_ref provider + resource_name rule_category + rule_name rule_type + rule_uuid service + severity + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -109,32 +119,42 @@ def search_detections(self: object, parameters: dict = None, **kwargs) -> Union[ def search_scan_jobs(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search for snapshot jobs identified by the provided filter. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - Available sort fields: - account_id region - asset_identifier status - cloud_provider - limit -- The upper-bound on the number of records to retrieve. - Use with the offset parameter to manage pagination of results. - offset -- The offset from where to begin. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. last_behavior|asc). - Available sort fields: - account_id last_updated_timestamp - asset_identifier region - cloud_provider status - instance_type - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-snapshots/ReadDeploymentsCombined + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Available sort fields: + account_id region + asset_identifier status + cloud_provider + limit : int + The upper-bound on the number of records to retrieve. + Use with the offset parameter to manage pagination of results. + offset : int + The offset from where to begin. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. last_behavior|asc). + Available sort fields: + account_id last_updated_timestamp + asset_identifier region + cloud_provider status + instance_type + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -148,19 +168,28 @@ def search_scan_jobs(self: object, parameters: dict = None, **kwargs) -> Union[D def get_scan_jobs(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve snapshot jobs identified by the provided IDs. - Keyword arguments: - parameters -- full parameters payload, not required if using other keywords. - ids -- ID(s) of the snapshots to retrieve. String or list of strings. Max: 100 - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-snapshots/ReadDeploymentsEntities + + Keyword arguments + ----------------- + parameters : dict + Full parameters payload. Not required if using other keywords. + ids : str or list[str] + ID(s) of the snapshots to retrieve. String or list of strings. Max: 100 + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -174,31 +203,41 @@ def get_scan_jobs(self: object, *args, parameters: dict = None, **kwargs) -> Uni def launch_scan_job(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Launch a snapshot scan for a given cloud asset. - Keyword arguments: - account_id -- Cloud provider account ID. String. - asset_identifier -- Cloud asset identifier. String. - body - full body payload in JSON format, not required if using other keywords. - { - "resources": [ - { - "account_id": "string", - "asset_identifier": "string", - "cloud_provider": "string", - "region": "string" - } - ] - } - cloud_provider -- Cloud provider ID. String. - region -- Cloud provider region ID. String. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-snapshots/CreateDeploymentEntity + + Keyword arguments + ----------------- + account_id : str + Cloud provider account ID. + asset_identifier : str + Cloud asset identifier. + body : dict + full body payload in JSON format, not required if using other keywords. + { + "resources": [ + { + "account_id": "string", + "asset_identifier": "string", + "cloud_provider": "string", + "region": "string" + } + ] + } + cloud_provider : str + Cloud provider ID. + region : str + Cloud provider region ID. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = snapshot_launch_payload(passed_keywords=kwargs) @@ -215,19 +254,28 @@ def launch_scan_job(self: object, body: dict = None, **kwargs) -> Union[Dict[str def get_scan_reports(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve the scan report for an instance. - Keyword arguments: - parameters -- full parameters payload, not required if using other keywords. - ids -- The instance identifiers to fetch reports for. String or list of strings. Max: 100 - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-snapshots/GetScanReport + + Keyword arguments + ----------------- + parameters : dict + Full parameters payload. Not required if using other keywords. + ids : str or list[str] + The instance identifiers to fetch reports for. String or list of strings. Max: 100 + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -246,15 +294,15 @@ def get_credentials(self: object) -> Union[Dict[str, Union[int, dict]], Result]: https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-snapshots/GetCredentialsMixin0 Keyword arguments - ---- + ----------------- This method does not accept keyword arguments. Arguments - ---- + --------- This method does not accept arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -270,19 +318,19 @@ def get_iac_credentials(self: object) -> Union[Dict[str, Union[int, dict]], Resu HTTP Method: GET Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspg-iacapi/GetCredentialsMixin0 Keyword arguments - ---- + ----------------- This method does not accept keyword arguments. Arguments - ---- + --------- This method does not accept arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -296,43 +344,56 @@ def get_iac_credentials(self: object) -> Union[Dict[str, Union[int, dict]], Resu def register_account(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create inventory from data received from a snapshot. - Keyword arguments: - body - full body payload in JSON format, not required if using other keywords. - { - "aws_accounts": [ - { - "account_number": "string", - "batch_regions": [ - { - "job_definition_name": "string", - "job_queue": "string", - "region": "string" - } - ], - "iam_external_id": "string", - "iam_role_arn": "string", - "kms_alias": "string", - "processing_account": "string" - } - ] - } - aws_accounts -- Complete list of AWS accounts to register. List of dictionaries. - Overrides any values specified below. - account_number -- AWS account number. String - batch_regions -- Region the batch is executed. List of dictionaries. - iam_external_id -- The external ID of the IAM account used. String. - iam_role_arn -- The AWS ARN for the IAM account used. String. - kms_alias -- The KMS alias for the IAM account used. String. - processing_account -- The name of the processing account. String. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-snapshots/RegisterCspmSnapshotAccount + + Keyword arguments + ----------------- + body : dict + full body payload in JSON format, not required if using other keywords. + { + "aws_accounts": [ + { + "account_number": "string", + "batch_regions": [ + { + "job_definition_name": "string", + "job_queue": "string", + "region": "string" + } + ], + "iam_external_id": "string", + "iam_role_arn": "string", + "kms_alias": "string", + "processing_account": "string" + } + ] + } + aws_accounts : list + Complete list of AWS accounts to register. List of dictionaries. + Overrides any values specified below. + account_number : str + AWS account number. + batch_regions : list[dict] + Region the batch is executed. + iam_external_id : str + The external ID of the IAM account used. + iam_role_arn : str + The AWS ARN for the IAM account used. + kms_alias : str + The KMS alias for the IAM account used. + processing_account : str + The name of the processing account. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = snapshot_registration_payload(passed_keywords=kwargs) diff --git a/src/falconpy/configuration_assessment.py b/src/falconpy/configuration_assessment.py index 128d5bd10..f47495312 100644 --- a/src/falconpy/configuration_assessment.py +++ b/src/falconpy/configuration_assessment.py @@ -64,33 +64,44 @@ def query_combined_assessments(self: object, Returns a set of HostFinding entities which match the filter criteria - Keyword arguments: - after -- A pagination token used with the `limit` parameter to manage pagination of - results. On your first request, do not provide an `after` token. On subsequent - requests, provide the `after` token from the previous response to continue - from that place in the results. String. - limit -- The number of items to return in this response (default: 100, max: 5000). - Use with the after parameter to manage pagination of results. String. - sort -- Sort assessment by their properties. String. - Sort examples: created_timestamp|desc, updated_timestamp|asc - filter -- Filter items using a query in Falcon Query Language (FQL). String. - Wildcards * are unsupported. - Filter examples: - created_timestamp:>'2019-11-25T22:36:12Z' - updated_timestamp:>'2019-11-25T22:36:12Z' - aid:'1a2345b67c8d90e12f3af456789b0123' - facet -- Select various details blocks to be returned for each assessment entity. String. - Supported values: host, finding.rule, finding.evaluation_logic - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/configuration-assessment/getCombinedAssessmentsQuery + + Keyword arguments + ----------------- + after : str + A pagination token used with the `limit` parameter to manage pagination of + results. On your first request, do not provide an `after` token. On subsequent + requests, provide the `after` token from the previous response to continue + from that place in the results. + limit : int + The number of items to return in this response (default: 100, max: 5000). + Use with the after parameter to manage pagination of results. + sort : str + Sort assessment by their properties. String. + Sort examples: created_timestamp|desc, updated_timestamp|asc + filter : str + Filter items using a query in Falcon Query Language (FQL). String. + Wildcards * are unsupported. + Filter examples: + created_timestamp:>'2019-11-25T22:36:12Z' + updated_timestamp:>'2019-11-25T22:36:12Z' + aid:'1a2345b67c8d90e12f3af456789b0123' + facet : str or list[str] + Select various details blocks to be returned for each assessment entity. String. + Supported values: host, finding.rule, finding.evaluation_logic + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -108,19 +119,28 @@ def get_rule_details(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get rules details for provided one or more rule IDs. - Keyword arguments: - ids -- One or more rules IDs (max: 400). String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/configuration-assessment/getRuleDetails + + Keyword arguments + ----------------- + ids : str or list[str] + One or more rules IDs (max: 400) + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/configuration_assessment_evaluation_logic.py b/src/falconpy/configuration_assessment_evaluation_logic.py index e07e794ed..9043728fb 100644 --- a/src/falconpy/configuration_assessment_evaluation_logic.py +++ b/src/falconpy/configuration_assessment_evaluation_logic.py @@ -65,20 +65,29 @@ def get_evaluation_logic(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get details on evaluation logic items by providing one or more finding IDs. - Keyword arguments: - ids -- One or more evaluation logic finding IDs. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /configuration-assessment-evaluation-logic/getEvaluationLogicMixin0 + /configuration-assessment-evaluation-logic/getEvaluationLogicMixin0 + + Keyword arguments + ----------------- + ids : str or list[str] + One or more evaluation logic finding IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/container_alerts.py b/src/falconpy/container_alerts.py index 5178d3019..c16a7c833 100644 --- a/src/falconpy/container_alerts.py +++ b/src/falconpy/container_alerts.py @@ -63,20 +63,29 @@ def read_counts_by_severity(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get container alert counts by severity. - Keyword arguments: - filter -- Search Container Alerts using a query in Falcon Query Language (FQL). String. - Supported filters: cid, container_id, last_seen - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-alerts/ReadContainerAlertsCountBySeverity + + Keyword arguments + ----------------- + filter : str + Search Container Alerts using a query in Falcon Query Language (FQL). String. + Supported filters: cid, container_id, last_seen + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -90,20 +99,29 @@ def read_counts_by_severity(self: object, def read_counts(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search Container Alerts by the provided search criteria. - Keyword arguments: - filter -- Search Container Alerts using a query in Falcon Query Language (FQL). String. - Supported filters: cid, container_id, last_seen - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-alerts/ReadContainerAlertsCount + + Keyword arguments + ----------------- + filter : str + Search Container Alerts using a query in Falcon Query Language (FQL). String. + Supported filters: cid, container_id, last_seen + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -117,22 +135,32 @@ def read_counts(self: object, *args, parameters: dict = None, **kwargs) -> Union def search_and_read(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search Container Alerts by the provided search criteria. - Keyword arguments: - filter -- Search Container Alerts using a query in Falcon Query Language (FQL). String. - Supported filters: cid, container_id, last_seen, name, severity - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - sort -- The fields to sort the records on. String. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-alerts/SearchAndReadContainerAlerts + + Keyword arguments + ----------------- + filter : str + Search Container Alerts using a query in Falcon Query Language (FQL). String. + Supported filters: cid, container_id, last_seen, name, severity + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The fields to sort the records on. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/container_detections.py b/src/falconpy/container_detections.py index 22c5ffd67..45482626b 100644 --- a/src/falconpy/container_detections.py +++ b/src/falconpy/container_detections.py @@ -63,26 +63,35 @@ def read_detection_counts_by_severity(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Aggregate counts of detections by severity. - Keyword arguments: - filter -- Filter images using a query in Falcon Query Language (FQL). String. - Supported filters: - cid image_registry - container_id image_repository - detection_type image_tag - id name - image_digest severity - image_id - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-detections/ReadDetectionsCountBySeverity + + Keyword arguments + ----------------- + filter : str + Filter images using a query in Falcon Query Language (FQL). String. + Supported filters: + cid image_registry + container_id image_repository + detection_type image_tag + id name + image_digest severity + image_id + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -100,26 +109,35 @@ def read_detections_count_by_type(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Aggregate counts of detections by detection type. - Keyword arguments: - filter -- Filter images using a query in Falcon Query Language (FQL). String. - Supported filters: - cid image_registry - container_id image_repository - detection_type image_tag - id name - image_digest severity - image_id - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-detections/ReadDetectionsCountByType + + Keyword arguments + ----------------- + filter : str + Filter images using a query in Falcon Query Language (FQL). String. + Supported filters: + cid image_registry + container_id image_repository + detection_type image_tag + id name + image_digest severity + image_id + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -137,26 +155,35 @@ def read_detections_count(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Aggregate count of detections. - Keyword arguments: - filter -- Filter images using a query in Falcon Query Language (FQL). String. - Supported filters: - cid image_registry - container_id image_repository - detection_type image_tag - id name - image_digest severity - image_id - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-detections/ReadDetectionsCount + + Keyword arguments + ----------------- + filter : str + Filter images using a query in Falcon Query Language (FQL). String. + Supported filters: + cid image_registry + container_id image_repository + detection_type image_tag + id name + image_digest severity + image_id + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -173,32 +200,42 @@ def read_combined_detections(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve image assessment detections identified by the provided filter criteria. - Keyword arguments: - filter -- Filter images using a query in Falcon Query Language (FQL). String. - Supported filters: - cid image_registry - container_id image_repository - detection_type image_tag - id name - image_digest severity - image_id - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - sort -- The fields to sort the records on. String. - Supported columns: - containers_impacted detection_type - detection_name images_impacted - detection_severity last_detected - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-detections/ReadCombinedDetections + + Keyword arguments + ----------------- + filter : str + Filter images using a query in Falcon Query Language (FQL). String. + Supported filters: + cid image_registry + container_id image_repository + detection_type image_tag + id name + image_digest severity + image_id + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + sort : str + The fields to sort the records on. String. + Supported columns: + containers_impacted detection_type + detection_name images_impacted + detection_severity last_detected + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -215,38 +252,47 @@ def search_runtime_detections(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve image assessment detections identified by the provided filter criteria. - Keyword arguments: - filter -- Filter Container Runtime Detections using a query in Falcon Query Language (FQL). String. - Supported filters: - action_taken file_name - aid file_path - cid host_id - cloud host_type - cluster_name image_id - command_line name - computer_name namespace - container_id pod_name - detect_timestamp severity - detection_description tactic - detection_id - - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - sort -- The fields to sort the records on. String. - Supported columns: - containers_impacted detection_type - detection_name images_impacted - detection_severity last_detected - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-detections/GetRuntimeDetectionsCombinedV2 + + Keyword arguments + ----------------- + filter : str + Filter Container Runtime Detections using a query in Falcon Query Language (FQL). String. + Supported filters: + action_taken file_name + aid file_path + cid host_id + cloud host_type + cluster_name image_id + command_line name + computer_name namespace + container_id pod_name + detect_timestamp severity + detection_description tactic + detection_id + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + sort : str + The fields to sort the records on. String. + Supported columns: + containers_impacted detection_type + detection_name images_impacted + detection_severity last_detected + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -260,21 +306,30 @@ def search_runtime_detections(self: object, def read_detections(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve image assessment detection entities identified by the provided filter criteria. - Keyword arguments: - filter -- Filter images using a query in Falcon Query Language (FQL). String. - Supported filters: cid, detection_type, image_registry, image_repository, image_tag - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-detections/ReadDetections + + Keyword arguments + ----------------- + filter : str + Filter images using a query in Falcon Query Language (FQL). String. + Supported filters: cid, detection_type, image_registry, image_repository, image_tag + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -288,27 +343,36 @@ def read_detections(self: object, parameters: dict = None, **kwargs) -> Union[Di def search_detections(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve image assessment detection entities identified by the provided filter criteria. - Keyword arguments: - filter -- Filter images using a query in Falcon Query Language (FQL). String. - Supported filters: - cid image_registry - container_id image_repository - detection_type image_tag - id name - image_digest severity - image_id - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-detections/SearchDetections + + Keyword arguments + ----------------- + filter : str + Filter images using a query in Falcon Query Language (FQL). String. + Supported filters: + cid image_registry + container_id image_repository + detection_type image_tag + id name + image_digest severity + image_id + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/container_image_compliance.py b/src/falconpy/container_image_compliance.py index 0d845d776..5053bfe06 100644 --- a/src/falconpy/container_image_compliance.py +++ b/src/falconpy/container_image_compliance.py @@ -63,24 +63,30 @@ def aggregate_cluster_assessments(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get the assessments for each cluster. - Keyword arguments: - filter -- Filter results using a query in Falcon Query Language (FQL). Supported Filters: String. - cloud_info.cloud_provider: Cloud provider - cid: Customer ID - cloud_info.cloud_region: Cloud region - cloud_info.cluster_name: Kubernetes cluster name - cloud_info.cloud_account_id: Cloud account ID - cloud_info.namespace: Kubernetes namespace - compliance_finding.framework: Compliance finding framework (available values: CIS) - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/complianceAssessments/extAggregateClusterAssessments + + Keyword arguments + ----------------- + filter : str + Filter results using a query in Falcon Query Language (FQL). Supported Filters: String. + cloud_info.cloud_provider: Cloud provider + cid: Customer ID + cloud_info.cloud_region: Cloud region + cloud_info.cluster_name: Kubernetes cluster name + cloud_info.cloud_account_id: Cloud account ID + cloud_info.namespace: Kubernetes namespace + compliance_finding.framework: Compliance finding framework (available values: CIS) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -97,37 +103,45 @@ def aggregate_image_assessments(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get the assessments for each cluster. - Keyword arguments: - filter -- Filter results using a query in Falcon Query Language (FQL). Supported Filters: String. - cloud_info.namespace: Kubernetes namespace - cid: Customer ID - compliance_finding.name: Compliance finding Name - cloud_info.cloud_account_id: Cloud account ID - cloud_info.cloud_provider: Cloud provider - compliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, - 2: medium, 1:low) - image_repository: Image repository - cloud_info.cloud_region: Cloud region - compliance_finding.id: Compliance finding ID - image_digest: Image digest (sha256 digest) - compliance_finding.framework: Compliance finding framework (available values: CIS) - image_tag: Image tag - cloud_info.cluster_name: Kubernetes cluster name - image_registry: Image registry - asset_type: asset type (container, image) - image_id: Image ID - after -- 'after' value from the last response. Keep it empty for the first request. String. - limit -- number of images to return in the response after 'after' key. - Keep it empty for the default number of 10000. String. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/complianceAssessments/extAggregateImageAssessments + + Keyword arguments + ----------------- + filter : str + Filter results using a query in Falcon Query Language (FQL). Supported Filters: String. + cloud_info.namespace: Kubernetes namespace + cid: Customer ID + compliance_finding.name: Compliance finding Name + cloud_info.cloud_account_id: Cloud account ID + cloud_info.cloud_provider: Cloud provider + compliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, + 2: medium, 1:low) + image_repository: Image repository + cloud_info.cloud_region: Cloud region + compliance_finding.id: Compliance finding ID + image_digest: Image digest (sha256 digest) + compliance_finding.framework: Compliance finding framework (available values: CIS) + image_tag: Image tag + cloud_info.cluster_name: Kubernetes cluster name + image_registry: Image registry + asset_type: asset type (container, image) + image_id: Image ID + after : str + 'after' value from the last response. Keep it empty for the first request. + limit : str + number of images to return in the response after 'after' key. + Keep it empty for the default number of 10000. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -144,32 +158,38 @@ def aggregate_rules_assessments(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get the assessments for each rule. - Keyword arguments: - filter -- Filter results using a query in Falcon Query Language (FQL). Supported Filters: - compliance_finding.framework: Compliance finding framework (available values: CIS) - image_id: Image ID - cloud_info.cloud_region: Cloud region - image_repository: Image repository - cloud_info.cloud_provider: Cloud provider - cloud_info.cluster_name: Kubernetes cluster name - compliance_finding.id: Compliance finding ID - compliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, - 2: medium, 1:low) - cid: Customer ID - compliance_finding.name: Compliance finding Name - image_tag: Image tag - cloud_info.cloud_account_id: Cloud account ID - image_registry: Image registry - image_digest: Image digest (sha256 digest) - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/complianceAssessments/extAggregateRulesAssessments + + Keyword arguments + ----------------- + filter : str + Filter results using a query in Falcon Query Language (FQL). Supported Filters: + compliance_finding.framework: Compliance finding framework (available values: CIS) + image_id: Image ID + cloud_info.cloud_region: Cloud region + image_repository: Image repository + cloud_info.cloud_provider: Cloud provider + cloud_info.cluster_name: Kubernetes cluster name + compliance_finding.id: Compliance finding ID + compliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, + 2: medium, 1:low) + cid: Customer ID + compliance_finding.name: Compliance finding Name + image_tag: Image tag + cloud_info.cloud_account_id: Cloud account ID + image_registry: Image registry + image_digest: Image digest (sha256 digest) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -186,33 +206,39 @@ def aggregate_failed_containers_by_rules(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get the containers grouped into rules on which they failed. - Keyword arguments: - filter -- Filter results using a query in Falcon Query Language (FQL). Supported Filters: - cloud_info.cluster_name: Kubernetes cluster name - compliance_finding.id: Compliance finding ID - image_repository: Image repository - image_id: Image ID - compliance_finding.framework: Compliance finding framework (available values: CIS) - image_tag: Image tag - cloud_info.cloud_provider: Cloud provider - compliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, - 2: medium, 1:low) - image_registry: Image registry - compliance_finding.name: Compliance finding Name - image_digest: Image digest (sha256 digest) - cloud_info.cloud_account_id: Cloud account ID - cloud_info.namespace: Kubernetes namespace - cid: Customer ID - cloud_info.cloud_region: Cloud region - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/complianceAssessments/extAggregateFailedContainersByRulesPath + + Keyword arguments + ----------------- + filter : str + Filter results using a query in Falcon Query Language (FQL). Supported Filters: + cloud_info.cluster_name: Kubernetes cluster name + compliance_finding.id: Compliance finding ID + image_repository: Image repository + image_id: Image ID + compliance_finding.framework: Compliance finding framework (available values: CIS) + image_tag: Image tag + cloud_info.cloud_provider: Cloud provider + compliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, + 2: medium, 1:low) + image_registry: Image registry + compliance_finding.name: Compliance finding Name + image_digest: Image digest (sha256 digest) + cloud_info.cloud_account_id: Cloud account ID + cloud_info.namespace: Kubernetes namespace + cid: Customer ID + cloud_info.cloud_region: Cloud region + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -229,33 +255,39 @@ def aggregate_failed_containers_count_by_severity(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get the failed containers count grouped into severity levels. - Keyword arguments: - filter -- Filter results using a query in Falcon Query Language (FQL). Supported Filters: - compliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, - 2: medium, 1:low) - cid: Customer ID - compliance_finding.name: Compliance finding Name - image_digest: Image digest (sha256 digest) - compliance_finding.framework: Compliance finding framework (available values: CIS) - compliance_finding.id: Compliance finding ID - image_tag: Image tag - cloud_info.cloud_provider: Cloud provider - cloud_info.cluster_name: Kubernetes cluster name - cloud_info.namespace: Kubernetes namespace - image_repository: Image repository - cloud_info.cloud_account_id: Cloud account ID - image_registry: Image registry - image_id: Image ID - cloud_info.cloud_region: Cloud region - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/complianceAssessments/extAggregateFailedContainersCountBySeverity + + Keyword arguments + ----------------- + filter : str + Filter results using a query in Falcon Query Language (FQL). Supported Filters: + compliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, + 2: medium, 1:low) + cid: Customer ID + compliance_finding.name: Compliance finding Name + image_digest: Image digest (sha256 digest) + compliance_finding.framework: Compliance finding framework (available values: CIS) + compliance_finding.id: Compliance finding ID + image_tag: Image tag + cloud_info.cloud_provider: Cloud provider + cloud_info.cluster_name: Kubernetes cluster name + cloud_info.namespace: Kubernetes namespace + image_repository: Image repository + cloud_info.cloud_account_id: Cloud account ID + image_registry: Image registry + image_id: Image ID + cloud_info.cloud_region: Cloud region + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -272,33 +304,39 @@ def aggregate_failed_images_by_rules(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get the images grouped into rules on which they failed. - Keyword arguments: - filter -- Filter results using a query in Falcon Query Language (FQL). Supported Filters: - cloud_info.cloud_account_id: Cloud account ID - cloud_info.cloud_provider: Cloud provider - image_repository: Image repository - image_digest: Image digest (sha256 digest) - cloud_info.cluster_name: Kubernetes cluster name - compliance_finding.name: Compliance finding Name - cloud_info.cloud_region: Cloud region - compliance_finding.framework: Compliance finding framework (available values: CIS) - image_tag: Image tag - cloud_info.namespace: Kubernetes namespace - compliance_finding.id: Compliance finding ID - compliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, - 2: medium, 1:low) - cid: Customer ID - image_registry: Image registry - image_id: Image ID - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/complianceAssessments/extAggregateFailedImagesByRulesPath + + Keyword arguments + ----------------- + filter : str + Filter results using a query in Falcon Query Language (FQL). Supported Filters: + cloud_info.cloud_account_id: Cloud account ID + cloud_info.cloud_provider: Cloud provider + image_repository: Image repository + image_digest: Image digest (sha256 digest) + cloud_info.cluster_name: Kubernetes cluster name + compliance_finding.name: Compliance finding Name + cloud_info.cloud_region: Cloud region + compliance_finding.framework: Compliance finding framework (available values: CIS) + image_tag: Image tag + cloud_info.namespace: Kubernetes namespace + compliance_finding.id: Compliance finding ID + compliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, + 2: medium, 1:low) + cid: Customer ID + image_registry: Image registry + image_id: Image ID + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -315,33 +353,39 @@ def aggregate_failed_images_count_by_severity(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get the failed images count grouped into severity levels. - Keyword arguments: - filter -- Filter results using a query in Falcon Query Language (FQL). Supported Filters: - cloud_info.cloud_region: Cloud region - compliance_finding.id: Compliance finding ID - cloud_info.cloud_account_id: Cloud account ID - cloud_info.namespace: Kubernetes namespace - image_id: Image ID - compliance_finding.framework: Compliance finding framework (available values: CIS) - cloud_info.cloud_provider: Cloud provider - compliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, - 2: medium, 1:low) - image_registry: Image registry - image_repository: Image repository - image_tag: Image tag - cloud_info.cluster_name: Kubernetes cluster name - cid: Customer ID - compliance_finding.name: Compliance finding Name - image_digest: Image digest (sha256 digest) - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/complianceAssessments/extAggregateFailedImagesCountBySeverity + + Keyword arguments + ----------------- + filter : str + Filter results using a query in Falcon Query Language (FQL). Supported Filters: + cloud_info.cloud_region: Cloud region + compliance_finding.id: Compliance finding ID + cloud_info.cloud_account_id: Cloud account ID + cloud_info.namespace: Kubernetes namespace + image_id: Image ID + compliance_finding.framework: Compliance finding framework (available values: CIS) + cloud_info.cloud_provider: Cloud provider + compliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, + 2: medium, 1:low) + image_registry: Image registry + image_repository: Image repository + image_tag: Image tag + cloud_info.cluster_name: Kubernetes cluster name + cid: Customer ID + compliance_finding.name: Compliance finding Name + image_digest: Image digest (sha256 digest) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -358,33 +402,39 @@ def aggregate_failed_rules_by_clusters(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get the failed rules for each cluster grouped into severity levels. - Keyword arguments: - filter -- Filter results using a query in Falcon Query Language (FQL). Supported Filters: - cid: Customer ID - compliance_finding.name: Compliance finding Name - cloud_info.cloud_region: Cloud region - image_tag: Image tag - image_registry: Image registry - image_id: Image ID - compliance_finding.framework: Compliance finding framework (available values: CIS) - cloud_info.cloud_account_id: Cloud account ID - cloud_info.cloud_provider: Cloud provider - cloud_info.cluster_name: Kubernetes cluster name - compliance_finding.id: Compliance finding ID - compliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, - 2: medium, 1:low) - image_repository: Image repository - asset_type: asset type (container, image) - image_digest: Image digest (sha256 digest) - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/complianceAssessments/extAggregateFailedRulesByClusters + + Keyword arguments + ----------------- + filter : str + Filter results using a query in Falcon Query Language (FQL). Supported Filters: + cid: Customer ID + compliance_finding.name: Compliance finding Name + cloud_info.cloud_region: Cloud region + image_tag: Image tag + image_registry: Image registry + image_id: Image ID + compliance_finding.framework: Compliance finding framework (available values: CIS) + cloud_info.cloud_account_id: Cloud account ID + cloud_info.cloud_provider: Cloud provider + cloud_info.cluster_name: Kubernetes cluster name + compliance_finding.id: Compliance finding ID + compliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, + 2: medium, 1:low) + image_repository: Image repository + asset_type: asset type (container, image) + image_digest: Image digest (sha256 digest) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -401,34 +451,40 @@ def aggregate_failed_rules_by_image(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get images with failed rules, rule count grouped by severity for each image. - Keyword arguments: - filter -- Filter results using a query in Falcon Query Language (FQL). Supported Filters: - compliance_finding.framework: Compliance finding framework (available values: CIS) - image_tag: Image tag - cloud_info.cloud_account_id: Cloud account ID - compliance_finding.id: Compliance finding ID - compliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, - 2: medium, 1:low) - cid: Customer ID - asset_type: asset type (container, image) - image_repository: Image repository - cloud_info.namespace: Kubernetes namespace - cloud_info.cloud_region: Cloud region - cloud_info.cluster_name: Kubernetes cluster name - image_id: Image ID - image_digest: Image digest (sha256 digest) - cloud_info.cloud_provider: Cloud provider - image_registry: Image registry - compliance_finding.name: Compliance finding Name - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/complianceAssessments/extAggregateFailedRulesByImages + + Keyword arguments + ----------------- + filter : str + Filter results using a query in Falcon Query Language (FQL). Supported Filters: + compliance_finding.framework: Compliance finding framework (available values: CIS) + image_tag: Image tag + cloud_info.cloud_account_id: Cloud account ID + compliance_finding.id: Compliance finding ID + compliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, + 2: medium, 1:low) + cid: Customer ID + asset_type: asset type (container, image) + image_repository: Image repository + cloud_info.namespace: Kubernetes namespace + cloud_info.cloud_region: Cloud region + cloud_info.cluster_name: Kubernetes cluster name + image_id: Image ID + image_digest: Image digest (sha256 digest) + cloud_info.cloud_provider: Cloud provider + image_registry: Image registry + compliance_finding.name: Compliance finding Name + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -445,33 +501,39 @@ def aggregate_failed_rules_count_by_severity(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get the failed rules count grouped into severity levels. - Keyword arguments: - filter -- Filter results using a query in Falcon Query Language (FQL). Supported Filters: - compliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, - 2: medium, 1:low) - image_repository: Image repository - cloud_info.cloud_provider: Cloud provider - compliance_finding.id: Compliance finding ID - cid: Customer ID - image_registry: Image registry - compliance_finding.name: Compliance finding Name - cloud_info.cloud_region: Cloud region - compliance_finding.framework: Compliance finding framework (available values: CIS) - image_tag: Image tag - image_digest: Image digest (sha256 digest) - cloud_info.cloud_account_id: Cloud account ID - cloud_info.cluster_name: Kubernetes cluster name - asset_type: asset type (container, image) - image_id: Image ID - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/complianceAssessments/extAggregateFailedRulesCountBySeverity + + Keyword arguments + ----------------- + filter : str + Filter results using a query in Falcon Query Language (FQL). Supported Filters: + compliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, + 2: medium, 1:low) + image_repository: Image repository + cloud_info.cloud_provider: Cloud provider + compliance_finding.id: Compliance finding ID + cid: Customer ID + image_registry: Image registry + compliance_finding.name: Compliance finding Name + cloud_info.cloud_region: Cloud region + compliance_finding.framework: Compliance finding framework (available values: CIS) + image_tag: Image tag + image_digest: Image digest (sha256 digest) + cloud_info.cloud_account_id: Cloud account ID + cloud_info.cluster_name: Kubernetes cluster name + asset_type: asset type (container, image) + image_id: Image ID + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -488,35 +550,41 @@ def aggregate_rules_by_status(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get the rules grouped by their statuses. - Keyword arguments: - filter -- Filter results using a query in Falcon Query Language (FQL). Supported Filters: - image_repository: Image repository - compliance_finding.name: Compliance finding Name - cloud_info.cloud_account_id: Cloud account ID - cloud_info.cloud_provider: Cloud provider - compliance_finding.id: Compliance finding ID - compliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, - 2: medium, 1:low) - image_id: Image ID - container_id: Container ID - cloud_info.cluster_name: Kubernetes cluster name - image_registry: Image registry - cloud_info.cloud_region: Cloud region - compliance_finding.framework: Compliance finding framework (available values: CIS) - container_name: Container name - cid: Customer ID - asset_type: asset type (container, image) - image_digest: Image digest (sha256 digest) - image_tag: Image tag - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/complianceAssessments/extAggregateRulesByStatus + + Keyword arguments + ----------------- + filter : str + Filter results using a query in Falcon Query Language (FQL). Supported Filters: + image_repository: Image repository + compliance_finding.name: Compliance finding Name + cloud_info.cloud_account_id: Cloud account ID + cloud_info.cloud_provider: Cloud provider + compliance_finding.id: Compliance finding ID + compliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, + 2: medium, 1:low) + image_id: Image ID + container_id: Container ID + cloud_info.cluster_name: Kubernetes cluster name + image_registry: Image registry + cloud_info.cloud_region: Cloud region + compliance_finding.framework: Compliance finding framework (available values: CIS) + container_name: Container name + cid: Customer ID + asset_type: asset type (container, image) + image_digest: Image digest (sha256 digest) + image_tag: Image tag + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/container_images.py b/src/falconpy/container_images.py index de62c57c0..d719d75af 100644 --- a/src/falconpy/container_images.py +++ b/src/falconpy/container_images.py @@ -64,20 +64,29 @@ def aggregate_assessment_history(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Image assessment history. - Keyword arguments: - filter -- Filter using a query in Falcon Query Language (FQL). String. - Supported filters: cid, registry, repository - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-images/AggregateImageAssessmentHistory + + Keyword arguments + ----------------- + filter : str + Filter using a query in Falcon Query Language (FQL). String. + Supported filters: cid, registry, repository + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -95,24 +104,33 @@ def aggregate_count_by_base_os(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Aggregate count of images grouped by Base OS distribution. - Keyword arguments: - filter -- Filter images using a query in Falcon Query Language (FQL). String. - Supported filters: - arch image_digest registry - base_os image_id repository - cid index_digest source - first_seen multi_arch tag - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-images/AggregateImageCountByBaseOS + + Keyword arguments + ----------------- + filter : str + Filter images using a query in Falcon Query Language (FQL). String. + Supported filters: + arch image_digest registry + base_os image_id repository + cid index_digest source + first_seen multi_arch tag + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -130,24 +148,33 @@ def aggregate_count_by_state(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Aggregate count of images grouped by state. - Keyword arguments: - filter -- Filter images using a query in Falcon Query Language (FQL). String. - Supported filters: - arch image_digest registry - base_os image_id repository - cid index_digest source - first_seen multi_arch tag - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-images/AggregateImageCountByState + + Keyword arguments + ----------------- + filter : str + Filter images using a query in Falcon Query Language (FQL). String. + Supported filters: + arch image_digest registry + base_os image_id repository + cid index_digest source + first_seen multi_arch tag + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -165,34 +192,43 @@ def aggregate_count(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Aggregate count of images. - Keyword arguments: - filter -- Filter images using a query in Falcon Query Language (FQL). String. - Supported filters: - ai_related first_seen - ai_vulnerability_count image_digest - arch image_id - base_os include_base_image_vuln - cid index_digest - container_id layer_digest - container_running_status multi_arch - cps_rating package_name_version - crowdstrike_user registry - cve_id repository - detection_count source - detection_name tag - detection_severity vulnerability_count - vulnerability_severity - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-images/AggregateImageCount + + Keyword arguments + ----------------- + filter : str + Filter images using a query in Falcon Query Language (FQL). String. + Supported filters: + ai_related first_seen + ai_vulnerability_count image_digest + arch image_id + base_os include_base_image_vuln + cid index_digest + container_id layer_digest + container_running_status multi_arch + cps_rating package_name_version + crowdstrike_user registry + cve_id repository + detection_count source + detection_name tag + detection_severity vulnerability_count + vulnerability_severity + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -209,19 +245,26 @@ def get_combined_base_images(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve base images for provided filter. - Keyword arguments: - filter -- Filter images using a query in Falcon Query Language (FQL). String. - Supported filters: image_digest, image_id, registry, repository, tag - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-images/CombinedBaseImages + + Keyword arguments + ----------------- + filter : str + Filter images using a query in Falcon Query Language (FQL). String. + Supported filters: image_digest, image_id, registry, repository, tag + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -235,36 +278,46 @@ def get_combined_base_images(self: object, def get_combined_images(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get image assessment results by providing an FQL filter and paging details. - Keyword arguments: - filter -- Filter images using a query in Falcon Query Language (FQL). String. - Supported filters: - ai_related architecture - container_id container_running_status - cve_id detection_name - detection_severity first_seen - image_digest image_id - index_digest multi_arch - registry repository - tag vulnerability_severity - limit -- The upper-bound on the number of records to retrieve [1-100]. Integer. - offset -- The offset from where to begin. Integer. - sort -- The fields to sort the records on. String. - Supported columns: - first_seen image_id - highest_detection_severity registry - highest_vulnerability_severity repository - image_digest tag - source - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-images/GetCombinedImages + + Keyword arguments + ----------------- + filter : str + Filter images using a query in Falcon Query Language (FQL). String. + Supported filters: + ai_related architecture + container_id container_running_status + cve_id detection_name + detection_severity first_seen + image_digest image_id + index_digest multi_arch + registry repository + tag vulnerability_severity + limit : int + The upper-bound on the number of records to retrieve [1-100] + offset : int + The offset from where to begin. + sort : str + The fields to sort the records on. String. + Supported columns: + first_seen image_id + highest_detection_severity registry + highest_vulnerability_severity repository + image_digest tag + source + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -281,26 +334,35 @@ def get_combined_images_by_vulnerability_count(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve top x images with the most vulnerabilities. - Keyword arguments: - filter -- Filter images using a query in Falcon Query Language (FQL). String. - Supported filters: - arch image_digest registry - base_os image_id repository - cid index_digest source - first_seen multi_arch tag - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- This is not used in the backend but is added here for compatibility - purposes as some clients expects this i.e UI widgets. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-images/CombinedImageByVulnerabilityCount + + Keyword arguments + ----------------- + filter : str + Filter images using a query in Falcon Query Language (FQL). String. + Supported filters: + arch image_digest registry + base_os image_id repository + cid index_digest source + first_seen multi_arch tag + limit : int + The upper-bound on the number of records to retrieve. + offset : int + This is not used in the backend but is added here for compatibility + purposes as some clients expects this i.e UI widgets. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -314,27 +376,38 @@ def get_combined_images_by_vulnerability_count(self: object, def get_combined_detail(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve image entities identified by the provided filter criteria. - Keyword arguments: - filter -- Filter images using a query in Falcon Query Language (FQL). String. - Supported filters: - arch image_digest registry - base_os image_id repository - cid index_digest source - first_seen multi_arch tag - with_config -- Include image config. Boolean. Defaults true false. - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - sort -- The fields to sort the records on. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-images/CombinedImageDetail + + Keyword arguments + ----------------- + filter : str + Filter images using a query in Falcon Query Language (FQL). String. + Supported filters: + arch image_digest registry + base_os image_id repository + cid index_digest source + first_seen multi_arch tag + with_config : bool + Include image config. Boolean. Defaults true false. + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + sort : str + The fields to sort the records on. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -348,49 +421,61 @@ def get_combined_detail(self: object, parameters: dict = None, **kwargs) -> Unio def read_combined_export(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve images with an option to expand aggregated vulnerabilities/detections. - Keyword arguments: - filter -- Filter images using a query in Falcon Query Language (FQL). - Supported filters: - ai_related first_seen - ai_vulnerability_count image_digest - arch image_id - base_os include_base_image_vuln - cid index_digest - container_id layer_digest - container_running_status multi_arch - cps_rating package_name_version - crowdstrike_user registry - cve_id repository - detection_count source - detection_name tag - detection_severity vulnerability_count - vulnerability_severity - expand_vulnerabilities -- Expand vulnerabilities. Boolean. - expand_detections -- Expand detections. Boolean. - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - sort -- The fields to sort the records on. String. - Supported columns: - ai_vulnerabilities image_id - base_os last_seen - cid layers_with_vulnerabilities - detections packages - firstScanned registry - first_seen repository - highest_cps_current_rating source - highest_detection_severity tag - highest_vulnerability_severity vulnerabilities - image_digest - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-images/ReadCombinedImagesExport + + Keyword arguments + ----------------- + filter : str + Filter images using a query in Falcon Query Language (FQL). + Supported filters: + ai_related first_seen + ai_vulnerability_count image_digest + arch image_id + base_os include_base_image_vuln + cid index_digest + container_id layer_digest + container_running_status multi_arch + cps_rating package_name_version + crowdstrike_user registry + cve_id repository + detection_count source + detection_name tag + detection_severity vulnerability_count + vulnerability_severity + expand_vulnerabilities : bool + Expand vulnerabilities. + expand_detections : bool + Expand detections. + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + sort : str + The fields to sort the records on. String. + Supported columns: + ai_vulnerabilities image_id + base_os last_seen + cid layers_with_vulnerabilities + detections packages + firstScanned registry + first_seen repository + highest_cps_current_rating source + highest_detection_severity tag + highest_vulnerability_severity vulnerabilities + image_digest + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -407,23 +492,35 @@ def get_combined_issues_summary(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve image issues summary such as Image detections, Runtime detections, Policies, Vulnerabilities. - Keyword arguments: - cid -- CID. String. - image_digest -- Image digest. String. - registry -- Registry name. String. - repository -- Repository name. String. - tag -- Tag name. String. - include_base_image_vuln -- Include the base image vulnerability within the summary. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-images/CombinedImageIssuesSummary + + Keyword arguments + ----------------- + cid : str + CID. + image_digest : str + Image digest. + registry : str + Registry name. + repository : str + Repository name. + tag : str + Tag name. + include_base_image_vuln : bool + Include the base image vulnerability within the summary. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -440,23 +537,35 @@ def get_combined_vulnerabilities_summary(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Aggregate information about vulnerabilities for an image. - Keyword arguments: - cid -- CID. String. - image_digest -- Image digest. String. - registry -- Registry name. String. - repository -- Repository name. String. - tag -- Tag name. String. - include_base_image_vuln -- Include the base image vulnerability within the summary. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-images/CombinedImageVulnerabilitySummary + + Keyword arguments + ----------------- + cid : str + CID. + image_digest : str + Image digest. + registry : str + Registry name. + repository : str + Repository name. + tag : str + Tag name. + include_base_image_vuln : bool + Include the base image vulnerability within the summary. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -470,8 +579,16 @@ def get_combined_vulnerabilities_summary(self: object, def create_base_images(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete base images by base image UUID. - Keyword arguments: - body -- Full body payload dictionary in JSON format. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-images/CreateBaseImagesEntities + + Keyword arguments + ----------------- + body : dict + Full body payload dictionary in JSON format. Not required if using other keywords. { "base_images": [ { @@ -483,20 +600,23 @@ def create_base_images(self: object, body: dict = None, **kwargs) -> Union[Dict[ } ] } - image_digest -- Image digest. String. - image_id -- UUID for the image. String. - registry -- Image registry. String. - repository -- Image repository. String. - tag -- Image tag. String. + image_digest : str + Image digest. + image_id : str + UUID for the image. + registry : str + Image registry. + repository : str + Image repository. + tag : str + Image tag. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-images/CreateBaseImagesEntities + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = base_image_payload(passed_keywords=kwargs) @@ -517,19 +637,28 @@ def delete_base_images(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete base images by base image UUID. - Keyword arguments: - ids -- UUID of images to delete. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-images/DeleteBaseImages + + Keyword arguments + ----------------- + ids : str or list[str] + UUID of images to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/container_packages.py b/src/falconpy/container_packages.py index 441e0b86f..8ad0cbf04 100644 --- a/src/falconpy/container_packages.py +++ b/src/falconpy/container_packages.py @@ -62,23 +62,31 @@ def read_packages_by_image_count(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve the N most frequently used packages across images. - Keyword arguments: - filter -- Filter packages using a query in Falcon Query Language (FQL). String. - Supported filters: - ai_related severity - cveid type - running_images vulnerability_count - limit -- The upper-bound on the number of records to retrieve. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-packages/ReadPackagesByImageCount + + Keyword arguments + ----------------- + filter : str + Filter packages using a query in Falcon Query Language (FQL). String. + Supported filters: + ai_related severity + cveid type + running_images vulnerability_count + limit : int + The upper-bound on the number of records to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -96,19 +104,28 @@ def read_zero_day_counts(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve packages count affected by zero day vulnerabilities. - Keyword arguments: - filter -- Filter packages using a query in Falcon Query Language (FQL). String. Supported filters: cid - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-packages/ReadPackagesCountByZeroDay + + Keyword arguments + ----------------- + filter : str + Filter packages using a query in Falcon Query Language (FQL). String. Supported filters: cid + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -125,26 +142,35 @@ def read_fixable_vuln_count(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve top x app packages with the most fixable vulnerabilities. - Keyword arguments: - filter -- Filter packages using a query in Falcon Query Language (FQL). String. - Supported filters: - cid license - container_id package_name_version - cveid severity - fix_status type - image_digest vulnerability_count - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-packages/ReadPackagesByFixableVulnCount + + Keyword arguments + ----------------- + filter : str + Filter packages using a query in Falcon Query Language (FQL). String. + Supported filters: + cid license + container_id package_name_version + cveid severity + fix_status type + image_digest vulnerability_count + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -158,26 +184,35 @@ def read_fixable_vuln_count(self: object, def read_vuln_count(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve top x packages with the most vulnerabilities. - Keyword arguments: - filter -- Filter packages using a query in Falcon Query Language (FQL). String. - Supported filters: - cid license - container_id package_name_version - cveid severity - fix_status type - image_digest vulnerability_count - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-packages/ReadPackagesByVulnCount + + Keyword arguments + ----------------- + filter : str + Filter packages using a query in Falcon Query Language (FQL). String. + Supported filters: + cid license + container_id package_name_version + cveid severity + fix_status type + image_digest vulnerability_count + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -191,29 +226,40 @@ def read_vuln_count(self: object, parameters: dict = None, **kwargs) -> Union[Di def read_combined_export(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve packages identified by the provided filter criteria for the purpose of export. - Keyword arguments: - filter -- Filter packages using a query in Falcon Query Language (FQL). String. - Supported filters: - cid license - container_id package_name_version - cveid severity - fix_status type - image_digest vulnerability_count - only_zero_day_affected -- Load zero day affected packages. Boolean. Defaults to False. - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - sort -- The fields to sort the records on. String. - Supported columns: license, package_name_version, type - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-packages/ReadPackagesCombinedExport + + Keyword arguments + ----------------- + filter : str + Filter packages using a query in Falcon Query Language (FQL). String. + Supported filters: + cid license + container_id package_name_version + cveid severity + fix_status type + image_digest vulnerability_count + only_zero_day_affected : bool + Load zero day affected packages. Boolean. Defaults to False. + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + sort : str + The fields to sort the records on. String. + Supported columns: license, package_name_version, type + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -227,29 +273,40 @@ def read_combined_export(self: object, parameters: dict = None, **kwargs) -> Uni def read_combined(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve packages identified by the provided filter criteria. - Keyword arguments: - filter -- Filter packages using a query in Falcon Query Language (FQL). String. - Supported filters: - cid license - container_id package_name_version - cveid severity - fix_status type - image_digest vulnerability_count - only_zero_day_affected -- Load zero day affected packages. Boolean. Default is False. - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - sort -- The fields to sort the records on. String. - Supported columns: license, package_name_version, type - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-packages/ReadPackagesCombined + + Keyword arguments + ----------------- + filter : str + Filter packages using a query in Falcon Query Language (FQL). String. + Supported filters: + cid license + container_id package_name_version + cveid severity + fix_status type + image_digest vulnerability_count + only_zero_day_affected : bool + Load zero day affected packages. Boolean. Default is False. + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + sort : str + The fields to sort the records on. String. + Supported columns: license, package_name_version, type + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -263,29 +320,40 @@ def read_combined(self: object, parameters: dict = None, **kwargs) -> Union[Dict def read_packages(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve packages identified by the provided filter criteria. - Keyword arguments: - filter -- Filter packages using a query in Falcon Query Language (FQL). String. - Supported filters: - cid license - container_id package_name_version - cveid severity - fix_status type - image_digest vulnerability_count - only_zero_day_affected -- Load zero day affected packages. Boolean. Default is False. - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - sort -- The fields to sort the records on. String. - Supported columns: license, package_name_version, type - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-packages/ReadPackagesCombinedV2 + + Keyword arguments + ----------------- + filter : str + Filter packages using a query in Falcon Query Language (FQL). String. + Supported filters: + cid license + container_id package_name_version + cveid severity + fix_status type + image_digest vulnerability_count + only_zero_day_affected : bool + Load zero day affected packages. Boolean. Default is False. + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + sort : str + The fields to sort the records on. String. + Supported columns: license, package_name_version, type + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/container_vulnerabilities.py b/src/falconpy/container_vulnerabilities.py index f8ee63802..1330637a4 100644 --- a/src/falconpy/container_vulnerabilities.py +++ b/src/falconpy/container_vulnerabilities.py @@ -62,34 +62,43 @@ def read_vulnerability_counts_by_active_exploited(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Aggregate count of vulnerabilities grouped by actively exploited. - Keyword arguments: - filter -- Filter vulnerabilities using a query in Falcon Query Language (FQL). String. - Supported filters: - ai_related fix_status - base_os image_digest - cid image_id - container_id images_impacted_range - container_running_status include_base_image_vuln - containers_impacted_range index_digest - cps_rating package_name_version - cve_id registry - cvss_score repository - description severity - exploited_status tag - exploited_status_name - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /container-vulnerabilities/ReadVulnerabilityCountByActivelyExploited + /container-vulnerabilities/ReadVulnerabilityCountByActivelyExploited + + Keyword arguments + ----------------- + filter : str + Filter vulnerabilities using a query in Falcon Query Language (FQL). String. + Supported filters: + ai_related fix_status + base_os image_digest + cid image_id + container_id images_impacted_range + container_running_status include_base_image_vuln + containers_impacted_range index_digest + cps_rating package_name_version + cve_id registry + cvss_score repository + description severity + exploited_status tag + exploited_status_name + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -106,34 +115,43 @@ def read_vulnerability_counts_by_cps_rating(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Aggregate count of vulnerabilities grouped by csp_rating. - Keyword arguments: - filter -- Filter vulnerabilities using a query in Falcon Query Language (FQL). String. - Supported filters: - ai_related fix_status - base_os image_digest - cid image_id - container_id images_impacted_range - container_running_status include_base_image_vuln - containers_impacted_range index_digest - cps_rating package_name_version - cve_id registry - cvss_score repository - description severity - exploited_status tag - exploited_status_name - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /container-vulnerabilities/ReadVulnerabilityCountByCPSRating + /container-vulnerabilities/ReadVulnerabilityCountByCPSRating + + Keyword arguments + ----------------- + filter : str + Filter vulnerabilities using a query in Falcon Query Language (FQL). String. + Supported filters: + ai_related fix_status + base_os image_digest + cid image_id + container_id images_impacted_range + container_running_status include_base_image_vuln + containers_impacted_range index_digest + cps_rating package_name_version + cve_id registry + cvss_score repository + description severity + exploited_status tag + exploited_status_name + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -150,34 +168,43 @@ def read_vulnerability_counts_by_cvss_score(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Aggregate count of vulnerabilities grouped by cvss score. - Keyword arguments: - filter -- Filter vulnerabilities using a query in Falcon Query Language (FQL). String. - Supported filters: - ai_related fix_status - base_os image_digest - cid image_id - container_id images_impacted_range - container_running_status include_base_image_vuln - containers_impacted_range index_digest - cps_rating package_name_version - cve_id registry - cvss_score repository - description severity - exploited_status tag - exploited_status_name - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /container-vulnerabilities/ReadVulnerabilityCountByCVSSScore + /container-vulnerabilities/ReadVulnerabilityCountByCVSSScore + + Keyword arguments + ----------------- + filter : str + Filter vulnerabilities using a query in Falcon Query Language (FQL). String. + Supported filters: + ai_related fix_status + base_os image_digest + cid image_id + container_id images_impacted_range + container_running_status include_base_image_vuln + containers_impacted_range index_digest + cps_rating package_name_version + cve_id registry + cvss_score repository + description severity + exploited_status tag + exploited_status_name + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -194,34 +221,43 @@ def read_vulnerability_counts_by_severity(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Aggregate count of vulnerabilities grouped by severity. - Keyword arguments: - filter -- Filter vulnerabilities using a query in Falcon Query Language (FQL). String. - Supported filters: - ai_related fix_status - base_os image_digest - cid image_id - container_id images_impacted_range - container_running_status include_base_image_vuln - containers_impacted_range index_digest - cps_rating package_name_version - cve_id registry - cvss_score repository - description severity - exploited_status tag - exploited_status_name - limit -- The upper-bound on the number of records to retrieve. String. - offset -- The offset from where to begin. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /container-vulnerabilities/ReadVulnerabilityCountBySeverity + /container-vulnerabilities/ReadVulnerabilityCountBySeverity + + Keyword arguments + ----------------- + filter : str + Filter vulnerabilities using a query in Falcon Query Language (FQL). String. + Supported filters: + ai_related fix_status + base_os image_digest + cid image_id + container_id images_impacted_range + container_running_status include_base_image_vuln + containers_impacted_range index_digest + cps_rating package_name_version + cve_id registry + cvss_score repository + description severity + exploited_status tag + exploited_status_name + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -238,33 +274,42 @@ def read_vulnerability_count(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Aggregate count of vulnerabilities. - Keyword arguments: - filter -- Filter vulnerabilities using a query in Falcon Query Language (FQL). String. - Supported filters: - ai_related fix_status - base_os image_digest - cid image_id - container_id images_impacted_range - container_running_status include_base_image_vuln - containers_impacted_range index_digest - cps_rating package_name_version - cve_id registry - cvss_score repository - description severity - exploited_status tag - exploited_status_name - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-vulnerabilities/ReadVulnerabilityCount + + Keyword arguments + ----------------- + filter : str + Filter vulnerabilities using a query in Falcon Query Language (FQL). String. + Supported filters: + ai_related fix_status + base_os image_digest + cid image_id + container_id images_impacted_range + container_running_status include_base_image_vuln + containers_impacted_range index_digest + cps_rating package_name_version + cve_id registry + cvss_score repository + description severity + exploited_status tag + exploited_status_name + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -281,22 +326,31 @@ def read_vulnerabilities_by_count(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve top x vulnerabilities with the most impacted images. - Keyword arguments: - filter -- Filter vulnerabilities using a query in Falcon Query Language (FQL). String. - Supported filters: cid, cve_id, registry, repository,tag - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /container-vulnerabilities/ReadVulnerabilitiesByImageCount + /container-vulnerabilities/ReadVulnerabilitiesByImageCount + + Keyword arguments + ----------------- + filter : str + Filter vulnerabilities using a query in Falcon Query Language (FQL). String. + Supported filters: cid, cve_id, registry, repository,tag + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -313,22 +367,31 @@ def read_vulnerabilities_by_pub_date(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve top x vulnerabilities with the most recent publication date. - Keyword arguments: - filter -- Filter vulnerabilities using a query in Falcon Query Language (FQL). String. - Supported filters: cid, cve_id, registry, repository,tag - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /container-vulnerabilities/ReadVulnerabilitiesPublicationDate + /container-vulnerabilities/ReadVulnerabilitiesPublicationDate + + Keyword arguments + ----------------- + filter : str + Filter vulnerabilities using a query in Falcon Query Language (FQL). String. + Supported filters: cid, cve_id, registry, repository,tag + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -345,28 +408,38 @@ def read_combined_vulnerability_detail(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve vulnerability details related to an image. - Keyword arguments: - id -- Image UUID. String. - filter -- Filter the vulnerabilities using a query in Falcon Query Language (FQL). String. - Supported vulnerability filters: - cid exploited_status_name - cps_rating is_zero_day - cve_id remediation_available - cvss_score severity - exploited_status include_base_image_vuln - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /container-vulnerabilities/ReadCombinedVulnerabilitiesDetails + /container-vulnerabilities/ReadCombinedVulnerabilitiesDetails + + Keyword arguments + ----------------- + id : str + Image UUID. + filter : str + Filter the vulnerabilities using a query in Falcon Query Language (FQL). String. + Supported vulnerability filters: + cid exploited_status_name + cps_rating is_zero_day + cve_id remediation_available + cvss_score severity + exploited_status include_base_image_vuln + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -383,21 +456,30 @@ def read_combined_vulnerabilities_info(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve vulnerability and package related info for this customer. - Keyword arguments: - cve_id -- Vulnerability CVE ID. String. - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /container-vulnerabilities/ReadCombinedVulnerabilitiesInfo + /container-vulnerabilities/ReadCombinedVulnerabilitiesInfo + + Keyword arguments + ----------------- + cve_id : str + Vulnerability CVE ID. + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -414,39 +496,49 @@ def read_combined_vulnerabilities(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve vulnerability and aggregate data filtered by the provided FQL. - Keyword arguments: - filter -- Filter vulnerabilities using a query in Falcon Query Language (FQL). String. - Supported filters: - ai_related fix_status - base_os image_digest - cid image_id - container_id images_impacted_range - container_running_status include_base_image_vuln - containers_impacted_range index_digest - cps_rating package_name_version - cve_id registry - cvss_score repository - description severity - exploited_status tag - exploited_status_name - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - sort -- The fields to sort the records on. String. - Supported columns: - cps_current_rating images_impacted - cve_id packages_impacted - cvss_score severity - description - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/container-vulnerabilities/ReadCombinedVulnerabilities + + Keyword arguments + ----------------- + filter : str + Filter vulnerabilities using a query in Falcon Query Language (FQL). String. + Supported filters: + ai_related fix_status + base_os image_digest + cid image_id + container_id images_impacted_range + container_running_status include_base_image_vuln + containers_impacted_range index_digest + cps_rating package_name_version + cve_id registry + cvss_score repository + description severity + exploited_status tag + exploited_status_name + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + sort : str + The fields to sort the records on. String. + Supported columns: + cps_current_rating images_impacted + cve_id packages_impacted + cvss_score severity + description + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/content_update_policies.py b/src/falconpy/content_update_policies.py index cd0f31e70..cf9b38671 100644 --- a/src/falconpy/content_update_policies.py +++ b/src/falconpy/content_update_policies.py @@ -65,23 +65,34 @@ def query_policy_members_combined(self: object, Returns a set of host details which match the filter criteria. - Keyword arguments: - id -- The ID of the Content Update Policy to search for members of. String. - filter -- The filter expression that should be used to limit the results. String. - offset -- The offset to start retrieving records from. Integer. - limit -- The maximum records to return. Integer. [1-5000] - sort -- The property to sort by. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /content-update-policies/queryCombinedContentUpdatePolicyMembers + /content-update-policies/queryCombinedContentUpdatePolicyMembers + + Keyword arguments + ----------------- + id : str + The ID of the Content Update Policy to search for members of. + filter : str + The filter expression that should be used to limit the results. + offset : int + The offset to start retrieving records from. + limit : int + The maximum records to return. Integer. [1-5000] + sort : str + The property to sort by. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -100,22 +111,32 @@ def query_policies_combined(self: object, Returns a set of Content Update Policies which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. String. - offset -- The offset to start retrieving records from. Integer. - limit -- The maximum records to return. Integer. [1-5000] - sort -- The property to sort by. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /content-update-policies/queryCombinedContentUpdatePolicies + /content-update-policies/queryCombinedContentUpdatePolicies + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. + offset : int + The offset to start retrieving records from. + limit : int + The maximum records to return. Integer. [1-5000] + sort : str + The property to sort by. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -133,20 +154,31 @@ def perform_action(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Perform the specified action on the Content Update Policies specified in the request. - Keyword arguments: - action_name -- The action to perform. String. - Allowed actions: - add-host-group override-revert - disable remove-host-group - enable remove-pinned-content-version - override-allow set-pinned-content-version - override-pause - action_parameters -- Action specific parameter options. Dictionary or list of dictionaries. - { - "name": "string", - "value": "string" - } - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html# + /content-update-policies/performContentUpdatePoliciesAction + + Keyword arguments + ----------------- + action_name : str + The action to perform. String. + Allowed actions: + add-host-group override-revert + disable remove-host-group + enable remove-pinned-content-version + override-allow set-pinned-content-version + override-pause + action_parameters : list + Action specific parameter options. Dictionary or list of dictionaries. + { + "name": "string", + "value": "string" + } + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "action_parameters": [ { @@ -158,18 +190,17 @@ def perform_action(self: object, "string" ] } - ids -- Content Update policy IDs to perform action against. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + ids : str or list[str] + Content Update policy IDs to perform action against. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /content-update-policies/performContentUpdatePoliciesAction + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = content_update_policy_action_payload(kwargs) @@ -190,19 +221,26 @@ def set_precedence(self: object, body: dict = None, **kwargs) -> Union[Dict[str, The first ID specified will have the highest precedence and the last ID specified will have the lowest. You must specify all non-Default Policies when updating precedence. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. - ids -- ID list in precedence order. String or list of strings. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /content-update-policies/setContentUpdatePoliciesPrecedence + /content-update-policies/setContentUpdatePoliciesPrecedence + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + ids : str or list[str] + ID list in precedence order. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, payload_value="ids") @@ -218,18 +256,25 @@ def set_precedence(self: object, body: dict = None, **kwargs) -> Union[Dict[str, def get_policies(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve a set of Content Update Policies by specifying their IDs. - Keyword arguments: - ids -- The IDs of the Content Update Policies to return. String or list of dictionaries. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/content-update-policies/getContentUpdatePolicies + + Keyword arguments + ----------------- + ids : str or list[str] + The IDs of the Content Update Policies to return. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -243,8 +288,16 @@ def get_policies(self: object, parameters: dict = None, **kwargs) -> Union[Dict[ def create_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create Content Update Policies by specifying details about the policy to create. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/content-update-policies/createContentUpdatePolicies + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "resources": [ { @@ -262,18 +315,19 @@ def create_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str } ] } - description -- Content update policy description. String. - name -- Content update policy name. String. - settings -- Content update policy settings. Dictionary. + description : str + Content update policy description. + name : str + Content update policy name. + settings : dict + Content update policy settings. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/content-update-policies/createContentUpdatePolicies + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = content_update_policy_payload(kwargs) @@ -289,8 +343,16 @@ def create_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str def update_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update Content Update Policies by specifying the ID of the policy and details to update. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/content-update-policies/updateContentUpdatePolicies + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "resources": [ { @@ -309,16 +371,15 @@ def update_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str } ] } - parameters -- Full parameters payload dictionary. Not required if using other keywords. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/content-update-policies/updateContentUpdatePolicies + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = content_update_policy_payload(kwargs) @@ -334,18 +395,25 @@ def update_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str def delete_policies(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a set of Content Update Policies by specifying their IDs. - Keyword arguments: - ids -- The IDs of the Content Update Policies to delete. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/content-update-policies/deleteContentUpdatePolicies + + Keyword arguments + ----------------- + ids : str or list[str] + The IDs of the Content Update Policies to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -361,23 +429,34 @@ def query_policy_members(self: object, parameters: dict = None, **kwargs) -> Uni Returns a set of Agent IDs which match the filter criteria. - Keyword arguments: - id -- The ID of the Content Update Policy to search for members of. String. - filter -- The filter expression that should be used to limit the results. String. - offset -- The offset to start retrieving records from. Integer. - limit -- The maximum records to return. Integer. [1-5000] - sort -- The property to sort by. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /content-update-policies/queryContentUpdatePolicyMembers + /content-update-policies/queryContentUpdatePolicyMembers + + Keyword arguments + ----------------- + id : str + The ID of the Content Update Policy to search for members of. + filter : str + The filter expression that should be used to limit the results. + offset : int + The offset to start retrieving records from. + limit : int + The maximum records to return. Integer. [1-5000] + sort : str + The property to sort by. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -394,24 +473,32 @@ def query_pinnable_content_versions(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Search for content versions available for pinning given the category. - Keyword arguments: - category -- Content category. String. - Allowed values: - rapid_response_al_bl_listing system_critical - sensor_operations vulnerability_management - sort -- Value to sort returned content versions by. - Allowed values: deployed_timestamp - Default: deployed_timestamp.desc - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/content-update-policies/queryPinnableContentVersions + + Keyword arguments + ----------------- + category : str + Content category. String. + Allowed values: + rapid_response_al_bl_listing system_critical + sensor_operations vulnerability_management + sort : str + Value to sort returned content versions by. + Allowed values: deployed_timestamp + Default: deployed_timestamp.desc + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -427,21 +514,31 @@ def query_policies(self: object, parameters: dict = None, **kwargs) -> Union[Dic Returns a set of Content Update Policy IDs which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. String. - offset -- The offset to start retrieving records from. Integer. - limit -- The maximum records to return. Integer. [1-5000] - sort -- The property to sort by. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/content-update-policies/queryContentUpdatePolicies + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. + offset : int + The offset to start retrieving records from. + limit : int + The maximum records to return. Integer. [1-5000] + sort : str + The property to sort by. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/correlation_rules.py b/src/falconpy/correlation_rules.py index 3e27a7064..94ff4febc 100644 --- a/src/falconpy/correlation_rules.py +++ b/src/falconpy/correlation_rules.py @@ -64,20 +64,29 @@ def aggregate_rule_versions(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get rules aggregates as specified via json in the request body. - Keyword arguments: - body -- Full body payload as JSON formatted dictionary. - filter -- Filter results using FQL format. String. - ids -- The IDs to retrieve. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/correlation-rules/aggregates.rule-versions.post.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload as. + filter : str + Filter results using FQL format. + ids : str or list[str] + The IDs to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -95,25 +104,36 @@ def get_rules_combined(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Find all rules matching the query and filter. - Keyword arguments: - filter -- FQL query specifying the filter parameters. FQL formatted string. - Supported filters: customer_id, user_id, user_uuid, status, name, created_on, - last_updated_on - Supported range filters: created_on, last_updated_on - q -- Match query criteria, which includes all the filter string fields. String. - sort -- Rule property to sort on. FQL formatted string. - offset -- Starting index of overall result set from which to return IDs. Integer. - limit -- Number of IDs to return. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/correlation-rules/combined_rules.get.v1 + + Keyword arguments + ----------------- + filter : str + FQL query specifying the filter parameters. FQL formatted string. + Supported filters: customer_id, user_id, user_uuid, status, name, created_on, + last_updated_on + Supported range filters: created_on, last_updated_on + q : str + Match query criteria, which includes all the filter string fields. + sort : str + Rule property to sort on. + offset : int + Starting index of overall result set from which to return IDs. + limit : int + Number of IDs to return. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -130,25 +150,36 @@ def get_rules_combined_v2(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Find all rules matching the query and filter. - Keyword arguments: - filter -- FQL query specifying the filter parameters. FQL formatted string. - Supported filters: customer_id, user_id, user_uuid, status, name, created_on, - last_updated_on - Supported range filters: created_on, last_updated_on - q -- Match query criteria, which includes all the filter string fields. String. - sort -- Rule property to sort on. FQL formatted string. - offset -- Starting index of overall result set from which to return IDs. Integer. - limit -- Number of IDs to return. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/correlation-rules/combined.rules.get.v2 + + Keyword arguments + ----------------- + filter : str + FQL query specifying the filter parameters. FQL formatted string. + Supported filters: customer_id, user_id, user_uuid, status, name, created_on, + last_updated_on + Supported range filters: created_on, last_updated_on + q : str + Match query criteria, which includes all the filter string fields. + sort : str + Rule property to sort on. + offset : int + Starting index of overall result set from which to return IDs. + limit : int + Number of IDs to return. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -166,19 +197,28 @@ def get_latest_rule_versions(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve latest rule versions by rule IDs. - Keyword arguments: - rule_ids -- The rule IDs to retrieve. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'rule_ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/correlation-rules/entities.latest-rules.get.v1 + + Keyword arguments + ----------------- + rule_ids : str or list[str] + The rule IDs to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'rule_ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -192,8 +232,17 @@ def get_latest_rule_versions(self: object, def export_rule(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Export rule versions. - Keyword arguments: - body -- Full body payload provided as a JSON format dictionary. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html# + /correlation-rules/entities.rule-versions_export.post.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a JSON format. { "get_latest": boolean, "report_format": "string", @@ -202,21 +251,23 @@ def export_rule(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Un "sort": "string" } } - filter -- Filter to use to filter rules. String. - get_latest -- Flag indicating if the latest rule version should be exported. Boolean. - report_format -- Format to use for rule export. String. - search -- Rule search to perform. Overrides filter and sort keywords. Dictionary. - sort -- Sort to use for rule export. String. + filter : str + Filter to use to filter rules. + get_latest : bool + Flag indicating if the latest rule version should be exported. + report_format : str + Format to use for rule export. + search : dict + Rule search to perform. Overrides filter and sort keywords. + sort : str + Sort to use for rule export. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /correlation-rules/entities.rule-versions_export.post.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = correlation_rules_export_payload(passed_keywords=kwargs) @@ -232,19 +283,26 @@ def export_rule(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Un def import_rule(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Import rule. - Keyword arguments: - body -- Rule to be imported. Not required if rule is provided. JSON formatted dictionary. - rule -- Rule to be imported. JSON formatted dictionary. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /correlation-rules/entities.rule-versions_import.post.v1 + /correlation-rules/entities.rule-versions_import.post.v1 + + Keyword arguments + ----------------- + body : dict + Rule to be imported. Not required if rule is provided. + rule : dict + Rule to be imported. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = kwargs.get("rule", None) @@ -260,22 +318,29 @@ def import_rule(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Un def publish_rule_version(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Publish existing rule version. - Keyword arguments: - body -- Full body payload provided as a JSON format dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html# + /correlation-rules/entities.rule-versions_publish.patch.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a JSON format dictionary. Not required if using other keywords. { "id": "string" } - id -- Correlation rule version ID to be published. String. + id : str + Correlation rule version ID to be published. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /correlation-rules/entities.rule-versions_publish.patch.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = { @@ -297,20 +362,29 @@ def delete_rule_versions(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete rule versions by IDs. - Keyword arguments: - ids -- The rule version IDs to delete. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /correlation-rules/entities.rule-versions.delete.v1 + /correlation-rules/entities.rule-versions.delete.v1 + + Keyword arguments + ----------------- + ids : str or list[str] + The rule version IDs to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -328,19 +402,28 @@ def get_rules(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve rules by IDs. - Keyword arguments: - ids -- The IDs to retrieve. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/correlation-rules/entities_rules.get.v1 + + Keyword arguments + ----------------- + ids : str or list[str] + The IDs to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -358,19 +441,28 @@ def get_rules_v2(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve rule versions by IDs. - Keyword arguments: - ids -- The rule IDs to retrieve. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/correlation-rules/entities.rules.get.v2 + + Keyword arguments + ----------------- + ids : str or list[str] + The rule IDs to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -384,8 +476,16 @@ def get_rules_v2(self: object, def create_rule(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create rule. - Keyword arguments: - body -- Full body payload provided as a JSON format dictionary. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/correlation-rules/entities_rules.post.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a JSON format. { "anomaly": { "event_field_name": "string", @@ -473,31 +573,45 @@ def create_rule(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Un "template_id": "string", "trigger_on_create": boolean } - anomaly -- Anomaly detection configuration. Dictionary. - comment -- Correlation rule comment. String. - customer_id -- CID for the tenant. String. - description -- Correlation rule description. String. - guardrail_notifications -- List of guardrail notifications. List of dictionaries. - mitre_attack -- List of MITRE ATT&CK tactic and technique mappings. List of dictionaries. - name -- Correlation rule name. String. - notifications -- List of notifications to implement. List of dictionaries. - operation -- Operation to perform. Dictionary. - search -- Search to perform. Dictionary. - severity -- Correlation severity. Integer. - status -- Correlation rule status. String. - tactic -- Identified tactic. String. - technique -- Identified technique. String. - template_id -- Template identifier to base the rule on. String. - trigger_on_create -- Flag indicating if the rule triggers on creation. Boolean. + anomaly : dict + Anomaly detection configuration. + comment : str + Correlation rule comment. + customer_id : str + CID for the tenant. + description : str + Correlation rule description. + guardrail_notifications : list[dict] + List of guardrail notifications. + mitre_attack : list[dict] + List of MITRE ATT&CK tactic and technique mappings. + name : str + Correlation rule name. + notifications : list[dict] + List of notifications to implement. + operation : dict + Operation to perform. + search : dict + Search to perform. + severity : int + Correlation severity. + status : str + Correlation rule status. + tactic : str + Identified tactic. + technique : str + Identified technique. + template_id : str + Template identifier to base the rule on. + trigger_on_create : bool + Flag indicating if the rule triggers on creation. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/correlation-rules/entities_rules.post.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = correlation_rules_payload(passed_keywords=kwargs) @@ -517,18 +631,23 @@ def delete_rules(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete rules by IDs. - Keyword arguments: - ids -- The IDs to delete. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/correlation-rules/entities_rules.delete.v1 - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/correlation-rules/entities_rules.delete.v1 + + Keyword arguments + ----------------- + ids : str or list[str] + The IDs to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -542,8 +661,16 @@ def delete_rules(self: object, def update_rule(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update rule. - Keyword arguments: - body -- Full body payload provided as a JSON format dictionary. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/correlation-rules/entities_rules.patch.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a JSON format. [{ "anomaly": { "event_field_name": "string", @@ -632,32 +759,47 @@ def update_rule(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Un "template_id": "string", "trigger_on_create": boolean }] - anomaly -- Anomaly detection configuration. Dictionary. - comment -- Correlation rule comment. String. - customer_id -- CID for the tenant. String. - description -- Correlation rule description. String. - guardrail_notifications -- List of guardrail notifications. List of dictionaries. - id -- Correlation rule ID to be updated. String. - mitre_attack -- List of MITRE ATT&CK tactic and technique mappings. List of dictionaries. - name -- Correlation rule name. String. - notifications -- List of notifications to implement. List of dictionaries. - operation -- Operation to perform. Dictionary. - search -- Search to perform. Dictionary. - severity -- Correlation severity. Integer. - status -- Correlation rule status. String. - tactic -- Identified tactic. String. - technique -- Identified technique. String. - template_id -- Template identifier to base the rule on. String. - trigger_on_create -- Flag indicating if the rule triggers on creation. Boolean. + anomaly : dict + Anomaly detection configuration. + comment : str + Correlation rule comment. + customer_id : str + CID for the tenant. + description : str + Correlation rule description. + guardrail_notifications : list[dict] + List of guardrail notifications. + id : str + Correlation rule ID to be updated. + mitre_attack : list[dict] + List of MITRE ATT&CK tactic and technique mappings. + name : str + Correlation rule name. + notifications : list[dict] + List of notifications to implement. + operation : dict + Operation to perform. + search : dict + Search to perform. + severity : int + Correlation severity. + status : str + Correlation rule status. + tactic : str + Identified tactic. + technique : str + Identified technique. + template_id : str + Template identifier to base the rule on. + trigger_on_create : bool + Flag indicating if the rule triggers on creation. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/correlation-rules/entities_rules.patch.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = correlation_rules_payload(passed_keywords=kwargs) @@ -677,25 +819,36 @@ def update_rule(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Un def query_rules(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Find all rule IDs matching the query and filter. - Keyword arguments: - filter -- FQL query specifying the filter parameters. FQL formatted string. - Supported filters: customer_id, user_id, user_uuid, status, name, created_on, - last_updated_on - Supported range filters: created_on, last_updated_on - q -- Match query criteria, which includes all the filter string fields. String. - sort -- Rule property to sort on. FQL formatted string. - offset -- Starting index of overall result set from which to return IDs. Integer. - limit -- Number of IDs to return. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/correlation-rules/queries_rules.get.v1 + + Keyword arguments + ----------------- + filter : str + FQL query specifying the filter parameters. FQL formatted string. + Supported filters: customer_id, user_id, user_uuid, status, name, created_on, + last_updated_on + Supported range filters: created_on, last_updated_on + q : str + Match query criteria, which includes all the filter string fields. + sort : str + Rule property to sort on. + offset : int + Starting index of overall result set from which to return IDs. + limit : int + Number of IDs to return. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -709,25 +862,36 @@ def query_rules(self: object, parameters: dict = None, **kwargs) -> Union[Dict[s def query_rules_v2(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Find all rule version IDs matching the query and filter. - Keyword arguments: - filter -- FQL query specifying the filter parameters. FQL formatted string. - Supported filters: customer_id, user_id, user_uuid, status, name, created_on, - last_updated_on, state, version, rule_id, executor_rule_id - Supported range filters: created_on, last_updated_on - q -- Match query criteria, which includes all the filter string fields. String. - sort -- Rule property to sort on. FQL formatted string. - offset -- Starting index of overall result set from which to return IDs. Integer. - limit -- Number of IDs to return. Integer. Default: 100 - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/correlation-rules/queries.rules.get.v2 + + Keyword arguments + ----------------- + filter : str + FQL query specifying the filter parameters. FQL formatted string. + Supported filters: customer_id, user_id, user_uuid, status, name, created_on, + last_updated_on, state, version, rule_id, executor_rule_id + Supported range filters: created_on, last_updated_on + q : str + Match query criteria, which includes all the filter string fields. + sort : str + Rule property to sort on. + offset : int + Starting index of overall result set from which to return IDs. + limit : int + Number of IDs to return. Integer. Default: 100 + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -744,25 +908,35 @@ def search_rule_template_ids(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Search rule template IDs matching the filter. - Keyword arguments: - filter -- FQL query specifying the filter parameters. String. - Supported filters: - name description vendor - outcome mitre_attack.tactic_id mitre_attack.technique_id - type created_on last_updated_on - sort -- Rule property to sort on. String. - offset -- Starting index of overall result set from which to return IDs. Integer. - limit -- Number of IDs to return. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/correlation-rules/queries.templates.get.v1Mixin0 + + Keyword arguments + ----------------- + filter : str + FQL query specifying the filter parameters. String. + Supported filters: + name description vendor + outcome mitre_attack.tactic_id mitre_attack.technique_id + type created_on last_updated_on + sort : str + Rule property to sort on. + offset : int + Starting index of overall result set from which to return IDs. + limit : int + Number of IDs to return. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -776,8 +950,16 @@ def search_rule_template_ids(self: object, def create_rule_from_template(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create rule from template. - Keyword arguments: - body -- Full body payload as JSON formatted dictionary. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/correlation-rules/entities.templates_rules.post.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload as. [ { "customer_id": "string", @@ -862,15 +1044,15 @@ def create_rule_from_template(self: object, body: dict = None, **kwargs) -> Unio ] } ] - customer_id -- Customer ID for the rule template. String. - templates -- List of rule template definitions to create rules from. List of dictionaries. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/correlation-rules/entities.templates_rules.post.v1 + customer_id : str + Customer ID for the rule template. + templates : list[dict] + List of rule template definitions to create rules from. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = correlation_rules_template_payload(passed_keywords=kwargs) @@ -890,21 +1072,30 @@ def get_rule_templates_by_id(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve rule templates by IDs. - Keyword arguments: - ids -- The IDs. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + HTTP Method: GET - This method only supports keywords for providing arguments. + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/correlation-rules/entities.templates.get.v1Mixin0 - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. + Keyword arguments + ----------------- + ids : str or list[str] + The IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. - Returns: dict object containing API response. + This method only supports keywords for providing arguments. - HTTP Method: GET + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/correlation-rules/entities.templates.get.v1Mixin0 + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/correlation_rules_admin.py b/src/falconpy/correlation_rules_admin.py index a727050a2..074e2d659 100644 --- a/src/falconpy/correlation_rules_admin.py +++ b/src/falconpy/correlation_rules_admin.py @@ -37,6 +37,7 @@ """ from typing import Dict, Union from ._util import force_default, process_service_request +from ._payload import entities_rules_ownership_put_v2_payload from ._result import Result from ._service_class import ServiceClass from ._endpoint._correlation_rules_admin import _correlation_rules_admin_endpoints as Endpoints @@ -60,35 +61,96 @@ class CorrelationRulesAdmin(ServiceClass): def change_correlation_rule_owner(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Change the owner of an existing Correlation Rule. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PUT + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/correlation-rules-admin/entities.rules_ownership.put.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "api_client_id": "string", "id": "string", "user_id": "string", "user_uuid": "string" } - api_client_id -- The API client ID. String. - id -- The rule ID. String. - user_id -- The user ID. String. - user_uuid -- The user UUID. String. + api_client_id : str + The API client ID. + id : str + The rule ID. + user_id : str + The user ID. + user_uuid : str + The user UUID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = correlation_rules_admin_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="entities_rules_ownership_put_v1", + body=body + ) + + @force_default(defaults=["body"], default_types=["dict"]) + def entities_rules_ownership_put_v2(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Bulk change the owner of existing Correlation Rules. HTTP Method: PUT Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/correlation-rules-admin/entities.rules_ownership.put.v1 + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/correlation-rules-admin/entities_rules_ownership_put_v2 + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "api_client_id": "string", + "ids": [ + "string" + ], + "user_id": "string", + "user_uuid": "string" + } + api_client_id : str + The api_client_id value. + ids : list + The ids value. + user_id : str + The user_id value. + user_uuid : str + The user_uuid value. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: - body = correlation_rules_admin_payload(passed_keywords=kwargs) + body = entities_rules_ownership_put_v2_payload(passed_keywords=kwargs) return process_service_request( calling_object=self, endpoints=Endpoints, - operation_id="entities_rules_ownership_put_v1", + operation_id="entities_rules_ownership_put_v2", body=body ) diff --git a/src/falconpy/correlation_rules_admin.pyi b/src/falconpy/correlation_rules_admin.pyi index 5352efc77..2b82909c8 100644 --- a/src/falconpy/correlation_rules_admin.pyi +++ b/src/falconpy/correlation_rules_admin.pyi @@ -16,4 +16,14 @@ class CorrelationRulesAdmin(ServiceClass): body: Optional[dict] = None, ) -> Union[Dict[str, Union[int, dict]], Result]: ... + def entities_rules_ownership_put_v2( + self, + *, + api_client_id: Optional[str] = None, + ids: Optional[Union[str, List[str]]] = None, + user_id: Optional[str] = None, + user_uuid: Optional[str] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + entities_rules_ownership_put_v1 = change_correlation_rule_owner diff --git a/src/falconpy/cspm_registration.py b/src/falconpy/cspm_registration.py index 13f97a0d0..7744b9677 100644 --- a/src/falconpy/cspm_registration.py +++ b/src/falconpy/cspm_registration.py @@ -68,29 +68,45 @@ class CSPMRegistration(ServiceClass): def get_aws_account(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Return information about the current status of an AWS account. - Keyword arguments: - scan_type -- Type of scan, `dry` or `full`, to perform on selected accounts - cspm_lite -- Only return CSPM lite accounts. Boolean. - ids -- AWS account IDs. String or list of strings. - iam_role_arns -- AWS IAM role ARNs. String or list of strings. - organization_ids -- AWS organization IDs. String or list of strings. - limit -- The maximum number of records to return in this response. [Integer, 1-1000] - Use with the offset parameter to manage pagination of results. Defaults to 100. - migrated -- Only return migrated d4c accounts. (true / false) String. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - status -- Account status to filter results by. String. - group_by -- Field to group by. String. (Only acceptable value: `organization`) - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/GetCSPMAwsAccount + + Keyword arguments + ----------------- + scan_type : str + Type of scan, `dry` or `full`, to perform on selected accounts + cspm_lite : str + Only return CSPM lite accounts. + ids : str or list[str] + AWS account IDs. + iam_role_arns : str or list[str] + AWS IAM role ARNs. + organization_ids : str or list[str] + AWS organization IDs. + limit : int + The maximum number of records to return in this response. [Integer, 1-1000] + Use with the offset parameter to manage pagination of results. Defaults to 100. + migrated : str + Only return migrated d4c accounts. (true / false) + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + status : str + Account status to filter results by. + group_by : str + Field to group by. String. (Only acceptable value: `organization`) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("scan_type", None): kwargs["scan-type"] = kwargs.get("scan_type", None) @@ -113,8 +129,16 @@ def create_aws_account(self: object, body: dict = None, **kwargs) -> Union[Dict[ Creates a new account in our system for a customer and generates a script to run in their AWS cloud environment to grant CrowdStrike Horizon access. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/CreateCSPMAwsAccount + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "resources": [ { @@ -138,30 +162,43 @@ def create_aws_account(self: object, body: dict = None, **kwargs) -> Union[Dict[ } ] } - account_id -- AWS Account ID. String. - account_type -- AWS account type. String. - behavior_assessment_enabled -- Indicate if behavior assessment should be enabled. Boolean. - cloudtrail_region -- AWS Cloudtrail Region. String. - deployment_method -- Deployment method. String. - dspm_enabled -- Flag indicating if DSPM should be enabled. Boolean. - dspm_role -- DSPM role. String. - falcon_client_id -- Falcon Client ID. String. - iam_role_arn -- IAM role ARN to use. String. - is_master -- Indicate if this is the primary account. Boolean. - organization_id -- AWS Organization ID. String. - root_stack_id -- Root stack ID. String. - sensor_management_enabled -- Indicate if sensor management should be enabled. Boolean. - target_ous -- List of target OUs. String or list of strings. - use_existing_cloudtrail -- Indicate if the existing CloudTrail should be used. Boolean. + account_id : str + AWS Account ID. + account_type : str + AWS account type. + behavior_assessment_enabled : bool + Indicate if behavior assessment should be enabled. + cloudtrail_region : str + AWS Cloudtrail Region. + deployment_method : str + Deployment method. + dspm_enabled : bool + Flag indicating if DSPM should be enabled. + dspm_role : str + DSPM role. + falcon_client_id : str + Falcon Client ID. + iam_role_arn : str + IAM role ARN to use. + is_master : bool + Indicate if this is the primary account. + organization_id : str + AWS Organization ID. + root_stack_id : str + Root stack ID. + sensor_management_enabled : bool + Indicate if sensor management should be enabled. + target_ous : str or list[str] + List of target OUs. + use_existing_cloudtrail : bool + Indicate if the existing CloudTrail should be used. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/CreateCSPMAwsAccount + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cspm_registration_payload(passed_keywords=kwargs) @@ -177,19 +214,29 @@ def create_aws_account(self: object, body: dict = None, **kwargs) -> Union[Dict[ def delete_aws_account(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete an existing AWS Account or Organization by specifying their IDs. - Keyword arguments: - ids -- AWS Account IDs to remove. String or list of strings. - organization_ids -- AWS Organization IDs to be removed. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/DeleteCSPMAwsAccount + + Keyword arguments + ----------------- + ids : str or list[str] + AWS Account IDs to remove. + organization_ids : str or list[str] + AWS Organization IDs to be removed. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("organization_ids", None): kwargs["organization-ids"] = kwargs.get("organization_ids", None) @@ -206,8 +253,16 @@ def delete_aws_account(self: object, parameters: dict = None, **kwargs) -> Union def update_aws_account(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Patches a existing account in our system for a customer. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/PatchCSPMAwsAccount + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "resources": [ { @@ -221,22 +276,27 @@ def update_aws_account(self: object, body: dict = None, **kwargs) -> Union[Dict[ } ] } - account_id -- AWS Account ID. String. - behavior_assessment_enabled -- Indicate if behavior assessment should be enabled. Boolean. - cloudtrail_region -- AWS Cloudtrail Region. String. - iam_role_arn -- IAM role ARN to use. String. - remediation_region -- AWS region to remediation. String. - remediation_tou_accepted -- Timestamp formatted string. - cloudtrail_region -- AWS Cloudtrail Region. String. + account_id : str + AWS Account ID. + behavior_assessment_enabled : bool + Indicate if behavior assessment should be enabled. + cloudtrail_region : str + AWS Cloudtrail Region. + iam_role_arn : str + IAM role ARN to use. + remediation_region : str + AWS region to remediation. + remediation_tou_accepted : str + Timestamp formatted. + cloudtrail_region : str + AWS Cloudtrail Region. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/PatchCSPMAwsAccount + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cspm_registration_payload(passed_keywords=kwargs) @@ -258,28 +318,39 @@ def get_aws_console_setup_urls(self: object, Returns a URL for customers to visit in their cloud environment to grant access to CrowdStrike. - Keyword arguments: - ids -- AWS Account IDs to retrieve setup URLs for. String or list of strings. - use_existing_cloudtrail -- Use the existing AWS cloudtrail. (true / false) String. - parameters -- full parameters payload, not required if using other keywords. - region -- AWS Region. String. - tags -- Base64 encoded JSON string to be used as AWS tags. String. - template -- Template to be rendered. String. - Allowed values: - aws-url aws-sensor-management-url - aws-iom-url aws-dspm-url - aws-ioa-url aws-idp-ur - aws-modular-cft-url - aws-modular-cft-gov-commercial-url - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/GetCSPMAwsConsoleSetupURLs + + Keyword arguments + ----------------- + ids : str or list[str] + AWS Account IDs to retrieve setup URLs for. + use_existing_cloudtrail : str + Use the existing AWS cloudtrail. (true / false) + parameters : dict + Full parameters payload. Not required if using other keywords. + region : str + AWS Region. + tags : str + Base64 encoded JSON string to be used as AWS tags. + template : str + Template to be rendered. String. + Allowed values: + aws-url aws-sensor-management-url + aws-iom-url aws-dspm-url + aws-ioa-url aws-idp-ur + aws-modular-cft-url + aws-modular-cft-gov-commercial-url + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -299,30 +370,49 @@ def get_aws_account_scripts_attachment(self: object, Return a script for customers to run in their cloud environment to grant access to CrowdStrike for their AWS environment. - Keyword arguments: - account_type -- CSPM account type. String. Allowed values: gov, commercial - accounts -- List of accounts to register. String or list of strings. Format: account,profile - aws_profile -- The AWS profile to be used during registration. String. - behavior_assessment_enabled -- Enable behavior assessment. String. Allowed values: true, false - custom_role_name -- The custom IAM role to be used during registration. String. - dspm_enabled -- Flag indicating if DSPM is enabled. String. Allowed values: true, false - dspm_regions -- List of DSPM regions. Comma delimited string. - dspm_role -- DSPM role. String. - ids -- List of AWS Account IDs to retrieve the script for. String or list of strings. - organization_id -- The AWS organization ID to be registered. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - sensor_management_enabled -- Enable sensor management. String. Allowed values: true, false - template -- Template to be rendered. String. Allowed values: aws-bash, aws-terraform - use_existing_cloudtrail -- Use the existing cloudtrail log. String. Allowed values: true, false - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/GetCSPMAwsAccountScriptsAttachment + + Keyword arguments + ----------------- + account_type : str + CSPM account type. String. Allowed values: gov, commercial + accounts : str or list[str] + List of accounts to register. String or list of strings. Format: account,profile + aws_profile : str + The AWS profile to be used during registration. + behavior_assessment_enabled : str + Enable behavior assessment. String. Allowed values: true, false + custom_role_name : str + The custom IAM role to be used during registration. + dspm_enabled : str + Flag indicating if DSPM is enabled. String. Allowed values: true, false + dspm_regions : str or list[str] + List of DSPM regions. Comma delimited. + dspm_role : str + DSPM role. + ids : str or list[str] + List of AWS Account IDs to retrieve the script for. + organization_id : str + The AWS organization ID to be registered. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + sensor_management_enabled : str + Enable sensor management. String. Allowed values: true, false + template : str + Template to be rendered. String. Allowed values: aws-bash, aws-terraform + use_existing_cloudtrail : str + Use the existing cloudtrail log. String. Allowed values: true, false + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -336,26 +426,39 @@ def get_aws_account_scripts_attachment(self: object, def get_azure_account(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Return information about Azure account registration. - Keyword arguments: - scan_type -- Type of scan, `dry` or `full`, to perform on selected accounts - cspm_lite -- Only return CSPM lite accounts. Boolean. - ids -- Azure account IDs. String or list of strings. - limit -- The maximum number of records to return in this response. [Integer, 1-1000] - Use with the offset parameter to manage pagination of results. Defaults to 100. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - status -- Account status to filter results by. String. - tenant_ids -- Azure tenant IDs to filter results. String or list of strings. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/GetCSPMAzureAccount + + Keyword arguments + ----------------- + scan_type : str + Type of scan, `dry` or `full`, to perform on selected accounts + cspm_lite : str + Only return CSPM lite accounts. + ids : str or list[str] + Azure account IDs. + limit : int + The maximum number of records to return in this response. [Integer, 1-1000] + Use with the offset parameter to manage pagination of results. Defaults to 100. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + status : str + Account status to filter results by. + tenant_ids : str or list[str] + Azure tenant IDs to filter results. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("scan_type", None): kwargs["scan-type"] = kwargs.get("scan_type", None) @@ -375,8 +478,16 @@ def create_azure_account(self: object, body: dict = None, **kwargs) -> Union[Dic Creates a new account in our system for a customer and generates a script to run in their cloud environment to grant CrowdStrike Horizon access. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/CreateCSPMAzureAccount + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "resources": [ { @@ -389,21 +500,25 @@ def create_azure_account(self: object, body: dict = None, **kwargs) -> Union[Dic } ] } - account_type -- Azure account type. String. - client_id -- Azure Client ID. String. - default_subscription -- Indicate if this is the default subscription. Boolean. - subscription_id -- Azure Subscription ID. String. - tenant_id -- Azure Tenant ID. String. - years_valid -- Number of years this account is valid. Integer. + account_type : str + Azure account type. + client_id : str + Azure Client ID. + default_subscription : bool + Indicate if this is the default subscription. + subscription_id : str + Azure Subscription ID. + tenant_id : str + Azure Tenant ID. + years_valid : int + Number of years this account is valid. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/CreateCSPMAzureAccount + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cspm_registration_payload(passed_keywords=kwargs) @@ -419,8 +534,16 @@ def create_azure_account(self: object, body: dict = None, **kwargs) -> Union[Dic def update_azure_account(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update Azure account. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/UpdateCSPMAzureAccount + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "resources": [ { @@ -429,21 +552,25 @@ def update_azure_account(self: object, body: dict = None, **kwargs) -> Union[Dic } ] } - account_type -- Azure account type. String. - client_id -- Azure Client ID. String. - default_subscription -- Indicate if this is the default subscription. Boolean. - subscription_id -- Azure Subscription ID. String. - tenant_id -- Azure Tenant ID. String. - years_valid -- Number of years this account is valid. Integer. + account_type : str + Azure account type. + client_id : str + Azure Client ID. + default_subscription : bool + Indicate if this is the default subscription. + subscription_id : str + Azure Subscription ID. + tenant_id : str + Azure Tenant ID. + years_valid : int + Number of years this account is valid. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/UpdateCSPMAzureAccount + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cspm_registration_payload(passed_keywords=kwargs) @@ -463,21 +590,32 @@ def delete_azure_account(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete an existing Azure Subscription by specifying their IDs. - Keyword arguments: - ids -- List of Azure Subscription IDs to delete. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - retain_tenant -- Should the tenant be retainined. (true / false) String. - tenant_ids -- Azure tenant IDs to remove. String or list of strings. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/DeleteCSPMAzureAccount + + Keyword arguments + ----------------- + ids : str or list[str] + List of Azure Subscription IDs to delete. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + retain_tenant : str + Should the tenant be retainined. (true / false) + tenant_ids : str or list[str] + Azure tenant IDs to remove. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -498,21 +636,30 @@ def update_azure_account_client_id(self: object, Update an Azure service account in our system with the user-created client_id created with the public key we've provided. - Keyword arguments: - body -- There are no body payload parameters. This field is not used. Ignore. - id -- List of Azure Subscription IDs to delete. String or list of strings. - tenant_id -- Azure Tenant ID to update client ID for. - Required if multiple tenants are registered. - parameters -- full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/UpdateCSPMAzureAccountClientID + + Keyword arguments + ----------------- + body : dict + There are no body payload parameters. This field is not used. Ignore. + id : str + List of Azure Subscription IDs to delete. + tenant_id : str + Azure Tenant ID to update client ID for. + Required if multiple tenants are registered. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("tenant_id", None): kwargs["tenant-id"] = kwargs.get("tenant_id", None) @@ -537,23 +684,32 @@ def update_azure_tenant_default_subscription_id(self: object, Update an Azure service account in our system with the user-created client_id created with the public key we've provided. - Keyword arguments: - body -- There are no body payload parameters. This field is not used. Ignore. - subscription_id -- Default Subscription ID to patch for all subscriptions - belonging to the tenant. String. - tenant_id -- Azure Tenant ID to update client ID for. - Required if multiple tenants are registered. - parameters -- full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /cspm-registration/UpdateCSPMAzureTenantDefaultSubscriptionID + /cspm-registration/UpdateCSPMAzureTenantDefaultSubscriptionID + + Keyword arguments + ----------------- + body : dict + There are no body payload parameters. This field is not used. Ignore. + subscription_id : str + Default Subscription ID to patch for all subscriptions + belonging to the tenant. + tenant_id : str + Azure Tenant ID to update client ID for. + Required if multiple tenants are registered. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("tenant_id", None): kwargs["tenant-id"] = kwargs.get("tenant_id", None) @@ -577,20 +733,29 @@ def azure_download_certificate(self: object, Returns JSON object(s) that contain the base64 encoded certificate for a service principal. - Keyword arguments: - tenant_id -- Azure Tenant ID to generate script for. - Defaults to the most recently registered tenant. - parameters -- full parameters payload, not required if tenant_id keyword is used. - - Arguments: When not specified, the first argument to this method is assumed to be - 'tenant_id'. All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/AzureDownloadCertificate + + Keyword arguments + ----------------- + tenant_id : str or list[str] + Azure Tenant ID to generate script for. + Defaults to the most recently registered tenant. + parameters : dict + full parameters payload, not required if tenant_id keyword is used. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'tenant_id'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -606,24 +771,34 @@ def get_azure_management_group(self: object, parameters: dict = None, **kwargs ) -> Union[Dict[str, Union[int, dict]], Result]: - """ - Return information about Azure management group registration. - - Keyword arguments: - limit -- The maximum number of records to return. Defaults to 100. Integer. - offset -- The offset to start retrieving records from. Integer. - parameters -- full parameters payload, not required if tenant_id keyword is used. - tenant_ids -- Azure Tenant ID to filter by. String or list of strings. - - Arguments: When not specified, the first argument to this method is assumed to be - 'tenant_ids'. All others are ignored. - - Returns: dict object containing API response. + """Return information about Azure management group registration. HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/GetCSPMAzureManagementGroup + + Keyword arguments + ----------------- + limit : int + The maximum number of records to return. Defaults to 100. + offset : int + The offset to start retrieving records from. + parameters : dict + full parameters payload, not required if tenant_id keyword is used. + tenant_ids : str or list[str] + Azure Tenant ID to filter by. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'tenant_ids'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -643,8 +818,16 @@ def create_azure_management_group(self: object, Creates a new account in our system for a customer and generates a script to run in their cloud environment to grant CrowdStrike Horizon access. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/CreateCSPMAzureManagementGroup + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "resources": [ { @@ -653,17 +836,17 @@ def create_azure_management_group(self: object, } ] } - default_subscription_id -- ID of the default azure subscription. String. - tenant_id -- Azure Tenant ID. String. + default_subscription_id : str + ID of the default azure subscription. + tenant_id : str + Azure Tenant ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/CreateCSPMAzureManagementGroup + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cspm_registration_payload(passed_keywords=kwargs) @@ -683,19 +866,28 @@ def delete_azure_management_group(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete an existing Azure Managment Group by specifying their IDs. - Keyword arguments: - tenant_ids -- AWS Organization IDs to be removed. String or list of strings. - parameters -- full parameters payload, not required if tenant_ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be - 'tenant_ids'. All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/DeleteCSPMAzureManagementGroup + + Keyword arguments + ----------------- + tenant_ids : str or list[str] + AWS Organization IDs to be removed. + parameters : dict + full parameters payload, not required if tenant_ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'tenant_ids'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -715,20 +907,30 @@ def azure_refresh_certificate(self: object, Returns JSON object(s) that contain the base64 encoded certificate for a service principal. - Keyword arguments: - tenant_id -- Azure Tenant ID to refresh. String. - parameters -- full parameters payload, not required if tenant_id keyword is used. - years_valid -- Years the certificate should be valid. Integer. Max: 2 - - Arguments: When not specified, the first argument to this method is assumed to be - 'tenant_id'. All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/AzureRefreshCertificate + + Keyword arguments + ----------------- + tenant_id : str or list[str] + Azure Tenant ID to refresh. + parameters : dict + full parameters payload, not required if tenant_id keyword is used. + years_valid : str + Years the certificate should be valid. Integer. Max: 2 + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'tenant_id'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -744,30 +946,42 @@ def get_azure_user_scripts_attachment(self: object, parameters: dict = None, **kwargs ) -> Union[Dict[str, Union[int, dict]], Result]: - """ - Retrieve Azure user script. + """Retrieve Azure user script. Return a script for customers to run in their cloud environment to grant access to CrowdStrike for their Azure environment. - Keyword arguments: - account_type -- Account type. ('commercial' or 'gov') String. - azure_management_group -- Use Azure Management Group. Boolean. - tenant_id -- Azure Tenant ID to generate script for. - Defaults to the most recently registered tenant. - parameters -- full parameters payload, not required if tenant_id keyword is used. - subscription_ids -- Subscription IDs to generate script for. Defaults to all. String or list of strings. - template -- Template to be rendered. String. - - Arguments: When not specified, the first argument to this method is assumed to be - 'tenant_id'. All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/GetCSPMAzureUserScriptsAttachment + + Keyword arguments + ----------------- + account_type : str + Account type. ('commercial' or 'gov') + azure_management_group : bool + Use Azure Management Group. + tenant_id : str + Azure Tenant ID to generate script for. + Defaults to the most recently registered tenant. + parameters : dict + full parameters payload, not required if tenant_id keyword is used. + subscription_ids : str or list[str] + Subscription IDs to generate script for. Defaults to all. + template : str + Template to be rendered. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'tenant_id'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("tenant_id", None): kwargs["tenant-id"] = kwargs.get("tenant_id", None) @@ -784,24 +998,36 @@ def get_azure_user_scripts_attachment(self: object, def get_gcp_account(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Return information about the current status of an GCP account. - Keyword arguments: - ids -- Hierarchical Resource IDs of accounts. String or list of strings. - limit -- The maximum records to return. Defaults to 100. Integer. - offset -- The offset to start retrieving records from. Integer. - parameters -- full parameters payload, not required if ids is provided as a keyword. - parent_type -- GCP Hierarchy Parent Type, organization/folder/project. String. - scan_type -- Type of scan, `dry` or `full`, to perform on selected accounts. - sort -- Order fields in ascending or descending order. Ex: parent_type|asc. - status -- Account status to filter results by, 'operational' or 'provisioned'. String. - - This method does not accept arguments or keywords. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/GetCSPMGCPAccount + + Keyword arguments + ----------------- + ids : str or list[str] + Hierarchical Resource IDs of accounts. + limit : int + The maximum records to return. Defaults to 100. + offset : int + The offset to start retrieving records from. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + parent_type : str + GCP Hierarchy Parent Type, organization/folder/project. + scan_type : str + Type of scan, `dry` or `full`, to perform on selected accounts. + sort : str + Order fields in ascending or descending order. Ex: parent_type|asc. + status : str + Account status to filter results by, 'operational' or 'provisioned'. String. + This method does not accept arguments or keywords. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("scan_type", None): kwargs["scan-type"] = kwargs.get("scan_type", None) @@ -821,8 +1047,16 @@ def create_gcp_account(self: object, body: dict = None, **kwargs) -> Union[Dict[ Creates a new account in our system for a customer and generates a new service account for them to add access to in their GCP environment to grant us access. - Keyword arguments: - body -- full body payload, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/CreateCSPMGCPAccount + + Keyword arguments + ----------------- + body : dict + full body payload, not required if using other keywords. { "resources": [ { @@ -831,17 +1065,17 @@ def create_gcp_account(self: object, body: dict = None, **kwargs) -> Union[Dict[ } ] } - parent_id -- GCP parent ID. String. - parent_type -- GCP parent type. String. + parent_id : str + GCP parent ID. + parent_type : str + GCP parent type. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/CreateCSPMGCPAccount + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = gcp_registration_payload(passed_keywords=kwargs) @@ -861,19 +1095,28 @@ def delete_gcp_account(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a GCP account from the system. - Keyword arguments: - ids -- Hierarchical Resource IDs of accounts. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/DeleteCSPMGCPAccount + + Keyword arguments + ----------------- + ids : str or list[str] + Hierarchical Resource IDs of accounts. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -887,8 +1130,16 @@ def delete_gcp_account(self: object, def update_gcp_account(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update a GCP account. - Keyword arguments: - body -- full body payload, not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/UpdateCSPMGCPAccount + + Keyword arguments + ----------------- + body : dict + full body payload, not required if using other keywords. { "resources": [ { @@ -897,17 +1148,17 @@ def update_gcp_account(self: object, body: dict = None, **kwargs) -> Union[Dict[ } ] } - environment -- GCP environment. String. - parent_id -- GCP parent ID. String. + environment : str + GCP environment. + parent_id : str + GCP parent ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/UpdateCSPMGCPAccount + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = gcp_registration_payload(passed_keywords=kwargs) @@ -926,8 +1177,16 @@ def connect_gcp_account(self: object, body: dict = None, **kwargs) -> Union[Dict Creates a new account in our system for a customer and generates a new service account for them to add access to in their GCP environment to grant us access. - Keyword arguments: - body -- full body payload, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/ConnectCSPMGCPAccount + + Keyword arguments + ----------------- + body : dict + full body payload, not required if using other keywords. { "resources": [ { @@ -942,23 +1201,29 @@ def connect_gcp_account(self: object, body: dict = None, **kwargs) -> Union[Dict } ] } - client_email -- GCP account email. String. - client_id -- GCP account client ID. String. - parent_id -- GCP parent ID. String. - parent_type -- GCP parent type. String. - private_key -- GCP private key. String. - private_key_id -- GCP private key ID. String. - project_id -- GCP project ID. String. - service_account_id -- GCP service account ID. Integer. + client_email : str + GCP account email. + client_id : str + GCP account client ID. + parent_id : str + GCP parent ID. + parent_type : str + GCP parent type. + private_key : str + GCP private key. + private_key_id : str + GCP private key ID. + project_id : str + GCP project ID. + service_account_id : int + GCP service account ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/ConnectCSPMGCPAccount + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = gcp_registration_payload(passed_keywords=kwargs) @@ -974,24 +1239,33 @@ def connect_gcp_account(self: object, body: dict = None, **kwargs) -> Union[Dict def validate_gcp_account(self: object, *args, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Run a synchronous health check. - Keyword arguments: - body -- full body payload, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/GetCSPMGCPValidateAccountsExt + + Keyword arguments + ----------------- + body : dict + full body payload, not required if using other keywords. { "resources": [ "string" ] } - resources -- GCP Account IDs to validate. String or list of strings. - - Arguments: When not specified, the first argument to this method is assumed to be 'resources'. - All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/GetCSPMGCPValidateAccountsExt + resources : str or list[str] + GCP Account IDs to validate. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'resources'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, @@ -1010,8 +1284,16 @@ def validate_gcp_account(self: object, *args, body: dict = None, **kwargs) -> Un def validate_gcp_service_account(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Validate credentials for a GCP service account. - Keyword arguments: - body -- full body payload, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/ValidateCSPMGCPServiceAccountExt + + Keyword arguments + ----------------- + body : dict + full body payload, not required if using other keywords. { "resources": [ { @@ -1033,24 +1315,30 @@ def validate_gcp_service_account(self: object, body: dict = None, **kwargs) -> U } ] } - client_email -- Client email associated with the service account. String. - client_id -- GCP Client ID. String. - private_key -- GCP private key. String. - private_key_id -- GCP private key ID. String. - project_id -- GCP project ID. String. - resources -- List of GCP service accounts to validate. List of dictionaries. - Overrides other keywords except for body. - service_account_conditions -- GCP service account conditions. List of dictionaries. - service_account_id -- GCP service account ID. Integer. + client_email : str + Client email associated with the service account. + client_id : str + GCP Client ID. + private_key : str + GCP private key. + private_key_id : str + GCP private key ID. + project_id : str + GCP project ID. + resources : str + List of GCP service accounts to validate. List of dictionaries. + Overrides other keywords except for body. + service_account_conditions : list[dict] + GCP service account conditions. + service_account_id : int + GCP service account ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/ValidateCSPMGCPServiceAccountExt + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cspm_service_account_validate_payload(passed_keywords=kwargs) @@ -1070,19 +1358,28 @@ def get_gcp_service_account(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Return the service account id and client email for external clients. - Keyword arguments: - id -- Service Account ID. String. - parameters -- full parameters payload, not required if id is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/GetCSPMGCPServiceAccountsExt + + Keyword arguments + ----------------- + id : str + Service Account ID. + parameters : dict + full parameters payload, not required if id is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1096,8 +1393,16 @@ def get_gcp_service_account(self: object, def update_gcp_service_account(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update a GCP service account. - Keyword arguments: - body -- full body payload, not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/UpdateCSPMGCPServiceAccountsExt + + Keyword arguments + ----------------- + body : dict + full body payload, not required if using other keywords. { "resources": [ { @@ -1121,24 +1426,30 @@ def update_gcp_service_account(self: object, body: dict = None, **kwargs) -> Uni } ] } - client_email -- Client email associated with the service account. String. - client_id -- GCP Client ID. String. - private_key -- GCP private key. String. - private_key_id -- GCP private key ID. String. - project_id -- GCP project ID. String. - resources -- List of GCP service accounts to validate. List of dictionaries. - Overrides other keywords except for body. - service_account_conditions -- GCP service account conditions. List of dictionaries. - service_account_id -- GCP service account ID. Integer. + client_email : str + Client email associated with the service account. + client_id : str + GCP Client ID. + private_key : str + GCP private key. + private_key_id : str + GCP private key ID. + project_id : str + GCP project ID. + resources : str + List of GCP service accounts to validate. List of dictionaries. + Overrides other keywords except for body. + service_account_conditions : list[dict] + GCP service account conditions. + service_account_id : int + GCP service account ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/UpdateCSPMGCPServiceAccountsExt + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cspm_service_account_validate_payload(passed_keywords=kwargs) @@ -1161,21 +1472,31 @@ def get_gcp_user_scripts_attachment(self: object, Return a script for customer to run in their cloud environment to grants access to the GCP environment as a downloadable attachment. - Keyword arguments: - ids -- Hierarchical Resource IDs of accounts. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - parent_type -- GCP Hierarchy Parent Type. String. - Allowed values: organization, folder, project - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/GetCSPMGCPUserScriptsAttachment + + Keyword arguments + ----------------- + ids : str or list[str] + Hierarchical Resource IDs of accounts. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + parent_type : str + GCP Hierarchy Parent Type. String. + Allowed values: organization, folder, project + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1192,61 +1513,81 @@ def get_behavior_detections(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve list of detected behaviors. - Keyword arguments: - account_id -- Cloud Account ID (AWS account ID, Azure Subscription ID, etc.) - aws_account_id -- AWS account ID. String. - azure_subscription_id -- Azure subscription ID. String. - azure_tenant_id -- Azure tenant ID. String. - cloud_provider -- Cloud provider. Allowed values: `azure`, `aws`, `gcp`. String. - date_time_since -- Filter to retrieve all events after this date. RFC3339 formatted string. - Example: 2006-01-01T12:00:01Z07:00 - limit -- The maximum number of records to return in this response. [Integer, 1-500] - next_token -- String to get next page of results, associated with the previous - execution. Must include all filters from previous execution. String. - resource_id -- Resource ID. String. - resource_uuid - Resource UUID. String. - service -- Cloud Service (Example: `EC2` or `S3`). String. - Available options - ACM Identity - ACR KMS - Any KeyVault - App Engine Kinesis - BigQuery Kubernetes - Cloud Load Balancing Lambda - Cloud Logging LoadBalancer - Cloud SQL Monitor - Cloud Storage NLB/ALB - CloudFormation NetworkSecurityGroup - CloudTrail PostgreSQL - CloudWatch Logs RDS - Cloudfront Redshift - Compute Engine S3 - Config SES - Disk SNS - DynamoDB SQLDatabase - EBS SQLServer - EC2 SQS - ECR SSM - EFS Serverless Application Repository - EKS StorageAccount - ELB Subscriptions - EMR VPC - Elasticache VirtualMachine - GuardDuty VirtualNetwork - IAM - severity -- Severity (e.g. `High`, `Medium` or `Informational`). String. - since -- Filter events using a duration string (e.g. 24h). String. Default: 24h - state -- State. (e.g. `open` or `closed`). String. - parameters - full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/GetBehaviorDetections + + Keyword arguments + ----------------- + account_id : str + Cloud Account ID (AWS account ID, Azure Subscription ID, etc.) + aws_account_id : str + AWS account ID. + azure_subscription_id : str + Azure subscription ID. + azure_tenant_id : str + Azure tenant ID. + cloud_provider : str + Cloud provider. Allowed values: `azure`, `aws`, `gcp` + date_time_since : str + Filter to retrieve all events after this date. RFC3339 formatted string. + Example: 2006-01-01T12:00:01Z07:00 + limit : int (1-500) + The maximum number of records to return in this response. + next_token : str + String to get next page of results, associated with the previous + execution. Must include all filters from previous execution. + resource_id : str or list[str] + Resource ID. + resource_uuid : str or list[str] + Resource UUID. + service : str + Cloud Service (Example: `EC2` or `S3`). String. + Available options + ACM Identity + ACR KMS + Any KeyVault + App Engine Kinesis + BigQuery Kubernetes + Cloud Load Balancing Lambda + Cloud Logging LoadBalancer + Cloud SQL Monitor + Cloud Storage NLB/ALB + CloudFormation NetworkSecurityGroup + CloudTrail PostgreSQL + CloudWatch Logs RDS + Cloudfront Redshift + Compute Engine S3 + Config SES + Disk SNS + DynamoDB SQLDatabase + EBS SQLServer + EC2 SQS + ECR SSM + EFS Serverless Application Repository + EKS StorageAccount + ELB Subscriptions + EMR VPC + Elasticache VirtualMachine + GuardDuty VirtualNetwork + IAM + severity : str + Severity (e.g. `High`, `Medium` or `Informational`) + since : str + Filter events using a duration string (e.g. 24h). String. Default: 24h + state : str + State. (e.g. `open` or `closed`) + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1263,57 +1604,74 @@ def get_configuration_detections(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve list of active misconfigurations. - Keyword arguments: - account_id -- Cloud Account ID (AWS account ID, Azure Subscription ID, etc.) - aws_account_id -- AWS account ID. String. - azure_subscription_id -- Azure subscription ID. String. - azure_tenant_id -- Azure tenant ID. String. - cloud_provider -- Cloud provider. Allowed values: `azure`, `aws`, `gcp`. String. - limit -- The maximum number of records to return in this response. [Integer, 1-500] - next_token -- String to get next page of results, associated with the previous - execution. Cannot be combined with any filter except `limit`. String. - region -- Cloud Provider Region (Example: `us-east-1`). String. - service -- Cloud Service (Example: `EC2` or `S3`). String. - Available options - ACM Identity - ACR KMS - Any KeyVault - App Engine Kinesis - BigQuery Kubernetes - Cloud Load Balancing Lambda - Cloud Logging LoadBalancer - Cloud SQL Monitor - Cloud Storage NLB/ALB - CloudFormation NetworkSecurityGroup - CloudTrail PostgreSQL - CloudWatch Logs RDS - Cloudfront Redshift - Compute Engine S3 - Config SES - Disk SNS - DynamoDB SQLDatabase - EBS SQLServer - EC2 SQS - ECR SSM - EFS Serverless Application Repository - EKS StorageAccount - ELB Subscriptions - EMR VPC - Elasticache VirtualMachine - GuardDuty VirtualNetwork - IAM - severity -- Severity (e.g. `High`, `Medium` or `Informational`). String. - status -- Status (e.g. `new`, `reoccurring`, or `all`). String. - parameters - full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/GetConfigurationDetections + + Keyword arguments + ----------------- + account_id : str + Cloud Account ID (AWS account ID, Azure Subscription ID, etc.) + aws_account_id : str + AWS account ID. + azure_subscription_id : str + Azure subscription ID. + azure_tenant_id : str + Azure tenant ID. + cloud_provider : str + Cloud provider. Allowed values: `azure`, `aws`, `gcp` + limit : int (1-500) + The maximum number of records to return in this response. + next_token : str + String to get next page of results, associated with the previous + execution. Cannot be combined with any filter except `limit` + region : str + Cloud Provider Region (Example: `us-east-1`) + service : str + Cloud Service (Example: `EC2` or `S3`). String. + Available options + ACM Identity + ACR KMS + Any KeyVault + App Engine Kinesis + BigQuery Kubernetes + Cloud Load Balancing Lambda + Cloud Logging LoadBalancer + Cloud SQL Monitor + Cloud Storage NLB/ALB + CloudFormation NetworkSecurityGroup + CloudTrail PostgreSQL + CloudWatch Logs RDS + Cloudfront Redshift + Compute Engine S3 + Config SES + Disk SNS + DynamoDB SQLDatabase + EBS SQLServer + EC2 SQS + ECR SSM + EFS Serverless Application Repository + EKS StorageAccount + ELB Subscriptions + EMR VPC + Elasticache VirtualMachine + GuardDuty VirtualNetwork + IAM + severity : str + Severity (e.g. `High`, `Medium` or `Informational`) + status : str + Status (e.g. `new`, `reoccurring`, or `all`) + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1329,21 +1687,29 @@ def get_configuration_detection_entities(self: object, parameters: dict = None, **kwargs ) -> dict: - """ - Get misconfigurations based on the ID - including custom policy detections in addition to default policy detections. - - Keyword arguments: - ids -- Detection IDs to retrieve. String or List of Strings. - parameters -- full parameters payload, not required ids keyword is used. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. All others are ignored. - - Returns: dict object containing API response. + """Get misconfigurations based on the ID - including custom policy detections in addition to default policy detections. HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/GetConfigurationDetectionEntities + + Keyword arguments + ----------------- + ids : str or list[str] + Detection IDs to retrieve. + parameters : dict + full parameters payload, not required ids keyword is used. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1357,18 +1723,25 @@ def get_configuration_detection_entities(self: object, def get_cloud_event_ids(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get list of related cloud event LogScale IDs for a given IOA. - Keyword arguments: - id -- IOA Aggregate Event ID. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/getCloudEventIDs + + Keyword arguments + ----------------- + id : str + IOA Aggregate Event ID. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1383,46 +1756,56 @@ def get_configuration_detection_ids_v2(self: object, parameters: dict = None, **kwargs ) -> dict: - """ - Get list of active misconfiguration ids - including custom policy detections in addition to default policy detections. - - Keyword arguments: - filter -- FQL formatted string to filter result. String. - Allowed filters - account_name policy_id - account_id policy_type - agent_id resource_id - attack_types region - azure_subscription_id status - cloud_provider scan_time - cloud_service_keyword severity - custom_policy_id severity_string - is_managed use_current_scan_ids (*) - (*) Use this to retrieve records for the latest scans - limit -- Maximum number of detections to return. Integer. (Default: 500) - next_token -- Token to use to retrieve the next page of results. - Cannot be combined with any filter except limit. String. - offset -- Starting offset for returned detections. Integer. - sort -- FQL formatted sort. String. Default: timestamp|desc - Allowed values - account_name policy_id - accoud_id policy_type - attack_types resource_id - azure_subscription_id region - cloud_provider scan_name - cloud_service_keyword severity - status severity_string - is_managed timestamp - parameters -- full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. + """Get list of active misconfiguration ids - including custom and default policy detections. HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/GetConfigurationDetectionIDsV2 + + Keyword arguments + ----------------- + filter : str + FQL formatted string to filter result. String. + Allowed filters + account_name policy_id + account_id policy_type + agent_id resource_id + attack_types region + azure_subscription_id status + cloud_provider scan_time + cloud_service_keyword severity + custom_policy_id severity_string + is_managed use_current_scan_ids (*) + (*) Use this to retrieve records for the latest scans + limit : int + Maximum number of detections to return. Integer. (Default: 500) + next_token : str + Token to use to retrieve the next page of results. + Cannot be combined with any filter except limit. + offset : int + Starting offset for returned detections. + sort : str + FQL formatted sort. String. Default: timestamp|desc + Allowed values + account_name policy_id + accoud_id policy_type + attack_types resource_id + azure_subscription_id region + cloud_provider scan_name + cloud_service_keyword severity + status severity_string + is_managed timestamp + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1436,29 +1819,45 @@ def get_configuration_detection_ids_v2(self: object, def get_ioa_events(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """For CSPM IOA events, gets list of IOA events. - Keyword arguments: - policy_id -- Policy ID. String. - cloud_provider -- Cloud provider. Allowed values: `azure`, `aws`, `gcp`. String. - account_id -- Cloud Account ID (AWS account ID, Azure Subscription ID, etc.) - aws_account_id -- AWS account ID. String. - azure_subscription_id -- Azure subscription ID. String. - azure_tenant_id -- Azure tenant ID. String. - user_ids -- User IDs. String or list of strings. - state -- State. String. - limit -- The maximum number of records to return in this response. [Integer, 1-500] - Use with the offset parameter to manage pagination of results. Defaults to 100. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/GetIOAEvents + + Keyword arguments + ----------------- + policy_id : str + Policy ID. + cloud_provider : str + Cloud provider. Allowed values: `azure`, `aws`, `gcp` + account_id : str + Cloud Account ID (AWS account ID, Azure Subscription ID, etc.) + aws_account_id : str + AWS account ID. + azure_subscription_id : str + Azure subscription ID. + azure_tenant_id : str + Azure tenant ID. + user_ids : str or list[str] + User IDs. + state : str + State. + limit : int + The maximum number of records to return in this response. [Integer, 1-500] + Use with the offset parameter to manage pagination of results. Defaults to 100. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1472,24 +1871,37 @@ def get_ioa_events(self: object, parameters: dict = None, **kwargs) -> Union[Dic def get_ioa_users(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """For CSPM IOA users, gets list of IOA users. - Keyword arguments: - policy_id -- Policy ID. String. - cloud_provider -- Cloud provider. Allowed values: `azure`, `aws`, `gcp`. String. - account_id -- Cloud Account ID (AWS account ID, Azure Subscription ID, etc.) - aws_account_id -- AWS account ID. String. - azure_subscription_id -- Azure subscription ID. String. - azure_tenant_id -- Azure tenant ID. String. - state -- State. String. - parameters - full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/GetIOAUsers + + Keyword arguments + ----------------- + policy_id : str + Policy ID. + cloud_provider : str + Cloud provider. Allowed values: `azure`, `aws`, `gcp` + account_id : str + Cloud Account ID (AWS account ID, Azure Subscription ID, etc.) + aws_account_id : str + AWS account ID. + azure_subscription_id : str + Azure subscription ID. + azure_tenant_id : str + Azure tenant ID. + state : str + State. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1503,19 +1915,28 @@ def get_ioa_users(self: object, parameters: dict = None, **kwargs) -> Union[Dict def get_policy(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Given a policy ID, returns detailed policy information. - Keyword arguments: - ids -- Policy IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/GetCSPMPolicy + + Keyword arguments + ----------------- + ids : int + Policy IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1529,19 +1950,28 @@ def get_policy(self: object, *args, parameters: dict = None, **kwargs) -> Union[ def get_policy_details(self: object, *args, parameters: dict = None, **kwargs) -> dict: """Given an array of policy IDs, returns detailed policies information. - Keyword arguments: - ids -- Policy IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/GetCSPMPoliciesDetails + + Keyword arguments + ----------------- + ids : str or list[str] + Policy IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1555,44 +1985,53 @@ def get_policy_details(self: object, *args, parameters: dict = None, **kwargs) - def get_policy_settings(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Return information about current policy settings. - Keyword arguments: - policy_id -- Policy ID. String. - cloud_platform -- Cloud platform. Allowed values: `azure`, `aws`, `gcp`. String. - service -- Service type to filter policy settings by. - Available values: - ACM Kinesis - ACR Kubernetes - AppService Lambda - CloudFormation LoadBalancer - CloudTrail Monitor - CloudWatch Logs NLB/ALB - Cloudfront NetworkSecurityGroup - Config PostgreSQL - Disk RDS - DynamoDB Redshift - EBS S3 - EC2 SES - ECR SNS - EFS SQLDatabase - EKS SQLServer - ELB SQS - EMR SSM - Elasticache Serverless Application Repository - GuardDuty StorageAccount - IAM Subscriptions - Identity VirtualMachine - KMS VirtualNetwork - KeyVault - parameters - full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/GetCSPMPolicySettings + + Keyword arguments + ----------------- + policy_id : str + Policy ID. + cloud_platform : str + Cloud platform. Allowed values: `azure`, `aws`, `gcp` + service : str + Service type to filter policy settings by. + Available values: + ACM Kinesis + ACR Kubernetes + AppService Lambda + CloudFormation LoadBalancer + CloudTrail Monitor + CloudWatch Logs NLB/ALB + Cloudfront NetworkSecurityGroup + Config PostgreSQL + Disk RDS + DynamoDB Redshift + EBS S3 + EC2 SES + ECR SNS + EFS SQLDatabase + EKS SQLServer + ELB SQS + EMR SSM + Elasticache Serverless Application Repository + GuardDuty StorageAccount + IAM Subscriptions + Identity VirtualMachine + KMS VirtualNetwork + KeyVault + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("cloud_platform", None): kwargs["cloud-platform"] = kwargs.get("cloud_platform", None) @@ -1613,8 +2052,16 @@ def update_policy_settings(self: object, body: dict = None, **kwargs) -> Union[D Can be used to override policy severity or to disable a policy entirely. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/UpdateCSPMPolicySettings + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "resources": [ { @@ -1632,22 +2079,27 @@ def update_policy_settings(self: object, body: dict = None, **kwargs) -> Union[D } ] } - account_id -- Account ID to update. String. - account_ids -- Account IDs to update. List of strings. - enabled -- Enabled / Disable flag. Boolean. - policy_id -- Policy ID to be updated. Integer. - region -- List of regions. String or list of strings. - severity -- Severity value to set for policy. String. - tag_excluded -- Exclude tags flag. Boolean. + account_id : str + Account ID to update. + account_ids : str or list[str] + Account IDs to update. + enabled : bool + Enabled / Disable flag. + policy_id : int + Policy ID to be updated. + region : str or list[str] + List of regions. + severity : str + Severity value to set for policy. + tag_excluded : bool + Exclude tags flag. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/UpdateCSPMPolicySettings + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cspm_policy_payload(passed_keywords=kwargs) @@ -1667,19 +2119,28 @@ def get_scan_schedule(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Return scan schedule configuration for one or more cloud platforms. - Keyword arguments: - cloud_platform -- Cloud Platform. String. Allowed Values: `azure`, `aws`, `gcp` - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/GetCSPMScanSchedule + + Keyword arguments + ----------------- + cloud_platform : str + Cloud Platform. String. Allowed Values: `azure`, `aws`, `gcp` + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("cloud_platform", None): kwargs["cloud-platform"] = kwargs.get("cloud_platform", None) @@ -1696,8 +2157,16 @@ def get_scan_schedule(self: object, def update_scan_schedule(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update scan schedule configuration for one or more cloud platforms. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/UpdateCSPMScanSchedule + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "resources": [ { @@ -1708,19 +2177,21 @@ def update_scan_schedule(self: object, body: dict = None, **kwargs) -> Union[Dic } ] } - cloud_platform -- Cloud platform. String. - next_scan_timestamp -- Time to schedule scan. UTC date formatted string. - scan_interval -- Scan interval. String. - scan_schedule -- Scan schedule type. String. + cloud_platform : str + Cloud platform. + next_scan_timestamp : str + Time to schedule scan. UTC date formatted. + scan_interval : str + Scan interval. + scan_schedule : str + Scan schedule type. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cspm-registration/UpdateCSPMScanSchedule + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cspm_scan_payload(passed_keywords=kwargs) diff --git a/src/falconpy/custom_ioa.py b/src/falconpy/custom_ioa.py index ca6c08a14..90252811a 100644 --- a/src/falconpy/custom_ioa.py +++ b/src/falconpy/custom_ioa.py @@ -60,19 +60,28 @@ class CustomIOA(ServiceClass): def get_patterns(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get pattern severities by ID. - Keyword arguments: - ids -- Pattern IDs. String or list of strings. - parameters -- full parameters payload, not required if using `ids` keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/get-patterns + + Keyword arguments + ----------------- + ids : str or list[str] + Pattern IDs. + parameters : dict + full parameters payload, not required if using `ids` keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -86,19 +95,28 @@ def get_patterns(self: object, *args, parameters: dict = None, **kwargs) -> Unio def get_platforms(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get platforms by ID. - Keyword arguments: - ids -- Platform IDs. String or list of strings. - parameters -- full parameters payload, not required if using `ids` keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/get-platformsMixin0 + + Keyword arguments + ----------------- + ids : str or list[str] + Platform IDs. + parameters : dict + full parameters payload, not required if using `ids` keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -112,19 +130,28 @@ def get_platforms(self: object, *args, parameters: dict = None, **kwargs) -> Uni def get_rule_groups(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get rule groups by ID. - Keyword arguments: - ids -- Rule group IDs. String or list of strings. - parameters -- full parameters payload, not required if using `ids` keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/get-rule-groupsMixin0 + + Keyword arguments + ----------------- + ids : str or list[str] + Rule group IDs. + parameters : dict + full parameters payload, not required if using `ids` keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -144,21 +171,31 @@ def create_rule_group(self: object, Returns the rule group. - Keyword arguments: - body -- Full body payload in JSON format. Not required if other keywords are provided. - comment -- Comment for the rule group. String. - description -- Rule group description. String. - name -- Name of the rule group. String. - platform -- Platform this rule group applies to. Allowed values: `windows`, `mac`, `linux` - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/create-rule-groupMixin0 + + Keyword arguments + ----------------- + body : dict + Full body payload in JSON format. Not required if other keywords are provided. + comment : str + Comment for the rule group. + description : str + Rule group description. + name : str + Name of the rule group. + platform : str + Platform this rule group applies to. Allowed values: `windows`, `mac`, `linux` + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = ioa_custom_payload(passed_keywords=kwargs) @@ -179,20 +216,30 @@ def delete_rule_groups(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete rule groups by ID. - Keyword arguments: - comment -- Explains why the rule group is being deleted. String. - ids -- Rule group IDs to be deleted. String or list of strings. - parameters -- full parameters payload, not required if using `ids` keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/delete-rule-groupsMixin0 + + Keyword arguments + ----------------- + comment : str + Explains why the rule group is being deleted. + ids : str or list[str] + Rule group IDs to be deleted. + parameters : dict + full parameters payload, not required if using `ids` keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -212,8 +259,16 @@ def update_rule_group(self: object, The following properties can be modified: `name`, `description`, `enabled`. - Keyword arguments: - body -- Full body payload in JSON format. Not required if other keywords are provided. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/update-rule-groupMixin0 + + Keyword arguments + ----------------- + body : dict + Full body payload in JSON format. Not required if other keywords are provided. { "comment": "string", "description": "string", @@ -222,21 +277,25 @@ def update_rule_group(self: object, "name": "string", "rulegroup_version": 0 } - comment -- Comment for the rule group. String. - description -- Rule group description. String. - enabled -- Flag indicating if the group is enabled. Boolean. - id -- ID of the rule group. String. - name -- Name of the rule group. String. - rulegroup_version -- Rule group version to modify. Integer. + comment : str + Comment for the rule group. + description : str + Rule group description. + enabled : bool + Flag indicating if the group is enabled. + id : str + ID of the rule group. + name : str + Name of the rule group. + rulegroup_version : int + Rule group version to modify. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/update-rule-groupMixin0 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = ioa_custom_payload(passed_keywords=kwargs) @@ -252,19 +311,28 @@ def update_rule_group(self: object, def get_rule_types(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get rule types by ID. - Keyword arguments: - ids -- Rule type IDs. String or list of strings. - parameters -- full parameters payload, not required if using `ids` keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/get-rule-types + + Keyword arguments + ----------------- + ids : str or list[str] + Rule type IDs. + parameters : dict + full parameters payload, not required if using `ids` keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -278,19 +346,28 @@ def get_rule_types(self: object, *args, parameters: dict = None, **kwargs) -> Un def get_rules_get(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get rules by ID and optionally version in the following format: ID[:version]. - Keyword arguments: - body -- full body payload in JSON format, not required if using `ids` keyword is used. - ids -- Rule IDs to retrieve. String or list of strings. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/get-rules-get + + Keyword arguments + ----------------- + body : dict + full body payload in JSON format, not required if using `ids` keyword is used. + ids : str or list[str] + Rule IDs to retrieve. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, payload_value="ids") @@ -308,19 +385,28 @@ def get_rules(self: object, *args, parameters: dict = None, **kwargs) -> Union[D The max number of IDs is constrained by URL size. - Keyword arguments: - ids -- Rule IDs. String or list of strings. - parameters -- full parameters payload, not required if using `ids` keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/get-rulesMixin0 + + Keyword arguments + ----------------- + ids : str or list[str] + Rule IDs. + parameters : dict + full parameters payload, not required if using `ids` keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -338,8 +424,16 @@ def create_rule(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create a rule within a rule group. Returns the rule. - Keyword arguments: - body -- full body payload in JSON format, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/create-rule + + Keyword arguments + ----------------- + body : dict + full body payload in JSON format, not required if using other keywords. { "comment": "string", "description": "string", @@ -364,36 +458,42 @@ def create_rule(self: object, "rulegroup_id": "string", "ruletype_id": "string" } - comment -- Comment related to this update. String. - description -- Rule description. String. - disposition_id -- Disposition ID. Integer. - field_values -- Rule values represented as an object. Dictionary. - { - "final_value": "string", - "label": "string", - "name": "string", - "type": "string", - "value": "string", - "values": [ - { - "label": "string", - "value": "string" - } - ] - } - name -- Name of the rule. String. - pattern_severity -- Severity. String. - rulegroup_id -- ID of the rule group. String. - ruletype_id -- ID of the rule type. String. + comment : str + Comment related to this update. + description : str + Rule description. + disposition_id : int + Disposition ID. + field_values : list + Rule values represented as an object. Dictionary. + { + "final_value": "string", + "label": "string", + "name": "string", + "type": "string", + "value": "string", + "values": [ + { + "label": "string", + "value": "string" + } + ] + } + name : str + Name of the rule. + pattern_severity : str + Severity. + rulegroup_id : str + ID of the rule group. + ruletype_id : str + ID of the rule type. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/create-rule + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = ioa_custom_payload(passed_keywords=kwargs) @@ -413,20 +513,29 @@ def delete_rules(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete rules from a rule group by ID. - Keyword arguments: - comment -- Explains why the entity is being deleted. String. - ids -- Rule IDs to be deleted. String or list of strings. - parameters -- full parameters payload, not required if using `ids` keyword. - rule_group_id -- The parent rule group. String. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/delete-rules + + Keyword arguments + ----------------- + comment : str + Explains why the entity is being deleted. + ids : str or list[str] + Rule IDs to be deleted. + parameters : dict + full parameters payload, not required if using `ids` keyword. + rule_group_id : str + The parent rule group. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -444,8 +553,16 @@ def update_rules(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update rules within a rule group. Return the updated rules. - Keyword arguments: - body -- full body payload in JSON format, not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/update-rules + + Keyword arguments + ----------------- + body : dict + full body payload in JSON format, not required if using other keywords. { "comment": "string", "rule_updates": [ @@ -477,45 +594,47 @@ def update_rules(self: object, "rulegroup_id": "string", "rulegroup_version": 0 } - comment -- Comment related to this update. String. - rulegroup_id -- ID of the rule group. String. - rule_updates -- JSON dictionary representing the rule updates to - be performed. Only one rule update can be done - in this manner. Dictionary. - { - "description": "string", - "disposition_id": 0, - "enabled": true, - "field_values": [ - { - "final_value": "string", - "label": "string", - "name": "string", - "type": "string", - "value": "string", - "values": [ - { - "label": "string", - "value": "string" - } - ] - } - ], - "instance_id": "string", - "name": "string", - "pattern_severity": "string", - "rulegroup_version": 0 - } - rulegroup_version -- Version of the rule group. Integer. + comment : str + Comment related to this update. + rulegroup_id : str + ID of the rule group. + rule_updates : list + JSON dictionary representing the rule updates to + be performed. Only one rule update can be done + in this manner. Dictionary. + { + "description": "string", + "disposition_id": 0, + "enabled": true, + "field_values": [ + { + "final_value": "string", + "label": "string", + "name": "string", + "type": "string", + "value": "string", + "values": [ + { + "label": "string", + "value": "string" + } + ] + } + ], + "instance_id": "string", + "name": "string", + "pattern_severity": "string", + "rulegroup_version": 0 + } + rulegroup_version : int + Version of the rule group. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/update-rules + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = ioa_custom_payload(passed_keywords=kwargs) @@ -534,8 +653,16 @@ def update_rules_v2(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update rules within a rule group. Return the updated rules. - Keyword arguments: - body -- full body payload in JSON format, not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/update-rules-v2 + + Keyword arguments + ----------------- + body : dict + full body payload in JSON format, not required if using other keywords. { "comment": "string", "rule_updates": [ @@ -567,45 +694,47 @@ def update_rules_v2(self: object, "rulegroup_id": "string", "rulegroup_version": 0 } - comment -- Comment related to this update. String. - rulegroup_id -- ID of the rule group. String. - rule_updates -- JSON dictionary representing the rule updates to - be performed. Only one rule update can be done - in this manner. Dictionary. - { - "description": "string", - "disposition_id": 0, - "enabled": true, - "field_values": [ - { - "final_value": "string", - "label": "string", - "name": "string", - "type": "string", - "value": "string", - "values": [ - { - "label": "string", - "value": "string" - } - ] - } - ], - "instance_id": "string", - "name": "string", - "pattern_severity": "string", - "rulegroup_version": 0 - } - rulegroup_version -- Version of the rule group. Integer. + comment : str + Comment related to this update. + rulegroup_id : str + ID of the rule group. + rule_updates : list + JSON dictionary representing the rule updates to + be performed. Only one rule update can be done + in this manner. Dictionary. + { + "description": "string", + "disposition_id": 0, + "enabled": true, + "field_values": [ + { + "final_value": "string", + "label": "string", + "name": "string", + "type": "string", + "value": "string", + "values": [ + { + "label": "string", + "value": "string" + } + ] + } + ], + "instance_id": "string", + "name": "string", + "pattern_severity": "string", + "rulegroup_version": 0 + } + rulegroup_version : int + Version of the rule group. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/update-rules-v2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = ioa_custom_payload(passed_keywords=kwargs) @@ -621,8 +750,16 @@ def update_rules_v2(self: object, def validate(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Validate field values and check for matches if a test string is provided. - Keyword arguments: - body -- full body payload in JSON format, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/validate + + Keyword arguments + ----------------- + body : dict + full body payload in JSON format, not required if using other keywords. { "fields": [ { @@ -638,28 +775,29 @@ def validate(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union } ] } - fields -- List of fields to validate. List of dictionaries. - { - "name": "string", - "test_data": "string", - "type": "string", - "values": [ - { - "label": "string", - "value": "string" - } - ] - } - - Arguments: When not specified, the first argument to this method is assumed to be 'fields'. - All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/validate + fields : list + List of fields to validate. List of dictionaries. + { + "name": "string", + "test_data": "string", + "type": "string", + "values": [ + { + "label": "string", + "value": "string" + } + ] + } + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'fields'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, payload_value="fields") @@ -675,21 +813,29 @@ def validate(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union def query_patterns(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get all pattern severity IDs. - Keyword arguments: - limit -- The maximum number of records to return in this response. [Integer, 1-500] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. String. - Use with the limit parameter to manage pagination of results. - parameters -- full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/query-patterns + + Keyword arguments + ----------------- + limit : int + The maximum number of records to return in this response. [Integer, 1-500] + Use with the offset parameter to manage pagination of results. + offset : str + The offset to start retrieving records from. String. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -703,21 +849,29 @@ def query_patterns(self: object, parameters: dict = None, **kwargs) -> Union[Dic def query_platforms(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get all platform IDs. - Keyword arguments: - limit -- The maximum number of records to return in this response. [Integer, 1-500] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. String. - Use with the limit parameter to manage pagination of results. - parameters -- full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/query-platformsMixin0 + + Keyword arguments + ----------------- + limit : int + The maximum number of records to return in this response. [Integer, 1-500] + Use with the offset parameter to manage pagination of results. + offset : str + The offset to start retrieving records from. String. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -731,39 +885,49 @@ def query_platforms(self: object, parameters: dict = None, **kwargs) -> Union[Di def query_rule_groups_full(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Find all rule groups matching the query with optional filter. - Keyword arguments: - filter -- FQL query specifying the filter parameters. String. - Filter term criteria: - enabled rules.name - platform rules.description - name rules.pattern_severity - description rules.ruletype_name - rules.action_label rules.enabled - - Filter range criteria: - created_on - modified_on (use any common date format, e.g. '2010-05-15T14:55:21.892315096Z') - limit -- The maximum number of records to return in this response. [Integer, 1-500] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. String. - Use with the limit parameter to manage pagination of results. - parameters -- full parameters payload, not required if using other keywords. - q -- Match query criteria, which includes all the filter string fields. String. - sort -- FQL syntax specifying sort criteria. String. - Possible order by fields: - created_by enabled - created_on name - modified_by description - modified_on - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/query-rule-groups-full + + Keyword arguments + ----------------- + filter : str + FQL query specifying the filter parameters. String. + Filter term criteria: + enabled rules.name + platform rules.description + name rules.pattern_severity + description rules.ruletype_name + rules.action_label rules.enabled + Filter range criteria: + created_on + modified_on (use any common date format, e.g. '2010-05-15T14:55:21.892315096Z') + limit : int + The maximum number of records to return in this response. [Integer, 1-500] + Use with the offset parameter to manage pagination of results. + offset : str + The offset to start retrieving records from. String. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Match query criteria, which includes all the filter string fields. + sort : str + FQL syntax specifying sort criteria. String. + Possible order by fields: + created_by enabled + created_on name + modified_by description + modified_on + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -777,39 +941,49 @@ def query_rule_groups_full(self: object, parameters: dict = None, **kwargs) -> U def query_rule_groups(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Find all rule group IDs matching the query with optional filter. - Keyword arguments: - filter -- FQL query specifying the filter parameters. String. - Filter term criteria: - enabled rules.name - platform rules.description - name rules.pattern_severity - description rules.ruletype_name - rules.action_label rules.enabled - - Filter range criteria: - created_on - modified_on (use any common date format, e.g. '2010-05-15T14:55:21.892315096Z') - limit -- The maximum number of records to return in this response. [Integer, 1-500] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. String. - Use with the limit parameter to manage pagination of results. - parameters -- full parameters payload, not required if using other keywords. - q -- Match query criteria, which includes all the filter string fields. String. - sort -- FQL syntax specifying sort criteria. String. - Possible order by fields: - created_by enabled - created_on name - modified_by description - modified_on - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/query-rule-groupsMixin0 + + Keyword arguments + ----------------- + filter : str + FQL query specifying the filter parameters. String. + Filter term criteria: + enabled rules.name + platform rules.description + name rules.pattern_severity + description rules.ruletype_name + rules.action_label rules.enabled + Filter range criteria: + created_on + modified_on (use any common date format, e.g. '2010-05-15T14:55:21.892315096Z') + limit : int + The maximum number of records to return in this response. [Integer, 1-500] + Use with the offset parameter to manage pagination of results. + offset : str + The offset to start retrieving records from. String. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Match query criteria, which includes all the filter string fields. + sort : str + FQL syntax specifying sort criteria. String. + Possible order by fields: + created_by enabled + created_on name + modified_by description + modified_on + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -823,21 +997,29 @@ def query_rule_groups(self: object, parameters: dict = None, **kwargs) -> Union[ def query_rule_types(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get all rule type IDs. - Keyword arguments: - limit -- The maximum number of records to return in this response. [Integer, 1-500] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. String. - Use with the limit parameter to manage pagination of results. - parameters -- full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/query-rule-types + + Keyword arguments + ----------------- + limit : int + The maximum number of records to return in this response. [Integer, 1-500] + Use with the offset parameter to manage pagination of results. + offset : str + The offset to start retrieving records from. String. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -851,40 +1033,50 @@ def query_rule_types(self: object, parameters: dict = None, **kwargs) -> Union[D def query_rules(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Find all rule IDs matching the query with optional filter. - Keyword arguments: - filter -- FQL query specifying the filter parameters. String. - Filter term criteria: - enabled rules.name - platform rules.description - name rules.pattern_severity - description rules.ruletype_name - rules.action_label rules.enabled - - Filter range criteria: - created_on - modified_on (use any common date format, e.g. '2010-05-15T14:55:21.892315096Z') - limit -- The maximum number of records to return in this response. [Integer, 1-500] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. String. - Use with the limit parameter to manage pagination of results. - parameters -- full parameters payload, not required if using other keywords. - q -- Match query criteria, which includes all the filter string fields. String. - sort -- FQL syntax specifying sort criteria. String. - Possible order by fields: - rules.ruletype_name rules.created_on - rules.enabled rules.current_version.description - rules.created_by rules.current_version.pattern_severity - rules.current_version.name rules.current_version.action_label - rules.current_version.modified_by rules.current_version.modified_on - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-ioa/query-rulesMixin0 + + Keyword arguments + ----------------- + filter : str + FQL query specifying the filter parameters. String. + Filter term criteria: + enabled rules.name + platform rules.description + name rules.pattern_severity + description rules.ruletype_name + rules.action_label rules.enabled + Filter range criteria: + created_on + modified_on (use any common date format, e.g. '2010-05-15T14:55:21.892315096Z') + limit : int + The maximum number of records to return in this response. [Integer, 1-500] + Use with the offset parameter to manage pagination of results. + offset : str + The offset to start retrieving records from. String. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Match query criteria, which includes all the filter string fields. + sort : str + FQL syntax specifying sort criteria. String. + Possible order by fields: + rules.ruletype_name rules.created_on + rules.enabled rules.current_version.description + rules.created_by rules.current_version.pattern_severity + rules.current_version.name rules.current_version.action_label + rules.current_version.modified_by rules.current_version.modified_on + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/custom_storage.py b/src/falconpy/custom_storage.py index c15f99e41..bdeaa5383 100644 --- a/src/falconpy/custom_storage.py +++ b/src/falconpy/custom_storage.py @@ -60,20 +60,29 @@ class CustomStorage(ServiceClass): def list_collections(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """List available collection names in alphabetical order. - Keyword arguments: - end -- The end key to end listing to. String. - limit -- The limit of results to return. Integer. - start -- The start key to start listing from. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-storage/ListCollections + + Keyword arguments + ----------------- + end : str + The end key to end listing to. + limit : int + The limit of results to return. + start : str + The start key to start listing from. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -87,18 +96,25 @@ def list_collections(self: object, parameters: dict = None, **kwargs) -> Union[D def describe_collections(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Fetch metadata about one or more existing collections. - Keyword arguments: - names -- A set of collection names to describe. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PUT Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-storage/DescribeCollections + + Keyword arguments + ----------------- + names : str or list[str] + A set of collection names to describe. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ names = kwargs.get("names", None) if isinstance(names, str): @@ -116,18 +132,25 @@ def describe_collections(self: object, parameters: dict = None, **kwargs) -> Uni def describe_collection(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Fetch metadata about an existing collection. - Keyword arguments: - collection_name -- The name of the collection. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-storage/DescribeCollection + + Keyword arguments + ----------------- + collection_name : str + The name of the collection. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ collection_name = kwargs.get("collection_name", None) if collection_name: @@ -155,11 +178,11 @@ def list(self, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, HTTP Method: GET Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-storage/ListObjects Keyword arguments - ---- + ----------------- collection_name : string (required) The name of the collection to list objects for. end : string @@ -174,7 +197,7 @@ def list(self, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -205,11 +228,11 @@ def search(self, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int HTTP Method: POST Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-storage/SearchObjects Keyword arguments - ---- + ----------------- collection_name : string (required) The name of the collection to search. filter : string (required) @@ -226,7 +249,7 @@ def search(self, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -254,11 +277,11 @@ def get(self, **kwargs) -> Union[bytes, Dict[str, Union[int, dict]]]: HTTP Method: GET Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-storage/GetObject Keyword arguments - ---- + ----------------- collection_name : string (required) The name of the collection where the object resides. object_key : string (required) @@ -267,7 +290,7 @@ def get(self, **kwargs) -> Union[bytes, Dict[str, Union[int, dict]]]: This method only supports keywords for providing arguments. Returns - ---- + ------- bytes or dict Binary (success) or Dictionary (failure) object containing API response. """ @@ -298,11 +321,11 @@ def upload(self, body: dict = None, parameters: dict = None, **kwargs) -> Union[ HTTP Method: PUT Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-storage/PutObject Keyword arguments - ---- + ----------------- body : binary [application/octet-stream] (required) The object to be uploaded. collection_name : string (required) @@ -320,7 +343,7 @@ def upload(self, body: dict = None, parameters: dict = None, **kwargs) -> Union[ This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -358,11 +381,11 @@ def delete(self, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int HTTP Method: DELETE Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-storage/DeleteObject Keyword arguments - ---- + ----------------- collection_name : string (required) The name of the collection to upload to. dry_run : boolean @@ -376,7 +399,7 @@ def delete(self, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -407,11 +430,11 @@ def metadata(self, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: HTTP Method: GET Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-storage/GetObjectMetadata Keyword arguments - ---- + ----------------- collection_name : string (required) The name of the collection where the object resides. object_key : string (required) @@ -420,7 +443,7 @@ def metadata(self, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -448,21 +471,31 @@ def metadata(self, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: def list_schemas(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get the list of schemas for the requested collection in reverse version order (latest first). - Keyword arguments: - collection_name -- The name of the collection. String. - end -- The end key to end listing to. String. - limit -- The limit of results to return. Integer. - start -- The start key to start listing from. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-storage/ListSchemas + + Keyword arguments + ----------------- + collection_name : str + The name of the collection. + end : str + The end key to end listing to. + limit : int + The limit of results to return. + start : str + The start key to start listing from. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ collection_name = kwargs.get("collection_name", None) if collection_name: @@ -482,19 +515,26 @@ def list_schemas(self: object, parameters: dict = None, **kwargs) -> Union[Dict[ def get_schema(self: object, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get the bytes of the specified schema of the requested collection. - Keyword arguments: - collection_name -- The name of the collection. String. - schema_version -- The version of the collection schema or "latest" for the latest version. String. - Defaults to "latest". - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-storage/GetSchema + + Keyword arguments + ----------------- + collection_name : str + The name of the collection. + schema_version : str + The version of the collection schema or "latest" for the latest version. String. + Defaults to "latest". + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ collection_name = kwargs.get("collection_name", None) schema_version = kwargs.get("schema_version", "latest") @@ -516,19 +556,26 @@ def get_schema(self: object, **kwargs) -> Union[Dict[str, Union[int, dict]], Res def schema_metadata(self: object, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get the metadata for the specified schema of the requested collection. - Keyword arguments: - collection_name -- The name of the collection. String. - schema_version -- The version of the collection schema or "latest" for the latest version. String. - Defaults to "latest". - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-storage/GetSchemaMetadata + + Keyword arguments + ----------------- + collection_name : str + The name of the collection. + schema_version : str + The version of the collection schema or "latest" for the latest version. String. + Defaults to "latest". + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ collection_name = kwargs.get("collection_name", None) schema_version = kwargs.get("schema_version", "latest") @@ -554,11 +601,11 @@ def list_by_version(self: object, parameters: dict = None, **kwargs) -> Union[Di HTTP Method: GET Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-storage/ListObjectsByVersion Keyword arguments - ---- + ----------------- collection_name : string (required) The name of the collection to list objects for. collection_version : string(required) @@ -575,7 +622,7 @@ def list_by_version(self: object, parameters: dict = None, **kwargs) -> Union[Di This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -610,11 +657,11 @@ def search_by_version(self: object, parameters: dict = None, **kwargs) -> Union[ HTTP Method: POST Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-storage/SearchObjectsByVersion Keyword arguments - ---- + ----------------- collection_name : string (required) The name of the collection to search. collection_version: string (required) @@ -633,7 +680,7 @@ def search_by_version(self: object, parameters: dict = None, **kwargs) -> Union[ This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -665,11 +712,11 @@ def get_version(self: object, **kwargs) -> Union[Dict[str, Union[int, dict]], Re HTTP Method: GET Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-storage/GetVersionedObject Keyword arguments - ---- + ----------------- collection_name : string (required) The name of the collection where the object resides. collection_version : string (required) @@ -680,7 +727,7 @@ def get_version(self: object, **kwargs) -> Union[Dict[str, Union[int, dict]], Re This method only supports keywords for providing arguments. Returns - ---- + ------- bytes or dict Binary (success) or Dictionary (failure) object containing API response. """ @@ -715,11 +762,11 @@ def upload_version(self: object, body: dict = None, **kwargs) -> Union[Dict[str, HTTP Method: PUT Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-storage/PutObjectByVersion Keyword arguments - ---- + ----------------- body : binary [application/octet-stream] (required) The object to be uploaded. collection_name : string (required) @@ -739,7 +786,7 @@ def upload_version(self: object, body: dict = None, **kwargs) -> Union[Dict[str, This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -780,11 +827,11 @@ def delete_version(self: object, parameters: dict = None, **kwargs) -> Union[Dic HTTP Method: DELETE Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-storage/DeleteVersionedObject Keyword arguments - ---- + ----------------- collection_name : string (required) The name of the collection to delete from. collection_name : string (required) @@ -800,7 +847,7 @@ def delete_version(self: object, parameters: dict = None, **kwargs) -> Union[Dic This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -835,11 +882,11 @@ def version_metadata(self: object, **kwargs) -> Union[Dict[str, Union[int, dict] HTTP Method: GET Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/custom-storage/GetVersionedObjectMetadata Keyword arguments - ---- + ----------------- collection_name : string (required) The name of the collection where the object resides. collection_version : string (required) @@ -850,7 +897,7 @@ def version_metadata(self: object, **kwargs) -> Union[Dict[str, Union[int, dict] This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ diff --git a/src/falconpy/d4c_registration.py b/src/falconpy/d4c_registration.py index 5a01615cd..3e42ad6b8 100644 --- a/src/falconpy/d4c_registration.py +++ b/src/falconpy/d4c_registration.py @@ -65,25 +65,40 @@ class D4CRegistration(ServiceClass): def get_aws_account(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Return information about the current status of an AWS account. - Keyword arguments: - ids -- List of AWS Account IDs to retrieve. String or list of strings. - limit -- The maximum records to return. Defaults to 100. Integer. - migrated -- Only return migrated D4C accounts. Boolean. - offset -- The offset to start retrieving records from. Integer. - organization_ids -- List of AWS Organization IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - scan_type -- Type of scan, `dry` or `full`, to perform on selected accounts. - status -- Account status to filter results by. String. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/d4c-registration/GetD4CAwsAccount + + Keyword arguments + ----------------- + ids : str or list[str] + List of AWS Account IDs to retrieve. + limit : int + The maximum records to return. Defaults to 100. + migrated : str + Only return migrated D4C accounts. + offset : int + The offset to start retrieving records from. + organization_ids : str or list[str] + List of AWS Organization IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + scan_type : str + Type of scan, `dry` or `full`, to perform on selected accounts. + status : str + Account status to filter results by. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("scan_type", None): kwargs["scan-type"] = kwargs.get("scan_type", None) @@ -103,10 +118,20 @@ def create_aws_account(self: object, body: dict = None, **kwargs) -> Union[Dict[ Creates a new account in our system for a customer and generates a script for them to run in their AWS cloud environment to grant us access. - Keyword arguments: - account_id -- AWS account ID. String. - account_type -- AWS account type. String. - body -- full body payload, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/d4c-registration/CreateD4CAwsAccount + + Keyword arguments + ----------------- + account_id : str + AWS account ID. + account_type : str + AWS account type. + body : dict + full body payload, not required if using other keywords. { "resources": [ { @@ -119,19 +144,21 @@ def create_aws_account(self: object, body: dict = None, **kwargs) -> Union[Dict[ } ] } - cloudtrail_region -- AWS region for CloudTrail log access. String. - iam_role_arn -- AWS IAM role ARN. String. - is_master -- Flag indicating if this is the master account. Boolean. - organization_id -- AWS organization ID. String. + cloudtrail_region : str + AWS region for CloudTrail log access. + iam_role_arn : str + AWS IAM role ARN. + is_master : bool + Flag indicating if this is the master account. + organization_id : str + AWS organization ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/d4c-registration/CreateD4CAwsAccount + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = aws_d4c_registration_payload(passed_keywords=kwargs) @@ -151,20 +178,30 @@ def delete_aws_account(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete an existing AWS account or organization from the tenant. - Keyword arguments: - ids -- List of AWS Account IDs to retrieve. String or list of strings. - organization_ids -- List of AWS Organization IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/d4c-registration/DeleteD4CAwsAccount + + Keyword arguments + ----------------- + ids : str or list[str] + List of AWS Account IDs to retrieve. + organization_ids : str or list[str] + List of AWS Organization IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -182,19 +219,28 @@ def get_aws_console_setup(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Return a URL for customer to visit in their cloud environment to grant CrowdStrike access. - Keyword arguments: - region -- AWS region to generate the URL for. String. - parameters -- full parameters payload, not required if region is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'region'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/d4c-registration/GetD4CAwsConsoleSetupURLs + + Keyword arguments + ----------------- + region : str + AWS region to generate the URL for. + parameters : dict + full parameters payload, not required if region is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'region'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -211,44 +257,76 @@ def get_aws_account_scripts(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Return a script for customer to run in their cloud environment to grant CrowdStrike access. - Keyword arguments: - ids -- AWS account IDs. String. - template -- Template to be rendered. String - accounts -- The list of accounts to register. String or list of strings. - behavior_assessment_enabled -- Available values: true, false. Boolean. - sensor_management_enabled -- Available values: true, false. Boolean. - dspm_enabled -- Available values: true, false. Boolean. - dspm_regions -- DSPM Regions. String. - dspm_host_account_id -- DSPM Host Account ID. String. - dspm_host_integration_role_name -- DSPM Host Integration Role Name. String. - dspm_host_scanner_role_name -- DSPM Host Scanner Role Name. String. - dspm_role -- DSPM Role. String. - vulnerability_scanning_enabled -- Enabled. Available values: true, false. Boolean. - - vulnerability_scanning_regions -- Regions. String or list of strings. - vulnerability_scanning_host_account_id -- Account ID. String. - vulnerability_scanning_host_integration_role_name -- Host Integration Role Name. String. - vulnerability_scanning_host_scanner_role_name -- Host Scanner Role Name. String. - vulnerability_scanning_role -- Role. String. - use_existing_cloudtrail -- Use Existing CloudTrail. Available values: true, false. Boolean. - organization_id -- The AWS organization ID to be registered. String. - organizational_unit_ids -- The AWS Organizational Unit IDs to be registered. String or list of strings. - aws_profile -- The AWS profile to be used during registration. String. - aws_region -- The AWS region to be used during registration. String. - iam_role_arn -- The custom IAM role to be used during registration. String. - falcon_client_id -- The Falcon client ID used during registration. String. - idp_enabled -- Set to true to enable Identity Protection feature. String. - tags -- Base64 encoded JSON string to be used as AWS tags. String. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/d4c-registration/GetD4CAWSAccountScriptsAttachment + + Keyword arguments + ----------------- + ids : str or list[str] + AWS account IDs. + template : str + Template to be rendered. + accounts : str or list[str] + The list of accounts to register. + behavior_assessment_enabled : str + Available values: true, false. + sensor_management_enabled : str + Available values: true, false. + dspm_enabled : str + Available values: true, false. + dspm_regions : str or list[str] + DSPM Regions. + dspm_host_account_id : str + DSPM Host Account ID. + dspm_host_integration_role_name : str + DSPM Host Integration Role Name. + dspm_host_scanner_role_name : str + DSPM Host Scanner Role Name. + dspm_role : str + DSPM Role. + vulnerability_scanning_enabled : str + Enabled. Available values: true, false. + vulnerability_scanning_regions : str or list[str] + Regions. + vulnerability_scanning_host_account_id : str + Account ID. + vulnerability_scanning_host_integration_role_name : str + Host Integration Role Name. + vulnerability_scanning_host_scanner_role_name : str + Host Scanner Role Name. + vulnerability_scanning_role : str + Role. + use_existing_cloudtrail : str + Use Existing CloudTrail. Available values: true, false. + organization_id : str + The AWS organization ID to be registered. + organizational_unit_ids : str or list[str] + The AWS Organizational Unit IDs to be registered. + aws_profile : str + The AWS profile to be used during registration. + aws_region : str + The AWS region to be used during registration. + iam_role_arn : str + The custom IAM role to be used during registration. + falcon_client_id : str + The Falcon client ID used during registration. + idp_enabled : str + Set to true to enable Identity Protection feature. + tags : str + Base64 encoded JSON string to be used as AWS tags. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -266,25 +344,38 @@ def get_azure_account(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Return information about Azure account registration. - Keyword arguments: - ids -- List of Azure Account IDs to retrieve. If this is empty then all accounts are returned. - String or list of strings. - limit -- The maximum records to return. Defaults to 100. Integer. - offset -- The offset to start retrieving records from. Integer. - parameters -- full parameters payload, not required if ids is provided as a keyword. - scan_type -- Type of scan, `dry` or `full`, to perform on selected accounts. - status -- Account status to filter results by, 'provisioned' or 'operational'. String. - tenant_ids -- Tenant ids to filter azure accounts returned. String or list of strings. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/d4c-registration/GetDiscoverCloudAzureAccount + + Keyword arguments + ----------------- + ids : str or list[str] + List of Azure Account IDs to retrieve. If this is empty then all accounts are returned. + limit : int + The maximum records to return. Defaults to 100. + offset : int + The offset to start retrieving records from. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + scan_type : str + Type of scan, `dry` or `full`, to perform on selected accounts. + status : str + Account status to filter results by, 'provisioned' or 'operational' + tenant_ids : str or list[str] + Tenant ids to filter azure accounts returned. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("scan_type", None): kwargs["scan-type"] = kwargs.get("scan_type", None) @@ -304,9 +395,18 @@ def create_azure_account(self: object, body: dict = None, **kwargs) -> Union[Dic Creates a new account in our system for a customer and generates a script for them to run in their cloud environment to grant us access. - Keyword arguments: - account_type -- Azure Account type. String. - body -- full body payload, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/d4c-registration/CreateDiscoverCloudAzureAccount + + Keyword arguments + ----------------- + account_type : str + Azure Account type. + body : dict + full body payload, not required if using other keywords. { "resources": [ { @@ -319,20 +419,23 @@ def create_azure_account(self: object, body: dict = None, **kwargs) -> Union[Dic } ] } - client_id -- Azure Client ID. String. - default_subscription -- Is this the default subscription? Boolean. - subscription_id -- Azure subscription ID. String. - tenant_id -- Azure tenant ID. String. - years_valid -- Years valid. Integer. + client_id : str + Azure Client ID. + default_subscription : bool + Is this the default subscription? + subscription_id : str + Azure subscription ID. + tenant_id : str + Azure tenant ID. + years_valid : int + Years valid. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/d4c-registration/CreateDiscoverCloudAzureAccount + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = azure_registration_payload(passed_keywords=kwargs) @@ -355,25 +458,36 @@ def update_azure_account_client_id(self: object, Update an Azure service account in our system by with the user-created client_id created with the public key we've provided. - Keyword arguments: - id -- ClientID to use for the Service Principal associated - with the customer's Azure Account. - object_id -- Object ID to use for the Service Principal associated - with the customer's Azure account. String. - parameters -- full parameters payload, not required if ids is provided as a keyword. - tenant_id -- Tenant ID to update client ID for. - Required if multiple tenants are registered. String. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /d4c-registration/UpdateDiscoverCloudAzureAccountClientID + /d4c-registration/UpdateDiscoverCloudAzureAccountClientID + + Keyword arguments + ----------------- + id : str + ClientID to use for the Service Principal associated + with the customer's Azure Account. + object_id : str + Object ID to use for the Service Principal associated + with the customer's Azure account. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + tenant_id : str + Tenant ID to update client ID for. + Required if multiple tenants are registered. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("tenant_id", None): kwargs["tenant-id"] = kwargs.get("tenant_id", None) @@ -396,22 +510,32 @@ def get_azure_user_scripts_attachment(self: object, Return a script for customer to run in their cloud environment to grant us access to their Azure environment as a downloadable attachment. - Keyword arguments: - parameters -- full parameters payload, not required if using other keywords. - azure_management_group - Use Azure Management Group. Boolean. - subscription_ids -- Azure subscription IDs. String or list of strings. - template -- Template to be rendered. String. - tenant_id -- Azure tenant ID. String. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /d4c-registration/GetDiscoverCloudAzureUserScriptsAttachment + /d4c-registration/GetDiscoverCloudAzureUserScriptsAttachment + + Keyword arguments + ----------------- + parameters : dict + Full parameters payload. Not required if using other keywords. + azure_management_group : bool + Use Azure Management Group. + subscription_ids : str or list[str] + Azure subscription IDs. + template : str + Template to be rendered. + tenant_id : str + Azure tenant ID. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("tenant_id", None): kwargs["tenant-id"] = kwargs.get("tenant_id", None) @@ -432,12 +556,20 @@ def get_azure_user_scripts(self: object) -> Union[Dict[str, Union[int, dict]], R This method does not accept arguments or keywords. - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/d4c-registration/GetDiscoverCloudAzureUserScripts + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -449,24 +581,36 @@ def get_azure_user_scripts(self: object) -> Union[Dict[str, Union[int, dict]], R def get_gcp_account(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Return information about the current status of an GCP account. - Keyword arguments: - ids -- Hierarchical Resource IDs of accounts. String or list of strings. - limit -- The maximum records to return. Defaults to 100. Integer. - offset -- The offset to start retrieving records from. Integer. - parameters -- full parameters payload, not required if ids is provided as a keyword. - parent_type -- GCP Hierarchy Parent Type, organization/folder/project. String. - scan_type -- Type of scan, `dry` or `full`, to perform on selected accounts. - sort -- Order fields in ascending or descending order. Ex: parent_type|asc. - status -- Account status to filter results by, 'operational' or 'provisioned'. String. - - This method does not accept arguments or keywords. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/d4c-registration/GetD4CCGPAccount + + Keyword arguments + ----------------- + ids : str or list[str] + Hierarchical Resource IDs of accounts. + limit : int + The maximum records to return. Defaults to 100. + offset : int + The offset to start retrieving records from. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + parent_type : str + GCP Hierarchy Parent Type, organization/folder/project. + scan_type : str + Type of scan, `dry` or `full`, to perform on selected accounts. + sort : str + Order fields in ascending or descending order. Ex: parent_type|asc. + status : str + Account status to filter results by, 'operational' or 'provisioned'. String. + This method does not accept arguments or keywords. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -483,8 +627,16 @@ def create_gcp_account(self: object, body: dict = None, **kwargs) -> Union[Dict[ Creates a new account in our system for a customer and generates a new service account for them to add access to in their GCP environment to grant us access. - Keyword arguments: - body -- full body payload, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/d4c-registration/CreateD4CGCPAccount + + Keyword arguments + ----------------- + body : dict + full body payload, not required if using other keywords. { "resources": [ { @@ -493,17 +645,17 @@ def create_gcp_account(self: object, body: dict = None, **kwargs) -> Union[Dict[ } ] } - parent_id -- GCP parent ID. String. - parent_type -- GCP parent type. String. + parent_id : str + GCP parent ID. + parent_type : str + GCP parent type. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/d4c-registration/CreateD4CGCPAccount + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = gcp_registration_payload(passed_keywords=kwargs) @@ -523,19 +675,28 @@ def delete_gcp_account(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a GCP account from the system. - Keyword arguments: - ids -- Hierarchical Resource IDs of accounts. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/d4c-registration/DeleteD4CGCPAccount + + Keyword arguments + ----------------- + ids : str or list[str] + Hierarchical Resource IDs of accounts. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -552,8 +713,16 @@ def connect_gcp_account(self: object, body: dict = None, **kwargs) -> Union[Dict Creates a new account in our system for a customer and generates a new service account for them to add access to in their GCP environment to grant us access. - Keyword arguments: - body -- full body payload, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/d4c-registration/ConnectD4CGCPAccount + + Keyword arguments + ----------------- + body : dict + full body payload, not required if using other keywords. { "resources": [ { @@ -568,23 +737,29 @@ def connect_gcp_account(self: object, body: dict = None, **kwargs) -> Union[Dict } ] } - client_email -- GCP account email. String. - client_id -- GCP account client ID. String. - parent_id -- GCP parent ID. String. - parent_type -- GCP parent type. String. - private_key -- GCP private key. String. - private_key_id -- GCP private key ID. String. - project_id -- GCP project ID. String. - service_account_id -- GCP service account ID. Integer. + client_email : str + GCP account email. + client_id : str + GCP account client ID. + parent_id : str + GCP parent ID. + parent_type : str + GCP parent type. + private_key : str + GCP private key. + private_key_id : str + GCP private key ID. + project_id : str + GCP project ID. + service_account_id : int + GCP service account ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/d4c-registration/ConnectD4CGCPAccount + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = gcp_registration_payload(passed_keywords=kwargs) @@ -604,19 +779,28 @@ def get_gcp_service_account(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Return the service account id and client email for external clients. - Keyword arguments: - id -- Service Account ID. String. - parameters -- full parameters payload, not required if id is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/d4c-registration/GetD4CGCPServiceAccountsExt + + Keyword arguments + ----------------- + id : str + Service Account ID. + parameters : dict + full parameters payload, not required if id is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -630,8 +814,16 @@ def get_gcp_service_account(self: object, def update_gcp_service_account(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update a GCP service account. - Keyword arguments: - body -- full body payload, not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/d4c-registration/UpdateD4CGCPServiceAccountsExt + + Keyword arguments + ----------------- + body : dict + full body payload, not required if using other keywords. { "resources": [ { @@ -655,24 +847,30 @@ def update_gcp_service_account(self: object, body: dict = None, **kwargs) -> Uni } ] } - client_email -- Client email associated with the service account. String. - client_id -- GCP Client ID. String. - private_key -- GCP private key. String. - private_key_id -- GCP private key ID. String. - project_id -- GCP project ID. String. - resources -- List of GCP service accounts to validate. List of dictionaries. - Overrides other keywords except for body. - service_account_conditions -- GCP service account conditions. List of dictionaries. - service_account_id -- GCP service account ID. Integer. + client_email : str + Client email associated with the service account. + client_id : str + GCP Client ID. + private_key : str + GCP private key. + private_key_id : str + GCP private key ID. + project_id : str + GCP project ID. + resources : str + List of GCP service accounts to validate. List of dictionaries. + Overrides other keywords except for body. + service_account_conditions : list[dict] + GCP service account conditions. + service_account_id : int + GCP service account ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/d4c-registration/UpdateD4CGCPServiceAccountsExt + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cspm_service_account_validate_payload(passed_keywords=kwargs) @@ -695,22 +893,33 @@ def get_gcp_user_scripts_attachment_v2(self: object, Return a script for customer to run in their cloud environment to grant us access to their GCP environment as a downloadable attachment. - Keyword arguments: - ids -- Hierarchical Resource IDs of accounts. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - parent_type -- GCP Hierarchy Parent Type. String. - Allowed values: organization, folder, project - status -- Account status to filter results by. String. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/d4c-registration/GetD4CGCPUserScriptsAttachment + + Keyword arguments + ----------------- + ids : str or list[str] + Hierarchical Resource IDs of accounts. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + parent_type : str + GCP Hierarchy Parent Type. String. + Allowed values: organization, folder, project + status : str + Account status to filter results by. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -730,22 +939,33 @@ def azure_download_certificate(self: object, Returns JSON object(s) that contain the base64 encoded certificate for a service principal. - Keyword arguments: - tenant_id -- Azure Tenant ID to generate script for. - Defaults to the most recently registered tenant. - parameters -- full parameters payload, not required if tenant-id keyword is used. - refresh -- Force a refresh of the certificate. Boolean. Defaults to False. - years_valid -- Years the certificate should be valid (only used when refresh=true). String. - - Arguments: When not specified, the first argument to this method is assumed to be - 'tenant_id'. All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/d4c-registration/DiscoverCloudAzureDownloadCertificate + + Keyword arguments + ----------------- + tenant_id : str or list[str] + Azure Tenant ID to generate script for. + Defaults to the most recently registered tenant. + parameters : dict + full parameters payload, not required if tenant-id keyword is used. + refresh : bool + Force a refresh of the certificate. Boolean. Defaults to False. + years_valid : str + Years the certificate should be valid (only used when refresh=true) + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'tenant_id'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -760,12 +980,20 @@ def get_azure_tenant_ids(self: object) -> dict: This method does not accept keywords or arguments. - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/d4c-registration/GetDiscoverCloudAzureTenantIDs + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -784,19 +1012,28 @@ def get_gcp_user_scripts(self: object, Return a script for customer to run in their cloud environment to grant us access to their GCP environment. - Keyword arguments: - parent_type -- GCP Hierarchy Parent Type, organization/folder/project. String. - parameters - full parameters payload, not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be - 'parent_type'. All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/d4c-registration/GetD4CGCPUserScripts + + Keyword arguments + ----------------- + parent_type : str + GCP Hierarchy Parent Type, organization/folder/project. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'parent_type'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -813,22 +1050,31 @@ def get_aws_horizon_scripts(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Return a script for customer to run in their cloud environment to grant CrowdStrike access. - Keyword arguments: - account_type -- Account type (commercial, gov). Only applicable when registering AWS - commercial accounts in a Gov environment. String. - delete -- Generate a delete script. Boolean. - organization_id -- AWS organization ID. String. - parameters -- full parameters payload, not required if using other keywords. - single_account -- Get static script for single account. Boolean. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response or a binary script. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/d4c-registration/GetHorizonD4CScripts + + Keyword arguments + ----------------- + account_type : str + Account type (commercial, gov). Only applicable when registering AWS + commercial accounts in a Gov environment. + delete : str + Generate a delete script. + organization_id : str + AWS organization ID. + parameters : dict + Full parameters payload. Not required if using other keywords. + single_account : str + Get static script for single account. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict object containing API response or a binary script. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/data_protection_configuration.py b/src/falconpy/data_protection_configuration.py index c4572e32b..523ce7855 100644 --- a/src/falconpy/data_protection_configuration.py +++ b/src/falconpy/data_protection_configuration.py @@ -38,6 +38,7 @@ # pylint: disable=C0302 from typing import Dict, Union from ._util import force_default, process_service_request, handle_single_argument +from ._payload import entities_web_location_group_create_payload, entities_web_location_group_patch_payload from ._result import Result from ._service_class import ServiceClass from ._endpoint._data_protection_configuration import _data_protection_configuration_endpoints as Endpoints @@ -77,20 +78,29 @@ def get_classification(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get the classifications that match the provided ids. - Keyword arguments: - ids -- IDs of the classifications to get. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /data-protection-configuration/entities.classification.get.v2 + /data-protection-configuration/entities.classification.get.v2 + + Keyword arguments + ----------------- + ids : str or list[str] + IDs of the classifications to get. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -104,8 +114,16 @@ def get_classification(self: object, def create_classification(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create classifications. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.classification.post.v2 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "resources": [ { @@ -155,17 +173,17 @@ def create_classification(self: object, body: dict = None, **kwargs) -> Union[Di } ] } - classification_properties -- The properties of the new classification. Dictionary. - name -- The name of the new classification. String. + classification_properties : dict + The properties of the new classification. + name : str + The name of the new classification. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.classification.post.v2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = data_protection_classification_payload(passed_keywords=kwargs) @@ -181,8 +199,16 @@ def create_classification(self: object, body: dict = None, **kwargs) -> Union[Di def update_classifications(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update classifications. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.classification.patch.v2 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "resources": [ { @@ -233,18 +259,19 @@ def update_classifications(self: object, body: dict = None, **kwargs) -> Union[D } ] } - id -- The ID of the classification to update. String. Required for update operations. - classification_properties -- The properties of the classification. Dictionary. - name -- The name of the classification. String. + id : str + The ID of the classification to update. String. Required for update operations. + classification_properties : dict + The properties of the classification. + name : str + The name of the classification. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.classification.patch.v2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = data_protection_classification_payload(passed_keywords=kwargs) @@ -264,20 +291,31 @@ def delete_classification(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete classifications that match the provided ids. - Keyword arguments: - ids -- IDs of the classifications to delete. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /data-protection-configuration/entities.classification.delete.v2 + /data-protection-configuration/entities.classification.delete.v2 + + Keyword arguments + ----------------- + ids : str or list[str] + IDs of the classifications to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -295,19 +333,28 @@ def get_cloud_application(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get a particular cloud-application. - Keyword arguments: - ids -- The cloud application id(s) to get. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.cloud-application.get + + Keyword arguments + ----------------- + ids : str or list[str] + The cloud application id(s) to get. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -321,8 +368,16 @@ def get_cloud_application(self: object, def create_cloud_application(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Persist the given cloud application for the provided entity instance. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.cloud-application.create + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "description": "string", "name": "string", @@ -333,18 +388,19 @@ def create_cloud_application(self: object, body: dict = None, **kwargs) -> Union } ] } - description -- The description of the cloud application. String. - name -- The name of the cloud application. String. - urls -- The fields contain the FQDN and the path. List of dictionaries. + description : str + The description of the cloud application. + name : str + The name of the cloud application. + urls : list[dict] + The fields contain the FQDN and the path. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.cloud-application.create + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = data_protection_cloud_app_payload(passed_keywords=kwargs) @@ -364,9 +420,18 @@ def update_cloud_application(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update a cloud application. - Keyword arguments: - id -- The cloud app id to update. String. - body -- The new cloud-application definition. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.cloud-application.patch + + Keyword arguments + ----------------- + id : str + The cloud app id to update. + body : dict + The new cloud-application definition. { "description": "string", "name": "string", @@ -377,20 +442,21 @@ def update_cloud_application(self: object, } ] } - description -- The description of the cloud application. String. - name -- The name of the cloud application. String. - urls -- The fields contain the FQDN and the path. List of dictionaries. - - parameters -- Full parameters payload dictionary. Not required if using other keywords. + description : str + The description of the cloud application. + name : str + The name of the cloud application. + urls : list[dict] + The fields contain the FQDN and the path. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.cloud-application.patch + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = data_protection_cloud_app_payload(passed_keywords=kwargs) @@ -412,19 +478,28 @@ def delete_cloud_application(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete cloud application. - Keyword arguments: - ids -- The id of the cloud application to delete. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.cloud-application.delete + + Keyword arguments + ----------------- + ids : str or list[str] + The id of the cloud application to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -442,19 +517,28 @@ def get_content_pattern(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get a particular content-pattern(s). - Keyword arguments: - ids -- The content-pattern id(s) to get. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.content-pattern.get + + Keyword arguments + ----------------- + ids : str or list[str] + The content-pattern id(s) to get. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -468,8 +552,16 @@ def get_content_pattern(self: object, def create_content_pattern(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Persist the given content pattern for the provided entity instance. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.content-pattern.create + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "category": "string", "description": "string", @@ -481,22 +573,25 @@ def create_content_pattern(self: object, body: dict = None, **kwargs) -> Union[D ], "region": "string" } - category -- The content pattern category. String. - description -- The description of the content pattern. String. - example -- The new content pattern demonstration. String. - min_match_threshold -- Integer. - name -- The name of the new content pattern. String. - regexes -- List of strings. - region -- The region for the content pattern. String. + category : str + The content pattern category. + description : str + The description of the content pattern. + example : str + The new content pattern demonstration. + min_match_threshold : int + name : str + The name of the new content pattern. + regexes : str or list[str] + region : str + The region for the content pattern. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.content-pattern.create + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = data_protection_content_pattern_payload(passed_keywords=kwargs) @@ -516,9 +611,18 @@ def update_content_pattern(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update a content pattern. - Keyword arguments: - id -- The id of the content pattern to patch. - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.content-pattern.patch + + Keyword arguments + ----------------- + id : str + The id of the content pattern to patch. + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "category": "string", "description": "string", @@ -530,24 +634,27 @@ def update_content_pattern(self: object, ], "region": "string" } - category -- The content pattern category. String. - description -- The description of the content pattern. String. - example -- The new content pattern demonstration. String. - min_match_threshold -- Integer. - name -- The name of the new content pattern. String. - regexes -- List of strings. - region -- The region for the content pattern. String. - - parameters -- Full parameters payload dictionary. Not required if using other keywords. + category : str + The content pattern category. + description : str + The description of the content pattern. + example : str + The new content pattern demonstration. + min_match_threshold : int + name : str + The name of the new content pattern. + regexes : str or list[str] + region : str + The region for the content pattern. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.content-pattern.patch + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = data_protection_content_pattern_payload(passed_keywords=kwargs) @@ -569,19 +676,28 @@ def delete_content_pattern(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete content pattern. - Keyword arguments: - ids -- The id(s) of the content pattern to delete. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.content-pattern.delete + + Keyword arguments + ----------------- + ids : str or list[str] + The id(s) of the content pattern to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -595,8 +711,16 @@ def delete_content_pattern(self: object, def update_policy_precedence(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update policy precedence. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.policy.precedence.post.v1 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "resources": [ { @@ -607,17 +731,17 @@ def update_policy_precedence(self: object, body: dict = None, **kwargs) -> Union } ] } - platform -- The platform for the policy precedence update (e.g., 'win' or 'mac'). String. - precedence -- Ordered list of policy IDs defining the precedence order. List of strings. + platform : str + The platform for the policy precedence update (e.g., 'win' or 'mac') + precedence : str or list[str] + Ordered list of policy IDs defining the precedence order. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.policy.precedence.post.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = data_protection_policy_precedence_payload(passed_keywords=kwargs) @@ -637,19 +761,28 @@ def get_enterprise_account(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get a particular enterprise-account(s). - Keyword arguments: - ids -- The enterprise-account id(s) to get. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.enterprise-account.get + + Keyword arguments + ----------------- + ids : str or list[str] + The enterprise-account id(s) to get. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -663,8 +796,16 @@ def get_enterprise_account(self: object, def create_enterprise_account(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Persist the given enterprise account for the provided entity instance. - Keyword arguments: - body -- Definition of enterprise-account to create. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.enterprise-account.create + + Keyword arguments + ----------------- + body : dict + Definition of enterprise-account to create. { "application_group_id": "string", "domains": [ @@ -673,19 +814,18 @@ def create_enterprise_account(self: object, body: dict = None, **kwargs) -> Unio "name": "string", "plugin_config_id": "string" } - application_group_id -- String. - domains -- List of strings. - name -- The name of the enterprise account. String. - plugin_config_id -- String. + application_group_id : str + domains : str or list[str] + name : str + The name of the enterprise account. + plugin_config_id : str This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.enterprise-account.create + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = data_protection_enterprise_account_payload(passed_keywords=kwargs) @@ -706,9 +846,18 @@ def update_enterprise_account(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update a enterprise account. - Keyword arguments: - id -- The id of the enterprise account to update. - body -- Definition of enterprise-account to create. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.enterprise-account.patch + + Keyword arguments + ----------------- + id : str + The id of the enterprise account to update. + body : dict + Definition of enterprise-account to create. { "application_group_id": "string", "domains": [ @@ -718,21 +867,20 @@ def update_enterprise_account(self: object, "name": "string", "plugin_config_id": "string" } - application_group_id -- String. - domains -- List of strings. - name -- The name of the enterprise account. String. - plugin_config_id -- String. - - parameters -- Full parameters payload dictionary. Not required if using other keywords. + application_group_id : str + domains : str or list[str] + name : str + The name of the enterprise account. + plugin_config_id : str + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.enterprise-account.patch + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = data_protection_enterprise_account_payload(passed_keywords=kwargs) @@ -754,19 +902,28 @@ def delete_enterprise_account(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete enterprise account. - Keyword arguments: - ids -- The id of the enterprise account to delete. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.enterprise-account.delete + + Keyword arguments + ----------------- + ids : str or list[str] + The id of the enterprise account to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -780,19 +937,28 @@ def delete_enterprise_account(self: object, def get_file_type(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get a particular file-type. - Keyword arguments: - ids -- The file-type id(s) to get. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.file-type.get + + Keyword arguments + ----------------- + ids : str or list[str] + The file-type id(s) to get. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -810,19 +976,28 @@ def get_sensitivity_label(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get sensitivity label matching the IDs (V2). - Keyword arguments: - ids -- The sensitivity label entity id(s) to get. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.file-type.get + + Keyword arguments + ----------------- + ids : str or list[str] + The sensitivity label entity id(s) to get. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -836,8 +1011,16 @@ def get_sensitivity_label(self: object, def create_sensitivity_label(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create new sensitivity label (V2). - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.sensitivity-label.create-v2 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "co_authoring": true, "display_name": "string", @@ -847,21 +1030,21 @@ def create_sensitivity_label(self: object, body: dict = None, **kwargs) -> Union "plugins_configuration_id": "string", "synced": true } - co_authoring -- Boolean. - display_name -- String. - external_id -- String. - label_provider -- String. - name -- The name of the new sensitivity label. String. - plugins_configuration_id -- String. - synced -- Boolean. - This method only supports keywords for providing arguments. + co_authoring : bool + display_name : str + external_id : str + label_provider : str + name : str + The name of the new sensitivity label. + plugins_configuration_id : str + synced : bool - Returns: dict object containing API response. - - HTTP Method: POST + This method only supports keywords for providing arguments. - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.sensitivity-label.create-v2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = data_protection_sensitivity_label_payload(passed_keywords=kwargs) @@ -881,19 +1064,28 @@ def delete_sensitivity_label(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete sensitivity labels matching the IDs (V2). - Keyword arguments: - ids -- The sensitivity label entity id(s) to delete. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.sensitivity-label.delete-v2 + + Keyword arguments + ----------------- + ids : str or list[str] + The sensitivity label entity id(s) to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -911,19 +1103,28 @@ def get_local_application_group(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get particular local application groups. - Keyword arguments: - ids -- The local application group id(s) to get. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.local-application-group.get + + Keyword arguments + ----------------- + ids : str or list[str] + The local application group id(s) to get. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -940,8 +1141,16 @@ def create_local_application_group(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Persist the given local application group for the provided entity instance. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.local-application-group.create + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "description": "string", "local_application_ids": [ @@ -949,19 +1158,19 @@ def create_local_application_group(self: object, ], "name": "string" } - description -- The description of the local application group. String. - local_application_ids -- List of local application IDs to include in the group. - List of strings. - name -- The name of the local application group. String. + description : str + The description of the local application group. + local_application_ids : str or list[str] + List of local application IDs to include in the group. + name : str + The name of the local application group. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.local-application-group.create + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = data_protection_local_application_group_payload(passed_keywords=kwargs) @@ -981,9 +1190,18 @@ def update_local_application_group(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update a local application group. - Keyword arguments: - id -- The local application group id to update. String. - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.local-application-group.patch + + Keyword arguments + ----------------- + id : str + The local application group id to update. + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "description": "string", "local_application_ids": [ @@ -991,20 +1209,21 @@ def update_local_application_group(self: object, ], "name": "string" } - description -- The description of the local application group. String. - local_application_ids -- List of local application IDs to include in the group. - List of strings. - name -- The name of the local application group. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + description : str + The description of the local application group. + local_application_ids : str or list[str] + List of local application IDs to include in the group. + name : str + The name of the local application group. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.local-application-group.patch + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = data_protection_local_application_group_payload(passed_keywords=kwargs) @@ -1028,19 +1247,28 @@ def delete_local_application_group(self: object, The application group will not be visible anymore, but will still be in the database. - Keyword arguments: - ids -- The id of the local application group to delete. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.local-application-group.delete + + Keyword arguments + ----------------- + ids : str or list[str] + The id of the local application group to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1058,19 +1286,28 @@ def get_local_application(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get a particular local application. - Keyword arguments: - ids -- The local application id(s) to get. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.local-application.get + + Keyword arguments + ----------------- + ids : str or list[str] + The local application id(s) to get. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1084,8 +1321,16 @@ def get_local_application(self: object, def create_local_application(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Persist the given local application for the provided entity instance. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.local-application.create + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "apply_rules_for_children_processes": true, "executable_name": "string", @@ -1094,21 +1339,22 @@ def create_local_application(self: object, body: dict = None, **kwargs) -> Union ], "name": "string" } - apply_rules_for_children_processes -- Whether to apply rules for children processes - of this application. Boolean. - executable_name -- The executable name of the local application. String. - group_ids -- List of group IDs to associate with this local application. - List of strings. - name -- The name of the local application. String. + apply_rules_for_children_processes : bool + Whether to apply rules for children processes + of this application. + executable_name : str + The executable name of the local application. + group_ids : str or list[str] + List of group IDs to associate with this local application. + name : str + The name of the local application. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.local-application.create + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = data_protection_local_application_payload(passed_keywords=kwargs) @@ -1128,9 +1374,18 @@ def update_local_application(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update a local application. - Keyword arguments: - id -- The local application id to update. String. - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.local-application.patch + + Keyword arguments + ----------------- + id : str + The local application id to update. + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "apply_rules_for_children_processes": true, "executable_name": "string", @@ -1139,22 +1394,24 @@ def update_local_application(self: object, ], "name": "string" } - apply_rules_for_children_processes -- Whether to apply rules for children processes - of this application. Boolean. - executable_name -- The executable name of the local application. String. - group_ids -- List of group IDs to associate with this local application. - List of strings. - name -- The name of the local application. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + apply_rules_for_children_processes : bool + Whether to apply rules for children processes + of this application. + executable_name : str + The executable name of the local application. + group_ids : str or list[str] + List of group IDs to associate with this local application. + name : str + The name of the local application. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.local-application.patch + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = data_protection_local_application_payload(passed_keywords=kwargs) @@ -1178,19 +1435,28 @@ def delete_local_application(self: object, The application will not be visible anymore, but will still be in the database. - Keyword arguments: - ids -- The id of the local application to delete. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.local-application.delete + + Keyword arguments + ----------------- + ids : str or list[str] + The id of the local application to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1204,19 +1470,28 @@ def delete_local_application(self: object, def get_policies(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get policies that match the provided ids. - Keyword arguments: - ids -- IDs of the policies to get. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.policy.get.v2 + + Keyword arguments + ----------------- + ids : str or list[str] + IDs of the policies to get. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1234,9 +1509,18 @@ def create_policy(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create policies. - Keyword arguments: - platform_name -- platform name of the policies to update, either 'win' or 'mac'. - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.policy.post.v2 + + Keyword arguments + ----------------- + platform_name : str + platform name of the policies to update, either 'win' or 'mac'. + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "resources": [ { @@ -1311,20 +1595,23 @@ def create_policy(self: object, } ] } - description -- The description of the new policy. String. - name -- The name of the new policy. String. - policy_properties -- The properties of the new policy. Dictionary. - precedence -- The order of precedence. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + description : str + The description of the new policy. + name : str + The name of the new policy. + policy_properties : dict + The properties of the new policy. + precedence : int + The order of precedence. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.policy.post.v2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = data_protection_policy_payload(passed_keywords=kwargs) @@ -1346,9 +1633,18 @@ def update_policies(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update policies. - Keyword arguments: - platform_name -- platform name of the policies to update, either 'win' or 'mac'. - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.policy.patch.v2 + + Keyword arguments + ----------------- + platform_name : str + platform name of the policies to update, either 'win' or 'mac'. + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "resources": [ { @@ -1428,23 +1724,29 @@ def update_policies(self: object, } ] } - id -- The ID of the policy to update. String. Required for update operations. - is_enabled -- Flag indicating if the policy is enabled. Boolean. - host_groups -- List of host group IDs to assign to the policy. List of strings. - description -- The description of the policy. String. - name -- The name of the policy. String. - policy_properties -- The properties of the policy. Dictionary. - precedence -- The order of precedence. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + id : str + The ID of the policy to update. String. Required for update operations. + is_enabled : bool + Flag indicating if the policy is enabled. + host_groups : str or list[str] + List of host group IDs to assign to the policy. + description : str + The description of the policy. + name : str + The name of the policy. + policy_properties : dict + The properties of the policy. + precedence : int + The order of precedence. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.policy.patch.v2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = data_protection_policy_payload(passed_keywords=kwargs) @@ -1462,20 +1764,30 @@ def update_policies(self: object, def delete_policies(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete policies that match the provided ids. - Keyword arguments: - ids -- IDs of the policies to delete. String or list of strings. - platform_name -- platform name of the policies to update, either 'win' or 'mac'. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.policy.delete.v2 + + Keyword arguments + ----------------- + ids : str or list[str] + IDs of the policies to delete. + platform_name : str + platform name of the policies to update, either 'win' or 'mac' + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1493,19 +1805,28 @@ def get_web_location(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get web-location entities matching the provided ID(s). - Keyword arguments: - ids -- The web-location entity id(s) to get. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.web-location.get-v2 + + Keyword arguments + ----------------- + ids : str or list[str] + The web-location entity id(s) to get. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1519,9 +1840,18 @@ def get_web_location(self: object, def create_web_location(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Persist the given web-locations. - Keyword arguments: - application_id -- Associated application ID. String. - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.web-location.create-v2 + + Keyword arguments + ----------------- + application_id : str + Associated application ID. + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "web_locations": [ { @@ -1536,23 +1866,29 @@ def create_web_location(self: object, body: dict = None, **kwargs) -> Union[Dict } ] } - application_id -- The ID of the application. String. - deleted -- Flag indicating if this location is deleted. Boolean. - enterprise_account_id -- Associated enterprise account ID. String. - location_type -- Location type. String. - name -- Location name. String. - provider_location_id -- Provider location ID. String. - provider_location_name -- Provider location name. String. - type -- Type. String. + application_id : str + The ID of the application. + deleted : bool + Flag indicating if this location is deleted. + enterprise_account_id : str + Associated enterprise account ID. + location_type : str + Location type. + name : str + Location name. + provider_location_id : str + Provider location ID. + provider_location_name : str + Provider location name. + type : str + Type. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.web-location.create-v2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = data_protection_web_locations_payload(passed_keywords=kwargs) @@ -1572,9 +1908,18 @@ def update_web_location(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update a web-location. - Keyword arguments: - application_id -- Application ID for the location. String. - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.web-location.patch-v2 + + Keyword arguments + ----------------- + application_id : str + Application ID for the location. + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "web_locations": [ { @@ -1589,23 +1934,29 @@ def update_web_location(self: object, } ] } - application_id -- The ID of the application. String. - deleted -- Flag indicating if this location is deleted. Boolean. - enterprise_account_id -- Associated enterprise account ID. String. - location_type -- Location type. String. - name -- Location name. String. - provider_location_id -- Provider location ID. String. - provider_location_name -- Provider location name. String. - type -- Type. String. + application_id : str + The ID of the application. + deleted : bool + Flag indicating if this location is deleted. + enterprise_account_id : str + Associated enterprise account ID. + location_type : str + Location type. + name : str + Location name. + provider_location_id : str + Provider location ID. + provider_location_name : str + Provider location name. + type : str + Type. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.web-location.patch-v2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = data_protection_web_locations_payload(passed_keywords=kwargs) @@ -1627,19 +1978,28 @@ def delete_web_location(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete web-location. - Keyword arguments: - ids -- The IDs of the web-location to delete. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities.web-location.delete-v2 + + Keyword arguments + ----------------- + ids : str or list[str] + The IDs of the web-location to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1653,32 +2013,42 @@ def delete_web_location(self: object, def query_classifications(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search for classifications that match the provided criteria. - Keyword arguments: - filter -- Filter results by specific attributes. String. - Allowed attributes are: - created_by modified_by - modified_at properties.content_patterns - properties.content_patterns_operator properties.file_types - properties.evidence_duplication_enabled - properties.protection_mode properties.sensitivity_labels - properties.web_sources name - created_at - offset -- The offset to start retrieving records from. Integer. - limit -- The maximum records to return. Integer. - sort -- The property to sort by. String. - Allowed fields are: - name created_at - modified_at - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/queries.classification.get.v2 + + Keyword arguments + ----------------- + filter : str + Filter results by specific attributes. String. + Allowed attributes are: + created_by modified_by + modified_at properties.content_patterns + properties.content_patterns_operator properties.file_types + properties.evidence_duplication_enabled + properties.protection_mode properties.sensitivity_labels + properties.web_sources name + created_at + offset : int + The offset to start retrieving records from. + limit : int + The maximum records to return. + sort : str + The property to sort by. String. + Allowed fields are: + name created_at + modified_at + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1695,31 +2065,41 @@ def query_cloud_applications(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get all cloud-application IDs matching the query with filter. - Keyword arguments: - filter -- Optional filter for searching cloud applications. String. - Allowed filters are: - name type - deleted supports_network_inspection - application_group_id - sort -- The sort instructions to order by on. String. - Allowed values are: - name type - deleted supports_network_inspection - application_group_id - limit -- The number of items to return in this response (default: 100, max: 500). Integer. - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/queries.cloud-application.get-v2 + + Keyword arguments + ----------------- + filter : str + Optional filter for searching cloud applications. String. + Allowed filters are: + name type + deleted supports_network_inspection + application_group_id + sort : str + The sort instructions to order by on. String. + Allowed values are: + name type + deleted supports_network_inspection + application_group_id + limit : int + The number of items to return in this response (default: 100, max: 500). Integer. + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1733,33 +2113,43 @@ def query_cloud_applications(self: object, def query_content_patterns(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get all content-pattern IDs matching the query with filter. - Keyword arguments: - filter -- The filter to use when finding content patterns. String. - Allowed filters are: - name type - category region - example created_at - updated_at deleted' - sort -- The sort instructions to order by on. String. - Allowed values are: - name type - category region - example created_at - updated_at deleted' - limit -- The number of items to return in this response (default: 100, max: 500). Integer. - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/queries.content-pattern.get-v2 + + Keyword arguments + ----------------- + filter : str + The filter to use when finding content patterns. String. + Allowed filters are: + name type + category region + example created_at + updated_at deleted' + sort : str + The sort instructions to order by on. String. + Allowed values are: + name type + category region + example created_at + updated_at deleted' + limit : int + The number of items to return in this response (default: 100, max: 500). Integer. + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1776,31 +2166,41 @@ def query_enterprise_accounts(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get all enterprise-account IDs matching the query with filter. - Keyword arguments: - filter -- The filter to use when finding enterprise accounts. String. - Allowed filters are: - name application_group_id - deleted created_at - updated_at - sort -- The sort instructions to order by on. Integer. - Allowed values are: - name application_group_id - deleted created_at - updated_at - limit -- The number of items to return in this response (default: 100, max: 500). Integer. - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/queries.enterprise-account.get-v2 + + Keyword arguments + ----------------- + filter : str + The filter to use when finding enterprise accounts. String. + Allowed filters are: + name application_group_id + deleted created_at + updated_at + sort : str + The sort instructions to order by on. Integer. + Allowed values are: + name application_group_id + deleted created_at + updated_at + limit : int + The number of items to return in this response (default: 100, max: 500). Integer. + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1814,29 +2214,39 @@ def query_enterprise_accounts(self: object, def query_file_type(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get all file-type IDs matching the query with filter. - Keyword arguments: - filter -- The filter to use when finding file types. String. - Allowed filters are: - name created_at - updated_at - sort -- The sort instructions to order by on. String. - Allowed values are - name created_at - updated_at - limit -- The number of items to return in this response (default: 100, max: 500). Integer. - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/queries.file-type.get-v2 + + Keyword arguments + ----------------- + filter : str + The filter to use when finding file types. String. + Allowed filters are: + name created_at + updated_at + sort : str + The sort instructions to order by on. String. + Allowed values are + name created_at + updated_at + limit : int + The number of items to return in this response (default: 100, max: 500). Integer. + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1850,30 +2260,40 @@ def query_file_type(self: object, parameters: dict = None, **kwargs) -> Union[Di def query_sensitivity_label(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get all sensitivity label IDs matching the query with filter. - Keyword arguments: - filter -- The filter to use when finding sensitivity labels. String. - The only allowed filters are: - name display_name - external_id deleted - sort -- The sort instructions to order by on. String. - Allowed values are: - name display_name - deleted created_at - updated_at - limit -- The number of items to return in this response (default: 100, max: 500). Integer. - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/queries.sensitivity-label.get-v2 + + Keyword arguments + ----------------- + filter : str + The filter to use when finding sensitivity labels. String. + The only allowed filters are: + name display_name + external_id deleted + sort : str + The sort instructions to order by on. String. + Allowed values are: + name display_name + deleted created_at + updated_at + limit : int + The number of items to return in this response (default: 100, max: 500). Integer. + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1890,26 +2310,35 @@ def query_local_application_groups(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get all local application group IDs matching the query with filter. - Keyword arguments: - filter -- Optional filter for searching local application groups. String. - Allowed filters are: - name is_deleted - platform created_at - updated_at - limit -- The number of items to return in this response (default: 100, max: 500). Integer. - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/queries.local-application-group.get + + Keyword arguments + ----------------- + filter : str + Optional filter for searching local application groups. String. + Allowed filters are: + name is_deleted + platform created_at + updated_at + limit : int + The number of items to return in this response (default: 100, max: 500). Integer. + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1926,25 +2355,34 @@ def query_local_applications(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get all local-application IDs matching the query with filter. - Keyword arguments: - filter -- Optional filter for searching local applications. String. - Allowed filters are: - name is_deleted - created_at updated_at - limit -- The number of items to return in this response (default: 100, max: 500). Integer. - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/queries.local-application.get + + Keyword arguments + ----------------- + filter : str + Optional filter for searching local applications. String. + Allowed filters are: + name is_deleted + created_at updated_at + limit : int + The number of items to return in this response (default: 100, max: 500). Integer. + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1958,51 +2396,62 @@ def query_local_applications(self: object, def query_policies(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search for policies that match the provided criteria. - Keyword arguments: - platform_name -- platform name of the policies to search, either 'win' or 'mac'. String. - filter -- Filter results by specific attributes. String. - Allowed attributes are: - properties.max_file_size_to_inspect description - is_default properties.be_upload_timeout_duration_seconds - created_by modified_at - properties.enable_content_inspection properties.similarity_threshold - properties.block_notifications properties.custom_allow_notification - properties.evidence_duplication_enabled_default properties.be_paste_timeout_response - properties.inspection_depth properties.classifications - properties.be_paste_clipboard_max_size properties.min_confidence_level - properties.evidence_storage_free_disk_perc properties.besplash_enabled - properties.browsers_without_active_extension modified_by - created_at properties.enable_network_inspection - properties.enable_context_inspection properties.besplash_custom_message - properties.besplash_message_source properties.be_paste_clipboard_max_size_unit - properties.be_paste_clipboard_min_size_unit properties.max_file_size_to_inspect_unit - properties.network_inspection_files_exceeding_size_limit properties.evidence_encrypted_enabled - properties.similarity_detection properties.enable_clipboard_inspection - properties.allow_notifications properties.evidence_download_enabled - properties.be_exclude_domains properties.be_upload_timeout_response - properties.unsupported_browsers_action precedence is_enabled - properties.custom_block_notification properties.evidence_storage_max_size - properties.be_paste_clipboard_min_size name - properties.block_all_data_access - properties.be_paste_clipboard_over_size_behaviour_block - properties.enable_end_user_notifications_unsupported_browser - properties.be_paste_timeout_duration_milliseconds - offset -- The offset to start retrieving records from. Integer. - limit -- The maximum records to return. Integer. - sort -- The property to sort by. String. - Allowed fields are: - name precedence - created_at modified_at - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/queries.policy.get.v2 + + Keyword arguments + ----------------- + platform_name : str + platform name of the policies to search, either 'win' or 'mac' + filter : str + Filter results by specific attributes. String. + Allowed attributes are: + properties.max_file_size_to_inspect description + is_default properties.be_upload_timeout_duration_seconds + created_by modified_at + properties.enable_content_inspection properties.similarity_threshold + properties.block_notifications properties.custom_allow_notification + properties.evidence_duplication_enabled_default properties.be_paste_timeout_response + properties.inspection_depth properties.classifications + properties.be_paste_clipboard_max_size properties.min_confidence_level + properties.evidence_storage_free_disk_perc properties.besplash_enabled + properties.browsers_without_active_extension modified_by + created_at properties.enable_network_inspection + properties.enable_context_inspection properties.besplash_custom_message + properties.besplash_message_source properties.be_paste_clipboard_max_size_unit + properties.be_paste_clipboard_min_size_unit properties.max_file_size_to_inspect_unit + properties.network_inspection_files_exceeding_size_limit properties.evidence_encrypted_enabled + properties.similarity_detection properties.enable_clipboard_inspection + properties.allow_notifications properties.evidence_download_enabled + properties.be_exclude_domains properties.be_upload_timeout_response + properties.unsupported_browsers_action precedence is_enabled + properties.custom_block_notification properties.evidence_storage_max_size + properties.be_paste_clipboard_min_size name + properties.block_all_data_access + properties.be_paste_clipboard_over_size_behaviour_block + properties.enable_end_user_notifications_unsupported_browser + properties.be_paste_timeout_duration_milliseconds + offset : int + The offset to start retrieving records from. + limit : int + The maximum records to return. + sort : str + The property to sort by. String. + Allowed fields are: + name precedence + created_at modified_at + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2016,33 +2465,269 @@ def query_policies(self: object, parameters: dict = None, **kwargs) -> Union[Dic def query_web_locations(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get web-location IDs matching the query with filter. - Keyword arguments: - filter -- The filter to use when finding web locations. String. - Allowed filters: - name type - deleted application_id - provider_location_id enterprise_account_id - type -- The type of entity to query. String. Allowed values are: - predefined custom - limit -- The number of items to return in this response (default: 100, max: 500). - Use with the offset parameter to manage pagination of results. Integer. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + HTTP Method: GET + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/queries.web-location.get-v2 + + Keyword arguments + ----------------- + filter : str + The filter to use when finding web locations. String. + Allowed filters: + name type + deleted application_id + provider_location_id enterprise_account_id + type : str + The type of entity to query. String. Allowed values are: + predefined custom + limit : int + The number of items to return in this response (default: 100, max: 500). + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="queries_web_location_get_v2", + keywords=kwargs, + params=parameters + ) + + @force_default(defaults=["body"], default_types=["dict"]) + def entities_web_location_group_create(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Create a web location group. + + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities_web_location_group_create + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "description": "string", + "name": "string", + "web_location_ids": [ + "string" + ] + } + description : str + The description value. + name : str + The name value. + web_location_ids : list + The web_location_ids value. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = entities_web_location_group_create_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="entities_web_location_group_create", + body=body + ) + + @force_default(defaults=["parameters"], default_types=["dict"]) + def entities_web_location_group_delete(self: object, + *args, + parameters: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Soft delete web location groups. + + HTTP Method: DELETE + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities_web_location_group_delete + + Keyword arguments + ----------------- + ids : str or list[str] + The id(s) of the web location group to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. + """ + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="entities_web_location_group_delete", + keywords=kwargs, + params=handle_single_argument(args, parameters, "ids") + ) + + @force_default(defaults=["parameters"], default_types=["dict"]) + def entities_web_location_group_get(self: object, + *args, + parameters: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Get specific web location groups. + + HTTP Method: GET + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities_web_location_group_get + + Keyword arguments + ----------------- + ids : str or list[str] + The web location group id(s) to get. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. + """ + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="entities_web_location_group_get", + keywords=kwargs, + params=handle_single_argument(args, parameters, "ids") + ) + + @force_default(defaults=["body", "parameters"], default_types=["dict", "dict"]) + def entities_web_location_group_patch(self: object, + body: dict = None, + parameters: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Update a web location group. + + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/entities_web_location_group_patch + + Keyword arguments + ----------------- + id : str + The web location group id to update. + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "description": "string", + "name": "string", + "web_location_ids": [ + "string" + ] + } + description : str + The description value. + name : str + The name value. + web_location_ids : list + The web_location_ids value. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = entities_web_location_group_patch_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="entities_web_location_group_patch", + keywords=kwargs, + params=parameters, + body=body + ) + + @force_default(defaults=["parameters"], default_types=["dict"]) + def queries_web_location_group_get(self: object, + parameters: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Get all web location group IDs matching the query with filter. HTTP Method: GET Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/queries.web-location.get-v2 + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/data-protection-configuration/queries_web_location_group_get + + Keyword arguments + ----------------- + filter : str + Optional filter for searching web location groups. Allowed filters are 'name' (string), 'deleted' (boolean), + 'type' (string: 'predefined' or 'custom'), 'created' and 'last_updated' + type : str + The type of entity to query. Allowed values are 'predefined' and 'custom' + sort : str + The sort instructions to order by on. Allowed values are 'name', 'created' and 'last_updated' + limit : int + The number of items to return in this response (default: 100, max: 500). Use with the offset parameter to + manage pagination of results. + offset : int + The offset to start retrieving records from. Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, endpoints=Endpoints, - operation_id="queries_web_location_get_v2", + operation_id="queries_web_location_group_get", keywords=kwargs, params=parameters ) diff --git a/src/falconpy/data_protection_configuration.pyi b/src/falconpy/data_protection_configuration.pyi index 926c28f0a..96602e476 100644 --- a/src/falconpy/data_protection_configuration.pyi +++ b/src/falconpy/data_protection_configuration.pyi @@ -439,6 +439,51 @@ class DataProtectionConfiguration(ServiceClass): parameters: Optional[dict] = None, ) -> Union[Dict[str, Union[int, dict]], Result]: ... + def entities_web_location_group_create( + self, + *, + description: Optional[str] = None, + name: Optional[str] = None, + web_location_ids: Optional[Union[str, List[str]]] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def entities_web_location_group_delete( + self, + *args: Union[str, List[str]], + ids: Optional[Union[str, List[str]]] = None, + parameters: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def entities_web_location_group_get( + self, + *args: Union[str, List[str]], + ids: Optional[Union[str, List[str]]] = None, + parameters: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def entities_web_location_group_patch( + self, + *, + id: Optional[str] = None, + description: Optional[str] = None, + name: Optional[str] = None, + web_location_ids: Optional[Union[str, List[str]]] = None, + body: Optional[dict] = None, + parameters: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def queries_web_location_group_get( + self, + *, + filter: Optional[str] = None, + type: Optional[str] = None, + sort: Optional[str] = None, + limit: Optional[int] = None, + offset: Optional[int] = None, + parameters: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + entities_classification_get_v2 = get_classification entities_classification_post_v2 = create_classification entities_classification_patch_v2 = update_classifications diff --git a/src/falconpy/delivery_settings.py b/src/falconpy/delivery_settings.py index b17064aa0..9b8e86443 100644 --- a/src/falconpy/delivery_settings.py +++ b/src/falconpy/delivery_settings.py @@ -59,16 +59,24 @@ class DeliverySettings(ServiceClass): def get_delivery_settings(self: object) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve Delivery Settings. - Keyword arguments: This method does not accept keyword arguments. - - Arguments: This method does not accept arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/delivery-settings/GetDeliverySettings + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Arguments + --------- + This method does not accept arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -80,8 +88,16 @@ def get_delivery_settings(self: object) -> Union[Dict[str, Union[int, dict]], Re def create_delivery_settings(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create Delivery Settings. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/delivery-settings/PostDeliverySettings + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "delivery_settings": [ { @@ -90,17 +106,17 @@ def create_delivery_settings(self: object, body: dict = None, **kwargs) -> Union } ] } - delivery_cadence -- Cadence for the delivery. String. - delivery_type -- Type of delivery. String. + delivery_cadence : str + Cadence for the delivery. + delivery_type : str + Type of delivery. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/delivery-settings/PostDeliverySettings + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = delivery_settings_payload(passed_keywords=kwargs) diff --git a/src/falconpy/deployments.py b/src/falconpy/deployments.py index 69d2fb9de..443c37758 100644 --- a/src/falconpy/deployments.py +++ b/src/falconpy/deployments.py @@ -63,22 +63,34 @@ def query_release_notes(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Query for release-notes resources and returns details. - Keyword arguments: - filter -- FQL query specifying filter parameters. String. - limit -- Maximum number of records to return. Integer. - offset -- Starting pagination offset of records to return. Integer. - sort -- Sort items by providing a comma separated list of property and direction (eg name.desc,time.asc). String. - If direction is omitted, defaults to descending. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/release-notes/CombinedReleaseNotesV1 + + Keyword arguments + ----------------- + filter : str + FQL query specifying filter parameters. + limit : int + Maximum number of records to return. + offset : str + Starting pagination offset of records to return. + sort : str + Sort items by providing a comma separated list of property and direction (eg name.desc,time.asc). String. + If direction is omitted, defaults to descending. + Authorization : str + authorization header. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -92,19 +104,30 @@ def query_release_notes(self: object, def get_deployments(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get deployment resources by IDs. - Keyword arguments: - ids -- Release version IDs to retrieve deployment details. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/deployments/GetDeploymentsExternalV1 + + Keyword arguments + ----------------- + ids : str or list[str] + Release version IDs to retrieve deployment details. + Authorization : str + authorization header. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -118,22 +141,34 @@ def get_deployments(self: object, *args, parameters: dict = None, **kwargs) -> U def query_releases(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query for releases resources and returns details. - Keyword arguments: - filter -- FQL query specifying filter parameters. String. - limit -- Maximum number of records to return. Integer. - offset -- Starting pagination offset of records to return. Integer. - sort -- Sort items by providing a comma separated list of property and direction (eg name.desc,time.asc). - If direction is omitted, defaults to descending. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/releases/CombinedReleasesV1Mixin0 + + Keyword arguments + ----------------- + filter : str + FQL query specifying filter parameters. + limit : int + Maximum number of records to return. + offset : str + Starting pagination offset of records to return. + sort : str + Sort items by providing a comma separated list of property and direction (eg name.desc,time.asc). + If direction is omitted, defaults to descending. + Authorization : str + authorization header. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -147,23 +182,32 @@ def query_releases(self: object, parameters: dict = None, **kwargs) -> Union[Dic def get_release_notes_v1(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Return the release notes for the IDs in the request. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/release-notes/GetEntityIDsByQueryPOST + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required when using other keywords. { "IDs": [ "string" ] } - ids -- Release note IDs to be retrieve. String or list of strings. + ids : str or list[str] + Release note IDs to be retrieve. + Authorization : str + authorization header. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/release-notes/GetEntityIDsByQueryPOST + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, payload_value="ids") @@ -180,23 +224,32 @@ def get_release_notes_v1(self: object, body: dict = None, **kwargs) -> Union[Dic def get_release_notes(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Return the release notes for the IDs in the request. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/release-notes/GetEntityIDsByQueryPOSTV2 + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required when using other keywords. { "IDs": [ "string" ] } - ids -- Release note IDs to be retrieve. String or list of strings. + ids : str or list[str] + Release note IDs to be retrieve. + Authorization : str + authorization header. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/release-notes/GetEntityIDsByQueryPOSTV2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, payload_value="ids") @@ -213,22 +266,34 @@ def get_release_notes(self: object, body: dict = None, **kwargs) -> Union[Dict[s def query_release_note_ids(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query for release-notes resources and returns IDs. - Keyword arguments: - filter -- FQL query specifying filter parameters. String. - limit -- Maximum number of records to return. Integer. - offset -- Starting pagination offset of records to return. Integer. - sort -- Sort items by providing a comma separated list of property and direction (eg name.desc,time.asc). String. - If direction is omitted, defaults to descending. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/release-notes/QueryReleaseNotesV1 + + Keyword arguments + ----------------- + filter : str + FQL query specifying filter parameters. + limit : int + Maximum number of records to return. + offset : str + Starting pagination offset of records to return. + sort : str + Sort items by providing a comma separated list of property and direction (eg name.desc,time.asc). String. + If direction is omitted, defaults to descending. + Authorization : str + authorization header. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/detects.py b/src/falconpy/detects.py index 45d9ae7d0..0e2f50057 100644 --- a/src/falconpy/detects.py +++ b/src/falconpy/detects.py @@ -69,8 +69,16 @@ class Detects(ServiceClass): def get_aggregate_detects(self: object, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get detect aggregates as specified via json in request body. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/detects/GetAggregateDetects + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -105,38 +113,44 @@ def get_aggregate_detects(self: object, body: list = None, **kwargs) -> Union[Di "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/detects/GetAggregateDetects + Returns + ------- + dict + Dictionary object containing API response. """ if not body: # Similar to 664: Detects aggregates expects a list @@ -153,9 +167,18 @@ def get_aggregate_detects(self: object, body: list = None, **kwargs) -> Union[Di def update_detects_by_ids(self: object, *args, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Modify the state, assignee, and visibility of detections. - Keyword arguments: - assigned_to_uuid -- A user ID to assign the detection to. - body -- full body payload, not required when using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/detects/UpdateDetectsByIdsV2 + + Keyword arguments + ----------------- + assigned_to_uuid : str + A user ID to assign the detection to. + body : dict + full body payload, not required when using other keywords. { "assigned_to_uuid": "string", "comment": "string", @@ -168,28 +191,32 @@ def update_detects_by_ids(self: object, *args, body: dict = None, **kwargs) -> U "show_in_ui": true, "status": "string" } - comment -- Optional comment to add to the detection. Comments are displayed with - the detection in Falcon and are usually used to provide context or - notes for other Falcon users. A detection can have multiple comments - over time. - ids -- ID(s) of the detection to update. String or list of strings. - new_behaviors_processed -- String or list of strings. - show_in_ui -- Boolean determining if this detection is displayed in the Falcon - console. - status -- Current status of the detection. Allowed values: - ignored new - in_progress true_positive - false_positive - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/detects/UpdateDetectsByIdsV2 + comment : str + Optional comment to add to the detection. Comments are displayed with + the detection in Falcon and are usually used to provide context or + notes for other Falcon users. A detection can have multiple comments + over time. + ids : str or list[str] + ID(s) of the detection to update. + new_behaviors_processed : str or list[str] + show_in_ui : bool + Boolean determining if this detection is displayed in the Falcon + console. + status : str + Current status of the detection. Allowed values: + ignored new + in_progress true_positive + false_positive + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = update_detects_payload(current_payload=generic_payload_list( @@ -223,24 +250,33 @@ def update_detects_by_ids(self: object, *args, body: dict = None, **kwargs) -> U def get_detect_summaries(self: object, *args, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """View information about detections. - Keyword arguments: - body -- full body payload, not required when ids keyword is provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/detects/GetDetectSummaries + + Keyword arguments + ----------------- + body : dict + full body payload, not required when ids keyword is provided. { "ids": [ "string" ] } - ids -- ID(s) of the detections to retrieve. String or list of strings. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/detects/GetDetectSummaries + ids : str or list[str] + ID(s) of the detections to retrieve. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_arguments=args, @@ -261,93 +297,97 @@ def get_detect_summaries(self: object, *args, body: dict = None, **kwargs) -> Un def query_detects(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search for detection IDs that match a given query. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - An asterisk wildcard '*' includes all results. - - AVAILABLE FILTERS - General - ---------------------------------------------------- - adversary_ids max_confidence - assigned_to_name max_severity - cid max_severity_displayname - date_updated seconds_to_triaged - detection_id seconds_to_resolved - first_behavior status - last_behavior - - Behavioral (behaviors.filter) Ex: behaviors.md5 - ---------------------------------------------------- - alleged_filetype pattern_disposition - behavior_id scenario - cmdline severity - confidence sha256 - control_graph_id tactic - device_id technique - filename timestamp - ioc_source triggering_process_id - ioc_type triggering_process_graph_id - ioc_value user_id - md5 user_name - objective - parent_details.parent_cmdline - parent_details.parent_md5 - parent_details.parent_process_id - parent_details.parent_process_graph_id - parent_details.parent_sha256 - - Devices (device.filter) Ex: device.platform_name - ---------------------------------------------------- - agent_load_flags machine_domain - agent_local_time major_version - agent_version minor_version - bios_manufacturer modified_timestamp - bios_version os_version - cid ou - config_id_base platform_id - config_id_build platform_name - config_id_platform product_type - cpu_signature product_type_desc - device_id release_group - external_ip reduced_functionality_mode - first_seen serial_number - hostname site_name - last_seen status - local_ip system_product_name - mac_address system_manufacturer - - Misc - ---------------------------------------------------- - hostinfo.domain - hostinfo.active_directory_dn_display - - quarantined_files.id quarantined_files.state - quarantined_files.paths quarantined_files.sha256 - - For more detail regarding filtering options, please review: - https://falcon.crowdstrike.com/documentation/86/detections-monitoring-apis#find-detections - - limit -- The maximum number of detections to return in this response. - [Integer, default: 100; max: 9999] - Use with the offset parameter to manage pagination of results. - offset -- The first detection to return, where 0 is the latest detection. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - q -- Search all detection metadata for the provided string. - sort -- The property to sort by. FQL syntax (e.g. last_behavior|asc). - Available sort fields: - adversary_id last_behavior - devices.hostname max_confidence - first_behavior max_severity - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/detects/QueryDetects + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + An asterisk wildcard '*' includes all results. + AVAILABLE FILTERS + General + ---------------------------------------------------- + adversary_ids max_confidence + assigned_to_name max_severity + cid max_severity_displayname + date_updated seconds_to_triaged + detection_id seconds_to_resolved + first_behavior status + last_behavior + Behavioral (behaviors.filter) Ex: behaviors.md5 + ---------------------------------------------------- + alleged_filetype pattern_disposition + behavior_id scenario + cmdline severity + confidence sha256 + control_graph_id tactic + device_id technique + filename timestamp + ioc_source triggering_process_id + ioc_type triggering_process_graph_id + ioc_value user_id + md5 user_name + objective + parent_details.parent_cmdline + parent_details.parent_md5 + parent_details.parent_process_id + parent_details.parent_process_graph_id + parent_details.parent_sha256 + Devices (device.filter) Ex: device.platform_name + ---------------------------------------------------- + agent_load_flags machine_domain + agent_local_time major_version + agent_version minor_version + bios_manufacturer modified_timestamp + bios_version os_version + cid ou + config_id_base platform_id + config_id_build platform_name + config_id_platform product_type + cpu_signature product_type_desc + device_id release_group + external_ip reduced_functionality_mode + first_seen serial_number + hostname site_name + last_seen status + local_ip system_product_name + mac_address system_manufacturer + Misc + ---------------------------------------------------- + hostinfo.domain + hostinfo.active_directory_dn_display + quarantined_files.id quarantined_files.state + quarantined_files.paths quarantined_files.sha256 + For more detail regarding filtering options, please review: + https://falcon.crowdstrike.com/documentation/86/detections-monitoring-apis#find-detections + limit : int + The maximum number of detections to return in this response. + [Integer, default: 100; max: 9999] + Use with the offset parameter to manage pagination of results. + offset : int + The first detection to return, where 0 is the latest detection. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Search all detection metadata for the provided. + sort : str + The property to sort by. FQL syntax (e.g. last_behavior|asc). + Available sort fields: + adversary_id last_behavior + devices.hostname max_confidence + first_behavior max_severity + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/device_content.py b/src/falconpy/device_content.py index 3754187bf..0e288d066 100644 --- a/src/falconpy/device_content.py +++ b/src/falconpy/device_content.py @@ -59,19 +59,28 @@ class DeviceContent(ServiceClass): def get_states(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve the host content state for a number of ids between 1 and 100. - Keyword arguments: - ids -- The ids of the devices to fetch the content state of. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/device-content/entities.states.v1 + + Keyword arguments + ----------------- + ids : str or list[str] + The ids of the devices to fetch the content state of. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -85,22 +94,32 @@ def get_states(self: object, *args, parameters: dict = None, **kwargs) -> Union[ def query_states(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query for the content state of the host. - Keyword arguments: - limit -- The max number of resource ids to return. Integer. - sort -- What field to sort the results on. String. - offset -- The offset token returned from the previous query. Integer. - If none is returned, there are no more pages to the result set. - filter -- The FQL search filter. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/device-content/queries.states.v1 + + Keyword arguments + ----------------- + limit : int + The max number of resource ids to return. + sort : str + What field to sort the results on. + offset : int + The offset token returned from the previous query. Integer. + If none is returned, there are no more pages to the result set. + filter : str + The FQL search filter. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/device_control_policies.py b/src/falconpy/device_control_policies.py index fb9c4532f..08d864193 100644 --- a/src/falconpy/device_control_policies.py +++ b/src/falconpy/device_control_policies.py @@ -76,25 +76,36 @@ def query_combined_policy_members(self: object, providing an FQL filter and paging details. Returns a set of host details which match the filter criteria. - Keyword arguments: - id -- The ID of the Device Control Policy to search for members of - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /device-control-policies/queryCombinedDeviceControlPolicyMembers + /device-control-policies/queryCombinedDeviceControlPolicyMembers + + Keyword arguments + ----------------- + id : str + The ID of the Device Control Policy to search for members of + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -114,28 +125,38 @@ def query_combined_policies(self: object, Search for Device Control Policies in your environment by providing an FQL filter and paging details. Returns a set of Device Control Policies which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. - created_by modified_timestamp - created_timestamp name - enabled platform_name - modified_by precedence - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /device-control-policies/queryCombinedDeviceControlPolicies + /device-control-policies/queryCombinedDeviceControlPolicies + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. + created_by modified_timestamp + created_timestamp name + enabled platform_name + modified_by precedence + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -148,18 +169,25 @@ def query_combined_policies(self: object, def get_default_policies(self: object) -> dict: """Retrieve the configuration for a Default Device Control Policy. - Keyword arguments: - This method does not accept keyword arguments. - - Arguments: This method does not accept arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /device-control-policies/getDefaultDeviceControlPolicies + /device-control-policies/getDefaultDeviceControlPolicies + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Arguments + --------- + This method does not accept arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -171,17 +199,27 @@ def get_default_policies(self: object) -> dict: def update_default_policies(self: object, body: dict = None, **kwargs) -> dict: """Update Device Control Policies by specifying the ID of the policy and details to update. - Keyword arguments: - blocked_notification -- dictionary containing the custom message and enablement status - for the blocked notification. Dictionary. - { - "custom_message": "string", - "use_custom": true - } - blocked_custom_message -- Message to use for blocked notifications. Using this keyword will - automatically generate the necessary blocked_notification dictionary. - String. - body -- full body payload, not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html# + /device-control-policies/updateDefaultDeviceControlPolicies + + Keyword arguments + ----------------- + blocked_notification : str + dictionary containing the custom message and enablement status + for the blocked notification. Dictionary. + { + "custom_message": "string", + "use_custom": true + } + blocked_custom_message : str + Message to use for blocked notifications. Using this keyword will + automatically generate the necessary blocked_notification. + body : dict + full body payload, not required if using other keywords. { "custom_notifications": { "blocked_notification": { @@ -194,25 +232,23 @@ def update_default_policies(self: object, body: dict = None, **kwargs) -> dict: } } } - restricted_custom_message -- message to use for restricted notifications. Using this keyword will - automatically generate the necessary restricted_notification dictionary. - String. - restricted_notification -- dictionary containing the custom message and enablement status - for the restricted notification. Dictionary. - { - "custom_message": "string", - "use_custom": true - } + restricted_custom_message : str + message to use for restricted notifications. Using this keyword will + automatically generate the necessary restricted_notification. + restricted_notification : str + dictionary containing the custom message and enablement status + for the restricted notification. Dictionary. + { + "custom_message": "string", + "use_custom": true + } This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /device-control-policies/updateDefaultDeviceControlPolicies + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = default_device_policy_config_payload(passed_keywords=kwargs) @@ -232,15 +268,26 @@ def perform_action(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Perform a Device Control Policy action. - Keyword arguments: - action_name -- action to perform: 'add-host-group', 'add-rule-group', 'disable', 'enable', - 'remove-rule-group' or 'remove-host-group'. - action_parameters -- Action specific parameter options. List of dictionaries. - { - "name": "string", - "value": "string" - } - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html# + /device-control-policies/performDeviceControlPoliciesAction + + Keyword arguments + ----------------- + action_name : str + action to perform: 'add-host-group', 'add-rule-group', 'disable', 'enable', + 'remove-rule-group' or 'remove-host-group'. + action_parameters : list + Action specific parameter options. List of dictionaries. + { + "name": "string", + "value": "string" + } + body : dict + full body payload, not required if keywords are used. { "action_parameters": [ { @@ -252,20 +299,20 @@ def perform_action(self: object, "string" ] } - group_id -- Host Group ID to apply the policy to. String. - Overridden if action_parameters is specified. - ids -- Device Control policy ID(s) to perform actions against. String or list of strings. - parameters - full parameters payload, not required if action_name is provided as a keyword. + group_id : str + Host Group ID to apply the policy to. String. + Overridden if action_parameters is specified. + ids : str or list[str] + Device Control policy ID(s) to perform actions against. + parameters : dict + full parameters payload, not required if action_name is provided as a keyword. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /device-control-policies/performDeviceControlPoliciesAction + Returns + ------- + dict + Dictionary object containing API response. """ _allowed_actions = ['add-host-group', 'disable', 'enable', 'remove-host-group'] operation_id = "performDeviceControlPoliciesAction" @@ -300,8 +347,17 @@ def perform_action(self: object, def update_policy_classes(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update device control policy's classes (USB and Bluetooth). - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html# + /device-control-with-bluetooth/patchDeviceControlPoliciesClassesV1 + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "policies": [ { @@ -370,19 +426,19 @@ def update_policy_classes(self: object, body: dict = None, **kwargs) -> Union[Di } ] } - bluetooth_classes -- Bluetooth device control policy. Dictionary. - id -- Device control policy ID. String. - usb_classes -- USB device control policy. Dictionary. + bluetooth_classes : dict + Bluetooth device control policy. + id : str + Device control policy ID. + usb_classes : dict + USB device control policy. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /device-control-with-bluetooth/patchDeviceControlPoliciesClassesV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = device_classes_policy_payload(kwargs) @@ -397,19 +453,25 @@ def update_policy_classes(self: object, body: dict = None, **kwargs) -> Union[Di def get_default_settings(self: object) -> Union[Dict[str, Union[int, dict]], Result]: """Get default device control settings (USB and Bluetooth). - Keyword arguments: - This method does not accept keyword arguments. - - Arguments: - This method does not accept arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /device-control-with-bluetooth/getDefaultDeviceControlSettings + /device-control-with-bluetooth/getDefaultDeviceControlSettings + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Arguments + --------- + This method does not accept arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -421,8 +483,17 @@ def get_default_settings(self: object) -> Union[Dict[str, Union[int, dict]], Res def update_default_settings(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update the configuration for Default Device Control Settings. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html# + /device-control-with-bluetooth/patchDeviceControlPoliciesClassesV1 + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "bluetooth_custom_notifications": { "blocked_notification": { @@ -463,19 +534,19 @@ def update_default_settings(self: object, body: dict = None, **kwargs) -> Union[ } ] } - bluetooth_custom_notifications -- Custom bluetooth notifications. Dictionary. - usb_custom_notifications -- Custom USB notifications. Dictionary. - usb_exceptions -- USB exceptions. Dictionary or list of dictionaries. + bluetooth_custom_notifications : dict + Custom bluetooth notifications. + usb_custom_notifications : dict + Custom USB notifications. + usb_exceptions : dict or list[dict] + USB exceptions. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /device-control-with-bluetooth/patchDeviceControlPoliciesClassesV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = device_policy_bluetooth_config_payload(kwargs) @@ -496,26 +567,34 @@ def set_precedence(self: object, body: dict = None, **kwargs) -> Union[Dict[str, specified will have the lowest. You must specify all non-Default Policies for a platform when updating precedence. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html# + /device-control-policies/performDeviceControlPoliciesAction + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "ids": [ "string" ], "platform_name": "Windows" } - ids -- Device Control policy ID(s) to perform actions against. String or list of strings. - platform_name -- OS platform name. + ids : str or list[str] + Device Control policy ID(s) to perform actions against. + platform_name : str + OS platform name. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /device-control-policies/performDeviceControlPoliciesAction + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, payload_value="ids") @@ -533,20 +612,29 @@ def set_precedence(self: object, body: dict = None, **kwargs) -> Union[Dict[str, def get_policies(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve a set of Device Control Policies by specifying their IDs. - Keyword arguments: - ids -- List of Device Control Policy IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /device-control-policies/getDeviceControlPolicies + /device-control-policies/getDeviceControlPolicies + + Keyword arguments + ----------------- + ids : str or list[str] + List of Device Control Policy IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -560,8 +648,17 @@ def get_policies(self: object, *args, parameters: dict = None, **kwargs) -> Unio def create_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create Device Control Policies by specifying details about the policy to create. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html# + /device-control-policies/createDeviceControlPolicies + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "resources": [ { @@ -613,22 +710,24 @@ def create_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str } ] } - clone_id -- ID of the Device Control Policy to clone. String. - description -- Device Control Policy description. String. - name -- Device Control Policy name. String. - platform_name -- Name of the operating system platform. String. - settings -- Device Control policy specific settings. Dictionary. - See above for JSON dictionary format example. + clone_id : str + ID of the Device Control Policy to clone. + description : str + Device Control Policy description. + name : str + Device Control Policy name. + platform_name : str + Name of the operating system platform. + settings : dict + Device Control policy specific settings. Dictionary. + See above for JSON dictionary format example. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /device-control-policies/createDeviceControlPolicies + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = device_policy_payload(passed_keywords=kwargs) @@ -644,20 +743,29 @@ def create_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str def delete_policies(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a set of Device Control Policies by specifying their IDs. - Keyword arguments: - ids -- List of Device Control Policy IDs to delete. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /device-control-policies/createDeviceControlPolicies + /device-control-policies/createDeviceControlPolicies + + Keyword arguments + ----------------- + ids : str or list[str] + List of Device Control Policy IDs to delete. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -671,20 +779,29 @@ def delete_policies(self: object, *args, parameters: dict = None, **kwargs) -> U def get_policies_v2(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get device control policies for the given filter criteria. Supports USB and Bluetooth. - Keyword arguments: - ids -- List of Device Control Policy IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /device-control-with-bluetooth/getDeviceControlPoliciesV2 + /device-control-with-bluetooth/getDeviceControlPoliciesV2 + + Keyword arguments + ----------------- + ids : str or list[str] + List of Device Control Policy IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -698,8 +815,17 @@ def get_policies_v2(self: object, *args, parameters: dict = None, **kwargs) -> U def create_policies_v2(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create Device Control Policies by specifying details about the policy to create. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html# + /device-control-policies/createDeviceControlPolicies + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "policies": [ { @@ -736,24 +862,27 @@ def create_policies_v2(self: object, body: dict = None, **kwargs) -> Union[Dict[ } ] } - bluetooth_settings -- Device Control policy USB specific settings. Dictionary. - See above for JSON dictionary format example. - clone_id -- ID of the Device Control Policy to clone. String. - description -- Device Control Policy description. String. - name -- Device Control Policy name. String. - platform_name -- Name of the operating system platform. String. - usb_settings -- Device Control policy USB specific settings. Dictionary. - See above for JSON dictionary format example. + bluetooth_settings : str + Device Control policy USB specific settings. Dictionary. + See above for JSON dictionary format example. + clone_id : str + ID of the Device Control Policy to clone. + description : str + Device Control Policy description. + name : str + Device Control Policy name. + platform_name : str + Name of the operating system platform. + usb_settings : str + Device Control policy USB specific settings. Dictionary. + See above for JSON dictionary format example. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /device-control-policies/createDeviceControlPolicies + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = device_control_policy_payload_v2(passed_keywords=kwargs) @@ -769,8 +898,17 @@ def create_policies_v2(self: object, body: dict = None, **kwargs) -> Union[Dict[ def update_policies_v2(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create Device Control Policies by specifying details about the policy to create. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html# + /device-control-with-bluetooth/patchDeviceControlPoliciesV2 + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "policies": [ { @@ -807,24 +945,27 @@ def update_policies_v2(self: object, body: dict = None, **kwargs) -> Union[Dict[ } ] } - bluetooth_settings -- Device Control policy USB specific settings. Dictionary. - See above for JSON dictionary format example. - description -- Device Control Policy description. String. - id -- ID of the Device Control Policy to update. String. - name -- Device Control Policy name. String. - platform_name -- Name of the operating system platform. String. - usb_settings -- Device Control policy USB specific settings. Dictionary. - See above for JSON dictionary format example. + bluetooth_settings : str + Device Control policy USB specific settings. Dictionary. + See above for JSON dictionary format example. + description : str + Device Control Policy description. + id : str + ID of the Device Control Policy to update. + name : str + Device Control Policy name. + platform_name : str + Name of the operating system platform. + usb_settings : str + Device Control policy USB specific settings. Dictionary. + See above for JSON dictionary format example. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /device-control-with-bluetooth/patchDeviceControlPoliciesV2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = device_control_policy_payload_v2(passed_keywords=kwargs) @@ -840,8 +981,17 @@ def update_policies_v2(self: object, body: dict = None, **kwargs) -> Union[Dict[ def update_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update Device Control Policies by specifying the ID of the policy and details to update. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html# + /device-control-policies/updateDeviceControlPolicies + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "resources": [ { @@ -892,21 +1042,22 @@ def update_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str } ] } - id -- ID of the Device Control Policy to update. String. - description -- Device Control Policy description. String. - name -- Device Control Policy name. String. - settings -- Device Control policy specific settings. Dictionary. - See above for JSON dictionary format example. + id : str + ID of the Device Control Policy to update. + description : str + Device Control Policy description. + name : str + Device Control Policy name. + settings : dict + Device Control policy specific settings. Dictionary. + See above for JSON dictionary format example. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /device-control-policies/updateDeviceControlPolicies + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = device_policy_payload(passed_keywords=kwargs) @@ -926,25 +1077,36 @@ def query_policy_members(self: object, parameters: dict = None, **kwargs) -> Uni an FQL filter and paging details. Returns a set of Agent IDs which match the filter criteria. - Keyword arguments: - id -- The ID of the Device Control Policy to search for members of - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /device-control-policies/queryDeviceControlPolicyMembers + /device-control-policies/queryDeviceControlPolicyMembers + + Keyword arguments + ----------------- + id : str + The ID of the Device Control Policy to search for members of + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -962,28 +1124,38 @@ def query_policies(self: object, parameters: dict = None, **kwargs) -> Union[Dic FQL filter and paging details. Returns a set of Device Control Policy IDs which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. - created_by modified_timestamp - created_timestamp name - enabled platform_name - modified_by precedence - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /device-control-policies/queryDeviceControlPolicyMembers + /device-control-policies/queryDeviceControlPolicyMembers + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. + created_by modified_timestamp + created_timestamp name + enabled platform_name + modified_by precedence + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/discover.py b/src/falconpy/discover.py index 379ddcb3b..d3b3db8b4 100644 --- a/src/falconpy/discover.py +++ b/src/falconpy/discover.py @@ -64,30 +64,41 @@ def query_combined_applications(self: object, Returns details on applications which match the filter criteria. - Keyword arguments: - after -- A pagination token used with the limit parameter to manage pagination of results. - On your first request, do not provide an after token. On subsequent requests, - provide the after token from the previous response to continue from that place in - the results. String. - facet -- Select various details blocks to be returned for each application entity. String. - Supported values: - browser_extension host_info - install_usage package - ide_extension - filter -- The filter expression that should be used to limit the results. FQL syntax. String. - limit -- The number of account IDs to return in this response. (Max: 100, default: 100) - Use with the offset parameter to manage pagination of results. Integer. - parameters - full parameters payload, not required if using other keywords. - sort -- Sort assets by their properties. A single sort field is allowed. String. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/discover/combined-applications + + Keyword arguments + ----------------- + after : str + A pagination token used with the limit parameter to manage pagination of results. + On your first request, do not provide an after token. On subsequent requests, + provide the after token from the previous response to continue from that place in + the results. + facet : str or list[str] + Select various details blocks to be returned for each application entity. String. + Supported values: + browser_extension host_info + install_usage package + ide_extension + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The number of account IDs to return in this response. (Max: 100, default: 100) + Use with the offset parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + Sort assets by their properties. A single sort field is allowed. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -103,58 +114,69 @@ def query_combined_hosts(self: object, parameters: dict = None, **kwargs) -> Uni Returns details on assets which match the filter criteria. - Keyword arguments: - facet -- Select various details blocks to be returned for each host entity. - String or list of strings. - Supported values: - system_insights third_party - risk_factors - filter -- The filter expression that should be used to limit the results. FQL syntax. - Available Filters: - agent_version kernel_version - aid last_discoverer_aid - bios_manufacturer last_seen_timestamp - bios_version local_ips_count - cid machine_domain - city network_interfaces - confidence network_interfaces.interface_alias - country network_interfaces.interface_description - current_local_ip network_interfaces.local_ip - discoverer_aids network_interfaces.mac_address - discoverer_count network_interfaces.network_prefix - discoverer_platform_names os_version - discoverer_product_type_descs ou - discoverer_tags platform_name - entity_type product_type - external_ip product_type_desc - first_discoverer_aid site_name - first_discoverer_ip system_manufacturer - first_seen_timestamp system_product_name - groups system_serial_number - hostname tags - id scan_details.scan_id - scan_details.schedule_id scan_details.scan_date - vulnerability_assessment_date - limit -- The number of asset IDs to return in this response. (Max: 100, default: 100) - Use with the offset parameter to manage pagination of results. - offset -- An offset used with the limit parameter to manage pagination of results. - On your first request, don't provide an offset. On subsequent requests, - provide the offset from the previous response to continue from that place - in the results. - parameters - full parameters payload, not required if using other keywords. - sort -- Sort assets by their properties. A single sort field is allowed. - Common sort options include: - hostname|asc - product_type|desc - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/discover/combined-hosts + + Keyword arguments + ----------------- + facet : str or list[str] + Select various details blocks to be returned for each host entity. + String or list of strings. + Supported values: + system_insights third_party + risk_factors + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Available Filters: + agent_version kernel_version + aid last_discoverer_aid + bios_manufacturer last_seen_timestamp + bios_version local_ips_count + cid machine_domain + city network_interfaces + confidence network_interfaces.interface_alias + country network_interfaces.interface_description + current_local_ip network_interfaces.local_ip + discoverer_aids network_interfaces.mac_address + discoverer_count network_interfaces.network_prefix + discoverer_platform_names os_version + discoverer_product_type_descs ou + discoverer_tags platform_name + entity_type product_type + external_ip product_type_desc + first_discoverer_aid site_name + first_discoverer_ip system_manufacturer + first_seen_timestamp system_product_name + groups system_serial_number + hostname tags + id scan_details.scan_id + scan_details.schedule_id scan_details.scan_date + vulnerability_assessment_date + limit : int + The number of asset IDs to return in this response. (Max: 100, default: 100) + Use with the offset parameter to manage pagination of results. + offset : str + An offset used with the limit parameter to manage pagination of results. + On your first request, don't provide an offset. On subsequent requests, + provide the offset from the previous response to continue from that place + in the results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + Sort assets by their properties. A single sort field is allowed. + Common sort options include: + hostname|asc + product_type|desc + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -170,19 +192,28 @@ def get_accounts(self: object, *args, parameters: dict = None, **kwargs) -> Unio Find account IDs with `query_accounts`. - Keyword arguments: - ids -- One or more account IDs (max: 100). String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/discover/get-accounts + + Keyword arguments + ----------------- + ids : str or list[str] + One or more account IDs (max: 100) + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -198,19 +229,28 @@ def get_applications(self: object, *args, parameters: dict = None, **kwargs) -> Find application IDs with `query_applications`. - Keyword arguments: - ids -- One or more application IDs (max: 100). String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/discover/get-applications + + Keyword arguments + ----------------- + ids : str or list[str] + One or more application IDs (max: 100) + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -226,19 +266,28 @@ def get_hosts(self: object, *args, parameters: dict = None, **kwargs) -> Union[D Find asset IDs with `query_hosts`. - Keyword arguments: - ids -- One or more asset IDs (max: 100). String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/discover/get-hosts + + Keyword arguments + ----------------- + ids : str or list[str] + One or more asset IDs (max: 100) + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -254,19 +303,28 @@ def get_logins(self: object, *args, parameters: dict = None, **kwargs) -> Union[ Find login IDs with `query_logins`. - Keyword arguments: - ids -- One or more login IDs (max: 100). String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/discover/get-logins + + Keyword arguments + ----------------- + ids : str or list[str] + One or more login IDs (max: 100) + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -283,44 +341,54 @@ def query_accounts(self: object, parameters: dict = None, **kwargs) -> Union[Dic Supports providing a FQL (Falcon Query Language) filter and paging details. Returns a set of account IDs which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - Common filter options include: - account_type:'Local' - admin_privileges:'Yes' - first_seen_timestamp:<'now-7d' - last_successful_login_type:'Terminal server' - Available Filters: - id last_successful_login_timestamp - cid last_successful_login_hostname - user_sid last_successful_login_remote_ip - login_domain last_successful_login_host_country - account_name last_successful_login_host_city - username last_failed_login_type - account_type last_failed_login_timestamp - admin_privileges last_failed_login_hostname - first_seen_timestamp password_last_set_timestamp - last_successful_login_type - limit -- The number of account IDs to return in this response. (Max: 100, default: 100) - Use with the offset parameter to manage pagination of results. - offset -- An offset used with the limit parameter to manage pagination of results. - On your first request, don't provide an offset. On subsequent requests, - provide the offset from the previous response to continue from that place - in the results. - parameters - full parameters payload, not required if using other keywords. - sort -- Sort assets by their properties. A single sort field is allowed. - Common sort options include: - username|asc - last_failed_login_timestamp|desc - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/discover/query-accounts + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Common filter options include: + account_type:'Local' + admin_privileges:'Yes' + first_seen_timestamp:<'now-7d' + last_successful_login_type:'Terminal server' + Available Filters: + id last_successful_login_timestamp + cid last_successful_login_hostname + user_sid last_successful_login_remote_ip + login_domain last_successful_login_host_country + account_name last_successful_login_host_city + username last_failed_login_type + account_type last_failed_login_timestamp + admin_privileges last_failed_login_hostname + first_seen_timestamp password_last_set_timestamp + last_successful_login_type + limit : int + The number of account IDs to return in this response. (Max: 100, default: 100) + Use with the offset parameter to manage pagination of results. + offset : int + An offset used with the limit parameter to manage pagination of results. + On your first request, don't provide an offset. On subsequent requests, + provide the offset from the previous response to continue from that place + in the results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + Sort assets by their properties. A single sort field is allowed. + Common sort options include: + username|asc + last_failed_login_timestamp|desc + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -337,46 +405,56 @@ def query_applications(self: object, parameters: dict = None, **kwargs) -> Union Supports providing a FQL (Falcon Query Language) filter and paging details. Returns a set of account IDs which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - Available Filters: - name last_used_user_name - version last_used_file_name - vendor last_used_file_hash - name_vendor last_used_timestamp - name_vendor_version last_updated_timestamp - first_seen_timestamp is_suspicious - installation_timestamp category - architectures host.id - installation_paths host.platform_name - versioning_scheme host.hostname - groups cid - is_normalized host.os_version - last_used_user_sid host.machine_domain - host.ou host.site_name - host.country host.current_mac_address - host.current_network_prefix host.tags - host.groups host.product_type_desc - host.kernel_version host.system_manufacturer - host.internet_exposure host.agent_version - host.external_ip host.aid - limit -- The number of account IDs to return in this response. (Max: 100, default: 100) - Use with the offset parameter to manage pagination of results. - offset -- An offset used with the limit parameter to manage pagination of results. - On your first request, don't provide an offset. On subsequent requests, - provide the offset from the previous response to continue from that place - in the results. - parameters - full parameters payload, not required if using other keywords. - sort -- Sort assets by their properties. A single sort field is allowed. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/discover/query-applications + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Available Filters: + name last_used_user_name + version last_used_file_name + vendor last_used_file_hash + name_vendor last_used_timestamp + name_vendor_version last_updated_timestamp + first_seen_timestamp is_suspicious + installation_timestamp category + architectures host.id + installation_paths host.platform_name + versioning_scheme host.hostname + groups cid + is_normalized host.os_version + last_used_user_sid host.machine_domain + host.ou host.site_name + host.country host.current_mac_address + host.current_network_prefix host.tags + host.groups host.product_type_desc + host.kernel_version host.system_manufacturer + host.internet_exposure host.agent_version + host.external_ip host.aid + limit : int + The number of account IDs to return in this response. (Max: 100, default: 100) + Use with the offset parameter to manage pagination of results. + offset : int + An offset used with the limit parameter to manage pagination of results. + On your first request, don't provide an offset. On subsequent requests, + provide the offset from the previous response to continue from that place + in the results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + Sort assets by their properties. A single sort field is allowed. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -393,53 +471,63 @@ def query_hosts(self: object, parameters: dict = None, **kwargs) -> Union[Dict[s Supports providing a FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - Available Filters: - agent_version kernel_version - aid last_discoverer_aid - bios_manufacturer last_seen_timestamp - bios_version local_ips_count - cid machine_domain - city network_interfaces - confidence network_interfaces.interface_alias - country network_interfaces.interface_description - current_local_ip network_interfaces.local_ip - discoverer_aids network_interfaces.mac_address - discoverer_count network_interfaces.network_prefix - discoverer_platform_names os_version - discoverer_product_type_descs ou - discoverer_tags platform_name - entity_type product_type - external_ip product_type_desc - first_discoverer_aid site_name - first_discoverer_ip system_manufacturer - first_seen_timestamp system_product_name - groups system_serial_number - hostname tags - id scan_details.scan_id - scan_details.schedule_id scan_details.scan_date - vulnerability_assessment_date - limit -- The number of asset IDs to return in this response. (Max: 100, default: 100) - Use with the offset parameter to manage pagination of results. - offset -- An offset used with the limit parameter to manage pagination of results. - On your first request, don't provide an offset. On subsequent requests, - provide the offset from the previous response to continue from that place - in the results. - parameters - full parameters payload, not required if using other keywords. - sort -- Sort assets by their properties. A single sort field is allowed. - Common sort options include: - hostname|asc - product_type|desc - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/discover/query-hosts + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Available Filters: + agent_version kernel_version + aid last_discoverer_aid + bios_manufacturer last_seen_timestamp + bios_version local_ips_count + cid machine_domain + city network_interfaces + confidence network_interfaces.interface_alias + country network_interfaces.interface_description + current_local_ip network_interfaces.local_ip + discoverer_aids network_interfaces.mac_address + discoverer_count network_interfaces.network_prefix + discoverer_platform_names os_version + discoverer_product_type_descs ou + discoverer_tags platform_name + entity_type product_type + external_ip product_type_desc + first_discoverer_aid site_name + first_discoverer_ip system_manufacturer + first_seen_timestamp system_product_name + groups system_serial_number + hostname tags + id scan_details.scan_id + scan_details.schedule_id scan_details.scan_date + vulnerability_assessment_date + limit : int + The number of asset IDs to return in this response. (Max: 100, default: 100) + Use with the offset parameter to manage pagination of results. + offset : int + An offset used with the limit parameter to manage pagination of results. + On your first request, don't provide an offset. On subsequent requests, + provide the offset from the previous response to continue from that place + in the results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + Sort assets by their properties. A single sort field is allowed. + Common sort options include: + hostname|asc + product_type|desc + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -456,46 +544,56 @@ def query_logins(self: object, parameters: dict = None, **kwargs) -> Union[Dict[ Supports providing a FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - Common filter options include: - account_type:'Local' - login_type:'Interactive' - first_seen_timestamp:<'now-7d' - admin_privileges:'No' - Available Filters: - id login_timestamp - cid login_domain - login_status admin_privileges - account_id local_ip - host_id remote_ip - user_sid host_country - aid host_city - account_name is_suspicious - username failure_description - hostname login_event_count - account_type aggregation_time_interval - login_type - limit -- The number of login IDs to return in this response. (Max: 100, default: 100) - Use with the offset parameter to manage pagination of results. - offset -- An offset used with the limit parameter to manage pagination of results. - On your first request, don't provide an offset. On subsequent requests, - provide the offset from the previous response to continue from that place - in the results. - parameters - full parameters payload, not required if using other keywords. - sort -- Sort logins by their properties. A single sort field is allowed. - Common sort options include: - account_name|asc - login_timestamp|desc - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/discover/query-logins + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Common filter options include: + account_type:'Local' + login_type:'Interactive' + first_seen_timestamp:<'now-7d' + admin_privileges:'No' + Available Filters: + id login_timestamp + cid login_domain + login_status admin_privileges + account_id local_ip + host_id remote_ip + user_sid host_country + aid host_city + account_name is_suspicious + username failure_description + hostname login_event_count + account_type aggregation_time_interval + login_type + limit : int + The number of login IDs to return in this response. (Max: 100, default: 100) + Use with the offset parameter to manage pagination of results. + offset : int + An offset used with the limit parameter to manage pagination of results. + On your first request, don't provide an offset. On subsequent requests, + provide the offset from the previous response to continue from that place + in the results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + Sort logins by their properties. A single sort field is allowed. + Common sort options include: + account_name|asc + login_timestamp|desc + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -511,19 +609,28 @@ def get_iot_hosts(self: object, *args, parameters: dict = None, **kwargs) -> dic Find IoT assets with `query_iot_hosts`. - Keyword arguments: - ids -- One or more login IDs (max: 100). String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/discover/get-iot-hosts + + Keyword arguments + ----------------- + ids : str or list[str] + One or more login IDs (max: 100) + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -540,61 +647,71 @@ def query_iot_hosts(self: object, parameters: dict = None, **kwargs) -> dict: Supports providing a FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - Common filter options include: - entity_type:'managed' - product_type_desc:'Workstation' - platform_name:'Windows' - last_seen_timestamp:>'now-7d' - Available Filters: - agent_version last_seen_timestamp - aid local_ip_addresses - bios_manufacturer local_ips_count - bios_version mac_addresses - business_criticality machine_domain - cid network_id - city network_interfaces - claroty_id number_of_disk_drives - confidence os_is_eol - country os_version - current_local_ip ou - data_providers physical_core_count - data_providers_count platform_name - device_class processor_package_count - device_family product_type_desc - device_type protocols - discoverer_count purdue_level - discoverer_product_type_descs reduced_functionality_mode - entity_type site_name - external_ip subnet - first_seen_timestamp system_manufacturer - groups system_product_name - hostname system_serial_number - ics_id tags - id virtual_zone - internet_exposure vlan - kernel_version - limit -- The number of asset IDs to return in this response. (Max: 100, default: 100) - Use with the offset parameter to manage pagination of results. - offset -- An offset used with the limit parameter to manage pagination of results. - On your first request, don't provide an offset. On subsequent requests, - provide the offset from the previous response to continue from that place - in the results. - parameters - full parameters payload, not required if using other keywords. - sort -- Sort assets by their properties. A single sort field is allowed. - Common sort options include: - hostname|asc - product_type_desc|desc - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/discover/query-iot-hosts + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Common filter options include: + entity_type:'managed' + product_type_desc:'Workstation' + platform_name:'Windows' + last_seen_timestamp:>'now-7d' + Available Filters: + agent_version last_seen_timestamp + aid local_ip_addresses + bios_manufacturer local_ips_count + bios_version mac_addresses + business_criticality machine_domain + cid network_id + city network_interfaces + claroty_id number_of_disk_drives + confidence os_is_eol + country os_version + current_local_ip ou + data_providers physical_core_count + data_providers_count platform_name + device_class processor_package_count + device_family product_type_desc + device_type protocols + discoverer_count purdue_level + discoverer_product_type_descs reduced_functionality_mode + entity_type site_name + external_ip subnet + first_seen_timestamp system_manufacturer + groups system_product_name + hostname system_serial_number + ics_id tags + id virtual_zone + internet_exposure vlan + kernel_version + limit : int + The number of asset IDs to return in this response. (Max: 100, default: 100) + Use with the offset parameter to manage pagination of results. + offset : int + An offset used with the limit parameter to manage pagination of results. + On your first request, don't provide an offset. On subsequent requests, + provide the offset from the previous response to continue from that place + in the results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + Sort assets by their properties. A single sort field is allowed. + Common sort options include: + hostname|asc + product_type_desc|desc + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -611,61 +728,71 @@ def query_iot_hosts_v2(self: object, parameters: dict = None, **kwargs) -> dict: Supports providing a FQL (Falcon Query Language) filter and paging details. Returns a set of asset IDs which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - Common filter options include: - entity_type:'managed' - product_type_desc:'Workstation' - platform_name:'Windows' - last_seen_timestamp:>'now-7d' - Available Filters: - agent_version last_seen_timestamp - aid local_ip_addresses - bios_manufacturer local_ips_count - bios_version mac_addresses - business_criticality machine_domain - cid network_id - city network_interfaces - claroty_id number_of_disk_drives - confidence os_is_eol - country os_version - current_local_ip ou - data_providers physical_core_count - data_providers_count platform_name - device_class processor_package_count - device_family product_type_desc - device_type protocols - discoverer_count purdue_level - discoverer_product_type_descs reduced_functionality_mode - entity_type site_name - external_ip subnet - first_seen_timestamp system_manufacturer - groups system_product_name - hostname system_serial_number - ics_id tags - id virtual_zone - internet_exposure vlan - kernel_version - limit -- The number of asset IDs to return in this response. (Max: 100, default: 100) - Use with the offset parameter to manage pagination of results. - offset -- An offset used with the limit parameter to manage pagination of results. - On your first request, don't provide an offset. On subsequent requests, - provide the offset from the previous response to continue from that place - in the results. - parameters - full parameters payload, not required if using other keywords. - sort -- Sort assets by their properties. A single sort field is allowed. - Common sort options include: - hostname|asc - product_type_desc|desc - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/discover-iot/query-iot-hostsV2 + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Common filter options include: + entity_type:'managed' + product_type_desc:'Workstation' + platform_name:'Windows' + last_seen_timestamp:>'now-7d' + Available Filters: + agent_version last_seen_timestamp + aid local_ip_addresses + bios_manufacturer local_ips_count + bios_version mac_addresses + business_criticality machine_domain + cid network_id + city network_interfaces + claroty_id number_of_disk_drives + confidence os_is_eol + country os_version + current_local_ip ou + data_providers physical_core_count + data_providers_count platform_name + device_class processor_package_count + device_family product_type_desc + device_type protocols + discoverer_count purdue_level + discoverer_product_type_descs reduced_functionality_mode + entity_type site_name + external_ip subnet + first_seen_timestamp system_manufacturer + groups system_product_name + hostname system_serial_number + ics_id tags + id virtual_zone + internet_exposure vlan + kernel_version + limit : int + The number of asset IDs to return in this response. (Max: 100, default: 100) + Use with the offset parameter to manage pagination of results. + offset : str + An offset used with the limit parameter to manage pagination of results. + On your first request, don't provide an offset. On subsequent requests, + provide the offset from the previous response to continue from that place + in the results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + Sort assets by their properties. A single sort field is allowed. + Common sort options include: + hostname|asc + product_type_desc|desc + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/downloads.py b/src/falconpy/downloads.py index 878d21ed1..fd508979c 100644 --- a/src/falconpy/downloads.py +++ b/src/falconpy/downloads.py @@ -59,27 +59,35 @@ class Downloads(ServiceClass): def fetch_download_info(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get files info and pre-signed download URLs. - Keyword arguments: - filter -- Search files using various filters using query in Falcon Query Language (FQL). String. - Supported filters: - arch file_name - category file_version - os - sort -- The fields to sort records on. String. - Supported columns: - arch file_name - category file_version - os - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/downloads-api/FetchFilesDownloadInfo + + Keyword arguments + ----------------- + filter : str + Search files using various filters using query in Falcon Query Language (FQL). String. + Supported filters: + arch file_name + category file_version + os + sort : str + The fields to sort records on. String. + Supported columns: + arch file_name + category file_version + os + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -93,29 +101,39 @@ def fetch_download_info(self: object, parameters: dict = None, **kwargs) -> Unio def fetch_download_info_v2(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get cloud security tools info and pre-signed download URLs. - Keyword arguments: - filter -- Search files using various filters. String. - Supported filters: - arch category - file_name file_version - os - sort -- The fields to sort records on. String. - Supported columns: - arch category - file_name file_version - os - limit -- The upper-bound on the number of records to retrieve. Maximum limit: 100. String. - offset -- The offset from where to begin. Maximum offset = 1000 - limit. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/downloads-api/FetchFilesDownloadInfoV2 + + Keyword arguments + ----------------- + filter : str + Search files using various filters. String. + Supported filters: + arch category + file_name file_version + os + sort : str + The fields to sort records on. String. + Supported columns: + arch category + file_name file_version + os + limit : int + The upper-bound on the number of records to retrieve. Maximum limit: 100. + offset : int + The offset from where to begin. Maximum offset = 1000 - limit. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -131,19 +149,27 @@ def download(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, * DEPRECATED * - Keyword arguments: - file_name -- Name of the file to be downloaded - file_version -- Version of the file to be downloaded - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/downloads-api/DownloadFile + + Keyword arguments + ----------------- + file_name : str + Name of the file to be downloaded + file_version : str + Version of the file to be downloaded + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -159,23 +185,35 @@ def enumerate(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str * DEPRECATED * - Keyword arguments: - arch -- Apply filtering on system architecture. String. - file_name -- Apply filtering on file name. String. - file_version -- Apply filtering on file version. String. - os -- Apply filtering on operating system. String. - platform -- Apply filtering on file platform. String. - category -- Apply filtering on file category. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/downloads-api/EnumerateFile + + Keyword arguments + ----------------- + arch : str + Apply filtering on system architecture. + file_name : str + Apply filtering on file name. + file_version : str + Apply filtering on file version. + os : str + Apply filtering on operating system. + platform : str + Apply filtering on file platform. + category : str + Apply filtering on file category. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/drift_indicators.py b/src/falconpy/drift_indicators.py index b8c1d6f45..e11c62b8e 100644 --- a/src/falconpy/drift_indicators.py +++ b/src/falconpy/drift_indicators.py @@ -62,28 +62,36 @@ def get_drift_indicators_by_date(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Return the count of Drift Indicators by the date. by default it's for 7 days. - Keyword arguments: - filter -- Filter drift indicators using a query in Falcon Query Language (FQL). String. - Supported filters: - cid namespace - cloud_name occurred_at - command_line parent_process_id - container_id pod_name - file_name prevented - file_sha256 scheduler_name - host_id severity - indicator_process_id worker_node_name - limit -- The upper-bound on the number of records to retrieve. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/drift-indicators/GetDriftIndicatorsValuesByDate + + Keyword arguments + ----------------- + filter : str + Filter drift indicators using a query in Falcon Query Language (FQL). String. + Supported filters: + cid namespace + cloud_name occurred_at + command_line parent_process_id + container_id pod_name + file_name prevented + file_sha256 scheduler_name + host_id severity + indicator_process_id worker_node_name + limit : int + The upper-bound on the number of records to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -100,27 +108,34 @@ def read_drift_indicator_counts(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Return the total count of Drift indicators over a time period. - Keyword arguments: - filter -- Filter images using a query in Falcon Query Language (FQL). String. - Supported filters: - cid namespace - cloud_name occurred_at - command_line parent_process_id - container_id pod_name - file_name prevented - file_sha256 scheduler_name - host_id severity - indicator_process_id worker_node_name - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/drift-indicators/ReadDriftIndicatorsCount + + Keyword arguments + ----------------- + filter : str + Filter images using a query in Falcon Query Language (FQL). String. + Supported filters: + cid namespace + cloud_name occurred_at + command_line parent_process_id + container_id pod_name + file_name prevented + file_sha256 scheduler_name + host_id severity + indicator_process_id worker_node_name + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -137,30 +152,40 @@ def search_and_read_drift_indicators(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve Drift Indicators by the provided search criteria. - Keyword arguments: - filter -- Filter Drift Indicators using a query in Falcon Query Language (FQL). String. - Supported filters: - cid namespace - cloud_name occurred_at - command_line parent_process_id - container_id pod_name - file_name prevented - file_sha256 scheduler_name - host_id severity - indicator_process_id worker_node_name - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - sort -- The fields to sort the records on. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/drift-indicators/SearchAndReadDriftIndicatorEntities + + Keyword arguments + ----------------- + filter : str + Filter Drift Indicators using a query in Falcon Query Language (FQL). String. + Supported filters: + cid namespace + cloud_name occurred_at + command_line parent_process_id + container_id pod_name + file_name prevented + file_sha256 scheduler_name + host_id severity + indicator_process_id worker_node_name + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + sort : str + The fields to sort the records on. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -178,19 +203,28 @@ def read_drift_indicator_entities(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve Drift Indicator entities identified by the provided IDs. - Keyword arguments: - ids -- AID(s) of the hosts to retrieve. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/drift-indicators/ReadDriftIndicatorEntities + + Keyword arguments + ----------------- + ids : str or list[str] + AID(s) of the hosts to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -207,30 +241,40 @@ def search_drift_indicators(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve all drift indicators that match the given query. - Keyword arguments: - filter -- Filter Drift Indicators using a query in Falcon Query Language (FQL). String. - Supported filters: - cid namespace - cloud_name occurred_at - command_line parent_process_id - container_id pod_name - file_name prevented - file_sha256 scheduler_name - host_id severity - indicator_process_id worker_node_name - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - sort -- The fields to sort the records on. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/drift-indicators/SearchDriftIndicators + + Keyword arguments + ----------------- + filter : str + Filter Drift Indicators using a query in Falcon Query Language (FQL). String. + Supported filters: + cid namespace + cloud_name occurred_at + command_line parent_process_id + container_id pod_name + file_name prevented + file_sha256 scheduler_name + host_id severity + indicator_process_id worker_node_name + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + sort : str + The fields to sort the records on. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/event_streams.py b/src/falconpy/event_streams.py index 1893768f3..7188df642 100644 --- a/src/falconpy/event_streams.py +++ b/src/falconpy/event_streams.py @@ -66,22 +66,32 @@ def refresh_active_stream(self: object, Use the URL shown in a listAvailableStreamsOAuth2 response. - Keyword arguments: - action_name -- Action to perform. Only allowed value is "refresh_active_stream_session". - app_id -- Label that identifies your connection. Will also accept `appId`. - 32 character alphanumeric. - body -- accepted but not used. - parameters -- full parameters payload, not required if using other keywords. - partition -- Instance partition to request data for. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/event-streams/refreshActiveStreamSession + + Keyword arguments + ----------------- + action_name : str + Action to perform. Only allowed value is "refresh_active_stream_session". + app_id : str + Label that identifies your connection. Will also accept `appId`. + 32 character alphanumeric. + body : dict + accepted but not used. + parameters : dict + Full parameters payload. Not required if using other keywords. + partition : int + Instance partition to request data for. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not kwargs.get("action_name", None): parameters["action_name"] = "refresh_active_stream_session" @@ -102,20 +112,28 @@ def refresh_active_stream(self: object, def list_available_streams(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Discover all event streams in your environment. - Keyword arguments: - app_id -- Label that identifies your connection. Will also accept `appId`. - 32 character alphanumeric. - format -- format for streaming events. Either 'json' or 'flatjson'. - parameters -- full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/event-streams/listAvailableStreamsOAuth2 + + Keyword arguments + ----------------- + app_id : str + Label that identifies your connection. Will also accept `appId`. + 32 character alphanumeric. + format : str + format for streaming events. Either 'json' or 'flatjson'. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("app_id", None): parameters["appId"] = kwargs.get("app_id", None) diff --git a/src/falconpy/exposure_management.py b/src/falconpy/exposure_management.py index b530f405c..ae551957d 100644 --- a/src/falconpy/exposure_management.py +++ b/src/falconpy/exposure_management.py @@ -60,8 +60,16 @@ class ExposureManagement(ServiceClass): def aggregate_assets(self: object, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get detect aggregates as specified via json in request body. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/exposure-management/aggregate-external-assets + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -96,38 +104,44 @@ def aggregate_assets(self: object, body: list = None, **kwargs) -> Union[Dict[st "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/exposure-management/aggregate-external-assets + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -146,27 +160,38 @@ def query_combined_ecosystem_subsidiaries(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve a list of ecosystem subsidiaries with their detailed information. - Keyword arguments: - offset -- Starting index of result set from which to return IDs. Integer. - limit -- Number of IDs to return. Integer. - sort -- Order by fields. String. - filter -- Filter ecosystem subsidiaries using an FQL query. String. - version_id -- The version ID of the ecosystem subsidiaries data, represented as a hash string. - This parameter is required to ensure data consistency and prevent stale data. - If a new version of the ecosystem subsidiaries data is written, the version ID - will be updated. By including this parameter in the request, the client can ensure - that the response will be invalidated if a new version is written. - This is a required field. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/exposure-management/combined-ecosystem-subsidiaries + + Keyword arguments + ----------------- + offset : int + Starting index of result set from which to return IDs. + limit : int + Number of IDs to return. + sort : str + Order by fields. + filter : str + Filter ecosystem subsidiaries using an FQL query. + version_id : str + The version ID of the ecosystem subsidiaries data, represented as a hash string. + This parameter is required to ensure data consistency and prevent stale data. + If a new version of the ecosystem subsidiaries data is written, the version ID + will be updated. By including this parameter in the request, the client can ensure + that the response will be invalidated if a new version is written. + This is a required field. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -180,19 +205,27 @@ def query_combined_ecosystem_subsidiaries(self: object, def download_assets(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Download the entire contents of the blob. The relative link to this endpoint is returned from query_external_assets. - Keyword arguments: - assetId -- The Asset ID. String. - hash -- The File Hash. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/exposure-management/blob-download-external-assets + + Keyword arguments + ----------------- + assetId : str + The Asset ID. + hash : str + The File Hash. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -206,19 +239,27 @@ def download_assets(self: object, parameters: dict = None, **kwargs) -> Union[Di def preview_assets(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Download a preview of the blob. The relative link to this endpoint is returned from query_external_assets. - Keyword arguments: - assetId -- The Asset ID. String. - hash -- The File Hash. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/exposure-management/blob-preview-external-assets + + Keyword arguments + ----------------- + assetId : str + The Asset ID. + hash : str + The File Hash. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -235,23 +276,31 @@ def get_ecosystem_subsidiaries(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve detailed information about ecosystem subsidiaries by ID. - Keyword arguments: - ids -- One or more ecosystem subsidiary IDs (max: 100). String or list of strings. - version_id -- The version ID of the ecosystem subsidiaries data, represented as a hash string. - This parameter is required to ensure data consistency and prevent stale data. - If a new version of the ecosystem subsidiaries data is written, the version ID will - be updated. By including this parameter in the request, the client can ensure that - the response will be invalidated if a new version is written. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/exposure-management/get-ecosystem-subsidiaries + + Keyword arguments + ----------------- + ids : str or list[str] + One or more ecosystem subsidiary IDs (max: 100) + version_id : str + The version ID of the ecosystem subsidiaries data, represented as a hash string. + This parameter is required to ensure data consistency and prevent stale data. + If a new version of the ecosystem subsidiaries data is written, the version ID will + be updated. By including this parameter in the request, the client can ensure that + the response will be invalidated if a new version is written. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -265,9 +314,18 @@ def get_ecosystem_subsidiaries(self: object, def add_assets(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update the details of external assets. - Keyword arguments: - assets -- List of assets to be added. List of dictionaries. - body -- Full body payload as a dictionary. Not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/exposure-management/post-external-assets-inventory-v1 + + Keyword arguments + ----------------- + assets : list[dict] + List of assets to be added. + body : dict + Full body payload as a dictionary. Not required when using other keywords. { "data": [ { @@ -281,18 +339,19 @@ def add_assets(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Uni } ] } - id -- Asset ID to be added. String. - subsidiary_id -- Subsidiary ID of the asset to be added. String. - value -- Asset value. String. + id : str + Asset ID to be added. + subsidiary_id : str + Subsidiary ID of the asset to be added. + value : str + Asset value. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/exposure-management/post-external-assets-inventory-v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = fem_add_asset_payload(passed_keywords=kwargs) @@ -309,19 +368,28 @@ def add_assets(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Uni def get_assets(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get details on external assets by providing one or more IDs. - Keyword arguments: - ids -- One or more asset IDs (max: 100). Find asset IDs with `query_external_assets`. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/exposure-management/get-external-assets + + Keyword arguments + ----------------- + ids : str or list[str] + One or more asset IDs (max: 100). Find asset IDs with `query_external_assets`. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -340,21 +408,29 @@ def delete_assets(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete external assets by providing one or more IDs. - Keyword arguments: - body -- Full body payload as a dictionary. Not required if using other keywords. - description -- Delete operation description. String. - ids -- One or more asset IDs (max: 100). Find asset IDs with query_external_assets. - String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/exposure-management/delete-external-assets + + Keyword arguments + ----------------- + body : dict + Full body payload as a dictionary. Not required if using other keywords. + description : str + Delete operation description. + ids : str or list[str] + One or more asset IDs (max: 100). Find asset IDs with query_external_assets. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: if kwargs.get("description", None): @@ -374,25 +450,39 @@ def delete_assets(self: object, def update_assets(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update the details of external assets. - Keyword arguments: - action -- The asset triage action. String. - assigned_to -- The user assigned to triage the asset. String. - body -- Full body payload as a dictionary. Not required when using other keywords. - cid -- Falcon Customer ID. String. - criticality -- The criticality level manually assigned to this asset. String. - criticality_description -- The criticality description assigned to this asset. String. - description -- The asset triage description. String. - id -- The unique ID of the asset. String. - status -- The asset trriage status. String. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/exposure-management/patch-external-assets + + Keyword arguments + ----------------- + action : str + The asset triage action. + assigned_to : str + The user assigned to triage the asset. + body : dict + Full body payload as a dictionary. Not required when using other keywords. + cid : str + Falcon Customer ID. + criticality : str + The criticality level manually assigned to this asset. + criticality_description : str + The criticality description assigned to this asset. + description : str + The asset triage description. + id : str + The unique ID of the asset. + status : str + The asset trriage status. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = fem_asset_payload(passed_keywords=kwargs) @@ -412,27 +502,38 @@ def query_ecosystem_subsidiaries(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve a list of IDs for ecosystem subsidiaries that match the provided filter conditions. - Keyword arguments: - offset -- Starting index of result set from which to return IDs. Integer. - limit -- Number of IDs to return. Integer. - sort -- Order by fields. String. - filter -- Filter ecosystem subsidiaries using an FQL query. String. - version_id -- The version ID of the ecosystem subsidiaries data, represented as a hash string. - This parameter is required to ensure data consistency and prevent stale data. - If a new version of the ecosystem subsidiaries data is written, the version ID - will be updated. By including this parameter in the request, the client can ensure - that the response will be invalidated if a new version is written. - This is a required field. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/exposure-management/query-ecosystem-subsidiaries + + Keyword arguments + ----------------- + offset : int + Starting index of result set from which to return IDs. + limit : int + Number of IDs to return. + sort : str + Order by fields. + filter : str + Filter ecosystem subsidiaries using an FQL query. + version_id : str + The version ID of the ecosystem subsidiaries data, represented as a hash string. + This parameter is required to ensure data consistency and prevent stale data. + If a new version of the ecosystem subsidiaries data is written, the version ID + will be updated. By including this parameter in the request, the client can ensure + that the response will be invalidated if a new version is written. + This is a required field. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -446,21 +547,31 @@ def query_ecosystem_subsidiaries(self: object, def query_assets_v1(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get a list of external asset IDs that match the provided filter conditions. - Keyword arguments: - offset -- Starting index of result set from which to return IDs. Integer. - limit -- Number of IDs to return. Integer. - sort -- Order by fields. String. - filter -- Filter assets using an FQL query. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/exposure-management/query-external-assets + + Keyword arguments + ----------------- + offset : str + Starting index of result set from which to return IDs. + limit : int + Number of IDs to return. + sort : str + Order by fields. + filter : str + Filter assets using an FQL query. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -474,153 +585,163 @@ def query_assets_v1(self: object, parameters: dict = None, **kwargs) -> Union[Di def query_assets(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get a list of external asset IDs that match the provided filter conditions. - Keyword arguments: - offset -- Starting index of result set from which to return IDs. Integer. - limit -- Number of IDs to return. Integer. - sort -- Order by fields. String. - filter -- Filter assets using an FQL query. String. - Available filter fields that support exact match: - asset_id ip.cloud_vm.region - asset_type ip.cloud_vm.security_groups - confidence ip.cloud_vm.source - connectivity_status ip.cloud_vm.status - criticality ip.fqdns - criticality_description ip.ip_address - criticality_timestamp ip.isp - criticality_username ip.location.area_code - data_providers ip.location.city - discovered_by ip.location.country_code - dns_domain.fqdn ip.location.country_name - dns_domain.isps ip.location.postal_code - dns_domain.parent_domain ip.location.region_code - dns_domain.resolved_ips ip.location.region_name - dns_domain.services.applications.category ip.location.timezone - dns_domain.services.applications.cpe ip.ptr - dns_domain.services.applications.name ip.aid - dns_domain.services.applications.vendor ip.services.applications.category - dns_domain.services.applications.version ip.services.applications.cpe - dns_domain.services.cloud_provider ip.services.applications.name - dns_domain.services.cpes ip.services.applications.vendor - dns_domain.services.hosting_provider ip.services.applications.version - dns_domain.services.last_seen ip.services.cloud_provider - dns_domain.services.platform_name ip.services.cpes - dns_domain.services.port ip.services.first_seen - dns_domain.services.protocol ip.services.last_seen - dns_domain.services.protocol_port ip.services.platform_name - dns_domain.services.status ip.services.port - dns_domain.services.status_code ip.services.protocol - dns_domain.services.transport ip.services.protocol_port - dns_domain.type ip.services.status - first_seen ip.services.status_code - id ip.services.transport - internet_exposure last_seen - ip.asn manual - ip.cloud_provider perimeter - ip.cloud_vm.description subsidiaries.id - ip.cloud_vm.instance_id subsidiaries.name - ip.cloud_vm.lifecycle triage.action - ip.cloud_vm.mac_address triage.assigned_to - ip.cloud_vm.owner_id triage.status - ip.cloud_vm.platform triage.updated_by - ip.cloud_vm.private_ip triage.updated_timestamp - ip.cloud_vm.public_ip - Available filter fields that supports wildcard (*): - asset_id ip.cloud_vm.security_groups - asset_type ip.cloud_vm.source - confidence ip.cloud_vm.status - connectivity_status ip.fqdns - criticality ip.ip_address - criticality_username ip.isp - data_providers ip.location.area_code - discovered_by ip.location.city - dns_domain.fqdn ip.location.country_code - dns_domain.isps ip.location.country_name - dns_domain.parent_domain ip.location.postal_code - dns_domain.resolved_ips ip.location.region_code - dns_domain.services.applications.category ip.location.region_name - dns_domain.services.applications.cpe ip.location.timezone - dns_domain.services.applications.name ip.ptr - dns_domain.services.applications.vendor ip.aid - dns_domain.services.applications.version ip.services.applications.category - dns_domain.services.cloud_provider ip.services.applications.cpe - dns_domain.services.cpes ip.services.applications.name - dns_domain.services.hosting_provider ip.services.applications.vendor - dns_domain.services.id ip.services.applications.version - dns_domain.services.platform_name ip.services.cloud_provider - dns_domain.services.port ip.services.cpes - dns_domain.services.protocol ip.services.platform_name - dns_domain.services.protocol_port ip.services.port - dns_domain.services.status ip.services.protocol - dns_domain.services.status_code ip.services.protocol_port - dns_domain.services.transport ip.services.status - dns_domain.type ip.services.status_code - id ip.services.transport - internet_exposure manual - ip.asn perimeter - ip.cloud_vm.instance_id subsidiaries.id - ip.cloud_vm.lifecycle subsidiaries.name - ip.cloud_vm.mac_address triage.action - ip.cloud_vm.owner_id triage.assigned_to - ip.cloud_vm.platform triage.status - ip.cloud_vm.private_ip triage.updated_by - ip.cloud_vm.public_ip ip.cloud_vm.region - Available filter fields that supports in ([v1, v2]): - asset_id ip.cloud_vm.source - asset_type ip.cloud_vm.status - confidence ip.fqdns - connectivity_status ip.isp - criticality ip.location.area_code - criticality_username ip.location.city - data_providers ip.location.country_code - discovered_by ip.location.country_name - dns_domain.fqdn ip.location.postal_code - dns_domain.isps ip.location.region_code - dns_domain.parent_domain ip.location.region_name - dns_domain.services.applications.category ip.location.timezone - dns_domain.services.applications.cpe ip.ptr - dns_domain.services.applications.name ip.aid - dns_domain.services.applications.vendor ip.services.applications.category - dns_domain.services.applications.version ip.services.applications.cpe - dns_domain.services.cloud_provider ip.services.applications.name - dns_domain.services.cpes ip.services.applications.vendor - dns_domain.services.id ip.services.applications.version - dns_domain.services.platform_name ip.services.cloud_provider - dns_domain.services.port ip.services.cpes - dns_domain.services.protocol ip.services.platform_name - dns_domain.services.protocol_port ip.services.port - dns_domain.services.status ip.services.protocol - dns_domain.services.status_code ip.services.protocol_port - dns_domain.services.transport ip.services.status - dns_domain.type ip.services.status_code - id ip.services.transport - internet_exposure manual - ip.asn perimeter - ip.cloud_vm.instance_id subsidiaries.id - ip.cloud_vm.lifecycle subsidiaries.name - ip.cloud_vm.mac_address triage.action - ip.cloud_vm.owner_id triage.assigned_to - ip.cloud_vm.platform triage.status - ip.cloud_vm.region triage.updated_by - ip.cloud_vm.security_groups - Available filter fields that supports range comparisons (>, <, >=, <=): - criticality_timestamp ip.cloud_vm.public_ip - dns_domain.resolved_ips ip.ip_address - dns_domain.services.first_seen ip.services.first_seen - dns_domain.services.last_seen ip.services.last_seen - dns_domain.services.port ip.services.port - dns_domain.services.status_code ip.services.status_code - first_seen last_seen - ip.cloud_vm.private_ip triage.updated_timestamp - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/exposure-management/query-external-assets-v2 + + Keyword arguments + ----------------- + offset : int + Starting index of result set from which to return IDs. + limit : int + Number of IDs to return. + sort : str + Order by fields. + filter : str + Filter assets using an FQL query. String. + Available filter fields that support exact match: + asset_id ip.cloud_vm.region + asset_type ip.cloud_vm.security_groups + confidence ip.cloud_vm.source + connectivity_status ip.cloud_vm.status + criticality ip.fqdns + criticality_description ip.ip_address + criticality_timestamp ip.isp + criticality_username ip.location.area_code + data_providers ip.location.city + discovered_by ip.location.country_code + dns_domain.fqdn ip.location.country_name + dns_domain.isps ip.location.postal_code + dns_domain.parent_domain ip.location.region_code + dns_domain.resolved_ips ip.location.region_name + dns_domain.services.applications.category ip.location.timezone + dns_domain.services.applications.cpe ip.ptr + dns_domain.services.applications.name ip.aid + dns_domain.services.applications.vendor ip.services.applications.category + dns_domain.services.applications.version ip.services.applications.cpe + dns_domain.services.cloud_provider ip.services.applications.name + dns_domain.services.cpes ip.services.applications.vendor + dns_domain.services.hosting_provider ip.services.applications.version + dns_domain.services.last_seen ip.services.cloud_provider + dns_domain.services.platform_name ip.services.cpes + dns_domain.services.port ip.services.first_seen + dns_domain.services.protocol ip.services.last_seen + dns_domain.services.protocol_port ip.services.platform_name + dns_domain.services.status ip.services.port + dns_domain.services.status_code ip.services.protocol + dns_domain.services.transport ip.services.protocol_port + dns_domain.type ip.services.status + first_seen ip.services.status_code + id ip.services.transport + internet_exposure last_seen + ip.asn manual + ip.cloud_provider perimeter + ip.cloud_vm.description subsidiaries.id + ip.cloud_vm.instance_id subsidiaries.name + ip.cloud_vm.lifecycle triage.action + ip.cloud_vm.mac_address triage.assigned_to + ip.cloud_vm.owner_id triage.status + ip.cloud_vm.platform triage.updated_by + ip.cloud_vm.private_ip triage.updated_timestamp + ip.cloud_vm.public_ip + Available filter fields that supports wildcard (*): + asset_id ip.cloud_vm.security_groups + asset_type ip.cloud_vm.source + confidence ip.cloud_vm.status + connectivity_status ip.fqdns + criticality ip.ip_address + criticality_username ip.isp + data_providers ip.location.area_code + discovered_by ip.location.city + dns_domain.fqdn ip.location.country_code + dns_domain.isps ip.location.country_name + dns_domain.parent_domain ip.location.postal_code + dns_domain.resolved_ips ip.location.region_code + dns_domain.services.applications.category ip.location.region_name + dns_domain.services.applications.cpe ip.location.timezone + dns_domain.services.applications.name ip.ptr + dns_domain.services.applications.vendor ip.aid + dns_domain.services.applications.version ip.services.applications.category + dns_domain.services.cloud_provider ip.services.applications.cpe + dns_domain.services.cpes ip.services.applications.name + dns_domain.services.hosting_provider ip.services.applications.vendor + dns_domain.services.id ip.services.applications.version + dns_domain.services.platform_name ip.services.cloud_provider + dns_domain.services.port ip.services.cpes + dns_domain.services.protocol ip.services.platform_name + dns_domain.services.protocol_port ip.services.port + dns_domain.services.status ip.services.protocol + dns_domain.services.status_code ip.services.protocol_port + dns_domain.services.transport ip.services.status + dns_domain.type ip.services.status_code + id ip.services.transport + internet_exposure manual + ip.asn perimeter + ip.cloud_vm.instance_id subsidiaries.id + ip.cloud_vm.lifecycle subsidiaries.name + ip.cloud_vm.mac_address triage.action + ip.cloud_vm.owner_id triage.assigned_to + ip.cloud_vm.platform triage.status + ip.cloud_vm.private_ip triage.updated_by + ip.cloud_vm.public_ip ip.cloud_vm.region + Available filter fields that supports in ([v1, v2]): + asset_id ip.cloud_vm.source + asset_type ip.cloud_vm.status + confidence ip.fqdns + connectivity_status ip.isp + criticality ip.location.area_code + criticality_username ip.location.city + data_providers ip.location.country_code + discovered_by ip.location.country_name + dns_domain.fqdn ip.location.postal_code + dns_domain.isps ip.location.region_code + dns_domain.parent_domain ip.location.region_name + dns_domain.services.applications.category ip.location.timezone + dns_domain.services.applications.cpe ip.ptr + dns_domain.services.applications.name ip.aid + dns_domain.services.applications.vendor ip.services.applications.category + dns_domain.services.applications.version ip.services.applications.cpe + dns_domain.services.cloud_provider ip.services.applications.name + dns_domain.services.cpes ip.services.applications.vendor + dns_domain.services.id ip.services.applications.version + dns_domain.services.platform_name ip.services.cloud_provider + dns_domain.services.port ip.services.cpes + dns_domain.services.protocol ip.services.platform_name + dns_domain.services.protocol_port ip.services.port + dns_domain.services.status ip.services.protocol + dns_domain.services.status_code ip.services.protocol_port + dns_domain.services.transport ip.services.status + dns_domain.type ip.services.status_code + id ip.services.transport + internet_exposure manual + ip.asn perimeter + ip.cloud_vm.instance_id subsidiaries.id + ip.cloud_vm.lifecycle subsidiaries.name + ip.cloud_vm.mac_address triage.action + ip.cloud_vm.owner_id triage.assigned_to + ip.cloud_vm.platform triage.status + ip.cloud_vm.region triage.updated_by + ip.cloud_vm.security_groups + Available filter fields that supports range comparisons (>, <, >=, <=): + criticality_timestamp ip.cloud_vm.public_ip + dns_domain.resolved_ips ip.ip_address + dns_domain.services.first_seen ip.services.first_seen + dns_domain.services.last_seen ip.services.last_seen + dns_domain.services.port ip.services.port + dns_domain.services.status_code ip.services.status_code + first_seen last_seen + ip.cloud_vm.private_ip triage.updated_timestamp + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/faas_execution.py b/src/falconpy/faas_execution.py index 47b06472e..da0d1958c 100644 --- a/src/falconpy/faas_execution.py +++ b/src/falconpy/faas_execution.py @@ -59,21 +59,31 @@ class FaaSExecution(ServiceClass): def read_request_body(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve a large request body, such as a file, that has spilled into object storage. - Keyword arguments: - id -- Execution ID. String. - fn -- Function reference. String. Format: $fn_id:$fn_version - filename -- Filename to be retrieved. String. - sha256 -- SHA256 checksum for file to be retrieved. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/execution/ReadRequestBody + + Keyword arguments + ----------------- + id : str + Execution ID. + fn : str + Function reference. String. Format: $fn_id:$fn_version + filename : str + Filename to be retrieved. + sha256 : str + SHA256 checksum for file to be retrieved. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/falcon_complete_dashboard.py b/src/falconpy/falcon_complete_dashboard.py index fd7cee041..8132e1ee5 100644 --- a/src/falconpy/falcon_complete_dashboard.py +++ b/src/falconpy/falcon_complete_dashboard.py @@ -61,9 +61,16 @@ class CompleteDashboard(ServiceClass): def aggregate_alerts(self: object, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve aggregate allowlist ticket values based on the matched filter. - Keyword arguments: - body -- full body payload, not required when using other keywords. - List of dictionaries. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Falcon%20Complete%20Dashboard/AggregateAlerts + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [{ "date_ranges": [ { @@ -92,36 +99,40 @@ def aggregate_alerts(self: object, body: list = None, **kwargs) -> Union[Dict[st "time_zone": "string", "type": "string" }] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - interval -- String. - min_doc_count -- Minimum number of documents required to match. Integer. - missing -- String. - name -- Name of the aggregation. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Size limit to apply to the queries. Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + interval : str + min_doc_count : int + Minimum number of documents required to match. + missing : str + name : str + Name of the aggregation. + q : str + FQL syntax. + ranges : list[dict] + size : int + Size limit to apply to the queries. + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str + String. + This method does not support body payload validation. This method only supports keywords for providing arguments. - This method does not support body payload validation. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Falcon%20Complete%20Dashboard/AggregateAlerts + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -137,9 +148,16 @@ def aggregate_alerts(self: object, body: list = None, **kwargs) -> Union[Dict[st def aggregate_allow_list(self: object, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve aggregate allowlist ticket values based on the matched filter. - Keyword arguments: - body -- full body payload, not required when using other keywords. - List of dictionaries. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Falcon%20Complete%20Dashboard/AggregateAllowList + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [{ "date_ranges": [ { @@ -168,36 +186,40 @@ def aggregate_allow_list(self: object, body: list = None, **kwargs) -> Union[Dic "time_zone": "string", "type": "string" }] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - interval -- String. - min_doc_count -- Minimum number of documents required to match. Integer. - missing -- String. - name -- Name of the aggregation. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Size limit to apply to the queries. Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + interval : str + min_doc_count : int + Minimum number of documents required to match. + missing : str + name : str + Name of the aggregation. + q : str + FQL syntax. + ranges : list[dict] + size : int + Size limit to apply to the queries. + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str + String. + This method does not support body payload validation. This method only supports keywords for providing arguments. - This method does not support body payload validation. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Falcon%20Complete%20Dashboard/AggregateAllowList + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -213,9 +235,16 @@ def aggregate_allow_list(self: object, body: list = None, **kwargs) -> Union[Dic def aggregate_block_list(self: object, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve aggregate blocklist ticket values based on the matched filter. - Keyword arguments: - body -- full body payload, not required when using other keywords. - List of dictionaries. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Falcon%20Complete%20Dashboard/AggregateBlockList + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -250,40 +279,46 @@ def aggregate_block_list(self: object, body: list = None, **kwargs) -> Union[Dic "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str + String. + This method does not support body payload validation. This method only supports keywords for providing arguments. - This method does not support body payload validation. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Falcon%20Complete%20Dashboard/AggregateBlockList + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -302,9 +337,17 @@ def aggregate_device_count_collection(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve aggregate host/devices count based on the matched filter. - Keyword arguments: - body -- full body payload, not required when using other keywords. - List of dictionaries. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html# + /Falcon%20Complete%20Dashboard/AggregateDeviceCountCollection + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -339,41 +382,46 @@ def aggregate_device_count_collection(self: object, "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str + String. + This method does not support body payload validation. This method only supports keywords for providing arguments. - This method does not support body payload validation. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /Falcon%20Complete%20Dashboard/AggregateDeviceCountCollection + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -390,9 +438,16 @@ def aggregate_device_count_collection(self: object, def aggregate_escalations(self: object, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve aggregate escalation ticket values based on the matched filter. - Keyword arguments: - body -- full body payload, not required when using other keywords. - List of dictionaries. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Falcon%20Complete%20Dashboard/AggregateEscalations + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -427,40 +482,46 @@ def aggregate_escalations(self: object, body: list = None, **kwargs) -> Union[Di "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str + String. + This method does not support body payload validation. This method only supports keywords for providing arguments. - This method does not support body payload validation. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Falcon%20Complete%20Dashboard/AggregateEscalations + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -482,7 +543,17 @@ def aggregate_fc_incidents(self: object, body: list = None, **kwargs) -> Union[D HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Falcon%20Complete%20Dashboard/AggregateFCIncidents + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -505,7 +576,17 @@ def query_incident_ids_by_filter(self: object, HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Falcon%20Complete%20Dashboard/QueryIncidentIdsByFilter + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -519,9 +600,16 @@ def query_incident_ids_by_filter(self: object, def aggregate_prevention_policy(self: object, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve aggregate prevention policy values based on the matched filter. - Keyword arguments: - body -- full body payload, not required when using other keywords. - List of dictionaries. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Falcon%20Complete%20Dashboard/AggregatePreventionPolicy + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -556,40 +644,46 @@ def aggregate_prevention_policy(self: object, body: list = None, **kwargs) -> Un "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str + String. + This method does not support body payload validation. This method only supports keywords for providing arguments. - This method does not support body payload validation. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Falcon%20Complete%20Dashboard/AggregatePreventionPolicy + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -605,9 +699,16 @@ def aggregate_prevention_policy(self: object, body: list = None, **kwargs) -> Un def aggregate_remediations(self: object, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve aggregate remediation ticket values based on the matched filter. - Keyword arguments: - body -- full body payload, not required when using other keywords. - List of dictionaries. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Falcon%20Complete%20Dashboard/AggregateRemediations + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -642,40 +743,46 @@ def aggregate_remediations(self: object, body: list = None, **kwargs) -> Union[D "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str + String. + This method does not support body payload validation. This method only supports keywords for providing arguments. - This method does not support body payload validation. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Falcon%20Complete%20Dashboard/AggregateRemediations + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -694,9 +801,16 @@ def aggregate_sensor_update_policy(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve aggregate sensor update policy values based on the matched filter. - Keyword arguments: - body -- full body payload, not required when using other keywords. - List of dictionaries. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Falcon%20Complete%20Dashboard/AggregateSensorUpdatePolicy + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -731,40 +845,46 @@ def aggregate_sensor_update_policy(self: object, "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str + String. + This method does not support body payload validation. This method only supports keywords for providing arguments. - This method does not support body payload validation. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Falcon%20Complete%20Dashboard/AggregateSensorUpdatePolicy + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -780,9 +900,16 @@ def aggregate_sensor_update_policy(self: object, def aggregate_support_issues(self: object, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve aggregate device count values based on the matched filter. - Keyword arguments: - body -- full body payload, not required when using other keywords. - List of dictionaries. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Falcon%20Complete%20Dashboard/AggregateSupportIssues + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -817,40 +944,46 @@ def aggregate_support_issues(self: object, body: list = None, **kwargs) -> Union "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str + String. + This method does not support body payload validation. This method only supports keywords for providing arguments. - This method does not support body payload validation. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Falcon%20Complete%20Dashboard/AggregateSupportIssues + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -869,9 +1002,17 @@ def aggregate_total_device_counts(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve aggregate device count values based on the matched filter. - Keyword arguments: - body -- full body payload, not required when using other keywords. - List of dictionaries. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html# + /Falcon%20Complete%20Dashboard/AggregateTotalDeviceCounts + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -906,41 +1047,46 @@ def aggregate_total_device_counts(self: object, "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str + String. + This method does not support body payload validation. This method only supports keywords for providing arguments. - This method does not support body payload validation. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /Falcon%20Complete%20Dashboard/AggregateTotalDeviceCounts + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -959,23 +1105,33 @@ def query_alert_ids_by_filter_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve Alerts Ids for epp that match the provided FQL filter criteria with scrolling enabled. - Keyword arguments: - filter -- Optional filter and sort criteria in the form of an FQL query. String. - limit -- The maximum number of records to return in this response. [Integer, 1-500] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. String. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort on, followed by a dot `.`, followed by the sort direction. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Falcon%20Complete%20Dashboard/QueryAlertIdsByFilter + + Keyword arguments + ----------------- + filter : str + Optional filter and sort criteria in the form of an FQL query. + limit : int + The maximum number of records to return in this response. [Integer, 1-500] + Use with the offset parameter to manage pagination of results. + offset : str + The offset to start retrieving records from. String. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort on, followed by a dot `.`, followed by the sort direction. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -992,23 +1148,33 @@ def query_alert_ids_by_filter(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve Alerts Ids for epp, idp and ngsiem that match the provided FQL filter criteria with scrolling enabled. - Keyword arguments: - filter -- Optional filter and sort criteria in the form of an FQL query. String. - limit -- The maximum number of records to return in this response. [Integer, 1-500] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. String. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort on, followed by a dot `.`, followed by the sort direction. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Falcon%20Complete%20Dashboard/QueryAlertIdsByFilterV2 + + Keyword arguments + ----------------- + filter : str + Optional filter and sort criteria in the form of an FQL query. + limit : int + The maximum number of records to return in this response. [Integer, 1-500] + Use with the offset parameter to manage pagination of results. + offset : str + The offset to start retrieving records from. String. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort on, followed by a dot `.`, followed by the sort direction. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1025,23 +1191,33 @@ def query_allow_list_filter(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve allowlist tickets that match the provided filter criteria with scrolling enabled. - Keyword arguments: - filter -- Optional filter and sort criteria in the form of an FQL query. String. - limit -- The maximum number of records to return in this response. [Integer, 1-500] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. String. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort on, followed by a dot `.`, followed by the sort direction. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Falcon%20Complete%20Dashboard/QueryAllowListFilter + + Keyword arguments + ----------------- + filter : str + Optional filter and sort criteria in the form of an FQL query. + limit : int + The maximum number of records to return in this response. [Integer, 1-500] + Use with the offset parameter to manage pagination of results. + offset : str + The offset to start retrieving records from. String. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort on, followed by a dot `.`, followed by the sort direction. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1058,23 +1234,33 @@ def query_block_list_filter(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve block list tickets that match the provided filter criteria with scrolling enabled. - Keyword arguments: - filter -- Optional filter and sort criteria in the form of an FQL query. String. - limit -- The maximum number of records to return in this response. [Integer, 1-500] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. String. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort on, followed by a dot `.`, followed by the sort direction. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Falcon%20Complete%20Dashboard/QueryBlockListFilter + + Keyword arguments + ----------------- + filter : str + Optional filter and sort criteria in the form of an FQL query. + limit : int + The maximum number of records to return in this response. [Integer, 1-500] + Use with the offset parameter to manage pagination of results. + offset : str + The offset to start retrieving records from. String. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort on, followed by a dot `.`, followed by the sort direction. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1091,24 +1277,34 @@ def get_device_count_collection_queries_by_filter(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve device count collection Ids that match the provided FQL filter, criteria with scrolling enabled. - Keyword arguments: - filter -- Optional filter and sort criteria in the form of an FQL query. String. - limit -- The maximum number of records to return in this response. [Integer, 1-500] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. String. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort on, followed by a dot `.`, followed by the sort direction. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /Falcon%20Complete%20Dashboard/GetDeviceCountCollectionQueriesByFilter + /Falcon%20Complete%20Dashboard/GetDeviceCountCollectionQueriesByFilter + + Keyword arguments + ----------------- + filter : str + Optional filter and sort criteria in the form of an FQL query. + limit : int + The maximum number of records to return in this response. [Integer, 1-500] + Use with the offset parameter to manage pagination of results. + offset : str + The offset to start retrieving records from. String. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort on, followed by a dot `.`, followed by the sort direction. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1125,24 +1321,34 @@ def query_escalations_filter(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve escalation tickets that match the provided filter criteria with scrolling enabled. - Keyword arguments: - filter -- Optional filter and sort criteria in the form of an FQL query. String. - limit -- The maximum number of records to return in this response. [Integer, 1-500] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. String. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort on, followed by a dot `.`, followed by the sort direction. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /Falcon%20Complete%20Dashboard/QueryEscalationsFilter + /Falcon%20Complete%20Dashboard/QueryEscalationsFilter + + Keyword arguments + ----------------- + filter : str + Optional filter and sort criteria in the form of an FQL query. + limit : int + The maximum number of records to return in this response. [Integer, 1-500] + Use with the offset parameter to manage pagination of results. + offset : str + The offset to start retrieving records from. String. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort on, followed by a dot `.`, followed by the sort direction. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1159,24 +1365,34 @@ def query_remediations_filter(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve remediation tickets that match the provided filter criteria with scrolling enabled. - Keyword arguments: - filter -- Optional filter and sort criteria in the form of an FQL query. String. - limit -- The maximum number of records to return in this response. [Integer, 1-500] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. String. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort on, followed by a dot `.`, followed by the sort direction. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /Falcon%20Complete%20Dashboard/QueryRemediationsFilter + /Falcon%20Complete%20Dashboard/QueryRemediationsFilter + + Keyword arguments + ----------------- + filter : str + Optional filter and sort criteria in the form of an FQL query. + limit : int + The maximum number of records to return in this response. [Integer, 1-500] + Use with the offset parameter to manage pagination of results. + offset : str + The offset to start retrieving records from. String. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort on, followed by a dot `.`, followed by the sort direction. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/falcon_container.py b/src/falconpy/falcon_container.py index 943296cc5..0968aca6e 100644 --- a/src/falconpy/falcon_container.py +++ b/src/falconpy/falcon_container.py @@ -67,23 +67,23 @@ def download_export_file(self: object, HTTP Method: GET Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falcon-container-image/DownloadExportFile Keyword arguments - ---- + ----------------- id : str (required) Export job ID. parameters : dict Full parameters payload. Not required if using other keywords. Arguments - ---- + --------- When not specified, the first argument to this method is assumed to be 'id'. All others are ignored. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -106,23 +106,23 @@ def read_export_jobs(self: object, HTTP Method: GET Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falcon-container-image/ReadExportJobs Keyword arguments - ---- + ----------------- ids : str or List of str (required) Export Job IDs to read. Allowed up to 100 IDs per request. parameters : dict Full parameters payload. Not required if using other keywords. Arguments - ---- + --------- When not specified, the first argument to this method is assumed to be 'ids'. All others are ignored. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -143,11 +143,11 @@ def launch_export_job(self: object, body: dict = None, **kwargs) -> Union[Dict[s HTTP Method: POST Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falcon-container-image/LaunchExportJob Keyword arguments - ---- + ----------------- body : dict Full body payload, not required when using other keywords. { @@ -179,7 +179,7 @@ def launch_export_job(self: object, body: dict = None, **kwargs) -> Union[Dict[s This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -199,19 +199,19 @@ def get_credentials(self: object) -> Union[Dict[str, Union[int, dict]], Result]: HTTP Method: GET Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falcon-container/GetCredentials Keyword arguments - ---- + ----------------- This method does not accept keyword arguments. Arguments - ---- + --------- This method does not accept arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -228,11 +228,11 @@ def read_image_vulnerabilities(self: object, body: dict = None, **kwargs) -> Uni HTTP Method: POST Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falcon-container-cli/ReadImageVulnerabilities Keyword arguments - ---- + ----------------- applicationPackages : list[dict] List of application packages. body : dict @@ -278,7 +278,7 @@ def read_image_vulnerabilities(self: object, body: dict = None, **kwargs) -> Uni This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -303,11 +303,11 @@ def get_assessment(self: object, parameters: dict = None, **kwargs) -> Union[Dic HTTP Method: GET Swagger URL - ---- + ----------- This operation does not exist in swagger. Keyword arguments - ---- + ----------------- digest: str (must be paired with image_id) Hash digest for the image. image_id: str (must be paired with digest) @@ -322,7 +322,7 @@ def get_assessment(self: object, parameters: dict = None, **kwargs) -> Union[Dic This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -340,21 +340,21 @@ def delete_image_details(self: object, *args, image_id: str = None) -> Union[Dic HTTP Method: DELETE Swagger URL - ---- + ----------- This operation does not exist in swagger. Keyword arguments - ---- + ----------------- image_id : str (required) ID of the image to delete details for. Arguments - ---- + --------- When not specified, the first argument to this method is assumed to be 'image_id'. All others are ignored. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -375,11 +375,11 @@ def image_matches_policy(self: object, parameters: dict = None, **kwargs) -> Uni HTTP Method: GET Swagger URL - ---- + ----------- This operation does not exist in swagger. Keyword arguments - ---- + ----------------- repository : str (required) Repository where the image resides. parameters : dict @@ -390,7 +390,7 @@ def image_matches_policy(self: object, parameters: dict = None, **kwargs) -> Uni This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -410,11 +410,11 @@ def read_registry_entities(self: object, parameters: dict = None, **kwargs) -> U HTTP Method: GET Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falcon-container-image/ReadRegistryEntities Keyword arguments - ---- + ----------------- limit : int The maximum number of records to return in this response. [1-500] Use with the offset parameter to manage pagination of results. @@ -429,7 +429,7 @@ def read_registry_entities(self: object, parameters: dict = None, **kwargs) -> U This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -452,23 +452,23 @@ def read_registry_entities_by_uuid(self: object, HTTP Method: GET Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falcon-container-image/ReadRegistryEntitiesByUUID Keyword arguments - ---- + ----------------- ids : str Registry entity UUID. parameters : dict Full parameters payload. Not required if using other keywords. Arguments - ---- + --------- When not specified, the first argument to this method is assumed to be 'ids'. All others are ignored. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -491,23 +491,23 @@ def delete_registry_entities(self: object, HTTP Method: DELETE Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falcon-container-image/DeleteRegistryEntities Keyword arguments - ---- + ----------------- ids : str List of Prevention Policy IDs to delete. parameters : dict Full parameters payload. Not required if using other keywords. Arguments - ---- + --------- When not specified, the first argument to this method is assumed to be 'ids'. All others are ignored. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -530,11 +530,11 @@ def query_export_jobs(self: object, HTTP Method: GET Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falcon-container-image/QueryExportJobs Keyword arguments - ---- + ----------------- filter : str (required) Filter exports using a query in Falcon Query Language (FQL). Only the last 100 jobs are returned. Supported filter fields: resource, status @@ -542,12 +542,12 @@ def query_export_jobs(self: object, Full parameters payload. Not required if using other keywords. Arguments - ---- + --------- When not specified, the first argument to this method is assumed to be 'filter'. All others are ignored. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -566,11 +566,11 @@ def create_registry_entities(self: object, body: dict = None, **kwargs) -> Union HTTP Method: POST Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falcon-container-image/CreateRegistryEntities Keyword arguments - ---- + ----------------- body : dict Full body payload, not required if keywords are used. { @@ -586,7 +586,7 @@ def create_registry_entities(self: object, body: dict = None, **kwargs) -> Union This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -607,11 +607,11 @@ def update_registry_entities(self: object, body: dict = None, **kwargs) -> Union HTTP Method: PATCH Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falcon-container-image/UpdateRegistryEntities Keyword arguments - ---- + ----------------- body : dict Full body payload, not required if keywords are used. { @@ -621,7 +621,7 @@ def update_registry_entities(self: object, body: dict = None, **kwargs) -> Union This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -642,11 +642,11 @@ def scan_inventory(self: object, body: dict = None, **kwargs) -> Union[Dict[str, HTTP Method: POST Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falcon-container-image/UpdateRegistryEntities Keyword arguments - ---- + ----------------- agent_uuid : str Agent UUID agent_version : str @@ -720,7 +720,7 @@ def scan_inventory(self: object, body: dict = None, **kwargs) -> Union[Dict[str, This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -740,19 +740,19 @@ def get_scan_headers(self: object) -> Union[Dict[str, Union[int, dict]], Result] HTTP Method: HEAD Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falcon-container-image/HeadImageScanInventory Keyword arguments - ---- + ----------------- This method does not accept keyword arguments. Arguments - ---- + --------- This method does not accept arguments. Returns - ---- + ------- dict Dictionary object containing API response. Body payload will be empty. """ @@ -769,21 +769,31 @@ def check_prevention_policies(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Check image prevention policies. - Keyword arguments: - registry -- Image registry. String. - repository -- Image repository. String. - tag -- Image tag. String. - architecture -- Architecture e.g. 'amd64', 'arm64'... String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falcon-container-image/PolicyChecks + + Keyword arguments + ----------------- + registry : str + Image registry. + repository : str + Image repository. + tag : str + Image tag. + architecture : str + Architecture e.g. 'amd64', 'arm64' + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -800,28 +810,41 @@ def get_report_by_reference(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get image assessment scan report by image reference (v2). - Keyword arguments: - registry -- Image registry. String. - repository -- Image repository. String. - tag -- Image tag. String. - image_id -- Image ID. String. - digest -- Image digest. String. - report_format -- Specify image-assessment scan report format. - Supported formats: - cyclonedx-json - json - sarif - architecture -- Platform architecture to filter multi-arch images (e.g. amd64, arm64). String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falcon-container-image/GetReportByReference + + Keyword arguments + ----------------- + registry : str + Image registry. + repository : str + Image repository. + tag : str + Image tag. + image_id : str + Image ID. + digest : str + Image digest. + report_format : str + Specify image-assessment scan report format. + Supported formats: + cyclonedx-json + json + sarif + architecture : str + Platform architecture to filter multi-arch images (e.g. amd64, arm64) + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -835,23 +858,31 @@ def get_report_by_reference(self: object, def get_report_by_id(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get image assessment scan report by scan UUID (v2). - Keyword arguments: - uuid -- Scan UUID. String. - report_format -- Specify image-assessment scan report format. String. - Supported formats: - cyclonedx-json - json - sarif - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falcon-container-image/GetReportByScanID + + Keyword arguments + ----------------- + uuid : str + Scan UUID. + report_format : str + Specify image-assessment scan report format. String. + Supported formats: + cyclonedx-json + json + sarif + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ uuid = kwargs.get("uuid", None) if uuid: diff --git a/src/falconpy/falcon_id.py b/src/falconpy/falcon_id.py index d28652298..194a4df5d 100644 --- a/src/falconpy/falcon_id.py +++ b/src/falconpy/falcon_id.py @@ -64,19 +64,28 @@ def get_third_party_passkey_registry(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Fetch third party passkey registries. - Keyword arguments: - ids -- Third party passkey registry IDs to retrieve String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falcon-id/GetThirdPartyPasskeyRegistry + + Keyword arguments + ----------------- + ids : str or list[str] + Third party passkey registry IDs to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -94,19 +103,28 @@ def delete_third_party_passkey_registry(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete third party passkey registries. - Keyword arguments: - ids -- Third party passkey registry IDs to delete String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falcon-id/DeleteThirdPartyPasskeyRegistry + + Keyword arguments + ----------------- + ids : str or list[str] + Third party passkey registry IDs to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -123,23 +141,31 @@ def update_third_party_passkey_registry(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update third party passkey registries. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falcon-id/UpdateThirdPartyPasskeyRegistry + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "enabled": true, "id": "string" } - enabled -- The enabled value. Boolean. - id -- The id value. String. + enabled : bool + The enabled value. + id : str + The id value. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falcon-id/UpdateThirdPartyPasskeyRegistry + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = update_third_party_passkey_registry_payload(passed_keywords=kwargs) @@ -158,21 +184,31 @@ def query_third_party_passkey_registry(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Query third party passkey registries. - Keyword arguments: - filter -- FQL filter. String. - offset -- Paging offset. Integer. - limit -- Paging limit. Integer. - sort -- Sorting field and direction. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falcon-id/QueryThirdPartyPasskeyRegistry + + Keyword arguments + ----------------- + filter : str + FQL filter. + offset : int + Paging offset. + limit : int + Paging limit. + sort : str + Sorting field and direction. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/falconx_sandbox.py b/src/falconpy/falconx_sandbox.py index 87557efb8..32916b1c8 100644 --- a/src/falconpy/falconx_sandbox.py +++ b/src/falconpy/falconx_sandbox.py @@ -72,23 +72,33 @@ def get_artifacts(self: object, ) -> Union[Dict[str, Union[int, dict]], Result, Response]: """Download IOC packs, PCAP files, and other analysis artifacts. - Keyword arguments: - id -- ID of an artifact, such as an IOC pack, PCAP file, or actor image. - Find an artifact ID in a report or summary. String. - name -- The name given to your download file. String. - parameters -- Full parameters payload, not required if id is provided as a keyword. - stream -- Enable streaming download of the returned file. Boolean. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: gzip-compressed binary object on SUCCESS - dict object containing API response on FAILURE - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falconx-sandbox/GetArtifacts + + Keyword arguments + ----------------- + id : str + ID of an artifact, such as an IOC pack, PCAP file, or actor image. + Find an artifact ID in a report or summary. + name : str + The name given to your download file. + parameters : dict + Full parameters payload, not required if id is provided as a keyword. + stream : bool + Enable streaming download of the returned file. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + gzip-compressed binary object on SUCCESS + dict object containing API response on FAILURE """ # Create a copy of our default header dictionary header_payload = json.loads(json.dumps(self.headers)) @@ -112,22 +122,32 @@ def get_dump_extracted_strings(self: object, ) -> Union[Dict[str, Union[int, dict]], Result, Response]: """Get extracted strings from a memory dump. - Keyword arguments: - id -- Extracted Strings ID. String. - name -- The name given to your download file. String. - parameters -- Full parameters payload, not required if id is provided as a keyword. - stream -- Enable streaming download of the returned file. Boolean. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: gzip-compressed binary object on SUCCESS - dict object containing API response on FAILURE - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falconx-sandbox/GetMemoryDumpExtractedStrings + + Keyword arguments + ----------------- + id : str + Extracted Strings ID. + name : str + The name given to your download file. + parameters : dict + Full parameters payload, not required if id is provided as a keyword. + stream : bool + Enable streaming download of the returned file. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + gzip-compressed binary object on SUCCESS + dict object containing API response on FAILURE """ # Create a copy of our default header dictionary header_payload = json.loads(json.dumps(self.headers)) @@ -151,22 +171,32 @@ def get_hex_dump(self: object, ) -> Union[Dict[str, Union[int, dict]], Result, Response]: """Get hex view of a memory dump. - Keyword arguments: - id -- Hex Dump ID. String. - name -- The name given to your download file. String. - parameters -- Full parameters payload, not required if id is provided as a keyword. - stream -- Enable streaming download of the returned file. Boolean. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: gzip-compressed binary object on SUCCESS - dict object containing API response on FAILURE - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falconx-sandbox/GetMemoryDumpHexDump + + Keyword arguments + ----------------- + id : str + Hex Dump ID. + name : str + The name given to your download file. + parameters : dict + Full parameters payload, not required if id is provided as a keyword. + stream : bool + Enable streaming download of the returned file. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + gzip-compressed binary object on SUCCESS + dict object containing API response on FAILURE """ # Create a copy of our default header dictionary header_payload = json.loads(json.dumps(self.headers)) @@ -190,22 +220,32 @@ def get_memory_dump(self: object, ) -> Union[Dict[str, Union[int, dict]], Result, Response]: """Get memory dump content as a binary. - Keyword arguments: - id -- Memory Dump ID. String. - name -- The name given to your download file. String. - parameters -- full parameters payload, not required if id is provided as a keyword. - stream -- Enable streaming download of the returned file. Boolean. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: gzip-compressed binary object on SUCCESS - dict object containing API response on FAILURE - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falconx-sandbox/GetMemoryDump + + Keyword arguments + ----------------- + id : str + Memory Dump ID. + name : str + The name given to your download file. + parameters : dict + full parameters payload, not required if id is provided as a keyword. + stream : bool + Enable streaming download of the returned file. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + gzip-compressed binary object on SUCCESS + dict object containing API response on FAILURE """ # Create a copy of our default header dictionary header_payload = json.loads(json.dumps(self.headers)) @@ -229,19 +269,28 @@ def get_summary_reports(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get a short summary version of a sandbox report. - Keyword arguments: - ids -- List of Summary IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falconx-sandbox/GetSummaryReports + + Keyword arguments + ----------------- + ids : str or list[str] + List of Summary IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -257,21 +306,29 @@ def get_submissions(self: object, *args, parameters: dict = None, **kwargs) -> U Time required for analysis varies but is usually less than 15 minutes. - Keyword arguments: - ids -- ID(s) of submitted malware samples. Find a submission ID from the response when - submitting a malware sample or search with `query_submissions`. - String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falconx-sandbox/GetSubmissions + + Keyword arguments + ----------------- + ids : str or list[str] + ID(s) of submitted malware samples. Find a submission ID from the response when + submitting a malware sample or search with `query_submissions`. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -292,14 +349,24 @@ def submit(self: object, The sample file must have been previously uploaded through `upload_sample`. Time required for analysis varies but is usually less than 15 minutes. - Keyword arguments: - action_script -- Runtime script for sandbox analysis. - Accepted values: - default default_randomtheme - default_maxantievasion default_openie - default_randomfiles - aid -- Agent ID. String. - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falconx-sandbox/Submit + + Keyword arguments + ----------------- + action_script : str + Runtime script for sandbox analysis. + Accepted values: + default default_randomtheme + default_maxantievasion default_openie + default_randomfiles + aid : str + Agent ID. + body : dict + full body payload, not required if keywords are used. { "sandbox": [ { @@ -321,47 +388,55 @@ def submit(self: object, "string" ] } - command_line -- Command line script passed to the submitted file at runtime. - Max length: 2048 characters - document_password -- Auto-filled for Adobe or Office files that prompt for a password. - Max length: 32 characters - enable_tor -- Deprecated, please use network_settings instead. - If true, sandbox analysis routes network traffic via TOR. - environment_id -- Specifies the sandbox environment used for analysis. - Accepted values: - 400 - macOS Catalina 10.15 - 300 - Linux Ubuntu 16.04, 64-bit - 200 - Android (static analysis) - 160 - Windows 10, 64-bit - 140 - Windows 11, 64-bit - 110 - Windows 7, 64-bit - 100 - Windows 7, 32-bit - network_settings -- Specifies the sandbox network_settings used for analysis. - Accepted values: - default - Fully operating network - tor - Route network traffic via TOR - simulated - Simulate network traffic - offline - No network traffic - send_email_notification -- Boolean indicating if an email notification should be sent. - sha256 -- ID of the sample, which is a SHA256 hash value. Find a sample ID - from the response when uploading a malware sample or search with `query_sample`. - The `url` keyword must be unset if this keyword is used. - submit_name -- Name of the malware sample that's used for file type detection and analysis. - system_date -- Set a custom date in the format yyyy-MM-dd for the sandbox environment. - system_time -- Set a custom time in the format HH:mm for the sandbox environment. - url -- A web page or file URL. It can be HTTP(S) or FTP. - The `sha256` keyword must be unset if url is used. - user_tags -- List of strings. - + command_line : str + Command line script passed to the submitted file at runtime. + Max length: 2048 characters + document_password : str + Auto-filled for Adobe or Office files that prompt for a password. + Max length: 32 characters + enable_tor : str + Deprecated, please use network_settings instead. + If true, sandbox analysis routes network traffic via TOR. + environment_id : str + Specifies the sandbox environment used for analysis. + Accepted values: + 400 - macOS Catalina 10.15 + 300 - Linux Ubuntu 16.04, 64-bit + 200 - Android (static analysis) + 160 - Windows 10, 64-bit + 140 - Windows 11, 64-bit + 110 - Windows 7, 64-bit + 100 - Windows 7, 32-bit + network_settings : str + Specifies the sandbox network_settings used for analysis. + Accepted values: + default - Fully operating network + tor - Route network traffic via TOR + simulated - Simulate network traffic + offline - No network traffic + send_email_notification : bool + Boolean indicating if an email notification should be sent. + sha256 : str + ID of the sample, which is a SHA256 hash value. Find a sample ID + from the response when uploading a malware sample or search with `query_sample`. + The `url` keyword must be unset if this keyword is used. + submit_name : str + Name of the malware sample that's used for file type detection and analysis. + system_date : str + Set a custom date in the format yyyy-MM-dd for the sandbox environment. + system_time : str + Set a custom time in the format HH:mm for the sandbox environment. + url : str + A web page or file URL. It can be HTTP(S) or FTP. + The `sha256` keyword must be unset if url is used. + user_tags : str or list[str] This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falconx-sandbox/Submit + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = falconx_payload(passed_keywords=kwargs) @@ -380,23 +455,33 @@ def query_reports(self: object, parameters: dict = None, **kwargs) -> Union[Dict Returns a set of report IDs that match your criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. String. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. (`asc` or `desc`) - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falconx-sandbox/QueryReports + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : str + The offset to start retrieving records from. String. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. (`asc` or `desc`) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -412,23 +497,33 @@ def query_submissions(self: object, parameters: dict = None, **kwargs) -> Union[ Returns a set of submission IDs that match your criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. String. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. (`asc` or `desc`) - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falconx-sandbox/QuerySubmissions + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : str + The offset to start retrieving records from. String. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. (`asc` or `desc`) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -449,49 +544,57 @@ def upload_sample(self: object, After uploading, use `submit` to start analyzing the file. - Keyword arguments: - comment -- A descriptive comment to identify the file for other users. String. - file_data -- Content of the uploaded sample in binary format. Max file size is 256 MB. - 'sample' and 'upfile' are also accepted as this parameter. - - Accepted File Formats: - Portable executables: .exe, .scr, .pif, .dll, .com, .cpl, etc. - Office documents: .doc, .docx, .ppt, .pps, .pptx, - .ppsx, .xls, .xlsx, .rtf, .pub - PDF - APK - Executable JAR - Windows script component: .sct - Windows shortcut: .lnk - Windows help: .chm - HTML application: .hta - Windows script file: .wsf - Javascript: .js - Visual Basic: .vbs, .vbe - Shockwave Flash: .swf - Perl: .pl - Powershell: .ps1, .psd1, .psm1 - Scalable vector graphics: .svg - Python: .py - Linux ELF executables - Email files: MIME RFC 822 .eml, Outlook .msg - file_name -- Name of the file. String. - is_confidential -- Defines the visibility of this file in Falcon MalQuery, either - via the API or the Falcon console. - True = File is only shown to users within your customer account. - False = File can be seen by other CrowdStrike customers. - Defaults to True. - parameters -- full parameters payload, not required if other keywords are provided. - - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falconx-sandbox/UploadSampleV2 + + Keyword arguments + ----------------- + comment : str + A descriptive comment to identify the file for other users. + file_data : str + Content of the uploaded sample in binary format. Max file size is 256 MB. + 'sample' and 'upfile' are also accepted as this parameter. + Accepted File Formats: + Portable executables: .exe, .scr, .pif, .dll, .com, .cpl, etc. + Office documents: .doc, .docx, .ppt, .pps, .pptx, + .ppsx, .xls, .xlsx, .rtf, .pub + PDF + APK + Executable JAR + Windows script component: .sct + Windows shortcut: .lnk + Windows help: .chm + HTML application: .hta + Windows script file: .wsf + Javascript: .js + Visual Basic: .vbs, .vbe + Shockwave Flash: .swf + Perl: .pl + Powershell: .ps1, .psd1, .psm1 + Scalable vector graphics: .svg + Python: .py + Linux ELF executables + Email files: MIME RFC 822 .eml, Outlook .msg + file_name : str + Name of the file. + is_confidential : str + Defines the visibility of this file in Falcon MalQuery, either + via the API or the Falcon console. + True = File is only shown to users within your customer account. + False = File can be seen by other CrowdStrike customers. + Defaults to True. + parameters : dict + full parameters payload, not required if other keywords are provided. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ method_args = ["file_name", "sample", "upfile", "file_data", "is_confidential", "comment"] kwargs = params_to_keywords(method_args, @@ -532,21 +635,29 @@ def upload_sample(self: object, def get_reports(self: object, *args, parameters: dict = None, **kwargs) -> object: """Retrieve a full sandbox report. - Keyword arguments: - ids -- ID(s) of report. Find a report ID from the response when - submitting a malware sample or search with `query_reports`. - String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falconx-sandbox/GetReports + + Keyword arguments + ----------------- + ids : str or list[str] + ID(s) of report. Find a report ID from the response when + submitting a malware sample or search with `query_reports`. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -562,21 +673,29 @@ def delete_report(self: object, *args, parameters: dict = None, **kwargs) -> Uni Operation can be checked for success by polling for the report ID on the get_summary_reports endpoint. - Keyword arguments: - ids -- ID(s) of report to delete. Find a report ID from the response when - submitting a malware sample or search with `query_reports`. - String. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falconx-sandbox/DeleteReport + + Keyword arguments + ----------------- + ids : str + ID(s) of report to delete. Find a report ID from the response when + submitting a malware sample or search with `query_reports`. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -597,24 +716,33 @@ def get_sample(self: object, Use the password_protected boolean to specify if you want your zip to be password protected with the value "infected". - Keyword arguments: - ids -- SHA256 of the sample to retrieve. Find a report ID from the response when - submitting a malware sample or search with `query_sample`. - String. - parameters -- Full parameters payload, not required if ids is provided as a keyword. - password_protected -- Flag whether the sample should be zipped and password protected - with a value of "infected". Default value is "false". - stream -- Enable streaming download of the returned file. Boolean. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: binary object on SUCCESS, dict object containing API response on FAILURE. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falconx-sandbox/GetSampleV2 + + Keyword arguments + ----------------- + ids : str + SHA256 of the sample to retrieve. Find a report ID from the response when + submitting a malware sample or search with `query_sample`. + parameters : dict + Full parameters payload, not required if ids is provided as a keyword. + password_protected : bool + Flag whether the sample should be zipped and password protected + with a value of "infected". Default value is "false". + stream : bool + Enable streaming download of the returned file. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + binary object on SUCCESS, dict object containing API response on FAILURE. """ return process_service_request( calling_object=self, @@ -629,21 +757,29 @@ def get_sample(self: object, def delete_sample(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Remove a sample, including file, meta and submissions from the collection. - Keyword arguments: - ids -- SHA256 of the file to delete. Find the SHA256 from the response when - submitting a malware sample or search with `query_sample`. - String. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falconx-sandbox/DeleteSampleV2 + + Keyword arguments + ----------------- + ids : str + SHA256 of the file to delete. Find the SHA256 from the response when + submitting a malware sample or search with `query_sample`. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -659,24 +795,34 @@ def query_sample(self: object, body: dict = None, **kwargs) -> Union[Dict[str, U Maximum number of accepted items is 200. - Keyword arguments: - sha256s -- List of SHA256s to confirm existence for. You will be returned a list of - existing hashes. String or list of strings. - body -- full body payload, not required if sha256 is provided as a keyword. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falconx-sandbox/QuerySampleV1 + + Keyword arguments + ----------------- + sha256s : str or list[str] + List of SHA256s to confirm existence for. You will be returned a list of + existing hashes. + body : dict + full body payload, not required if sha256 is provided as a keyword. { "sha256s": [ "string" ] } - Arguments: When not specified, the first argument to this method is assumed to be 'sha256'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: POST + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'sha256'. + All others are ignored. - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falconx-sandbox/QuerySampleV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, payload_value="sha256s") diff --git a/src/falconpy/fdr.py b/src/falconpy/fdr.py index 8a3016da7..be945a0e8 100644 --- a/src/falconpy/fdr.py +++ b/src/falconpy/fdr.py @@ -61,19 +61,19 @@ def get_event_combined(self: object) -> Union[Dict[str, Union[int, dict]], Resul HTTP Method: GET Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/event%20schema/fdrschema.combined.event.get Keyword arguments - ---- + ----------------- This method does not accept keyword arguments. Arguments - ---- + --------- This method does not accept arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -94,23 +94,23 @@ def get_event_entities(self: object, HTTP Method: GET Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/event%20schema/fdrschema.entities.event.get Keyword arguments - ---- + ----------------- ids : str FDR feed IDs to retrieve. parameters : dict Full parameters payload. Not required if using other keywords. Arguments - ---- + --------- When not specified, the first argument to this method is assumed to be 'ids'. All others are ignored. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -132,11 +132,11 @@ def query_event_entities(self: object, HTTP Method: GET Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/event%20schema/fdrschema.queries.event.get Keyword arguments - ---- + ----------------- filter : str FQL formatted filter to limit returned results. limit : int @@ -153,7 +153,7 @@ def query_event_entities(self: object, This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -176,23 +176,23 @@ def get_field_entities(self: object, HTTP Method: GET Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/field%20schema/fdrschema.entities.field.get Keyword arguments - ---- + ----------------- ids : str FDR feed IDs to retrieve. parameters : dict Full parameters payload. Not required if using other keywords. Arguments - ---- + --------- When not specified, the first argument to this method is assumed to be 'ids'. All others are ignored. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -211,11 +211,11 @@ def query_field_entities(self: object, parameters: dict = None, **kwargs) -> Uni HTTP Method: GET Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/field%20schema/fdrschema.queries.field.get Keyword arguments - ---- + ----------------- filter : str FQL formatted filter to limit returned results. limit : int @@ -232,7 +232,7 @@ def query_field_entities(self: object, parameters: dict = None, **kwargs) -> Uni This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ diff --git a/src/falconpy/federated_connections.py b/src/falconpy/federated_connections.py index 7a7d9faa4..77a946132 100644 --- a/src/falconpy/federated_connections.py +++ b/src/falconpy/federated_connections.py @@ -63,25 +63,34 @@ def post_federated_connections_config(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create configuration for a federated connection. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/federated-connections/PostFederatedConnectionsConfig + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "cluster_url": "string", "connection_id": "string", "view_token": "string" } - cluster_url -- URL of the external cluster. String. - connection_id -- ID of the federated connection. String. - view_token -- token for accessing external cluster. String. + cluster_url : str + URL of the external cluster. + connection_id : str + ID of the federated connection. + view_token : str + token for accessing external cluster. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/federated-connections/PostFederatedConnectionsConfig + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = post_federated_connections_config_payload(passed_keywords=kwargs) @@ -100,18 +109,25 @@ def delete_federated_connections_config(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete configuration for a federated connection. - Keyword arguments: - connection_id -- Connection ID to delete configuration for. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/federated-connections/DeleteFederatedConnectionsConfig + + Keyword arguments + ----------------- + connection_id : str + Connection ID to delete configuration for. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -129,25 +145,35 @@ def patch_federated_connections_config(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update configuration for a federated connection. - Keyword arguments: - connection_id -- Connection ID to update configuration for. String. - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/federated-connections/PatchFederatedConnectionsConfig + + Keyword arguments + ----------------- + connection_id : str + Connection ID to update configuration for. + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "cluster_url": "string", "view_token": "string" } - cluster_url -- URL of the external cluster. String. - view_token -- token for accessing external cluster. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + cluster_url : str + URL of the external cluster. + view_token : str + token for accessing external cluster. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/federated-connections/PatchFederatedConnectionsConfig + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = patch_federated_connections_config_payload(passed_keywords=kwargs) diff --git a/src/falconpy/filevantage.py b/src/falconpy/filevantage.py index 14c790bef..9b8735e9e 100644 --- a/src/falconpy/filevantage.py +++ b/src/falconpy/filevantage.py @@ -70,19 +70,28 @@ class FileVantage(ServiceClass): def get_actions(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve the processing result for one or more actions. - Keyword arguments: - ids -- Action IDs to retrieve. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/getActionsMixin0 + + Keyword arguments + ----------------- + ids : str or list[str] + Action IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -96,28 +105,37 @@ def get_actions(self: object, *args, parameters: dict = None, **kwargs) -> Union def start_actions(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Initiate the specified action on the provided change IDs. - Keyword arguments: - body - full body payload in JSON format, not required if using other keywords. - { - "change_ids": [ - "string" - ], - "comment": "string", - "operation": "string" - } - change_ids -- Represents the IDs of the changes the operation will perform. - String or list of strings. Limited to 100 IDs per action. - comment -- OPtional comment to describe the reason for the action. String. - operation -- Operation to perform. String. Allowed values: suppress, unsuppress, or purge. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/startActions + + Keyword arguments + ----------------- + body : dict + full body payload in JSON format, not required if using other keywords. + { + "change_ids": [ + "string" + ], + "comment": "string", + "operation": "string" + } + change_ids : str or list[str] + Represents the IDs of the changes the operation will perform. + String or list of strings. Limited to 100 IDs per action. + comment : str + OPtional comment to describe the reason for the action. + operation : str + Operation to perform. String. Allowed values: suppress, unsuppress, or purge. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = filevantage_start_payload(passed_keywords=kwargs) @@ -134,20 +152,30 @@ def start_actions(self: object, body: dict = None, **kwargs) -> Union[Dict[str, def get_contents(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve the content captured for the provided change ID. - Keyword arguments: - id -- Change IDs to retrieve. String. - compress -- Compress the response using gzip. Boolean. Defaults to False. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/getChanges + + Keyword arguments + ----------------- + id : str + Change IDs to retrieve. + compress : str + Compress the response using gzip. Boolean. Defaults to False. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ header_payload = json.loads(json.dumps(self.headers)) if kwargs.get("compress", None): @@ -166,19 +194,28 @@ def get_contents(self: object, *args, parameters: dict = None, **kwargs) -> Unio def get_changes(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve information on changes. - Keyword arguments: - ids -- Change IDs to retrieve. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/getChanges + + Keyword arguments + ----------------- + ids : str or list[str] + Change IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -196,21 +233,30 @@ def update_policy_host_groups(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Manage host groups assigned to a policy. - Keyword arguments: - action -- The action to perform on the provided IDs. (String) - Allowed values: assign or unassign. - policy_id -- The ID of the policy to perform the action on. (String) - ids -- One or more host groups IDs. (String or List of strings) - parameters - full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/updatePolicyHostGroups + + Keyword arguments + ----------------- + action : str + The action to perform on the provided IDs. (String) + Allowed values: assign or unassign. + policy_id : str + The ID of the policy to perform the action on. (String) + ids : str or list[str] + One or more host groups IDs. (String or List of strings) + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -231,20 +277,28 @@ def update_policy_precedence(self: object, Requests that do no represent all IDs of the provided policy type will not be processed. - Keyword arguments: - type -- The policy type to set the precedence order for. (String) - Allowed values: Windows, Linux, or Mac - ids -- Procedence of the policies for the provided type. (String or List of strings) - parameters - full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/updatePolicyPrecedence + + Keyword arguments + ----------------- + type : str + The policy type to set the precedence order for. (String) + Allowed values: Windows, Linux, or Mac + ids : str or list[str] + Procedence of the policies for the provided type. (String or List of strings) + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -270,23 +324,32 @@ def update_policy_rule_groups(self: object, When setting rule group precedence, the prcedence for ALL rule group IDs within the policy must be provided. - Keyword arguments: - action -- The action to perform with the provided IDs. (String) - Allowed values: assign, unassign, precedence - policy_id -- The ID of teh policy for which to perform the action. (String) - ids -- One or more rule group IDs. (String or List of strings) - For the precedence action, precedence is controlled by the order of the IDs - in the list provided. - parameters - full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/updatePolicyRuleGroups + + Keyword arguments + ----------------- + action : str + The action to perform with the provided IDs. (String) + Allowed values: assign, unassign, precedence + policy_id : str + The ID of teh policy for which to perform the action. (String) + ids : str or list[str] + One or more rule group IDs. (String or List of strings) + For the precedence action, precedence is controlled by the order of the IDs + in the list provided. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -301,19 +364,28 @@ def update_policy_rule_groups(self: object, def get_policies(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve the configuration for one or more policies. - Keyword arguments: - ids -- List of policy IDs to retrieve. String or list of strings. (Max: 500) - parameters -- full parameters payload, not required if ids keyword is provided. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/getPolicies + + Keyword arguments + ----------------- + ids : str or list[str] + List of policy IDs to retrieve. String or list of strings. (Max: 500) + parameters : dict + full parameters payload, not required if ids keyword is provided. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -329,26 +401,35 @@ def create_policy(self: object, body: dict = None, **kwargs) -> Union[Dict[str, New policies are always added at the end of the precedence list for the provided policy type. - Keyword arguments: - body - full body payload in JSON format, not required if using other keywords. - { - "description": "string", - "name": "string", - "platform": "string", - } - description -- The policy description. (String, 0-500 characters.) - platform -- Policy platform. (String) - Allowed values: Windows, Linux or Mac - name -- Name of the policy. (String, 1-100 characters.) - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/createPolicies + + Keyword arguments + ----------------- + body : dict + full body payload in JSON format, not required if using other keywords. + { + "description": "string", + "name": "string", + "platform": "string", + } + description : str + The policy description. (String, 0-500 characters.) + platform : str + Policy platform. (String) + Allowed values: Windows, Linux or Mac + name : str + Name of the policy. (String, 1-100 characters.) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = filevantage_policy_payload(passed_keywords=kwargs) @@ -365,19 +446,28 @@ def create_policy(self: object, body: dict = None, **kwargs) -> Union[Dict[str, def delete_policies(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete one or more policies. Only disabled policies can be deleted. - Keyword arguments: - ids -- List of policy IDs to delete. String or list of strings. (Max: 500) - parameters -- full parameters payload, not required if other keywords are provided. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/deletePolicies + + Keyword arguments + ----------------- + ids : str or list[str] + List of policy IDs to delete. String or list of strings. (Max: 500) + parameters : dict + full parameters payload, not required if other keywords are provided. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -394,27 +484,37 @@ def update_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str Only name, description, and enabled status of the policy is allowed to be update. Rule and host group assignment is performed via their respective update end points. - Keyword arguments: - body - full body payload in JSON format, not required if using other keywords. - { - "description": "string", - "id": "string", - "name": "string", - "enabled": boolean, - } - description -- The policy description. (String, 0-500 characters.) - id -- ID of the policy to be updated. (String) - name -- Name of the policy. (String, 1-100 characters.) - enabled -- Enablement status of the policy. Boolean. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/updatePolicies + + Keyword arguments + ----------------- + body : dict + full body payload in JSON format, not required if using other keywords. + { + "description": "string", + "id": "string", + "name": "string", + "enabled": boolean, + } + description : str + The policy description. (String, 0-500 characters.) + id : str + ID of the policy to be updated. (String) + name : str + Name of the policy. (String, 1-100 characters.) + enabled : bool + Enablement status of the policy. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = filevantage_policy_payload(passed_keywords=kwargs) @@ -436,19 +536,27 @@ def get_scheduled_exclusions(self: object, Scheduled exclusions within the provided policy that match a provided ID will be returned. - Keyword arguments: - ids -- List of rule IDs to retrieve. String or list of strings. (Max: 500) - parameters -- full parameters payload, not required if ids keyword is provided. - policy_id -- Rule group from which to retrieve the rule configuration. (String) - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/getScheduledExclusions + + Keyword arguments + ----------------- + ids : str or list[str] + List of rule IDs to retrieve. String or list of strings. (Max: 500) + parameters : dict + full parameters payload, not required if ids keyword is provided. + policy_id : str + Rule group from which to retrieve the rule configuration. (String) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -462,56 +570,71 @@ def get_scheduled_exclusions(self: object, def create_scheduled_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: r"""Create a new scheduled exclusion within the provided policy. - Keyword arguments: - body - full body payload in JSON format, not required if using other keywords. - { - "description": "string", - "name": "string", - "policy_id": "string", - "processes": "string", - "repeated": { - "all_day": boolean, - "end_time": "string", - "frequency": "string", - "monthly_days": [ - integer - ], - "occurrence": "string", - "start_time": "string", - "weekly_days": [ - "string" - ] - }, - "schedule_end": "string", - "schedule_start": "string", - "timezone": "string", - "users": "string" - } - description -- The scheduled exclusion description. (String, 0-500 characters.) - name -- Name of the scheduled exclusion. (String, 1-100 characters.) - policy_id -- ID of the policy the scheduled exclusion is assigned. (String) - users -- Comma delimited list of users to NOT monitor changes. (String, 1-500 characters) - `admin*` excludes changes made by all usernames that begin with admin. - Falcon GLOB syntax is supported. - processes -- Comma delimited list of processes to NOT monitor changes. (String, 1-500 characters) - `**\RunMe.exe` or `**/RunMe.sh` excludes changes made by RunMe.exe - or RunMe.sh in any location. - repeated -- Optionally provide to indicate the exclusion is applied repeatedly within the - scheduled_start and scheduled_end time. (Dictionary) - schedule_start -- Indicates the start of the schedule. (String, RFC3339 format, Required) - schedule_end -- Indicates the end of the schedule. (String, RFC3339 format) - timezone -- Must be provided to indicate the TimeZone name set for the provided scheduled_start and - scheduled_end values. (String) - See https://en.wikipedia.org/wiki/List_of_tz_database_time_zones for values. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/createScheduledExclusions + + Keyword arguments + ----------------- + body : dict + full body payload in JSON format, not required if using other keywords. + { + "description": "string", + "name": "string", + "policy_id": "string", + "processes": "string", + "repeated": { + "all_day": boolean, + "end_time": "string", + "frequency": "string", + "monthly_days": [ + integer + ], + "occurrence": "string", + "start_time": "string", + "weekly_days": [ + "string" + ] + }, + "schedule_end": "string", + "schedule_start": "string", + "timezone": "string", + "users": "string" + } + description : str + The scheduled exclusion description. (String, 0-500 characters.) + name : str + Name of the scheduled exclusion. (String, 1-100 characters.) + policy_id : str + ID of the policy the scheduled exclusion is assigned. (String) + users : str + Comma delimited list of users to NOT monitor changes. (String, 1-500 characters) + `admin*` excludes changes made by all usernames that begin with admin. + Falcon GLOB syntax is supported. + processes : str + Comma delimited list of processes to NOT monitor changes. (String, 1-500 characters) + `**\RunMe.exe` or `**/RunMe.sh` excludes changes made by RunMe.exe + or RunMe.sh in any location. + repeated : dict + Optionally provide to indicate the exclusion is applied repeatedly within the + scheduled_start and scheduled_end time. (Dictionary) + schedule_start : str + Indicates the start of the schedule. (String, RFC3339 format, Required) + schedule_end : str + Indicates the end of the schedule. (String, RFC3339 format) + timezone : str + Must be provided to indicate the TimeZone name set for the provided scheduled_start and + scheduled_end values. (String) + See https://en.wikipedia.org/wiki/List_of_tz_database_time_zones for values. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = filevantage_scheduled_exclusion_payload(passed_keywords=kwargs) @@ -533,19 +656,27 @@ def delete_scheduled_exclusions(self: object, Scheduled exclusions that match the provided ID will be deleted form the provided policy. - Keyword arguments: - ids -- List of rule group IDs to delete. String or list of strings. (Max: 500 characters) - parameters -- full parameters payload, not required if other keywords are provided. - policy_id -- The ID of the rule group from which the scheduled exclusions will be deleted. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/deleteScheduledExclusions + + Keyword arguments + ----------------- + ids : str or list[str] + List of rule group IDs to delete. String or list of strings. (Max: 500 characters) + parameters : dict + full parameters payload, not required if other keywords are provided. + policy_id : str + The ID of the rule group from which the scheduled exclusions will be deleted. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -559,39 +690,53 @@ def delete_scheduled_exclusions(self: object, def update_scheduled_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: r"""Update the provided scheduled exclusion configuration within the provided policy. - Keyword arguments: - body - full body payload in JSON format, not required if using other keywords. - { - "description": "string", - "id": "string", - "name": "string", - "policy_id": "string", - "processes": "string", - "schedule_end": "string", - "schedule_start": "string", - "users": "string" - } - description -- The scheduled exclusion description. (String, 0-500 characters.) - id -- ID of the scheduled exclusion to be updated. (String) - name -- Name of the scheduled exclusion. (String, 1-100 characters.) - policy_id -- ID of the policy the scheduled exclusion is assigned. (String) - users -- Comma delimited list of users to NOT monitor changes. (String, 1-500 characters) - `admin*` excludes changes made by all usernames that begin with admin. - Falcon GLOB syntax is supported. - processes - Comma delimited list of processes to NOT monitor changes. (String, 1-500 characters) - `**\RunMe.exe` or `**/RunMe.sh` excludes changes made by RunMe.exe - or RunMe.sh in any location. - schedule_start - Indicates the start of the schedule. (String, RFC3339 format, Required) - schedule_end - Indicates the end of the schedule. (String, RFC3339 format) - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/updateScheduledExclusions + + Keyword arguments + ----------------- + body : dict + full body payload in JSON format, not required if using other keywords. + { + "description": "string", + "id": "string", + "name": "string", + "policy_id": "string", + "processes": "string", + "schedule_end": "string", + "schedule_start": "string", + "users": "string" + } + description : str + The scheduled exclusion description. (String, 0-500 characters.) + id : str + ID of the scheduled exclusion to be updated. (String) + name : str + Name of the scheduled exclusion. (String, 1-100 characters.) + policy_id : str + ID of the policy the scheduled exclusion is assigned. (String) + users : str + Comma delimited list of users to NOT monitor changes. (String, 1-500 characters) + `admin*` excludes changes made by all usernames that begin with admin. + Falcon GLOB syntax is supported. + processes : str + Comma delimited list of processes to NOT monitor changes. (String, 1-500 characters) + `**\RunMe.exe` or `**/RunMe.sh` excludes changes made by RunMe.exe + or RunMe.sh in any location. + schedule_start : str + Indicates the start of the schedule. (String, RFC3339 format, Required) + schedule_end : str + Indicates the end of the schedule. (String, RFC3339 format) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = filevantage_scheduled_exclusion_payload(passed_keywords=kwargs) @@ -615,19 +760,27 @@ def update_rule_group_precedence(self: object, The IDs for ALL rules contained within the rule group msut be specified in the desired precedence order. Requests that do not represent all IDs will not be processed. - Keyword arguments: - ids -- List of rule IDs to retrieve. String or list of strings. (Max: 500) - parameters -- full parameters payload, not required if ids keyword is provided. - rule_group_id -- Rule group from which to retrieve the rule configuration. (String) - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/updateRuleGroupPrecedence + + Keyword arguments + ----------------- + ids : str or list[str] + List of rule IDs to retrieve. String or list of strings. (Max: 500) + parameters : dict + full parameters payload, not required if ids keyword is provided. + rule_group_id : str + Rule group from which to retrieve the rule configuration. (String) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -644,19 +797,27 @@ def get_rules(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str Rules within the provided rule group ID that match a provided ID will be returned. - Keyword arguments: - ids -- List of rule IDs to retrieve. String or list of strings. (Max: 500) - parameters -- full parameters payload, not required if ids keyword is provided. - rule_group_id -- Rule group from which to retrieve the rule configuration. (String) - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/getRules + + Keyword arguments + ----------------- + ids : str or list[str] + List of rule IDs to retrieve. String or list of strings. (Max: 500) + parameters : dict + full parameters payload, not required if ids keyword is provided. + rule_group_id : str + Rule group from which to retrieve the rule configuration. (String) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -670,129 +831,170 @@ def get_rules(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str def create_rule(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: r"""Create a new rule configuration within the specified group. - Keyword arguments: - body - full body payload in JSON format, not required if using other keywords. - { - "created_timestamp": "string", - "depth": "string", - "description": "string", - "exclude": "string", - "exclude_processes": "string", - "exclude_users": "string", - "id": "string", - "include": "string", - "include_processes": "string", - "include_users": "string", - "content_files": "string", - "content_registry_values": "string", - "enable_content_capture": boolean, - "enable_hash_capture": boolean, - "modified_timestamp": "string", - "path": "string", - "precedence": 0, - "rule_group_id": "string", - "severity": "string", - "type": "string", - "watch_attributes_directory_changes": boolean, - "watch_attributes_file_changes": boolean, - "watch_create_directory_changes": boolean, - "watch_create_file_changes": boolean, - "watch_create_key_changes": boolean, - "watch_delete_directory_changes": boolean, - "watch_delete_file_changes": boolean, - "watch_delete_key_changes": boolean, - "watch_delete_value_changes": boolean, - "watch_permissions_directory_changes": boolean, - "watch_permissions_file_changes": boolean, - "watch_rename_directory_changes": boolean, - "watch_rename_file_changes": boolean, - "watch_rename_key_changes": boolean, - "watch_set_value_changes": boolean, - "watch_write_file_changes": boolean - } - description -- The rule description. (String, 0-500 characters.) - rule_group_id -- Group ID containing the group configuration. (String) - path -- the file system or registry path to monitor. (String, 1-250 characters) - All paths must end with the path separator, e.g. c:\windows\ /usr/bin/ - severity -- to categorize change events produced by this rule. (String) - Allowed values: Low, Medium, High or Critical - depth -- recursion levels below the base path to monitor. (String) - Allowed values: 1, 2, 3, 4, 5 or ANY - precedence -- the order in which rules will be evaluated starting with 1. - Specifying a precedence value that is already set for another rule - in the group will result this rule being placed before that existing rule. - include -- the files, directories, registry keys, or registry values that will be monitored. (String). - Falcon GLOB syntax is supported. - Allowed rule group configuration is based on the type of rule - the rule group is added to. - exclude -- the files, directories, registry keys, or registry values that will NOT be monitored. (String). - Falcon GLOB syntax is supported. - Allowed rule group configuration is based on the type of rule - the rule group is added to. - include_users -- the changes performed by specific users that will be monitored. (String). - Falcon GLOB syntax is supported. - macOS is not supported at this time. - Allowed rule group configuration is based on the type of rule - the rule group is added to. - exclude_users -- the changes performed by specific users that will NOT be monitored. (String). - Falcon GLOB syntax is supported. - macOS is not supported at this time. - Allowed rule group configuration is based on the type of rule - the rule group is added to. - include_processes -- the changes performed by specific processes that will be monitored. (String). - Falcon GLOB syntax is supported. - macOS is not supported at this time. - Allowed rule group configuration is based on the type of rule - the rule group is added to. - exclude_users -- the changes performed by specific processes that will be NOT monitored. (String). - Falcon GLOB syntax is supported. - macOS is not supported at this time. - Allowed rule group configuration is based on the type of rule - the rule group is added to. - exclude_processes -- the changes performed by the specific processes that will NOT be monitored. (String). - Falcon GLOB syntax is supported. - macOS is not supported at this time. - Allowed rule group configuration is based on the type of rule - the rule group is added to. - content_files -- the files whose content will be monitored. (String). - Listed files must match the file include pattern - and not match the file exclude pattern. - content_registry_values -- the registry values whose content will be monitored. (String). - Listed registry values must match the registry include pattern - and not match the registry exclude pattern. - enable_content_capture -- Enable content capturing. Boolean. - enable_hash_capture -- Enable hash capturing. Boolean. - watch_delete_directory_changes -- File system directory monitoring. Boolean. - watch_create_directory_changes -- File system directory monitoring. Boolean. - watch_rename_directory_changes -- File system directory monitoring. Boolean. - watch_attributes_directory_changes -- File system directory monitoring. Boolean. - macOS is not supported at this time. - watch_permissions_directory_changes -- File system directory monitoring. Boolean. - macOS is not supported at this time. - watch_rename_file_changes -- File system file monitoring. Boolean. - watch_write_file_changes -- File system file monitoring. Boolean. - watch_create_file_changes -- File system file monitoring. Boolean. - watch_delete_file_changes -- File system file monitoring. Boolean. - watch_attributes_file_changes -- File system file monitoring. Boolean. - macOS is not supported at this time. - watch_permissions_file_changes -- File system file monitoring. Boolean. - macOS is not supported at this time. - watch_create_key_changes -- Windows registry key and value monitoring. Boolean. - watch_delete_key_changes -- Windows registry key and value monitoring. Boolean. - watch_permissions_key_changes -- Windows registry key permissions monitoring. Boolean. - watch_rename_key_changes -- Windows registry key and value monitoring. Boolean. - watch_set_value_changes -- Windows registry key and value monitoring. Boolean. - watch_delete_value_changes -- Windows registry key and value monitoring. Boolean. - watch_create_file_changes -- Windows registry key and value monitoring. Boolean. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/createRules + + Keyword arguments + ----------------- + body : dict + full body payload in JSON format, not required if using other keywords. + { + "created_timestamp": "string", + "depth": "string", + "description": "string", + "exclude": "string", + "exclude_processes": "string", + "exclude_users": "string", + "id": "string", + "include": "string", + "include_processes": "string", + "include_users": "string", + "content_files": "string", + "content_registry_values": "string", + "enable_content_capture": boolean, + "enable_hash_capture": boolean, + "modified_timestamp": "string", + "path": "string", + "precedence": 0, + "rule_group_id": "string", + "severity": "string", + "type": "string", + "watch_attributes_directory_changes": boolean, + "watch_attributes_file_changes": boolean, + "watch_create_directory_changes": boolean, + "watch_create_file_changes": boolean, + "watch_create_key_changes": boolean, + "watch_delete_directory_changes": boolean, + "watch_delete_file_changes": boolean, + "watch_delete_key_changes": boolean, + "watch_delete_value_changes": boolean, + "watch_permissions_directory_changes": boolean, + "watch_permissions_file_changes": boolean, + "watch_rename_directory_changes": boolean, + "watch_rename_file_changes": boolean, + "watch_rename_key_changes": boolean, + "watch_set_value_changes": boolean, + "watch_write_file_changes": boolean + } + description : str + The rule description. (String, 0-500 characters.) + rule_group_id : str + Group ID containing the group configuration. (String) + path : str + the file system or registry path to monitor. (String, 1-250 characters) + All paths must end with the path separator, e.g. c:\windows\ /usr/bin/ + severity : str + to categorize change events produced by this rule. (String) + Allowed values: Low, Medium, High or Critical + depth : str + recursion levels below the base path to monitor. (String) + Allowed values: 1, 2, 3, 4, 5 or ANY + precedence : int + the order in which rules will be evaluated starting with 1. + Specifying a precedence value that is already set for another rule + in the group will result this rule being placed before that existing rule. + include : str + the files, directories, registry keys, or registry values that will be monitored. (String). + Falcon GLOB syntax is supported. + Allowed rule group configuration is based on the type of rule + the rule group is added to. + exclude : str + the files, directories, registry keys, or registry values that will NOT be monitored. (String). + Falcon GLOB syntax is supported. + Allowed rule group configuration is based on the type of rule + the rule group is added to. + include_users : str + the changes performed by specific users that will be monitored. (String). + Falcon GLOB syntax is supported. + macOS is not supported at this time. + Allowed rule group configuration is based on the type of rule + the rule group is added to. + exclude_users : str + the changes performed by specific users that will NOT be monitored. (String). + Falcon GLOB syntax is supported. + macOS is not supported at this time. + Allowed rule group configuration is based on the type of rule + the rule group is added to. + include_processes : str + the changes performed by specific processes that will be monitored. (String). + Falcon GLOB syntax is supported. + macOS is not supported at this time. + Allowed rule group configuration is based on the type of rule + the rule group is added to. + exclude_users : str + the changes performed by specific processes that will be NOT monitored. (String). + Falcon GLOB syntax is supported. + macOS is not supported at this time. + Allowed rule group configuration is based on the type of rule + the rule group is added to. + exclude_processes : str + the changes performed by the specific processes that will NOT be monitored. (String). + Falcon GLOB syntax is supported. + macOS is not supported at this time. + Allowed rule group configuration is based on the type of rule + the rule group is added to. + content_files : str or list[str] + the files whose content will be monitored. (String). + Listed files must match the file include pattern + and not match the file exclude pattern. + content_registry_values : str or list[str] + the registry values whose content will be monitored. (String). + Listed registry values must match the registry include pattern + and not match the registry exclude pattern. + enable_content_capture : bool + Enable content capturing. + enable_hash_capture : bool + Enable hash capturing. + watch_delete_directory_changes : bool + File system directory monitoring. + watch_create_directory_changes : bool + File system directory monitoring. + watch_rename_directory_changes : bool + File system directory monitoring. + watch_attributes_directory_changes : bool + File system directory monitoring. Boolean. + macOS is not supported at this time. + watch_permissions_directory_changes : bool + File system directory monitoring. Boolean. + macOS is not supported at this time. + watch_rename_file_changes : bool + File system file monitoring. + watch_write_file_changes : bool + File system file monitoring. + watch_create_file_changes : bool + File system file monitoring. + watch_delete_file_changes : bool + File system file monitoring. + watch_attributes_file_changes : bool + File system file monitoring. Boolean. + macOS is not supported at this time. + watch_permissions_file_changes : bool + File system file monitoring. Boolean. + macOS is not supported at this time. + watch_create_key_changes : bool + Windows registry key and value monitoring. + watch_delete_key_changes : bool + Windows registry key and value monitoring. + watch_permissions_key_changes : bool + Windows registry key permissions monitoring. + watch_rename_key_changes : bool + Windows registry key and value monitoring. + watch_set_value_changes : bool + Windows registry key and value monitoring. + watch_delete_value_changes : bool + Windows registry key and value monitoring. + watch_create_file_changes : bool + Windows registry key and value monitoring. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = filevantage_rule_payload(passed_keywords=kwargs) @@ -811,19 +1013,27 @@ def delete_rules(self: object, parameters: dict = None, **kwargs) -> Union[Dict[ Rules that match a provided ID will be deleted form the provided rule group ID. - Keyword arguments: - ids -- List of rule group IDs to delete. String or list of strings. - parameters -- full parameters payload, not required if other keywords are provided. - rule_group_id -- The ID of the rule group from which the rules will be deleted. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/deleteRules + + Keyword arguments + ----------------- + ids : str or list[str] + List of rule group IDs to delete. + parameters : dict + full parameters payload, not required if other keywords are provided. + rule_group_id : str + The ID of the rule group from which the rules will be deleted. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -839,129 +1049,170 @@ def update_rule(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Un The rule must exist within the specified rule group. - Keyword arguments: - body - full body payload in JSON format, not required if using other keywords. - { - "created_timestamp": "string", - "depth": "string", - "description": "string", - "exclude": "string", - "exclude_processes": "string", - "exclude_users": "string", - "id": "string", - "include": "string", - "include_processes": "string", - "include_users": "string", - "content_files": "string", - "content_registry_values": "string", - "enable_content_capture": boolean, - "enable_hash_capture": boolean, - "modified_timestamp": "string", - "path": "string", - "precedence": 0, - "rule_group_id": "string", - "severity": "string", - "type": "string", - "watch_attributes_directory_changes": boolean, - "watch_attributes_file_changes": boolean, - "watch_create_directory_changes": boolean, - "watch_create_file_changes": boolean, - "watch_create_key_changes": boolean, - "watch_delete_directory_changes": boolean, - "watch_delete_file_changes": boolean, - "watch_delete_key_changes": boolean, - "watch_delete_value_changes": boolean, - "watch_permissions_directory_changes": boolean, - "watch_permissions_file_changes": boolean, - "watch_rename_directory_changes": boolean, - "watch_rename_file_changes": boolean, - "watch_rename_key_changes": boolean, - "watch_set_value_changes": boolean, - "watch_write_file_changes": boolean - } - description -- The rule description. (String, 0-500 characters.) - id -- ID of the rule to be updated. (String) - rule_group_id -- Group ID containing the group configuration. (String) - path -- the file system or registry path to monitor. (String, 1-250 characters) - All paths must end with the path separator, e.g. c:\windows\ /usr/bin/ - severity -- to categorize change events produced by this rule. (String) - Allowed values: Low, Medium, High or Critical - depth -- recursion levels below the base path to monitor. (String) - Allowed values: 1, 2, 3, 4, 5 or ANY - precedence -- the order in which rules will be evaluated starting with 1. - Specifying a precedence value that is already set for another rule - in the group will result this rule being placed before that existing rule. - include -- the files, directories, registry keys, or registry values that will be monitored. (String). - Falcon GLOB syntax is supported. - Allowed rule group configuration is based on the type of rule - the rule group is added to. - exclude -- the files, directories, registry keys, or registry values that will NOT be monitored. (String). - Falcon GLOB syntax is supported. - Allowed rule group configuration is based on the type of rule - the rule group is added to. - include_users -- the changes performed by specific users that will be monitored. (String). - Falcon GLOB syntax is supported. - macOS is not supported at this time. - Allowed rule group configuration is based on the type of rule - the rule group is added to. - exclude_users -- the changes performed by specific users that will NOT be monitored. (String). - Falcon GLOB syntax is supported. - macOS is not supported at this time. - Allowed rule group configuration is based on the type of rule - the rule group is added to. - include_processes -- the changes performed by specific processes that will be monitored. (String). - Falcon GLOB syntax is supported. - macOS is not supported at this time. - Allowed rule group configuration is based on the type of rule - the rule group is added to. - exclude_users -- the changes performed by specific processes that will be NOT monitored. (String). - Falcon GLOB syntax is supported. - macOS is not supported at this time. - Allowed rule group configuration is based on the type of rule - the rule group is added to. - exclude_processes -- the changes performed by the specific processes that will NOT be monitored. (String). - Falcon GLOB syntax is supported. - macOS is not supported at this time. - Allowed rule group configuration is based on the type of rule - the rule group is added to. - content_files -- the files whose content will be monitored. (String). - Listed files must match the file include pattern - and not match the file exclude pattern. - content_registry_values -- the registry values whose content will be monitored. (String). - Listed registry values must match the registry include pattern - and not match the registry exclude pattern. - enable_content_capture -- Enable content capturing. Boolean. - enable_hash_capture -- Enable hash capturing. Boolean. - watch_delete_directory_changes -- File system directory monitoring. Boolean. - watch_create_directory_changes -- File system directory monitoring. Boolean. - watch_rename_directory_changes -- File system directory monitoring. Boolean. - watch_attributes_directory_changes -- File system directory monitoring. Boolean. - macOS is not supported at this time. - watch_permissions_directory_changes -- File system directory monitoring. Boolean. - macOS is not supported at this time. - watch_rename_file_changes -- File system file monitoring. Boolean. - watch_write_file_changes -- File system file monitoring. Boolean. - watch_create_file_changes -- File system file monitoring. Boolean. - watch_delete_file_changes -- File system file monitoring. Boolean. - watch_attributes_file_changes -- File system file monitoring. Boolean. - macOS is not supported at this time. - watch_permissions_file_changes -- File system file monitoring. Boolean. - macOS is not supported at this time. - watch_create_key_changes -- Windows registry key and value monitoring. Boolean. - watch_delete_key_changes -- Windows registry key and value monitoring. Boolean. - watch_rename_key_changes -- Windows registry key and value monitoring. Boolean. - watch_set_value_changes -- Windows registry key and value monitoring. Boolean. - watch_delete_value_changes -- Windows registry key and value monitoring. Boolean. - watch_create_file_changes -- Windows registry key and value monitoring. Boolean. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/updateRules + + Keyword arguments + ----------------- + body : dict + full body payload in JSON format, not required if using other keywords. + { + "created_timestamp": "string", + "depth": "string", + "description": "string", + "exclude": "string", + "exclude_processes": "string", + "exclude_users": "string", + "id": "string", + "include": "string", + "include_processes": "string", + "include_users": "string", + "content_files": "string", + "content_registry_values": "string", + "enable_content_capture": boolean, + "enable_hash_capture": boolean, + "modified_timestamp": "string", + "path": "string", + "precedence": 0, + "rule_group_id": "string", + "severity": "string", + "type": "string", + "watch_attributes_directory_changes": boolean, + "watch_attributes_file_changes": boolean, + "watch_create_directory_changes": boolean, + "watch_create_file_changes": boolean, + "watch_create_key_changes": boolean, + "watch_delete_directory_changes": boolean, + "watch_delete_file_changes": boolean, + "watch_delete_key_changes": boolean, + "watch_delete_value_changes": boolean, + "watch_permissions_directory_changes": boolean, + "watch_permissions_file_changes": boolean, + "watch_rename_directory_changes": boolean, + "watch_rename_file_changes": boolean, + "watch_rename_key_changes": boolean, + "watch_set_value_changes": boolean, + "watch_write_file_changes": boolean + } + description : str + The rule description. (String, 0-500 characters.) + id : str + ID of the rule to be updated. (String) + rule_group_id : str + Group ID containing the group configuration. (String) + path : str + the file system or registry path to monitor. (String, 1-250 characters) + All paths must end with the path separator, e.g. c:\windows\ /usr/bin/ + severity : str + to categorize change events produced by this rule. (String) + Allowed values: Low, Medium, High or Critical + depth : str + recursion levels below the base path to monitor. (String) + Allowed values: 1, 2, 3, 4, 5 or ANY + precedence : int + the order in which rules will be evaluated starting with 1. + Specifying a precedence value that is already set for another rule + in the group will result this rule being placed before that existing rule. + include : str + the files, directories, registry keys, or registry values that will be monitored. (String). + Falcon GLOB syntax is supported. + Allowed rule group configuration is based on the type of rule + the rule group is added to. + exclude : str + the files, directories, registry keys, or registry values that will NOT be monitored. (String). + Falcon GLOB syntax is supported. + Allowed rule group configuration is based on the type of rule + the rule group is added to. + include_users : str + the changes performed by specific users that will be monitored. (String). + Falcon GLOB syntax is supported. + macOS is not supported at this time. + Allowed rule group configuration is based on the type of rule + the rule group is added to. + exclude_users : str + the changes performed by specific users that will NOT be monitored. (String). + Falcon GLOB syntax is supported. + macOS is not supported at this time. + Allowed rule group configuration is based on the type of rule + the rule group is added to. + include_processes : str + the changes performed by specific processes that will be monitored. (String). + Falcon GLOB syntax is supported. + macOS is not supported at this time. + Allowed rule group configuration is based on the type of rule + the rule group is added to. + exclude_users : str + the changes performed by specific processes that will be NOT monitored. (String). + Falcon GLOB syntax is supported. + macOS is not supported at this time. + Allowed rule group configuration is based on the type of rule + the rule group is added to. + exclude_processes : str + the changes performed by the specific processes that will NOT be monitored. (String). + Falcon GLOB syntax is supported. + macOS is not supported at this time. + Allowed rule group configuration is based on the type of rule + the rule group is added to. + content_files : str or list[str] + the files whose content will be monitored. (String). + Listed files must match the file include pattern + and not match the file exclude pattern. + content_registry_values : str or list[str] + the registry values whose content will be monitored. (String). + Listed registry values must match the registry include pattern + and not match the registry exclude pattern. + enable_content_capture : bool + Enable content capturing. + enable_hash_capture : bool + Enable hash capturing. + watch_delete_directory_changes : bool + File system directory monitoring. + watch_create_directory_changes : bool + File system directory monitoring. + watch_rename_directory_changes : bool + File system directory monitoring. + watch_attributes_directory_changes : bool + File system directory monitoring. Boolean. + macOS is not supported at this time. + watch_permissions_directory_changes : bool + File system directory monitoring. Boolean. + macOS is not supported at this time. + watch_rename_file_changes : bool + File system file monitoring. + watch_write_file_changes : bool + File system file monitoring. + watch_create_file_changes : bool + File system file monitoring. + watch_delete_file_changes : bool + File system file monitoring. + watch_attributes_file_changes : bool + File system file monitoring. Boolean. + macOS is not supported at this time. + watch_permissions_file_changes : bool + File system file monitoring. Boolean. + macOS is not supported at this time. + watch_create_key_changes : bool + Windows registry key and value monitoring. + watch_delete_key_changes : bool + Windows registry key and value monitoring. + watch_rename_key_changes : bool + Windows registry key and value monitoring. + watch_set_value_changes : bool + Windows registry key and value monitoring. + watch_delete_value_changes : bool + Windows registry key and value monitoring. + watch_create_file_changes : bool + Windows registry key and value monitoring. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = filevantage_rule_payload(passed_keywords=kwargs) @@ -980,19 +1231,28 @@ def get_rule_groups(self: object, *args, parameters: dict = None, **kwargs) -> U Full details of each rule group that matches a provided ID will be returned. - Keyword arguments: - ids -- List of rule group IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids keyword is provided. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/getRuleGroups + + Keyword arguments + ----------------- + ids : str or list[str] + List of rule group IDs to retrieve. + parameters : dict + full parameters payload, not required if ids keyword is provided. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1008,26 +1268,35 @@ def create_rule_group(self: object, body: dict = None, **kwargs) -> Union[Dict[s Individual rules can be assigned to a rule group after it has been created. - Keyword arguments: - body - full body payload in JSON format, not required if using other keywords. - { - "description": "string", - "type": "string", - "name": "string" - } - description -- The rule group description. (String, 0-500 characters.) - type -- The type of rule group. (String) - Allowed values: WindowsFiles, WindowsRegistry, LinuxFiles or MacFiles. - name -- Name of the rule group. (String, 1-100 characters.) - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/createRuleGroups + + Keyword arguments + ----------------- + body : dict + full body payload in JSON format, not required if using other keywords. + { + "description": "string", + "type": "string", + "name": "string" + } + description : str + The rule group description. (String, 0-500 characters.) + type : str + The type of rule group. (String) + Allowed values: WindowsFiles, WindowsRegistry, LinuxFiles or MacFiles. + name : str + Name of the rule group. (String, 1-100 characters.) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = filevantage_rule_group_payload(passed_keywords=kwargs) @@ -1048,19 +1317,28 @@ def delete_rule_groups(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a set of rule groups by specifying their IDs. - Keyword arguments: - ids -- List of rule group IDs to delete. String or list of strings. - parameters -- full parameters payload, not required if ids keyword is provided. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/deleteRuleGroups + + Keyword arguments + ----------------- + ids : str or list[str] + List of rule group IDs to delete. + parameters : dict + full parameters payload, not required if ids keyword is provided. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1076,25 +1354,34 @@ def update_rule_group(self: object, body: dict = None, **kwargs) -> Union[Dict[s Provides the ability to update the name and description of a rule group. - Keyword arguments: - body - full body payload in JSON format, not required if using other keywords. - { - "description": "string", - "id": "string", - "name": "string" - } - description -- The rule group description. (String, 0-500 characters.) - id -- ID of the rule group to be updated. (String) - name -- Name of the rule group. (String, 1-100 characters.) - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/updateRuleGroups + + Keyword arguments + ----------------- + body : dict + full body payload in JSON format, not required if using other keywords. + { + "description": "string", + "id": "string", + "name": "string" + } + description : str + The rule group description. (String, 0-500 characters.) + id : str + ID of the rule group to be updated. (String) + name : str + Name of the rule group. (String, 1-100 characters.) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = filevantage_rule_group_payload(passed_keywords=kwargs) @@ -1111,24 +1398,33 @@ def update_rule_group(self: object, body: dict = None, **kwargs) -> Union[Dict[s def signal_changes(self: object, *args, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Initiate a workflow for the provided change IDs. - Keyword arguments: - body - full body payload, not required if ids is provided as a keyword. - { - "ids": [ - "string" - ] - } - ids -- Action IDs to retrieve. String or list of strings. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/signalChangesExternal + + Keyword arguments + ----------------- + body : dict + full body payload, not required if ids is provided as a keyword. + { + "ids": [ + "string" + ] + } + ids : str or list[str] + Action IDs to retrieve. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ parameters = handle_single_argument(args, kwargs, "ids") @@ -1151,24 +1447,33 @@ def signal_changes(self: object, *args, body: dict = None, **kwargs) -> Union[Di def query_actions(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search for actions within your environment. Returns one or more action IDs. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. String. - limit -- The maximum number of records to return. [Integer, 1-500, Default: 100] - offset -- The integer offset to start retrieving records from. Integer. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. status.desc or hostname.asc). String. - Available sort fields - action_timestamp ingestion_timestamp - - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/queryActionsMixin0 + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int (1-500, Default: 100) + The maximum number of records to return. + offset : int + The integer offset to start retrieving records from. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. status.desc or hostname.asc). String. + Available sort fields + action_timestamp ingestion_timestamp + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1182,27 +1487,36 @@ def query_actions(self: object, parameters: dict = None, **kwargs) -> Union[Dict def query_changes(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search for changes within your environment. Returns one or more change IDs. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - Available filters - action_timestamp ingestion_timestamp - host.name - limit -- The maximum number of records to return. [Integer, 1-500, Default: 100] - offset -- The integer offset to start retrieving records from. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. status.desc or hostname.asc). - Available sort fields - action_timestamp ingestion_timestamp - - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/queryChanges + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Available filters + action_timestamp ingestion_timestamp + host.name + limit : int (1-500, Default: 100) + The maximum number of records to return. + offset : int + The integer offset to start retrieving records from. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. status.desc or hostname.asc). + Available sort fields + action_timestamp ingestion_timestamp + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1219,31 +1533,40 @@ def query_changes_scroll(self: object, parameters: dict = None, **kwargs) -> Uni Returns a list of Falcon FileVantage change IDs filtered, sorted and limited by the query parameters provided. An unlimited number of results can be retrieved using multiple requests. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - Available filters - action_timestamp ingestion_timestamp - host.name - limit -- The maximum number of records to return. [Integer, 1-5000, Default: 100] - after -- A pagination token used with the `limit` parameter to manage pagination of results. - On your first request don't provide a value for the `after` token. On subsequent - requests provide the `after` token value from the previous response to continue - pagination from where you left. If the response returns an empty `after` token - it means there are no more results to return. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. status.desc or hostname.asc). - Available sort fields - action_timestamp ingestion_timestamp - - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/highVolumeQueryChanges + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Available filters + action_timestamp ingestion_timestamp + host.name + limit : int (1-5000, Default: 100) + The maximum number of records to return. + after : str + A pagination token used with the `limit` parameter to manage pagination of results. + On your first request don't provide a value for the `after` token. On subsequent + requests provide the `after` token value from the previous response to continue + pagination from where you left. If the response returns an empty `after` token + it means there are no more results to return. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. status.desc or hostname.asc). + Available sort fields + action_timestamp ingestion_timestamp + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1260,26 +1583,36 @@ def query_policies(self: object, parameters: dict = None, **kwargs) -> Union[Dic Rule group ids will be returned sorted by created_timestamp order if a sort parameter is not provided. - Keyword arguments: - limit -- The maximum number of ids to return. Defaults to 100 if not specified. - (Integer, 1-500) - offset -- The first item to return, where 0 is the latest item. (Integer) - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. (String) - Supported options: precedence, created_timestamp or modified_timestamp. - (e.g. created_timestamp|asc, modified_timestamp|desc, etc.) - type -- The type of policies to retrieve. (String) - Allowed values: Windows, Linux, or Mac. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/queryPolicies + + Keyword arguments + ----------------- + limit : int + The maximum number of ids to return. Defaults to 100 if not specified. + (Integer, 1-500) + offset : int + The first item to return, where 0 is the latest item. (Integer) + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. (String) + Supported options: precedence, created_timestamp or modified_timestamp. + (e.g. created_timestamp|asc, modified_timestamp|desc, etc.) + type : str + The type of policies to retrieve. (String) + Allowed values: Windows, Linux, or Mac. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1299,18 +1632,26 @@ def query_scheduled_exclusions(self: object, Use the IDs from this response to fetch the rules with get_rules. - Keyword arguments: - policy_id -- The ID of the policy to retrieve the scheduled exclusion IDs for. (String) - - Arguments: When not specified, the first argument to this method is assumed to be - 'policy_ids'. All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/queryScheduledExclusions + + Keyword arguments + ----------------- + policy_id : str + The ID of the policy to retrieve the scheduled exclusion IDs for. (String) + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'policy_ids'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1327,26 +1668,36 @@ def query_rule_groups(self: object, parameters: dict = None, **kwargs) -> Union[ Rule group ids will be returned sorted by created_timestamp order if a sort parameter is not provided. - Keyword arguments: - limit -- The maximum number of ids to return. Defaults to 100 if not specified. - (Integer, 1-500) - offset -- The first item to return, where 0 is the latest item. (Integer) - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. (String) - Supported options: created_timestamp or modified_timestamp. - (e.g. created_timestamp|asc, modified_timestamp|desc, etc.) - type -- The rule group type to retrieve the IDs for. (String) - Allowed values: WindowsFiles, WindowsRegistry, LinuxFiles, or MacFiles. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/queryRuleGroups + + Keyword arguments + ----------------- + limit : int + The maximum number of ids to return. Defaults to 100 if not specified. + (Integer, 1-500) + offset : int + The first item to return, where 0 is the latest item. (Integer) + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. (String) + Supported options: created_timestamp or modified_timestamp. + (e.g. created_timestamp|asc, modified_timestamp|desc, etc.) + type : str + The rule group type to retrieve the IDs for. (String) + Allowed values: WindowsFiles, WindowsRegistry, LinuxFiles, or MacFiles. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/firewall_management.py b/src/falconpy/firewall_management.py index a393a0a8f..245a1e638 100644 --- a/src/falconpy/firewall_management.py +++ b/src/falconpy/firewall_management.py @@ -70,8 +70,16 @@ class FirewallManagement(ServiceClass): def aggregate_events(self: object, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Aggregate events for customer. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/aggregate_events + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -106,40 +114,46 @@ def aggregate_events(self: object, body: list = None, **kwargs) -> Union[Dict[st "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str + String. + This method does not support body payload validation. This method only supports keywords for providing arguments. - This method does not support body payload validation. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/aggregate_events + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -155,8 +169,16 @@ def aggregate_events(self: object, body: list = None, **kwargs) -> Union[Dict[st def aggregate_policy_rules(self: object, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Aggregate rules within a policy for customer. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/aggregate_policy_rules + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -191,40 +213,46 @@ def aggregate_policy_rules(self: object, body: list = None, **kwargs) -> Union[D "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str + String. + This method does not support body payload validation. This method only supports keywords for providing arguments. - This method does not support body payload validation. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/aggregate_policy_rules + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -240,8 +268,16 @@ def aggregate_policy_rules(self: object, body: list = None, **kwargs) -> Union[D def aggregate_rule_groups(self: object, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Aggregate rule groups for customer. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/aggregate_rule_groups + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -276,40 +312,46 @@ def aggregate_rule_groups(self: object, body: list = None, **kwargs) -> Union[Di "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str + String. + This method does not support body payload validation. This method only supports keywords for providing arguments. - This method does not support body payload validation. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/aggregate_rule_groups + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -325,8 +367,16 @@ def aggregate_rule_groups(self: object, body: list = None, **kwargs) -> Union[Di def aggregate_rules(self: object, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Aggregate rules for customer. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/aggregate_rules + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -361,40 +411,46 @@ def aggregate_rules(self: object, body: list = None, **kwargs) -> Union[Dict[str "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str + String. + This method does not support body payload validation. This method only supports keywords for providing arguments. - This method does not support body payload validation. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/aggregate_rules + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -410,19 +466,28 @@ def aggregate_rules(self: object, body: list = None, **kwargs) -> Union[Dict[str def get_events(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get events entities by ID and optionally version. - Keyword arguments: - ids -- The IDs of the events to retrieve. String or list of strings. - parameters - full parameters payload, not required if `ids` keyword is provided. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/get_events + + Keyword arguments + ----------------- + ids : str or list[str] + The IDs of the events to retrieve. + parameters : dict + full parameters payload, not required if `ids` keyword is provided. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -440,19 +505,28 @@ def get_firewall_fields(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get the firewall field specifications by ID. - Keyword arguments: - ids -- The IDs of the rule types to retrieve. String or list of strings. - parameters - full parameters payload, not required if `ids` keyword is provided. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/get_firewall_fields + + Keyword arguments + ----------------- + ids : str or list[str] + The IDs of the rule types to retrieve. + parameters : dict + full parameters payload, not required if `ids` keyword is provided. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -466,19 +540,28 @@ def get_firewall_fields(self: object, def get_network_locations_details(self: object, *args, parameters: dict = None, **kwargs) -> dict: """Get network location entities by ID. - Keyword arguments: - ids -- The IDs of the event(s) to retrieve. String or list of strings. - parameters - full parameters payload, not required if `ids` keyword is provided. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/get_rule_groups + + Keyword arguments + ----------------- + ids : str or list[str] + The IDs of the event(s) to retrieve. + parameters : dict + full parameters payload, not required if `ids` keyword is provided. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -496,8 +579,16 @@ def update_network_locations_metadata(self: object, ) -> dict: """Update the network locations metadata such as polling intervals for the cid. - Keyword arguments: - body -- Full body payload in JSON format. Not required if other keywords are provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/update-network-locations-metadata + + Keyword arguments + ----------------- + body : dict + Full body payload in JSON format. Not required if other keywords are provided. { "cid": "string", "dns_resolution_targets_polling_interval": 0, @@ -507,21 +598,22 @@ def update_network_locations_metadata(self: object, "string" ] } - cid -- CID for the location. String. - comment -- Audit log comment for the action performed. String. - dns_resolution_targets_polling_interval -- Integer. - https_reachable_hsots_polling_interval -- Integer. - icmp_request_targets_polling_interval -- Integer - location_precedencee -- Reorder precedence of network locations. List of strings. + cid : str + CID for the location. + comment : str + Audit log comment for the action performed. + dns_resolution_targets_polling_interval : int + https_reachable_hsots_polling_interval : int + icmp_request_targets_polling_interval : int + location_precedencee : list[str] + Reorder precedence of network locations. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/update-network-locations-metadata + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = network_locations_metadata_payload(passed_keywords=kwargs) @@ -542,26 +634,35 @@ def update_network_locations_precedence(self: object, ) -> dict: """Update the network locations precedence according to the list of IDs provided. - Keyword arguments: - body -- Full body payload in JSON format. Not required if other keywords are provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/update-network-locations-precedence + + Keyword arguments + ----------------- + body : dict + Full body payload in JSON format. Not required if other keywords are provided. { "cid": "string", "location_precedence": [ "string" ] } - cid -- CID for the location. String. - comment -- Audit log comment for the action performed. String. - location_precedencee -- Reorder precedence of network locations. List of strings. + cid : str + CID for the location. + comment : str + Audit log comment for the action performed. + location_precedencee : list[str] + Reorder precedence of network locations. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/update-network-locations-precedence + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = network_locations_metadata_payload(passed_keywords=kwargs) @@ -578,19 +679,28 @@ def update_network_locations_precedence(self: object, def get_network_locations(self: object, *args, parameters: dict = None, **kwargs) -> dict: """Get network location entities by ID. - Keyword arguments: - ids -- The IDs of the location(s) to retrieve. String or list of strings. - parameters - full parameters payload, not required if `ids` keyword is provided. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/get-network-locations + + Keyword arguments + ----------------- + ids : str or list[str] + The IDs of the location(s) to retrieve. + parameters : dict + full parameters payload, not required if `ids` keyword is provided. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -604,10 +714,19 @@ def get_network_locations(self: object, *args, parameters: dict = None, **kwargs def create_network_locations(self: object, body: dict = None, parameters: dict = None, **kwargs) -> dict: """Create new network locations provided and return the ID. - Keyword arguments: - add_fw_rules -- Flag to indicate if the cloned locatoin needs to be added to the same - firewall rules that encompass the original location. - body -- Full body payload in JSON format. Not required if other keywords are provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/create-network-locations + + Keyword arguments + ----------------- + add_fw_rules : bool + Flag to indicate if the cloned locatoin needs to be added to the same + firewall rules that encompass the original location. + body : dict + Full body payload in JSON format. Not required if other keywords are provided. { "connection_types": { "wired": true, @@ -655,30 +774,42 @@ def create_network_locations(self: object, body: dict = None, parameters: dict = }, "name": "string" } - clone_id -- A network location ID from which to copy rules. If this is provided then all - other keywords except `add_fw_rules` and `comment` are ignored. String. - comment -- Audit log comment for this action. String. - connection_types -- Connections available at the location. Dictionary. - default_gateways -- List of available default gateways. List of strings. - description -- Description of the location. String. - dhcp_servers -- List of available DHCP servers. List of strings. - dns_resolution_targets -- Dictionary containing a list of DNS resolution targets. - dns_servers -- List of available DNS servers. List of strings. - enabled -- Flag indicating if this location is enabled. Boolean. - host_addresses -- List of available host addresses. List of strings. - https_reachable_hosts -- Dictionary of hosts reachable via HTTPS at this location. - icmp_request_targets -- Dictionary of targets for ICMP monitoring requests. - name -- Name for this rule. String. - parameters - full parameters payload, not required if using other keywords. + clone_id : str + A network location ID from which to copy rules. If this is provided then all + other keywords except `add_fw_rules` and `comment` are ignored. + comment : str + Audit log comment for this action. + connection_types : dict + Connections available at the location. + default_gateways : str or list[str] + List of available default gateways. + description : str + Description of the location. + dhcp_servers : str or list[str] + List of available DHCP servers. + dns_resolution_targets : dict + Dictionary containing a list of DNS resolution targets. + dns_servers : str or list[str] + List of available DNS servers. + enabled : bool + Flag indicating if this location is enabled. + host_addresses : str or list[str] + List of available host addresses. + https_reachable_hosts : dict + Dictionary of hosts reachable via HTTPS at this location. + icmp_request_targets : dict + Dictionary of targets for ICMP monitoring requests. + name : str + Name for this rule. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/create-network-locations + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = network_locations_create_payload(passed_keywords=kwargs) @@ -696,8 +827,16 @@ def create_network_locations(self: object, body: dict = None, parameters: dict = def upsert_network_locations(self: object, body: dict = None, **kwargs) -> dict: """Update the network locations provided and return the ID. - Keyword arguments: - body -- Full body payload in JSON format. Not required if other keywords are provided. + HTTP Method: PUT + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/upsert-network-locations + + Keyword arguments + ----------------- + body : dict + Full body payload in JSON format. Not required if other keywords are provided. { "connection_types": { "wired": true, @@ -750,33 +889,48 @@ def upsert_network_locations(self: object, body: dict = None, **kwargs) -> dict: "modified_by": "string", "modified_on": "string" } - comment -- Audit log comment for this action. String. - connection_types -- Connections available at the location. Dictionary. - created_on -- Timestamp string. - created_by -- String. - default_gateways -- List of available default gateways. List of strings. - description -- Description of the location. String. - dhcp_servers -- List of available DHCP servers. List of strings. - dns_resolution_targets -- Dictionary containing a list of DNS resolution targets. - dns_servers -- List of available DNS servers. List of strings. - enabled -- Flag indicating if this location is enabled. Boolean. - host_addresses -- List of available host addresses. List of strings. - https_reachable_hosts -- Dictionary of hosts reachable via HTTPS at this location. - icmp_request_targets -- Dictionary of targets for ICMP monitoring requests. - id -- Network location ID to be updated. String. - modified_by -- User UUID that modified this location. String. - modified_on -- UTC formatted date string of the update. - name -- Name for this rule. String. - parameters - full parameters payload, not required if using other keywords. + comment : str + Audit log comment for this action. + connection_types : dict + Connections available at the location. + created_on : str + Timestamp. + created_by : str + default_gateways : str or list[str] + List of available default gateways. + description : str + Description of the location. + dhcp_servers : str or list[str] + List of available DHCP servers. + dns_resolution_targets : dict + Dictionary containing a list of DNS resolution targets. + dns_servers : str or list[str] + List of available DNS servers. + enabled : bool + Flag indicating if this location is enabled. + host_addresses : str or list[str] + List of available host addresses. + https_reachable_hosts : dict + Dictionary of hosts reachable via HTTPS at this location. + icmp_request_targets : dict + Dictionary of targets for ICMP monitoring requests. + id : str + Network location ID to be updated. + modified_by : str + User UUID that modified this location. + modified_on : str + UTC formatted date string of the update. + name : str + Name for this rule. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PUT - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/upsert-network-locations + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = network_locations_create_payload(passed_keywords=kwargs) @@ -793,8 +947,16 @@ def upsert_network_locations(self: object, body: dict = None, **kwargs) -> dict: def update_network_locations(self: object, body: dict = None, parameters: dict = None, **kwargs) -> dict: """Create new network locations provided and return the ID. - Keyword arguments: - body -- Full body payload in JSON format. Not required if other keywords are provided. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/update-network-locations + + Keyword arguments + ----------------- + body : dict + Full body payload in JSON format. Not required if other keywords are provided. { "connection_types": { "wired": true, @@ -847,33 +1009,48 @@ def update_network_locations(self: object, body: dict = None, parameters: dict = "modified_by": "string", "modified_on": "string" } - comment -- Audit log comment for this action. String. - connection_types -- Connections available at the location. Dictionary. - created_on -- Timestamp string. - created_by -- String. - default_gateways -- List of available default gateways. List of strings. - description -- Description of the location. String. - dhcp_servers -- List of available DHCP servers. List of strings. - dns_resolution_targets -- Dictionary containing a list of DNS resolution targets. - dns_servers -- List of available DNS servers. List of strings. - enabled -- Flag indicating if this location is enabled. Boolean. - host_addresses -- List of available host addresses. List of strings. - https_reachable_hosts -- Dictionary of hosts reachable via HTTPS at this location. - icmp_request_targets -- Dictionary of targets for ICMP monitoring requests. - id -- Network location ID to be updated. String. - modified_by -- User UUID that modified this location. String. - modified_on -- UTC formatted date string of the update. - name -- Name for this rule. String. - parameters - full parameters payload, not required if using other keywords. + comment : str + Audit log comment for this action. + connection_types : dict + Connections available at the location. + created_on : str + Timestamp. + created_by : str + default_gateways : str or list[str] + List of available default gateways. + description : str + Description of the location. + dhcp_servers : str or list[str] + List of available DHCP servers. + dns_resolution_targets : dict + Dictionary containing a list of DNS resolution targets. + dns_servers : str or list[str] + List of available DNS servers. + enabled : bool + Flag indicating if this location is enabled. + host_addresses : str or list[str] + List of available host addresses. + https_reachable_hosts : dict + Dictionary of hosts reachable via HTTPS at this location. + icmp_request_targets : dict + Dictionary of targets for ICMP monitoring requests. + id : str + Network location ID to be updated. + modified_by : str + User UUID that modified this location. + modified_on : str + UTC formatted date string of the update. + name : str + Name for this rule. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/update-network-locations + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = network_locations_create_payload(passed_keywords=kwargs) @@ -895,19 +1072,28 @@ def delete_network_locations(self: object, ) -> dict: """Delete network location entities by ID. - Keyword arguments: - ids -- The IDs of the network location(s) to delete. String or list of strings. - parameters - full parameters payload, not required if `ids` keyword is provided. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/delete-network-locations + + Keyword arguments + ----------------- + ids : str or list[str] + The IDs of the network location(s) to delete. + parameters : dict + full parameters payload, not required if `ids` keyword is provided. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -921,19 +1107,28 @@ def delete_network_locations(self: object, def get_platforms(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get platforms by ID, e.g., windows or mac or droid. - Keyword arguments: - ids -- The IDs of the platforms to retrieve. String or list of strings. - parameters - full parameters payload, not required if `ids` keyword is provided. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/get_platforms + + Keyword arguments + ----------------- + ids : str or list[str] + The IDs of the platforms to retrieve. + parameters : dict + full parameters payload, not required if `ids` keyword is provided. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -951,19 +1146,28 @@ def get_policy_containers(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get policy container entities by policy ID. - Keyword arguments: - ids -- The IDs of the policy container(s) to retrieve. String or list of strings. - parameters - full parameters payload, not required if `ids` keyword is provided. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/get_policy_containers + + Keyword arguments + ----------------- + ids : str or list[str] + The IDs of the policy container(s) to retrieve. + parameters : dict + full parameters payload, not required if `ids` keyword is provided. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -983,8 +1187,16 @@ def update_policy_container_v1(self: object, **DEPRECATED** - Keyword arguments: - body -- Full body payload in JSON format. Not required if other keywords are provided. + HTTP Method: PUT + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/update-policy-container-v1 + + Keyword arguments + ----------------- + body : dict + Full body payload in JSON format. Not required if other keywords are provided. { "default_inbound": "string", "default_outbound": "string", @@ -999,25 +1211,33 @@ def update_policy_container_v1(self: object, "test_mode": true, "tracking": "string" } - default_inbound -- Default inbound. String. - default_outbound -- Default outbound. String. - enforce -- Flag indicating if the policy is enforced. Boolean. - is_default_policy -- Flag indicating if the policy is the default. Boolean. - local_logging -- Flag indicating if local logging should be enabled. Boolean. - platform_id -- Platform ID. (`windows`, `mac`, `linux`) String. - policy_id -- ID of the policy to be updated. String. - rule_group_ids -- Rule group IDs this policy applies to. String or list of strings. - test_mode -- Flag indicating if this policy is in test mode. Boolean. - tracking -- Tracking. String. + default_inbound : str + Default inbound. + default_outbound : str + Default outbound. + enforce : bool + Flag indicating if the policy is enforced. + is_default_policy : bool + Flag indicating if the policy is the default. + local_logging : bool + Flag indicating if local logging should be enabled. + platform_id : str + Platform ID. (`windows`, `mac`, `linux`) + policy_id : str + ID of the policy to be updated. + rule_group_ids : str or list[str] + Rule group IDs this policy applies to. + test_mode : bool + Flag indicating if this policy is in test mode. + tracking : str + Tracking. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PUT - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/update-policy-container-v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = firewall_container_payload(passed_keywords=kwargs) @@ -1037,8 +1257,16 @@ def update_policy_container(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update an identified policy container. - Keyword arguments: - body -- Full body payload in JSON format. Not required if other keywords are provided. + HTTP Method: PUT + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/update-policy-container + + Keyword arguments + ----------------- + body : dict + Full body payload in JSON format. Not required if other keywords are provided. { "default_inbound": "string", "default_outbound": "string", @@ -1053,25 +1281,33 @@ def update_policy_container(self: object, "test_mode": boolean, "tracking": "string" } - default_inbound -- Default inbound. String. - default_outbound -- Default outbound. String. - enforce -- Flag indicating if the policy is enforced. Boolean. - is_default_policy -- Flag indicating if the policy is the default. Boolean. - local_logging -- Flag indicating if local logging functionality is enabled. Boolean. - platform_id -- Platform ID. (`windows`, `mac`, `linux`) String. - policy_id -- ID of the policy to be updated. String. - rule_group_ids -- Rule group IDs this policy applies to. String or list of strings. - test_mode -- Flag indicating if this policy is in test mode. Boolean. - tracking -- Tracking. String. + default_inbound : str + Default inbound. + default_outbound : str + Default outbound. + enforce : bool + Flag indicating if the policy is enforced. + is_default_policy : bool + Flag indicating if the policy is the default. + local_logging : bool + Flag indicating if local logging functionality is enabled. + platform_id : str + Platform ID. (`windows`, `mac`, `linux`) + policy_id : str + ID of the policy to be updated. + rule_group_ids : str or list[str] + Rule group IDs this policy applies to. + test_mode : bool + Flag indicating if this policy is in test mode. + tracking : str + Tracking. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PUT - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/update-policy-container + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = firewall_container_payload(passed_keywords=kwargs) @@ -1089,19 +1325,28 @@ def get_rule_groups(self: object, *args, parameters: dict = None, **kwargs) -> U These groups do not contain their rule entites, just the rule IDs in precedence order. - Keyword arguments: - ids -- The IDs of the rule group(s) to retrieve. String or list of strings. - parameters - full parameters payload, not required if `ids` keyword is provided. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/get_rule_groups + + Keyword arguments + ----------------- + ids : str or list[str] + The IDs of the rule group(s) to retrieve. + parameters : dict + full parameters payload, not required if `ids` keyword is provided. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1122,11 +1367,21 @@ def create_rule_group(self: object, Returns the ID. - Keyword arguments: - action -- Rule action to perform. String. Overridden if 'rules' keyword is provided. - address_family -- Address type, String. Either 'IP4', 'IP6' or 'NONE'. - Overridden if 'rules' keyword is provided. - body -- Full body payload in JSON format. Not required if other keywords are provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/create-rule-group + + Keyword arguments + ----------------- + action : str + Rule action to perform. String. Overridden if 'rules' keyword is provided. + address_family : str + Address type, String. Either 'IP4', 'IP6' or 'NONE'. + Overridden if 'rules' keyword is provided. + body : dict + Full body payload in JSON format. Not required if other keywords are provided. { "description": "string", "enabled": true, @@ -1190,105 +1445,126 @@ def create_rule_group(self: object, } ] } - clone_id -- A rule group ID from which to copy rules. - If this is provided the `rules` keyword is ignored. - comment -- Audit log comment for this action. String. - description -- Rule group description. String. - direction -- Traffic direction for created rule. String. Either 'IN', 'OUT' or 'BOTH'. - Overridden if 'rules' keyword is provided. - enabled -- Flag indicating if the rule group is enabled. Boolean. - fields -- Fields to impact. Dictionary or list of dictionaries. - Overridden if 'rules' keyword is provided. - icmp -- ICMP protocol options. Dictionary. Overridden if 'rules' keyword is provided. - library -- If this flag is set to true then the rules will be cloned from the - clone_id from the CrowdStrike Firewall Rule Groups Library. String. - local_address -- Local address and netmask detail. Dictionary or list of dictionaries. - Overridden if 'rules' keyword is provided. - local_port -- Local port range. Dictionary or list of dictionaries. - Overridden if 'rules' keyword is provided. - log -- Log rule matches. Boolean. Overridden if 'rules' keyword is provided. - name -- Rule group name. String. - monitor -- Monitor count / period. Dictionary. Overridden if 'rules' keyword is provided. - parameters - full parameters payload, not required if using other keywords. - platform -- OS platform covered by rule. String. - protocol -- Integer protocol specified. Integer. Overridden if 'rules' keyword is provided. - (TCP = 6, UDP = 17) - remote_address -- Remote address and netmask detail. Dictionary or list of dictionaries. - Overridden if 'rules' keyword is provided. - remote_port -- Remote port range. Dictionary or list of dictionaries. - Overridden if 'rules' keyword is provided. - rule_description -- Description for created rule. String. - Overridden if 'rules' keyword is provided. - rule_enabled -- Enablement status for new rule. Boolean. - Overridden if 'rules' keyword is provided. - rule_name -- Name for the new rule. String. Overridden if 'rules' keyword is provided. - rules - Rule(s) in JSON format. Single dictionary or List of dictionaries. - { - "action": "string", - "address_family": "string", - "description": "string", - "direction": "string", - "enabled": true, - "fields": [ - { - "final_value": "string", - "label": "string", - "name": "string", - "type": "string", - "value": "string", - "values": [ - "string" - ] - } - ], - "icmp": { - "icmp_code": "string", - "icmp_type": "string" - }, - "local_address": [ - { - "address": "string", - "netmask": 0 - } - ], - "local_port": [ - { - "end": 0, - "start": 0 - } - ], - "log": true, - "monitor": { - "count": "string", - "period_ms": "string" - }, - "name": "string", - "protocol": "string", - "remote_address": [ - { - "address": "string", - "netmask": 0 - } - ], - "remote_port": [ - { - "end": 0, - "start": 0 - } - ], - "temp_id": "string" - } - temp_id -- String to use for rule temporary ID. String. - Overridden if 'rules' keyword is provided. + clone_id : str + A rule group ID from which to copy rules. + If this is provided the `rules` keyword is ignored. + comment : str + Audit log comment for this action. + description : str + Rule group description. + direction : str + Traffic direction for created rule. String. Either 'IN', 'OUT' or 'BOTH'. + Overridden if 'rules' keyword is provided. + enabled : bool + Flag indicating if the rule group is enabled. + fields : str + Fields to impact. Dictionary or list of dictionaries. + Overridden if 'rules' keyword is provided. + icmp : str + ICMP protocol options. Dictionary. Overridden if 'rules' keyword is provided. + library : str + If this flag is set to true then the rules will be cloned from the + clone_id from the CrowdStrike Firewall Rule Groups Library. + local_address : str + Local address and netmask detail. Dictionary or list of dictionaries. + Overridden if 'rules' keyword is provided. + local_port : str + Local port range. Dictionary or list of dictionaries. + Overridden if 'rules' keyword is provided. + log : str + Log rule matches. Boolean. Overridden if 'rules' keyword is provided. + name : str + Rule group name. + monitor : str + Monitor count / period. Dictionary. Overridden if 'rules' keyword is provided. + parameters : dict + Full parameters payload. Not required if using other keywords. + platform : str + OS platform covered by rule. + protocol : str + Integer protocol specified. Integer. Overridden if 'rules' keyword is provided. + (TCP = 6, UDP = 17) + remote_address : str + Remote address and netmask detail. Dictionary or list of dictionaries. + Overridden if 'rules' keyword is provided. + remote_port : str + Remote port range. Dictionary or list of dictionaries. + Overridden if 'rules' keyword is provided. + rule_description : str + Description for created rule. String. + Overridden if 'rules' keyword is provided. + rule_enabled : str + Enablement status for new rule. Boolean. + Overridden if 'rules' keyword is provided. + rule_name : str + Name for the new rule. String. Overridden if 'rules' keyword is provided. + rules : list + Rule(s) in JSON format. Single dictionary or List of dictionaries. + { + "action": "string", + "address_family": "string", + "description": "string", + "direction": "string", + "enabled": true, + "fields": [ + { + "final_value": "string", + "label": "string", + "name": "string", + "type": "string", + "value": "string", + "values": [ + "string" + ] + } + ], + "icmp": { + "icmp_code": "string", + "icmp_type": "string" + }, + "local_address": [ + { + "address": "string", + "netmask": 0 + } + ], + "local_port": [ + { + "end": 0, + "start": 0 + } + ], + "log": true, + "monitor": { + "count": "string", + "period_ms": "string" + }, + "name": "string", + "protocol": "string", + "remote_address": [ + { + "address": "string", + "netmask": 0 + } + ], + "remote_port": [ + { + "end": 0, + "start": 0 + } + ], + "temp_id": "string" + } + temp_id : str + String to use for rule temporary ID. String. + Overridden if 'rules' keyword is provided. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/create-rule-group + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = firewall_rule_group_payload(passed_keywords=kwargs) @@ -1311,19 +1587,28 @@ def delete_rule_groups(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete rule group entities by ID. - Keyword arguments: - ids -- The IDs of the rule group(s) to delete. String or list of strings. - parameters - full parameters payload, not required if `ids` keyword is provided. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/delete-rule-groups + + Keyword arguments + ----------------- + ids : str or list[str] + The IDs of the rule group(s) to delete. + parameters : dict + full parameters payload, not required if `ids` keyword is provided. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1344,8 +1629,16 @@ def update_rule_group(self: object, Can also create, edit, delete, or reorder rules. - Keyword arguments: - body -- Full body payload in JSON format. Not required if other keywords are provided. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/update-rule-group + + Keyword arguments + ----------------- + body : dict + Full body payload in JSON format. Not required if other keywords are provided. { "diff_operations": [ { @@ -1364,27 +1657,36 @@ def update_rule_group(self: object, ], "tracking": "string" } - comment -- Audit log comment for this action. String. - diff_from -- From value for diff. String. Overridden if 'diff_operations' is provided. - diff_op -- Operation for diff. String. Overridden if 'diff_operations' is provided. - diff_operations -- Diff operations to perform against the rule group. - Single dictionary or List of dictionaries. - diff_path -- Path for diff. String. Overridden if 'diff_operations' is provided. - diff_type -- Type of diff to apply. String. - id -- ID of the rule group to update. String. - parameters - full parameters payload, not required if using other keywords. - rule_ids -- Rule ID(s). List of strings. - rule_versions -- Rule version(s). List of integers. - tracking -- Tracking. String. + comment : str + Audit log comment for this action. + diff_from : str + From value for diff. String. Overridden if 'diff_operations' is provided. + diff_op : str + Operation for diff. String. Overridden if 'diff_operations' is provided. + diff_operations : list + Diff operations to perform against the rule group. + Single. + diff_path : str + Path for diff. String. Overridden if 'diff_operations' is provided. + diff_type : str + Type of diff to apply. + id : str + ID of the rule group to update. + parameters : dict + Full parameters payload. Not required if using other keywords. + rule_ids : str or list[str] + Rule ID(s) + rule_versions : list[int] + Rule version(s) + tracking : str + Tracking. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/update-rule-group + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = firewall_rule_group_update_payload(passed_keywords=kwargs) @@ -1406,8 +1708,16 @@ def create_rule_group_validation(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Validate the request for creating a new rule group on a platform for a customer with a name and description. - Keyword arguments: - body -- Full body payload in JSON format. Not required if other keywords are provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/create-rule-group-validation + + Keyword arguments + ----------------- + body : dict + Full body payload in JSON format. Not required if other keywords are provided. { "description": "string", "enabled": true, @@ -1473,26 +1783,33 @@ def create_rule_group_validation(self: object, } ] } - clone_id -- A rule group ID from which to copy rules. If this is provided then the - 'rules' property of the body and the 'rules' keyword are ignored. String. - comment -- Audit log comment for this action. String. - description -- Description of the rule. String. - enabled -- Flag indicating if this rule is enabled. Boolean. - library -- If this flag is set to true then the rules will be cloned from the clone_id - from the CrowdStrike Firewall Rule Groups Library. Boolean. - name -- Name for this rule. String. - parameters - full parameters payload, not required if using other keywords. - platform -- Platform name this rule applies to. String. - rules -- JSON formatted list of rules to validate. List of dictionaries. + clone_id : str + A rule group ID from which to copy rules. If this is provided then the + 'rules' property of the body and the 'rules' keyword are ignored. + comment : str + Audit log comment for this action. + description : str + Description of the rule. + enabled : bool + Flag indicating if this rule is enabled. + library : str + If this flag is set to true then the rules will be cloned from the clone_id + from the CrowdStrike Firewall Rule Groups Library. + name : str + Name for this rule. + parameters : dict + Full parameters payload. Not required if using other keywords. + platform : str + Platform name this rule applies to. + rules : list[dict] + JSON formatted list of rules to validate. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/create-rule-group-validation + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = firewall_rule_group_validation_payload(passed_keywords=kwargs) @@ -1518,8 +1835,16 @@ def update_rule_group_validation(self: object, Validates the request of updating name, description, or enabled status of a rule group, or create, edit, delete, or reorder rules. - Keyword arguments: - body -- Full body payload in JSON format. Not required if other keywords are provided. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/update-rule-group-validation + + Keyword arguments + ----------------- + body : dict + Full body payload in JSON format. Not required if other keywords are provided. { "diff_operations": [ { @@ -1538,27 +1863,36 @@ def update_rule_group_validation(self: object, ], "tracking": "string" } - comment -- Audit log comment for this action. String. - diff_from -- From value for diff. String. Overridden if 'diff_operations' is provided. - diff_op -- Operation for diff. String. Overridden if 'diff_operations' is provided. - diff_operations -- Diff operations to perform against the rule group. - Single dictionary or List of dictionaries. - diff_path -- Path for diff. String. Overridden if 'diff_operations' is provided. - diff_type -- Type of diff to apply. String. - id -- ID of the rule group to update. String. - parameters - full parameters payload, not required if using other keywords. - rule_ids -- Rule ID(s). List of strings. - rule_versions -- Rule version(s). List of integers. - tracking -- Tracking. String. + comment : str + Audit log comment for this action. + diff_from : str + From value for diff. String. Overridden if 'diff_operations' is provided. + diff_op : str + Operation for diff. String. Overridden if 'diff_operations' is provided. + diff_operations : list + Diff operations to perform against the rule group. + Single. + diff_path : str + Path for diff. String. Overridden if 'diff_operations' is provided. + diff_type : str + Type of diff to apply. + id : str + ID of the rule group to update. + parameters : dict + Full parameters payload. Not required if using other keywords. + rule_ids : str or list[str] + Rule ID(s) + rule_versions : list[int] + Rule version(s) + tracking : str + Tracking. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/update-rule-group-validation + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = firewall_rule_group_update_payload(passed_keywords=kwargs) @@ -1579,19 +1913,28 @@ def get_rules(self: object, *args, parameters: dict = None, **kwargs) -> Union[D ID = 64-bit unsigned int as decimal string Family ID = 32-character hexadecimal string - Keyword arguments: - ids -- The IDs of the rule(s) to retrieve. String or list of strings. - parameters - full parameters payload, not required if `ids` keyword is provided. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/get_rules + + Keyword arguments + ----------------- + ids : str or list[str] + The IDs of the rule(s) to retrieve. + parameters : dict + full parameters payload, not required if `ids` keyword is provided. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1605,23 +1948,31 @@ def get_rules(self: object, *args, parameters: dict = None, **kwargs) -> Union[D def validate_filepath_pattern(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Validate that the test pattern matches the executable filepath glob pattern. - Keyword arguments: - body -- Full body payload in JSON format. Not required if using other keywords. Dictionary. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/validate-filepath-pattern + + Keyword arguments + ----------------- + body : dict + Full body payload in JSON format. Not required if using other keywords. { "filepath_pattern": "string", "filepath_test_string": "string" } - filepath_pattern -- Pattern to test against. String. - filepath_test_string -- File path string to be tested. String. + filepath_pattern : str + Pattern to test against. + filepath_test_string : str + File path string to be tested. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/validate-filepath-pattern + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = firewall_filepattern_payload(passed_keywords=kwargs) @@ -1638,35 +1989,45 @@ def validate_filepath_pattern(self: object, body: dict = None, **kwargs) -> Unio def query_events(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Find all event IDs matching the query with filter. - Keyword arguments: - after -- A pagination token used with the limit parameter to manage pagination - of results. On your first request, don't provide an after token. On - subsequent requests, provide the after token from the previous response - to continue from that place in the results. - filter -- FQL query specifying the filter parameters. - Filter term criteria: - enabled name - platform description - - Filter range criteria: - created_on - modified_on - - (use any common date format, such as '2010-05-15T14:55:21.892315096Z') - limit -- The maximum number of rule IDs to return. [integer, 1-5000] Defaults to 10. - offset -- The integer offset to start retrieving records from. Defaults to 0. - parameters - full parameters payload, not required if using other keywords. - q -- Perform a generic substring search across all fields. - sort -- The property to sort by. FQL syntax (e.g. created_on|desc). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/query_events + + Keyword arguments + ----------------- + after : str + A pagination token used with the limit parameter to manage pagination + of results. On your first request, don't provide an after token. On + subsequent requests, provide the after token from the previous response + to continue from that place in the results. + filter : str + FQL query specifying the filter parameters. + Filter term criteria: + enabled name + platform description + Filter range criteria: + created_on + modified_on + (use any common date format, such as '2010-05-15T14:55:21.892315096Z') + limit : int + The maximum number of rule IDs to return. [integer, 1-5000] Defaults to 10. + offset : str + The integer offset to start retrieving records from. Defaults to 0. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Perform a generic substring search across all fields. + sort : str + The property to sort by. FQL syntax (e.g. created_on|desc). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1680,20 +2041,29 @@ def query_events(self: object, parameters: dict = None, **kwargs) -> Union[Dict[ def query_firewall_fields(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get the firewall field specification IDs for the provided platform. - Keyword arguments: - platform_id -- Get fields configuration for this platform. String. - limit -- The maximum number of rule IDs to return. [integer, 1-5000] Defaults to 10. - offset -- The integer offset to start retrieving records from. Defaults to 0. - parameters - full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/query_firewall_fields + + Keyword arguments + ----------------- + platform_id : str + Get fields configuration for this platform. + limit : int + The maximum number of rule IDs to return. [integer, 1-5000] Defaults to 10. + offset : str + The integer offset to start retrieving records from. Defaults to 0. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1707,26 +2077,38 @@ def query_firewall_fields(self: object, parameters: dict = None, **kwargs) -> Un def query_network_locations(self: object, parameters: dict = None, **kwargs) -> dict: """Find all network location IDs matching the query with filter. - Keyword arguments: - after -- A pagination token used with the limit parameter to manage pagination - of results. On your first request, don't provide an after token. On - subsequent requests, provide the after token from the previous response - to continue from that place in the results. String. - filter -- FQL query specifying the filter parameters. String. - limit -- The maximum number of rule IDs to return. Integer. - offset -- The integer offset to start retrieving records from. String. - parameters - full parameters payload, not required if using other keywords. - q -- Perform a generic substring search across all fields. String. - sort -- The property to sort by. FQL syntax. String. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/query-network-locations + + Keyword arguments + ----------------- + after : str + A pagination token used with the limit parameter to manage pagination + of results. On your first request, don't provide an after token. On + subsequent requests, provide the after token from the previous response + to continue from that place in the results. + filter : str + FQL query specifying the filter parameters. + limit : int + The maximum number of rule IDs to return. + offset : str + The integer offset to start retrieving records from. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Perform a generic substring search across all fields. + sort : str + The property to sort by. FQL syntax. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1740,19 +2122,27 @@ def query_network_locations(self: object, parameters: dict = None, **kwargs) -> def query_platforms(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get the list of platform names. - Keyword arguments: - limit -- The maximum number of rule IDs to return. [integer, 1-100] - offset -- The integer offset to start retrieving records from. Defaults to 0. - parameters - full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/query_platforms + + Keyword arguments + ----------------- + limit : int (1-100) + The maximum number of rule IDs to return. + offset : str + The integer offset to start retrieving records from. Defaults to 0. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1768,35 +2158,45 @@ def query_policy_rules(self: object, parameters: dict = None, **kwargs) -> Union Results are returned in precedence order. - Keyword arguments: - after -- A pagination token used with the limit parameter to manage pagination - of results. On your first request, don't provide an after token. On - subsequent requests, provide the after token from the previous response - to continue from that place in the results. - filter -- FQL query specifying the filter parameters. - Filter term criteria: - enabled name - platform description - - Filter range criteria: - created_on - modified_on - - (use any common date format, such as '2010-05-15T14:55:21.892315096Z') - limit -- The maximum number of rule IDs to return. [integer, 1-5000] Defaults to 10. - offset -- The integer offset to start retrieving records from. Defaults to 0. - parameters - full parameters payload, not required if using other keywords. - q -- Perform a generic substring search across all fields. - sort -- The property to sort by. FQL syntax (e.g. created_on|desc). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/query_policy_rules + + Keyword arguments + ----------------- + after : str + A pagination token used with the limit parameter to manage pagination + of results. On your first request, don't provide an after token. On + subsequent requests, provide the after token from the previous response + to continue from that place in the results. + filter : str + FQL query specifying the filter parameters. + Filter term criteria: + enabled name + platform description + Filter range criteria: + created_on + modified_on + (use any common date format, such as '2010-05-15T14:55:21.892315096Z') + limit : int + The maximum number of rule IDs to return. [integer, 1-5000] Defaults to 10. + offset : str + The integer offset to start retrieving records from. Defaults to 0. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Perform a generic substring search across all fields. + sort : str + The property to sort by. FQL syntax (e.g. created_on|desc). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1810,35 +2210,45 @@ def query_policy_rules(self: object, parameters: dict = None, **kwargs) -> Union def query_rule_groups(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Find all rule group IDs matching the query with filter. - Keyword arguments: - after -- A pagination token used with the limit parameter to manage pagination - of results. On your first request, don't provide an after token. On - subsequent requests, provide the after token from the previous response - to continue from that place in the results. - filter -- FQL query specifying the filter parameters. - Filter term criteria: - enabled name - platform description - - Filter range criteria: - created_on - modified_on - - (use any common date format, such as '2010-05-15T14:55:21.892315096Z') - limit -- The maximum number of rule IDs to return. [integer, 1-5000] Defaults to 10. - offset -- The integer offset to start retrieving records from. Defaults to 0. - parameters - full parameters payload, not required if using other keywords. - q -- Perform a generic substring search across all fields. - sort -- The property to sort by. FQL syntax (e.g. created_on|desc). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/query_rule_groups + + Keyword arguments + ----------------- + after : str + A pagination token used with the limit parameter to manage pagination + of results. On your first request, don't provide an after token. On + subsequent requests, provide the after token from the previous response + to continue from that place in the results. + filter : str + FQL query specifying the filter parameters. + Filter term criteria: + enabled name + platform description + Filter range criteria: + created_on + modified_on + (use any common date format, such as '2010-05-15T14:55:21.892315096Z') + limit : int + The maximum number of rule IDs to return. [integer, 1-5000] Defaults to 10. + offset : str + The integer offset to start retrieving records from. Defaults to 0. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Perform a generic substring search across all fields. + sort : str + The property to sort by. FQL syntax (e.g. created_on|desc). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1852,35 +2262,45 @@ def query_rule_groups(self: object, parameters: dict = None, **kwargs) -> Union[ def query_rules(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Find all rule IDs matching the query with filter. - Keyword arguments: - after -- A pagination token used with the limit parameter to manage pagination - of results. On your first request, don't provide an after token. On - subsequent requests, provide the after token from the previous response - to continue from that place in the results. - filter -- FQL query specifying the filter parameters. - Filter term criteria: - enabled name - platform description - - Filter range criteria: - created_on - modified_on - - (use any common date format, such as '2010-05-15T14:55:21.892315096Z') - limit -- The maximum number of rule IDs to return. [integer, 1-5000] Defaults to 10. - offset -- The integer offset to start retrieving records from. Defaults to 0. - parameters - full parameters payload, not required if using other keywords. - q -- Perform a generic substring search across all fields. - sort -- The property to sort by. FQL syntax (e.g. created_on|desc). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-management/query_rule_groups + + Keyword arguments + ----------------- + after : str + A pagination token used with the limit parameter to manage pagination + of results. On your first request, don't provide an after token. On + subsequent requests, provide the after token from the previous response + to continue from that place in the results. + filter : str + FQL query specifying the filter parameters. + Filter term criteria: + enabled name + platform description + Filter range criteria: + created_on + modified_on + (use any common date format, such as '2010-05-15T14:55:21.892315096Z') + limit : int + The maximum number of rule IDs to return. [integer, 1-5000] Defaults to 10. + offset : str + The integer offset to start retrieving records from. Defaults to 0. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Perform a generic substring search across all fields. + sort : str + The property to sort by. FQL syntax (e.g. created_on|desc). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/firewall_policies.py b/src/falconpy/firewall_policies.py index a48bc89af..e691b8624 100644 --- a/src/falconpy/firewall_policies.py +++ b/src/falconpy/firewall_policies.py @@ -66,24 +66,35 @@ def query_combined_policy_members(self: object, Returns a set of host details which match the filter criteria. - Keyword arguments: - id -- The ID of the Firewall Policy to search for members of - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-policies/queryCombinedFirewallPolicyMembers + + Keyword arguments + ----------------- + id : str + The ID of the Firewall Policy to search for members of + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -102,28 +113,38 @@ def query_combined_policies(self: object, Returns a set of Firewall Policies which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. (value.asc, value.desc) - Available values: - created_by modified_timestamp - created_timestamp name - enabled platform_name - modified_by precedence - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-policies/queryCombinedFirewallPolicies + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. (value.asc, value.desc) + Available values: + created_by modified_timestamp + created_timestamp name + enabled platform_name + modified_by precedence + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -141,15 +162,25 @@ def perform_action(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Perform the specified action on the Firewall Policies specified in the request. - Keyword arguments: - action_name -- action to perform: 'add-host-group', 'disable', 'enable', - 'add-rule-group', 'remove-rule-group' or 'remove-host-group'. - action_parameters -- Action specific parameter options. List of dictionaries. - { - "name": "string", - "value": "string" - } - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-policies/performFirewallPoliciesAction + + Keyword arguments + ----------------- + action_name : str + action to perform: 'add-host-group', 'disable', 'enable', + 'add-rule-group', 'remove-rule-group' or 'remove-host-group'. + action_parameters : list + Action specific parameter options. List of dictionaries. + { + "name": "string", + "value": "string" + } + body : dict + full body payload, not required if keywords are used. { "action_parameters": [ { @@ -161,19 +192,20 @@ def perform_action(self: object, "string" ] } - group_id -- Host Group ID to apply the policy to. String. - Overridden if action_parameters is specified. - ids -- Firewall policy ID(s) to perform actions against. String or list of strings. - parameters - full parameters payload, not required if action_name is provided as a keyword. + group_id : str + Host Group ID to apply the policy to. String. + Overridden if action_parameters is specified. + ids : str or list[str] + Firewall policy ID(s) to perform actions against. + parameters : dict + full parameters payload, not required if action_name is provided as a keyword. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-policies/performFirewallPoliciesAction + Returns + ------- + dict + Dictionary object containing API response. """ _allowed_actions = ['add-host-group', 'disable', 'enable', 'remove-host-group', 'add-rule-group', 'remove-rule-group' @@ -214,25 +246,33 @@ def set_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str, U will have the lowest. You must specify all non-Default Policies for a platform when updating precedence. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-policies/setFirewallPoliciesPrecedence + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "ids": [ "string" ], "platform_name": "Windows" } - ids -- Firewall policy ID(s) to perform actions against. String or list of strings. - platform_name -- OS platform name. + ids : str or list[str] + Firewall policy ID(s) to perform actions against. + platform_name : str + OS platform name. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-policies/setFirewallPoliciesPrecedence + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, payload_value="ids") @@ -250,19 +290,28 @@ def set_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str, U def get_policies(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve a set of Firewall Policies by specifying their IDs. - Keyword arguments: - ids -- List of Firewall Policy IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-policies/getFirewallPolicies + + Keyword arguments + ----------------- + ids : str or list[str] + List of Firewall Policy IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -280,8 +329,16 @@ def create_policies(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create Firewall Policies by specifying details about the policy to create. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-policies/createFirewallPolicies + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "resources": [ { @@ -292,19 +349,21 @@ def create_policies(self: object, } ] } - clone_id -- ID of the Firewall Policy to clone. String. - description -- Firewall Policy description. String. - name -- Firewall Policy name. String. - platform_name -- Name of the operating system platform. String. + clone_id : str + ID of the Firewall Policy to clone. + description : str + Firewall Policy description. + name : str + Firewall Policy name. + platform_name : str + Name of the operating system platform. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-policies/createFirewallPolicies + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = firewall_policy_payload(passed_keywords=kwargs) @@ -322,19 +381,28 @@ def create_policies(self: object, def delete_policies(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a set of Firewall Policies by specifying their IDs. - Keyword arguments: - ids -- List of Firewall Policy IDs to delete. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-policies/deleteFirewallPolicies + + Keyword arguments + ----------------- + ids : str or list[str] + List of Firewall Policy IDs to delete. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -348,29 +416,38 @@ def delete_policies(self: object, *args, parameters: dict = None, **kwargs) -> U def update_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update Firewall Policies by specifying the ID of the policy and details to update. - Keyword arguments: - body -- full body payload, not required if keywords are used. - { - "resources": [ - { - "id": "string", - "description": "string", - "name": "string" - } - ] - } - id -- ID of the Device Control Policy to update. String. - description -- Device Control Policy description. String. - name -- Device Control Policy name. String. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-policies/updateFirewallPolicies + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. + { + "resources": [ + { + "id": "string", + "description": "string", + "name": "string" + } + ] + } + id : str + ID of the Device Control Policy to update. + description : str + Device Control Policy description. + name : str + Device Control Policy name. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = firewall_policy_payload(passed_keywords=kwargs) @@ -388,24 +465,35 @@ def query_policy_members(self: object, parameters: dict = None, **kwargs) -> Uni Returns a set of Agent IDs which match the filter criteria. - Keyword arguments: - id -- The ID of the Device Control Policy to search for members of - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-policies/queryFirewallPolicyMembers + + Keyword arguments + ----------------- + id : str + The ID of the Device Control Policy to search for members of + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -421,27 +509,37 @@ def query_policies(self: object, parameters: dict = None, **kwargs) -> Union[Dic Returns a set of Firewall Policy IDs which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. - created_by modified_timestamp - created_timestamp name - enabled platform_name - modified_by precedence - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/firewall-policies/queryFirewallPolicies + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. + created_by modified_timestamp + created_timestamp name + enabled platform_name + modified_by precedence + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/foundry_logscale.py b/src/falconpy/foundry_logscale.py index f458c6e5f..26c64daa3 100644 --- a/src/falconpy/foundry_logscale.py +++ b/src/falconpy/foundry_logscale.py @@ -60,19 +60,28 @@ class FoundryLogScale(ServiceClass): def list_repos(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """List available repositories and views. - Keyword arguments: - check_test_data -- Include whether test data is present in the application repository. Boolean. - parameters - full parameters payload, not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'check_test_data'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/foundry-logscale/ListReposV1 + + Keyword arguments + ----------------- + check_test_data : bool + Include whether test data is present in the application repository. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'check_test_data'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -91,23 +100,34 @@ def ingest_data(self: object, ) -> dict: """Ingest data into the application repository synchronously. - Keyword arguments: - data_content -- JSON formatted data to ingest. String. - data_file -- Content of the uploaded archive in binary format. - 'file' is also accepted as this parameter. - parameters -- full parameters payload, not required if using other keywords. - tag -- Custom tag for ingested data in the form 'tag:value'. String. - tag_source -- Tag the data with the specified source. String. - test_data -- Tag the data with 'test-ingest'. Defaults to False. Boolean. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/foundry-logscale/IngestDataV1 + + Keyword arguments + ----------------- + data_content : str + JSON formatted data to ingest. + data_file : str + Content of the uploaded archive in binary format. + 'file' is also accepted as this parameter. + parameters : dict + Full parameters payload. Not required if using other keywords. + tag : str + Custom tag for ingested data in the form 'tag:value' + tag_source : str + Tag the data with the specified source. + test_data : bool + Tag the data with 'test-ingest'. Defaults to False. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ # Try to find the binary object they provided us if not data_file: @@ -144,23 +164,34 @@ def ingest_data_async(self: object, ) -> dict: """Ingest data into the application repository asynchronously. - Keyword arguments: - data_content -- JSON formatted data to ingest. String. - data_file -- Content of the uploaded file in binary format. - 'file' is also accepted as this parameter. - parameters -- full parameters payload, not required if using other keywords. - tag -- Custom tag for ingested data in the form 'tag:value'. String. - tag_source -- Tag the data with the specified source. String. - test_data -- Tag the data with 'test-ingest'. Defaults to False. Boolean. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/foundry-logscale/IngestDataAsyncV1 + + Keyword arguments + ----------------- + data_content : str + JSON formatted data to ingest. + data_file : str + Content of the uploaded file in binary format. + 'file' is also accepted as this parameter. + parameters : dict + Full parameters payload. Not required if using other keywords. + tag : str + Custom tag for ingested data in the form 'tag:value' + tag_source : str + Tag the data with the specified source. + test_data : bool + Tag the data with 'test-ingest'. Defaults to False. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ # Try to find the binary object they provided us if not data_file: @@ -196,23 +227,34 @@ def create_file(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create a lookup file. - Keyword arguments: - data_file -- Content of the uploaded file in binary format. - 'file' is also accepted as this parameter. - name -- Name used to identify the file - description -- File description - id -- Unique identifier of the file being updated. - repo -- Name of repository or view to save the file - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/lookup-files/CreateFileV1 + + Keyword arguments + ----------------- + data_file : str + Content of the uploaded file in binary format. + 'file' is also accepted as this parameter. + name : str + Name used to identify the file + description : str + File description + id : str + Unique identifier of the file being updated. + repo : str + Name of repository or view to save the file + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not data_file: data_file = kwargs.get("file", None) @@ -245,21 +287,30 @@ def update_file(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update a lookup file. - Keyword arguments: - data_file -- Content of the uploaded file in binary format. - 'file' is also accepted as this parameter. - description -- File description. String. - id -- Unique identifier of the file being updated. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/lookup-files/UpdateFileV1 + + Keyword arguments + ----------------- + data_file : str + Content of the uploaded file in binary format. + 'file' is also accepted as this parameter. + description : str + File description. + id : str + Unique identifier of the file being updated. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not data_file: data_file = kwargs.get("file", None) @@ -292,9 +343,18 @@ def execute_dynamic(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Deploy a saved search. - Keyword arguments: - app_id -- Application ID. String. - body -- full body payload, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/foundry-logscale/CreateSavedSearchesDynamicExecuteV1 + + Keyword arguments + ----------------- + app_id : str + Application ID. + body : dict + full body payload, not required if using other keywords. { "end": "string", "repo_or_view": "string", @@ -302,27 +362,36 @@ def execute_dynamic(self: object, "search_query_args": {}, "start": "string" } - end -- Ending position. String. - include_schema_generation -- Include generated schemas in the response. Boolean. - incude_test_data -- Include test data when executing searches. Boolean. - infer_json_types -- Whether to try to infer data types in json event response - instead of returning map[string]string. Boolean. - match_response_schema -- Whether to validate search results against their schema. Boolean. - metadata -- Include metadata in the response. Boolean. - mode -- Mode to execute the query under (async or sync). String. - repo_or_view -- Name of the repo or view to perform the search. String. - search_query -- Query for the search. String. - search_query_args -- Argumetns provided to the search. Dictionary. - start -- Starting position. String. + end : str + Ending position. + include_schema_generation : bool + Include generated schemas in the response. + incude_test_data : bool + Include test data when executing searches. + infer_json_types : bool + Whether to try to infer data types in json event response + instead of returning map[string] + match_response_schema : bool + Whether to validate search results against their schema. + metadata : bool + Include metadata in the response. + mode : str + Mode to execute the query under (async or sync) + repo_or_view : str + Name of the repo or view to perform the search. + search_query : str + Query for the search. + search_query_args : dict + Argumetns provided to the search. + start : str + Starting position. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/foundry-logscale/CreateSavedSearchesDynamicExecuteV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = foundry_dynamic_search_payload(passed_keywords=kwargs) @@ -340,29 +409,43 @@ def execute_dynamic(self: object, def get_search_results(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get the results of a saved search. - Keyword arguments: - app_id -- Application ID. String. - job_id -- Job ID for a previously executed asynchronous query. String. - job_status_only -- If set to true, result rows are dropped from the response - and only the job status is returned. Boolean. - limit -- The maximum number of records to return in this response. Integer. - Use with the offset parameter to manage pagination of results. - infer_json_types -- Whether to try to infer data types in json event response - instead of returning map[string]string. Boolean. - match_response_schema -- Whether to validate search results against their schema. Boolean. - metadata -- Flag indicating if metadata should be included in the results. Boolean. - offset -- The offset to start retrieving records from. String. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/foundry-logscale/GetSavedSearchesExecuteV1 + + Keyword arguments + ----------------- + app_id : str + Application ID. + job_id : str + Job ID for a previously executed asynchronous query. + job_status_only : bool + If set to true, result rows are dropped from the response + and only the job status is returned. + limit : str + The maximum number of records to return in this response. Integer. + Use with the offset parameter to manage pagination of results. + infer_json_types : bool + Whether to try to infer data types in json event response + instead of returning map[string] + match_response_schema : bool + Whether to validate search results against their schema. + metadata : bool + Flag indicating if metadata should be included in the results. + offset : str + The offset to start retrieving records from. String. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -380,9 +463,18 @@ def execute(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Deploy a saved search. - Keyword arguments: - app_id -- Application ID. String. - body -- full body payload, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/foundry-logscale/CreateSavedSearchesExecuteV1 + + Keyword arguments + ----------------- + app_id : str + Application ID. + body : dict + full body payload, not required if using other keywords. { "end": "string", "id": "string", @@ -421,31 +513,43 @@ def execute(self: object, ] } } - detailed -- Flag indicating if search field details should be included. Boolean. - end -- Ending position. String. - id -- Saved search ID. String. - include_test_data -- Include test data when executing searches. Boolean. - infer_json_types -- Whether to try to infer data types in json event response - instead of returning map[string]string. Boolean. - match_response_schema -- Whether to validate search results against their schema. Boolean. - metadata -- Include metadata in the response. Boolean. - name -- Saved search name. String. - search_parameters -- Search specific parameters. Dictionary. - NOT to be confused with the default parameters dictionary. - start -- Starting position. String. - with_in -- With in. Dictionary. - with_limit -- With limit. Dictionary. - with_renames -- With renames. Dictionary. - with_sort -- With sort. Dictionary. + detailed : bool + Flag indicating if search field details should be included. + end : str + Ending position. + id : str + Saved search ID. + include_test_data : bool + Include test data when executing searches. + infer_json_types : bool + Whether to try to infer data types in json event response + instead of returning map[string] + match_response_schema : bool + Whether to validate search results against their schema. + metadata : bool + Include metadata in the response. + name : str + Saved search name. + search_parameters : dict + Search specific parameters. Dictionary. + NOT to be confused with the default parameters. + start : str + Starting position. + with_in : dict + With in. + with_limit : dict + With limit. + with_renames : list + With renames. + with_sort : dict + With sort. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/foundry-logscale/CreateSavedSearchesExecuteV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = foundry_execute_search_payload(passed_keywords=kwargs) @@ -463,18 +567,26 @@ def execute(self: object, def populate(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Populate a saved search. - Keyword arguments: - app_id -- Application ID. String. - - Arguments: When not specified, the first argument to this method is assumed to be 'app_id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/foundry-logscale/CreateSavedSearchesIngestV1 + + Keyword arguments + ----------------- + app_id : str + Application ID. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'app_id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -488,21 +600,29 @@ def populate(self: object, *args, parameters: dict = None, **kwargs) -> Union[Di def download_results(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get the results of a saved search as a file. - Keyword arguments: - job_id -- Job ID for a previously executed asynchronous query. String. - infer_json_types -- Whether to try to infer data types in json event response - instead of returning map[string]string. Boolean. - parameters - full parameters payload, not required if using other keywords. - result_format -- Result file format. Allowed values: 'json' or 'csv'. String. - - This method only supports keywords for providing arguments. - - Returns: binary object (success) or dict object (failure) containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/foundry-logscale/GetSavedSearchesJobResultsDownloadV1 + + Keyword arguments + ----------------- + job_id : str + Job ID for a previously executed asynchronous query. + infer_json_types : bool + Whether to try to infer data types in json event response + instead of returning map[string] + parameters : dict + Full parameters payload. Not required if using other keywords. + result_format : str + Result file format. Allowed values: 'json' or 'csv' + + This method only supports keywords for providing arguments. + + Returns + ------- + binary object (success) or dict object (failure) containing API response. """ return process_service_request( calling_object=self, @@ -516,19 +636,28 @@ def download_results(self: object, parameters: dict = None, **kwargs) -> Union[D def list_views(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """List views. - Keyword arguments: - check_test_data -- Include whether test data is present in the application repository. Boolean. - parameters - full parameters payload, not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'check_test_data'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/foundry-logscale/ListViewV1 + + Keyword arguments + ----------------- + check_test_data : bool + Include whether test data is present in the application repository. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'check_test_data'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/foundry_lookup_files.py b/src/falconpy/foundry_lookup_files.py index 4dbfb80cf..ba20fb80c 100644 --- a/src/falconpy/foundry_lookup_files.py +++ b/src/falconpy/foundry_lookup_files.py @@ -62,23 +62,35 @@ def create_file_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create a lookup file within a foundry app. - Keyword arguments: - file_name -- Name to use for the uploaded file. String. - file -- File to be uploaded. String. - name -- Name used to identify the file. String. - description -- File description. String. - id -- Unique identifier of the file being updated. String. - repo -- Name of repository or view to save the file. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/foundry-lookup-files/CreateFileV1 + + Keyword arguments + ----------------- + file_name : str + Name to use for the uploaded file. + file : str + File to be uploaded. + name : str + Name used to identify the file. + description : str + File description. + id : str + Unique identifier of the file being updated. + repo : str + Name of repository or view to save the file. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ kwargs = params_to_keywords(["file", "name", "description", "id", "repo"], parameters, @@ -112,21 +124,31 @@ def update_file_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update a lookup file within a Foundry app. - Keyword arguments: - file_name -- Name to use for the uploaded file. String. - id -- Unique identifier of the file being updated. String. - description -- File description. String. - file -- File to be uploaded. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/foundry-lookup-files/UpdateFileV1 + + Keyword arguments + ----------------- + file_name : str + Name to use for the uploaded file. + id : str + Unique identifier of the file being updated. + description : str + File description. + file : str + File to be uploaded. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ kwargs = params_to_keywords(["id", "description", "file"], parameters, diff --git a/src/falconpy/host_group.py b/src/falconpy/host_group.py index bd00370bc..eefb71926 100644 --- a/src/falconpy/host_group.py +++ b/src/falconpy/host_group.py @@ -69,26 +69,36 @@ def query_combined_group_members(self: object, Returns a set of host details which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - An asterisk wildcard '*' includes all results. - - id -- The ID of the Host Group to search for members of. String - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. name|asc). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-group/queryCombinedGroupMembers + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + An asterisk wildcard '*' includes all results. + id : str + The ID of the Host Group to search for members of. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. name|asc). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -107,32 +117,42 @@ def query_combined_host_groups(self: object, Returns a set of Host Groups which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - An asterisk wildcard '*' includes all results. - Available filter fields: - created_by modified_by - created_timestamp modified_timestamp - group_type name - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. created_timestamp|asc). - Available sort fields: - created_by modified_by - created_timestamp modified_timestamp - group_type name - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-group/queryCombinedHostGroups + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + An asterisk wildcard '*' includes all results. + Available filter fields: + created_by modified_by + created_timestamp modified_timestamp + group_type name + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. created_timestamp|asc). + Available sort fields: + created_by modified_by + created_timestamp modified_timestamp + group_type name + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -150,11 +170,21 @@ def perform_group_action(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Perform the specified action on the Host Groups specified in the request. - Keyword arguments: - action_name -- Action to perform on the host group. String. - Allowed values: 'add-hosts' or 'remove-hosts'. - action_parameters - List of dictionaries containing action specific parameter settings. - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-group/performGroupAction + + Keyword arguments + ----------------- + action_name : str + Action to perform on the host group. String. + Allowed values: 'add-hosts' or 'remove-hosts'. + action_parameters : list + List of dictionaries containing action specific parameter settings. + body : dict + full body payload, not required when using other keywords. { "action_parameters": [ { @@ -166,19 +196,20 @@ def perform_group_action(self: object, "string" ] } - disable_hostname_check -- Disables hostname checking before the action. Boolean. - filter -- Filter to use to specify hosts to apply this action to. FQL formatted string. - Overridden if action_parameters is specified. - ids -- List of host group IDs to perform an action against. String or list of strings. + disable_hostname_check : bool + Disables hostname checking before the action. + filter : str + Filter to use to specify hosts to apply this action to. FQL formatted string. + Overridden if action_parameters is specified. + ids : str or list[str] + List of host group IDs to perform an action against. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-group/performGroupAction + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, @@ -214,19 +245,28 @@ def perform_group_action(self: object, def get_host_groups(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve a set of Host Groups by specifying their IDs. - Keyword arguments: - ids -- List of host group IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-group/getHostGroups + + Keyword arguments + ----------------- + ids : str or list[str] + List of host group IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -240,9 +280,18 @@ def get_host_groups(self: object, *args, parameters: dict = None, **kwargs) -> U def create_host_groups(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create Host Groups by specifying details about the group to create. - Keyword arguments: - assignment_rule -- Assignment rule to apply. String. - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-group/createHostGroups + + Keyword arguments + ----------------- + assignment_rule : str + Assignment rule to apply. + body : dict + full body payload, not required when using other keywords. { "resources": [ { @@ -253,18 +302,19 @@ def create_host_groups(self: object, body: dict = None, **kwargs) -> Union[Dict[ } ] } - description -- Description of the host group. String. - group_type -- Type of Host Group to create. String. - name -- The Host Group name. String. + description : str + Description of the host group. + group_type : str + Type of Host Group to create. + name : str + The Host Group name. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-group/createHostGroups + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = host_group_create_payload(passed_keywords=kwargs) @@ -284,19 +334,28 @@ def delete_host_groups(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a set of Host Groups by specifying their IDs. - Keyword arguments: - ids -- List of host group IDs to delete. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-group/deleteHostGroups + + Keyword arguments + ----------------- + ids : str or list[str] + List of host group IDs to delete. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -310,9 +369,18 @@ def delete_host_groups(self: object, def update_host_groups(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update Host Groups by specifying the ID of the group and details to update. - Keyword arguments: - assignment_rule -- Assignment rule to apply. String. - body -- full body payload, not required when using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-group/updateHostGroups + + Keyword arguments + ----------------- + assignment_rule : str + Assignment rule to apply. + body : dict + full body payload, not required when using other keywords. { "resources": [ { @@ -323,18 +391,19 @@ def update_host_groups(self: object, body: dict = None, **kwargs) -> Union[Dict[ } ] } - description -- Description of the host group. String. - id -- Host Group ID to be updated. String. - name -- The Host Group name. String. + description : str + Description of the host group. + id : str + Host Group ID to be updated. + name : str + The Host Group name. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-group/updateHostGroups + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = host_group_update_payload(passed_keywords=kwargs) @@ -354,25 +423,36 @@ def query_group_members(self: object, parameters: dict = None, **kwargs) -> Unio Returns a set of Agent IDs which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - An asterisk wildcard '*' includes all results. - id -- The ID of the Host Group to search for members of. String. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. name|asc). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-group/queryGroupMembers + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + An asterisk wildcard '*' includes all results. + id : str + The ID of the Host Group to search for members of. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. name|asc). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -388,32 +468,42 @@ def query_host_groups(self: object, parameters: dict = None, **kwargs) -> Union[ Returns a set of Host Group IDs which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - An asterisk wildcard '*' includes all results. - Available filter fields: - created_by modified_by - created_timestamp modified_timestamp - group_type name - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. created_timestamp|asc). - Available sort fields: - created_by modified_by - created_timestamp modified_timestamp - group_type name - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-group/queryHostGroups + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + An asterisk wildcard '*' includes all results. + Available filter fields: + created_by modified_by + created_timestamp modified_timestamp + group_type name + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. created_timestamp|asc). + Available sort fields: + created_by modified_by + created_timestamp modified_timestamp + group_type name + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/host_migration.py b/src/falconpy/host_migration.py index 08fccdaff..82a6f1572 100644 --- a/src/falconpy/host_migration.py +++ b/src/falconpy/host_migration.py @@ -61,76 +61,83 @@ class HostMigration(ServiceClass): def aggregate_host_migration(self: object, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get host migration aggregates as specified via json in request body. - Keyword arguments: - body -- full body payload, not required if using other keywords. - { - "resources": [ - { - "date_ranges": [ - { - "from": "string", - "to": "string" - } - ], - "exclude": "string", - "extended_bounds": { - "max": "string", - "min": "string" - }, - "field": "string", - "filter": "string", - "from": 0, - "include": "string", - "interval": "string", - "max_doc_count": 0, - "min_doc_count": 0, - "missing": "string", - "name": "string", - "q": "string", - "ranges": [ - { - "From": 0, - "To": 0 - } - ], - "size": 0, - "sort": "string", - "sub_aggregates": [ - null - ], - "time_zone": "string", - "type": "string" - } - ] - } - - Supported Types: - Both types support the following FQL filter properties: - groups, hostgroups, static_host_groups, hostname, status, - target_cid, source_cid, migration_id, id, host_migration_id, created_time. - The values groups and hostgroups are aliases for static_host_groups. - The value host_migration_id is an alias for id - - Type 1 - Terms - "type": "terms" - Supported field values: - groups, hostgroups, static_host_groups, hostname, - status, target_cid, source_cid, migration_id, id, host_migration_id. - sort must be done on the same value as field and include a direction (asc or desc). - Supports all FQL fields except for groups, hostgroups, or static_host_groups. - Examples sort value: status|asc or created_by|desc - - Type 2 - Date Range - "type": "date_range" - Supported field fields: created_time. - Does not support sort, size, or from. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-migration/HostMigrationAggregatesV1 + + Keyword arguments + ----------------- + body : list + full body payload, not required if using other keywords. + { + "resources": [ + { + "date_ranges": [ + { + "from": "string", + "to": "string" + } + ], + "exclude": "string", + "extended_bounds": { + "max": "string", + "min": "string" + }, + "field": "string", + "filter": "string", + "from": 0, + "include": "string", + "interval": "string", + "max_doc_count": 0, + "min_doc_count": 0, + "missing": "string", + "name": "string", + "q": "string", + "ranges": [ + { + "From": 0, + "To": 0 + } + ], + "size": 0, + "sort": "string", + "sub_aggregates": [ + null + ], + "time_zone": "string", + "type": "string" + } + ] + } + + Supported Types: + Both types support the following FQL filter properties: + groups, hostgroups, static_host_groups, hostname, status, + target_cid, source_cid, migration_id, id, host_migration_id, created_time. + The values groups and hostgroups are aliases for static_host_groups. + The value host_migration_id is an alias for id + + Type 1 - Terms + "type": "terms" + Supported field values: + groups, hostgroups, static_host_groups, hostname, + status, target_cid, source_cid, migration_id, id, host_migration_id. + sort must be done on the same value as field and include a direction (asc or desc). + Supports all FQL fields except for groups, hostgroups, or static_host_groups. + Examples sort value: status|asc or created_by|desc + + Type 2 - Date Range + "type": "date_range" + Supported field fields: created_time. + Does not support sort, size, or from. + + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -146,74 +153,81 @@ def aggregate_host_migration(self: object, body: list = None, **kwargs) -> Union def aggregate_migration(self: object, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get migration aggregates as specified via json in request body. - Keyword arguments: - body -- full body payload, not required if using other keywords. - { - "resources": [ - { - "date_ranges": [ - { - "from": "string", - "to": "string" + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-migration/MigrationAggregatesV1 + + Keyword arguments + ----------------- + body : list + full body payload, not required if using other keywords. + { + "resources": [ + { + "date_ranges": [ + { + "from": "string", + "to": "string" + } + ], + "exclude": "string", + "extended_bounds": { + "max": "string", + "min": "string" + }, + "field": "string", + "filter": "string", + "from": 0, + "include": "string", + "interval": "string", + "max_doc_count": 0, + "min_doc_count": 0, + "missing": "string", + "name": "string", + "q": "string", + "ranges": [ + { + "From": 0, + "To": 0 + } + ], + "size": 0, + "sort": "string", + "sub_aggregates": [ + null + ], + "time_zone": "string", + "type": "string" } - ], - "exclude": "string", - "extended_bounds": { - "max": "string", - "min": "string" - }, - "field": "string", - "filter": "string", - "from": 0, - "include": "string", - "interval": "string", - "max_doc_count": 0, - "min_doc_count": 0, - "missing": "string", - "name": "string", - "q": "string", - "ranges": [ - { - "From": 0, - "To": 0 - } - ], - "size": 0, - "sort": "string", - "sub_aggregates": [ - null - ], - "time_zone": "string", - "type": "string" + ] } - ] - } - - Supported Types: - Both types support the following FQL filter props: - name, id, migration_id, target_cid, status, migration_status, created_by, created_time. - The value migration_status is an alias for status. - The value migration_id is an alias for id. + Supported Types: + Both types support the following FQL filter props: + name, id, migration_id, target_cid, status, migration_status, created_by, created_time. + The value migration_status is an alias for status. + The value migration_id is an alias for id. - Type 1 - Terms - "type": "terms" - Supported field values: name, id, migration_id, target_cid, status, migration_status, created_by. - sort on terms type must be done on the same value as field and include a direction (asc or desc). - Supports all supported FQL fields. - Examples sort value: status|asc or created_by|desc. - Type 2 - Date Range - "type": "date_range" - Supported field fields: created_time. - Does not support sort, size, or from. + Type 1 - Terms + "type": "terms" + Supported field values: name, id, migration_id, target_cid, status, migration_status, created_by. + sort on terms type must be done on the same value as field and include a direction (asc or desc). + Supports all supported FQL fields. + Examples sort value: status|asc or created_by|desc. - Returns: dict object containing API response. + Type 2 - Date Range + "type": "date_range" + Supported field fields: created_time. + Does not support sort, size, or from. - HTTP Method: POST - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-migration/MigrationAggregatesV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -232,55 +246,62 @@ def perform_host_migration_action(self: object, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Perform an action on host migrations. - Keyword arguments: - id -- The migration job to perform actions on. String. + HTTP Method: POST - action_name -- The action to perform - Available values: remove_hosts, remove_host_groups, add_host_groups + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-migration/HostMigrationsActionsV1 - body -- full body payload, not required if using other keywords. - { - "resources": [ - { - "action_parameters": [ - { - "name": "string", - "value": "string" - } - ], - "filter": "string", - "ids": [ - "string" - ] + Keyword arguments + ----------------- + id : str + The migration job to perform actions on. + action_name : str + The action to perform + Available values: remove_hosts, remove_host_groups, add_host_groups + body : dict + full body payload, not required if using other keywords. + { + "resources": [ + { + "action_parameters": [ + { + "name": "string", + "value": "string" + } + ], + "filter": "string", + "ids": [ + "string" + ] + } + ] } - ] - } - Available Actions: - These actions only works if the migration has not started. + Available Actions: + These actions only works if the migration has not started. - add_host_groups adds static host groups to the selected hosts in a migration. - This action accepts the following action parameter: { "name": "host_group": "value": "$host_group_id" }. - Action parameters can be repeated to add multiple static host groups in a single request. + add_host_groups adds static host groups to the selected hosts in a migration. + This action accepts the following action parameter: { "name": "host_group": "value": "$host_group_id" }. + Action parameters can be repeated to add multiple static host groups in a single request. - remove_host_groups removes static host groups from the selected hosts in a migration. - This action accepts the following action parameter: { "name": "host_group": "value": "$host_group_id" }. - Action parameters can be repeated to remove multiple static host groups in a single request. + remove_host_groups removes static host groups from the selected hosts in a migration. + This action accepts the following action parameter: { "name": "host_group": "value": "$host_group_id" }. + Action parameters can be repeated to remove multiple static host groups in a single request. - remove_hosts removes the selected hosts from a migration. - This action does not accept any action parameters. + remove_hosts removes the selected hosts from a migration. + This action does not accept any action parameters. - FQL Filter supports the following fields: - groups, hostgroups, static_host_groups, - hostname, status, target_cid, source_cid, - migration_id, id, host_migration_id, created_time. + FQL Filter supports the following fields: + groups, hostgroups, static_host_groups, + hostname, status, target_cid, source_cid, + migration_id, id, host_migration_id, created_time. - Returns: dict object containing API response. - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-migration/HostMigrationsActionsV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, @@ -312,8 +333,16 @@ def perform_host_migration_action(self: object, def get_host_migration_details(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get migration aggregates as specified via json in request body. - Keyword arguments: - body -- full body payload, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-migration/GetHostMigrationsV1 + + Keyword arguments + ----------------- + body : dict + full body payload, not required if using other keywords. { "resources":[ { @@ -324,7 +353,10 @@ def get_host_migration_details(self: object, body: dict = None, **kwargs) -> Uni ] } - Returns: dict object containing API response. + + Returns + ------- + dict object containing API response. Events The events field describes actions that have occurred to the host migration entity. @@ -335,13 +367,6 @@ def get_host_migration_details(self: object, body: dict = None, **kwargs) -> Uni The status_details field is an optional field that provides some more details about the status of a failed host migration. It may be omitted or empty from a response. - - - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-migration/GetHostMigrationsV1 """ if not body: body = generic_payload_list(submitted_keywords=kwargs, @@ -359,8 +384,16 @@ def get_host_migration_details(self: object, body: dict = None, **kwargs) -> Uni def get_migration_destination(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get destinations for a migration. - Keyword arguments: - body -- full body payload, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-migration/GetMigrationDestinationsV1 + + Keyword arguments + ----------------- + body : dict + full body payload, not required if using other keywords. { "resources": [ { @@ -372,12 +405,11 @@ def get_migration_destination(self: object, body: dict = None, **kwargs) -> Unio ] } - Returns: dict object containing API response. - - HTTP Method: POST - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-migration/GetMigrationDestinationsV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: if kwargs.get("device_ids", None): @@ -400,52 +432,60 @@ def perform_migration_job_action(self: object, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Perform an action on host migrations. - Keyword arguments: - action_name -- The action to perform + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-migration/MigrationsActionsV1 + + Keyword arguments + ----------------- + action_name : str + The action to perform Available values: remove_hosts, remove_host_groups, add_host_groups - body -- full body payload, not required if using other keywords. - { - "resources": [ - { - "action_parameters": [ - { - "name": "string", - "value": "string" - } - ], - "filter": "string", - "ids": [ - "string" - ] + body : dict + full body payload, not required if using other keywords. + { + "resources": [ + { + "action_parameters": [ + { + "name": "string", + "value": "string" + } + ], + "filter": "string", + "ids": [ + "string" + ] + } + ] } - ] - } - Available Actions: - These actions only works if the migration has not started. + Available Actions: + These actions only works if the migration has not started. - add_host_groups adds static host groups to the selected hosts in a migration. - This action accepts the following action parameter: { "name": "host_group": "value": "$host_group_id" }. - Action parameters can be repeated to add multiple static host groups in a single request. + add_host_groups adds static host groups to the selected hosts in a migration. + This action accepts the following action parameter: { "name": "host_group": "value": "$host_group_id" }. + Action parameters can be repeated to add multiple static host groups in a single request. - remove_host_groups removes static host groups from the selected hosts in a migration. - This action accepts the following action parameter: { "name": "host_group": "value": "$host_group_id" }. - Action parameters can be repeated to remove multiple static host groups in a single request. + remove_host_groups removes static host groups from the selected hosts in a migration. + This action accepts the following action parameter: { "name": "host_group": "value": "$host_group_id" }. + Action parameters can be repeated to remove multiple static host groups in a single request. - remove_hosts removes the selected hosts from a migration. - This action does not accept any action parameters. + remove_hosts removes the selected hosts from a migration. + This action does not accept any action parameters. - FQL Filter supports the following fields: - groups, hostgroups, static_host_groups, - hostname, status, target_cid, source_cid, - migration_id, id, host_migration_id, created_time. + FQL Filter supports the following fields: + groups, hostgroups, static_host_groups, + hostname, status, target_cid, source_cid, + migration_id, id, host_migration_id, created_time. - Returns: dict object containing API response. - - HTTP Method: POST - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-migration/MigrationsActionsV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, @@ -481,19 +521,28 @@ def get_migration_job_details(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get migration job details. - Keyword arguments: - ids -- The migration jobs of interest. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-migration/GetMigrationsV1 + + Keyword arguments + ----------------- + ids : str or list[str] + The migration jobs of interest. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -507,8 +556,16 @@ def get_migration_job_details(self: object, def create_migration(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create a device migration job. - Keyword arguments: - body -- full body payload, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-migration/CreateMigrationV1 + + Keyword arguments + ----------------- + body : dict + full body payload, not required if using other keywords. { "resources": [ { @@ -522,12 +579,11 @@ def create_migration(self: object, body: dict = None, **kwargs) -> Union[Dict[st ] } - Returns: dict object containing API response. - - HTTP Method: POST - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-migration/CreateMigrationV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, @@ -562,33 +618,44 @@ def query_host_migration_ids(self: object, Returns a set of Agent IDs which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. Valid fields: groups, hostgroups, target_cid, - migration_id, host_migration_id, static_host_groups, hostname, status, source_cid, id, created_time - id -- The migration job to query. String. - limit -- The maximum records to return. [1-10000] - offset -- The offset to start retrieving records from - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. name|asc). - Available values : - hostname|asc, hostname|desc, hostname, - status|asc, status|desc, status, migration_id|asc, - migration_id|desc, migration_id, created_time|asc, - created_time|desc, created_time, host_migration_id|asc, - host_migration_id|desc, host_migration_id, groups|asc, - groups|desc, groups, hostgroups|asc, hostgroups|desc, - hostgroups, source_cid|asc, source_cid|desc, source_cid, - id|asc, id|desc, id, static_host_groups|asc, static_host_groups|desc, - static_host_groups, target_cid|asc, target_cid|desc, target_cid - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-migration/GetHostMigrationIDsV1 + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. Valid fields: groups, hostgroups, target_cid, + migration_id, host_migration_id, static_host_groups, hostname, status, source_cid, id, created_time + id : str + The migration job to query. + limit : int + The maximum records to return. [1-10000] + offset : int + The offset to start retrieving records from + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. name|asc). + Available values : + hostname|asc, hostname|desc, hostname, + status|asc, status|desc, status, migration_id|asc, + migration_id|desc, migration_id, created_time|asc, + created_time|desc, created_time, host_migration_id|asc, + host_migration_id|desc, host_migration_id, groups|asc, + groups|desc, groups, hostgroups|asc, hostgroups|desc, + hostgroups, source_cid|asc, source_cid|desc, source_cid, + id|asc, id|desc, id, static_host_groups|asc, static_host_groups|desc, + static_host_groups, target_cid|asc, target_cid|desc, target_cid + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -606,33 +673,41 @@ def query_migration_jobs(self: object, parameters: dict = None, **kwargs) -> Uni Returns a set of Agent IDs which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. Valid fields: name, id, migration_id, - target_cid, status, migration_status, created_by, created_time - limit -- The maximum records to return. [1-10000] - offset -- The offset to start retrieving records from - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. name|asc). - Available values : - target_cid|asc, target_cid|desc, target_cid, - status|asc, status|desc, status, - migration_status|asc, migration_status|desc, migration_status, - created_by|asc, created_by|desc, created_by, - created_time|asc, created_time|desc, created_time, - name|asc, name|desc, name, - id|asc, id|desc, id, migration_id|asc, - migration_id|desc, migration_id + HTTP Method: GET + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-migration/GetMigrationIDsV1 + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. Valid fields: name, id, migration_id, + target_cid, status, migration_status, created_by, created_time + limit : int + The maximum records to return. [1-10000] + offset : int + The offset to start retrieving records from + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. name|asc). + Available values : + target_cid|asc, target_cid|desc, target_cid, + status|asc, status|desc, status, + migration_status|asc, migration_status|desc, migration_status, + created_by|asc, created_by|desc, created_by, + created_time|asc, created_time|desc, created_time, + name|asc, name|desc, name, + id|asc, id|desc, id, migration_id|asc, + migration_id|desc, migration_id This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: GET - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/host-migration/GetMigrationIDsV1 + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/hosts.py b/src/falconpy/hosts.py index 96bdb137c..92a330caf 100644 --- a/src/falconpy/hosts.py +++ b/src/falconpy/hosts.py @@ -67,227 +67,323 @@ def query_hidden_devices_combined(self: object, Returns full device records. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. String. FQL syntax. - This should be supplied for each consecutive call. - fields -- The fields to return, comma delimited if specifying more than one field. String. - For example: fields=hostname,device_id would return device records only containing - the hostname and device_id. - limit -- The maximum number of records to return. [integer, 1-10000] - offset -- The offset to page from, provided from the previous call as the next value, for - the next result set. For the first call, do not supply an offset. String. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by (e.g. status.desc or hostname.asc). String. If not specified, the - default sort will be device_id.asc. This should be supplied for each consecutive call. - Available sort fields: - _all agent_load_flags - agent_version bios_manufacturer - bios_version chassis_type - chassis_type_desc cid - config_id_base config_id_build - config_id_platform connection_ip - connection_mac_address cpu_signature - cpu_vendor criticality - default_gateway_ip deployment_type - detection_suppression_status device_id - device_policies.aidr.applied device_policies.aidr.policy_id - device_policies.aidr.policy_type device_policies.airlock.applied - device_policies.airlock.policy_id device_policies.airlock.policy_type - device_policies.application-abuse-prevention.applieddevice_policies.application-abuse-prevention.policy_id - device_policies.application-abuse-prevention.policy_typedevice_policies.automox.applied - device_policies.automox.policy_id device_policies.automox.policy_type - device_policies.aws-verified-access.applied device_policies.aws-verified-access.policy_id - device_policies.aws-verified-access.policy_type device_policies.browser-extension.applied - device_policies.browser-extension.policy_id device_policies.browser-extension.policy_type - device_policies.cloud-ml.applied device_policies.cloud-ml.policy_id - device_policies.cloud-ml.policy_type device_policies.consumer-subscription.applied - device_policies.consumer-subscription.policy_id device_policies.consumer-subscription.policy_type - device_policies.content-update.applied device_policies.content-update.policy_id - device_policies.content-update.policy_type device_policies.data-protection-cloud.applied - device_policies.data-protection-cloud.policy_id device_policies.data-protection-cloud.policy_type - device_policies.data-protection.applied device_policies.data-protection.policy_id - device_policies.data-protection.policy_type device_policies.device_control.applied - device_policies.device_control.policy_id device_policies.device_control.policy_type - device_policies.exposure-management.applied device_policies.exposure-management.policy_id - device_policies.exposure-management.policy_type device_policies.fem-browser-extension-control.applied - device_policies.fem-browser-extension-control.policy_id - device_policies.fem-browser-extension-control.policy_type - device_policies.fim.applied device_policies.fim.policy_id - device_policies.fim.policy_type device_policies.firewall.applied - device_policies.firewall.policy_id device_policies.firewall.policy_type - device_policies.firewall.rule_set_id device_policies.host-retention.applied - device_policies.host-retention.policy_id device_policies.host-retention.policy_type - device_policies.identity-endpoint.applied device_policies.identity-endpoint.policy_id - device_policies.identity-endpoint.policy_type device_policies.identity-protection.applied - device_policies.identity-protection.policy_id device_policies.identity-protection.policy_type - device_policies.it-automation.applied device_policies.it-automation.policy_id - device_policies.it-automation.policy_type device_policies.jumpcloud.applied - device_policies.jumpcloud.policy_id device_policies.jumpcloud.policy_type - device_policies.kubernetes-admission-control.applieddevice_policies.kubernetes-admission-control.policy_id - device_policies.kubernetes-admission-control.policy_typedevice_policies.logscale-collector.applied - device_policies.logscale-collector.policy_id device_policies.logscale-collector.policy_type - device_policies.mobile.applied device_policies.mobile.policy_id - device_policies.mobile.policy_type device_policies.netskope.applied - device_policies.netskope.policy_id device_policies.netskope.policy_type - device_policies.network-scan-content.applied device_policies.network-scan-content.policy_id - device_policies.network-scan-content.policy_type device_policies.prevention.applied - device_policies.prevention.policy_id device_policies.prevention.policy_type - device_policies.remote_response.applied device_policies.remote_response.policy_id - device_policies.remote_response.policy_type device_policies.sca.applied - device_policies.sca.policy_id device_policies.sca.policy_type - device_policies.sensor_update.applied device_policies.sensor_update.policy_id - device_policies.sensor_update.policy_type device_policies.sensor_update.uninstall_protection - device_policies.system-tray.applied device_policies.system-tray.policy_id - device_policies.system-tray.policy_type device_policies.vulnerability-management.applied - device_policies.vulnerability-management.policy_id device_policies.vulnerability-management.policy_type - device_policies.ztl.applied device_policies.ztl.policy_id - device_policies.ztl.policy_type email - external_ip filesystem_containment_status - first_login_timestamp first_login_user - first_seen group_hash - groups host_utc_offset - hostname instance_id - internet_exposure k8s_cluster_git_version - k8s_cluster_id k8s_cluster_version - kernel_version last_login_timestamp - last_login_uid last_login_user - last_login_user_sid last_reboot - last_seen license_activation_state - linux_sensor_mode local_ip - local_ip.raw mac_address - machine_domain major_version - managed_apps.airlock.version managed_apps.automox.version - managed_apps.aws-verified-access.version managed_apps.identity-protection.version - managed_apps.jumpcloud.version managed_apps.netskope.version - migration_completed_time minor_version - modified_timestamp os_build - os_product_name os_version - ou platform_id - platform_name pod_annotations - pod_host_ip4 pod_host_ip6 - pod_hostname pod_id - pod_ip4 pod_ip6 - pod_labels pod_name - pod_namespace pod_service_account_name - pointer_size policies.applied - policies.policy_id policies.policy_type - policy_id product_type - product_type_desc reduced_functionality_mode - release_group rtr_state - safe_mode serial_number - service_provider service_provider_account_id - site_name status - system_manufacturer system_product_name - tags zone_group - kernel_version device_policies.browser-extension.policy_type - k8s_cluster_id policies.applied - cid policies.policy_type - device_policies.sensor_update.policy_type instance_id - groups system_product_name - device_policies.prevention.policy_id device_policies.identity-protection.policy_type - device_policies.mobile.policy_type managed_apps.aws-verified-access.version - deployment_type tags - device_policies.content-update.applied policies.policy_id - first_login_timestamp device_policies.host-retention.applied - device_policies.vulnerability-management.applied device_policies.mobile.policy_id - license_activation_state last_login_timestamp - filesystem_containment_status device_policies.device_control.policy_type - device_policies.network-scan-content.applied device_policies.airlock.policy_type - config_id_base group_hash - product_type_desc linux_sensor_mode - device_policies.fim.policy_type device_policies.network-scan-content.policy_id - device_policies.remote_response.policy_type device_policies.prevention.policy_type - internet_exposure device_policies.vulnerability-management.policy_type - k8s_cluster_git_version device_policies.aws-verified-access.applied - device_id device_policies.mobile.applied - device_policies.identity-protection.policy_id rtr_state - email chassis_type - pod_host_ip6 device_policies.ztl.policy_type - pod_id managed_apps.identity-protection.version - host_utc_offset pod_namespace - device_policies.sensor_update.policy_id pod_service_account_name - migration_completed_time k8s_cluster_version - device_policies.browser-extension.policy_id minor_version - device_policies.firewall.rule_set_id policy_id - platform_id device_policies.system-tray.applied - device_policies.data-protection.policy_type device_policies.host-retention.policy_id - device_policies.aws-verified-access.policy_type zone_group - pod_ip4 machine_domain - first_login_user device_policies.device_control.policy_id - device_policies.sensor_update.applied device_policies.kubernetes-admission-control.applied - device_policies.system-tray.policy_id device_policies.data-protection.applied - device_policies.it-automation.policy_type detection_suppression_status - device_policies.it-automation.policy_id hostname - device_policies.it-automation.applied first_seen - last_reboot last_login_uid - system_manufacturer ou - device_policies.kubernetes-admission-control.policy_id device_policies.system-tray.policy_type - device_policies.vulnerability-management.policy_id device_policies.fim.applied - managed_apps.jumpcloud.version local_ip.raw - device_policies.identity-protection.applied managed_apps.netskope.version - device_policies.device_control.applied config_id_platform - device_policies.automox.applied cpu_signature - device_policies.kubernetes-admission-control.policy_type - device_policies.content-update.policy_id device_policies.automox.policy_id - service_provider_account_id device_policies.jumpcloud.applied - managed_apps.airlock.version device_policies.aws-verified-access.policy_id - cpu_vendor mac_address - major_version device_policies.network-scan-content.policy_type - device_policies.sca.policy_id agent_load_flags - pod_name platform_name - connection_mac_address device_policies.netskope.applied - device_policies.consumer-subscription.policy_id device_policies.ztl.policy_id - local_ip chassis_type_desc - site_name bios_manufacturer - status modified_timestamp - device_policies.airlock.policy_id device_policies.host-retention.policy_type - device_policies.netskope.policy_type _all - service_provider device_policies.firewall.policy_type - pod_host_ip4 reduced_functionality_mode - config_id_build os_build - managed_apps.automox.version last_seen - device_policies.remote_response.applied device_policies.consumer-subscription.policy_type - device_policies.airlock.applied device_policies.sca.applied - device_policies.automox.policy_type device_policies.data-protection.policy_id - device_policies.consumer-subscription.applied pod_ip6 - device_policies.content-update.policy_type connection_ip - device_policies.firewall.policy_id agent_version - pod_labels device_policies.netskope.policy_id - os_product_name device_policies.firewall.applied - device_policies.browser-extension.applied device_policies.remote_response.policy_id - last_login_user device_policies.sensor_update.uninstall_protection - product_type device_policies.jumpcloud.policy_id - pod_annotations device_policies.ztl.applied - os_version default_gateway_ip - device_policies.prevention.applied last_login_user_sid - device_policies.jumpcloud.policy_type bios_version - device_policies.exposure-management.applied device_policies.exposure-management.policy_type - device_policies.exposure-management.policy_id device_policies.logscale-collector.policy_id - device_policies.logscale-collector.policy_type device_policies.logscale-collector.applied - device_policies.cloud-ml.policy_id device_policies.cloud-ml.policy_type - device_policies.cloud-ml.applied device_policies.fem-browser-extension-control.applied - device_policies.fem-browser-extension-control.policy_type - device_policies.fem-browser-extension-control.policy_id - device_policies.application-abuse-prevention.applied - device_policies.application-abuse-prevention.policy_id - device_policies.application-abuse-prevention.policy_type - device_policies.data-protection-cloud.applied - device_policies.data-protection-cloud.policy_id - device_policies.data-protection-cloud.policy_type - device_policies.identity-endpoint.applied - device_policies.identity-endpoint.policy_id - device_policies.identity-endpoint.policy_type - pointer_size safe_mode - - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/hosts/CombinedHiddenDevicesByFilter + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. String. FQL syntax. + This should be supplied for each consecutive call. + fields : str + The fields to return, comma delimited if specifying more than one field. String. + For example: fields=hostname,device_id would return device records only containing + the hostname and device_id. + limit : int (1-10000) + The maximum number of records to return. + offset : str + The offset to page from, provided from the previous call as the next value, for + the next result set. For the first call, do not supply an offset. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by (e.g. status.desc or hostname.asc). String. If not specified, the + default sort will be device_id.asc. This should be supplied for each consecutive call. + Available sort fields: + _all agent_load_flags + agent_version bios_manufacturer + bios_version chassis_type + chassis_type_desc cid + cloud_service_compartment_id config_id_base + config_id_build config_id_platform + connection_ip connection_mac_address + cpu_signature cpu_vendor + criticality default_gateway_ip + deployment_type detection_suppression_status + device_id device_policies.aidr.applied + device_policies.aidr.policy_id device_policies.aidr.policy_type + device_policies.airlock.applied device_policies.airlock.policy_id + device_policies.airlock.policy_type device_policies.application-abuse-prevention.applied + device_policies.application-abuse-prevention.policy_iddevice_policies.application-abuse-prevention.policy_type + device_policies.automox.applied device_policies.automox.policy_id + device_policies.automox.policy_type device_policies.aws-verified-access.applied + device_policies.aws-verified-access.policy_id device_policies.aws-verified-access.policy_type + device_policies.browser-extension.applied device_policies.browser-extension.policy_id + device_policies.browser-extension.policy_type device_policies.cloud-ml.applied + device_policies.cloud-ml.policy_id device_policies.cloud-ml.policy_type + device_policies.consumer-subscription.applied device_policies.consumer-subscription.policy_id + device_policies.consumer-subscription.policy_type device_policies.content-update.applied + device_policies.content-update.policy_id device_policies.content-update.policy_type + device_policies.data-protection-cloud.applied device_policies.data-protection-cloud.policy_id + device_policies.data-protection-cloud.policy_type device_policies.data-protection.applied + device_policies.data-protection.policy_id device_policies.data-protection.policy_type + device_policies.device_control.applied device_policies.device_control.policy_id + device_policies.device_control.policy_type device_policies.exposure-management.applied + device_policies.exposure-management.policy_id device_policies.exposure-management.policy_type + device_policies.fem-browser-extension-control.applied device_policies.fem-browser-extension-control.policy_id + device_policies.fem-browser-extension-control.policy_typedevice_policies.fim.applied + device_policies.fim.policy_id device_policies.fim.policy_type + device_policies.firewall.applied device_policies.firewall.policy_id + device_policies.firewall.policy_type device_policies.firewall.rule_set_id + device_policies.host-retention.applied device_policies.host-retention.policy_id + device_policies.host-retention.policy_type device_policies.identity-endpoint.applied + device_policies.identity-endpoint.policy_id device_policies.identity-endpoint.policy_type + device_policies.identity-protection.applied device_policies.identity-protection.policy_id + device_policies.identity-protection.policy_type device_policies.it-automation.applied + device_policies.it-automation.policy_id device_policies.it-automation.policy_type + device_policies.jumpcloud.applied device_policies.jumpcloud.policy_id + device_policies.jumpcloud.policy_type device_policies.kubernetes-admission-control.applied + device_policies.kubernetes-admission-control.policy_iddevice_policies.kubernetes-admission-control.policy_type + device_policies.logscale-collector.applied device_policies.logscale-collector.policy_id + device_policies.logscale-collector.policy_type device_policies.mobile.applied + device_policies.mobile.policy_id device_policies.mobile.policy_type + device_policies.netskope.applied device_policies.netskope.policy_id + device_policies.netskope.policy_type device_policies.network-scan-content.applied + device_policies.network-scan-content.policy_id device_policies.network-scan-content.policy_type + device_policies.prevention.applied device_policies.prevention.policy_id + device_policies.prevention.policy_type device_policies.remote_response.applied + device_policies.remote_response.policy_id device_policies.remote_response.policy_type + device_policies.sca.applied device_policies.sca.policy_id + device_policies.sca.policy_type device_policies.sensor_update.applied + device_policies.sensor_update.policy_id device_policies.sensor_update.policy_type + device_policies.sensor_update.uninstall_protection device_policies.system-tray.applied + device_policies.system-tray.policy_id device_policies.system-tray.policy_type + device_policies.vulnerability-management.applied device_policies.vulnerability-management.policy_id + device_policies.vulnerability-management.policy_type device_policies.ztl.applied + device_policies.ztl.policy_id device_policies.ztl.policy_type + email external_ip + filesystem_containment_status first_login_timestamp + first_login_user first_seen + group_hash groups + host_utc_offset hostname + instance_id internet_exposure + k8s_cluster_git_version k8s_cluster_id + k8s_cluster_version kernel_version + last_login_timestamp last_login_uid + last_login_user last_login_user_sid + last_reboot last_seen + license_activation_state linux_sensor_mode + local_ip local_ip.raw + mac_address machine_domain + major_version managed_apps.airlock.version + managed_apps.automox.version managed_apps.aws-verified-access.version + managed_apps.identity-protection.version managed_apps.jumpcloud.version + managed_apps.netskope.version migration_completed_time + minor_version modified_timestamp + os_build os_product_name + os_version ou + platform_id platform_name + pod_annotations pod_host_ip4 + pod_host_ip6 pod_hostname + pod_id pod_ip4 + pod_ip6 pod_labels + pod_name pod_namespace + pod_service_account_name pointer_size + policies.applied policies.policy_id + policies.policy_type policy_id + product_type product_type_desc + reduced_functionality_mode release_group + rtr_state safe_mode + serial_number service_provider + service_provider_account_id site_name + status system_manufacturer + system_product_name tags + zone_group + device_policies.application-abuse-prevention.applieddevice_policies.application-abuse-prevention.policy_id + device_policies.application-abuse-prevention.policy_typedevice_policies.automox.applied + device_policies.automox.policy_id device_policies.automox.policy_type + device_policies.aws-verified-access.applied device_policies.aws-verified-access.policy_id + device_policies.aws-verified-access.policy_type device_policies.browser-extension.applied + device_policies.browser-extension.policy_id device_policies.browser-extension.policy_type + device_policies.cloud-ml.applied device_policies.cloud-ml.policy_id + device_policies.cloud-ml.policy_type device_policies.consumer-subscription.applied + device_policies.consumer-subscription.policy_id device_policies.consumer-subscription.policy_type + device_policies.content-update.applied device_policies.content-update.policy_id + device_policies.content-update.policy_type device_policies.data-protection-cloud.applied + device_policies.data-protection-cloud.policy_id device_policies.data-protection-cloud.policy_type + device_policies.data-protection.applied device_policies.data-protection.policy_id + device_policies.data-protection.policy_type device_policies.device_control.applied + device_policies.device_control.policy_id device_policies.device_control.policy_type + device_policies.exposure-management.applied device_policies.exposure-management.policy_id + device_policies.exposure-management.policy_type device_policies.fem-browser-extension-control.applied + device_policies.fem-browser-extension-control.policy_id + device_policies.fem-browser-extension-control.policy_type + device_policies.fim.applied device_policies.fim.policy_id + device_policies.fim.policy_type device_policies.firewall.applied + device_policies.firewall.policy_id device_policies.firewall.policy_type + device_policies.firewall.rule_set_id device_policies.host-retention.applied + device_policies.host-retention.policy_id device_policies.host-retention.policy_type + device_policies.identity-endpoint.applied device_policies.identity-endpoint.policy_id + device_policies.identity-endpoint.policy_type device_policies.identity-protection.applied + device_policies.identity-protection.policy_id device_policies.identity-protection.policy_type + device_policies.it-automation.applied device_policies.it-automation.policy_id + device_policies.it-automation.policy_type device_policies.jumpcloud.applied + device_policies.jumpcloud.policy_id device_policies.jumpcloud.policy_type + device_policies.kubernetes-admission-control.applieddevice_policies.kubernetes-admission-control.policy_id + device_policies.kubernetes-admission-control.policy_typedevice_policies.logscale-collector.applied + device_policies.logscale-collector.policy_id device_policies.logscale-collector.policy_type + device_policies.mobile.applied device_policies.mobile.policy_id + device_policies.mobile.policy_type device_policies.netskope.applied + device_policies.netskope.policy_id device_policies.netskope.policy_type + device_policies.network-scan-content.applied device_policies.network-scan-content.policy_id + device_policies.network-scan-content.policy_type device_policies.prevention.applied + device_policies.prevention.policy_id device_policies.prevention.policy_type + device_policies.remote_response.applied device_policies.remote_response.policy_id + device_policies.remote_response.policy_type device_policies.sca.applied + device_policies.sca.policy_id device_policies.sca.policy_type + device_policies.sensor_update.applied device_policies.sensor_update.policy_id + device_policies.sensor_update.policy_type device_policies.sensor_update.uninstall_protection + device_policies.system-tray.applied device_policies.system-tray.policy_id + device_policies.system-tray.policy_type device_policies.vulnerability-management.applied + device_policies.vulnerability-management.policy_id device_policies.vulnerability-management.policy_type + device_policies.ztl.applied device_policies.ztl.policy_id + device_policies.ztl.policy_type email + external_ip filesystem_containment_status + first_login_timestamp first_login_user + first_seen group_hash + groups host_utc_offset + hostname instance_id + internet_exposure k8s_cluster_git_version + k8s_cluster_id k8s_cluster_version + kernel_version last_login_timestamp + last_login_uid last_login_user + last_login_user_sid last_reboot + last_seen license_activation_state + linux_sensor_mode local_ip + local_ip.raw mac_address + machine_domain major_version + managed_apps.airlock.version managed_apps.automox.version + managed_apps.aws-verified-access.version managed_apps.identity-protection.version + managed_apps.jumpcloud.version managed_apps.netskope.version + migration_completed_time minor_version + modified_timestamp os_build + os_product_name os_version + ou platform_id + platform_name pod_annotations + pod_host_ip4 pod_host_ip6 + pod_hostname pod_id + pod_ip4 pod_ip6 + pod_labels pod_name + pod_namespace pod_service_account_name + pointer_size policies.applied + policies.policy_id policies.policy_type + policy_id product_type + product_type_desc reduced_functionality_mode + release_group rtr_state + safe_mode serial_number + service_provider service_provider_account_id + site_name status + system_manufacturer system_product_name + tags zone_group + kernel_version device_policies.browser-extension.policy_type + k8s_cluster_id policies.applied + cid policies.policy_type + device_policies.sensor_update.policy_type instance_id + groups system_product_name + device_policies.prevention.policy_id device_policies.identity-protection.policy_type + device_policies.mobile.policy_type managed_apps.aws-verified-access.version + deployment_type tags + device_policies.content-update.applied policies.policy_id + first_login_timestamp device_policies.host-retention.applied + device_policies.vulnerability-management.applied device_policies.mobile.policy_id + license_activation_state last_login_timestamp + filesystem_containment_status device_policies.device_control.policy_type + device_policies.network-scan-content.applied device_policies.airlock.policy_type + config_id_base group_hash + product_type_desc linux_sensor_mode + device_policies.fim.policy_type device_policies.network-scan-content.policy_id + device_policies.remote_response.policy_type device_policies.prevention.policy_type + internet_exposure device_policies.vulnerability-management.policy_type + k8s_cluster_git_version device_policies.aws-verified-access.applied + device_id device_policies.mobile.applied + device_policies.identity-protection.policy_id rtr_state + email chassis_type + pod_host_ip6 device_policies.ztl.policy_type + pod_id managed_apps.identity-protection.version + host_utc_offset pod_namespace + device_policies.sensor_update.policy_id pod_service_account_name + migration_completed_time k8s_cluster_version + device_policies.browser-extension.policy_id minor_version + device_policies.firewall.rule_set_id policy_id + platform_id device_policies.system-tray.applied + device_policies.data-protection.policy_type device_policies.host-retention.policy_id + device_policies.aws-verified-access.policy_type zone_group + pod_ip4 machine_domain + first_login_user device_policies.device_control.policy_id + device_policies.sensor_update.applied device_policies.kubernetes-admission-control.applied + device_policies.system-tray.policy_id device_policies.data-protection.applied + device_policies.it-automation.policy_type detection_suppression_status + device_policies.it-automation.policy_id hostname + device_policies.it-automation.applied first_seen + last_reboot last_login_uid + system_manufacturer ou + device_policies.kubernetes-admission-control.policy_id device_policies.system-tray.policy_type + device_policies.vulnerability-management.policy_id device_policies.fim.applied + managed_apps.jumpcloud.version local_ip.raw + device_policies.identity-protection.applied managed_apps.netskope.version + device_policies.device_control.applied config_id_platform + device_policies.automox.applied cpu_signature + device_policies.kubernetes-admission-control.policy_type + device_policies.content-update.policy_id device_policies.automox.policy_id + service_provider_account_id device_policies.jumpcloud.applied + managed_apps.airlock.version device_policies.aws-verified-access.policy_id + cpu_vendor mac_address + major_version device_policies.network-scan-content.policy_type + device_policies.sca.policy_id agent_load_flags + pod_name platform_name + connection_mac_address device_policies.netskope.applied + device_policies.consumer-subscription.policy_id device_policies.ztl.policy_id + local_ip chassis_type_desc + site_name bios_manufacturer + status modified_timestamp + device_policies.airlock.policy_id device_policies.host-retention.policy_type + device_policies.netskope.policy_type _all + service_provider device_policies.firewall.policy_type + pod_host_ip4 reduced_functionality_mode + config_id_build os_build + managed_apps.automox.version last_seen + device_policies.remote_response.applied device_policies.consumer-subscription.policy_type + device_policies.airlock.applied device_policies.sca.applied + device_policies.automox.policy_type device_policies.data-protection.policy_id + device_policies.consumer-subscription.applied pod_ip6 + device_policies.content-update.policy_type connection_ip + device_policies.firewall.policy_id agent_version + pod_labels device_policies.netskope.policy_id + os_product_name device_policies.firewall.applied + device_policies.browser-extension.applied device_policies.remote_response.policy_id + last_login_user device_policies.sensor_update.uninstall_protection + product_type device_policies.jumpcloud.policy_id + pod_annotations device_policies.ztl.applied + os_version default_gateway_ip + device_policies.prevention.applied last_login_user_sid + device_policies.jumpcloud.policy_type bios_version + device_policies.exposure-management.applied device_policies.exposure-management.policy_type + device_policies.exposure-management.policy_id device_policies.logscale-collector.policy_id + device_policies.logscale-collector.policy_type device_policies.logscale-collector.applied + device_policies.cloud-ml.policy_id device_policies.cloud-ml.policy_type + device_policies.cloud-ml.applied device_policies.fem-browser-extension-control.applied + device_policies.fem-browser-extension-control.policy_type + device_policies.fem-browser-extension-control.policy_id + device_policies.application-abuse-prevention.applied + device_policies.application-abuse-prevention.policy_id + device_policies.application-abuse-prevention.policy_type + device_policies.data-protection-cloud.applied + device_policies.data-protection-cloud.policy_id + device_policies.data-protection-cloud.policy_type + device_policies.identity-endpoint.applied + device_policies.identity-endpoint.policy_id + device_policies.identity-endpoint.policy_type + pointer_size safe_mode + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -307,12 +403,21 @@ def perform_action(self: object, Contain or lift containment on a host. Delete or restore a host. - Keyword arguments: - action_name -- action to perform, 'contain', 'lift_containment', - 'hide_host', 'unhide_host', 'detection_suppress', or - 'detection_unsuppress'. - body -- full body payload, not required if ids are provided as keyword. - You must use body if you are going to specify action_parameters. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/hosts/PerformActionV2 + + Keyword arguments + ----------------- + action_name : str + action to perform, 'contain', 'lift_containment', + 'hide_host', 'unhide_host', 'detection_suppress', or + 'detection_unsuppress'. + body : dict + full body payload, not required if ids are provided as keyword. + You must use body if you are going to specify action_parameters. { "action_parameters": [ { @@ -324,18 +429,19 @@ def perform_action(self: object, "string" ] } - ids -- AID(s) to perform actions against. String or list of strings. - note -- a custom note that is attached to the action. String. - parameters - full parameters payload, not required if action_name is provide as a keyword. + ids : str or list[str] + AID(s) to perform actions against. + note : str + a custom note that is attached to the action. + parameters : dict + full parameters payload, not required if action_name is provide as a keyword. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/hosts/PerformActionV2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, payload_value="ids") @@ -366,12 +472,22 @@ def perform_action(self: object, def perform_group_action(self: object, body: dict = None, parameters: dict = None, **kwargs) -> dict: """Take various actions on the provided prevention policy IDs. - Keyword arguments: - action_name -- action to perform, 'add_group_member', 'remove_all', - 'remove_group_member'. String. - action_parameters -- Action parameter payload. List of dictionaries. - body -- full body payload, not required if ids are provided as keyword. - You must use body if you are going to specify action_parameters. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/hosts/PerformActionV2 + + Keyword arguments + ----------------- + action_name : str + action to perform, 'add_group_member', 'remove_all', + 'remove_group_member' + action_parameters : list[dict] + Action parameter payload. + body : dict + full body payload, not required if ids are provided as keyword. + You must use body if you are going to specify action_parameters. { "action_parameters": [ { @@ -380,18 +496,19 @@ def perform_group_action(self: object, body: dict = None, parameters: dict = Non } ] } - disable_hostname_check -- Disable the hostname check. Boolean. - ids -- Group ID(s) to perform actions against. String or list of strings. - parameters - full parameters payload, not required if action_name is provide as a keyword. + disable_hostname_check : bool + Disable the hostname check. + ids : str or list[str] + Group ID(s) to perform actions against. + parameters : dict + full parameters payload, not required if action_name is provide as a keyword. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/hosts/PerformActionV2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = simple_action_parameter(passed_keywords=kwargs) @@ -424,19 +541,27 @@ def update_device_tags(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Append or remove one or more Falcon Grouping Tags on one or more hosts. - Keyword arguments: - action_name -- action to perform, 'add' or 'remove'. - ids -- AID(s) of the hosts to update. String or list of strings. - tags -- Tag(s) to update. String or list of strings. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/hosts/UpdateDeviceTags + + Keyword arguments + ----------------- + action_name : str + action to perform, 'add' or 'remove'. + ids : str or list[str] + AID(s) of the hosts to update. + tags : str or list[str] + Tag(s) to update. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ # BODY PAYLOAD MODEL (For Uber class reference) # { @@ -492,19 +617,28 @@ def get_device_details_v1(self: object, You can get a host's agent IDs (AIDs) from query_devices_by_filter, the Falcon console or the Streaming API. - Keyword arguments: - ids -- AID(s) of the hosts to retrieve. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/hosts/GetDeviceDetails + + Keyword arguments + ----------------- + ids : str or list[str] + AID(s) of the hosts to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -528,19 +662,28 @@ def get_device_details_v2(self: object, For most scenarios, developers should leverage the 'get_device_details' method (PostDeviceDetailsV2 operation) instead of this method. - Keyword arguments: - ids -- AID(s) of the hosts to retrieve. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/hosts/GetDeviceDetailsV2 + + Keyword arguments + ----------------- + ids : str or list[str] + AID(s) of the hosts to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -568,21 +711,31 @@ def get_device_details(self: object, a query string parameter, allowing for legacy aliases and methods to be redirected to this new method. - Keyword arguments: - body -- full body payload, not required if ids is provided as a keyword. - ids -- AID(s) of the hosts to retrieve. String or list of strings. - parameters - full parameters payload, ignored unless this is the only location of the - 'ids' list. Should not be used. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/hosts/PostDeviceDetailsV2 + + Keyword arguments + ----------------- + body : dict + full body payload, not required if ids is provided as a keyword. + ids : str or list[str] + AID(s) of the hosts to retrieve. + parameters : dict + full parameters payload, ignored unless this is the only location of the + 'ids' list. Should not be used. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ # Catch any IDs passed as arguments, will be discarded if a body payload is provided parameters = handle_single_argument(args, parameters, "ids") @@ -620,19 +773,28 @@ def get_online_state(self: object, Make a `GET` request to `QueryDevicesByFilter` or `QueryDevicesByFilterScroll` to get a list of host IDs. - Keyword arguments: - ids -- AID(s) of the hosts to retrieve state information. String or list of strings. - parameters - full parameters payload, not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/hosts/GetOnlineState.V1 + + Keyword arguments + ----------------- + ids : str or list[str] + AID(s) of the hosts to retrieve state information. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -646,39 +808,49 @@ def get_online_state(self: object, def query_hidden_devices(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve hidden hosts that match the provided filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return. [integer, 1-5000] - offset -- The integer offset to start retrieving records from. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. status.desc or hostname.asc). - Available sort fields - device_id machine_domain - agent_load_flags major_version - agent_version minor_version - bios_manufacturer modified_timestamp - bios_version os_version - config_id_base ou - config_id_build platform_id - config_id_platform platform_name - cpu_signature product_type_desc - external_ip reduced_functionality_mode - first_seen release_group - hostname serial_number - last_login_timestamp site_name - last_seen status - local_ip system_manufacturer - local_ip.raw system_product_name - mac_address - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/hosts/QueryHiddenDevices + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int (1-5000) + The maximum number of records to return. + offset : int + The integer offset to start retrieving records from. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. status.desc or hostname.asc). + Available sort fields + device_id machine_domain + agent_load_flags major_version + agent_version minor_version + bios_manufacturer modified_timestamp + bios_version os_version + config_id_base ou + config_id_build platform_id + config_id_platform platform_name + cpu_signature product_type_desc + external_ip reduced_functionality_mode + first_seen release_group + hostname serial_number + last_login_timestamp site_name + last_seen status + local_ip system_manufacturer + local_ip.raw system_product_name + mac_address + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -698,41 +870,51 @@ def query_devices_by_filter_scroll(self: object, Provides continuous pagination capability (based on offset pointer which expires after 2 minutes with no maximum limit) - Keyword arguments: - filter -- The filter expression that should be used to limit the results. - FQL syntax. [string] - limit -- The maximum number of records to return. [integer, 1-10000] - offset -- The offset to page from, provided from the previous scroll call, for the next - result set. For the first call, do not supply an offset. [string] - parameters - full parameters payload, not required if using other keywords. [dictionary] - sort -- The property to sort by. FQL syntax (e.g. status.desc or hostname.asc). - Available sort fields - device_id machine_domain - agent_load_flags major_version - agent_version minor_version - bios_manufacturer modified_timestamp - bios_version os_version - config_id_base ou - config_id_build platform_id - config_id_platform platform_name - cpu_signature product_type_desc - external_ip reduced_functionality_mode - first_seen release_group - hostname serial_number - last_login_timestamp site_name - last_seen status - local_ip system_manufacturer - local_ip.raw system_product_name - mac_address - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/hosts/QueryDevicesByFilterScroll + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. + FQL syntax. + limit : int (1-10000) + The maximum number of records to return. + offset : str + The offset to page from, provided from the previous scroll call, for the next + result set. For the first call, do not supply an offset. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. status.desc or hostname.asc). + Available sort fields + device_id machine_domain + agent_load_flags major_version + agent_version minor_version + bios_manufacturer modified_timestamp + bios_version os_version + config_id_base ou + config_id_build platform_id + config_id_platform platform_name + cpu_signature product_type_desc + external_ip reduced_functionality_mode + first_seen release_group + hostname serial_number + last_login_timestamp site_name + last_seen status + local_ip system_manufacturer + local_ip.raw system_product_name + mac_address + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -749,39 +931,49 @@ def query_devices_by_filter(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Search for hosts in your environment by platform, hostname, IP, and other criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return. [integer, 1-5000] - offset -- The integer offset to start retrieving records from. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. status.desc or hostname.asc). - Available sort fields - device_id machine_domain - agent_load_flags major_version - agent_version minor_version - bios_manufacturer modified_timestamp - bios_version os_version - config_id_base ou - config_id_build platform_id - config_id_platform platform_name - cpu_signature product_type_desc - external_ip reduced_functionality_mode - first_seen release_group - hostname serial_number - last_login_timestamp site_name - last_seen status - local_ip system_manufacturer - local_ip.raw system_product_name - mac_address - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/hosts/QueryDevicesByFilter + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int (1-5000) + The maximum number of records to return. + offset : int + The integer offset to start retrieving records from. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. status.desc or hostname.asc). + Available sort fields + device_id machine_domain + agent_load_flags major_version + agent_version minor_version + bios_manufacturer modified_timestamp + bios_version os_version + config_id_base ou + config_id_build platform_id + config_id_platform platform_name + cpu_signature product_type_desc + external_ip reduced_functionality_mode + first_seen release_group + hostname serial_number + last_login_timestamp site_name + last_seen status + local_ip system_manufacturer + local_ip.raw system_product_name + mac_address + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -800,223 +992,319 @@ def query_devices_by_filter_combined(self: object, Returns full device records. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. String. FQL syntax. - limit -- The maximum number of records to return. Integer. [1-10000] - offset -- The offset to page from, provided from the previous call as the "next" value, - for the next result set. For the first call, do not supply an offset. String. - parameters - Full parameters payload, not required if using other keywords. - sort -- The property to sort by (e.g. status.desc or hostname.asc). String. - If not specified, the default sort will be device_id.asc. - This should be supplied for each consecutive call. - Available sort fields: - _all agent_load_flags - agent_version bios_manufacturer - bios_version chassis_type - chassis_type_desc cid - config_id_base config_id_build - config_id_platform connection_ip - connection_mac_address cpu_signature - cpu_vendor criticality - default_gateway_ip deployment_type - detection_suppression_status device_id - device_policies.aidr.applied device_policies.aidr.policy_id - device_policies.aidr.policy_type device_policies.airlock.applied - device_policies.airlock.policy_id device_policies.airlock.policy_type - device_policies.application-abuse-prevention.applieddevice_policies.application-abuse-prevention.policy_id - device_policies.application-abuse-prevention.policy_typedevice_policies.automox.applied - device_policies.automox.policy_id device_policies.automox.policy_type - device_policies.aws-verified-access.applied device_policies.aws-verified-access.policy_id - device_policies.aws-verified-access.policy_type device_policies.browser-extension.applied - device_policies.browser-extension.policy_id device_policies.browser-extension.policy_type - device_policies.cloud-ml.applied device_policies.cloud-ml.policy_id - device_policies.cloud-ml.policy_type device_policies.consumer-subscription.applied - device_policies.consumer-subscription.policy_id device_policies.consumer-subscription.policy_type - device_policies.content-update.applied device_policies.content-update.policy_id - device_policies.content-update.policy_type device_policies.data-protection-cloud.applied - device_policies.data-protection-cloud.policy_id device_policies.data-protection-cloud.policy_type - device_policies.data-protection.applied device_policies.data-protection.policy_id - device_policies.data-protection.policy_type device_policies.device_control.applied - device_policies.device_control.policy_id device_policies.device_control.policy_type - device_policies.exposure-management.applied device_policies.exposure-management.policy_id - device_policies.exposure-management.policy_type device_policies.fem-browser-extension-control.applied - device_policies.fem-browser-extension-control.policy_id - device_policies.fem-browser-extension-control.policy_type - device_policies.fim.applied device_policies.fim.policy_id - device_policies.fim.policy_type device_policies.firewall.applied - device_policies.firewall.policy_id device_policies.firewall.policy_type - device_policies.firewall.rule_set_id device_policies.host-retention.applied - device_policies.host-retention.policy_id device_policies.host-retention.policy_type - device_policies.identity-endpoint.applied device_policies.identity-endpoint.policy_id - device_policies.identity-endpoint.policy_type device_policies.identity-protection.applied - device_policies.identity-protection.policy_id device_policies.identity-protection.policy_type - device_policies.it-automation.applied device_policies.it-automation.policy_id - device_policies.it-automation.policy_type device_policies.jumpcloud.applied - device_policies.jumpcloud.policy_id device_policies.jumpcloud.policy_type - device_policies.kubernetes-admission-control.applieddevice_policies.kubernetes-admission-control.policy_id - device_policies.kubernetes-admission-control.policy_typedevice_policies.logscale-collector.applied - device_policies.logscale-collector.policy_id device_policies.logscale-collector.policy_type - device_policies.mobile.applied device_policies.mobile.policy_id - device_policies.mobile.policy_type device_policies.netskope.applied - device_policies.netskope.policy_id device_policies.netskope.policy_type - device_policies.network-scan-content.applied device_policies.network-scan-content.policy_id - device_policies.network-scan-content.policy_type device_policies.prevention.applied - device_policies.prevention.policy_id device_policies.prevention.policy_type - device_policies.remote_response.applied device_policies.remote_response.policy_id - device_policies.remote_response.policy_type device_policies.sca.applied - device_policies.sca.policy_id device_policies.sca.policy_type - device_policies.sensor_update.applied device_policies.sensor_update.policy_id - device_policies.sensor_update.policy_type device_policies.sensor_update.uninstall_protection - device_policies.system-tray.applied device_policies.system-tray.policy_id - device_policies.system-tray.policy_type device_policies.vulnerability-management.applied - device_policies.vulnerability-management.policy_id device_policies.vulnerability-management.policy_type - device_policies.ztl.applied device_policies.ztl.policy_id - device_policies.ztl.policy_type email - external_ip filesystem_containment_status - first_login_timestamp first_login_user - first_seen group_hash - groups host_utc_offset - hostname instance_id - internet_exposure k8s_cluster_git_version - k8s_cluster_id k8s_cluster_version - kernel_version last_login_timestamp - last_login_uid last_login_user - last_login_user_sid last_reboot - last_seen license_activation_state - linux_sensor_mode local_ip - local_ip.raw mac_address - machine_domain major_version - managed_apps.airlock.version managed_apps.automox.version - managed_apps.aws-verified-access.version managed_apps.identity-protection.version - managed_apps.jumpcloud.version managed_apps.netskope.version - migration_completed_time minor_version - modified_timestamp os_build - os_product_name os_version - ou platform_id - platform_name pod_annotations - pod_host_ip4 pod_host_ip6 - pod_hostname pod_id - pod_ip4 pod_ip6 - pod_labels pod_name - pod_namespace pod_service_account_name - pointer_size policies.applied - policies.policy_id policies.policy_type - policy_id product_type - product_type_desc reduced_functionality_mode - release_group rtr_state - safe_mode serial_number - service_provider service_provider_account_id - site_name status - system_manufacturer system_product_name - tags zone_group - kernel_version device_policies.browser-extension.policy_type - k8s_cluster_id policies.applied - cid policies.policy_type - device_policies.sensor_update.policy_type instance_id - groups system_product_name - device_policies.prevention.policy_id device_policies.identity-protection.policy_type - device_policies.mobile.policy_type managed_apps.aws-verified-access.version - deployment_type tags - device_policies.content-update.applied policies.policy_id - first_login_timestamp device_policies.host-retention.applied - device_policies.vulnerability-management.applied device_policies.mobile.policy_id - license_activation_state last_login_timestamp - filesystem_containment_status device_policies.device_control.policy_type - device_policies.network-scan-content.applied device_policies.airlock.policy_type - config_id_base group_hash - product_type_desc linux_sensor_mode - device_policies.fim.policy_type device_policies.network-scan-content.policy_id - device_policies.remote_response.policy_type device_policies.prevention.policy_type - internet_exposure device_policies.vulnerability-management.policy_type - k8s_cluster_git_version device_policies.aws-verified-access.applied - device_id device_policies.mobile.applied - device_policies.identity-protection.policy_id rtr_state - email chassis_type - pod_host_ip6 device_policies.ztl.policy_type - pod_id managed_apps.identity-protection.version - host_utc_offset pod_namespace - device_policies.sensor_update.policy_id pod_service_account_name - migration_completed_time k8s_cluster_version - device_policies.browser-extension.policy_id minor_version - device_policies.firewall.rule_set_id policy_id - platform_id device_policies.system-tray.applied - device_policies.data-protection.policy_type device_policies.host-retention.policy_id - device_policies.aws-verified-access.policy_type zone_group - pod_ip4 machine_domain - first_login_user device_policies.device_control.policy_id - device_policies.sensor_update.applied device_policies.kubernetes-admission-control.applied - device_policies.system-tray.policy_id device_policies.data-protection.applied - device_policies.it-automation.policy_type detection_suppression_status - device_policies.it-automation.policy_id hostname - device_policies.it-automation.applied first_seen - last_reboot last_login_uid - system_manufacturer ou - device_policies.kubernetes-admission-control.policy_id device_policies.system-tray.policy_type - device_policies.vulnerability-management.policy_id device_policies.fim.applied - managed_apps.jumpcloud.version local_ip.raw - device_policies.identity-protection.applied managed_apps.netskope.version - device_policies.device_control.applied config_id_platform - device_policies.automox.applied cpu_signature - device_policies.kubernetes-admission-control.policy_type - device_policies.content-update.policy_id device_policies.automox.policy_id - service_provider_account_id device_policies.jumpcloud.applied - managed_apps.airlock.version device_policies.aws-verified-access.policy_id - cpu_vendor mac_address - major_version device_policies.network-scan-content.policy_type - device_policies.sca.policy_id agent_load_flags - pod_name platform_name - connection_mac_address device_policies.netskope.applied - device_policies.consumer-subscription.policy_id device_policies.ztl.policy_id - local_ip chassis_type_desc - site_name bios_manufacturer - status modified_timestamp - device_policies.airlock.policy_id device_policies.host-retention.policy_type - device_policies.netskope.policy_type _all - service_provider device_policies.firewall.policy_type - pod_host_ip4 reduced_functionality_mode - config_id_build os_build - managed_apps.automox.version last_seen - device_policies.remote_response.applied device_policies.consumer-subscription.policy_type - device_policies.airlock.applied device_policies.sca.applied - device_policies.automox.policy_type device_policies.data-protection.policy_id - device_policies.consumer-subscription.applied pod_ip6 - device_policies.content-update.policy_type connection_ip - device_policies.firewall.policy_id agent_version - pod_labels device_policies.netskope.policy_id - os_product_name device_policies.firewall.applied - device_policies.browser-extension.applied device_policies.remote_response.policy_id - last_login_user device_policies.sensor_update.uninstall_protection - product_type device_policies.jumpcloud.policy_id - pod_annotations device_policies.ztl.applied - os_version default_gateway_ip - device_policies.prevention.applied last_login_user_sid - device_policies.jumpcloud.policy_type bios_version - device_policies.exposure-management.applied device_policies.exposure-management.policy_type - device_policies.exposure-management.policy_id device_policies.logscale-collector.policy_id - device_policies.logscale-collector.policy_type device_policies.logscale-collector.applied - device_policies.cloud-ml.policy_id device_policies.cloud-ml.policy_type - device_policies.cloud-ml.applied device_policies.fem-browser-extension-control.applied - device_policies.fem-browser-extension-control.policy_id - device_policies.fem-browser-extension-control.policy_type - device_policies.application-abuse-prevention.applied - device_policies.application-abuse-prevention.policy_id - device_policies.application-abuse-prevention.policy_type - device_policies.data-protection-cloud.applied - device_policies.data-protection-cloud.policy_id - device_policies.data-protection-cloud.policy_type - device_policies.identity-endpoint.applied - device_policies.identity-endpoint.policy_id - device_policies.identity-endpoint.policy_type - pointer_size safe_mode - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/hosts/CombinedDevicesByFilter + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. String. FQL syntax. + limit : int + The maximum number of records to return. Integer. [1-10000] + offset : str + The offset to page from, provided from the previous call as the "next" value, + for the next result set. For the first call, do not supply an offset. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by (e.g. status.desc or hostname.asc). String. + If not specified, the default sort will be device_id.asc. + This should be supplied for each consecutive call. + Available sort fields: + _all agent_load_flags + agent_version bios_manufacturer + bios_version chassis_type + chassis_type_desc cid + cloud_service_compartment_id config_id_base + config_id_build config_id_platform + connection_ip connection_mac_address + cpu_signature cpu_vendor + criticality default_gateway_ip + deployment_type detection_suppression_status + device_id device_policies.aidr.applied + device_policies.aidr.policy_id device_policies.aidr.policy_type + device_policies.airlock.applied device_policies.airlock.policy_id + device_policies.airlock.policy_type device_policies.application-abuse-prevention.applied + device_policies.application-abuse-prevention.policy_iddevice_policies.application-abuse-prevention.policy_type + device_policies.automox.applied device_policies.automox.policy_id + device_policies.automox.policy_type device_policies.aws-verified-access.applied + device_policies.aws-verified-access.policy_id device_policies.aws-verified-access.policy_type + device_policies.browser-extension.applied device_policies.browser-extension.policy_id + device_policies.browser-extension.policy_type device_policies.cloud-ml.applied + device_policies.cloud-ml.policy_id device_policies.cloud-ml.policy_type + device_policies.consumer-subscription.applied device_policies.consumer-subscription.policy_id + device_policies.consumer-subscription.policy_type device_policies.content-update.applied + device_policies.content-update.policy_id device_policies.content-update.policy_type + device_policies.data-protection-cloud.applied device_policies.data-protection-cloud.policy_id + device_policies.data-protection-cloud.policy_type device_policies.data-protection.applied + device_policies.data-protection.policy_id device_policies.data-protection.policy_type + device_policies.device_control.applied device_policies.device_control.policy_id + device_policies.device_control.policy_type device_policies.exposure-management.applied + device_policies.exposure-management.policy_id device_policies.exposure-management.policy_type + device_policies.fem-browser-extension-control.applied device_policies.fem-browser-extension-control.policy_id + device_policies.fem-browser-extension-control.policy_typedevice_policies.fim.applied + device_policies.fim.policy_id device_policies.fim.policy_type + device_policies.firewall.applied device_policies.firewall.policy_id + device_policies.firewall.policy_type device_policies.firewall.rule_set_id + device_policies.host-retention.applied device_policies.host-retention.policy_id + device_policies.host-retention.policy_type device_policies.identity-endpoint.applied + device_policies.identity-endpoint.policy_id device_policies.identity-endpoint.policy_type + device_policies.identity-protection.applied device_policies.identity-protection.policy_id + device_policies.identity-protection.policy_type device_policies.it-automation.applied + device_policies.it-automation.policy_id device_policies.it-automation.policy_type + device_policies.jumpcloud.applied device_policies.jumpcloud.policy_id + device_policies.jumpcloud.policy_type device_policies.kubernetes-admission-control.applied + device_policies.kubernetes-admission-control.policy_iddevice_policies.kubernetes-admission-control.policy_type + device_policies.logscale-collector.applied device_policies.logscale-collector.policy_id + device_policies.logscale-collector.policy_type device_policies.mobile.applied + device_policies.mobile.policy_id device_policies.mobile.policy_type + device_policies.netskope.applied device_policies.netskope.policy_id + device_policies.netskope.policy_type device_policies.network-scan-content.applied + device_policies.network-scan-content.policy_id device_policies.network-scan-content.policy_type + device_policies.prevention.applied device_policies.prevention.policy_id + device_policies.prevention.policy_type device_policies.remote_response.applied + device_policies.remote_response.policy_id device_policies.remote_response.policy_type + device_policies.sca.applied device_policies.sca.policy_id + device_policies.sca.policy_type device_policies.sensor_update.applied + device_policies.sensor_update.policy_id device_policies.sensor_update.policy_type + device_policies.sensor_update.uninstall_protection device_policies.system-tray.applied + device_policies.system-tray.policy_id device_policies.system-tray.policy_type + device_policies.vulnerability-management.applied device_policies.vulnerability-management.policy_id + device_policies.vulnerability-management.policy_type device_policies.ztl.applied + device_policies.ztl.policy_id device_policies.ztl.policy_type + email external_ip + filesystem_containment_status first_login_timestamp + first_login_user first_seen + group_hash groups + host_utc_offset hostname + instance_id internet_exposure + k8s_cluster_git_version k8s_cluster_id + k8s_cluster_version kernel_version + last_login_timestamp last_login_uid + last_login_user last_login_user_sid + last_reboot last_seen + license_activation_state linux_sensor_mode + local_ip local_ip.raw + mac_address machine_domain + major_version managed_apps.airlock.version + managed_apps.automox.version managed_apps.aws-verified-access.version + managed_apps.identity-protection.version managed_apps.jumpcloud.version + managed_apps.netskope.version migration_completed_time + minor_version modified_timestamp + os_build os_product_name + os_version ou + platform_id platform_name + pod_annotations pod_host_ip4 + pod_host_ip6 pod_hostname + pod_id pod_ip4 + pod_ip6 pod_labels + pod_name pod_namespace + pod_service_account_name pointer_size + policies.applied policies.policy_id + policies.policy_type policy_id + product_type product_type_desc + reduced_functionality_mode release_group + rtr_state safe_mode + serial_number service_provider + service_provider_account_id site_name + status system_manufacturer + system_product_name tags + zone_group + device_policies.application-abuse-prevention.applieddevice_policies.application-abuse-prevention.policy_id + device_policies.application-abuse-prevention.policy_typedevice_policies.automox.applied + device_policies.automox.policy_id device_policies.automox.policy_type + device_policies.aws-verified-access.applied device_policies.aws-verified-access.policy_id + device_policies.aws-verified-access.policy_type device_policies.browser-extension.applied + device_policies.browser-extension.policy_id device_policies.browser-extension.policy_type + device_policies.cloud-ml.applied device_policies.cloud-ml.policy_id + device_policies.cloud-ml.policy_type device_policies.consumer-subscription.applied + device_policies.consumer-subscription.policy_id device_policies.consumer-subscription.policy_type + device_policies.content-update.applied device_policies.content-update.policy_id + device_policies.content-update.policy_type device_policies.data-protection-cloud.applied + device_policies.data-protection-cloud.policy_id device_policies.data-protection-cloud.policy_type + device_policies.data-protection.applied device_policies.data-protection.policy_id + device_policies.data-protection.policy_type device_policies.device_control.applied + device_policies.device_control.policy_id device_policies.device_control.policy_type + device_policies.exposure-management.applied device_policies.exposure-management.policy_id + device_policies.exposure-management.policy_type device_policies.fem-browser-extension-control.applied + device_policies.fem-browser-extension-control.policy_id + device_policies.fem-browser-extension-control.policy_type + device_policies.fim.applied device_policies.fim.policy_id + device_policies.fim.policy_type device_policies.firewall.applied + device_policies.firewall.policy_id device_policies.firewall.policy_type + device_policies.firewall.rule_set_id device_policies.host-retention.applied + device_policies.host-retention.policy_id device_policies.host-retention.policy_type + device_policies.identity-endpoint.applied device_policies.identity-endpoint.policy_id + device_policies.identity-endpoint.policy_type device_policies.identity-protection.applied + device_policies.identity-protection.policy_id device_policies.identity-protection.policy_type + device_policies.it-automation.applied device_policies.it-automation.policy_id + device_policies.it-automation.policy_type device_policies.jumpcloud.applied + device_policies.jumpcloud.policy_id device_policies.jumpcloud.policy_type + device_policies.kubernetes-admission-control.applieddevice_policies.kubernetes-admission-control.policy_id + device_policies.kubernetes-admission-control.policy_typedevice_policies.logscale-collector.applied + device_policies.logscale-collector.policy_id device_policies.logscale-collector.policy_type + device_policies.mobile.applied device_policies.mobile.policy_id + device_policies.mobile.policy_type device_policies.netskope.applied + device_policies.netskope.policy_id device_policies.netskope.policy_type + device_policies.network-scan-content.applied device_policies.network-scan-content.policy_id + device_policies.network-scan-content.policy_type device_policies.prevention.applied + device_policies.prevention.policy_id device_policies.prevention.policy_type + device_policies.remote_response.applied device_policies.remote_response.policy_id + device_policies.remote_response.policy_type device_policies.sca.applied + device_policies.sca.policy_id device_policies.sca.policy_type + device_policies.sensor_update.applied device_policies.sensor_update.policy_id + device_policies.sensor_update.policy_type device_policies.sensor_update.uninstall_protection + device_policies.system-tray.applied device_policies.system-tray.policy_id + device_policies.system-tray.policy_type device_policies.vulnerability-management.applied + device_policies.vulnerability-management.policy_id device_policies.vulnerability-management.policy_type + device_policies.ztl.applied device_policies.ztl.policy_id + device_policies.ztl.policy_type email + external_ip filesystem_containment_status + first_login_timestamp first_login_user + first_seen group_hash + groups host_utc_offset + hostname instance_id + internet_exposure k8s_cluster_git_version + k8s_cluster_id k8s_cluster_version + kernel_version last_login_timestamp + last_login_uid last_login_user + last_login_user_sid last_reboot + last_seen license_activation_state + linux_sensor_mode local_ip + local_ip.raw mac_address + machine_domain major_version + managed_apps.airlock.version managed_apps.automox.version + managed_apps.aws-verified-access.version managed_apps.identity-protection.version + managed_apps.jumpcloud.version managed_apps.netskope.version + migration_completed_time minor_version + modified_timestamp os_build + os_product_name os_version + ou platform_id + platform_name pod_annotations + pod_host_ip4 pod_host_ip6 + pod_hostname pod_id + pod_ip4 pod_ip6 + pod_labels pod_name + pod_namespace pod_service_account_name + pointer_size policies.applied + policies.policy_id policies.policy_type + policy_id product_type + product_type_desc reduced_functionality_mode + release_group rtr_state + safe_mode serial_number + service_provider service_provider_account_id + site_name status + system_manufacturer system_product_name + tags zone_group + kernel_version device_policies.browser-extension.policy_type + k8s_cluster_id policies.applied + cid policies.policy_type + device_policies.sensor_update.policy_type instance_id + groups system_product_name + device_policies.prevention.policy_id device_policies.identity-protection.policy_type + device_policies.mobile.policy_type managed_apps.aws-verified-access.version + deployment_type tags + device_policies.content-update.applied policies.policy_id + first_login_timestamp device_policies.host-retention.applied + device_policies.vulnerability-management.applied device_policies.mobile.policy_id + license_activation_state last_login_timestamp + filesystem_containment_status device_policies.device_control.policy_type + device_policies.network-scan-content.applied device_policies.airlock.policy_type + config_id_base group_hash + product_type_desc linux_sensor_mode + device_policies.fim.policy_type device_policies.network-scan-content.policy_id + device_policies.remote_response.policy_type device_policies.prevention.policy_type + internet_exposure device_policies.vulnerability-management.policy_type + k8s_cluster_git_version device_policies.aws-verified-access.applied + device_id device_policies.mobile.applied + device_policies.identity-protection.policy_id rtr_state + email chassis_type + pod_host_ip6 device_policies.ztl.policy_type + pod_id managed_apps.identity-protection.version + host_utc_offset pod_namespace + device_policies.sensor_update.policy_id pod_service_account_name + migration_completed_time k8s_cluster_version + device_policies.browser-extension.policy_id minor_version + device_policies.firewall.rule_set_id policy_id + platform_id device_policies.system-tray.applied + device_policies.data-protection.policy_type device_policies.host-retention.policy_id + device_policies.aws-verified-access.policy_type zone_group + pod_ip4 machine_domain + first_login_user device_policies.device_control.policy_id + device_policies.sensor_update.applied device_policies.kubernetes-admission-control.applied + device_policies.system-tray.policy_id device_policies.data-protection.applied + device_policies.it-automation.policy_type detection_suppression_status + device_policies.it-automation.policy_id hostname + device_policies.it-automation.applied first_seen + last_reboot last_login_uid + system_manufacturer ou + device_policies.kubernetes-admission-control.policy_id device_policies.system-tray.policy_type + device_policies.vulnerability-management.policy_id device_policies.fim.applied + managed_apps.jumpcloud.version local_ip.raw + device_policies.identity-protection.applied managed_apps.netskope.version + device_policies.device_control.applied config_id_platform + device_policies.automox.applied cpu_signature + device_policies.kubernetes-admission-control.policy_type + device_policies.content-update.policy_id device_policies.automox.policy_id + service_provider_account_id device_policies.jumpcloud.applied + managed_apps.airlock.version device_policies.aws-verified-access.policy_id + cpu_vendor mac_address + major_version device_policies.network-scan-content.policy_type + device_policies.sca.policy_id agent_load_flags + pod_name platform_name + connection_mac_address device_policies.netskope.applied + device_policies.consumer-subscription.policy_id device_policies.ztl.policy_id + local_ip chassis_type_desc + site_name bios_manufacturer + status modified_timestamp + device_policies.airlock.policy_id device_policies.host-retention.policy_type + device_policies.netskope.policy_type _all + service_provider device_policies.firewall.policy_type + pod_host_ip4 reduced_functionality_mode + config_id_build os_build + managed_apps.automox.version last_seen + device_policies.remote_response.applied device_policies.consumer-subscription.policy_type + device_policies.airlock.applied device_policies.sca.applied + device_policies.automox.policy_type device_policies.data-protection.policy_id + device_policies.consumer-subscription.applied pod_ip6 + device_policies.content-update.policy_type connection_ip + device_policies.firewall.policy_id agent_version + pod_labels device_policies.netskope.policy_id + os_product_name device_policies.firewall.applied + device_policies.browser-extension.applied device_policies.remote_response.policy_id + last_login_user device_policies.sensor_update.uninstall_protection + product_type device_policies.jumpcloud.policy_id + pod_annotations device_policies.ztl.applied + os_version default_gateway_ip + device_policies.prevention.applied last_login_user_sid + device_policies.jumpcloud.policy_type bios_version + device_policies.exposure-management.applied device_policies.exposure-management.policy_type + device_policies.exposure-management.policy_id device_policies.logscale-collector.policy_id + device_policies.logscale-collector.policy_type device_policies.logscale-collector.applied + device_policies.cloud-ml.policy_id device_policies.cloud-ml.policy_type + device_policies.cloud-ml.applied device_policies.fem-browser-extension-control.applied + device_policies.fem-browser-extension-control.policy_id + device_policies.fem-browser-extension-control.policy_type + device_policies.application-abuse-prevention.applied + device_policies.application-abuse-prevention.policy_id + device_policies.application-abuse-prevention.policy_type + device_policies.data-protection-cloud.applied + device_policies.data-protection-cloud.policy_id + device_policies.data-protection-cloud.policy_type + device_policies.identity-endpoint.applied + device_policies.identity-endpoint.policy_id + device_policies.identity-endpoint.policy_type + pointer_size safe_mode + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1034,24 +1322,33 @@ def query_device_login_history_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve details about recent login sessions for a set of devices. - Keyword arguments: - body -- full body payload, not required when ids keyword is provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/hosts/QueryDeviceLoginHistory + + Keyword arguments + ----------------- + body : dict + full body payload, not required when ids keyword is provided. { "ids": [ "string" ] } - ids -- AID(s) of the hosts to retrieve. String or list of strings. Supports a maximum of 500 IDs. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/hosts/QueryDeviceLoginHistory + ids : str or list[str] + AID(s) of the hosts to retrieve. String or list of strings. Supports a maximum of 500 IDs. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_arguments=args, @@ -1079,27 +1376,39 @@ def query_device_login_history_v2(self: object, A max of 10 device ids can be specified - Keyword arguments: - body -- full body payload, not required when ids keyword is provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/hosts/QueryDeviceLoginHistoryV2 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when ids keyword is provided. { "ids": [ "string" ] } - ids -- AID(s) of the hosts to retrieve. String or list of strings. Supports a maximum of 10 IDs. - limit -- The maximum number of results to return. Integer. Default: 10, Max: 100 - from -- The inclusive beginning of the time window to search. String. - to -- The inclusive end of the time window to search. String. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/hosts/QueryDeviceLoginHistoryV2 + ids : str or list[str] + AID(s) of the hosts to retrieve. String or list of strings. Supports a maximum of 10 IDs. + limit : int + The maximum number of results to return. Integer. Default: 10, Max: 100 + from : str + The inclusive beginning of the time window to search. + to : str + The inclusive end of the time window to search. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_arguments=args, @@ -1124,24 +1433,33 @@ def query_network_address_history(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve history of IP and MAC addresses of devices. - Keyword arguments: - body -- full body payload, not required when ids keyword is provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/hosts/QueryGetNetworkAddressHistoryV1 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when ids keyword is provided. { "ids": [ "string" ] } - ids -- AID(s) of the hosts to retrieve. String or list of strings. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/hosts/QueryGetNetworkAddressHistoryV1 + ids : str or list[str] + AID(s) of the hosts to retrieve. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_arguments=args, @@ -1165,8 +1483,16 @@ def devices_actions_delete_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Permanently delete hosts from the system. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/hosts/DevicesActionsDeleteV1 + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "action_parameters": [ { @@ -1179,18 +1505,19 @@ def devices_actions_delete_v1(self: object, "string" ] } - action_parameters -- The action_parameters value. List. - filter -- The filter value. String. - ids -- The ids value. List. + action_parameters : list + The action_parameters value. + filter : str + The filter value. + ids : str or list[str] + The ids value. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/hosts/DevicesActionsDeleteV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = devices_actions_delete_v1_payload(passed_keywords=kwargs) diff --git a/src/falconpy/identity_protection.py b/src/falconpy/identity_protection.py index 55a4b41d1..7389d98b5 100644 --- a/src/falconpy/identity_protection.py +++ b/src/falconpy/identity_protection.py @@ -63,28 +63,36 @@ def graphql(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[ Allows to retrieve entities, timeline activities, identity-based incidents and security assessment. Allows to perform actions on entities and identity-based incidents. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html + /identity-protection/api.preempt.proxy.post.graphql + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "query": "string" } - query -- JSON-similar string. (GraphQL syntax) - variables -- variables to use for interpolation. Dictionary. + query : str + JSON-similar string. (GraphQL syntax) + variables : str + variables to use for interpolation. Dictionary. + Currently using a non-standard body payload format. + Example payload: + { + "query": "{\n entities(first: 1)\n {\n nodes {\n entityId \n }\n }\n}" + } This method only supports keywords for providing arguments. - Currently using a non-standard body payload format. - Example payload: - { - "query": "{\n entities(first: 1)\n {\n nodes {\n entityId \n }\n }\n}" - } - - Returns: dict object containing API response. - - HTTP Method: POST - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html - /identity-protection/api.preempt.proxy.post.graphql + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = {} @@ -103,8 +111,16 @@ def graphql(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[ def get_sensor_aggregates(self: object, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get sensor aggregates as specified via json in request body. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/identity-protection/GetSensorAggregates + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -139,38 +155,44 @@ def get_sensor_aggregates(self: object, body: list = None, **kwargs) -> Union[Di "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/identity-protection/GetSensorAggregates + Returns + ------- + dict + Dictionary object containing API response. """ if not body: # Similar to 664: Detects aggregates expects a list @@ -187,23 +209,30 @@ def get_sensor_aggregates(self: object, body: list = None, **kwargs) -> Union[Di def get_sensor_details(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get details on one or more sensors by providing device IDs. - Keyword arguments: - body -- full body payload, not required if ids are provided as keyword. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/identity-protection/GetSensorDetails + + Keyword arguments + ----------------- + body : dict + full body payload, not required if ids are provided as keyword. { "ids": [ "string" ] } - ids -- Sensor ID(s) to retrieve. String or list of strings. (Max: 5,000) + ids : str or list[str] + Sensor ID(s) to retrieve. String or list of strings. (Max: 5,000) This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/identity-protection/GetSensorDetails + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, payload_value="ids") @@ -223,19 +252,28 @@ def get_policy_rules(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get policy rules. - Keyword arguments: - ids -- Rule IDs. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/identity-protection/api.preempt.proxy.get.policy-rules + + Keyword arguments + ----------------- + ids : str or list[str] + Rule IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -249,10 +287,20 @@ def get_policy_rules(self: object, def create_policy_rule(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create policy rule. - Keyword arguments: - action -- Action to perform. String. - activity -- Activities that trigger the policy. Dictionary. - body -- Full body payload as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/identity-protection/api.preempt.proxy.post.policy-rules + + Keyword arguments + ----------------- + action : str + Action to perform. + activity : dict + Activities that trigger the policy. + body : dict + Full body payload as a dictionary. Not required if using other keywords. { "action": "string", "activity": { @@ -332,25 +380,30 @@ def create_policy_rule(self: object, body: dict = None, **kwargs) -> Union[Dict[ }, "trigger": "string" } - destination -- Activity destination. Dictionary. - enabled -- Flag indicating if the policy rule should be enabled. Boolean. - name -- Policy rule name. - simulation_mode -- Simulate the policy action instead of actually taking action. Boolean. - simulationMode will also be accepted for this argument. - source_endpoint -- Source endpoint details. Dictionary. - sourceEndpoint will also be accepted for this argument. - source_user -- Source user details. Dictionary. - sourceUser will also be accepted for this argument. - trigger -- Policy rule trigger. String. + destination : dict + Activity destination. + enabled : bool + Flag indicating if the policy rule should be enabled. + name : str + Policy rule name. + simulation_mode : str + Simulate the policy action instead of actually taking action. Boolean. + simulationMode will also be accepted for this argument. + source_endpoint : str + Source endpoint details. Dictionary. + sourceEndpoint will also be accepted for this argument. + source_user : str + Source user details. Dictionary. + sourceUser will also be accepted for this argument. + trigger : str + Policy rule trigger. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/identity-protection/api.preempt.proxy.post.policy-rules + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = idp_policy_payload(passed_keywords=kwargs) @@ -371,20 +424,29 @@ def delete_policy_rules(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete policy rules. - Keyword arguments: - ids -- Rule IDs to delete. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html - #/identity-protection/api.preempt.proxy.delete.policy-rules + #/identity-protection/api.preempt.proxy.delete.policy-rules + + Keyword arguments + ----------------- + ids : str or list[str] + Rule IDs to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -398,23 +460,33 @@ def delete_policy_rules(self: object, def query_sensors(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search for sensors in your environment by providing hostname, IP, and other criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-200] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. Ex: hostanme.desc or status.asc - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/identity-protections/QuerySensorsByFilter + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-200] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. Ex: hostanme.desc or status.asc + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -428,21 +500,30 @@ def query_sensors(self: object, parameters: dict = None, **kwargs) -> Union[Dict def query_policy_rules(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query policy rule IDs. - Keyword arguments: - enabled -- Whether the rule is enabled. Boolean. - simulation_mode -- Whether the rule is in simulation mode. Boolean. - name -- Rule name. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html - #/identity-protection/api.preempt.proxy.get.policy-rules.query + #/identity-protection/api.preempt.proxy.get.policy-rules.query + + Keyword arguments + ----------------- + enabled : bool + Whether the rule is enabled. + simulation_mode : bool + Whether the rule is in simulation mode. + name : str + Rule name. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/image_assessment_policies.py b/src/falconpy/image_assessment_policies.py index cda52dc70..bd81e53b8 100644 --- a/src/falconpy/image_assessment_policies.py +++ b/src/falconpy/image_assessment_policies.py @@ -63,12 +63,20 @@ def read_policies(self: object) -> Union[Dict[str, Union[int, dict]], Result]: This method does not accept arguments. - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/image-assessment-policies/ReadPolicies + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -80,23 +88,31 @@ def read_policies(self: object) -> Union[Dict[str, Union[int, dict]], Result]: def create_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create Image Assessment policies. - Keyword arguments: - body -- Full body payload, not required when using other arguments. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/image-assessment-policies/CreatePolicies + + Keyword arguments + ----------------- + body : dict + Full body payload, not required when using other arguments. { "description": "string", "name": "string" } - description -- Policy description. String. - name -- Policy name. String. + description : str + Policy description. + name : str + Policy name. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/image-assessment-policies/CreatePolicies + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = image_policy_payload(passed_keywords=kwargs) @@ -116,41 +132,53 @@ def update_policies(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update Image Assessment Policy entities. - Keyword arguments: - id -- Image Assessment Policy entity UUID - body -- Full body payload in JSON format. Not required when using other keywords. - { - "description": "string", - "is_enabled": boolean, - "name": "string", - "policy_data": { - "rules": [ - { - "action": "string", - "policy_rules_data": { - "conditions": [ - {} - ] - } - } - ] - } - } - description -- Policy description. String. - is_enabled -- Flag indicating if the policy is enabled. Boolean. - name -- Policy name. String. - policy_data -- Policy detail in JSON format. Dictionary. - rules -- List of rules for the policy. List of dictionaries or a single dictionary. - Overridden if policy_data is supplied. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/image-assessment-policies/UpdatePolicies + + Keyword arguments + ----------------- + id : str + Image Assessment Policy entity UUID + body : dict + Full body payload in JSON format. Not required when using other keywords. + { + "description": "string", + "is_enabled": boolean, + "name": "string", + "policy_data": { + "rules": [ + { + "action": "string", + "policy_rules_data": { + "conditions": [ + {} + ] + } + } + ] + } + } + description : str + Policy description. + is_enabled : bool + Flag indicating if the policy is enabled. + name : str + Policy name. + policy_data : dict + Policy detail in JSON format. + rules : str + List of rules for the policy. List of dictionaries or a single dictionary. + Overridden if policy_data is supplied. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = image_policy_payload(passed_keywords=kwargs) @@ -168,19 +196,28 @@ def update_policies(self: object, def delete_policy(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete Image Assessment Policy by policy UUID. - Keyword arguments: - id -- Image Assessment Policy entity UUID. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/image-assessment-policies/DeletePolicy + + Keyword arguments + ----------------- + id : str + Image Assessment Policy entity UUID. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -197,12 +234,20 @@ def read_policy_exclusions(self: object) -> Union[Dict[str, Union[int, dict]], R This method does not accept arguments. - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/image-assessment-policies/ReadPolicyExclusions + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -214,34 +259,45 @@ def read_policy_exclusions(self: object) -> Union[Dict[str, Union[int, dict]], R def update_policy_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update Image Assessment Policy Exclusion entities. - Keyword arguments: - body -- Full body payload in JSON format, not required if using other keywords. - { - "conditions": [ + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/image-assessment-policies/UpdatePolicyExclusions + + Keyword arguments + ----------------- + body : dict + Full body payload in JSON format, not required if using other keywords. { - "description": "string", - "prop": "string", - "ttl": 0, - "value": [ - "string" + "conditions": [ + { + "description": "string", + "prop": "string", + "ttl": 0, + "value": [ + "string" + ] + } ] } - ] - } - conditions -- List of conditions to apply to the exclusion policy. List of dictionaries. - description -- Condition description. Ignored if conditions list is provided. String. - prop -- Condition property. Ignored if conditions list is provided. String. - ttl -- Condition time to live. Ignored if conditions list is provided. Integer. - value -- Condition values. Ignored if conditions list is provided. List of strings. + conditions : list[dict] + List of conditions to apply to the exclusion policy. + description : str + Condition description. Ignored if conditions list is provided. + prop : str + Condition property. Ignored if conditions list is provided. + ttl : int + Condition time to live. Ignored if conditions list is provided. + value : list[str] + Condition values. Ignored if conditions list is provided. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/image-assessment-policies/UpdatePolicyExclusions + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = image_exclusions_payload(passed_keywords=kwargs) @@ -260,12 +316,20 @@ def read_policy_groups(self: object) -> Union[Dict[str, Union[int, dict]], Resul This method does not accept arguments. - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/image-assessment-policies/ReadPolicyGroups + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -277,8 +341,16 @@ def read_policy_groups(self: object) -> Union[Dict[str, Union[int, dict]], Resul def create_policy_groups(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create Image Assessment Policy Group entities. - Keyword arguments: - body -- Full body payload in JSON format, not required whe using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/image-assessment-policies/CreatePolicyGroups + + Keyword arguments + ----------------- + body : dict + Full body payload in JSON format, not required whe using other keywords. { "description": "string", "name": "string", @@ -289,21 +361,24 @@ def create_policy_groups(self: object, body: dict = None, **kwargs) -> Union[Dic }, "policy_id": "string" } - conditions -- List of policy conditions to apply. Dictionary or list of dictionaries. - Overridden if policy_group_data is supplied. - description -- Policy group description. String. - name -- Policy group name. String. - policy_group_data -- Policy group conditions. Dictionary. - policy_id -- Policy ID to update. String. + conditions : str + List of policy conditions to apply. Dictionary or list of dictionaries. + Overridden if policy_group_data is supplied. + description : str + Policy group description. + name : str + Policy group name. + policy_group_data : dict + Policy group conditions. + policy_id : str + Policy ID to update. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/image-assessment-policies/CreatePolicyGroups + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = image_group_payload(passed_keywords=kwargs) @@ -323,8 +398,16 @@ def update_policy_groups(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update Image Assessment Policy Group entities. - Keyword arguments: - body -- Full body payload in JSON format, not required when using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/image-assessment-policies/UpdatePolicyGroups + + Keyword arguments + ----------------- + body : dict + Full body payload in JSON format, not required when using other keywords. { "description": "string", "name": "string", @@ -334,22 +417,26 @@ def update_policy_groups(self: object, ] } } - conditions -- List of policy conditions to apply. Dictionary or list of dictionaries. - Overridden if policy_group_data is supplied. - description -- Policy group description. String. - id -- Policy Image Group entity UUID. String. - name -- Policy group name. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - policy_group_data -- List of policy conditions. Dictionary. + conditions : str + List of policy conditions to apply. Dictionary or list of dictionaries. + Overridden if policy_group_data is supplied. + description : str + Policy group description. + id : str + Policy Image Group entity UUID. + name : str + Policy group name. + parameters : dict + Full parameters payload. Not required if using other keywords. + policy_group_data : dict + List of policy conditions. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/image-assessment-policies/UpdatePolicyGroups + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = image_group_payload(passed_keywords=kwargs) @@ -371,19 +458,28 @@ def delete_policy_group(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete Image Assessment Policy Group entities. - Keyword arguments: - id -- Policy Image Group entity UUID - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/image-assessment-policies/DeletePolicyGroup + + Keyword arguments + ----------------- + id : str + Policy Image Group entity UUID + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -397,23 +493,30 @@ def delete_policy_group(self: object, def update_policy_precedence(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update Image Assessment Policy precedence. - Keyword arguments: - body -- Full body payload in JSON format, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/image-assessment-policies/UpdatePolicyPrecedence + + Keyword arguments + ----------------- + body : dict + Full body payload in JSON format, not required when using other keywords. { "precedence": [ "string" ] } - precedence -- List of policy IDs in precedence order. String or List of strings. + precedence : str or list[str] + List of policy IDs in precedence order. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/image-assessment-policies/UpdatePolicyPrecedence + Returns + ------- + dict + Dictionary object containing API response. """ if not body: prec = kwargs.get("precedence", None) diff --git a/src/falconpy/incidents.py b/src/falconpy/incidents.py index ffa1b88e3..9052aaece 100644 --- a/src/falconpy/incidents.py +++ b/src/falconpy/incidents.py @@ -60,25 +60,39 @@ class Incidents(ServiceClass): def crowdscore(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query environment wide CrowdScore and return the entity data. - DEPRECATED: the Incidents API will be removed in March 2026. - - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-2500] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. Ex: score.asc, timestamp.desc + DECOMMISSIONED: This operation is no longer available in CrowdStrike's API. + Calling this method will result in an error from the API. - This method only supports keywords for providing arguments. - Returns: dict object containing API response. + DEPRECATED: the Incidents API will be removed in March 2026. HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/incidents/CrowdScore + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-2500] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. Ex: score.asc, timestamp.desc + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -92,25 +106,36 @@ def crowdscore(self: object, parameters: dict = None, **kwargs) -> Union[Dict[st def get_behaviors(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get details on behaviors by providing behavior IDs. + DECOMMISSIONED: This operation is no longer available in CrowdStrike's API. + Calling this method will result in an error from the API. + + DEPRECATED: the Incidents API will be removed in March 2026. - Keyword arguments: - body -- full body payload, not required if ids are provided as keyword. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/incidents/GetBehaviors + + Keyword arguments + ----------------- + body : dict + full body payload, not required if ids are provided as keyword. { "ids": [ "string" ] } - ids -- Behavior ID(s) to retrieve. String or list of strings. + ids : str or list[str] + Behavior ID(s) to retrieve. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/incidents/GetBehaviors + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, payload_value="ids") @@ -136,36 +161,55 @@ def perform_incident_action(self: object, A maximum of 5000 incidents may be updated per request. - Keyword arguments: - action_parameters -- Action specific parameters. List of dictionaries. - add_comment -- Adds the provided value as a new comment on all the incidents in the ids list. String. - add_tag -- Adds the associated value as a new tag on all the incidents of the ids list. - Overridden if action_parameters is specified. Multiple values may be provided. - String, comma delimited string, or list. - delete_tag -- Deletes tags matching the value from all the incidents in the ids list. - Overridden if action_parameters is specified. Multiple values may be provided. - String, comma delimited string or list. - overwrite_detects - Overwrite related detections. Boolean. - unassign -- Unassigns all users from all of the incidents in the ids list. - Overridden if action_parameters is specified. Boolean. - update_detects -- Update related detections. Boolean. - update_name -- Updates the name to the parameter value of all the incidents - in the ids list. Overridden if action_parameters is specified. String. - update_assigned_to_v2 -- Assigns the user matching the UUID in the parameter - value to all of the incidents in the ids list. For information - on getting the UUID of a user, see Find existing users. - Overridden if action_parameters is specified. UUID string. - update_description -- Updates the description to the parameter value of all the - incidents listed in the ids list. - Overridden if action_parameters is specified. String. - update_status -- Updates the status to the parameter value of all the incidents - in the ids list. Valid status values are 20, 25, 30, or 40: - 20: New - 25: Reopened - 30: In Progress - 40: Closed - Overridden if action_parameters is specified. Integer string. - body -- full body payload, not required if ids is provided as keyword. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/incidents/PerformIncidentAction + + Keyword arguments + ----------------- + action_parameters : list[dict] + Action specific parameters. + add_comment : str + Adds the provided value as a new comment on all the incidents in the ids. + add_tag : list + Adds the associated value as a new tag on all the incidents of the ids list. + Overridden if action_parameters is specified. Multiple values may be provided. + String, comma delimited string, or. + delete_tag : list + Deletes tags matching the value from all the incidents in the ids list. + Overridden if action_parameters is specified. Multiple values may be provided. + String, comma delimited string or. + overwrite_detects : bool + Overwrite related detections. + unassign : bool + Unassigns all users from all of the incidents in the ids list. + Overridden if action_parameters is specified. + update_detects : bool + Update related detections. + update_name : str + Updates the name to the parameter value of all the incidents + in the ids list. Overridden if action_parameters is specified. + update_assigned_to_v2 : str + Assigns the user matching the UUID in the parameter + value to all of the incidents in the ids list. For information + on getting the UUID of a user, see Find existing users. + Overridden if action_parameters is specified. UUID. + update_description : str + Updates the description to the parameter value of all the + incidents listed in the ids list. + Overridden if action_parameters is specified. + update_status : str + Updates the status to the parameter value of all the incidents + in the ids list. Valid status values are 20, 25, 30, or 40: + 20: New + 25: Reopened + 30: In Progress + 40: Closed + Overridden if action_parameters is specified. + body : dict + full body payload, not required if ids is provided as keyword. { "action_parameters": [ { @@ -177,17 +221,17 @@ def perform_incident_action(self: object, "string" ] } - ids -- Incident ID(s) to perform actions against. String or list of strings. - parameters -- Full parameters payload, not required if using other keywords. + ids : str or list[str] + Incident ID(s) to perform actions against. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/incidents/PerformIncidentAction + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, payload_value="ids") @@ -211,25 +255,36 @@ def perform_incident_action(self: object, def get_incidents(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get details on incidents by providing incident IDs. + DECOMMISSIONED: This operation is no longer available in CrowdStrike's API. + Calling this method will result in an error from the API. + + DEPRECATED: the Incidents API will be removed in March 2026. - Keyword arguments: - body -- full body payload, not required if ids are provided as keyword. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/incidents/GetIncidents + + Keyword arguments + ----------------- + body : dict + full body payload, not required if ids are provided as keyword. { "ids": [ "string" ] } - ids -- Incident ID(s) to retrieve. String or list of strings. + ids : str or list[str] + Incident ID(s) to retrieve. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/incidents/GetIncidents + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, payload_value="ids") @@ -245,25 +300,39 @@ def get_incidents(self: object, body: dict = None, **kwargs) -> Union[Dict[str, def query_behaviors(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search for behaviors by providing an FQL filter, sorting, and paging details. - DEPRECATED: the Incidents API will be removed in March 2026. + DECOMMISSIONED: This operation is no longer available in CrowdStrike's API. + Calling this method will result in an error from the API. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-500] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. Ex: timestamp.desc - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. + DEPRECATED: the Incidents API will be removed in March 2026. HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/incidents/QueryBehaviors + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-500] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. Ex: timestamp.desc + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -277,31 +346,45 @@ def query_behaviors(self: object, parameters: dict = None, **kwargs) -> Union[Di def query_incidents(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search for incidents by providing an FQL filter, sorting, and paging details. - DEPRECATED: the Incidents API will be removed in March 2026. - - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-500] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. Ex: state.asc, name.desc - Available sort fields: - assigned_to sort_score - assigned_to_name start - end state - modified_timestamp status - name + DECOMMISSIONED: This operation is no longer available in CrowdStrike's API. + Calling this method will result in an error from the API. - This method only supports keywords for providing arguments. - Returns: dict object containing API response. + DEPRECATED: the Incidents API will be removed in March 2026. HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/incidents/QueryIncidents + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-500] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. Ex: state.asc, name.desc + Available sort fields: + assigned_to sort_score + assigned_to_name start + end state + modified_timestamp status + name + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/incidents.pyi b/src/falconpy/incidents.pyi index bfe518a9d..7e3aa1e3a 100644 --- a/src/falconpy/incidents.pyi +++ b/src/falconpy/incidents.pyi @@ -1,11 +1,13 @@ """Type stubs for incidents.""" from typing import Dict, List, Optional, Union +from typing_extensions import deprecated from ._service_class import ServiceClass from ._result import Result class Incidents(ServiceClass): + @deprecated("This operation is no longer available in CrowdStrike's API. Calling this method will result in an error from the API.") def crowdscore( self, *, @@ -16,10 +18,10 @@ class Incidents(ServiceClass): parameters: Optional[dict] = None, ) -> Union[Dict[str, Union[int, dict]], Result]: ... + @deprecated("This operation is no longer available in CrowdStrike's API. Calling this method will result in an error from the API.") def get_behaviors( self, *, - ids: Optional[Union[str, List[str]]] = None, body: Optional[dict] = None, ) -> Union[Dict[str, Union[int, dict]], Result]: ... @@ -28,19 +30,18 @@ class Incidents(ServiceClass): *, update_detects: Optional[bool] = None, overwrite_detects: Optional[bool] = None, - action_parameters: Optional[list] = None, - ids: Optional[Union[str, List[str]]] = None, body: Optional[dict] = None, parameters: Optional[dict] = None, ) -> Union[Dict[str, Union[int, dict]], Result]: ... + @deprecated("This operation is no longer available in CrowdStrike's API. Calling this method will result in an error from the API.") def get_incidents( self, *, - ids: Optional[Union[str, List[str]]] = None, body: Optional[dict] = None, ) -> Union[Dict[str, Union[int, dict]], Result]: ... + @deprecated("This operation is no longer available in CrowdStrike's API. Calling this method will result in an error from the API.") def query_behaviors( self, *, @@ -51,6 +52,7 @@ class Incidents(ServiceClass): parameters: Optional[dict] = None, ) -> Union[Dict[str, Union[int, dict]], Result]: ... + @deprecated("This operation is no longer available in CrowdStrike's API. Calling this method will result in an error from the API.") def query_incidents( self, *, diff --git a/src/falconpy/installation_tokens.py b/src/falconpy/installation_tokens.py index e8fd24332..abbc3630c 100644 --- a/src/falconpy/installation_tokens.py +++ b/src/falconpy/installation_tokens.py @@ -64,19 +64,28 @@ def audit_events_read(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get the details of one or more audit events by id. - Keyword arguments: - ids -- List of audit event IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/installation-tokens/audit-events-read + + Keyword arguments + ----------------- + ids : str or list[str] + List of audit event IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -91,12 +100,20 @@ def customer_settings_read(self: object) -> Union[Dict[str, Union[int, dict]], R This method does not accept arguments or keywords. - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/installation-tokens/customer-settings-read + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -108,19 +125,28 @@ def customer_settings_read(self: object) -> Union[Dict[str, Union[int, dict]], R def tokens_read(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get the details of one or more tokens by id. - Keyword arguments: - ids -- List of installation token IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/installation-tokens/tokens-read + + Keyword arguments + ----------------- + ids : str or list[str] + List of installation token IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -134,25 +160,34 @@ def tokens_read(self: object, *args, parameters: dict = None, **kwargs) -> Union def tokens_create(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create a token. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/installation-tokens/tokens-create + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "expires_timestamp": "2021-09-22T02:28:11.762Z", "label": "string", "type": "string" } - expires_timestamp -- Installation token expiration date. UTC formatted string. - label -- Installation token label. String. - type -- Installation token type. String. + expires_timestamp : str + Installation token expiration date. UTC formatted. + label : str + Installation token label. + type : str + Installation token type. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/installation-tokens/tokens-create + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = installation_token_payload(passed_keywords=kwargs) @@ -170,19 +205,28 @@ def tokens_create(self: object, body: dict = None, **kwargs) -> Union[Dict[str, def tokens_delete(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a token immediately. To revoke a token, use PATCH tokens_update instead. - Keyword arguments: - ids -- List of installation token IDs to delete. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/installation-tokens/tokens-delete + + Keyword arguments + ----------------- + ids : str or list[str] + List of installation token IDs to delete. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -202,26 +246,36 @@ def tokens_update(self: object, Use this endpoint to edit labels, change expiration, revoke, or restore. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/installation-tokens/tokens-update + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "expires_timestamp": "2021-09-22T02:28:11.762Z", "label": "string", "revoked": boolean } - expires_timestamp -- Installation token expiration date. UTC formatted string. - ids -- The token IDs to be updated. String or list of strings. - label -- Installation token label. String. - revoked -- Boolean representing if this token is revoked. + expires_timestamp : str + Installation token expiration date. UTC formatted. + ids : str or list[str] + The token IDs to be updated. + label : str + Installation token label. + revoked : bool + Boolean representing if this token is revoked. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/installation-tokens/tokens-update + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = installation_token_payload(passed_keywords=kwargs) @@ -241,24 +295,34 @@ def tokens_update(self: object, def audit_events_query(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search for audit events by providing an FQL filter and paging details. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - Example: action:'token_create' - limit -- The maximum number of records to return in this response. [Integer, 1-1000] - Use with the offset parameter to manage pagination of results. Defaults to 50. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. timestamp|asc). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/installation-tokens/audit-events-query + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Example: action:'token_create' + limit : int + The maximum number of records to return in this response. [Integer, 1-1000] + Use with the offset parameter to manage pagination of results. Defaults to 50. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. timestamp|asc). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -272,24 +336,34 @@ def audit_events_query(self: object, parameters: dict = None, **kwargs) -> Union def tokens_query(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search for tokens by providing an FQL filter and paging details. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - Example: status:'valid' - limit -- The maximum number of records to return in this response. [Integer, 1-1000] - Use with the offset parameter to manage pagination of results. Defaults to 50. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. created_timestamp|desc). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/installation-tokens/tokens-query + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Example: status:'valid' + limit : int + The maximum number of records to return in this response. [Integer, 1-1000] + Use with the offset parameter to manage pagination of results. Defaults to 50. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. created_timestamp|desc). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -303,23 +377,31 @@ def tokens_query(self: object, parameters: dict = None, **kwargs) -> Union[Dict[ def customer_settings_update(self: object, body: dict = None, **kwargs) -> dict: """Create a token. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/installation-tokens-settings/customer-settings-update + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "max_active_tokens": 0, "tokens_required": true } - max_active_tokens -- Maximum number of active tokens within the CID. Integer. - tokens_required -- Flag indicating if installation tokens are required. Boolean. + max_active_tokens : int + Maximum number of active tokens within the CID. + tokens_required : bool (required) + Flag indicating if installation tokens are. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/installation-tokens-settings/customer-settings-update + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = token_settings_payload(passed_keywords=kwargs) diff --git a/src/falconpy/intel.py b/src/falconpy/intel.py index abc0c9a41..5a68c4e46 100644 --- a/src/falconpy/intel.py +++ b/src/falconpy/intel.py @@ -61,46 +61,58 @@ class Intel(ServiceClass): def query_actor_entities(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get info about actors that match provided FQL filters. - Keyword arguments: - fields -- The fields to return, or a predefined set of fields in the form of the collection - name surround by two underscores: ____. e.g. slug __full__. - Defaults to __basic__. - filter -- The filter expression that should be used to limit the results. FQL syntax. - Available filter parameters: - actors sub_type.name - actors.id sub_type.slug - actors.name tags - actors.slug tags.id - actors.url tags.slug - created_date tags.value - description target_countries - id target_countries.id - last_modified_date target_countries.slug - motivations target_countries.value - motivations.id target_industries - motivations.slug target_industries.id - motivations.value target_industries.slug - name target_industries.value - name.raw type - short_description type.id - slug type.name - sub_type type.slug - sub_type.id url - animal_classifier - limit -- The maximum number of actors to return. [integer, 1-5000] - offset -- The integer offset to start retrieving records from. - parameters - full parameters payload, not required if using other keywords. - q -- Perform a generic substring search across all fields. - sort -- The property to sort by. FQL syntax (e.g. created_date.desc). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/QueryIntelActorEntities + + Keyword arguments + ----------------- + fields : str or list[str] + The fields to return, or a predefined set of fields in the form of the collection + name surround by two underscores: ____. e.g. slug __full__. + Defaults to __basic__. + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Available filter parameters: + actors sub_type.name + actors.id sub_type.slug + actors.name tags + actors.slug tags.id + actors.url tags.slug + created_date tags.value + description target_countries + id target_countries.id + last_modified_date target_countries.slug + motivations target_countries.value + motivations.id target_industries + motivations.slug target_industries.id + motivations.value target_industries.slug + name target_industries.value + name.raw type + short_description type.id + slug type.name + sub_type type.slug + sub_type.id url + animal_classifier + limit : int (1-5000) + The maximum number of actors to return. + offset : int + The integer offset to start retrieving records from. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Perform a generic substring search across all fields. + sort : str + The property to sort by. FQL syntax (e.g. created_date.desc). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -117,40 +129,54 @@ def query_indicator_entities(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get info about indicators that match provided FQL filters. - Keyword arguments: - fields -- The fields to return, or a predefined set of fields in the form of the collection - name surround by two underscores: ____. e.g. slug __full__. - Defaults to __basic__. - filter -- The filter expression that should be used to limit the results. FQL syntax. - Available filter parameters: - _marker labels.name - actors last_updated - deleted malicious_confidence - domain_types malware_families - id published_date - indicator reports - ip_address_types targets - kill_chains threat_types - labels type - labels.created_on vulnerabilities - labels.last_valid_on reports.slug - include_deleted -- include both published and deleted indicators. - Boolean, defaults to False. - include_relations -- include related indicators. Boolean, defaults to True. - limit -- The maximum number of indicators to return. [integer, 1-50000] - offset -- The integer offset to start retrieving records from. - parameters - full parameters payload, not required if using other keywords. - q -- Perform a generic substring search across all fields. - sort -- The property to sort by. FQL syntax (e.g. published_date|asc). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/QueryIntelIndicatorEntities + + Keyword arguments + ----------------- + fields : str + The fields to return, or a predefined set of fields in the form of the collection + name surround by two underscores: ____. e.g. slug __full__. + Defaults to __basic__. + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Available filter parameters: + _marker labels.name + actors last_updated + deleted malicious_confidence + domain_types malware_families + id published_date + indicator reports + ip_address_types targets + kill_chains threat_types + labels type + labels.created_on vulnerabilities + labels.last_valid_on reports.slug + include_deleted : bool + include both published and deleted indicators. + Boolean, defaults to False. + include_relations : bool + include related indicators. Boolean, defaults to True. + limit : int (1-50000) + The maximum number of indicators to return. + offset : int + The integer offset to start retrieving records from. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Perform a generic substring search across all fields. + sort : str + The property to sort by. FQL syntax (e.g. published_date|asc). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -164,48 +190,60 @@ def query_indicator_entities(self: object, def query_report_entities(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get info about reports that match provided FQL filters. - Keyword arguments: - fields -- The fields to return, or a predefined set of fields in the form of the collection - name surround by two underscores: ____. e.g. slug __full__. - Defaults to __basic__. - filter -- The filter expression that should be used to limit the results. FQL syntax. - Available filter parameters: - actors sub_type - actors.animal_classifier sub_type.id - actors.id sub_type.name - actors.name sub_type.slug - actors.slug tags - actors.url tags.id - created_date tags.slug - description tags.value - id target_countries - last_modified_date target_countries.id - malware target_countries.slug - malware.community_identifiers target_countries.value - malware.family_name target_industries - malware.slug target_industries.id - motivations target_industries.slug - motivations.id target_industries.value - motivations.slug type - motivations.value type.id - name type.name - name.raw type.slug - short_description url - slug summary - limit -- The maximum number of reports to return. [integer, 1-5000] - offset -- The integer offset to start retrieving records from. - parameters - full parameters payload, not required if using other keywords. - q -- Perform a generic substring search across all fields. - sort -- The property to sort by. FQL syntax (e.g. created_date|asc). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/QueryIntelReportEntities + + Keyword arguments + ----------------- + fields : str or list[str] + The fields to return, or a predefined set of fields in the form of the collection + name surround by two underscores: ____. e.g. slug __full__. + Defaults to __basic__. + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Available filter parameters: + actors sub_type + actors.animal_classifier sub_type.id + actors.id sub_type.name + actors.name sub_type.slug + actors.slug tags + actors.url tags.id + created_date tags.slug + description tags.value + id target_countries + last_modified_date target_countries.id + malware target_countries.slug + malware.community_identifiers target_countries.value + malware.family_name target_industries + malware.slug target_industries.id + motivations target_industries.slug + motivations.id target_industries.value + motivations.slug type + motivations.value type.id + name type.name + name.raw type.slug + short_description url + slug summary + limit : int (1-5000) + The maximum number of reports to return. + offset : int + The integer offset to start retrieving records from. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Perform a generic substring search across all fields. + sort : str + The property to sort by. FQL syntax (e.g. created_date|asc). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -223,22 +261,32 @@ def get_actor_entities(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve specific actors using their actor IDs. - Keyword arguments: - fields -- The fields to return, or a predefined set of fields in the form of the collection - name surround by two underscores: ____. e.g. slug __full__. - Defaults to __basic__. - ids -- One or more actor IDs. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/GetIntelActorEntities + + Keyword arguments + ----------------- + fields : str or list[str] + The fields to return, or a predefined set of fields in the form of the collection + name surround by two underscores: ____. e.g. slug __full__. + Defaults to __basic__. + ids : str or list[str] + One or more actor IDs. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -256,24 +304,33 @@ def get_indicator_entities(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve specific indicators using their indicator IDs. - Keyword arguments: - body -- full body payload, not required when ids keyword is provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/GetIntelIndicatorEntities + + Keyword arguments + ----------------- + body : dict + full body payload, not required when ids keyword is provided. { "ids": [ "string" ] } - ids -- ID(s) of the indicator entities to retrieve. String or list of strings. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/GetIntelIndicatorEntities + ids : str or list[str] + ID(s) of the indicator entities to retrieve. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_arguments=args, @@ -297,19 +354,27 @@ def get_mitre_report(self: object, ) -> Union[Union[Dict[str, Union[int, dict]], bytes], Result]: """Export Mitre ATT&CK information for a given actor. - Keyword arguments: - actor_id -- Actor ID, derived from the actor name. String. - format -- Report format. Accepted options: 'CSV' or 'JSON'. String - parameters - full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/GetMitreReport + + Keyword arguments + ----------------- + actor_id : str + Actor ID, derived from the actor name. + format : str + Report format. Accepted options: 'CSV' or 'JSON' + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -323,24 +388,33 @@ def get_mitre_report(self: object, def mitre_attacks(self: object, *args, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve reports and observable IDs associated with the given actor and attacks. - Keyword arguments: - body -- full body payload, not required when ids keyword is provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/PostMitreAttacks + + Keyword arguments + ----------------- + body : dict + full body payload, not required when ids keyword is provided. { "ids": [ "string" ] } - ids -- ID(s) of the indicator entities to retrieve. String or list of strings. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/PostMitreAttacks + ids : str or list[str] + ID(s) of the indicator entities to retrieve. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_arguments=args, @@ -364,22 +438,32 @@ def get_malware_report(self: object, **kwargs) -> Union[Dict[str, Union[int, dict]], bytes]: """Export Mitre ATT&CK information for a given malware family. - Keyword arguments: - id -- Malware family name. String. - Malware family names should be in lower case with spaces, dots and - slashes replaced with dashes. - format -- Report format. String. Supported values: CSV, JSON or JSON_NAVIGATOR. - parameters - full parameters payload, not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/GetMalwareMitreReport + + Keyword arguments + ----------------- + id : str + Malware family name. String. + Malware family names should be in lower case with spaces, dots and + slashes replaced with dashes. + format : str + Report format. String. Supported values: CSV, JSON or JSON_NAVIGATOR. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ # If not specified, default to JSON. if not kwargs.get("format", None): @@ -400,21 +484,30 @@ def get_malware_entities(self: object, **kwargs) -> Union[Dict[str, Union[int, dict]], bytes]: """Get malware entities for specified ids. - Keyword arguments: - ids -- Malware family entities to retrieve. String or list of strings. - Malware family names should be in lower case with spaces, dots and - slashes replaced with dashes. - parameters - full parameters payload, not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/GetMalwareEntities + + Keyword arguments + ----------------- + ids : str or list[str] + Malware family entities to retrieve. String or list of strings. + Malware family names should be in lower case with spaces, dots and + slashes replaced with dashes. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -428,21 +521,30 @@ def get_malware_entities(self: object, def get_report_pdf(self: object, *args, parameters: dict = None, **kwargs) -> object: """Return a Report PDF attachment. - Keyword arguments: - id -- One or more actor IDs. String or list of strings. - ids -- The ID of the report you want to download as a PDF. - This parameter is used only if no id parameter given. String. - parameters - full parameters payload, not required if id is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: binary object on SUCCESS, dict object containing API response on FAILURE. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/GetIntelReportPDF + + Keyword arguments + ----------------- + id : str + One or more actor IDs. + ids : str + The ID of the report you want to download as a PDF. + This parameter is used only if no id parameter given. + parameters : dict + full parameters payload, not required if id is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + binary object on SUCCESS, dict object containing API response on FAILURE. """ return process_service_request( calling_object=self, @@ -456,24 +558,41 @@ def get_report_pdf(self: object, *args, parameters: dict = None, **kwargs) -> ob def query_malware_entities(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get malware entities that match provided FQL filters. - Keyword arguments: - offset -- Set the starting row number to return malware IDs from. Defaults to 0. Integer. - limit -- Set the number of malware IDs to return. The value must be between 1 and 5000. Integer. - sort -- Order fields in ascending or descending order. String. - Ex: created_date|asc. - filter -- Filter your query by specifying FQL filter parameters. String. - q -- Perform a generic substring search across all fields. String. - fields -- The fields to return. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/QueryMalwareEntities + + Keyword arguments + ----------------- + offset : int + Set the starting row number to return malware IDs from. Defaults to 0. + limit : int + Set the number of malware IDs to return. The value must be between 1 and 5000. + sort : str + Order fields in ascending or descending order. String. + Ex: created_date|asc. + filter : str + Filter your query by specifying FQL filter parameters. + The `last_updated` and `created_timestamp` fields are returned as ISO 8601 + timestamp strings for this operation, so their filter values must be + quoted. Ex: last_updated:>='2026-01-28T10:22:34Z'. An unquoted value + is parsed as an integer, so a Unix epoch timestamp is accepted without + error but matches nothing and the filter appears to be ignored. + q : str + Perform a generic substring search across all fields. + fields : str or list[str] + The fields to return. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -491,22 +610,32 @@ def get_report_entities(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve specific reports using their report IDs. - Keyword arguments: - fields -- The fields to return, or a predefined set of fields in the form of the collection - name surround by two underscores: ____. e.g. slug __full__. - Defaults to __basic__. - ids -- One or more actor IDs. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/GetIntelReportEntities + + Keyword arguments + ----------------- + fields : str or list[str] + The fields to return, or a predefined set of fields in the form of the collection + name surround by two underscores: ____. e.g. slug __full__. + Defaults to __basic__. + ids : str or list[str] + One or more actor IDs. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -520,20 +649,29 @@ def get_report_entities(self: object, def get_rule_file(self: object, *args, parameters: dict = None, **kwargs) -> object: """Download earlier rule sets. - Keyword arguments: - format -- Choose the format you want the rule set in. Either zip or gzip. Defaults to zip. - id -- One or more actor IDs. String or list of strings. - parameters - full parameters payload, not required if id is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: binary object on SUCCESS, dict object containing API response on FAILURE. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/GetIntelRuleFile + + Keyword arguments + ----------------- + format : str + Choose the format you want the rule set in. Either zip or gzip. Defaults to zip. + id : int + One or more actor IDs. + parameters : dict + full parameters payload, not required if id is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + binary object on SUCCESS, dict object containing API response on FAILURE. """ return process_service_request( calling_object=self, @@ -547,30 +685,41 @@ def get_rule_file(self: object, *args, parameters: dict = None, **kwargs) -> obj def get_latest_rule_file(self: object, *args, parameters: dict = None, **kwargs) -> object: """Download the latest rule set. - Keyword arguments: - if_none_match -- Download the latest rule set only if it doesn't have an ETag - matching the given ones. String. - if_modified_since -- Download the latest rule set only if the rule was modified after this date. - http, ANSIC and RFC850 formats accepted. String. - format -- Choose the format you want the rule set in. Either zip or gzip. Defaults to zip. - parameters - full parameters payload, not required if other keywords are used. - type -- The rule news report type. The following values are accepted: - common-event-format snort-suricata-update - netwitness yara-changelog - snort-suricata-changelog yara-master - snort-suricata-master yara-update - cql-master cql-changelog - cql-update - - Arguments: When not specified, the first argument to this method is assumed to be 'type'. - All others are ignored. - - Returns: binary object on SUCCESS, dict object containing API response on FAILURE. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/GetLatestIntelRuleFile + + Keyword arguments + ----------------- + if_none_match : str + Download the latest rule set only if it doesn't have an ETag + matching the given ones. + if_modified_since : str + Download the latest rule set only if the rule was modified after this date. + http, ANSIC and RFC850 formats accepted. + format : str + Choose the format you want the rule set in. Either zip or gzip. Defaults to zip. + parameters : dict + full parameters payload, not required if other keywords are used. + type : str + The rule news report type. The following values are accepted: + common-event-format snort-suricata-update + netwitness yara-changelog + snort-suricata-changelog yara-master + snort-suricata-master yara-update + cql-master cql-changelog + cql-update + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'type'. + All others are ignored. + + Returns + ------- + binary object on SUCCESS, dict object containing API response on FAILURE. """ headers = {} if kwargs.get("if_none_match", None): @@ -595,19 +744,28 @@ def get_rule_entities(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve details for rule sets for the specified ids. - Keyword arguments: - ids -- One or more actor IDs. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/GetIntelRuleEntities + + Keyword arguments + ----------------- + ids : str or list[str] + One or more actor IDs. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -621,43 +779,54 @@ def get_rule_entities(self: object, def query_actor_ids(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get actor IDs that match provided FQL filters. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - Available filter parameters: - actors sub_type.name - actors.id sub_type.slug - actors.name tags - actors.slug tags.id - actors.url tags.slug - created_date tags.value - description target_countries - id target_countries.id - last_modified_date target_countries.slug - motivations target_countries.value - motivations.id target_industries - motivations.slug target_industries.id - motivations.value target_industries.slug - name target_industries.value - name.raw type - short_description type.id - slug type.name - sub_type type.slug - sub_type.id url - animal_classifier - limit -- The maximum number of actors to return. [integer, 1-5000] - offset -- The integer offset to start retrieving records from. - parameters - full parameters payload, not required if using other keywords. - q -- Perform a generic substring search across all fields. - sort -- The property to sort by. FQL syntax (e.g. created_date|asc). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/QueryIntelActorIds + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Available filter parameters: + actors sub_type.name + actors.id sub_type.slug + actors.name tags + actors.slug tags.id + actors.url tags.slug + created_date tags.value + description target_countries + id target_countries.id + last_modified_date target_countries.slug + motivations target_countries.value + motivations.id target_industries + motivations.slug target_industries.id + motivations.value target_industries.slug + name target_industries.value + name.raw type + short_description type.id + slug type.name + sub_type type.slug + sub_type.id url + animal_classifier + limit : int (1-5000) + The maximum number of actors to return. + offset : int + The integer offset to start retrieving records from. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Perform a generic substring search across all fields. + sort : str + The property to sort by. FQL syntax (e.g. created_date|asc). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -671,37 +840,50 @@ def query_actor_ids(self: object, parameters: dict = None, **kwargs) -> Union[Di def query_indicator_ids(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get indicators IDs that match provided FQL filters. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - Available filter parameters: - _marker labels.name - actors last_updated - deleted malicious_confidence - domain_types malware_families - id published_date - indicator reports - ip_address_types targets - kill_chains threat_types - labels type - labels.created_on vulnerabilities - labels.last_valid_on reports.slug - include_deleted -- include both published and deleted indicators. - Boolean, defaults to False. - include_relations -- include related indicators. Boolean, defaults to True. - limit -- The maximum number of indicators to return. [integer, 1-50000] - offset -- The integer offset to start retrieving records from. - parameters - full parameters payload, not required if using other keywords. - q -- Perform a generic substring search across all fields. - sort -- The property to sort by. FQL syntax (e.g. published_date|asc). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/QueryIntelIndicatorIds + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Available filter parameters: + _marker labels.name + actors last_updated + deleted malicious_confidence + domain_types malware_families + id published_date + indicator reports + ip_address_types targets + kill_chains threat_types + labels type + labels.created_on vulnerabilities + labels.last_valid_on reports.slug + include_deleted : bool + include both published and deleted indicators. + Boolean, defaults to False. + include_relations : bool + include related indicators. Boolean, defaults to True. + limit : int (1-50000) + The maximum number of indicators to return. + offset : int + The integer offset to start retrieving records from. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Perform a generic substring search across all fields. + sort : str + The property to sort by. FQL syntax (e.g. published_date|asc). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -719,21 +901,31 @@ def query_mitre_attacks(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get MITRE tactics and techniques for the given actor. - Keyword arguments: - id -- Actor ID, derived from the actor name. (Example: fancy-bear). String. - ids -- The actor ID(derived from the actor's name) for which to retrieve a list of attacks. - Example: fancy-bear. Multiple values are allowed. List of strings. - parameters - full parameters payload, not required if using `id` keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/QueryMitreAttacks + + Keyword arguments + ----------------- + id : str + Actor ID, derived from the actor name. (Example: fancy-bear) + ids : str or list[str] + The actor ID(derived from the actor's name) for which to retrieve a list of attacks. + Example: fancy-bear. Multiple values are allowed. + parameters : dict + full parameters payload, not required if using `id` keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -750,21 +942,30 @@ def query_mitre_attacks_for_malware(self: object, **kwargs) -> Union[Dict[str, Union[int, dict]], bytes]: """Get MITRE tactics and techniques for the given malware. - Keyword arguments: - ids -- Malware family entities to retrieve. String or list of strings. - Malware family names should be in lower case with spaces, dots and - slashes replaced with dashes. - parameters - full parameters payload, not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/QueryMitreAttacksForMalware + + Keyword arguments + ----------------- + ids : str or list[str] + Malware family entities to retrieve. String or list of strings. + Malware family names should be in lower case with spaces, dots and + slashes replaced with dashes. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -778,45 +979,56 @@ def query_mitre_attacks_for_malware(self: object, def query_report_ids(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get report IDs that match provided FQL filters. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - Available filter parameters: - actors sub_type - actors.animal_classifier sub_type.id - actors.id sub_type.name - actors.name sub_type.slug - actors.slug tags - actors.url tags.id - created_date tags.slug - description tags.value - id target_countries - last_modified_date target_countries.id - malware target_countries.slug - malware.community_identifiers target_countries.value - malware.family_name target_industries - malware.slug target_industries.id - motivations target_industries.slug - motivations.id target_industries.value - motivations.slug type - motivations.value type.id - name type.name - name.raw type.slug - short_description url - slug summary - limit -- The maximum number of reports to return. [integer, 1-5000] - offset -- The integer offset to start retrieving records from. - parameters - full parameters payload, not required if using other keywords. - q -- Perform a generic substring search across all fields. - sort -- The property to sort by. FQL syntax (e.g. created_date|asc). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/QueryIntelReportIds + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Available filter parameters: + actors sub_type + actors.animal_classifier sub_type.id + actors.id sub_type.name + actors.name sub_type.slug + actors.slug tags + actors.url tags.id + created_date tags.slug + description tags.value + id target_countries + last_modified_date target_countries.id + malware target_countries.slug + malware.community_identifiers target_countries.value + malware.family_name target_industries + malware.slug target_industries.id + motivations target_industries.slug + motivations.id target_industries.value + motivations.slug type + motivations.value type.id + name type.name + name.raw type.slug + short_description url + slug summary + limit : int (1-5000) + The maximum number of reports to return. + offset : int + The integer offset to start retrieving records from. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Perform a generic substring search across all fields. + sort : str + The property to sort by. FQL syntax (e.g. created_date|asc). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -830,34 +1042,50 @@ def query_report_ids(self: object, parameters: dict = None, **kwargs) -> Union[D def query_rule_ids(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search for rule IDs that match provided filter criteria. - Keyword arguments: - description -- substring match on the description field. List of strings. - limit -- The maximum number of rule IDs to return. [integer, 1-5000] Defaults to 10. - max_created_date -- Filter results to those created on or before a certain date. String. - min_created_date -- Filter results to those created on or after a certain date. String. - name -- search by rule title. List of strings. - offset -- The integer offset to start retrieving records from. Defaults to 0. - parameters - full parameters payload, not required if using other keywords. - q -- Perform a generic substring search across all fields. - sort -- The property to sort by. FQL syntax (e.g. created_date|asc). - tags -- search for rule tags. List of strings. - type -- The rule news report type. Required. - The following values are accepted: - common-event-format snort-suricata-update - netwitness yara-changelog - snort-suricata-changelog yara-master - snort-suricata-master yara-update - cql-master cql-changelog - cql-update - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/QueryIntelReportIds + + Keyword arguments + ----------------- + description : str or list[str] + substring match on the description field. + limit : int + The maximum number of rule IDs to return. [integer, 1-5000] Defaults to 10. + max_created_date : str + Filter results to those created on or before a certain date. + min_created_date : int + Filter results to those created on or after a certain date. + name : str or list[str] + search by rule title. + offset : int + The integer offset to start retrieving records from. Defaults to 0. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Perform a generic substring search across all fields. + sort : str + The property to sort by. FQL syntax (e.g. created_date|asc). + tags : str or list[str] + search for rule tags. + type : str + The rule news report type. Required. + The following values are accepted: + common-event-format snort-suricata-update + netwitness yara-changelog + snort-suricata-changelog yara-master + snort-suricata-master yara-update + cql-master cql-changelog + cql-update + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -871,22 +1099,38 @@ def query_rule_ids(self: object, parameters: dict = None, **kwargs) -> Union[Dic def query_malware(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get malware family names that match provided FQL filters. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of actors to return. [integer, 1-5000] - offset -- The integer offset to start retrieving records from. - parameters - full parameters payload, not required if using other keywords. - q -- Perform a generic substring search across all fields. - sort -- The property to sort by. FQL syntax (e.g. created_date|asc). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/QueryMalware + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + The `last_updated` and `created_timestamp` fields are returned as ISO 8601 + timestamp strings for this operation, so their filter values must be + quoted. Ex: last_updated:>='2026-01-28T10:22:34Z'. An unquoted value + is parsed as an integer, so a Unix epoch timestamp is accepted without + error but matches nothing and the filter appears to be ignored. + limit : int (1-5000) + The maximum number of actors to return. + offset : int + The integer offset to start retrieving records from. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Perform a generic substring search across all fields. + sort : str + The property to sort by. FQL syntax (e.g. created_date|asc). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -900,24 +1144,33 @@ def query_malware(self: object, parameters: dict = None, **kwargs) -> Union[Dict def get_vulnerabilities(self: object, *args, body: dict = None, **kwargs) -> dict: """Retrieve specific vulnerabilities using their indicator IDs. - Keyword arguments: - body -- full body payload, not required when ids keyword is provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/GetVulnerabilities + + Keyword arguments + ----------------- + body : dict + full body payload, not required when ids keyword is provided. { "ids": [ "string" ] } - ids -- ID(s) of the indicator entities to retrieve. String or list of strings. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/GetVulnerabilities + ids : str or list[str] + ID(s) of the indicator entities to retrieve. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_arguments=args, @@ -938,34 +1191,45 @@ def get_vulnerabilities(self: object, *args, body: dict = None, **kwargs) -> dic def query_vulnerabilities(self: object, parameters: dict = None, **kwargs) -> dict: """Search for rule IDs that match provided filter criteria. - Keyword arguments: - filter -- FQL query specifying the filter parameters. String. - Filter parameters include: - _all related_actors - affected_products.product related_actors.animal_classifier - affected_products.vendor related_actors.name - community_identifiers related_reports.serial_id - cve related_reports.title - cvss_v3_base related_threats - cvss_v3_base.score related_threats.name - cvss_v3_base.severity severity - exploit_status updated_timestamp - publish_date - limit -- The maximum number of IDs to return. Integer. - offset -- The integer offset to start retrieving records from. Defaults to 0. - parameters - full parameters payload, not required if using other keywords. - q -- Match phrase_prefix query criteria; included fields: - _all (all filter string fields indexed). - sort -- The property to sort by. FQL syntax. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/QueryVulnerabilities + + Keyword arguments + ----------------- + filter : str + FQL query specifying the filter parameters. String. + Filter parameters include: + _all related_actors + affected_products.product related_actors.animal_classifier + affected_products.vendor related_actors.name + community_identifiers related_reports.serial_id + cve related_reports.title + cvss_v3_base related_threats + cvss_v3_base.score related_threats.name + cvss_v3_base.severity severity + exploit_status updated_timestamp + publish_date + limit : int + The maximum number of IDs to return. + offset : str + The integer offset to start retrieving records from. Defaults to 0. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Match phrase_prefix query criteria; included fields: + _all (all filter string fields indexed). + sort : str + The property to sort by. FQL syntax. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -982,8 +1246,16 @@ def cao_incidents_aggregates_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Perform statistical aggregations over incident data. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/cao_incidents_aggregates_v1 + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "date_ranges": [ { @@ -1028,36 +1300,55 @@ def cao_incidents_aggregates_v1(self: object, "time_zone": "string", "type": "string" } - date_ranges -- The date_ranges value. List. - exclude -- The exclude value. String. - extended_bounds -- The extended_bounds value. Dictionary. - field -- The field value. String. - filter -- The filter value. String. - filters_spec -- The filters_spec value. Dictionary. - from -- The from value. Integer. - include -- The include value. String. - interval -- The interval value. String. - max_doc_count -- The max_doc_count value. Integer. - min_doc_count -- The min_doc_count value. Integer. - missing -- The missing value. String. - name -- The name value. String. - percents -- The percents value. List. - q -- The q value. String. - ranges -- The ranges value. List. - size -- The size value. Integer. - sort -- The sort value. String. - sub_aggregates -- The sub_aggregates value. List. - time_zone -- The time_zone value. String. - type -- The type value. String. + date_ranges : list + The date_ranges value. + exclude : str + The exclude value. + extended_bounds : dict + The extended_bounds value. + field : str + The field value. + filter : str + The filter value. + filters_spec : dict + The filters_spec value. + from : int + The from value. + include : str + The include value. + interval : str + The interval value. + max_doc_count : int + The max_doc_count value. + min_doc_count : int + The min_doc_count value. + missing : str + The missing value. + name : str + The name value. + percents : list + The percents value. + q : str + The q value. + ranges : list + The ranges value. + size : int + The size value. + sort : str + The sort value. + sub_aggregates : list + The sub_aggregates value. + time_zone : str + The time_zone value. + type : str + The type value. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/cao_incidents_aggregates_v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cao_incidents_aggregates_v1_payload(passed_keywords=kwargs) @@ -1076,23 +1367,30 @@ def cao_incidents_entities_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve full details for one or more adversary incidents by their IDs. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/cao_incidents_entities_v1 + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "ids": [ "string" ] } - ids -- The ids value. List. + ids : str or list[str] + The ids value. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/cao_incidents_entities_v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = cao_incidents_entities_v1_payload(passed_keywords=kwargs) @@ -1111,37 +1409,47 @@ def cao_incidents_queries_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Search for adversary incidents using FQL criteria and return a paginated list of matching incident IDs. - Keyword arguments: - sort -- The property to sort on, followed by a dot (.), followed by the sort direction, either "asc" or "desc". - Available sort properties: ActivityStart, ActivityEnd, PublishDate, InvolvesAdversaries.Name, - InvolvesAdversaries.Slug, LastModifiedAt. String. - filter -- Optional filter and sort criteria in the form of an FQL query. String. - Available filters: - ActivityEnd ActivityStart - All Id - InvolvesAdversaries.AnimalClassifier InvolvesAdversaries.Id - InvolvesAdversaries.Name InvolvesAdversaries.Slug - InvolvesIndicators.Value InvolvesThreats.FamilyName - LastModifiedAt MitreAttack.Id - MitreAttack.TacticId MitreAttack.TacticName - MitreAttack.TechniqueId MitreAttack.TechniqueName - Motivations.Slug Objectives.Slug - PublishDate ReferencesNotableEvents.Title - TargetCountries.Slug TargetIndustries.Slug - TargetRegions.Slug TargetingProfile.Slug - TargetsVulnerabilities.CVE Title - limit -- The maximum records to return. Cannot be higher than 200. Integer. - offset -- Starting index of overall result set from which to return ids. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/cao_incidents_queries_v1 + + Keyword arguments + ----------------- + sort : str + The property to sort on, followed by a dot (.), followed by the sort direction, either "asc" or "desc". + Available sort properties: ActivityStart, ActivityEnd, PublishDate, InvolvesAdversaries.Name, + InvolvesAdversaries.Slug, LastModifiedAt. + filter : str + Optional filter and sort criteria in the form of an FQL query. String. + Available filters: + ActivityEnd ActivityStart + All Id + InvolvesAdversaries.AnimalClassifier InvolvesAdversaries.Id + InvolvesAdversaries.Name InvolvesAdversaries.Slug + InvolvesIndicators.Value InvolvesThreats.FamilyName + LastModifiedAt MitreAttack.Id + MitreAttack.TacticId MitreAttack.TacticName + MitreAttack.TechniqueId MitreAttack.TechniqueName + Motivations.Slug Objectives.Slug + PublishDate ReferencesNotableEvents.Title + TargetCountries.Slug TargetIndustries.Slug + TargetRegions.Slug TargetingProfile.Slug + TargetsVulnerabilities.CVE Title + limit : int + The maximum records to return. Cannot be higher than 200. + offset : str + Starting index of overall result set from which to return ids. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/intelligence_feeds.py b/src/falconpy/intelligence_feeds.py index 11b9230c7..8dbb7b843 100644 --- a/src/falconpy/intelligence_feeds.py +++ b/src/falconpy/intelligence_feeds.py @@ -63,19 +63,25 @@ def download_feed(self: object, **kwargs) -> Union[Dict[str, Union[int, dict]], Result, Response]: """Download feed file contents as a zip archive. - Keyword arguments: - feed_item_id -- Feed object reference ID. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - stream -- Enable streaming download of the returned file. Boolean. - - This method only supports keywords for providing arguments. - - Returns: binary object on SUCCESS, dict object containing API response on FAILURE. - HTTP Method: GET Swagger URL + ----------- + Keyword arguments + ----------------- + feed_item_id : str + Feed object reference ID. + parameters : dict + Full parameters payload. Not required if using other keywords. + stream : bool + Enable streaming download of the returned file. + + This method only supports keywords for providing arguments. + + Returns + ------- + binary object on SUCCESS, dict object containing API response on FAILURE. """ return process_service_request( calling_object=self, @@ -91,12 +97,19 @@ def list_feeds(self: object) -> Union[Dict[str, Union[int, dict]], Result]: This method does not accept arguments. - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -110,25 +123,33 @@ def query_feeds(self: object, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query the accessible feeds for a customer. - Keyword arguments: - feed_name -- Feed Name. - feed_interval -- Feed interval must be one of: 'dump', 'daily', 'hourly' or 'minutely'. - since -- Since is a valid timestamp in RFC3399 format. - Restrictions: minutely: now()-2h - hourly: now()-2d - daily: now()-5d - dump: now()-7d - any: Automatically combines the appropriate intervals - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- + + Keyword arguments + ----------------- + feed_name : str + Feed Name. + feed_interval : str + Feed interval must be one of: 'dump', 'daily', 'hourly' or 'minutely'. + since : str + Since is a valid timestamp in RFC3399 format. + Restrictions: minutely: now()-2h + hourly: now()-2d + daily: now()-5d + dump: now()-7d + any: Automatically combines the appropriate intervals + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + Returns + ------- + dict + Dictionary object containing API response. """ # if kwargs.get("feed_name", None): # kwargs["feed-name"] = kwargs.get("feed_name", None) diff --git a/src/falconpy/intelligence_indicator_graph.py b/src/falconpy/intelligence_indicator_graph.py index 9f40bfd02..a58bab79d 100644 --- a/src/falconpy/intelligence_indicator_graph.py +++ b/src/falconpy/intelligence_indicator_graph.py @@ -64,9 +64,17 @@ def search(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Search indicators based on FQL filter. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. - DEPRECATED: Please use query string parameters instead of the body payload for these arguments. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intelligence-indicator-graph/SearchIndicators + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + DEPRECATED: Please use query string parameters instead of the body payload for these arguments. { "filter": "string", "sort": [ @@ -76,33 +84,35 @@ def search(self: object, } ] } - filter -- The filter expression that should be used to limit the results. String. FQL syntax. - Available values: - Type LastUpdated - KillChain MaliciousConfidence - MaliciousConfidenceValidatedTime - FirstSeen LastSeen - Adversaries.Name Adversaries.Slug - Reports.Title Reports.Slug - Threats.FamilyName Vulnerabilities.CVE - Sectors.Name FileDetails.SHA256 - FileDetails.SHA1 FileDetails.MD5 - DomainDetails.Detail IPv4Details.IPv4 - IPv6Details.IPv6 URLDetails.URL - limit -- Returned record limit. Integer. - offset -- Offset to start returning results. Integer. - sort -- List of sort operations to perform on the returnset. String. - - parameters -- Full parameters payload dictionary. Not required if using other keywords. + filter : str + The filter expression that should be used to limit the results. String. FQL syntax. + Available values: + Type LastUpdated + KillChain MaliciousConfidence + MaliciousConfidenceValidatedTime + FirstSeen LastSeen + Adversaries.Name Adversaries.Slug + Reports.Title Reports.Slug + Threats.FamilyName Vulnerabilities.CVE + Sectors.Name FileDetails.SHA256 + FileDetails.SHA1 FileDetails.MD5 + DomainDetails.Detail IPv4Details.IPv4 + IPv6Details.IPv6 URLDetails.URL + limit : int + Returned record limit. + offset : str + Offset to start returning results. + sort : str + List of sort operations to perform on the returnset. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intelligence-indicator-graph/SearchIndicators + Returns + ------- + dict + Dictionary object containing API response. """ # Body payload parameters have been deprecated as of version 1.5.4 # if not body: @@ -126,8 +136,16 @@ def lookup(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Search indicators based on FQL filter. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intelligence-indicator-graph/LookupIndicators + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "values": [ "example.com", @@ -137,17 +155,18 @@ def lookup(self: object, "86464cd07e4f924e33a5a1d1dcebdae6" ] } - values -- Values to look up. String or list of strings. - - Arguments: When not specified, the first argument to this method is assumed to be 'values'. - All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intelligence-indicator-graph/LookupIndicators + values : str or list[str] + Values to look up. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'values'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not kwargs and args: kwargs["values"] = args[0] diff --git a/src/falconpy/ioa_exclusions.py b/src/falconpy/ioa_exclusions.py index 089368ce6..9efbab68c 100644 --- a/src/falconpy/ioa_exclusions.py +++ b/src/falconpy/ioa_exclusions.py @@ -69,20 +69,34 @@ def get_ss_exclusion_aggregates(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get Self Service IOA Exclusion aggregates as specified via json in the request body. - Keyword arguments: - ifn_regex -- The `ifn_regex` expression to filter exclusion aggregations by. String. - Used alongside filter expressions provided in the request body. - cl_regex -- The `cl_regex` expression to filter exclusion aggregations by. String. - Used alongside filter expressions provided in the request body. - parent_ifn_regex -- The `parent_ifn_regex` expression to filter exclusion aggregations by. String. - Used alongside filter expressions provided in the request body. - parent_cl_regex -- The `parent_cl_regex` expression to filter exclusion aggregations by. String. - Used alongside filter expressions provided in the request body. - grandparent_ifn_regex -- The `grandparent_ifn_regex` expression to filter exclusion aggregations by. String. - Used alongside filter expressions provided in the request body. - grandparent_cl_regex -- The `grandparent_cl_regex` expression to filter exclusion aggregations by. String. - Used alongside filter expressions provided in the request body. - body -- full body payload, not required when ids keyword is provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioa-exclusions/ss-ioa-exclusions.aggregates.v2 + + Keyword arguments + ----------------- + ifn_regex : str + The `ifn_regex` expression to filter exclusion aggregations by. String. + Used alongside filter expressions provided in the request body. + cl_regex : str + The `cl_regex` expression to filter exclusion aggregations by. String. + Used alongside filter expressions provided in the request body. + parent_ifn_regex : str + The `parent_ifn_regex` expression to filter exclusion aggregations by. String. + Used alongside filter expressions provided in the request body. + parent_cl_regex : str + The `parent_cl_regex` expression to filter exclusion aggregations by. String. + Used alongside filter expressions provided in the request body. + grandparent_ifn_regex : str + The `grandparent_ifn_regex` expression to filter exclusion aggregations by. String. + Used alongside filter expressions provided in the request body. + grandparent_cl_regex : str + The `grandparent_cl_regex` expression to filter exclusion aggregations by. String. + Used alongside filter expressions provided in the request body. + body : list + full body payload, not required when ids keyword is provided. { "date_ranges": [ { @@ -131,35 +145,53 @@ def get_ss_exclusion_aggregates(self: object, "time_zone": "string", "type": "string" } - date_ranges -- Date range timeframe. List of dictionaries. - exclude -- Fields to exclude from results. String. - extended_bounds -- Extended bounds for histogram aggregations. Dictionary. - field -- Field to aggregate on. String. - filters_spec -- Additional filter specifications. Dictionary. - from -- Starting index of overall result set. Integer. - include -- Fields to include in results. String. - max_doc_count -- Maximum number of documents per bucket. Integer. - min_doc_count -- Minimum number of documents per bucket. Integer. - missing -- Value to use for documents missing the field. String. - name -- Name of the aggregation. String. - percents -- Percentile values to calculate. List of integers. - q -- Full text search query. String. - ranges -- Range boundaries for range aggregations. List of dictionaries. - size -- Maximum number of records to return. Integer. - sort -- The field to sort on. String. - sub_aggregates -- Nested aggregation definitions. List. - time_zone -- Time zone for date histogram aggregations. String. - type -- Type of aggregation to perform. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + date_ranges : list[dict] + Date range timeframe. + exclude : str + Fields to exclude from results. + extended_bounds : dict + Extended bounds for histogram aggregations. + field : str + Field to aggregate on. + filters_spec : dict + Additional filter specifications. + from : int + Starting index of overall result set. + include : str + Fields to include in results. + max_doc_count : int + Maximum number of documents per bucket. + min_doc_count : int + Minimum number of documents per bucket. + missing : str + Value to use for documents missing the field. + name : str + Name of the aggregation. + percents : list[int] + Percentile values to calculate. + q : str + Full text search query. + ranges : list[dict] + Range boundaries for range aggregations. + size : int + Maximum number of records to return. + sort : str + The field to sort on. + sub_aggregates : list + Nested aggregation definitions. + time_zone : str + Time zone for date histogram aggregations. + type : str + Type of aggregation to perform. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioa-exclusions/ss-ioa-exclusions.aggregates.v2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = aggregate_payload(submitted_keywords=kwargs) @@ -176,8 +208,16 @@ def get_ss_exclusion_aggregates(self: object, def get_ss_exclusion_reports_v2(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create a report of Self Service IOA Exclusions scoped by the given filters. - Keyword arguments: - body -- full body payload, not required when ids keyword is provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioa-exclusions/ss-ioa-exclusions.get-reports.v2 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when ids keyword is provided. { "report_format": "string", "search": { @@ -185,17 +225,17 @@ def get_ss_exclusion_reports_v2(self: object, body: dict = None, **kwargs) -> Un "sort": "string" } } - report_format -- Format of the report to generate. String. - search -- Search criteria including filter and sort options. Dictionary. + report_format : str + Format of the report to generate. + search : dict + Search criteria including filter and sort options. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioa-exclusions/ss-ioa-exclusions.get-reports.v2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = ioa_ss_exclusion_payload(passed_keywords=kwargs) @@ -215,19 +255,28 @@ def get_ss_exclusion_rules_v2(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get the Self Service IOA Exclusions rules by id. - Keyword arguments: - ids -- The ids of the exclusions to retrieve. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioa-exclusions/ss-ioa-exclusions.get.v2 + + Keyword arguments + ----------------- + ids : str or list[str] + The ids of the exclusions to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -241,8 +290,16 @@ def get_ss_exclusion_rules_v2(self: object, def create_ss_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create new Self Service IOA Exclusions. - Keyword arguments: - body -- full body payload, not required when ids keyword is provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioa-exclusions/ss-ioa-exclusions.create.v2 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when ids keyword is provided. { "exclusions": [ { @@ -264,16 +321,15 @@ def create_ss_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dic } ] } - exclusions -- List of exclusion definitions to create. List of dictionaries. + exclusions : list[dict] + List of exclusion definitions to create. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioa-exclusions/ss-ioa-exclusions.create.v2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: if kwargs.get("exclusions", None): @@ -292,8 +348,16 @@ def create_ss_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dic def update_ss_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update the Self Service IOA Exclusions rule by id. - Keyword arguments: - body -- full body payload, not required when ids keyword is provided. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioa-exclusions/ss-ioa-exclusions.update.v2 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when ids keyword is provided. { "exclusions": [ { @@ -316,16 +380,15 @@ def update_ss_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dic } ] } - exclusions -- List of exclusion definitions to update. List of dictionaries. + exclusions : list[dict] + List of exclusion definitions to update. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioa-exclusions/ss-ioa-exclusions.update.v2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: if kwargs.get("exclusions", None): @@ -344,19 +407,27 @@ def update_ss_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dic def delete_ss_exclusions(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete the Self Service IOA Exclusions rule by id. - Keyword arguments: - ids -- The ids of the exclusions to delete. String or list of strings. - comment -- The comment why these ss ioa exclusions were deleted. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioa-exclusions/ss-ioa-exclusions.delete.v2 + + Keyword arguments + ----------------- + ids : str or list[str] + The ids of the exclusions to delete. + comment : str + The comment why these ss ioa exclusions were deleted. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -375,8 +446,16 @@ def get_ss_exclusion_matched_rules(self: object, For child, parent and grandparent. - Keyword arguments: - body -- full body payload, not required when ids keyword is provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioa-exclusions/ss-ioa-exclusions.matched-rule.v2 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when ids keyword is provided. { "aid": "string", "command_line": "string", @@ -389,23 +468,29 @@ def get_ss_exclusion_matched_rules(self: object, "string" ] } - aid -- Agent ID to match exclusions against. String. - command_line -- Command line of the child process. String. - grandparent_command_line -- Command line of the grandparent process. String. - grandparent_image_file_name -- Image file name of the grandparent process. String. - image_file_name -- Image file name of the child process. String. - parent_command_line -- Command line of the parent process. String. - parent_image_file_name -- Image file name of the parent process. String. - pattern_ids -- Pattern IDs to match exclusions against. List of strings. + aid : str + Agent ID to match exclusions against. + command_line : str + Command line of the child process. + grandparent_command_line : str + Command line of the grandparent process. + grandparent_image_file_name : str + Image file name of the grandparent process. + image_file_name : str + Image file name of the child process. + parent_command_line : str + Command line of the parent process. + parent_image_file_name : str + Image file name of the parent process. + pattern_ids : str or list[str] + Pattern IDs to match exclusions against. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioa-exclusions/ss-ioa-exclusions.matched-rule.v2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = ioa_ss_default_exclusion_payload(passed_keywords=kwargs) @@ -421,8 +506,16 @@ def get_ss_exclusion_matched_rules(self: object, def get_default_ss_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get defaults for Self Service IOA Exclusions based on provided IFN/CLI for child, parent and grandparent. - Keyword arguments: - body -- full body payload, not required when ids keyword is provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioa-exclusions/ss-ioa-exclusions.new-rules.v2 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when ids keyword is provided. { "aid": "string", "command_line": "string", @@ -432,22 +525,27 @@ def get_default_ss_exclusions(self: object, body: dict = None, **kwargs) -> Unio "parent_command_line": "string", "parent_image_file_name": "string" } - aid -- Agent ID to get default exclusions for. String. - command_line -- Command line of the child process. String. - grandparent_command_line -- Command line of the grandparent process. String. - grandparent_image_file_name -- Image file name of the grandparent process. String. - image_file_name -- Image file name of the child process. String. - parent_command_line -- Command line of the parent process. String. - parent_image_file_name -- Image file name of the parent process. String. + aid : str + Agent ID to get default exclusions for. + command_line : str + Command line of the child process. + grandparent_command_line : str + Command line of the grandparent process. + grandparent_image_file_name : str + Image file name of the grandparent process. + image_file_name : str + Image file name of the child process. + parent_command_line : str + Command line of the parent process. + parent_image_file_name : str + Image file name of the parent process. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioa-exclusions/ss-ioa-exclusions.new-rules.v2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = ioa_ss_default_exclusion_payload(passed_keywords=kwargs) @@ -463,29 +561,46 @@ def get_default_ss_exclusions(self: object, body: dict = None, **kwargs) -> Unio def query_ss_exclusions(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search for Self Service IOA Exclusions. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. String. - Filtered queries involving regex fields should specify their expressions in the `ifn_regex` and `cl_regex` parameters. - Regex parameters here are used alongside expressions specified in the filter query parameter. - ifn_regex -- The `ifn_regex` expression to filter exclusions by. String. - cl_regex -- The `cl_regex` expression to filter exclusions by. String. - parent_ifn_regex -- The `parent_ifn_regex` expression to filter exclusions by. String. - parent_cl_regex -- The `parent_cl_regex` expression to filter exclusions by. String. - grandparent_ifn_regex -- The `grandparent_ifn_regex` expression to filter exclusions by. String. - grandparent_cl_regex -- The `grandparent_cl_regex` expression to filter exclusions by. String. - offset -- The offset to start retrieving records from. Integer. - limit -- The maximum records to return. [1-500]. Integer. - sort -- The sort expression that should be used to sort the results. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioa-exclusions/ss-ioa-exclusions.search.v2 + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. String. + Filtered queries involving regex fields should specify their expressions in the + `ifn_regex` and `cl_regex` parameters. + Regex parameters here are used alongside expressions specified in the filter query parameter. + ifn_regex : str + The `ifn_regex` expression to filter exclusions by. + cl_regex : str + The `cl_regex` expression to filter exclusions by. + parent_ifn_regex : str + The `parent_ifn_regex` expression to filter exclusions by. + parent_cl_regex : str + The `parent_cl_regex` expression to filter exclusions by. + grandparent_ifn_regex : str + The `grandparent_ifn_regex` expression to filter exclusions by. + grandparent_cl_regex : str + The `grandparent_cl_regex` expression to filter exclusions by. + offset : int + The offset to start retrieving records from. + limit : int + The maximum records to return. [1-500] + sort : str + The sort expression that should be used to sort the results. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -499,19 +614,28 @@ def query_ss_exclusions(self: object, parameters: dict = None, **kwargs) -> Unio def get_exclusions(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get a set of IOA Exclusions by specifying their IDs. - Keyword arguments: - ids -- List of exclusion IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioa-exclusions/getIOAExclusionsV1 + + Keyword arguments + ----------------- + ids : str or list[str] + List of exclusion IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -525,39 +649,54 @@ def get_exclusions(self: object, *args, parameters: dict = None, **kwargs) -> Un def create_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create the IOA exclusions. - Keyword arguments: - body -- full body payload, not required when ids keyword is provided. - { - "cl_regex": "string", - "comment": "string", - "description": "string", - "detection_json": "string", - "groups": [ - "string" - ], - "ifn_regex": "string", - "name": "string", - "pattern_id": "string", - "pattern_name": "string" - } - cl_regex -- Command line regex value for the exclusion. String. - comment -- Comment describing why the exclusion is entered. String. - description -- Description of the exclusion. String. - detection_json -- Detection JSON payload for the exclusion. String. - groups -- Group IDs to exclude. List of strings. - ifn_regex -- Image file name regex value for the exclusion. String. - name -- Name of the exclusion. String. - pattern_id -- Pattern ID associated with the exclusion. String. - pattern_name -- Pattern name associated with the exclusion. String. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioa-exclusions/createIOAExclusionsV1 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when ids keyword is provided. + { + "cl_regex": "string", + "comment": "string", + "description": "string", + "detection_json": "string", + "groups": [ + "string" + ], + "ifn_regex": "string", + "name": "string", + "pattern_id": "string", + "pattern_name": "string" + } + cl_regex : str + Command line regex value for the exclusion. + comment : str + Comment describing why the exclusion is entered. + description : str + Description of the exclusion. + detection_json : str + Detection JSON payload for the exclusion. + groups : str or list[str] + Group IDs to exclude. + ifn_regex : str + Image file name regex value for the exclusion. + name : str + Name of the exclusion. + pattern_id : str + Pattern ID associated with the exclusion. + pattern_name : str + Pattern name associated with the exclusion. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = ioa_exclusion_payload(passed_keywords=kwargs) @@ -573,20 +712,30 @@ def create_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[s def delete_exclusions(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete the IOA Exclusions by ID. - Keyword arguments: - comment -- Explains why this exclusions was deleted. String. - ids -- List of exclusion IDs to delete. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioa-exclusions/deleteIOAExclusionsV1 + + Keyword arguments + ----------------- + comment : str + Explains why this exclusions was deleted. + ids : str or list[str] + List of exclusion IDs to delete. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -600,42 +749,57 @@ def delete_exclusions(self: object, parameters: dict = None, **kwargs) -> Union[ def update_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update the IOA Exclusions. - Keyword arguments: - body -- full body payload, not required when ids keyword is provided. - { - "cl_regex": "string", - "comment": "string", - "description": "string", - "detection_json": "string", - "groups": [ - "string" - ], - "id": "string", - "ifn_regex": "string", - "name": "string", - "pattern_id": "string", - "pattern_name": "string" - } - cl_regex -- Command line regex value for the exclusion. String. - comment -- Comment describing why the exclusion is updated. String. - description -- Description of the exclusion. String. - detection_json -- Detection JSON payload for the exclusion. String. - groups -- Group IDs to exclude. List of strings. - id -- Identifier of the exclusion to update. String. - ifn_regex -- Image file name regex value for the exclusion. String. - name -- Name of the exclusion. String. - pattern_id -- Pattern ID associated with the exclusion. String. - pattern_name -- Pattern name associated with the exclusion. String. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioa-exclusions/updateIOAExclusionsV1 + Keyword arguments + ----------------- + body : dict + full body payload, not required when ids keyword is provided. + { + "cl_regex": "string", + "comment": "string", + "description": "string", + "detection_json": "string", + "groups": [ + "string" + ], + "id": "string", + "ifn_regex": "string", + "name": "string", + "pattern_id": "string", + "pattern_name": "string" + } + cl_regex : str + Command line regex value for the exclusion. + comment : str + Comment describing why the exclusion is updated. + description : str + Description of the exclusion. + detection_json : str + Detection JSON payload for the exclusion. + groups : str or list[str] + Group IDs to exclude. + id : str + Identifier of the exclusion to update. + ifn_regex : str + Image file name regex value for the exclusion. + name : str + Name of the exclusion. + pattern_id : str + Pattern ID associated with the exclusion. + pattern_name : str + Pattern name associated with the exclusion. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = ioa_exclusion_payload(passed_keywords=kwargs) @@ -656,42 +820,54 @@ def query_exclusions(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Search for IOA Exclusions. - Keyword arguments: - cl_regex -- The cl_regex expression to filter exclusions by, used alongside expressions - specified in the filter query parameter. - filter -- The filter expression that should be used to limit the results. FQL syntax. - The filter expression that should be used to limit the results. - Filtered queries involving regex fields should specify their expressions in the - 'ifn_regex' and 'cl_regex' parameters. - An asterisk wildcard '*' includes all results. - AVAILABLE FILTERS - applied_globally last_modified - created_by modified_by - created_on value - name pattern - ifn_regex -- The ifn_regex expression to filter exclusions by, used alongside expressions - specified in the filter query parameter. String. - limit -- The maximum number of exclusions to return in this response. - [Integer, default: 100; max: 500] - Use with the offset parameter to manage pagination of results. - offset -- The first exclusion to return, where 0 is the latest exclusion. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. last_behavior|asc). - Available sort fields: - applied_globally last_modified - created_by modified_by - created_on value - name pattern - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioa-exclusions/queryIOAExclusionsV1 + + Keyword arguments + ----------------- + cl_regex : str + The cl_regex expression to filter exclusions by, used alongside expressions + specified in the filter query parameter. + filter : str + The filter expression that should be used to limit the results. FQL syntax. + The filter expression that should be used to limit the results. + Filtered queries involving regex fields should specify their expressions in the + 'ifn_regex' and 'cl_regex' parameters. + An asterisk wildcard '*' includes all results. + AVAILABLE FILTERS + applied_globally last_modified + created_by modified_by + created_on value + name pattern + ifn_regex : str + The ifn_regex expression to filter exclusions by, used alongside expressions + specified in the filter query parameter. + limit : int + The maximum number of exclusions to return in this response. + [Integer, default: 100; max: 500] + Use with the offset parameter to manage pagination of results. + offset : int + The first exclusion to return, where 0 is the latest exclusion. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. last_behavior|asc). + Available sort fields: + applied_globally last_modified + created_by modified_by + created_on value + name pattern + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/ioc.py b/src/falconpy/ioc.py index 4d2066dcc..547090170 100644 --- a/src/falconpy/ioc.py +++ b/src/falconpy/ioc.py @@ -72,9 +72,18 @@ def indicator_aggregate(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get indicator aggregates as specified via json in request body. - Keyword arguments: - body -- full body payload, not required when using other keywords. - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioc/indicator.aggregate.v1 + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. + body : list + full body payload, not required when using other keywords. { "date_ranges": [ { @@ -108,38 +117,44 @@ def indicator_aggregate(self: object, "type": "string" } - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioc/indicator.aggregate.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: # IOC aggregate payload does NOT expect a list @@ -157,43 +172,55 @@ def indicator_aggregate(self: object, def indicator_combined(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get Combined for Indicators. - Keyword arguments: - after -- A pagination token used with the limit parameter to manage pagination of results. - On your first request, don't provide an `after` token. On subsequent requests, - provide the `after` token from the previous response to continue from that place - in the results. To access more than 10k indicators, use the `after` parameter - instead of `offset`. - filter -- The filter expression that should be used to limit the results. FQL syntax. - from_parent -- The filter for returning either only indicators for the request customer - or its MSSP parents. Boolean. - limit -- The maximum records to return. [1-500]. Defaults to 100. - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. - Offset and After params are mutually exclusive. - If none provided then scrolling will be used by default. - To access more than 10K IOCs, use the `after` parameter instead of `offset`. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by (e.g. alias.desc or state.asc). FQL syntax. - Available values - action modified_by - applied_globally modified_on - metadata.av_hits metadata.original_filename.raw - metadata.company_name.raw metadata.product_name.raw - created_by metadata.product_version - created_on severity_number - expiration source - expired type - metadata.filename.raw value - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioc/indicator.combined.v1 + + Keyword arguments + ----------------- + after : str + A pagination token used with the limit parameter to manage pagination of results. + On your first request, don't provide an `after` token. On subsequent requests, + provide the `after` token from the previous response to continue from that place + in the results. To access more than 10k indicators, use the `after` parameter + instead of `offset`. + filter : str + The filter expression that should be used to limit the results. FQL syntax. + from_parent : bool + The filter for returning either only indicators for the request customer + or its MSSP parents. + limit : int + The maximum records to return. [1-500]. Defaults to 100. + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. + Offset and After params are mutually exclusive. + If none provided then scrolling will be used by default. + To access more than 10K IOCs, use the `after` parameter instead of `offset`. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by (e.g. alias.desc or state.asc). FQL syntax. + Available values + action modified_by + applied_globally modified_on + metadata.av_hits metadata.original_filename.raw + metadata.company_name.raw metadata.product_name.raw + created_by metadata.product_version + created_on severity_number + expiration source + expired type + metadata.filename.raw value + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -207,19 +234,28 @@ def indicator_combined(self: object, parameters: dict = None, **kwargs) -> Union def action_get(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get Actions by IDs. - Keyword arguments: - ids -- List of Indicator ID(s) you wish to lookup. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioc/action.get.v1 + + Keyword arguments + ----------------- + ids : str or list[str] + List of Indicator ID(s) you wish to lookup. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -233,8 +269,16 @@ def action_get(self: object, *args, parameters: dict = None, **kwargs) -> Union[ def get_indicators_report(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Launch an indicators report creation job. - Keyword arguments: - body -- full parameters payload, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioc/GetIndicatorsReport + + Keyword arguments + ----------------- + body : dict + full parameters payload, not required if using other keywords. { "from_parent": true, "report_format": "string", @@ -244,29 +288,33 @@ def get_indicators_report(self: object, body: dict = None, **kwargs) -> Union[Di "sort": "string" } } - filter -- FQL formatted string specifying the search filter. - Overridden if 'search' keyword is provided. - from_parent -- Flag indicating if this indicator is defined in the parent. Boolean. - query -- FQL formatted string specifying the search query. - Overridden if 'search' keyword is provided. - report_format -- Format of the report. String. - search -- Search parameters. Strings are in FQL format. Dictionary. - { - "filter": "string", - "query": "string", - "sort": "string" - } - sort -- FQL formatted string specifying the search sort. - Overridden if 'search' keyword is provided. + filter : str + FQL formatted string specifying the search filter. + Overridden if 'search' keyword is provided. + from_parent : bool + Flag indicating if this indicator is defined in the parent. + query : str + FQL formatted string specifying the search query. + Overridden if 'search' keyword is provided. + report_format : str + Format of the report. + search : dict + Search parameters. Strings are in FQL format. Dictionary. + { + "filter": "string", + "query": "string", + "sort": "string" + } + sort : str + FQL formatted string specifying the search sort. + Overridden if 'search' keyword is provided. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioc/GetIndicatorsReport + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = indicator_report_payload(passed_keywords=kwargs) @@ -283,19 +331,28 @@ def get_indicators_report(self: object, body: dict = None, **kwargs) -> Union[Di def indicator_get(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get Indicators by IDs. - Keyword arguments: - ids -- List of Indicator ID(s) you wish to lookup. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioc/indicator.get.v1 + + Keyword arguments + ----------------- + ids : str or list[str] + List of Indicator ID(s) you wish to lookup. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -313,10 +370,20 @@ def indicator_create(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create Indicators. - Keyword arguments: - action -- Default action for the IOC. String. - applied_globally -- Is this IOC applied globally? Boolean. - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioc/indicator.create.v1 + + Keyword arguments + ----------------- + action : str + Default action for the IOC. + applied_globally : bool + Is this IOC applied globally? + body : dict + full body payload, not required if keywords are used. { "comment": "string", "indicators": [ @@ -345,36 +412,51 @@ def indicator_create(self: object, } ] } - comment -- Audit log comment for the update. String. - description -- Description for the IOC. String. - expiration -- UTC formatted date string. String. - filename -- Filename to use in the metadata dictionary. String. - host_groups -- List of host groups to apply this IOC to. List of strings. - ignore_warnings -- Set to true to ignore warnings and add all IOCs. Boolean. Default: False - indicators -- List of indicators to create. List of dictionaries. - metadata -- Dictionary containing the filename for the IOC. - Not required if filename is used. - { - "filename": "string" - } - mobile_action -- Action to perform for mobile. String. - parameters -- full parameters payload in JSON format. Not required if using other keywords. - platforms -- Platforms this IOC applies to. String. - retrodetects -- Whether to submit to retrodetects. Boolean. - severity -- Severity this IOC generates. String. - source -- Source of the IOC. String. - tags -- List of Falcon Grouping Tags to apply this IOC to. List of strings. - type -- Type of indicator. String. - value -- Value of the indicator. String. + comment : str + Audit log comment for the update. + description : str + Description for the IOC. + expiration : str + UTC formatted date. + filename : str + Filename to use in the metadata. + host_groups : list[str] + List of host groups to apply this IOC to. + ignore_warnings : bool + Set to true to ignore warnings and add all IOCs. Boolean. Default: False + indicators : list[dict] + List of indicators to create. + metadata : str + Dictionary containing the filename for the IOC. + Not required if filename is used. + { + "filename": "string" + } + mobile_action : str + Action to perform for mobile. + parameters : dict + Full parameters payload. Not required if using other keywords. + platforms : str + Platforms this IOC applies to. + retrodetects : bool + Whether to submit to retrodetects. + severity : str + Severity this IOC generates. + source : str + Source of the IOC. + tags : list[str] + List of Falcon Grouping Tags to apply this IOC to. + type : str + Type of indicator. + value : str + Value of the indicator. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioc/indicator.create.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = indicator_payload(passed_keywords=kwargs) @@ -396,20 +478,30 @@ def indicator_delete(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete Indicators by IDs. - Keyword arguments: - ids -- List of Indicator ID(s) you wish to delete. String or list of strings. - from_parent -- Limit action to IOCs originating from the MSSP parent. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioc/indicator.delete.v1 + + Keyword arguments + ----------------- + ids : str or list[str] + List of Indicator ID(s) you wish to delete. + from_parent : bool + Limit action to IOCs originating from the MSSP parent. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -427,10 +519,20 @@ def indicator_update(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update Indicators. - Keyword arguments: - action -- Default action for the IOC. String. - applied_globally -- Is this IOC applied globally? Boolean. - body -- full body payload, not required if keywords are used. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioc/indicator.update.v1 + + Keyword arguments + ----------------- + action : str + Default action for the IOC. + applied_globally : bool + Is this IOC applied globally? + body : dict + full body payload, not required if keywords are used. { "bulk_update": { "action": "string", @@ -478,40 +580,58 @@ def indicator_update(self: object, } ] } - bulk_update -- Dictionary representing the indicator values to update in bulk. - comment -- Audit log comment for the update. String. - description -- Description for the IOC. String. - expiration -- UTC formatted date string. String. - filename -- Filename to use in the metadata dictionary. String. - from_parent -- Flag indicating if this indicator originates from the parent. Boolean. - host_groups -- List of host groups to apply this IOC to. List of strings. - id -- ID of the indicator to be updated. At least one ID must be specified using this - keyword, or as part of the indicators list using the indicators keyword. - indicators -- List of indicators to update. List of dictionaries. - ignore_warnings -- Set to true to ignore warnings and add all IOCs. Boolean. Default: False - metadata -- Dictionary containing the filename for the IOC. - Not required if filename is used. - { - "filename": "string" - } - mobile_action -- Action to perform for mobile. String. - parameters -- full parameters payload in JSON format. Not required if using other keywords. - platforms -- Platforms this IOC applies to. String. - retrodetects -- Whether to submit to retrodetects. Boolean. - severity -- Severity this IOC generates. String. - source -- Source of the IOC. String. - tags -- List of Falcon Grouping Tags to apply this IOC to. List of strings. - type -- Type of indicator. String. - value -- Value of the indicator. String. + bulk_update : dict + Dictionary representing the indicator values to update in bulk. + comment : str + Audit log comment for the update. + description : str + Description for the IOC. + expiration : str + UTC formatted date. + filename : str + Filename to use in the metadata. + from_parent : bool + Flag indicating if this indicator originates from the parent. + host_groups : list[str] + List of host groups to apply this IOC to. + id : str + ID of the indicator to be updated. At least one ID must be specified using this + keyword, or as part of the indicators list using the indicators keyword. + indicators : list[dict] + List of indicators to update. + ignore_warnings : bool + Set to true to ignore warnings and add all IOCs. Boolean. Default: False + metadata : str + Dictionary containing the filename for the IOC. + Not required if filename is used. + { + "filename": "string" + } + mobile_action : str + Action to perform for mobile. + parameters : dict + Full parameters payload. Not required if using other keywords. + platforms : str + Platforms this IOC applies to. + retrodetects : bool + Whether to submit to retrodetects. + severity : str + Severity this IOC generates. + source : str + Source of the IOC. + tags : list[str] + List of Falcon Grouping Tags to apply this IOC to. + type : str + Type of indicator. + value : str + Value of the indicator. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioc/indicator.update.v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = indicator_update_payload(passed_keywords=kwargs) @@ -529,19 +649,27 @@ def indicator_update(self: object, def action_query(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query Actions. - Keyword arguments: - limit -- Number of IDs to return. Integer. - offset -- Starting index of overall result set from which to return IDs. String. - parameters -- full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioc/action.query.v1 + + Keyword arguments + ----------------- + limit : int + Number of IDs to return. + offset : str + Starting index of overall result set from which to return IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -555,43 +683,55 @@ def action_query(self: object, parameters: dict = None, **kwargs) -> Union[Dict[ def indicator_search(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search for Indicators. - Keyword arguments: - after -- A pagination token used with the limit parameter to manage pagination of results. - On your first request, don't provide an `after` token. On subsequent requests, - provide the `after` token from the previous response to continue from that place - in the results. To access more than 10k indicators, use the `after` parameter - instead of `offset`. - filter -- The filter expression that should be used to limit the results. FQL syntax. - from_parent -- The filter for returning either only indicators for the request customer - or its MSSP parents. String. - limit -- The maximum records to return. [1-500]. Defaults to 100. - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. - Offset and After params are mutually exclusive. - If none provided then scrolling will be used by default. - To access more than 10K IOCs, use the `after` parameter instead of `offset`. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by (e.g. alias.desc or state.asc). FQL syntax. - Available values - action modified_by - applied_globally modified_on - metadata.av_hits metadata.original_filename.raw - metadata.company_name.raw metadata.product_name.raw - created_by metadata.product_version - created_on severity_number - expiration source - expired type - metadata.filename.raw value - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioc/indicator.search.v1 + + Keyword arguments + ----------------- + after : str + A pagination token used with the limit parameter to manage pagination of results. + On your first request, don't provide an `after` token. On subsequent requests, + provide the `after` token from the previous response to continue from that place + in the results. To access more than 10k indicators, use the `after` parameter + instead of `offset`. + filter : str + The filter expression that should be used to limit the results. FQL syntax. + from_parent : bool + The filter for returning either only indicators for the request customer + or its MSSP parents. + limit : int + The maximum records to return. [1-500]. Defaults to 100. + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. + Offset and After params are mutually exclusive. + If none provided then scrolling will be used by default. + To access more than 10K IOCs, use the `after` parameter instead of `offset`. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by (e.g. alias.desc or state.asc). FQL syntax. + Available values + action modified_by + applied_globally modified_on + metadata.av_hits metadata.original_filename.raw + metadata.company_name.raw metadata.product_name.raw + created_by metadata.product_version + created_on severity_number + expiration source + expired type + metadata.filename.raw value + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -605,19 +745,27 @@ def indicator_search(self: object, parameters: dict = None, **kwargs) -> Union[D def ioc_type_query(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query IOC types. - Keyword arguments: - limit -- Number of IDs to return. Integer. - offset -- Starting index of overall result set from which to return IDs. String. - parameters -- full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioc/ioc_type.query.v1 + + Keyword arguments + ----------------- + limit : int + Number of IDs to return. + offset : str + Starting index of overall result set from which to return IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -631,19 +779,27 @@ def ioc_type_query(self: object, parameters: dict = None, **kwargs) -> Union[Dic def platform_query(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query platforms. - Keyword arguments: - limit -- Number of IDs to return. Integer. - offset -- Starting index of overall result set from which to return IDs. String. - parameters -- full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioc/platform.query.v1 + + Keyword arguments + ----------------- + limit : int + Number of IDs to return. + offset : str + Starting index of overall result set from which to return IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -657,19 +813,27 @@ def platform_query(self: object, parameters: dict = None, **kwargs) -> Union[Dic def severity_query(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query severities. - Keyword arguments: - limit -- Number of IDs to return. Integer. - offset -- Starting index of overall result set from which to return IDs. String. - parameters -- full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioc/severity.query.v1 + + Keyword arguments + ----------------- + limit : int + Number of IDs to return. + offset : str + Starting index of overall result set from which to return IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -683,25 +847,33 @@ def severity_query(self: object, parameters: dict = None, **kwargs) -> Union[Dic def devices_count_legacy(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Return the number of hosts in your customer account that have observed a given custom IOC. - Keyword arguments: - type -- The type of indicator. String. Required. - Valid types include: - `sha256`: A hex-encoded sha256 hash string. Length - min: 64, max: 64. - `md5`: A hex-encoded md5 hash string. Length - min 32, max: 32. - `domain`: A domain name. Length - min: 1, max: 200. - `ipv4`: An IPv4 address. Must be a valid IP address. - `ipv6`: An IPv6 address. Must be a valid IP address. - parameters -- full parameters payload, not required if using other keywords. - value -- The string representation of the indicator. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/iocs/DevicesCount + + Keyword arguments + ----------------- + type : str + The type of indicator. String. Required. + Valid types include: + `sha256`: A hex-encoded sha256 hash string. Length - min: 64, max: 64. + `md5`: A hex-encoded md5 hash string. Length - min 32, max: 32. + `domain`: A domain name. Length - min: 1, max: 200. + `ipv4`: An IPv4 address. Must be a valid IP address. + `ipv6`: An IPv6 address. Must be a valid IP address. + parameters : dict + Full parameters payload. Not required if using other keywords. + value : str + The string representation of the indicator. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -715,25 +887,33 @@ def devices_count_legacy(self: object, parameters: dict = None, **kwargs) -> Uni def devices_count(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Return the number of hosts in your customer account that have observed a given custom IOC. - Keyword arguments: - type -- The type of indicator. String. Required. - Valid types include: - `sha256`: A hex-encoded sha256 hash string. Length - min: 64, max: 64. - `md5`: A hex-encoded md5 hash string. Length - min 32, max: 32. - `domain`: A domain name. Length - min: 1, max: 200. - `ipv4`: An IPv4 address. Must be a valid IP address. - `ipv6`: An IPv6 address. Must be a valid IP address. - parameters -- full parameters payload, not required if using other keywords. - value -- The string representation of the indicator. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioc/indicator.get.device.count.v1 + + Keyword arguments + ----------------- + type : str + The type of indicator. String. Required. + Valid types include: + `sha256`: A hex-encoded sha256 hash string. Length - min: 64, max: 64. + `md5`: A hex-encoded md5 hash string. Length - min 32, max: 32. + `domain`: A domain name. Length - min: 1, max: 200. + `ipv4`: An IPv4 address. Must be a valid IP address. + `ipv6`: An IPv6 address. Must be a valid IP address. + parameters : dict + Full parameters payload. Not required if using other keywords. + value : str + The string representation of the indicator. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -749,29 +929,39 @@ def devices_ran_on_legacy(self: object, parameters: dict = None, **kwargs) -> Un For details about those hosts, use the hosts API interface. - Keyword arguments: - type -- The type of indicator. String. Required. - Valid types include: - `sha256`: A hex-encoded sha256 hash string. Length - min: 64, max: 64. - `md5`: A hex-encoded md5 hash string. Length - min 32, max: 32. - `domain`: A domain name. Length - min: 1, max: 200. - `ipv4`: An IPv4 address. Must be a valid IP address. - `ipv6`: An IPv6 address. Must be a valid IP address. - limit -- The first process to return, where 0 is the latest offset. - Use with the offset parameter to manage pagination of results. - offset -- The first process to return, where 0 is the latest offset. - Use with the limit parameter to manage pagination of results. - parameters -- full parameters payload, not required if using other keywords. - value -- The string representation of the indicator. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/iocs/DevicesRanOn + + Keyword arguments + ----------------- + type : str + The type of indicator. String. Required. + Valid types include: + `sha256`: A hex-encoded sha256 hash string. Length - min: 64, max: 64. + `md5`: A hex-encoded md5 hash string. Length - min 32, max: 32. + `domain`: A domain name. Length - min: 1, max: 200. + `ipv4`: An IPv4 address. Must be a valid IP address. + `ipv6`: An IPv6 address. Must be a valid IP address. + limit : str + The first process to return, where 0 is the latest offset. + Use with the offset parameter to manage pagination of results. + offset : str + The first process to return, where 0 is the latest offset. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + value : str + The string representation of the indicator. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -787,29 +977,39 @@ def devices_ran_on(self: object, parameters: dict = None, **kwargs) -> Union[Dic For details about those hosts, use the hosts API interface. - Keyword arguments: - type -- The type of indicator. String. Required. - Valid types include: - `sha256`: A hex-encoded sha256 hash string. Length - min: 64, max: 64. - `md5`: A hex-encoded md5 hash string. Length - min 32, max: 32. - `domain`: A domain name. Length - min: 1, max: 200. - `ipv4`: An IPv4 address. Must be a valid IP address. - `ipv6`: An IPv6 address. Must be a valid IP address. - limit -- The first process to return, where 0 is the latest offset. - Use with the offset parameter to manage pagination of results. - offset -- The first process to return, where 0 is the latest offset. - Use with the limit parameter to manage pagination of results. - parameters -- full parameters payload, not required if using other keywords. - value -- The string representation of the indicator. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioc/indicator.get.devices.ran.on.v1 + + Keyword arguments + ----------------- + type : str + The type of indicator. String. Required. + Valid types include: + `sha256`: A hex-encoded sha256 hash string. Length - min: 64, max: 64. + `md5`: A hex-encoded md5 hash string. Length - min 32, max: 32. + `domain`: A domain name. Length - min: 1, max: 200. + `ipv4`: An IPv4 address. Must be a valid IP address. + `ipv6`: An IPv6 address. Must be a valid IP address. + limit : str + The first process to return, where 0 is the latest offset. + Use with the offset parameter to manage pagination of results. + offset : str + The first process to return, where 0 is the latest offset. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + value : str + The string representation of the indicator. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -826,32 +1026,43 @@ def processes_ran_on_legacy(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Search for processes associated with a custom IOC. - Keyword arguments: - type -- The type of indicator. String. Required. - Valid types include: - `sha256`: A hex-encoded sha256 hash string. Length - min: 64, max: 64. - `md5`: A hex-encoded md5 hash string. Length - min 32, max: 32. - `domain`: A domain name. Length - min: 1, max: 200. - `ipv4`: An IPv4 address. Must be a valid IP address. - `ipv6`: An IPv6 address. Must be a valid IP address. - limit -- The first process to return, where 0 is the latest offset. - Use with the offset parameter to manage pagination of results. - offset -- The first process to return, where 0 is the latest offset. - Use with the limit parameter to manage pagination of results. - device_id -- Specify a host's ID to return only processes from that host. - Get a host's ID from get_device_details, the Falcon console, - or the Streaming API. - parameters -- full parameters payload, not required if using other keywords. - value -- The string representation of the indicator. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/iocs/ProcessesRanOn + + Keyword arguments + ----------------- + type : str + The type of indicator. String. Required. + Valid types include: + `sha256`: A hex-encoded sha256 hash string. Length - min: 64, max: 64. + `md5`: A hex-encoded md5 hash string. Length - min 32, max: 32. + `domain`: A domain name. Length - min: 1, max: 200. + `ipv4`: An IPv4 address. Must be a valid IP address. + `ipv6`: An IPv6 address. Must be a valid IP address. + limit : str + The first process to return, where 0 is the latest offset. + Use with the offset parameter to manage pagination of results. + offset : str + The first process to return, where 0 is the latest offset. + Use with the limit parameter to manage pagination of results. + device_id : str + Specify a host's ID to return only processes from that host. + Get a host's ID from get_device_details, the Falcon console, + or the Streaming API. + parameters : dict + Full parameters payload. Not required if using other keywords. + value : str + The string representation of the indicator. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -865,31 +1076,42 @@ def processes_ran_on_legacy(self: object, def processes_ran_on(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search for processes associated with a custom IOC. - Keyword arguments: - type -- The type of indicator. String. Required. - Valid types include: - `sha256`: A hex-encoded sha256 hash string. Length - min: 64, max: 64. - `md5`: A hex-encoded md5 hash string. Length - min 32, max: 32. - `domain`: A domain name. Length - min: 1, max: 200. - `ipv4`: An IPv4 address. Must be a valid IP address. - `ipv6`: An IPv6 address. Must be a valid IP address. - limit -- The first process to return, where 0 is the latest offset. - Use with the offset parameter to manage pagination of results. - offset -- The first process to return, where 0 is the latest offset. - Use with the limit parameter to manage pagination of results. - device_id -- Specify a host's ID to return only processes from that host. Get a host's ID from QueryDevicesByFilter, - the Falcon console, or the Streaming API. - parameters -- full parameters payload, not required if using other keywords. - value -- The string representation of the indicator. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioc/indicator.get.processes_ran_on.v1 + + Keyword arguments + ----------------- + type : str + The type of indicator. String. Required. + Valid types include: + `sha256`: A hex-encoded sha256 hash string. Length - min: 64, max: 64. + `md5`: A hex-encoded md5 hash string. Length - min 32, max: 32. + `domain`: A domain name. Length - min: 1, max: 200. + `ipv4`: An IPv4 address. Must be a valid IP address. + `ipv6`: An IPv6 address. Must be a valid IP address. + limit : str + The first process to return, where 0 is the latest offset. + Use with the offset parameter to manage pagination of results. + offset : str + The first process to return, where 0 is the latest offset. + Use with the limit parameter to manage pagination of results. + device_id : str + Specify a host's ID to return only processes from that host. Get a host's ID from QueryDevicesByFilter, + the Falcon console, or the Streaming API. + parameters : dict + Full parameters payload. Not required if using other keywords. + value : str + The string representation of the indicator. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -907,20 +1129,28 @@ def entities_processes(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """For the provided ProcessID retrieve the process details. - Keyword arguments: - ids -- List of Process ID(s) for the running process you want to lookup. - String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/iocs/entities.processes + + Keyword arguments + ----------------- + ids : str or list[str] + List of Process ID(s) for the running process you want to lookup. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -953,8 +1183,16 @@ def indicator_sdmf_query_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Execute an SDMF data frame query against IOC indicators. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioc/indicator_sdmf_query_v1 + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "control_info": { "deadline": "string", @@ -1021,19 +1259,21 @@ def indicator_sdmf_query_v1(self: object, ], "res_id": "string" } - control_info -- The control_info value. Dictionary. - id -- The id value. String. - nodes -- The nodes value. List. - res_id -- The res_id value. String. + control_info : dict + The control_info value. + id : str + The id value. + nodes : list + The nodes value. + res_id : str + The res_id value. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ioc/indicator_sdmf_query_v1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = indicator_sdmf_query_v1_payload(passed_keywords=kwargs) diff --git a/src/falconpy/iocs.py b/src/falconpy/iocs.py index ef99241bf..77a629afd 100644 --- a/src/falconpy/iocs.py +++ b/src/falconpy/iocs.py @@ -66,25 +66,33 @@ class Iocs(ServiceClass): def devices_count(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get the number of hosts in your customer account that have observed a given custom IOC. - Keyword arguments: - type -- The type of indicator. String. Required. - Valid types include: - `sha256`: A hex-encoded sha256 hash string. Length - min: 64, max: 64. - `md5`: A hex-encoded md5 hash string. Length - min 32, max: 32. - `domain`: A domain name. Length - min: 1, max: 200. - `ipv4`: An IPv4 address. Must be a valid IP address. - `ipv6`: An IPv6 address. Must be a valid IP address. - parameters -- full parameters payload, not required if using other keywords. - value -- The string representation of the indicator. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/iocs/DevicesCount + + Keyword arguments + ----------------- + type : str + The type of indicator. String. Required. + Valid types include: + `sha256`: A hex-encoded sha256 hash string. Length - min: 64, max: 64. + `md5`: A hex-encoded md5 hash string. Length - min 32, max: 32. + `domain`: A domain name. Length - min: 1, max: 200. + `ipv4`: An IPv4 address. Must be a valid IP address. + `ipv6`: An IPv6 address. Must be a valid IP address. + parameters : dict + Full parameters payload. Not required if using other keywords. + value : str + The string representation of the indicator. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -107,7 +115,17 @@ def get_ioc(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/iocs/GetIOC + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return generate_error_result( "This method has been deprecated. Please use the new IOC Service Class method " @@ -126,7 +144,17 @@ def create_ioc(self: object, body: dict) -> Union[Dict[str, Union[int, dict]], R HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/iocs/CreateIOC + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return generate_error_result( "This method has been deprecated. Please use the new IOC Service Class method " @@ -146,7 +174,17 @@ def delete_ioc(self: object, parameters: dict = None, **kwargs) -> Union[Dict[st HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/iocs/DeleteIOC + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return generate_error_result( "This method has been deprecated. Please use the new IOC Service Class method " @@ -166,7 +204,17 @@ def update_ioc(self: object, body: dict, parameters: dict = None, **kwargs) -> U HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/iocs/UpdateIOC + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return generate_error_result( "This method has been deprecated. Please use the new IOC Service Class method " @@ -179,29 +227,39 @@ def devices_ran_on(self: object, parameters: dict = None, **kwargs) -> Union[Dic For details about those hosts, use the hosts API interface. - Keyword arguments: - type -- The type of indicator. String. Required. - Valid types include: - `sha256`: A hex-encoded sha256 hash string. Length - min: 64, max: 64. - `md5`: A hex-encoded md5 hash string. Length - min 32, max: 32. - `domain`: A domain name. Length - min: 1, max: 200. - `ipv4`: An IPv4 address. Must be a valid IP address. - `ipv6`: An IPv6 address. Must be a valid IP address. - limit -- The first process to return, where 0 is the latest offset. - Use with the offset parameter to manage pagination of results. - offset -- The first process to return, where 0 is the latest offset. - Use with the limit parameter to manage pagination of results. - parameters -- full parameters payload, not required if using other keywords. - value -- The string representation of the indicator. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/iocs/DevicesRanOn + + Keyword arguments + ----------------- + type : str + The type of indicator. String. Required. + Valid types include: + `sha256`: A hex-encoded sha256 hash string. Length - min: 64, max: 64. + `md5`: A hex-encoded md5 hash string. Length - min 32, max: 32. + `domain`: A domain name. Length - min: 1, max: 200. + `ipv4`: An IPv4 address. Must be a valid IP address. + `ipv6`: An IPv6 address. Must be a valid IP address. + limit : str + The first process to return, where 0 is the latest offset. + Use with the offset parameter to manage pagination of results. + offset : str + The first process to return, where 0 is the latest offset. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + value : str + The string representation of the indicator. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -224,7 +282,17 @@ def query_iocs(self: object, parameters: dict = None, **kwargs) -> Union[Dict[st HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/iocs/QueryIOCs + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return generate_error_result( "This method has been deprecated. Please use the new IOC Service Class method " @@ -235,31 +303,42 @@ def query_iocs(self: object, parameters: dict = None, **kwargs) -> Union[Dict[st def processes_ran_on(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search for processes associated with a custom IOC. - Keyword arguments: - type -- The type of indicator. String. Required. - Valid types include: - `sha256`: A hex-encoded sha256 hash string. Length - min: 64, max: 64. - `md5`: A hex-encoded md5 hash string. Length - min 32, max: 32. - `domain`: A domain name. Length - min: 1, max: 200. - `ipv4`: An IPv4 address. Must be a valid IP address. - `ipv6`: An IPv6 address. Must be a valid IP address. - limit -- The first process to return, where 0 is the latest offset. - Use with the offset parameter to manage pagination of results. - offset -- The first process to return, where 0 is the latest offset. - Use with the limit parameter to manage pagination of results. - device_id -- Specify a host's ID to return only processes from that host. Get a host's ID from QueryDevicesByFilter, - the Falcon console, or the Streaming API. - parameters -- full parameters payload, not required if using other keywords. - value -- The string representation of the indicator. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/iocs/ProcessesRanOn + + Keyword arguments + ----------------- + type : str + The type of indicator. String. Required. + Valid types include: + `sha256`: A hex-encoded sha256 hash string. Length - min: 64, max: 64. + `md5`: A hex-encoded md5 hash string. Length - min 32, max: 32. + `domain`: A domain name. Length - min: 1, max: 200. + `ipv4`: An IPv4 address. Must be a valid IP address. + `ipv6`: An IPv6 address. Must be a valid IP address. + limit : str + The first process to return, where 0 is the latest offset. + Use with the offset parameter to manage pagination of results. + offset : str + The first process to return, where 0 is the latest offset. + Use with the limit parameter to manage pagination of results. + device_id : str + Specify a host's ID to return only processes from that host. Get a host's ID from QueryDevicesByFilter, + the Falcon console, or the Streaming API. + parameters : dict + Full parameters payload. Not required if using other keywords. + value : str + The string representation of the indicator. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -277,20 +356,28 @@ def entities_processes(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """For the provided ProcessID retrieve the process details. - Keyword arguments: - ids -- List of Process ID(s) for the running process you want to lookup. - String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/iocs/entities.processes + + Keyword arguments + ----------------- + ids : str or list[str] + List of Process ID(s) for the running process you want to lookup. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/it_automation.py b/src/falconpy/it_automation.py index 7759cd146..ee738e4e3 100644 --- a/src/falconpy/it_automation.py +++ b/src/falconpy/it_automation.py @@ -73,38 +73,49 @@ class ITAutomation(ServiceClass): def get_associated_tasks(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve tasks associated with the provided file ID. - Keyword arguments: - id -- The ID of the file to fetch associated tasks for. String. - filter -- The filter expression that should be used to limit the results. String. - Allowed filter fields: - access_type modified_time - created_by name - created_time runs - last_run_time task_type - modified_by - Example: - filter="example_string_field:'example@example.com'+example_date_field:>='2024-08-27T03:21:32Z'" - sort -- The sort expression that should be used to sort the results. String. - Sort either `asc` (ascending) or `desc` (descending). - Allowed sort fields: name - Example: - sort="name|asc" - offset -- Starting index for record retrieval. Integer. - Example: - offset=100 - limit -- The maximum records to return. Integer. - Example: - limit=50 - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationGetAssociatedTasks + + Keyword arguments + ----------------- + id : str + The ID of the file to fetch associated tasks for. + filter : str + The filter expression that should be used to limit the results. String. + Allowed filter fields: + access_type modified_time + created_by name + created_time runs + last_run_time task_type + modified_by + Example: + filter="example_string_field:'example@example.com'+example_date_field:>='2024-08-27T03:21:32Z'" + sort : str + The sort expression that should be used to sort the results. String. + Sort either `asc` (ascending) or `desc` (descending). + Allowed sort fields: name + Example: + sort="name|asc" + offset : int + Starting index for record retrieval. Integer. + Example: + offset=100 + limit : int + The maximum records to return. Integer. + Example: + limit=50 + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -118,44 +129,54 @@ def get_associated_tasks(self: object, parameters: dict = None, **kwargs) -> Uni def scheduled_task_details(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Return full details of scheduled tasks matching the filter query parameter. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. String. - Allowed filter fields: - created_by modified_time - created_time start_time - end_time task_id - is_active task_name - last_run task_type - modified_by group_ids - group_names - Example: - filter="example_string_field:'example@example.com'+example_date_field:>='2024-08-27T03:21:32Z'" - sort -- The sort expression that should be used to sort the results. String. - Sort either `asc` (ascending) or `desc` (descending). - Allowed sort fields: - created_by modified_time - created_time start_time - end_time task_id - last_run task_name - modified_by task_type - group_ids group_names - Example: example_field|asc - offset -- Starting index for record retrieval. Integer. - Example: - offset=100 - limit -- The maximum records to return. Integer. - Example: - limit=50 - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationCombinedScheduledTasks + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. String. + Allowed filter fields: + created_by modified_time + created_time start_time + end_time task_id + is_active task_name + last_run task_type + modified_by group_ids + group_names + Example: + filter="example_string_field:'example@example.com'+example_date_field:>='2024-08-27T03:21:32Z'" + sort : str + The sort expression that should be used to sort the results. String. + Sort either `asc` (ascending) or `desc` (descending). + Allowed sort fields: + created_by modified_time + created_time start_time + end_time task_id + last_run task_name + modified_by task_type + group_ids group_names + Example: example_field|asc + offset : int + Starting index for record retrieval. Integer. + Example: + offset=100 + limit : int + The maximum records to return. Integer. + Example: + limit=50 + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -172,40 +193,50 @@ def get_executions_by_query(self: object, parameters: dict = None, **kwargs) -> This operation will return the same output as if you ran ITAutomationSearchTaskExecutions and ITAutomationGetTaskExecution. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. String. - Allowed filter fields: - end_time status - run_by task_id - run_type task_name - start_time task_type - Example: - filter="example_string_field:'example@example.com'+example_date_field:>='2024-08-27T03:21:32Z'" - sort -- The sort expression that should be used to sort the results. String. - Sort either `asc` (ascending) or `desc` (descending). - Allowed sort fields: - end_time status - run_by task_id - run_type task_name - start_time task_type - Example: - sort="example_field|asc" - offset -- Starting index for record retrieval. Integer. - Example: - offset=100 - limit -- The maximum records to return. - Example: - limit=50 - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationGetTaskExecutionsByQuery + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. String. + Allowed filter fields: + end_time status + run_by task_id + run_type task_name + start_time task_type + Example: + filter="example_string_field:'example@example.com'+example_date_field:>='2024-08-27T03:21:32Z'" + sort : str + The sort expression that should be used to sort the results. String. + Sort either `asc` (ascending) or `desc` (descending). + Allowed sort fields: + end_time status + run_by task_id + run_type task_name + start_time task_type + Example: + sort="example_field|asc" + offset : int + Starting index for record retrieval. Integer. + Example: + offset=100 + limit : int + The maximum records to return. + Example: + limit=50 + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -222,38 +253,48 @@ def get_task_groups_by_query(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Return full details of task groups matching the filter query parameter. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. String. - Allowed filter fields: - access_type modified_by - created_by modified_time - created_time name - Example: - filter="example_string_field:'example@example.com'+example_date_field:>='2024-08-27T03:21:32Z'" - sort -- The sort expression that should be used to sort the results. String. - Sort either `asc` (ascending) or `desc` (descending). - Allowed sort fields: - access_type modified_by - created_by modified_time - created_time name - Example: - sort="example_field|asc" - offset -- Starting index for record retrieval. Integer. - Example: - offset=100 - limit -- The maximum records to return. Integer. - Example: - limit=50 - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationGetTaskGroupsByQuery + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. String. + Allowed filter fields: + access_type modified_by + created_by modified_time + created_time name + Example: + filter="example_string_field:'example@example.com'+example_date_field:>='2024-08-27T03:21:32Z'" + sort : str + The sort expression that should be used to sort the results. String. + Sort either `asc` (ascending) or `desc` (descending). + Allowed sort fields: + access_type modified_by + created_by modified_time + created_time name + Example: + sort="example_field|asc" + offset : int + Starting index for record retrieval. Integer. + Example: + offset=100 + limit : int + The maximum records to return. Integer. + Example: + limit=50 + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -267,42 +308,52 @@ def get_task_groups_by_query(self: object, def get_tasks_by_query(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Return full details of tasks matching the filter query parameter. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. String. - Allowed filter fields: - access_type modified_time - created_by name - created_time runs - last_run_time task_type - modified_by - Example: - filter="example_string_field:'example@example.com'+example_date_field:>='2024-08-27T03:21:32Z'" - sort -- The sort expression that should be used to sort the results. String. - Sort either `asc` (ascending) or `desc` (descending). - Allowed sort fields: - access_type modified_time - created_by name - created_time runs - last_run_time task_type - modified_by - Example: - sort="example_field|asc" - offset -- Starting index for record retrieval. Integer. - Example: - offset=100 - limit -- The maximum records to return. Integer. - Example: - limit=50 - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationGetTasksByQuery + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. String. + Allowed filter fields: + access_type modified_time + created_by name + created_time runs + last_run_time task_type + modified_by + Example: + filter="example_string_field:'example@example.com'+example_date_field:>='2024-08-27T03:21:32Z'" + sort : str + The sort expression that should be used to sort the results. String. + Sort either `asc` (ascending) or `desc` (descending). + Allowed sort fields: + access_type modified_time + created_by name + created_time runs + last_run_time task_type + modified_by + Example: + sort="example_field|asc" + offset : int + Starting index for record retrieval. Integer. + Example: + offset=100 + limit : int + The maximum records to return. Integer. + Example: + limit=50 + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -320,19 +371,28 @@ def get_user_group(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Return user groups for each provided ID. - Keyword arguments: - ids -- List of user group IDs to fetch. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationGetUserGroup + + Keyword arguments + ----------------- + ids : str or list[str] + List of user group IDs to fetch. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -346,23 +406,31 @@ def get_user_group(self: object, def create_user_group(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create a user group from the given request. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationCreateUserGroup + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "description": "string", "name": "string" } - description -- Description of the user group. String. - name -- Name of the user group. String. + description : str + Description of the user group. + name : str + Name of the user group. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationCreateUserGroup + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = automation_user_group_payload(passed_keywords=kwargs) @@ -381,9 +449,18 @@ def update_user_group(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update a user group for a given ID. - Keyword arguments: - add_user_ids -- List of user IDs to add. String or list of strings. - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationUpdateUserGroup + + Keyword arguments + ----------------- + add_user_ids : str or list[str] + List of user IDs to add. + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "add_user_ids": [ "string" @@ -394,19 +471,21 @@ def update_user_group(self: object, "string" ] } - description -- The updated user group description. String. - name -- The updated user group name. String. - id -- The ID of the user groups to update. String. - remove_user_ids -- List of user IDs to remove. String or list of strings. + description : str + The updated user group description. + name : str + The updated user group name. + id : str + The ID of the user groups to update. + remove_user_ids : str or list[str] + List of user IDs to remove. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationUpdateUserGroup + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = automation_user_group_payload(passed_keywords=kwargs) @@ -428,19 +507,28 @@ def delete_user_groups(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete user groups for each provided IDs. - Keyword arguments: - ids -- List of user group IDs to delete. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationDeleteUserGroup + + Keyword arguments + ----------------- + ids : str or list[str] + List of user group IDs to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -454,78 +542,93 @@ def delete_user_groups(self: object, def run_live_query(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Start a new task execution from the provided query data in the request and return the initiated task executions. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. - { - "discover_new_hosts": boolean, - "discover_offline_hosts": boolean, - "distribute": boolean, - "expiration_interval": "string", - "guardrails": { - "run_time_limit_millis": 0 - }, - "osquery": "string", - "output_parser_config": { - "columns": [ - { - "name": "string" - } + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationRunLiveQuery + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. + { + "discover_new_hosts": boolean, + "discover_offline_hosts": boolean, + "distribute": boolean, + "expiration_interval": "string", + "guardrails": { + "run_time_limit_millis": 0 + }, + "osquery": "string", + "output_parser_config": { + "columns": [ + { + "name": "string" + } + ], + "default_group_by": boolean, + "delimiter": "string" + }, + "queries": { + "linux": { + "action_type": "script", + "args": "string", + "content": "string", + "file_ids": [ + "string" ], - "default_group_by": boolean, - "delimiter": "string" + "language": "bash", + "script_file_id": "string" }, - "queries": { - "linux": { - "action_type": "script", - "args": "string", - "content": "string", - "file_ids": [ - "string" - ], - "language": "bash", - "script_file_id": "string" - }, - "mac": { - "action_type": "script", - "args": "string", - "content": "string", - "file_ids": [ - "string" - ], - "language": "bash", - "script_file_id": "string" - }, - "windows": { - "action_type": "script", - "args": "string", - "content": "string", - "file_ids": [ - "string" - ], - "language": "bash", - "script_file_id": "string" - } + "mac": { + "action_type": "script", + "args": "string", + "content": "string", + "file_ids": [ + "string" + ], + "language": "bash", + "script_file_id": "string" }, - "target": "string" - } - discover_new_hosts -- Flag indicating if this task can discover new hosts. Boolean. - discover_offline_hosts -- Flag indicating if this task can discover offline hosts. Boolean. - distribute -- Flag indicating if this task is distributed. Boolean. - expiration_interval -- Task expiration interval. String. - guardrails -- Task guardrails (limiters). Dictionary. - osquery -- OS Query content. String. - output_parser_config -- Output parser configuration. Dictionary. - queries -- Queries to perform. Dictionary. - target -- Execution target. String. + "windows": { + "action_type": "script", + "args": "string", + "content": "string", + "file_ids": [ + "string" + ], + "language": "bash", + "script_file_id": "string" + } + }, + "target": "string" + } + discover_new_hosts : bool + Flag indicating if this task can discover new hosts. + discover_offline_hosts : bool + Flag indicating if this task can discover offline hosts. + distribute : bool + Flag indicating if this task is distributed. + expiration_interval : str + Task expiration interval. + guardrails : dict + Task guardrails (limiters) + osquery : str + OS Query content. + output_parser_config : dict + Output parser configuration. + queries : dict + Queries to perform. + target : str + Execution target. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationRunLiveQuery + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = automation_live_query_payload(passed_keywords=kwargs) @@ -541,9 +644,18 @@ def run_live_query(self: object, body: dict = None, **kwargs) -> Union[Dict[str, def update_policy_host_groups(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Manage host groups assigned to a policy. - Keyword arguments: - action -- Policy action. String. - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationUpdatePolicyHostGroups + + Keyword arguments + ----------------- + action : str + Policy action. + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "action": "string", "host_group_ids": [ @@ -551,17 +663,17 @@ def update_policy_host_groups(self: object, body: dict = None, **kwargs) -> Unio ], "policy_id": "string" } - host_group_ids -- Host group IDs to apply the policy to. String or list of strings. - policy_id -- Policy ID to apply. String. + host_group_ids : str or list[str] + Host group IDs to apply the policy to. + policy_id : str + Policy ID to apply. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationUpdatePolicyHostGroups + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = policy_host_group_payload(passed_keywords=kwargs) @@ -581,23 +693,32 @@ def update_policies_precedence(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update the policy precedence for all policies of a specific platform. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. - ids -- Precedence of the policies for the provided platform. String or list of strings. - Order delineates precedence, if providing a comma-delimited list as a string, the first value will - be the beginning of the list. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - platform -- The policy platform for which to set the precedence order. String. - Allowed values: Windows, Linux, Mac - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationUpdatePoliciesPrecedence + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. + ids : str or list[str] + Precedence of the policies for the provided platform. String or list of strings. + Order delineates precedence, if providing a comma-delimited list as a string, the first value will + be the beginning of the. + parameters : dict + Full parameters payload. Not required if using other keywords. + platform : str + The policy platform for which to set the precedence order. String. + Allowed values: Windows, Linux, Mac + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, payload_value="ids") @@ -615,19 +736,28 @@ def update_policies_precedence(self: object, def get_policies(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve the configuration for 1 or more policies. - Keyword arguments: - ids -- One or more policy IDs. String or list of strings. Max: 500 - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationGetPolicies + + Keyword arguments + ----------------- + ids : str or list[str] + One or more policy IDs. String or list of strings. Max: 500 + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -643,8 +773,16 @@ def create_policy(self: object, body: dict = None, **kwargs) -> Union[Dict[str, New policies are always added at the end of the precedence list for the provided policy type. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationCreatePolicy + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "config": { "concurrency": { @@ -671,32 +809,45 @@ def create_policy(self: object, body: dict = None, **kwargs) -> Union[Dict[str, "name": "string", "platform": "string" } - name -- Policy name. String. Max: 100 characters - description -- Policy description. String. Max: 500 characters - platform -- Execution host platform. String. Allowed values: Windows, Linux, Mac - enable_script_execution -- Enable or disable script execution. Boolean. - enable_python_execution -- Enable or disable Python execution. Boolean. - enable_os_query -- Enable or disable OS Query. Boolean. - execution_timeout -- Specifies the timeout value for executions. Integer. - execution_timeout_unit -- Execution timeout unit. String. Allowed values: Hours, Minutes - cpu_throttle -- Specifies the CPU throttle value. Integer. - cpu_scheduling -- Sets priority to determine the order in which a query process will run on a host's CPU. String. - memory_pressure_level -- Sets memory pressure level to control system resource allocation during task execution. - String. - memory_allocation -- Specifies the memory allocation value. Integer. - memory_allocation_unit -- Memory allocation unit. String. Allowed values: MB, GB - concurrent_host_limit -- Specifies the maximum number of concurrent hosts. Integer. - concurrent_task_limit -- Specifies the maximum number of concurrent tasks. Integer. - concurrent_host_file_transfer_limit -- Specifies the maximum number of concurrent file transfers. Integer. + name : str + Policy name. String. Max: 100 characters + description : str + Policy description. String. Max: 500 characters + platform : str + Execution host platform. String. Allowed values: Windows, Linux, Mac + enable_script_execution : bool + Enable or disable script execution. + enable_python_execution : bool + Enable or disable Python execution. + enable_os_query : bool + Enable or disable OS Query. + execution_timeout : int + Specifies the timeout value for executions. + execution_timeout_unit : str + Execution timeout unit. String. Allowed values: Hours, Minutes + cpu_throttle : int + Specifies the CPU throttle value. + cpu_scheduling : str + Sets priority to determine the order in which a query process will run on a host's CPU. + memory_pressure_level : str + Sets memory pressure level to control system resource allocation during task execution. + memory_allocation : int + Specifies the memory allocation value. + memory_allocation_unit : str + Memory allocation unit. String. Allowed values: MB, GB + concurrent_host_limit : int + Specifies the maximum number of concurrent hosts. + concurrent_task_limit : int + Specifies the maximum number of concurrent tasks. + concurrent_host_file_transfer_limit : int + Specifies the maximum number of concurrent file transfers. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationCreatePolicy + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = automation_policy_payload(passed_keywords=kwargs) @@ -712,8 +863,16 @@ def create_policy(self: object, body: dict = None, **kwargs) -> Union[Dict[str, def update_policy(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update a new policy of the specified type. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationUpdatePolicies + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "config": { "concurrency": { @@ -741,33 +900,47 @@ def update_policy(self: object, body: dict = None, **kwargs) -> Union[Dict[str, "is_enabled": boolean, "name": "string" } - id -- A valid policy ID representing the policy to be updated. String. Required. - name -- Policy name. String. Max: 100 characters - description -- Policy description. String. Max: 500 characters - is_enabled -- Flag controlling whether the policy is active. Boolean. - enable_script_execution -- Enable or disable script execution. Boolean. - enable_python_execution -- Enable or disable Python execution. Boolean. - enable_os_query -- Enable or disable OS Query. Boolean. - execution_timeout -- Specifies the timeout value for executions. Integer. - execution_timeout_unit -- Execution timeout unit. String. Allowed values: Hours, Minutes - cpu_throttle -- Specifies the CPU throttle value. Integer. - cpu_scheduling -- Sets priority to determine the order in which a query process will run on a host's CPU. String. - memory_pressure_level -- Sets memory pressure level to control system resource allocation during task execution. - String. - memory_allocation -- Specifies the memory allocation value. Integer. - memory_allocation_unit -- Memory allocation unit. String. Allowed values: MB, GB - concurrent_host_limit -- Specifies the maximum number of concurrent hosts. Integer. - concurrent_task_limit -- Specifies the maximum number of concurrent tasks. Integer. - concurrent_host_file_transfer_limit -- Specifies the maximum number of concurrent file transfers. Integer. + id : str (required) + A valid policy ID representing the policy to be updated. + name : str + Policy name. String. Max: 100 characters + description : str + Policy description. String. Max: 500 characters + is_enabled : bool + Flag controlling whether the policy is active. + enable_script_execution : bool + Enable or disable script execution. + enable_python_execution : bool + Enable or disable Python execution. + enable_os_query : bool + Enable or disable OS Query. + execution_timeout : int + Specifies the timeout value for executions. + execution_timeout_unit : str + Execution timeout unit. String. Allowed values: Hours, Minutes + cpu_throttle : int + Specifies the CPU throttle value. + cpu_scheduling : str + Sets priority to determine the order in which a query process will run on a host's CPU. + memory_pressure_level : str + Sets memory pressure level to control system resource allocation during task execution. + memory_allocation : int + Specifies the memory allocation value. + memory_allocation_unit : str + Memory allocation unit. String. Allowed values: MB, GB + concurrent_host_limit : int + Specifies the maximum number of concurrent hosts. + concurrent_task_limit : int + Specifies the maximum number of concurrent tasks. + concurrent_host_file_transfer_limit : int + Specifies the maximum number of concurrent file transfers. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationUpdatePolicies + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = automation_policy_payload(passed_keywords=kwargs) @@ -783,19 +956,28 @@ def update_policy(self: object, body: dict = None, **kwargs) -> Union[Dict[str, def delete_policy(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete one or more policies. - Keyword arguments: - ids -- List of task IDs to delete. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationDeletePolicy + + Keyword arguments + ----------------- + ids : str or list[str] + List of task IDs to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -813,20 +995,29 @@ def get_scheduled_task(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Return scheduled tasks for each provided ID. - Keyword arguments: - ids -- Scheduled task IDs to fetch. String or list of strings. - Use ITAutomationSearchScheduledTasks to fetch scheduled task IDs - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationGetScheduledTasks + + Keyword arguments + ----------------- + ids : str or list[str] + Scheduled task IDs to fetch. String or list of strings. + Use ITAutomationSearchScheduledTasks to fetch scheduled task IDs + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -840,9 +1031,18 @@ def get_scheduled_task(self: object, def create_scheduled_task(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create a scheduled task from the given request. - Keyword arguments: - arguments -- Arguments to provide to the task when executed. Dictionary. - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationCreateScheduledTask + + Keyword arguments + ----------------- + arguments : dict + Arguments to provide to the task when executed. + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "arguments": { "additionalProp1": "string", @@ -889,28 +1089,39 @@ def create_scheduled_task(self: object, body: dict = None, **kwargs) -> Union[Di } ] } - discover_new_hosts -- Allow the task to discover new hosts. Boolean. - discover_offline_hosts -- Allow the task to discover offline hosts. Boolean. - distribute -- Distribute the task. Boolean. - expiration_interval -- Task expiration interval. String. - guardrails -- Task execution guardrails (limiters). Dictionary. - id -- The id of the scheduled task to update. String. - is_active -- Flag indicating if the task is active. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - schedule -- Task schedule. Dictionary. - target -- Task target. String. - task_id -- Task ID. String. - trigger_condition -- Task trigger conditions. List of dictionaries. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + discover_new_hosts : bool + Allow the task to discover new hosts. + discover_offline_hosts : bool + Allow the task to discover offline hosts. + distribute : bool + Distribute the task. + expiration_interval : str + Task expiration interval. + guardrails : dict + Task execution guardrails (limiters) + id : str + The id of the scheduled task to update. + is_active : bool + Flag indicating if the task is active. + parameters : dict + Full parameters payload. Not required if using other keywords. + schedule : dict + Task schedule. + target : str + Task target. + task_id : str + Task ID. + trigger_condition : list[dict] + Task trigger conditions. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationCreateScheduledTask + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = scheduled_task_payload(passed_keywords=kwargs) @@ -930,8 +1141,16 @@ def update_scheduled_task(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update an existing scheduled task with the supplied info. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationUpdateScheduledTask + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "discover_new_hosts": boolean, "discover_offline_hosts": boolean, @@ -978,28 +1197,39 @@ def update_scheduled_task(self: object, } ] } - discover_new_hosts -- Allow the task to discover new hosts. Boolean. - discover_offline_hosts -- Allow the task to discover offline hosts. Boolean. - distribute -- Distribute the task. Boolean. - execution_args -- Arguments to provide to the task when executed. Dictionary. - expiration_interval -- Task expiration interval. String. - guardrails -- Task execution guardrails (limiters). Dictionary. - id -- The id of the scheduled task to update. String. - is_active -- Flag indicating if the task is active. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - schedule -- Task schedule. Dictionary. - target -- Task target. String. - task_id -- Task ID. String. - trigger_condition -- Task trigger conditions. List of dictionaries. + discover_new_hosts : bool + Allow the task to discover new hosts. + discover_offline_hosts : bool + Allow the task to discover offline hosts. + distribute : bool + Distribute the task. + execution_args : dict + Arguments to provide to the task when executed. + expiration_interval : str + Task expiration interval. + guardrails : dict + Task execution guardrails (limiters) + id : str + The id of the scheduled task to update. + is_active : bool + Flag indicating if the task is active. + parameters : dict + Full parameters payload. Not required if using other keywords. + schedule : dict + Task schedule. + target : str + Task target. + task_id : str + Task ID. + trigger_condition : list[dict] + Task trigger conditions. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationUpdateScheduledTask + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = scheduled_task_payload(passed_keywords=kwargs) @@ -1021,19 +1251,28 @@ def delete_scheduled_task(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete one or more scheduled tasks by providing the scheduled tasks IDs. - Keyword arguments: - ids -- Scheduled task IDs to delete. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationDeleteScheduledTasks + + Keyword arguments + ----------------- + ids : str or list[str] + Scheduled task IDs to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1047,22 +1286,31 @@ def delete_scheduled_task(self: object, def cancel_execution(self: object, *args, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Cancel a task execution specified in the request. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationCancelTaskExecution + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "task_execution_id": "string" } - task_execution_id -- Task execution ID to cancel. String. + task_execution_id : str + Task execution ID to cancel. - Arguments: When not specified, the first argument to this method is assumed to be 'task_execution_id'. - All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: POST + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'task_execution_id'. + All others are ignored. - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationCancelTaskExecution + Returns + ------- + dict + Dictionary object containing API response. """ if not body: if not kwargs: @@ -1083,30 +1331,41 @@ def get_execution_host_status(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get the status of host executions by providing the execution IDs. - Keyword arguments: - ids -- Task execution IDs to get statuses for. String or list of strings. - Use ITAutomationSearchTaskExecutions to fetch execution IDs. - filter -- The filter expression that should be used to limit the results. String. - Allowed filter fields: end_time, start_time, status, total_results - Example: filter="example_string_field:'example@example.com'+example_date_field:>='2024-08-27T03:21:32Z'" - sort -- The sort expression that should be used to sort the results. String. - Sort either `asc` (ascending) or `desc` (descending). - Allowed sort fields: end_time, start_time, status, total_results - Example: sort="example_field|asc" - offset -- Starting index for record retrieval. Integer. - Example: offset=100 - limit -- The maximum records to return. Integer. - Example: limit=50 - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationGetTaskExecutionHostStatus + + Keyword arguments + ----------------- + ids : str or list[str] + Task execution IDs to get statuses for. String or list of strings. + Use ITAutomationSearchTaskExecutions to fetch execution IDs. + filter : str + The filter expression that should be used to limit the results. String. + Allowed filter fields: end_time, start_time, status, total_results + Example: filter="example_string_field:'example@example.com'+example_date_field:>='2024-08-27T03:21:32Z'" + sort : str + The sort expression that should be used to sort the results. String. + Sort either `asc` (ascending) or `desc` (descending). + Allowed sort fields: end_time, start_time, status, total_results + Example: sort="example_field|asc" + offset : int + Starting index for record retrieval. Integer. + Example: offset=100 + limit : int + The maximum records to return. Integer. + Example: limit=50 + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1120,23 +1379,31 @@ def get_execution_host_status(self: object, def rerun_execution(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Rerun the task execution specified in the request. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationRerunTaskExecution + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "run_type": "hosts", "task_execution_id": "string" } - run_type -- Task run type. String. - task_execution_id -- Task execution ID. String. + run_type : str + Task run type. + task_execution_id : str + Task execution ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationRerunTaskExecution + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = rerun_payload(passed_keywords=kwargs) @@ -1158,20 +1425,29 @@ def get_execution_results_search_status(self: object, Look for 'is_pending: false' to know search is complete. - Keyword arguments: - id -- Search Job ID to fetch. UseITAutomationStartExecutionResultsSearch to get the job ID. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /it-automation/ITAutomationGetExecutionResultsSearchStatus + /it-automation/ITAutomationGetExecutionResultsSearchStatus + + Keyword arguments + ----------------- + id : str + Search Job ID to fetch. UseITAutomationStartExecutionResultsSearch to get the job ID. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1187,8 +1463,16 @@ def execution_results_search(self: object, body: dict = None, **kwargs) -> Union Poll `ITAutomationGetExecutionResultsSearchStatus` to determine when the search is complete. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationStartExecutionResultsSearch + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "end": "string", "filter_expressions": [ @@ -1200,20 +1484,23 @@ def execution_results_search(self: object, body: dict = None, **kwargs) -> Union "start": "string", "task_execution_id": "string" } - end -- Task end. String. - filter_expressions -- Filter expressions to apply. String or list of strings. - group_by_fields -- Fields to use to group results. String or list of strings. - start -- Task start. String. - task_execution_id -- Task execution ID. String. + end : str + Task end. + filter_expressions : str or list[str] + Filter expressions to apply. + group_by_fields : str or list[str] + Fields to use to group results. + start : str + Task start. + task_execution_id : str + Task execution ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationStartExecutionResultsSearch + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = execution_results_search_payload(passed_keywords=kwargs) @@ -1231,23 +1518,33 @@ def get_execution_results(self: object, parameters: dict = None, **kwargs) -> Un Use the ITAutomationStartExecutionResultsSearch operation to begin the async search. - Keyword arguments: - id -- The Job ID to fetch. String. - Use the value returned from the ITAutomationStartExecutionResultsSearch operation. - offset -- The offset to start retrieving records from. Integer. - limit -- The maximum number of event results to return. Integer. - sort -- Sort results by one of the fields in the event results, either asc (ascending) or desc (descending). String. - Example: `hostname.asc` (sort by hostname ascending) - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationGetExecutionResults + + Keyword arguments + ----------------- + id : str + The Job ID to fetch. String. + Use the value returned from the ITAutomationStartExecutionResultsSearch operation. + offset : int + The offset to start retrieving records from. + limit : int + The maximum number of event results to return. + sort : str + Sort results by one of the fields in the event results, either asc (ascending) or desc (descending). String. + Example: `hostname.asc` (sort by hostname ascending) + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1265,20 +1562,29 @@ def get_execution(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get the task execution for the provided task execution IDs. - Keyword arguments: - ids -- Task execution IDs to fetch. String or list of strings. - Use ITAutomationSearchTaskExecutions to get the execution ID. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationGetTaskExecution + + Keyword arguments + ----------------- + ids : str or list[str] + Task execution IDs to fetch. String or list of strings. + Use ITAutomationSearchTaskExecutions to get the execution ID. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1292,9 +1598,18 @@ def get_execution(self: object, def start_execution(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Start a new task execution from an existing task provided in the request and returns the initiated task executions. - Keyword arguments: - arguments -- Arguments to pass to the execution. Dictionary. - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationStartTaskExecution + + Keyword arguments + ----------------- + arguments : dict + Arguments to pass to the execution. + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "arguments": { "additionalProp1": "string", @@ -1328,23 +1643,29 @@ def start_execution(self: object, body: dict = None, **kwargs) -> Union[Dict[str } ] } - discover_new_hosts -- Allow the task execution to discover new hosts. Boolean. - discover_offline_hosts -- Allow the task execution to discover offline hosts. Boolean. - distribute -- Distribute this task. Boolean. - expiration_interval -- Task expiration interval. String. - guardrails -- Task execution guardrails (limiters). Dictionary. - target -- Task target. String. - task_id -- Task ID. String. - trigger_conditions -- List of task triggers. List of dictionaries. + discover_new_hosts : bool + Allow the task execution to discover new hosts. + discover_offline_hosts : bool + Allow the task execution to discover offline hosts. + distribute : bool + Distribute this task. + expiration_interval : str + Task expiration interval. + guardrails : dict + Task execution guardrails (limiters) + target : str + Task target. + task_id : str + Task ID. + trigger_conditions : list[dict] + List of task triggers. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationStartTaskExecution + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = task_execution_payload(passed_keywords=kwargs) @@ -1360,19 +1681,28 @@ def start_execution(self: object, body: dict = None, **kwargs) -> Union[Dict[str def get_task_group(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Return task groups for each provided ID. - Keyword arguments: - ids -- Task group IDs to fetch. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationGetTaskGroups + + Keyword arguments + ----------------- + ids : str or list[str] + Task group IDs to fetch. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1386,11 +1716,22 @@ def get_task_group(self: object, *args, parameters: dict = None, **kwargs) -> Un def create_task_group(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create a task group from the given request. - Keyword arguments: - access_type -- Task group access type. String. - assigned_user_group_ids -- User group IDs to add. String or list of strings. - assigned_user_ids -- User IDs to add. String or list of strings. - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationCreateTaskGroup + + Keyword arguments + ----------------- + access_type : str + Task group access type. + assigned_user_group_ids : str or list[str] + User group IDs to add. + assigned_user_ids : str or list[str] + User IDs to add. + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "access_type": "Public", "assigned_user_group_ids": [ @@ -1405,18 +1746,19 @@ def create_task_group(self: object, body: dict = None, **kwargs) -> Union[Dict[s "string" ] } - description -- Task group description. String. - name -- Task group name. String. - task_ids -- Task IDs to add to the group. String or list of strings. + description : str + Task group description. + name : str + Task group name. + task_ids : str or list[str] + Task IDs to add to the group. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationCreateTaskGroup + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = task_payload(passed_keywords=kwargs) @@ -1436,12 +1778,24 @@ def update_task_group(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update a task group for a given ID. - Keyword arguments: - access_type -- Task group access type. String. - add_assigned_user_group_ids -- User group IDs to add. String or list of strings. - add_assigned_user_ids -- User IDs to add. String or list of strings. - add_task_ids -- Task IDs to add to the group. String or list of strings. - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationUpdateTaskGroup + + Keyword arguments + ----------------- + access_type : str + Task group access type. + add_assigned_user_group_ids : str or list[str] + User group IDs to add. + add_assigned_user_ids : str or list[str] + User IDs to add. + add_task_ids : str or list[str] + Task IDs to add to the group. + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "access_type": "Public", "add_assigned_user_group_ids": [ @@ -1465,22 +1819,27 @@ def update_task_group(self: object, "string" ] } - description -- Task group description. String. - id -- The ID of the task group to update. String. - name -- Task group name. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - removed_assigned_user_group_ids -- User group IDs to be removed. String or list of strings. - remove_assigned_user_ids -- User IDs to be removed. String or list of strings. - remove_task_ids -- Task IDs to be removed. String or list of strings. + description : str + Task group description. + id : str + The ID of the task group to update. + name : str + Task group name. + parameters : dict + Full parameters payload. Not required if using other keywords. + removed_assigned_user_group_ids : str or list[str] + User group IDs to be removed. + remove_assigned_user_ids : str or list[str] + User IDs to be removed. + remove_task_ids : str or list[str] + Task IDs to be removed. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationUpdateTaskGroup + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = task_payload(passed_keywords=kwargs) @@ -1502,19 +1861,28 @@ def delete_task_groups(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete one or more task groups by providing the task group IDs. - Keyword arguments: - ids -- Task group IDs to delete. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationDeleteTaskGroups + + Keyword arguments + ----------------- + ids : str or list[str] + Task group IDs to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1528,19 +1896,28 @@ def delete_task_groups(self: object, def get_tasks(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Return tasks for each provided ID. - Keyword arguments: - ids -- IDs of tasks to fetch. Use ITAutomationSearchTasks to fetch IDs. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationGetTasks + + Keyword arguments + ----------------- + ids : str or list[str] + IDs of tasks to fetch. Use ITAutomationSearchTasks to fetch IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1554,11 +1931,22 @@ def get_tasks(self: object, *args, parameters: dict = None, **kwargs) -> Union[D def create_task(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create a task with details from the given request. - Keyword arguments: - access_type -- Task access type. String. - add_assigned_user_group_ids -- User group IDs to add. String or list of strings. - add_assigned_user_ids -- User IDs to add. String or list of strings. - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationCreateTask + + Keyword arguments + ----------------- + access_type : str + Task access type. + add_assigned_user_group_ids : str or list[str] + User group IDs to add. + add_assigned_user_ids : str or list[str] + User IDs to add. + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "access_type": "Public", "add_assigned_user_group_ids": [ @@ -1704,30 +2092,42 @@ def create_task(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Un } ] } - description -- Task description. String. - name -- Task name. String. - os_query -- OS query detail. String. - output_parser_config -- Parser output configuration. Dictionary. - queries -- Queries to perform (by OS). Dictionary. - remediations -- Remediations to perform (by OS). Dictionary. - removed_assigned_user_group_ids -- User group IDs to be removed. String or list of strings. - remove_assigned_user_ids -- User IDs to be removed. String or list of strings. - target -- Task target. String. - task_parameters -- Task parameters. List of dictionaries. (Should be named "parameters" when providing - a raw body payload.) - task_group_id -- Task group ID. String. - task_type -- Task type. String. - trigger_condition -- Trigger conditions. List of dictionaries. - verification_condition -- Verification conditions. List of dictionaries. + description : str + Task description. + name : str + Task name. + os_query : str + OS query detail. + output_parser_config : dict + Parser output configuration. + queries : dict + Queries to perform (by OS) + remediations : dict + Remediations to perform (by OS) + removed_assigned_user_group_ids : str or list[str] + User group IDs to be removed. + remove_assigned_user_ids : str or list[str] + User IDs to be removed. + target : str + Task target. + task_parameters : list + Task parameters. List of dictionaries. (Should be named "parameters" when providing + a raw body payload.) + task_group_id : str + Task group ID. + task_type : str + Task type. + trigger_condition : list[dict] + Trigger conditions. + verification_condition : list[dict] + Verification conditions. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationCreateTask + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = task_payload(passed_keywords=kwargs) @@ -1747,11 +2147,22 @@ def update_task(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update a task with details from the given request. - Keyword arguments: - access_type -- Task access type. String. - add_assigned_user_group_ids -- User group IDs to add. String or list of strings. - add_assigned_user_ids -- User IDs to add. String or list of strings. - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationUpdateTask + + Keyword arguments + ----------------- + access_type : str + Task access type. + add_assigned_user_group_ids : str or list[str] + User group IDs to add. + add_assigned_user_ids : str or list[str] + User IDs to add. + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "access_type": "Public", "add_assigned_user_group_ids": [ @@ -1897,32 +2308,46 @@ def update_task(self: object, } ] } - description -- Task description. String. - id -- ID of the task to update. Use ITAutomationSearchTasks to fetch IDs. String. - name -- Task name. String. - os_query -- OS query detail. String. - output_parser_config -- Parser output configuration. Dictionary. - parameters -- Full parameters payload dictionary. Not required if ID keyword is used. - queries -- Queries to perform (by OS). Dictionary. - remediations -- Remediations to perform (by OS). Dictionary. - removed_assigned_user_group_ids -- User group IDs to be removed. String or list of strings. - remove_assigned_user_ids -- User IDs to be removed. String or list of strings. - target -- Task target. String. - task_parameters -- Task parameters. List of dictionaries. (Should be named "parameters" when providing - a raw body payload.) - task_group_id -- Task group ID. String. - task_type -- Task type. String. - trigger_condition -- Trigger conditions. List of dictionaries. - verification_condition -- Verification conditions. List of dictionaries. + description : str + Task description. + id : str + ID of the task to update. Use ITAutomationSearchTasks to fetch IDs. + name : str + Task name. + os_query : str + OS query detail. + output_parser_config : dict + Parser output configuration. + parameters : dict + Full parameters payload dictionary. Not required if ID keyword is used. + queries : dict + Queries to perform (by OS) + remediations : dict + Remediations to perform (by OS) + removed_assigned_user_group_ids : str or list[str] + User group IDs to be removed. + remove_assigned_user_ids : str or list[str] + User IDs to be removed. + target : str + Task target. + task_parameters : list + Task parameters. List of dictionaries. (Should be named "parameters" when providing + a raw body payload.) + task_group_id : str + Task group ID. + task_type : str + Task type. + trigger_condition : list[dict] + Trigger conditions. + verification_condition : list[dict] + Verification conditions. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationUpdateTask + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = task_payload(passed_keywords=kwargs) @@ -1940,19 +2365,28 @@ def update_task(self: object, def delete_task(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete tasks for each provided ID. - Keyword arguments: - ids -- ID(s) of tasks to delete. String or list of strings. Comma-delimited lists are supported. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationDeleteTask + + Keyword arguments + ----------------- + ids : str or list[str] + ID(s) of tasks to delete. String or list of strings. Comma-delimited lists are supported. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1969,34 +2403,44 @@ def search_user_groups(self: object, parameters: dict = None, **kwargs) -> Union This operation can be used together with the ITAutomationGetUserGroup operation to retrieve full information on user groups. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. - Allowed filter fields: - created_by created_time - description modified_by - modified_time name - Example: - example_string_field:'example@example.com'+example_date_field:>='2024-08-27T03:21:32Z' - sort -- The sort expression that should be used to sort the results. - Sort either `asc` (ascending) or `desc` (descending). - Allowed sort fields: - created_by created_time - modified_by modified_time - name - Example: - example_field|asc - offset -- Starting index for record retrieval. Integer. Example: 100 - limit -- The maximum records to return. Integer. Example: 50 - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationSearchUserGroup + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. + Allowed filter fields: + created_by created_time + description modified_by + modified_time name + Example: + example_string_field:'example@example.com'+example_date_field:>='2024-08-27T03:21:32Z' + sort : str + The sort expression that should be used to sort the results. + Sort either `asc` (ascending) or `desc` (descending). + Allowed sort fields: + created_by created_time + modified_by modified_time + name + Example: + example_field|asc + offset : int + Starting index for record retrieval. Integer. Example: 100 + limit : int + The maximum records to return. Integer. Example: 50 + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2010,29 +2454,39 @@ def search_user_groups(self: object, parameters: dict = None, **kwargs) -> Union def query_policies(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Return the list of policy ids matching the filter query parameter. - Keyword arguments: - offset -- The offset to start retrieving records from. Integer. Defaults to 0 if not specified. - limit -- The maximum number of ids to return. Integer. Defaults to 100 if not specified. - The maximum number of results that can be returned in a single call is 500. - sort -- Sort the returned IDs. String. - Sort either `asc` (ascending) or `desc` (descending). - Allowed values: - precedence - created_timestamp - modified_timestamp - Example: - sort="precedence|asc" - platform -- The platform of policies to retrieve. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationQueryPolicies + + Keyword arguments + ----------------- + offset : int + The offset to start retrieving records from. Integer. Defaults to 0 if not specified. + limit : int + The maximum number of ids to return. Integer. Defaults to 100 if not specified. + The maximum number of results that can be returned in a single call is 500. + sort : str + Sort the returned IDs. String. + Sort either `asc` (ascending) or `desc` (descending). + Allowed values: + precedence + created_timestamp + modified_timestamp + Example: + sort="precedence|asc" + platform : str + The platform of policies to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2046,45 +2500,55 @@ def query_policies(self: object, parameters: dict = None, **kwargs) -> Union[Dic def search_scheduled_tasks(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Return the list of scheduled task IDs matching the filter query parameter. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. String. - Allowed filter fields: - created_by modified_time - created_time start_time - end_time task_id - is_active task_name - last_run task_type - modified_by group_ids - group_names - Example: - filter="example_string_field:'example@example.com'+example_date_field:>='2024-08-27T03:21:32Z'" - sort -- The sort expression that should be used to sort the results. String. - Sort either `asc` (ascending) or `desc` (descending). - Allowed sort fields: - created_by modified_time - created_time start_time - end_time task_id - last_run task_name - modified_by task_type - group_ids group_names - Example: - sort="example_field|asc" - offset -- Starting index for record retrieval. Integer. - Example: - offset=100 - limit -- The maximum records to return. Integer. - Example: - limit=50 - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationSearchScheduledTasks + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. String. + Allowed filter fields: + created_by modified_time + created_time start_time + end_time task_id + is_active task_name + last_run task_type + modified_by group_ids + group_names + Example: + filter="example_string_field:'example@example.com'+example_date_field:>='2024-08-27T03:21:32Z'" + sort : str + The sort expression that should be used to sort the results. String. + Sort either `asc` (ascending) or `desc` (descending). + Allowed sort fields: + created_by modified_time + created_time start_time + end_time task_id + last_run task_name + modified_by task_type + group_ids group_names + Example: + sort="example_field|asc" + offset : int + Starting index for record retrieval. Integer. + Example: + offset=100 + limit : int + The maximum records to return. Integer. + Example: + limit=50 + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2100,40 +2564,50 @@ def search_task_executions(self: object, parameters: dict = None, **kwargs) -> U This operation can be used together with the entities operation to retrieve full information on executions. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. String. - Allowed filter fields: - end_time status - run_by task_id - run_type task_name - start_time task_type - Example: - filter="example_string_field:'example@example.com'+example_date_field:>='2024-08-27T03:21:32Z'" - sort -- The sort expression that should be used to sort the results. String. - Sort either `asc` (ascending) or `desc` (descending). - Allowed sort fields: - end_time status - run_by task_id - run_type task_name - start_time task_type - Example: - sort="example_field|asc" - offset -- Starting index for record retrieval. Integer. - Example: - offset=100 - limit -- The maximum records to return. Integer. - Example: - offset=50 - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationSearchTaskExecutions + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. String. + Allowed filter fields: + end_time status + run_by task_id + run_type task_name + start_time task_type + Example: + filter="example_string_field:'example@example.com'+example_date_field:>='2024-08-27T03:21:32Z'" + sort : str + The sort expression that should be used to sort the results. String. + Sort either `asc` (ascending) or `desc` (descending). + Allowed sort fields: + end_time status + run_by task_id + run_type task_name + start_time task_type + Example: + sort="example_field|asc" + offset : int + Starting index for record retrieval. Integer. + Example: + offset=100 + limit : int + The maximum records to return. Integer. + Example: + offset=50 + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2147,38 +2621,48 @@ def search_task_executions(self: object, parameters: dict = None, **kwargs) -> U def search_task_groups(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Return the list of task group ids matching the filter query parameter. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. String. - Allowed filter fields: - access_type modified_by - created_by modified_time - created_time name - Example: - filter="example_string_field:'example@example.com'+example_date_field:>='2024-08-27T03:21:32Z'" - sort -- The sort expression that should be used to sort the results. String. - Sort either `asc` (ascending) or `desc` (descending). - Allowed sort fields: - access_type modified_by - created_by modified_time - created_time name - Example: - sort="example_field|asc" - offset -- Starting index for record retrieval. Integer. - Example: - offset=100 - limit -- The maximum records to return. - Example: - limit=50 - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationSearchTaskGroups + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. String. + Allowed filter fields: + access_type modified_by + created_by modified_time + created_time name + Example: + filter="example_string_field:'example@example.com'+example_date_field:>='2024-08-27T03:21:32Z'" + sort : str + The sort expression that should be used to sort the results. String. + Sort either `asc` (ascending) or `desc` (descending). + Allowed sort fields: + access_type modified_by + created_by modified_time + created_time name + Example: + sort="example_field|asc" + offset : int + Starting index for record retrieval. Integer. + Example: + offset=100 + limit : int + The maximum records to return. + Example: + limit=50 + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2192,42 +2676,52 @@ def search_task_groups(self: object, parameters: dict = None, **kwargs) -> Union def search_tasks(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Return the list of task IDs matching the filter query parameter. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. String. - Allowed filter fields: - access_type modified_time - created_by name - created_time runs - last_run_time task_type - modified_by - Example: - filter="example_string_field:'example@example.com'+example_date_field:>='2024-08-27T03:21:32Z'" - sort -- The sort expression that should be used to sort the results. String. - Sort either `asc` (ascending) or `desc` (descending). - Allowed sort fields: - access_type modified_time - created_by name - created_time runs - last_run_time task_type - modified_by - Example: - sort="example_field|asc" - offset -- Starting index for record retrieval. Integer. - Example: - offset=100 - limit -- The maximum records to return. Integer. - Example: - limit=50 - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/it-automation/ITAutomationSearchTasks + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. String. + Allowed filter fields: + access_type modified_time + created_by name + created_time runs + last_run_time task_type + modified_by + Example: + filter="example_string_field:'example@example.com'+example_date_field:>='2024-08-27T03:21:32Z'" + sort : str + The sort expression that should be used to sort the results. String. + Sort either `asc` (ascending) or `desc` (descending). + Allowed sort fields: + access_type modified_time + created_by name + created_time runs + last_run_time task_type + modified_by + Example: + sort="example_field|asc" + offset : int + Starting index for record retrieval. Integer. + Example: + offset=100 + limit : int + The maximum records to return. Integer. + Example: + limit=50 + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/knowledge_base_audit_events.py b/src/falconpy/knowledge_base_audit_events.py index cdc3a6ff4..da780c6f1 100644 --- a/src/falconpy/knowledge_base_audit_events.py +++ b/src/falconpy/knowledge_base_audit_events.py @@ -64,9 +64,18 @@ def aggregates_knowledge_base_audit_events_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Aggregate knowledge base audit events based on the provided msa criteria. - Keyword arguments: - include_deleted -- Include audit events for deleted knowledge bases. Defaults to false. Boolean. - body -- Full body payload as a JSON formatted list. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/knowledge-base-audit-events/AggregatesKnowledgeBaseAuditEventsV1 + + Keyword arguments + ----------------- + include_deleted : bool + Include audit events for deleted knowledge bases. Defaults to false. + body : list + Full body payload as a JSON formatted list. Not required if using other keywords. [ { "date_ranges": [ @@ -101,30 +110,43 @@ def aggregates_knowledge_base_audit_events_v1(self: object, "type": "string" } ] - date_ranges -- List of date range objects. List of dictionaries. - field -- The field to aggregate on. String. - filter -- FQL filter expression. String. - interval -- Time interval for aggregation. String. - min_doc_count -- Minimum document count threshold. Integer. - missing -- Missing value handling. String. - name -- Name of the aggregation. String. - q -- Full text search across all metadata fields. String. - ranges -- List of range objects. List of dictionaries. - size -- Maximum number of results. Integer. - sort -- Sort expression. String. - sub_aggregates -- List of sub-aggregate expressions. List of strings. - time_zone -- Time zone for date operations. String. - type -- Type of aggregation (terms, date_histogram, etc.). String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + date_ranges : list[dict] + List of date range objects. + field : str + The field to aggregate on. + filter : str + FQL filter expression. + interval : str + Time interval for aggregation. + min_doc_count : int + Minimum document count threshold. + missing : str + Missing value handling. + name : str + Name of the aggregation. + q : str + Full text search across all metadata fields. + ranges : list[dict] + List of range objects. + size : int + Maximum number of results. + sort : str + Sort expression. + sub_aggregates : list[str] + List of sub-aggregate expressions. + time_zone : str + Time zone for date operations. + type : str + Type of aggregation (terms, date_histogram, etc.) + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/knowledge-base-audit-events/AggregatesKnowledgeBaseAuditEventsV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -145,23 +167,35 @@ def combined_knowledge_base_audit_events_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get knowledge base audit events with full event details and pagination. - Keyword arguments: - knowledge_base_id -- ID of the knowledge base to get audit events for. String. - offset -- Starting index of overall result set from which to return events. Integer. - limit -- Number of events to return. Integer. - sort -- Sort order. Ex: 'created_at|desc'. String. - filter -- FQL query specifying the filter parameters. String. - include_deleted -- Include audit events for deleted knowledge bases. Defaults to false. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/knowledge-base-audit-events/CombinedKnowledgeBaseAuditEventsV1 + + Keyword arguments + ----------------- + knowledge_base_id : str + ID of the knowledge base to get audit events for. + offset : int + Starting index of overall result set from which to return events. + limit : int + Number of events to return. + sort : str + Sort order. Ex: 'created_at|desc' + filter : str + FQL query specifying the filter parameters. + include_deleted : bool + Include audit events for deleted knowledge bases. Defaults to false. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -178,20 +212,29 @@ def entities_knowledge_base_audit_events_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve knowledge base audit event entities by their IDs. - Keyword arguments: - knowledge_base_id -- ID of the knowledge base. String. - ids -- IDs of audit events to retrieve. List. - include_deleted -- Include audit events for deleted knowledge bases. Defaults to false. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/knowledge-base-audit-events/EntitiesKnowledgeBaseAuditEventsV1 + + Keyword arguments + ----------------- + knowledge_base_id : str + ID of the knowledge base. + ids : str or list[str] + IDs of audit events to retrieve. + include_deleted : bool + Include audit events for deleted knowledge bases. Defaults to false. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -208,23 +251,35 @@ def queries_knowledge_base_audit_events_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Query knowledge base audit event IDs with pagination and filtering. - Keyword arguments: - knowledge_base_id -- ID of the knowledge base to query audit events for. String. - offset -- Starting index of overall result set from which to return ids. Integer. - limit -- Number of IDs to return. Integer. - sort -- Sort order. Ex: 'created_at|desc'. String. - filter -- FQL query specifying the filter parameters. String. - include_deleted -- Include audit events for deleted knowledge bases. Defaults to false. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/knowledge-base-audit-events/QueriesKnowledgeBaseAuditEventsV1 + + Keyword arguments + ----------------- + knowledge_base_id : str + ID of the knowledge base to query audit events for. + offset : int + Starting index of overall result set from which to return ids. + limit : int + Number of IDs to return. + sort : str + Sort order. Ex: 'created_at|desc' + filter : str + FQL query specifying the filter parameters. + include_deleted : bool + Include audit events for deleted knowledge bases. Defaults to false. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/knowledge_base_audit_events.pyi b/src/falconpy/knowledge_base_audit_events.pyi index 607ee52e3..4132ee054 100644 --- a/src/falconpy/knowledge_base_audit_events.pyi +++ b/src/falconpy/knowledge_base_audit_events.pyi @@ -10,26 +10,6 @@ class KnowledgeBaseAuditEvents(ServiceClass): self, *, include_deleted: Optional[bool] = None, - date_ranges: Optional[list] = None, - exclude: Optional[str] = None, - extended_bounds: Optional[dict] = None, - field: Optional[str] = None, - filter: Optional[str] = None, - filters_spec: Optional[dict] = None, - include: Optional[str] = None, - interval: Optional[str] = None, - max_doc_count: Optional[int] = None, - min_doc_count: Optional[int] = None, - missing: Optional[str] = None, - name: Optional[str] = None, - percents: Optional[list] = None, - q: Optional[str] = None, - ranges: Optional[list] = None, - size: Optional[int] = None, - sort: Optional[str] = None, - sub_aggregates: Optional[list] = None, - time_zone: Optional[str] = None, - type: Optional[str] = None, body: Optional[list] = None, parameters: Optional[dict] = None, ) -> Union[Dict[str, Union[int, dict]], Result]: ... diff --git a/src/falconpy/knowledge_base_files.py b/src/falconpy/knowledge_base_files.py index 9ec98e03e..e5dbfe5d1 100644 --- a/src/falconpy/knowledge_base_files.py +++ b/src/falconpy/knowledge_base_files.py @@ -62,19 +62,27 @@ def entities_knowledge_base_files_download_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Download knowledge base file entities for the provided id. - Keyword arguments: - knowledge_base_id -- ID of the knowledge base. String. - id -- ID of entities to retrieve. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/knowledge-base-files/EntitiesKnowledgeBaseFilesDownloadV1 + + Keyword arguments + ----------------- + knowledge_base_id : str + ID of the knowledge base. + id : str + ID of entities to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -91,20 +99,29 @@ def entities_knowledge_base_files_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve knowledge base file entities for the provided id. - Keyword arguments: - knowledge_base_id -- ID of the knowledge base. String. - ids -- IDs of entities to retrieve. List. - include_deleted -- Include deleted knowledge base files in the result. Defaults to false. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/knowledge-base-files/EntitiesKnowledgeBaseFilesV1 + + Keyword arguments + ----------------- + knowledge_base_id : str + ID of the knowledge base. + ids : str or list[str] + IDs of entities to retrieve. + include_deleted : bool + Include deleted knowledge base files in the result. Defaults to false. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -121,21 +138,31 @@ def entities_knowledge_base_files_update_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update an existing file in a knowledge base. - Keyword arguments: - file_name -- Name to use for the uploaded file. String. - id -- ID of the document to update. String. - file -- New file content to replace the existing document. String. - file_description -- New description for the document. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PUT Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/knowledge-base-files/EntitiesKnowledgeBaseFilesUpdateV1 + + Keyword arguments + ----------------- + file_name : str + Name to use for the uploaded file. + id : str + ID of the document to update. + file : str + New file content to replace the existing document. + file_description : str + New description for the document. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ kwargs = params_to_keywords(["id", "file", "file_description"], parameters, @@ -165,21 +192,31 @@ def entities_knowledge_base_files_create_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Upload a file to a knowledge base. - Keyword arguments: - file_name -- Name to use for the uploaded file. String. - knowledge_base_id -- ID of the knowledge base. String. - file -- File to be uploaded. String. - file_description -- Description for the uploaded file. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/knowledge-base-files/EntitiesKnowledgeBaseFilesCreateV1 + + Keyword arguments + ----------------- + file_name : str + Name to use for the uploaded file. + knowledge_base_id : str + ID of the knowledge base. + file : str + File to be uploaded. + file_description : str + Description for the uploaded file. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ kwargs = params_to_keywords(["knowledge_base_id", "file", "file_description"], parameters, @@ -209,19 +246,27 @@ def entities_knowledge_base_files_delete_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete document from knowledge base. - Keyword arguments: - knowledge_base_id -- ID of the knowledge base. String. - id -- ID of the document to delete. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/knowledge-base-files/EntitiesKnowledgeBaseFilesDeleteV1 + + Keyword arguments + ----------------- + knowledge_base_id : str + ID of the knowledge base. + id : str + ID of the document to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -238,22 +283,33 @@ def queries_knowledge_base_files_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Query knowledge base files based on the provided filters. - Keyword arguments: - knowledge_base_id -- ID of the knowledge base. String. - offset -- Starting index of overall result set from which to return ids. Integer. - limit -- Number of IDs to return. Offset + limit should NOT be above 10K. Integer. - filter -- FQL query specifying the filter parameters. String. - include_deleted -- Include deleted knowledge base files in the result. Defaults to false. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/knowledge-base-files/QueriesKnowledgeBaseFilesV1 + + Keyword arguments + ----------------- + knowledge_base_id : str + ID of the knowledge base. + offset : int + Starting index of overall result set from which to return ids. + limit : int + Number of IDs to return. Offset + limit should NOT be above 10K. + filter : str + FQL query specifying the filter parameters. + include_deleted : bool + Include deleted knowledge base files in the result. Defaults to false. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/knowledge_bases.py b/src/falconpy/knowledge_bases.py index b7d0a64b4..aa436a3d5 100644 --- a/src/falconpy/knowledge_bases.py +++ b/src/falconpy/knowledge_bases.py @@ -64,9 +64,18 @@ def aggregates_knowledge_bases_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Aggregate knowledge bases based on the provided msa criteria. - Keyword arguments: - include_deleted -- Include deleted knowledge bases in the result. Defaults to false. Boolean. - body -- Full body payload as a JSON formatted list. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/knowledge-bases/AggregatesKnowledgeBasesV1 + + Keyword arguments + ----------------- + include_deleted : bool + Include deleted knowledge bases in the result. Defaults to false. + body : list + Full body payload as a JSON formatted list. Not required if using other keywords. [ { "date_ranges": [ @@ -101,30 +110,43 @@ def aggregates_knowledge_bases_v1(self: object, "type": "string" } ] - date_ranges -- List of date range objects. List of dictionaries. - field -- The field to aggregate on. String. - filter -- FQL filter expression. String. - interval -- Time interval for aggregation. String. - min_doc_count -- Minimum document count threshold. Integer. - missing -- Missing value handling. String. - name -- Name of the aggregation. String. - q -- Full text search across all metadata fields. String. - ranges -- List of range objects. List of dictionaries. - size -- Maximum number of results. Integer. - sort -- Sort expression. String. - sub_aggregates -- List of sub-aggregate expressions. List of strings. - time_zone -- Time zone for date operations. String. - type -- Type of aggregation (terms, date_histogram, etc.). String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + date_ranges : list[dict] + List of date range objects. + field : str + The field to aggregate on. + filter : str + FQL filter expression. + interval : str + Time interval for aggregation. + min_doc_count : int + Minimum document count threshold. + missing : str + Missing value handling. + name : str + Name of the aggregation. + q : str + Full text search across all metadata fields. + ranges : list[dict] + List of range objects. + size : int + Maximum number of results. + sort : str + Sort expression. + sub_aggregates : list[str] + List of sub-aggregate expressions. + time_zone : str + Time zone for date operations. + type : str + Type of aggregation (terms, date_histogram, etc.) + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/knowledge-bases/AggregatesKnowledgeBasesV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -145,19 +167,27 @@ def entities_knowledge_bases_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve knowledge base entities for the provided id. - Keyword arguments: - ids -- IDs of entities to retrieve. List. - include_deleted -- Include deleted knowledge bases in the result. Defaults to false. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/knowledge-bases/EntitiesKnowledgeBasesV1 + + Keyword arguments + ----------------- + ids : str or list[str] + IDs of entities to retrieve. + include_deleted : bool + Include deleted knowledge bases in the result. Defaults to false. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -174,8 +204,16 @@ def entities_knowledge_bases_create_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create or update a knowledge base. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/knowledge-bases/EntitiesKnowledgeBasesCreateV1 + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "created_at": "string", "created_by": { @@ -216,25 +254,33 @@ def entities_knowledge_bases_create_v1(self: object, "uuid": "string" } } - created_at -- The created_at value. String. - created_by -- The created_by value. Dictionary. - description -- The description value. String. - embedding_model -- The embedding_model value. String. - files_count -- The files_count value. Integer. - id -- The id value. String. - is_deleted -- The is_deleted value. Boolean. - name -- The name value. String. - updated_at -- The updated_at value. String. - updated_by -- The updated_by value. Dictionary. + created_at : str + The created_at value. + created_by : dict + The created_by value. + description : str + The description value. + embedding_model : str + The embedding_model value. + files_count : int + The files_count value. + id : str + The id value. + is_deleted : bool + The is_deleted value. + name : str + The name value. + updated_at : str + The updated_at value. + updated_by : dict + The updated_by value. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/knowledge-bases/EntitiesKnowledgeBasesCreateV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = entities_knowledge_bases_create_v1_payload(passed_keywords=kwargs) @@ -253,8 +299,16 @@ def entities_knowledge_bases_update_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update an existing knowledge base. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/knowledge-bases/EntitiesKnowledgeBasesUpdateV1 + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "created_at": "string", "created_by": { @@ -295,25 +349,33 @@ def entities_knowledge_bases_update_v1(self: object, "uuid": "string" } } - created_at -- The created_at value. String. - created_by -- The created_by value. Dictionary. - description -- The description value. String. - embedding_model -- The embedding_model value. String. - files_count -- The files_count value. Integer. - id -- The id value. String. - is_deleted -- The is_deleted value. Boolean. - name -- The name value. String. - updated_at -- The updated_at value. String. - updated_by -- The updated_by value. Dictionary. + created_at : str + The created_at value. + created_by : dict + The created_by value. + description : str + The description value. + embedding_model : str + The embedding_model value. + files_count : int + The files_count value. + id : str + The id value. + is_deleted : bool + The is_deleted value. + name : str + The name value. + updated_at : str + The updated_at value. + updated_by : dict + The updated_by value. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/knowledge-bases/EntitiesKnowledgeBasesUpdateV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = entities_knowledge_bases_update_v1_payload(passed_keywords=kwargs) @@ -332,22 +394,33 @@ def queries_knowledge_bases_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Query knowledge bases based on the provided filters. - Keyword arguments: - offset -- Starting index of overall result set from which to return ids. Integer. - limit -- Number of IDs to return. Offset + limit should NOT be above 10K. Integer. - sort -- Possible order by fields: name, created_at. Ex: 'created_at|desc' or 'name|asc'. String. - filter -- FQL query specifying the filter parameters. String. - include_deleted -- Include deleted knowledge bases in the result. Defaults to false. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/knowledge-bases/QueriesKnowledgeBasesV1 + + Keyword arguments + ----------------- + offset : int + Starting index of overall result set from which to return ids. + limit : int + Number of IDs to return. Offset + limit should NOT be above 10K. + sort : str + Possible order by fields: name, created_at. Ex: 'created_at|desc' or 'name|asc' + filter : str + FQL query specifying the filter parameters. + include_deleted : bool + Include deleted knowledge bases in the result. Defaults to false. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -364,22 +437,33 @@ def combined_knowledge_bases_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Search for knowledge bases with filtering and return full entity details in a single response. - Keyword arguments: - offset -- Starting index of overall result set from which to return ids. Integer. - limit -- Number of ids to return. Offset + limit should NOT be above 10K. Integer. - sort -- Possible order by fields: name, created_at. Ex: 'created_at|desc' or 'name|asc'. String. - filter -- FQL query specifying the filter parameters. String. - include_deleted -- Include deleted knowledge bases in the result. Defaults to false. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/knowledge-bases/CombinedKnowledgeBasesV1 + + Keyword arguments + ----------------- + offset : int + Starting index of overall result set from which to return ids. + limit : int + Number of ids to return. Offset + limit should NOT be above 10K. + sort : str + Possible order by fields: name, created_at. Ex: 'created_at|desc' or 'name|asc' + filter : str + FQL query specifying the filter parameters. + include_deleted : bool + Include deleted knowledge bases in the result. Defaults to false. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/knowledge_bases.pyi b/src/falconpy/knowledge_bases.pyi index f31e28d47..18ecebf68 100644 --- a/src/falconpy/knowledge_bases.pyi +++ b/src/falconpy/knowledge_bases.pyi @@ -10,26 +10,6 @@ class KnowledgeBases(ServiceClass): self, *, include_deleted: Optional[bool] = None, - date_ranges: Optional[list] = None, - exclude: Optional[str] = None, - extended_bounds: Optional[dict] = None, - field: Optional[str] = None, - filter: Optional[str] = None, - filters_spec: Optional[dict] = None, - include: Optional[str] = None, - interval: Optional[str] = None, - max_doc_count: Optional[int] = None, - min_doc_count: Optional[int] = None, - missing: Optional[str] = None, - name: Optional[str] = None, - percents: Optional[list] = None, - q: Optional[str] = None, - ranges: Optional[list] = None, - size: Optional[int] = None, - sort: Optional[str] = None, - sub_aggregates: Optional[list] = None, - time_zone: Optional[str] = None, - type: Optional[str] = None, body: Optional[list] = None, parameters: Optional[dict] = None, ) -> Union[Dict[str, Union[int, dict]], Result]: ... diff --git a/src/falconpy/kubernetes_container_compliance.py b/src/falconpy/kubernetes_container_compliance.py index 5327bbc42..258800c57 100644 --- a/src/falconpy/kubernetes_container_compliance.py +++ b/src/falconpy/kubernetes_container_compliance.py @@ -64,28 +64,37 @@ def aggregate_assessments_by_cluster(self, Includes pass/fail assessment counts for various asset types. - Keyword arguments: - filter -- FQL filter expression used to limit the results. String. - Filter fields include: - cid cloud_info.cluster_type - cloud_info.cloud_account_id compliance_finding.framework_name - cloud_info.cloud_provider compliance_finding.framework_name_version - cloud_info.cloud_region compliance_finding.framework_version - cloud_info.cluster_id compliance_finding.severity - cloud_info.cluster_name - limit -- The maximum number of records to return. (1-500) Default is 20. Integer. - offset -- The zero-based position of the first record to return. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /kubernetes-container-compliance/AggregateAssessmentsGroupedByClustersV2 + /kubernetes-container-compliance/AggregateAssessmentsGroupedByClustersV2 + + Keyword arguments + ----------------- + filter : str + FQL filter expression used to limit the results. String. + Filter fields include: + cid cloud_info.cluster_type + cloud_info.cloud_account_id compliance_finding.framework_name + cloud_info.cloud_provider compliance_finding.framework_name_version + cloud_info.cloud_region compliance_finding.framework_version + cloud_info.cluster_id compliance_finding.severity + cloud_info.cluster_name + limit : int + The maximum number of records to return. (1-500) Default is 20. + offset : int + The zero-based position of the first record to return. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -102,26 +111,33 @@ def aggregate_compliance_by_asset_type(self, ) -> Union[Dict[str, Union[int, dict]], Result]: """Provide aggregated compliance assessment metrics and rule status information, organized by asset type. - Keyword arguments: - filter -- FQL filter expression used to limit the results. String. - Filter fields include: - cid cloud_info.cluster_type - cloud_info.cloud_account_id compliance_finding.asset_type - cloud_info.cloud_provider compliance_finding.framework_name - cloud_info.cloud_region compliance_finding.framework_name_version - cloud_info.cluster_id compliance_finding.framework_version - cloud_info.cluster_name compliance_finding.severity - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /kubernetes-container-compliance/AggregateComplianceByAssetType + /kubernetes-container-compliance/AggregateComplianceByAssetType + + Keyword arguments + ----------------- + filter : str + FQL filter expression used to limit the results. String. + Filter fields include: + cid cloud_info.cluster_type + cloud_info.cloud_account_id compliance_finding.asset_type + cloud_info.cloud_provider compliance_finding.framework_name + cloud_info.cloud_region compliance_finding.framework_name_version + cloud_info.cluster_id compliance_finding.framework_version + cloud_info.cluster_name compliance_finding.severity + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -138,26 +154,33 @@ def aggregate_compliance_by_cluster_type(self, ) -> Union[Dict[str, Union[int, dict]], Result]: """Provide aggregated compliance assessment metrics and rule status information, organized by Kubernetes cluster type. - Keyword arguments: - filter -- FQL filter expression used to limit the results. String. - Filter fields include: - cid cloud_info.cluster_type - cloud_info.cloud_account_id compliance_finding.asset_type - cloud_info.cloud_provider compliance_finding.framework_name - cloud_info.cloud_region compliance_finding.framework_name_version - cloud_info.cluster_id compliance_finding.framework_version - cloud_info.cluster_name compliance_finding.severity - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /kubernetes-container-compliance/AggregateComplianceByClusterType + /kubernetes-container-compliance/AggregateComplianceByClusterType + + Keyword arguments + ----------------- + filter : str + FQL filter expression used to limit the results. String. + Filter fields include: + cid cloud_info.cluster_type + cloud_info.cloud_account_id compliance_finding.asset_type + cloud_info.cloud_provider compliance_finding.framework_name + cloud_info.cloud_region compliance_finding.framework_name_version + cloud_info.cluster_id compliance_finding.framework_version + cloud_info.cluster_name compliance_finding.severity + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -174,26 +197,33 @@ def aggregate_compliance_by_framework(self, ) -> Union[Dict[str, Union[int, dict]], Result]: """Provide aggregated compliance assessment metrics and rule status information, organized by compliance framework. - Keyword arguments: - filter -- FQL filter expression used to limit the results. String. - Filter fields include: - cid cloud_info.cluster_type - cloud_info.cloud_account_id compliance_finding.asset_type - cloud_info.cloud_provider compliance_finding.framework_name - cloud_info.cloud_region compliance_finding.framework_name_version - cloud_info.cluster_id compliance_finding.framework_version - cloud_info.cluster_name compliance_finding.severity - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /kubernetes-container-compliance/AggregateComplianceByFramework + /kubernetes-container-compliance/AggregateComplianceByFramework + + Keyword arguments + ----------------- + filter : str + FQL filter expression used to limit the results. String. + Filter fields include: + cid cloud_info.cluster_type + cloud_info.cloud_account_id compliance_finding.asset_type + cloud_info.cloud_provider compliance_finding.framework_name + cloud_info.cloud_region compliance_finding.framework_name_version + cloud_info.cluster_id compliance_finding.framework_version + cloud_info.cluster_name compliance_finding.severity + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -213,27 +243,35 @@ def aggregate_failed_rules_by_clusters(self, Results are ranked in descending order based on the number of failed compliance rules across severity levels (critical, high, medium, and low). - Keyword arguments: - filter -- FQL filter expression used to limit the results. String. - Filter fields include: - cid cloud_info.cluster_type - cloud_info.cloud_account_id compliance_finding.asset_type - cloud_info.cloud_provider compliance_finding.framework_name - cloud_info.cloud_region compliance_finding.framework_name_version - cloud_info.cluster_id compliance_finding.framework_version - cloud_info.cluster_name compliance_finding.severity - limit -- The maximum number of records to return. (1-100) Default is 10. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /kubernetes-container-compliance/AggregateFailedRulesByClustersV3 + /kubernetes-container-compliance/AggregateFailedRulesByClustersV3 + + Keyword arguments + ----------------- + filter : str + FQL filter expression used to limit the results. String. + Filter fields include: + cid cloud_info.cluster_type + cloud_info.cloud_account_id compliance_finding.asset_type + cloud_info.cloud_provider compliance_finding.framework_name + cloud_info.cloud_region compliance_finding.framework_name_version + cloud_info.cluster_id compliance_finding.framework_version + cloud_info.cluster_name compliance_finding.severity + limit : int + The maximum number of records to return. (1-100) Default is 10. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -252,29 +290,38 @@ def aggregate_assessments_by_rules(self, Results organized by compliance rule, including pass/fail assessment counts. - Keyword arguments: - filter -- FQL filter expression used to limit the results. String. - Filter fields include: - cid compliance_finding.asset_type - cloud_info.cloud_account_id compliance_finding.framework_name - cloud_info.cloud_provider compliance_finding.framework_name_version - cloud_info.cloud_region compliance_finding.framework_version - cloud_info.cluster_id compliance_finding.id - cloud_info.cluster_name compliance_finding.severity - cloud_info.cluster_type compliance_finding.status - limit -- The maximum number of records to return. (1-500) Default is 20. Integer. - offset -- The zero-based position of the first record to return. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /kubernetes-container-compliance/AggregateAssessmentsGroupedByRulesV2 + /kubernetes-container-compliance/AggregateAssessmentsGroupedByRulesV2 + + Keyword arguments + ----------------- + filter : str + FQL filter expression used to limit the results. String. + Filter fields include: + cid compliance_finding.asset_type + cloud_info.cloud_account_id compliance_finding.framework_name + cloud_info.cloud_provider compliance_finding.framework_name_version + cloud_info.cloud_region compliance_finding.framework_version + cloud_info.cluster_id compliance_finding.id + cloud_info.cluster_name compliance_finding.severity + cloud_info.cluster_type compliance_finding.status + limit : int + The maximum number of records to return. (1-500) Default is 20. + offset : int + The zero-based position of the first record to return. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -294,27 +341,35 @@ def aggregate_top_failed_images(self, Results are ranked in descending order based on the number of failed assessments across severity levels (critical, high, medium, and low). - Keyword arguments: - filter -- FQL filter expression used to limit the results. String. - Filter fields include: - cid cloud_info.cluster_type - cloud_info.cloud_account_id compliance_finding.asset_type - cloud_info.cloud_provider compliance_finding.framework_name - cloud_info.cloud_region compliance_finding.framework_name_version - cloud_info.cluster_id compliance_finding.framework_version - cloud_info.cluster_name compliance_finding.severity - limit -- The maximum number of records to return. (1-100) Default is 10. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /kubernetes-container-compliance/AggregateTopFailedImages + /kubernetes-container-compliance/AggregateTopFailedImages + + Keyword arguments + ----------------- + filter : str + FQL filter expression used to limit the results. String. + Filter fields include: + cid cloud_info.cluster_type + cloud_info.cloud_account_id compliance_finding.asset_type + cloud_info.cloud_provider compliance_finding.framework_name + cloud_info.cloud_region compliance_finding.framework_name_version + cloud_info.cluster_id compliance_finding.framework_version + cloud_info.cluster_name compliance_finding.severity + limit : int + The maximum number of records to return. (1-100) Default is 10. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -333,36 +388,45 @@ def image_findings(self, Provides information needed to identify compliance violations. - Keyword arguments: - after -- A pagination token used with the `limit` parameter to manage pagination of results. String. - On your first request, don't provide an `after` token. On subsequent requests, provide the - `after` token from the previous response to continue from that place in the results. - filter -- FQL filter expression used to limit the results. String. - Filter fields include: - cid compliance_finding.framework_name_version - cloud_info.cloud_account_id compliance_finding.framework_version - cloud_info.cloud_provider compliance_finding.id - cloud_info.cloud_region compliance_finding.severity - cloud_info.cluster_id compliance_finding.status - cloud_info.cluster_name image_digest - cloud_info.cluster_type image_id - cloud_info.namespace image_registry - compliance_finding.asset_uid image_repository - compliance_finding.framework_name image_tag - limit -- The maximum number of images for which assessments are to be returned. Integer. - Use with the after parameter to manage pagination of results. - Default: 100, Max: 100 - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /kubernetes-container-compliance/CombinedImagesFindings + /kubernetes-container-compliance/CombinedImagesFindings + + Keyword arguments + ----------------- + after : str + A pagination token used with the `limit` parameter to manage pagination of results. String. + On your first request, don't provide an `after` token. On subsequent requests, provide the + `after` token from the previous response to continue from that place in the results. + filter : str + FQL filter expression used to limit the results. String. + Filter fields include: + cid compliance_finding.framework_name_version + cloud_info.cloud_account_id compliance_finding.framework_version + cloud_info.cloud_provider compliance_finding.id + cloud_info.cloud_region compliance_finding.severity + cloud_info.cluster_id compliance_finding.status + cloud_info.cluster_name image_digest + cloud_info.cluster_type image_id + cloud_info.namespace image_registry + compliance_finding.asset_uid image_repository + compliance_finding.framework_name image_tag + limit : int + The maximum number of images for which assessments are to be returned. Integer. + Use with the after parameter to manage pagination of results. + Default: 100, Max: 100 + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -381,36 +445,45 @@ def node_findings(self, Provides information needed to identify compliance violations. - Keyword arguments: - after -- A pagination token used with the `limit` parameter to manage pagination of results. String. - On your first request, don't provide an `after` token. On subsequent requests, provide the - `after` token from the previous response to continue from that place in the results. - filter -- FQL filter expression used to limit the results. String. - Filter fields include: - cid compliance_finding.framework_name_version - cloud_info.cloud_account_id compliance_finding.framework_version - cloud_info.cloud_provider compliance_finding.id - cloud_info.cloud_region compliance_finding.severity - cloud_info.cluster_id compliance_finding.status - cloud_info.cluster_name aid - cloud_info.cluster_type node_id - compliance_finding.asset_type node_name - compliance_finding.asset_uid node_type - compliance_finding.framework_name - limit -- The maximum number of nodes for which assessments are to be returned. Integer. - Use with the after parameter to manage pagination of results. - Default: 100, Max: 100. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /kubernetes-container-compliance/CombinedNodesFindings + /kubernetes-container-compliance/CombinedNodesFindings + + Keyword arguments + ----------------- + after : str + A pagination token used with the `limit` parameter to manage pagination of results. String. + On your first request, don't provide an `after` token. On subsequent requests, provide the + `after` token from the previous response to continue from that place in the results. + filter : str + FQL filter expression used to limit the results. String. + Filter fields include: + cid compliance_finding.framework_name_version + cloud_info.cloud_account_id compliance_finding.framework_version + cloud_info.cloud_provider compliance_finding.id + cloud_info.cloud_region compliance_finding.severity + cloud_info.cluster_id compliance_finding.status + cloud_info.cluster_name aid + cloud_info.cluster_type node_id + compliance_finding.asset_type node_name + compliance_finding.asset_uid node_type + compliance_finding.framework_name + limit : int + The maximum number of nodes for which assessments are to be returned. Integer. + Use with the after parameter to manage pagination of results. + Default: 100, Max: 100. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -430,20 +503,29 @@ def get_rules_metadata(self: object, Includes descriptions, remediation steps, and audit procedures by specifying rule identifiers. - Keyword arguments: - ids -- Rule IDs. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /kubernetes-container-compliance/getRulesMetadataByID + /kubernetes-container-compliance/getRulesMetadataByID + + Keyword arguments + ----------------- + ids : str or list[str] + Rule IDs. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/kubernetes_protection.py b/src/falconpy/kubernetes_protection.py index 3c78ca84b..17aec90e3 100644 --- a/src/falconpy/kubernetes_protection.py +++ b/src/falconpy/kubernetes_protection.py @@ -38,6 +38,7 @@ # pylint: disable=C0302, R0904 from typing import Dict, Union from ._util import process_service_request, force_default, handle_single_argument +from ._payload import aggregate_payload from ._result import Result from ._service_class import ServiceClass from ._endpoint._kubernetes_protection import _kubernetes_protection_endpoints as Endpoints @@ -59,17 +60,21 @@ class KubernetesProtection(ServiceClass): def read_clusters_by_date_range(self: object) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve clusters by date range counts. - Keyword arguments: - This method does not accept keyword arguments. - - This method does not accept arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadClustersByDateRangeCount + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + This method does not accept arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -85,33 +90,42 @@ def read_clusters_by_version(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Bucket clusters by kubernetes version. - Keyword arguments: - filter -- Retrieve count of Kubernetes clusters that match a query in Falcon Query Language (FQL). String. - Supported filters: - access cluster_status - agent_id container_count - agent_status iar_coverage - agent_type kac_agent_id - cid kubernetes_version - cloud_account_id last_seen - cloud_name management_status - cloud_region node_count - cloud_service pod_count - cluster_id tags - cluster_name pod_name - namespace - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /kubernetes-protection/ReadClustersByKubernetesVersionCount + /kubernetes-protection/ReadClustersByKubernetesVersionCount + + Keyword arguments + ----------------- + filter : str + Retrieve count of Kubernetes clusters that match a query in Falcon Query Language (FQL). String. + Supported filters: + access cluster_status + agent_id container_count + agent_status iar_coverage + agent_type kac_agent_id + cid kubernetes_version + cloud_account_id last_seen + cloud_name management_status + cloud_region node_count + cloud_service pod_count + cluster_id tags + cluster_name pod_name + namespace + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -129,32 +143,41 @@ def read_clusters_by_status(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Bucket clusters by status. - Keyword arguments: - filter -- Retrieve count of Kubernetes clusters that match a query in Falcon Query Language (FQL). String. - Supported filters: - access cluster_status - agent_id container_count - agent_status iar_coverage - agent_type kac_agent_id - cid kubernetes_version - cloud_account_id last_seen - cloud_name management_status - cloud_region node_count - cloud_service pod_count - cluster_id tags - cluster_name pod_name - namespace - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadClustersByStatusCount + + Keyword arguments + ----------------- + filter : str + Retrieve count of Kubernetes clusters that match a query in Falcon Query Language (FQL). String. + Supported filters: + access cluster_status + agent_id container_count + agent_status iar_coverage + agent_type kac_agent_id + cid kubernetes_version + cloud_account_id last_seen + cloud_name management_status + cloud_region node_count + cloud_service pod_count + cluster_id tags + cluster_name pod_name + namespace + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -172,32 +195,41 @@ def read_cluster_count(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve cluster counts. - Keyword arguments: - filter -- Retrieve count of Kubernetes clusters that match a query in Falcon Query Language (FQL). String. - Supported filters: - access cluster_status - agent_id container_count - agent_status iar_coverage - agent_type kac_agent_id - cid kubernetes_version - cloud_account_id last_seen - cloud_name management_status - cloud_region node_count - cloud_service pod_count - cluster_id tags - cluster_name pod_name - namespace - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadClusterCount + + Keyword arguments + ----------------- + filter : str + Retrieve count of Kubernetes clusters that match a query in Falcon Query Language (FQL). String. + Supported filters: + access cluster_status + agent_id container_count + agent_status iar_coverage + agent_type kac_agent_id + cid kubernetes_version + cloud_account_id last_seen + cloud_name management_status + cloud_region node_count + cloud_service pod_count + cluster_id tags + cluster_name pod_name + namespace + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -215,42 +247,51 @@ def read_containers_by_date_range(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve containers by date range counts. - Keyword arguments: - filter -- Get container counts using a query in Falcon Query Language (FQL). String. - Supported filters: - agent_id image_vulnerability_count - agent_type insecure_mount_source - allow_privilege_escalation insecure_mount_type - cid insecure_propagation_mode - cloud_account_id interactive_mode - cloud_name ipv4 - cloud_region ipv6 - cluster_id labels - cluster_name last_seen - container_id namespace - container_name node_name - cve_id node_uid - detection_name package_name_version - first_seen pod_id - image_detection_count pod_name - image_digest port - image_has_been_assessed privileged - image_id root_write_access - image_registry run_as_root_group - image_repository run_as_root_user - image_tag running_status - ai_related - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadContainersByDateRangeCount + + Keyword arguments + ----------------- + filter : str + Get container counts using a query in Falcon Query Language (FQL). String. + Supported filters: + agent_id image_vulnerability_count + agent_type insecure_mount_source + allow_privilege_escalation insecure_mount_type + cid insecure_propagation_mode + cloud_account_id interactive_mode + cloud_name ipv4 + cloud_region ipv6 + cluster_id labels + cluster_name last_seen + container_id namespace + container_name node_name + cve_id node_uid + detection_name package_name_version + first_seen pod_id + image_detection_count pod_name + image_digest port + image_has_been_assessed privileged + image_id root_write_access + image_registry run_as_root_group + image_repository run_as_root_user + image_tag running_status + ai_related + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -267,47 +308,56 @@ def read_containers_by_registry(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve top container image registries. - Keyword arguments: - filter -- Retrieve count of Kubernetes container image registries that match a query in - Falcon Query Language (FQL). String. - Supported filter fields: - agent_id image_repository - agent_type image_tag - ai_related image_vulnerability_count - allow_privilege_escalation insecure_mount_source - app_name insecure_mount_type - cid insecure_propagation_mode - cloud_account_id interactive_mode - cloud_instance_id ipv4 - cloud_name ipv6 - cloud_region kac_agent_id - cloud_service labels - cluster_id last_seen - cluster_name namespace - container_id node_name - container_image_id node_uid - container_name package_name_version - cve_id pod_id - detection_name pod_name - first_seen port - image_detection_count privileged - image_digest root_write_access - image_has_been_assessed run_as_root_group - image_id run_as_root_user - image_registry running_status - under_assessment -- Flag indicating whether to return registries under assessment or not under assessment. - If not provided all registries are considered. Boolean. Defaults to False. - limit -- The upper-bound on the number of records to retrieve. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadContainerCountByRegistry + + Keyword arguments + ----------------- + filter : str + Retrieve count of Kubernetes container image registries that match a query in + Falcon Query Language (FQL). String. + Supported filter fields: + agent_id image_repository + agent_type image_tag + ai_related image_vulnerability_count + allow_privilege_escalation insecure_mount_source + app_name insecure_mount_type + cid insecure_propagation_mode + cloud_account_id interactive_mode + cloud_instance_id ipv4 + cloud_name ipv6 + cloud_region kac_agent_id + cloud_service labels + cluster_id last_seen + cluster_name namespace + container_id node_name + container_image_id node_uid + container_name package_name_version + cve_id pod_id + detection_name pod_name + first_seen port + image_detection_count privileged + image_digest root_write_access + image_has_been_assessed run_as_root_group + image_id run_as_root_user + image_registry running_status + under_assessment : bool + Flag indicating whether to return registries under assessment or not under assessment. + If not provided all registries are considered. Boolean. Defaults to False. + limit : int + The upper-bound on the number of records to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -320,18 +370,22 @@ def read_containers_by_registry(self: object, def read_zero_day_affected_counts(self: object) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve containers count affected by zero day vulnerabilities. - Keyword arguments: - This method does not accept keyword arguments. - - This method does not accept arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /kubernetes-protection/FindContainersCountAffectedByZeroDayVulnerabilities + /kubernetes-protection/FindContainersCountAffectedByZeroDayVulnerabilities + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + This method does not accept arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -347,43 +401,52 @@ def read_vulnerable_container_count(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve count of vulnerable images running on containers. - Keyword arguments: - filter -- Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). String. - Supported filters: - agent_id image_vulnerability_count - agent_type insecure_mount_source - allow_privilege_escalation insecure_mount_type - cid insecure_propagation_mode - cloud_account_id interactive_mode - cloud_name ipv4 - cloud_region ipv6 - cluster_id labels - cluster_name last_seen - container_id namespace - container_name node_name - cve_id node_uid - detection_name package_name_version - first_seen pod_id - image_detection_count pod_name - image_digest port - image_has_been_assessed privileged - image_id root_write_access - image_registry run_as_root_group - image_repository run_as_root_user - image_tag running_status - ai_related - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /kubernetes-protection/ReadVulnerableContainerImageCount + /kubernetes-protection/ReadVulnerableContainerImageCount + + Keyword arguments + ----------------- + filter : str + Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). String. + Supported filters: + agent_id image_vulnerability_count + agent_type insecure_mount_source + allow_privilege_escalation insecure_mount_type + cid insecure_propagation_mode + cloud_account_id interactive_mode + cloud_name ipv4 + cloud_region ipv6 + cluster_id labels + cluster_name last_seen + container_id namespace + container_name node_name + cve_id node_uid + detection_name package_name_version + first_seen pod_id + image_detection_count pod_name + image_digest port + image_has_been_assessed privileged + image_id root_write_access + image_registry run_as_root_group + image_repository run_as_root_user + image_tag running_status + ai_related + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -401,42 +464,51 @@ def read_container_counts(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve container counts. - Keyword arguments: - filter -- Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). String. - Supported filters: - agent_id image_vulnerability_count - agent_type insecure_mount_source - allow_privilege_escalation insecure_mount_type - cid insecure_propagation_mode - cloud_account_id interactive_mode - cloud_name ipv4 - cloud_region ipv6 - cluster_id labels - cluster_name last_seen - container_id namespace - container_name node_name - cve_id node_uid - detection_name package_name_version - first_seen pod_id - image_detection_count pod_name - image_digest port - image_has_been_assessed privileged - image_id root_write_access - image_registry run_as_root_group - image_repository run_as_root_user - image_tag running_status - ai_related - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadContainerCount + + Keyword arguments + ----------------- + filter : str + Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). String. + Supported filters: + agent_id image_vulnerability_count + agent_type insecure_mount_source + allow_privilege_escalation insecure_mount_type + cid insecure_propagation_mode + cloud_account_id interactive_mode + cloud_name ipv4 + cloud_region ipv6 + cluster_id labels + cluster_name last_seen + container_id namespace + container_name node_name + cve_id node_uid + detection_name package_name_version + first_seen pod_id + image_detection_count pod_name + image_digest port + image_has_been_assessed privileged + image_id root_write_access + image_registry run_as_root_group + image_repository run_as_root_user + image_tag running_status + ai_related + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -453,45 +525,55 @@ def find_containers_by_runtime_version(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve containers by container_runtime_version. - Keyword arguments: - limit -- The upper-bound on the number of container records to retrieve. - offset -- It is used to get the offset - sort -- Field to sort results by - filter -- Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). String. - Supported filters: - agent_id image_vulnerability_count - agent_type insecure_mount_source - allow_privilege_escalation insecure_mount_type - cid insecure_propagation_mode - cloud_account_id interactive_mode - cloud_name ipv4 - cloud_region ipv6 - cluster_id labels - cluster_name last_seen - container_id namespace - container_name node_name - cve_id node_uid - detection_name package_name_version - first_seen pod_id - image_detection_count pod_name - image_digest port - image_has_been_assessed privileged - image_id root_write_access - image_registry run_as_root_group - image_repository run_as_root_user - image_tag running_status - ai_related - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /kubernetes-protection/FindContainersByContainerRunTimeVersion + /kubernetes-protection/FindContainersByContainerRunTimeVersion + + Keyword arguments + ----------------- + limit : int + The upper-bound on the number of container records to retrieve. + offset : int + It is used to get the offset + sort : str + Field to sort results by + filter : str + Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). String. + Supported filters: + agent_id image_vulnerability_count + agent_type insecure_mount_source + allow_privilege_escalation insecure_mount_type + cid insecure_propagation_mode + cloud_account_id interactive_mode + cloud_name ipv4 + cloud_region ipv6 + cluster_id labels + cluster_name last_seen + container_id namespace + container_name node_name + cve_id node_uid + detection_name package_name_version + first_seen pod_id + image_detection_count pod_name + image_digest port + image_has_been_assessed privileged + image_id root_write_access + image_registry run_as_root_group + image_repository run_as_root_user + image_tag running_status + ai_related + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -509,42 +591,51 @@ def group_managed_containers(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Group the containers by Managed. - Keyword arguments: - filter -- Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). String. - Supported filters: - agent_id image_vulnerability_count - agent_type insecure_mount_source - allow_privilege_escalation insecure_mount_type - cid insecure_propagation_mode - cloud_account_id interactive_mode - cloud_name ipv4 - cloud_region ipv6 - cluster_id labels - cluster_name last_seen - container_id namespace - container_name node_name - cve_id node_uid - detection_name package_name_version - first_seen pod_id - image_detection_count pod_name - image_digest port - image_has_been_assessed privileged - image_id root_write_access - image_registry run_as_root_group - image_repository run_as_root_user - image_tag running_status - ai_related - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/GroupContainersByManaged + + Keyword arguments + ----------------- + filter : str + Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). String. + Supported filters: + agent_id image_vulnerability_count + agent_type insecure_mount_source + allow_privilege_escalation insecure_mount_type + cid insecure_propagation_mode + cloud_account_id interactive_mode + cloud_name ipv4 + cloud_region ipv6 + cluster_id labels + cluster_name last_seen + container_id namespace + container_name node_name + cve_id node_uid + detection_name package_name_version + first_seen pod_id + image_detection_count pod_name + image_digest port + image_has_been_assessed privileged + image_id root_write_access + image_registry run_as_root_group + image_repository run_as_root_user + image_tag running_status + ai_related + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -562,43 +653,52 @@ def read_detections_count_by_date(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve count of image assessment detections on running containers over a period of time. - Keyword arguments: - filter -- Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). String. - Supported filters: - agent_id image_vulnerability_count - agent_type insecure_mount_source - allow_privilege_escalation insecure_mount_type - cid insecure_propagation_mode - cloud_account_id interactive_mode - cloud_name ipv4 - cloud_region ipv6 - cluster_id labels - cluster_name last_seen - container_id namespace - container_name node_name - cve_id node_uid - detection_name package_name_version - first_seen pod_id - image_detection_count pod_name - image_digest port - image_has_been_assessed privileged - image_id root_write_access - image_registry run_as_root_group - image_repository run_as_root_user - image_tag running_status - ai_related - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /kubernetes-protection/ReadContainerImageDetectionsCountByDate + /kubernetes-protection/ReadContainerImageDetectionsCountByDate + + Keyword arguments + ----------------- + filter : str + Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). String. + Supported filters: + agent_id image_vulnerability_count + agent_type insecure_mount_source + allow_privilege_escalation insecure_mount_type + cid insecure_propagation_mode + cloud_account_id interactive_mode + cloud_name ipv4 + cloud_region ipv6 + cluster_id labels + cluster_name last_seen + container_id namespace + container_name node_name + cve_id node_uid + detection_name package_name_version + first_seen pod_id + image_detection_count pod_name + image_digest port + image_has_been_assessed privileged + image_id root_write_access + image_registry run_as_root_group + image_repository run_as_root_user + image_tag running_status + ai_related + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -616,20 +716,29 @@ def read_images_by_state(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve count of image states running on containers. - Keyword arguments: - filter -- Filter using a query in Falcon Query Language (FQL). String. - Supported filters: cid - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadContainerImagesByState + + Keyword arguments + ----------------- + filter : str + Filter using a query in Falcon Query Language (FQL). String. + Supported filters: cid + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -647,42 +756,51 @@ def read_sensor_coverage(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Bucket containers by agent type and calculate sensor coverage. - Keyword arguments: - filter -- Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). String. - Supported filters: - agent_id image_vulnerability_count - agent_type insecure_mount_source - allow_privilege_escalation insecure_mount_type - cid insecure_propagation_mode - cloud_account_id interactive_mode - cloud_name ipv4 - cloud_region ipv6 - cluster_id labels - cluster_name last_seen - container_id namespace - container_name node_name - cve_id node_uid - detection_name package_name_version - first_seen pod_id - image_detection_count pod_name - image_digest port - image_has_been_assessed privileged - image_id root_write_access - image_registry run_as_root_group - image_repository run_as_root_user - image_tag running_status - ai_related - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadContainersSensorCoverage + + Keyword arguments + ----------------- + filter : str + Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). String. + Supported filters: + agent_id image_vulnerability_count + agent_type insecure_mount_source + allow_privilege_escalation insecure_mount_type + cid insecure_propagation_mode + cloud_account_id interactive_mode + cloud_name ipv4 + cloud_region ipv6 + cluster_id labels + cluster_name last_seen + container_id namespace + container_name node_name + cve_id node_uid + detection_name package_name_version + first_seen pod_id + image_detection_count pod_name + image_digest port + image_has_been_assessed privileged + image_id root_write_access + image_registry run_as_root_group + image_repository run_as_root_user + image_tag running_status + ai_related + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -700,28 +818,37 @@ def read_namespace_count(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Bucket containers by agent type and calculate sensor coverage. - Keyword arguments: - filter -- Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). String. - Supported filters: - agent_id cluster_id - agent_type cluster_name - annotations_list first_seen - cid kac_agent_id - cloud_account_id last_seen - cloud_name namespace_id - cloud_region namespace_name - cloud_service resource_status - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadNamespaceCount + + Keyword arguments + ----------------- + filter : str + Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). String. + Supported filters: + agent_id cluster_id + agent_type cluster_name + annotations_list first_seen + cid kac_agent_id + cloud_account_id last_seen + cloud_name namespace_id + cloud_region namespace_name + cloud_service resource_status + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -734,17 +861,21 @@ def read_namespace_count(self: object, def read_namespaces_by_date_range_count(self: object) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve namespaces by date range count. - Keyword arguments: - This method does not accept keyword arguments. - - This method does not accept arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadNamespacesByDateRangeCount + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + This method does not accept arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -760,43 +891,52 @@ def read_vulnerability_counts_by_severity(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve container vulnerabilities by severity counts. - Keyword arguments: - filter -- Get vulnerabilities count by severity for container using a query in Falcon Query Language (FQL). String. - Supported filters: - agent_id image_vulnerability_count - agent_type insecure_mount_source - allow_privilege_escalation insecure_mount_type - cid insecure_propagation_mode - cloud_account_id interactive_mode - cloud_name ipv4 - cloud_region ipv6 - cluster_id labels - cluster_name last_seen - container_id namespace - container_name node_name - cve_id node_uid - detection_name package_name_version - first_seen pod_id - image_detection_count pod_name - image_digest port - image_has_been_assessed privileged - image_id root_write_access - image_registry run_as_root_group - image_repository run_as_root_user - image_tag running_status - ai_related - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /kubernetes-protection/ReadContainerVulnerabilitiesBySeverityCount + /kubernetes-protection/ReadContainerVulnerabilitiesBySeverityCount + + Keyword arguments + ----------------- + filter : str + Get vulnerabilities count by severity for container using a query in Falcon Query Language (FQL). String. + Supported filters: + agent_id image_vulnerability_count + agent_type insecure_mount_source + allow_privilege_escalation insecure_mount_type + cid insecure_propagation_mode + cloud_account_id interactive_mode + cloud_name ipv4 + cloud_region ipv6 + cluster_id labels + cluster_name last_seen + container_id namespace + container_name node_name + cve_id node_uid + detection_name package_name_version + first_seen pod_id + image_detection_count pod_name + image_digest port + image_has_been_assessed privileged + image_id root_write_access + image_registry run_as_root_group + image_repository run_as_root_user + image_tag running_status + ai_related + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -809,17 +949,21 @@ def read_vulnerability_counts_by_severity(self: object, def read_deployment_counts_by_date_range(self: object) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve deployments by date range counts. - Keyword arguments: - This method does not accept keyword arguments. - - This method does not accept arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadDeploymentsByDateRangeCount + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + This method does not accept arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -835,27 +979,36 @@ def read_deployment_count(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve deployment counts. - Keyword arguments: - filter -- Retrieve count of Kubernetes deployments that match a query in Falcon Query Language (FQL). String. - Supported filters: - annotations_list deployment_id - cid deployment_name - cloud_account_id first_seen - cloud_name last_seen - cloud_region namespace - cluster_id pod_count - cluster_name - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadDeploymentCount + + Keyword arguments + ----------------- + filter : str + Retrieve count of Kubernetes deployments that match a query in Falcon Query Language (FQL). String. + Supported filters: + annotations_list deployment_id + cid deployment_name + cloud_account_id first_seen + cloud_name last_seen + cloud_region namespace + cluster_id pod_count + cluster_name + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -872,20 +1025,28 @@ def read_cluster_enrichment(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve cluster enrichment data. - Keyword arguments: - cluster_id -- One or more cluster ids for which to retrieve enrichment info - filter -- Supported filters: cloud_account_id, cloud_name, cloud_region, cluster_id, - cluster_name, last_seen, namespace - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadClusterEnrichment + + Keyword arguments + ----------------- + cluster_id : str or list[str] + One or more cluster ids for which to retrieve enrichment info + filter : str + Supported filters: cloud_account_id, cloud_name, cloud_region, cluster_id, + cluster_name, last_seen, namespace + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -902,20 +1063,28 @@ def read_container_enrichment(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve container enrichment data. - Keyword arguments: - container_id -- One or more container ids for which to retrieve enrichment info - filter -- Supported filters: cloud_account_id, cloud_name, cloud_region, cluster_id, - cluster_name, last_seen, namespace - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadContainerEnrichment + + Keyword arguments + ----------------- + container_id : str or list[str] + One or more container ids for which to retrieve enrichment info + filter : str + Supported filters: cloud_account_id, cloud_name, cloud_region, cluster_id, + cluster_name, last_seen, namespace + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -929,20 +1098,28 @@ def read_container_enrichment(self: object, def read_pod_enrichment(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve pod enrichment data. - Keyword arguments: - pod_id -- One or more pod ids for which to retrieve enrichment info - filter -- Supported filters: cloud_account_id, cloud_name, cloud_region, cluster_id, - cluster_name, last_seen, namespace - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadPodEnrichment + + Keyword arguments + ----------------- + pod_id : str or list[str] + One or more pod ids for which to retrieve enrichment info + filter : str + Supported filters: cloud_account_id, cloud_name, cloud_region, cluster_id, + cluster_name, last_seen, namespace + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -959,20 +1136,28 @@ def read_deployment_enrichment(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve deployment enrichment data. - Keyword arguments: - deployment_id -- One or more deployment ids for which to retrieve enrichment info - filter -- Supported filters: cloud_account_id, cloud_name, cloud_region, cluster_id, - cluster_name, last_seen, namespace - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadDeploymentEnrichment + + Keyword arguments + ----------------- + deployment_id : str or list[str] + One or more deployment ids for which to retrieve enrichment info + filter : str + Supported filters: cloud_account_id, cloud_name, cloud_region, cluster_id, + cluster_name, last_seen, namespace + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -989,20 +1174,28 @@ def read_node_enrichment(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve node enrichment data. - Keyword arguments: - node_name -- One or more node names for which to retrieve enrichment info - filter -- Supported filters: cloud_account_id, cloud_name, cloud_region, cluster_id, - cluster_name, last_seen, namespace - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadNodeEnrichment + + Keyword arguments + ----------------- + node_name : str or list[str] + One or more node names for which to retrieve enrichment info + filter : str + Supported filters: cloud_account_id, cloud_name, cloud_region, cluster_id, + cluster_name, last_seen, namespace + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1020,42 +1213,51 @@ def read_distinct_image_count(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve count of distinct images running on containers. - Keyword arguments: - filter -- Search Kubernetes containers using a query in Falcon Query Language (FQL). String. - Supported filters: - agent_id image_vulnerability_count - agent_type insecure_mount_source - allow_privilege_escalation insecure_mount_type - cid insecure_propagation_mode - cloud_account_id interactive_mode - cloud_name ipv4 - cloud_region ipv6 - cluster_id labels - cluster_name last_seen - container_id namespace - container_name node_name - cve_id node_uid - detection_name package_name_version - first_seen pod_id - image_detection_count pod_name - image_digest port - image_has_been_assessed privileged - image_id root_write_access - image_registry run_as_root_group - image_repository run_as_root_user - image_tag running_status - ai_related - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadDistinctContainerImageCount + + Keyword arguments + ----------------- + filter : str + Search Kubernetes containers using a query in Falcon Query Language (FQL). String. + Supported filters: + agent_id image_vulnerability_count + agent_type insecure_mount_source + allow_privilege_escalation insecure_mount_type + cid insecure_propagation_mode + cloud_account_id interactive_mode + cloud_name ipv4 + cloud_region ipv6 + cluster_id labels + cluster_name last_seen + container_id namespace + container_name node_name + cve_id node_uid + detection_name package_name_version + first_seen pod_id + image_detection_count pod_name + image_digest port + image_has_been_assessed privileged + image_id root_write_access + image_registry run_as_root_group + image_repository run_as_root_user + image_tag running_status + ai_related + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1073,42 +1275,51 @@ def read_images_by_most_used(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Bucket container by image-digest. - Keyword arguments: - filter -- Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). String. - Supported filters: - agent_id image_vulnerability_count - agent_type insecure_mount_source - allow_privilege_escalation insecure_mount_type - cid insecure_propagation_mode - cloud_account_id interactive_mode - cloud_name ipv4 - cloud_region ipv6 - cluster_id labels - cluster_name last_seen - container_id namespace - container_name node_name - cve_id node_uid - detection_name package_name_version - first_seen pod_id - image_detection_count pod_name - image_digest port - image_has_been_assessed privileged - image_id root_write_access - image_registry run_as_root_group - image_repository run_as_root_user - image_tag running_status - ai_related - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadContainerImagesByMostUsed + + Keyword arguments + ----------------- + filter : str + Retrieve count of Kubernetes containers that match a query in Falcon Query Language (FQL). String. + Supported filters: + agent_id image_vulnerability_count + agent_type insecure_mount_source + allow_privilege_escalation insecure_mount_type + cid insecure_propagation_mode + cloud_account_id interactive_mode + cloud_name ipv4 + cloud_region ipv6 + cluster_id labels + cluster_name last_seen + container_id namespace + container_name node_name + cve_id node_uid + detection_name package_name_version + first_seen pod_id + image_detection_count pod_name + image_digest port + image_has_been_assessed privileged + image_id root_write_access + image_registry run_as_root_group + image_repository run_as_root_user + image_tag running_status + ai_related + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1126,20 +1337,29 @@ def read_iom_count_by_date_range(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Return the count of Kubernetes IOMs by the date. by default it's for 7 days. - Keyword arguments: - filter -- Filter images using a query in Falcon Query Language (FQL). String. - Supported filters: cid, created_timestamp, detect_timestamp, prevented, severity - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadKubernetesIomByDateRange + + Keyword arguments + ----------------- + filter : str + Filter images using a query in Falcon Query Language (FQL). String. + Supported filters: cid, created_timestamp, detect_timestamp, prevented, severity + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1157,20 +1377,29 @@ def read_iom_count(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Return the total count of Kubernetes IOMs over the past seven days. - Keyword arguments: - filter -- Filter images using a query in Falcon Query Language (FQL). String. - Supported filters: cid, created_timestamp, detect_timestamp, prevented, severity - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadKubernetesIomCount + + Keyword arguments + ----------------- + filter : str + Filter images using a query in Falcon Query Language (FQL). String. + Supported filters: cid, created_timestamp, detect_timestamp, prevented, severity + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1188,29 +1417,38 @@ def read_node_counts_by_cloud(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Bucket nodes by cloud providers. - Keyword arguments: - filter -- Search Kubernetes nodes using a query in Falcon Query Language (FQL). String. - Supported filters: - aid container_count - annotations_list container_runtime_version - cid first_seen - cloud_account_id image_digest - cloud_name ipv4 - cloud_region last_seen - cluster_id node_name - cluster_name pod_count - node_uid - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadNodesByCloudCount + + Keyword arguments + ----------------- + filter : str + Search Kubernetes nodes using a query in Falcon Query Language (FQL). String. + Supported filters: + aid container_count + annotations_list container_runtime_version + cid first_seen + cloud_account_id image_digest + cloud_name ipv4 + cloud_region last_seen + cluster_id node_name + cluster_name pod_count + node_uid + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1228,30 +1466,39 @@ def read_nodes_by_container_engine_version(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Bucket nodes by their container engine version. - Keyword arguments: - filter -- Search Kubernetes nodes using a query in Falcon Query Language (FQL). String. - Supported filters: - aid container_count - annotations_list container_runtime_version - cid first_seen - cloud_account_id image_digest - cloud_name ipv4 - cloud_region last_seen - cluster_id node_name - cluster_name pod_count - node_uid - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /kubernetes-protection/ReadNodesByContainerEngineVersionCount + /kubernetes-protection/ReadNodesByContainerEngineVersionCount + + Keyword arguments + ----------------- + filter : str + Search Kubernetes nodes using a query in Falcon Query Language (FQL). String. + Supported filters: + aid container_count + annotations_list container_runtime_version + cid first_seen + cloud_account_id image_digest + cloud_name ipv4 + cloud_region last_seen + cluster_id node_name + cluster_name pod_count + node_uid + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1269,29 +1516,38 @@ def read_node_counts_by_date_range(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve nodes by date range counts. - Keyword arguments: - filter -- Search Kubernetes nodes using a query in Falcon Query Language (FQL). String. - Supported filters: - aid container_count - annotations_list container_runtime_version - cid first_seen - cloud_account_id image_digest - cloud_name ipv4 - cloud_region last_seen - cluster_id node_name - cluster_name pod_count - node_uid - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadNodesByDateRangeCount + + Keyword arguments + ----------------- + filter : str + Search Kubernetes nodes using a query in Falcon Query Language (FQL). String. + Supported filters: + aid container_count + annotations_list container_runtime_version + cid first_seen + cloud_account_id image_digest + cloud_name ipv4 + cloud_region last_seen + cluster_id node_name + cluster_name pod_count + node_uid + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1309,29 +1565,38 @@ def read_node_count(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve node counts. - Keyword arguments: - filter -- Retrieve count of Kubernetes nodes that match a query in Falcon Query Language (FQL). String. - Supported filters: - aid container_count - annotations_list container_runtime_version - cid first_seen - cloud_account_id image_digest - cloud_name ipv4 - cloud_region last_seen - cluster_id node_name - cluster_name pod_count - node_uid - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadNodeCount + + Keyword arguments + ----------------- + filter : str + Retrieve count of Kubernetes nodes that match a query in Falcon Query Language (FQL). String. + Supported filters: + aid container_count + annotations_list container_runtime_version + cid first_seen + cloud_account_id image_digest + cloud_name ipv4 + cloud_region last_seen + cluster_id node_name + cluster_name pod_count + node_uid + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1344,17 +1609,21 @@ def read_node_count(self: object, def read_pod_counts_by_date_range(self: object) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve pods by date range counts. - Keyword arguments: - This method does not accept keyword arguments. - - This method does not accept arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadPodsByDateRangeCount + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + This method does not accept arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1366,34 +1635,43 @@ def read_pod_counts_by_date_range(self: object) -> Union[Dict[str, Union[int, di def read_pod_counts(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve pod counts. - Keyword arguments: - filter -- Retrieve count of Kubernetes pods that match a query in Falcon Query Language (FQL). String. - Supported filters: - agent_id last_seen - agent_type namespace - allow_privilege_escalation node_name - annotations_list node_uid - cid owner_id - cloud_account_id owner_type - cloud_name pod_id - cloud_region pod_name - cluster_id port - cluster_name privileged - container_count root_write_access - ipv4 run_as_root_group - ipv6 run_as_root_user - labels - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadPodCount + + Keyword arguments + ----------------- + filter : str + Retrieve count of Kubernetes pods that match a query in Falcon Query Language (FQL). String. + Supported filters: + agent_id last_seen + agent_type namespace + allow_privilege_escalation node_name + annotations_list node_uid + cid owner_id + cloud_account_id owner_type + cloud_name pod_id + cloud_region pod_name + cluster_id port + cluster_name privileged + container_count root_write_access + ipv4 run_as_root_group + ipv6 run_as_root_user + labels + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1407,34 +1685,44 @@ def read_pod_counts(self: object, *args, parameters: dict = None, **kwargs) -> U def read_clusters_combined(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve kubernetes clusters identified by the provided filter criteria. - Keyword arguments: - filter -- Search Kubernetes clusters using a query in Falcon Query Language (FQL). String. - Supported filters: - access cluster_status - agent_id container_count - agent_status iar_coverage - agent_type kac_agent_id - cid kubernetes_version - cloud_account_id last_seen - cloud_name management_status - cloud_region node_count - cloud_service pod_count - cluster_id tags - cluster_name pod_name - namespace - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - sort -- Field to sort results by. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadClusterCombined + + Keyword arguments + ----------------- + filter : str + Search Kubernetes clusters using a query in Falcon Query Language (FQL). String. + Supported filters: + access cluster_status + agent_id container_count + agent_status iar_coverage + agent_type kac_agent_id + cid kubernetes_version + cloud_account_id last_seen + cloud_name management_status + cloud_region node_count + cloud_service pod_count + cluster_id tags + cluster_name pod_name + namespace + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + sort : str + Field to sort results by. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1451,35 +1739,46 @@ def read_clusters_combined_v2(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve kubernetes clusters identified by the provided filter criteria. - Keyword arguments: - filter -- Search Kubernetes clusters using a query in Falcon Query Language (FQL). String. - Supported filters: - access cluster_status - agent_id container_count - agent_status iar_coverage - agent_type kac_agent_id - cid kubernetes_version - cloud_account_id last_seen - cloud_name management_status - cloud_region node_count - cloud_service pod_count - cluster_id tags - cluster_name pod_name - namespace - include_counts -- Flag to include node, pod and container counts in the response. Boolean. - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - sort -- Field to sort results by. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadClusterCombinedV2 + + Keyword arguments + ----------------- + filter : str + Search Kubernetes clusters using a query in Falcon Query Language (FQL). String. + Supported filters: + access cluster_status + agent_id container_count + agent_status iar_coverage + agent_type kac_agent_id + cid kubernetes_version + cloud_account_id last_seen + cloud_name management_status + cloud_region node_count + cloud_service pod_count + cluster_id tags + cluster_name pod_name + namespace + include_counts : bool + Flag to include node, pod and container counts in the response. + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + sort : str + Field to sort results by. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1493,33 +1792,43 @@ def read_clusters_combined_v2(self: object, def read_running_images(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve images on running containers. - Keyword arguments: - filter -- Retrieve list of images on running containers using a query in Falcon Query Language (FQL). String. - Supported filters: - cid image_registry - cloud_account_id image_repository - cloud_name image_tag - cloud_region last_seen - cluster_id namespace - cluster_name running_status - hosts - image_digest - image_has_been_assessed - image_id - image_name - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - sort -- Field to sort results by. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadRunningContainerImages + + Keyword arguments + ----------------- + filter : str + Retrieve list of images on running containers using a query in Falcon Query Language (FQL). String. + Supported filters: + cid image_registry + cloud_account_id image_repository + cloud_name image_tag + cloud_region last_seen + cluster_id namespace + cluster_name running_status + hosts + image_digest + image_has_been_assessed + image_id + image_name + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + sort : str + Field to sort results by. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1536,44 +1845,54 @@ def read_containers_combined(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve containers identified by the provided filter criteria. - Keyword arguments: - filter -- Search Kubernetes containers using a query in Falcon Query Language (FQL). String. - Supported filters: - agent_id image_vulnerability_count - agent_type insecure_mount_source - allow_privilege_escalation insecure_mount_type - cid insecure_propagation_mode - cloud_account_id interactive_mode - cloud_name ipv4 - cloud_region ipv6 - cluster_id labels - cluster_name last_seen - container_id namespace - container_name node_name - cve_id node_uid - detection_name package_name_version - first_seen pod_id - image_detection_count pod_name - image_digest port - image_has_been_assessed privileged - image_id root_write_access - image_registry run_as_root_group - image_repository run_as_root_user - image_tag running_status - ai_related - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - sort -- Field to sort results by. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadContainerCombined + + Keyword arguments + ----------------- + filter : str + Search Kubernetes containers using a query in Falcon Query Language (FQL). String. + Supported filters: + agent_id image_vulnerability_count + agent_type insecure_mount_source + allow_privilege_escalation insecure_mount_type + cid insecure_propagation_mode + cloud_account_id interactive_mode + cloud_name ipv4 + cloud_region ipv6 + cluster_id labels + cluster_name last_seen + container_id namespace + container_name node_name + cve_id node_uid + detection_name package_name_version + first_seen pod_id + image_detection_count pod_name + image_digest port + image_has_been_assessed privileged + image_id root_write_access + image_registry run_as_root_group + image_repository run_as_root_user + image_tag running_status + ai_related + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + sort : str + Field to sort results by. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1590,29 +1909,39 @@ def read_deployments_combined(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve kubernetes deployments identified by the provided filter criteria. - Keyword arguments: - filter -- Search Kubernetes deployments using a query in Falcon Query Language (FQL). String. - Supported filters: - annotations_list deployment_id - cid deployment_name - cloud_account_id first_seen - cloud_name last_seen - cloud_region namespace - cluster_id pod_count - cluster_name - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - sort -- Field to sort results by. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadDeploymentCombined + + Keyword arguments + ----------------- + filter : str + Search Kubernetes deployments using a query in Falcon Query Language (FQL). String. + Supported filters: + annotations_list deployment_id + cid deployment_name + cloud_account_id first_seen + cloud_name last_seen + cloud_region namespace + cluster_id pod_count + cluster_name + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + sort : str + Field to sort results by. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1633,36 +1962,46 @@ def search_kubernetes_ioms(self: object, Pagination is supported via Elasticsearch's search_after search param and point in time. Assets are sorted by unique ID in ascending direction. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/PostSearchKubernetesIOMEntities + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "pit": "string", "search_after": [ null ] } - filter -- Search Kubernetes IOMs using a query in Falcon Query Language (FQL). String. - Supported filter fields: - cid cis_id - cluster_id cluster_name - containers_impacted_ai_related containers_impacted_count - containers_impacted_ids detection_type - name namespace - prevented resource_id - resource_name resource_type - severity - sort -- The fields to sort the records on. FQL Format. String. - limit -- Maximum number of records to return. Integer. Default: 100, Max: 500 - parameters -- Full parameters payload dictionary. Not required if using other keywords. + filter : str + Search Kubernetes IOMs using a query in Falcon Query Language (FQL). String. + Supported filter fields: + cid cis_id + cluster_id cluster_name + containers_impacted_ai_related containers_impacted_count + containers_impacted_ids detection_type + name namespace + prevented resource_id + resource_name resource_type + severity + sort : str + The fields to sort the records on. FQL Format. + limit : int + Maximum number of records to return. Integer. Default: 100, Max: 500 + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/PostSearchKubernetesIOMEntities + Returns + ------- + dict + Dictionary object containing API response. """ if not body: if kwargs.get("pit", None): @@ -1684,31 +2023,41 @@ def search_kubernetes_ioms(self: object, def search_and_read_ioms(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search Kubernetes IOM by the provided search criteria. - Keyword arguments: - filter -- Search Kubernetes IOMs using a query in Falcon Query Language (FQL). String. - Supported filters: - cid name - cis_id namespace - cluster_id resource_id - cluster_name resource_name - containers_impacted_count resource_type - containers_impacted_ids severity - detection_type prevented - containers_impacted_ai_related - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - sort -- The fields to sort the records on. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /kubernetes-protection/SearchAndReadKubernetesIomEntities + /kubernetes-protection/SearchAndReadKubernetesIomEntities + + Keyword arguments + ----------------- + filter : str + Search Kubernetes IOMs using a query in Falcon Query Language (FQL). String. + Supported filters: + cid name + cis_id namespace + cluster_id resource_id + cluster_name resource_name + containers_impacted_count resource_type + containers_impacted_ids severity + detection_type prevented + containers_impacted_ai_related + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + sort : str + The fields to sort the records on. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1722,31 +2071,41 @@ def search_and_read_ioms(self: object, parameters: dict = None, **kwargs) -> Uni def read_nodes_combined(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve kubernetes nodes identified by the provided filter criteria. - Keyword arguments: - filter -- Search Kubernetes nodes using a query in Falcon Query Language (FQL). String. - Supported filters: - aid container_count - annotations_list container_runtime_version - cid first_seen - cloud_account_id image_digest - cloud_name ipv4 - cloud_region last_seen - cluster_id node_name - cluster_name pod_count - node_uid - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - sort -- Field to sort results by. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadNodeCombined + + Keyword arguments + ----------------- + filter : str + Search Kubernetes nodes using a query in Falcon Query Language (FQL). String. + Supported filters: + aid container_count + annotations_list container_runtime_version + cid first_seen + cloud_account_id image_digest + cloud_name ipv4 + cloud_region last_seen + cluster_id node_name + cluster_name pod_count + node_uid + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + sort : str + Field to sort results by. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1760,36 +2119,46 @@ def read_nodes_combined(self: object, parameters: dict = None, **kwargs) -> Unio def read_pods_combined(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve kubernetes pods identified by the provided filter criteria. - Keyword arguments: - filter -- Search Kubernetes pods using a query in Falcon Query Language (FQL). String. - Supported filters: - agent_id last_seen - agent_type namespace - allow_privilege_escalation node_name - annotations_list node_uid - cid owner_id - cloud_account_id owner_type - cloud_name pod_id - cloud_region pod_name - cluster_id port - cluster_name privileged - container_count root_write_access - ipv4 run_as_root_group - ipv6 run_as_root_user - labels - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - sort -- Field to sort results by. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadPodCombined + + Keyword arguments + ----------------- + filter : str + Search Kubernetes pods using a query in Falcon Query Language (FQL). String. + Supported filters: + agent_id last_seen + agent_type namespace + allow_privilege_escalation node_name + annotations_list node_uid + cid owner_id + cloud_account_id owner_type + cloud_name pod_id + cloud_region pod_name + cluster_id port + cluster_name privileged + container_count root_write_access + ipv4 run_as_root_group + ipv6 run_as_root_user + labels + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + sort : str + Field to sort results by. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1807,19 +2176,28 @@ def read_iom_entities(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve Kubernetes IOM entities identified by the provided IDs. - Keyword arguments: - ids -- Kubernetes IOMs ID or list of IDs. String or list of strings. [Max: 100] - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ReadKubernetesIomEntities + + Keyword arguments + ----------------- + ids : str or list[str] + Kubernetes IOMs ID or list of IDs. String or list of strings. [Max: 100] + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1835,30 +2213,40 @@ def search_ioms(self: object, parameters: dict = None, **kwargs) -> Union[Dict[s This endpoint returns a list of Kubernetes IOM UUIDs matching the query. - Keyword arguments: - filter -- Search Kubernetes IOMs using a query in Falcon Query Language (FQL). String. - Supported filters: - cid name - cis_id namespace - cluster_id resource_id - cluster_name resource_name - containers_impacted_count resource_type - containers_impacted_ids severity - detection_type prevented - containers_impacted_ai_related - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - sort -- The fields to sort the records on. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/SearchKubernetesIoms + + Keyword arguments + ----------------- + filter : str + Search Kubernetes IOMs using a query in Falcon Query Language (FQL). String. + Supported filters: + cid name + cis_id namespace + cluster_id resource_id + cluster_name resource_name + containers_impacted_count resource_type + containers_impacted_ids severity + detection_type prevented + containers_impacted_ai_related + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + sort : str + The fields to sort the records on. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1872,25 +2260,36 @@ def search_ioms(self: object, parameters: dict = None, **kwargs) -> Union[Dict[s def get_aws_accounts(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Provide a list of AWS accounts. - Keyword arguments: - ids -- AWS Account IDs. String or list of strings. - is_horizon_acct -- Filter by whether an account originates from Horizon or not. String. - limit -- The maximum number of records to return in this response. [Integer, 0-1000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - status -- Filter by account status. String. - Supported values: operational, provisioned. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/GetAWSAccountsMixin0 + + Keyword arguments + ----------------- + ids : str or list[str] + AWS Account IDs. + is_horizon_acct : str + Filter by whether an account originates from Horizon or not. + limit : int + The maximum number of records to return in this response. [Integer, 0-1000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + status : str + Filter by account status. String. + Supported values: operational, provisioned. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1904,8 +2303,16 @@ def get_aws_accounts(self: object, parameters: dict = None, **kwargs) -> Union[D def create_aws_account(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create a new AWS customer account in our system and generates the installation script. - Keyword arguments: - body -- full body payload, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/CreateAWSAccount + + Keyword arguments + ----------------- + body : dict + full body payload, not required if using other keywords. { "resources": [ { @@ -1914,17 +2321,17 @@ def create_aws_account(self: object, body: dict = None, **kwargs) -> Union[Dict[ } ] } - account_id -- Account ID. String. - region -- Region. String. + account_id : str + Account ID. + region : str + Region. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/CreateAWSAccount + Returns + ------- + dict + Dictionary object containing API response. """ if not body: item = {} @@ -1949,19 +2356,28 @@ def delete_aws_accounts(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete AWS accounts. - Keyword arguments: - ids -- ID(s) of AWS accounts to delete. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/DeleteAWSAccountsMixin0 + + Keyword arguments + ----------------- + ids : str or list[str] + ID(s) of AWS accounts to delete. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1975,19 +2391,27 @@ def delete_aws_accounts(self: object, def update_aws_account(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update the AWS account per the query parameters provided. - Keyword arguments: - ids -- ID(s) of AWS accounts to update. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - region -- Default region for Account Automation. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/UpdateAWSAccount + + Keyword arguments + ----------------- + ids : str or list[str] + ID(s) of AWS accounts to update. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + region : str + Default region for Account Automation. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2001,25 +2425,37 @@ def update_aws_account(self: object, parameters: dict = None, **kwargs) -> Union def list_azure_accounts(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Provide a list of registered Azure subscriptions. - Keyword arguments: - ids -- Azure tenant IDs. String or list of strings. - is_horizon_acct -- Filter by whether an account originates from Horizon. Boolean. - subscription_id -- Azure subscription IDs. String or list of strings. - limit -- The maximum number of records to return in this response. [Integer, 1-500] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - status -- Filter by account status. (`operational` or `provisional`) String. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/ListAzureAccounts + + Keyword arguments + ----------------- + ids : str or list[str] + Azure tenant IDs. + is_horizon_acct : str + Filter by whether an account originates from Horizon. + subscription_id : str or list[str] + Azure subscription IDs. + limit : int + The maximum number of records to return in this response. [Integer, 1-500] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + status : str + Filter by account status. (`operational` or `provisional`) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2033,8 +2469,16 @@ def list_azure_accounts(self: object, parameters: dict = None, **kwargs) -> Unio def create_azure_subscription(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create a new Azure subscription. - Keyword arguments: - body -- full body payload, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/CreateAzureSubscription + + Keyword arguments + ----------------- + body : dict + full body payload, not required if using other keywords. { "resources": [ { @@ -2043,17 +2487,17 @@ def create_azure_subscription(self: object, body: dict = None, **kwargs) -> Unio } ] } - subscription_id -- Azure subscription ID. String. - tenant_id -- Tenant ID. String. + subscription_id : str + Azure subscription ID. + tenant_id : str + Tenant ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/CreateAzureSubscription + Returns + ------- + dict + Dictionary object containing API response. """ if not body: item = {} @@ -2078,19 +2522,28 @@ def delete_azure_subscription(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete an Azure subscription. - Keyword arguments: - ids -- Azure subscription IDs. String or list of strings. - parameters - full parameters payload, not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be - 'ids'. All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/DeleteAzureSubscription + + Keyword arguments + ----------------- + ids : str or list[str] + Azure subscription IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'ids'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2104,19 +2557,28 @@ def delete_azure_subscription(self: object, def get_locations(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Provide the cloud locations acknowledged by the Kubernetes Protection service. - Keyword arguments: - clouds -- Cloud provider. String or list of strings. - parameters - full parameters payload, not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'clouds'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/GetLocations + + Keyword arguments + ----------------- + clouds : str or list[str] + Cloud provider. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'clouds'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2130,23 +2592,35 @@ def get_locations(self: object, *args, parameters: dict = None, **kwargs) -> Uni def get_cloud_clusters(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Return a combined list of provisioned cloud accounts and known kubernetes clusters. - Keyword arguments: - cluser_service -- Cluster Service. String or list of strings. - cluster_status -- Cluster Status. String or list of strings. - ids -- Cloud Account IDs. String or list of strings. - locations -- Cloud location. String or list of strings. - limit -- Limit returned results. Integer. - offset -- Offset to use for pagination. Integer. - parameters - full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/GetCombinedCloudClusters + + Keyword arguments + ----------------- + cluser_service : str or list[str] + Cluster Service. + cluster_status : str or list[str] + Cluster Status. + ids : str or list[str] + Cloud Account IDs. + locations : str or list[str] + Cloud location. + limit : int + Limit returned results. + offset : int + Offset to use for pagination. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2160,20 +2634,29 @@ def get_cloud_clusters(self: object, parameters: dict = None, **kwargs) -> Union def get_azure_tenant_config(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve the Azure tenant config. - Keyword arguments: - ids -- Cloud Account IDs. String or list of strings. - limit -- Limit returned results. Integer. - offset -- Offset to use for pagination. Integer. - parameters - full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/GetAzureTenantConfig + + Keyword arguments + ----------------- + ids : str or list[str] + Cloud Account IDs. + limit : int + Limit returned results. + offset : int + Offset to use for pagination. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2187,21 +2670,31 @@ def get_azure_tenant_config(self: object, parameters: dict = None, **kwargs) -> def get_azure_tenant_ids(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Provide all the azure subscriptions and tenants. - Keyword arguments: - ids -- Cloud Account IDs. String or list of strings. - status -- Cluster Status. String. (Not Installed, Running, Stopped) - limit -- Limit returned results. Integer. - offset -- Offset to use for pagination. Integer. - parameters - full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/GetAzureTenantIDs + + Keyword arguments + ----------------- + ids : str or list[str] + Cloud Account IDs. + status : str + Cluster Status. String. (Not Installed, Running, Stopped) + limit : int + Limit returned results. + offset : int + Offset to use for pagination. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2218,19 +2711,27 @@ def get_azure_install_script(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Provide the script to run for a given tenant id and subscription IDs. - Keyword arguments: - id -- Azure Tenant ID. String. - subscription_id -- Azure Subscription IDs. String or list of strings. - parameters - full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/GetAzureInstallScript + + Keyword arguments + ----------------- + id : str + Azure Tenant ID. + subscription_id : str or list[str] + Azure Subscription IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2246,12 +2747,20 @@ def get_static_scripts(self: object, parameters: dict = None) -> Union[Dict[str, This method does not accept arguments or keywords. - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/GetStaticScripts + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2268,21 +2777,30 @@ def get_helm_values_yaml(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Provide a sample Helm values.yaml file to install alongside the agent Helm chart. - Keyword arguments: - cluster_name -- Cloud provider. String. - is_self_managed_cluster -- Set to true if the cluster is not managed by a cloud provider, false if it is. - Boolean. - parameters - full parameters payload, not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be - 'cluster_name'. All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/GetHelmValuesYaml + + Keyword arguments + ----------------- + cluster_name : str + Cloud provider. + is_self_managed_cluster : bool + Set to true if the cluster is not managed by a cloud provider, false if it is. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'cluster_name'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2296,17 +2814,22 @@ def get_helm_values_yaml(self: object, def regenerate(self: object, body: dict = None) -> Union[Dict[str, Union[int, dict]], Result]: """Regenerate API key for docker registry integrations. - Keyword arguments: - body -- Body payload is accepted but is not used. - - This method has no default argument or keywords. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/RegenerateAPIKey + + Keyword arguments + ----------------- + body : dict + Body payload is accepted but is not used. + This method has no default argument or keywords. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2319,27 +2842,39 @@ def regenerate(self: object, body: dict = None) -> Union[Dict[str, Union[int, di def get_clusters(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Provide the clusters acknowledged by the Kubernetes Protection service. - Keyword arguments: - account_ids -- Cluster Account IDs. For EKS, this would be the AWS Account ID. - String or list of strings. - cluster_names -- Cluster name. For EKS it will be cluster ARN. String or list of strings. - cluster_service -- Cluster Service. Available values: `eks` - limit -- The maximum number of records to return in this response. [Integer, 1-500] - Use with the offset parameter to manage pagination of results. - locations -- Cloud location. String or list of strings. - status -- Cluster status. 'Not Installed', 'Running', or 'Stopped'. String. - offset -- The offset to start retrieving records from. String. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/GetClusters + + Keyword arguments + ----------------- + account_ids : str or list[str] + Cluster Account IDs. For EKS, this would be the AWS Account ID. + cluster_names : str or list[str] + Cluster name. For EKS it will be cluster ARN. + cluster_service : str + Cluster Service. Available values: `eks` + limit : int + The maximum number of records to return in this response. [Integer, 1-500] + Use with the offset parameter to manage pagination of results. + locations : str or list[str] + Cloud location. + status : str or list[str] + Cluster status. 'Not Installed', 'Running', or 'Stopped' + offset : int + The offset to start retrieving records from. String. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2358,21 +2893,31 @@ def trigger_scan(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Trigger a dry run or a full scan of a customer's kubernetes footprint. - Keyword arguments: - body -- Body payload is accepted but is not used. - scan_type -- Type of scan to perform. String. Default value: `dry-run`. - Available Values: `cluster-refresh`, `dry-run`, or `full`. - parameters - full parameters payload, not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be - 'scan_type'. All others are ignored. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/TriggerScan + + Keyword arguments + ----------------- + body : dict + Body payload is accepted but is not used. + scan_type : str + Type of scan to perform. String. Default value: `dry-run`. + Available Values: `cluster-refresh`, `dry-run`, or `full`. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'scan_type'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2391,19 +2936,27 @@ def update_azure_service_principal(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Add the client ID for a given tenant ID to the subscription. - Keyword arguments: - id -- Azure tentant ID. String. Required. - client_id -- Azure client ID. String. Required. - parameters - full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/PatchAzureServicePrincipal + + Keyword arguments + ----------------- + id : str (required) + Azure tentant ID. + client_id : str (required) + Azure client ID. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2413,9 +2966,107 @@ def update_azure_service_principal(self: object, params=handle_single_argument(args, parameters, "ids") ) + @force_default(defaults=["body"], default_types=["list"]) + def post_aggregates_pods(self: object, + body: list = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Get aggregate query result for pods. + + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/kubernetes-protection/PostAggregatesPods + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted list. Not required if using other keywords. + [ + { + "date_ranges": [ + { + "from": "string", + "to": "string" + } + ], + "exclude": "string", + "field": "string", + "filter": "string", + "from": 0, + "include": "string", + "interval": "string", + "max_doc_count": 0, + "min_doc_count": 0, + "missing": "string", + "name": "string", + "q": "string", + "ranges": [ + { + "From": 0, + "To": 0 + } + ], + "size": 0, + "sort": "string", + "sub_aggregates": [ + null + ], + "time_zone": "string", + "type": "string" + } + ] + date_ranges : list[dict] + List of date range objects. + field : str + The field to aggregate on. + filter : str + FQL filter expression. + interval : str + Time interval for aggregation. + min_doc_count : int + Minimum document count threshold. + missing : str + Missing value handling. + name : str + Name of the aggregation. + q : str + Full text search across all metadata fields. + ranges : list[dict] + List of range objects. + size : int + Maximum number of results. + sort : str + Sort expression. + sub_aggregates : list[str] + List of sub-aggregate expressions. + time_zone : str + Time zone for date operations. + type : str + Type of aggregation (terms, date_histogram, etc.) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = [aggregate_payload(submitted_keywords=kwargs)] + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="PostAggregatesPods", + body=body + ) + # These method names align to the operation IDs in the API but # do not conform to snake_case / PEP8 and are defined here for # backwards compatibility / ease of use purposes + PostAggregatesPods = post_aggregates_pods ReadClustersByDateRangeCount = read_clusters_by_date_range ReadClustersByKubernetesVersionCount = read_clusters_by_version ReadClustersByStatusCount = read_clusters_by_status diff --git a/src/falconpy/kubernetes_protection.pyi b/src/falconpy/kubernetes_protection.pyi index 591a7bd3e..7c0564a83 100644 --- a/src/falconpy/kubernetes_protection.pyi +++ b/src/falconpy/kubernetes_protection.pyi @@ -505,6 +505,13 @@ class KubernetesProtection(ServiceClass): parameters: Optional[dict] = None, ) -> Union[Dict[str, Union[int, dict]], Result]: ... + def post_aggregates_pods( + self, + *, + body: Optional[list] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + PostAggregatesPods = post_aggregates_pods ReadClustersByDateRangeCount = read_clusters_by_date_range ReadClustersByKubernetesVersionCount = read_clusters_by_version ReadClustersByStatusCount = read_clusters_by_status diff --git a/src/falconpy/malquery.py b/src/falconpy/malquery.py index a33b19e5c..847ead0ec 100644 --- a/src/falconpy/malquery.py +++ b/src/falconpy/malquery.py @@ -63,12 +63,20 @@ def get_quotas(self: object) -> Union[Dict[str, Union[int, dict]], Result]: This method does not accept arguments or keywords. - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/malquery/GetMalQueryQuotasV1 + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -83,8 +91,16 @@ def fuzzy_search(self: object, body: dict = None, **kwargs) -> Union[Dict[str, U Search for a combination of hex patterns and strings in order to identify samples based upon file content at byte level granularity. - Keyword arguments: - body -- full body payload, not required when ids keyword is provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/malquery/PostMalQueryFuzzySearchV1 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when ids keyword is provided. { "options": { "filter_meta": [ @@ -99,22 +115,22 @@ def fuzzy_search(self: object, body: dict = None, **kwargs) -> Union[Dict[str, U } ] } - filter_meta -- List of strings. - limit -- Integer representing maximum number of matches to return. - patterns -- List of dictionaries containing patterns to match. - { - "type": "string", - "value": "string - } + filter_meta : list[str] + limit : str + Integer representing maximum number of matches to return. + patterns : list + List of dictionaries containing patterns to match. + { + "type": "string", + "value": "string + } This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/malquery/PostMalQueryFuzzySearchV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = malquery_fuzzy_payload(passed_keywords=kwargs) @@ -137,20 +153,29 @@ def get_download(self: object, Specify the file using its SHA256. Only one file is supported at this time. - Keyword arguments: - ids -- List of SHA256s to retrieve. String or list of strings. - parameters -- Full parameters payload, not required if ids is provided as a keyword. - stream -- Enable streaming download of the returned file. Boolean. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: binary object on SUCCESS, dict object containing API response on FAILURE. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/malquery/GetMalQueryDownloadV1 + + Keyword arguments + ----------------- + ids : str or list[str] + List of SHA256s to retrieve. + parameters : dict + Full parameters payload, not required if ids is provided as a keyword. + stream : bool + Enable streaming download of the returned file. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + binary object on SUCCESS, dict object containing API response on FAILURE. """ return process_service_request( calling_object=self, @@ -165,19 +190,28 @@ def get_download(self: object, def get_metadata(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve indexed files metadata by their hash. - Keyword arguments: - ids -- List of SHA256s to retrieve metadata for. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/malquery/GetMalQueryMetadataV1 + + Keyword arguments + ----------------- + ids : str or list[str] + List of SHA256s to retrieve metadata for. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -193,19 +227,28 @@ def get_request(self: object, *args, parameters: dict = None, **kwargs) -> Union Supports a single request id at this time. - Keyword arguments: - ids -- List of MalQuery identifiers to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/malquery/GetMalQueryRequestV1 + + Keyword arguments + ----------------- + ids : str or list[str] + List of MalQuery identifiers to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -225,20 +268,29 @@ def get_samples(self: object, Call this once the samples-multidownload request has finished processing - Keyword arguments: - ids -- Multi-download job ID. String. - parameters -- full parameters payload, not required if ids is provided as a keyword. - stream -- Enable streaming download of the returned file. Boolean. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: binary object on SUCCESS, dict object containing API response on FAILURE. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/malquery/GetMalQueryEntitiesSamplesFetchV1 + + Keyword arguments + ----------------- + ids : str + Multi-download job ID. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + stream : bool + Enable streaming download of the returned file. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + binary object on SUCCESS, dict object containing API response on FAILURE. """ return process_service_request( calling_object=self, @@ -256,24 +308,33 @@ def samples_multidownload(self: object, *args, body: dict = None, **kwargs) -> U Use the result id with the /request endpoint to check if the download is ready after which you can call get_samples to get the zip. - Keyword arguments: - body -- full body payload, not required when ids keyword is provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/malquery/PostMalQueryEntitiesSamplesMultidownloadV1 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when ids keyword is provided. { "samples": [ "string" ] } - samples -- SHA256(s) of the samples to retrieve. String or list of strings. - - Arguments: When not specified, the first argument to this method is assumed to be - 'samples'. All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/malquery/PostMalQueryEntitiesSamplesMultidownloadV1 + samples : str or list[str] + SHA256(s) of the samples to retrieve. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'samples'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_arguments=args, @@ -299,8 +360,16 @@ def exact_search(self: object, body: dict = None, **kwargs) -> Union[Dict[str, U Returns a request id which can be used with the /request endpoint. - Keyword arguments: - body -- full body payload, not required when ids keyword is provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/malquery/PostMalQueryExactSearchV1 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when ids keyword is provided. { "options": { "filter_filetypes": [ @@ -322,27 +391,33 @@ def exact_search(self: object, body: dict = None, **kwargs) -> Union[Dict[str, U } ] } - filter_filetypes -- File types to filter on. List of strings. - filter_meta -- File metadata to filter on. List of strings. - limit -- Integer representing maximum number of matches to return. - max_date -- Maximum date to match. UTC formatted string. - min_date -- Minimum date to match. UTC formatted string. - max_size -- Maximum size in bytes to match. String. - min_size -- Minumum size in bytes to match. String. - patterns -- List of dictionaries containing patterns to match. - { - "type": "string", - "value": "string - } + filter_filetypes : list[str] + File types to filter on. + filter_meta : list[str] + File metadata to filter on. + limit : str + Integer representing maximum number of matches to return. + max_date : str + Maximum date to match. UTC formatted. + min_date : str + Minimum date to match. UTC formatted. + max_size : str + Maximum size in bytes to match. + min_size : str + Minumum size in bytes to match. + patterns : list + List of dictionaries containing patterns to match. + { + "type": "string", + "value": "string + } This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/malquery/PostMalQueryExactSearchV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = malquery_exact_search_payload(passed_keywords=kwargs) @@ -360,8 +435,16 @@ def hunt(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int Returns a request id which can be used with the /request endpoint. - Keyword arguments: - body -- full body payload, not required when ids keyword is provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/malquery/PostMalQueryHuntV1 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when ids keyword is provided. { "options": { "filter_filetypes": [ @@ -378,23 +461,29 @@ def hunt(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int }, "yara_rule": "string" } - filter_filetypes -- File types to filter on. List of strings. - filter_meta -- File metadata to filter on. List of strings. - limit -- Integer representing maximum number of matches to return. - max_date -- Maximum date to match. UTC formatted string. - min_date -- Minimum date to match. UTC formatted string. - max_size -- Maximum size in bytes to match. String. - min_size -- Minumum size in bytes to match. String. - yara_rule -- Yara rule to use for matching. String. + filter_filetypes : list[str] + File types to filter on. + filter_meta : list[str] + File metadata to filter on. + limit : str + Integer representing maximum number of matches to return. + max_date : str + Maximum date to match. UTC formatted. + min_date : str + Minimum date to match. UTC formatted. + max_size : str + Maximum size in bytes to match. + min_size : str + Minumum size in bytes to match. + yara_rule : str + Yara rule to use for matching. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/malquery/PostMalQueryHuntV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = malquery_hunt_payload(passed_keywords=kwargs) diff --git a/src/falconpy/message_center.py b/src/falconpy/message_center.py index bd545ef45..4600ebc60 100644 --- a/src/falconpy/message_center.py +++ b/src/falconpy/message_center.py @@ -66,8 +66,16 @@ class MessageCenter(ServiceClass): def aggregate_cases(self: object, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve aggregate case values based on the matched filter. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/message-center/AggregateCases + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [{ "date_ranges": [ { @@ -96,31 +104,34 @@ def aggregate_cases(self: object, body: list = None, **kwargs) -> Union[Dict[str "time_zone": "string", "type": "string" }] - date_ranges -- List of dictionaries. - field -- String. - filter -- FQL syntax. String. - interval -- String. - min_doc_count -- Minimum number of documents required to match. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + field : str + filter : str + FQL syntax. + interval : str + min_doc_count : int + Minimum number of documents required to match. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str + String. + This method does not support body payload validation. This method only supports keywords for providing arguments. - This method does not support body payload validation. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/message-center/AggregateCases + Returns + ------- + dict + Dictionary object containing API response. """ if not body: # Similar to 664: This aggregate payload must be a list @@ -137,24 +148,33 @@ def aggregate_cases(self: object, body: list = None, **kwargs) -> Union[Dict[str def get_case_activity(self: object, *args, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve activities for given case IDs. - Keyword arguments: - body -- full body payload, not required if ids is provided as a keyword. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/message-center/GetCaseActivityByIds + + Keyword arguments + ----------------- + body : dict + full body payload, not required if ids is provided as a keyword. { "ids": [ "string" ] } - ids -- One or more case IDs. String or list of strings. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/message-center/GetCaseActivityByIds + ids : str or list[str] + One or more case IDs. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_arguments=args, @@ -173,32 +193,42 @@ def get_case_activity(self: object, *args, body: dict = None, **kwargs) -> Union def add_case_activity(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Add an activity to case. Only activities of type comment are allowed via API. - Keyword arguments: - body -- full body payload, not required when using other keywords. - NOTICE: This particular body payload contains a field named `body`, which - impacts body payload abstraction functionality. This field can be - set using the keyword `content` if you do not wish to specify a - full body payload using the `body` keyword. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/message-center/CaseAddActivity + + Keyword arguments + ----------------- + body : str + full body payload, not required when using other keywords. + NOTICE: This particular body payload contains a field named `body`, which + impacts body payload abstraction functionality. This field can be + set using the keyword `content` if you do not wish to specify a + full body payload using the `body` keyword. { "body": "string", "case_id": "string", "type": "string", "user_uuid": "string" } - content -- Comment content. Used for the `body` field within the body payload. String. - case_id -- Case ID. String. - type -- Activity type. String. Only activities of type comment can be added via the API. - The keyword `activity_type` can also be used to specify this value. - user_uuid -- UUID of the user related to the activity. String. + content : str + Comment content. Used for the `body` field within the body payload. + case_id : str + Case ID. + type : str + Activity type. String. Only activities of type comment can be added via the API. + The keyword `activity_type` can also be used to specify this value. + user_uuid : str + UUID of the user related to the activity. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/message-center/CaseAddActivity + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = activity_payload(passed_keywords=kwargs) @@ -215,19 +245,28 @@ def add_case_activity(self: object, body: dict = None, **kwargs) -> Union[Dict[s def download_case_attachment(self: object, *args, parameters: dict = None, **kwargs) -> object: """Retrieve an attachment for the case, given the Attachment ID. - Keyword arguments: - ids -- Attachment ID to retrieve. String. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/message-center/CaseDownloadAttachment + + Keyword arguments + ----------------- + ids : str + Attachment ID to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -246,30 +285,39 @@ def add_case_attachment(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Upload an attachment for the case. - Keyword arguments: - case_id -- Case ID to attach to. String. - file_data -- Content of the attachment in binary format. Max file size is 15 MB. - 'sample' and 'upfile' are also accepted as this parameter. - Filename must start with [a-zA-Z0-9_-] and has a maximum of 255 characters. - Allowed characters in file name are [a-zA-Z0-9-_.]. - - Accepted attachment formats: - Images: .png, .bmp, .jpg, .jpeg, .gif - Adobe PDF: .pdf - Office documents: .doc, .docx, .xls, .xlsx, .pptx - Text: .txt, .csv - file_name -- File name for the attached file. String. - parameters -- full parameters payload, not required if using other keywords. - user_uuid -- User UUID performing the attachment. String. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/message-center/CaseAddAttachment + + Keyword arguments + ----------------- + case_id : str + Case ID to attach to. + file_data : str + Content of the attachment in binary format. Max file size is 15 MB. + 'sample' and 'upfile' are also accepted as this parameter. + Filename must start with [a-zA-Z0-9_-] and has a maximum of 255 characters. + Allowed characters in file name are [a-zA-Z0-9-_.]. + Accepted attachment formats: + Images: .png, .bmp, .jpg, .jpeg, .gif + Adobe PDF: .pdf + Office documents: .doc, .docx, .xls, .xlsx, .pptx + Text: .txt, .csv + file_name : str + File name for the attached file. + parameters : dict + Full parameters payload. Not required if using other keywords. + user_uuid : str + User UUID performing the attachment. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ method_args = ["case_id", "file_data", "user_uuid"] kwargs = params_to_keywords(method_args, @@ -310,12 +358,20 @@ def add_case_attachment(self: object, def create_case_v2(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create a new case. - Keyword arguments: - body -- full body payload, not required when using other keywords. - NOTICE: This particular body payload contains a field named `body`, which - impacts body payload abstraction functionality. This field can be - set using the keyword `content` if you do not wish to specify a - full body payload using the `body` keyword. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/message-center/CreateCaseV2 + + Keyword arguments + ----------------- + body : str + full body payload, not required when using other keywords. + NOTICE: This particular body payload contains a field named `body`, which + impacts body payload abstraction functionality. This field can be + set using the keyword `content` if you do not wish to specify a + full body payload using the `body` keyword. { "body": "string", "detections": [ @@ -335,21 +391,25 @@ def create_case_v2(self: object, body: dict = None, **kwargs) -> Union[Dict[str, "type": "string", "user_uuid": "string" } - content -- Case content. Used for the `body` field within the body payload. String. - detections -- List of detections to attach to the case. List of dictionaries. - incidents -- List of incidents to attach to the case. List of dictionaries. - title -- Case title. String. - type -- Case type. String. The keyword `case_type` can also be used to specify this value. - user_uuid -- UUID of the user related to the case. String. + content : str + Case content. Used for the `body` field within the body payload. + detections : list[dict] + List of detections to attach to the case. + incidents : list[dict] + List of incidents to attach to the case. + title : str + Case title. + type : str + Case type. String. The keyword `case_type` can also be used to specify this value. + user_uuid : str + UUID of the user related to the case. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/message-center/CreateCaseV2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = case_payload(passed_keywords=kwargs) @@ -366,24 +426,33 @@ def create_case_v2(self: object, body: dict = None, **kwargs) -> Union[Dict[str, def get_cases(self: object, *args, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve message center cases. - Keyword arguments: - body -- full body payload, not required if ids is provided as a keyword. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/message-center/GetCaseEntitiesByIDs + + Keyword arguments + ----------------- + body : dict + full body payload, not required if ids is provided as a keyword. { "ids": [ "string" ] } - ids -- One or more case IDs. String or list of strings. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/message-center/GetCaseEntitiesByIDs + ids : str or list[str] + One or more case IDs. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_arguments=args, @@ -403,26 +472,36 @@ def get_cases(self: object, *args, body: dict = None, **kwargs) -> Union[Dict[st def query_activities(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve activities IDs for a case. - Keyword arguments: - case_id -- Case ID to search for activities. String. - filter -- The filter expression that should be used to limit the results. FQL syntax. - String. - limit -- The maximum number of records to return. [integer, 1-500] - offset -- The integer offset to start retrieving records from. Integer. - parameters - full parameters payload, not required if using other keywords. Dictionary. - sort -- The property to sort on. FQL syntax. String. - Available properties - activity.created_time - activity.type - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/message-center/QueryActivityByCaseID + + Keyword arguments + ----------------- + case_id : str + Case ID to search for activities. + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int (1-500) + The maximum number of records to return. + offset : int + The integer offset to start retrieving records from. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort on. FQL syntax. String. + Available properties + activity.created_time + activity.type + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -436,28 +515,37 @@ def query_activities(self: object, parameters: dict = None, **kwargs) -> Union[D def query_cases(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve case IDs that match the provided filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - String. - limit -- The maximum number of records to return. [integer, 1-500] - offset -- The integer offset to start retrieving records from. Integer. - parameters - full parameters payload, not required if using other keywords. Dictionary. - sort -- The property to sort on. FQL syntax. String. - Available properties - case.created_time - case.id - case.last_modified_time - case.status - case.type - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/message-center/QueryCasesIdsByFilter + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int (1-500) + The maximum number of records to return. + offset : int + The integer offset to start retrieving records from. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort on. FQL syntax. String. + Available properties + case.created_time + case.id + case.last_modified_time + case.status + case.type + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/ml_exclusions.py b/src/falconpy/ml_exclusions.py index a6b59441b..992a325cc 100644 --- a/src/falconpy/ml_exclusions.py +++ b/src/falconpy/ml_exclusions.py @@ -35,6 +35,7 @@ For more information, please refer to """ +# pylint: disable=C0302 from typing import Dict, Union from ._util import force_default, process_service_request, handle_single_argument from ._payload import ( @@ -42,8 +43,9 @@ aggregate_payload, ml_exclusions_actions_payload, ml_exclusions_report_payload, - ml_exclusions_update_payload -) + ml_exclusions_update_payload, + exclusions_sdmf_query_v1_payload, + ) from ._result import Result from ._service_class import ServiceClass from ._endpoint._ml_exclusions import _ml_exclusions_endpoints as Endpoints @@ -66,8 +68,16 @@ class MLExclusions(ServiceClass): def aggregate_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get exclusion aggregates as specified via json in request body. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/exclusions.aggregates.v2 + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. { "date_ranges": [ { @@ -116,36 +126,55 @@ def aggregate_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dic "time_zone": "string", "type": "string" } - date_ranges -- Date range timeframe. List of dictionaries. - exclude -- Fields to exclude from results. String. - extended_bounds -- Extended bounds for histogram aggregations. Dictionary. - field -- Field to aggregate on. String. - filter -- Filter criteria in the form of an FQL query. String. - filters_spec -- Additional filter specifications. Dictionary. - from -- Starting index of overall result set. Integer. - include -- Fields to include in results. String. - interval -- Time interval for date histogram aggregations. String. - max_doc_count -- Maximum number of documents per bucket. Integer. - min_doc_count -- Minimum number of documents per bucket. Integer. - missing -- Value to use for documents missing the field. String. - name -- Name of the aggregation. String. - percents -- Percentile values to calculate. List of floats. - q -- Full text search query. String. - ranges -- Range boundaries for range aggregations. List of dictionaries. - size -- Maximum number of records to return. Integer. - sort -- The field to sort on. String. - sub_aggregates -- Nested aggregation definitions. List of dictionaries. - time_zone -- Time zone for date histogram aggregations. String. - type -- Type of aggregation to perform. String. + date_ranges : list[dict] + Date range timeframe. + exclude : str + Fields to exclude from results. + extended_bounds : dict + Extended bounds for histogram aggregations. + field : str + Field to aggregate on. + filter : str + Filter criteria in the form of an FQL query. + filters_spec : dict + Additional filter specifications. + from : int + Starting index of overall result set. + include : str + Fields to include in results. + interval : str + Time interval for date histogram aggregations. + max_doc_count : int + Maximum number of documents per bucket. + min_doc_count : int + Minimum number of documents per bucket. + missing : str + Value to use for documents missing the field. + name : str + Name of the aggregation. + percents : list + Percentile values to calculate. List of floats. + q : str + Full text search query. + ranges : list[dict] + Range boundaries for range aggregations. + size : int + Maximum number of records to return. + sort : str + The field to sort on. + sub_aggregates : list[dict] + Nested aggregation definitions. + time_zone : str + Time zone for date histogram aggregations. + type : str + Type of aggregation to perform. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/exclusions.aggregates.v2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = aggregate_payload(submitted_keywords=kwargs) @@ -161,12 +190,20 @@ def aggregate_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dic def get_all_exclusions(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get all exclusions. - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/exclusions.get-all.v2 + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -184,11 +221,20 @@ def perform_actions(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Actions used to manipulate the content of exclusions, with ancestor fields. - Keyword arguments: - action_name -- The action to perform. String. - Available values: - add_item remove_item validate_filepath - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/exclusions.perform-action.v2 + + Keyword arguments + ----------------- + action_name : str + The action to perform. String. + Available values: + add_item remove_item validate_filepath + body : dict + full body payload, not required when using other keywords. { "action_parameters": [ { @@ -202,22 +248,27 @@ def perform_actions(self: object, "label": "string", "name": "string" } - action_parameters -- Action-specific parameters. List of dictionary. - available -- Flag indicating if the action is available. Boolean. - description -- Description of the exclusion action. String. - group -- Group associated with the action. String. - label -- Display label for the action. String. - name -- Name of the action. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + action_parameters : list[dict] + Action-specific parameters. + available : bool + Flag indicating if the action is available. + description : str + Description of the exclusion action. + group : str + Group associated with the action. + label : str + Display label for the action. + name : str + Name of the action. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/exclusions.perform-action.v2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = ml_exclusions_actions_payload(passed_keywords=kwargs) @@ -235,8 +286,16 @@ def perform_actions(self: object, def get_reports(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create a report of ML exclusions scoped by the given filters. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/exclusions.get-reports.v2 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "report_format": "string", "search": { @@ -245,14 +304,14 @@ def get_reports(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Un } } - This method only supports keywords for providing arguments. - Returns: dict object containing API response. - HTTP Method: POST + This method only supports keywords for providing arguments. - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/exclusions.get-reports.v2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = ml_exclusions_report_payload(passed_keywords=kwargs) @@ -272,19 +331,28 @@ def get_exclusions_by_id(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get the exclusions by id, with ancestor fields. - Keyword arguments: - ids -- The ids of the exclusions to retrieve. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/exclusions.get.v2 + + Keyword arguments + ----------------- + ids : str or list[str] + The ids of the exclusions to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -298,8 +366,16 @@ def get_exclusions_by_id(self: object, def create_exclusions_v2(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create the exclusions, with ancestor fields. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/exclusions.create.v2 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "exclusions": [ { @@ -316,16 +392,14 @@ def create_exclusions_v2(self: object, body: dict = None, **kwargs) -> Union[Dic } ] } - exclusions -- List of dictionary. + exclusions : list[dict] This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/exclusions.create.v2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = {} @@ -342,8 +416,16 @@ def create_exclusions_v2(self: object, body: dict = None, **kwargs) -> Union[Dic def update_exclusions_v2(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update the exclusions by id, with ancestor fields. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/exclusions.update.v2 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "comment": "string", "excluded_from": [ @@ -357,21 +439,27 @@ def update_exclusions_v2(self: object, body: dict = None, **kwargs) -> Union[Dic "parent_value": "string", "value": "string" } - comment -- Comment describing why the exclusion is updated. String. - excluded_from -- Exclusion sources. String or list of strings. - grandparent_value -- Grandparent process value for the exclusion. String. - groups -- Group IDs to associate with the exclusion. String or list of strings. - id -- Identifier of the exclusion to update. String. - parent_value -- Parent process value for the exclusion. String. - value -- Value to exclude. String. - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. + comment : str + Comment describing why the exclusion is updated. + excluded_from : str or list[str] + Exclusion sources. + grandparent_value : str + Grandparent process value for the exclusion. + groups : str or list[str] + Group IDs to associate with the exclusion. + id : str + Identifier of the exclusion to update. + parent_value : str + Parent process value for the exclusion. + value : str + Value to exclude. - HTTP Method: PATCH + This method only supports keywords for providing arguments. - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/exclusions.update.v2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = ml_exclusions_update_payload(passed_keywords=kwargs) @@ -387,19 +475,27 @@ def update_exclusions_v2(self: object, body: dict = None, **kwargs) -> Union[Dic def delete_exclusions_v2(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete the exclusions by id, with ancestor fields. - Keyword arguments: - ids -- The ids of the exclusions to delete. String or list of strings. - comment -- The comment why these exclusions were deleted. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/exclusions.delete.v2 + + Keyword arguments + ----------------- + ids : str or list[str] + The ids of the exclusions to delete. + comment : str + The comment why these exclusions were deleted. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -413,21 +509,31 @@ def delete_exclusions_v2(self: object, parameters: dict = None, **kwargs) -> Uni def search_exclusions_v2(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search for exclusions, with ancestor fields. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. String. - offset -- The offset to start retrieving records from. Integer. - limit -- The maximum records to return. [1-500]. Integer - sort -- The sort expression that should be used to sort the results. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/exclusions.search.v2 + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. + offset : int + The offset to start retrieving records from. + limit : int + The maximum records to return. [1-500] + sort : str + The sort expression that should be used to sort the results. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -445,19 +551,28 @@ def get_ml_exclusion_sets(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get a set of ML Exclusions by specifying their IDs. - Keyword arguments: - ids -- The ids of the exclusions to retrieve. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/getMLExclusionsV1 + + Keyword arguments + ----------------- + ids : str or list[str] + The ids of the exclusions to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -474,8 +589,16 @@ def create_ml_exclusions_v2(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create the ML exclusions. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/createMLExclusionsV1 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "comment": "string", "excluded_from": [ @@ -486,19 +609,20 @@ def create_ml_exclusions_v2(self: object, ], "value": "string" } - comment -- Comment describing why the exclusion is entered. String. - excluded_from -- String or list of strings. - groups -- Group IDs to exclude. List of strings. - value -- Value to exclude. String + comment : str + Comment describing why the exclusion is entered. + excluded_from : str or list[str] + groups : str or list[str] + Group IDs to exclude. + value : str + Value to exclude. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/createMLExclusionsV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = exclusion_payload(passed_keywords=kwargs) @@ -517,8 +641,16 @@ def update_ml_exclusions(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update the ML exclusions. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/updateMLExclusionsV1 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "comment": "string", "groups": [ @@ -528,20 +660,23 @@ def update_ml_exclusions(self: object, "is_descendant_process": true, "value": "string" } - comment -- Comment describing why the exclusion is entered. String. - groups -- Group IDs to exclude. List of strings. - id -- Identifier of the exclusion to update. String. - is_descendant_process -- Flag indicating if the exclusion applies to descendant processes. Boolean. - value -- Value to exclude. String. + comment : str + Comment describing why the exclusion is entered. + groups : str or list[str] + Group IDs to exclude. + id : str + Identifier of the exclusion to update. + is_descendant_process : bool + Flag indicating if the exclusion applies to descendant processes. + value : str + Value to exclude. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/updateMLExclusionsV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = ml_exclusions_update_payload(passed_keywords=kwargs) @@ -556,19 +691,28 @@ def update_ml_exclusions(self: object, def get_exclusions(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get a set of ML Exclusions by specifying their IDs. - Keyword arguments: - ids -- List of exclusion IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/getMLExclusionsV1 + + Keyword arguments + ----------------- + ids : str or list[str] + List of exclusion IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -582,8 +726,16 @@ def get_exclusions(self: object, *args, parameters: dict = None, **kwargs) -> Un def create_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create the ML exclusions. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/createMLExclusionsV1 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "comment": "string", "excluded_from": [ @@ -594,19 +746,21 @@ def create_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[s ], "value": "string" } - comment -- String comment describing why the exclusion is entered. - excluded_from -- Exclusion sources to apply. String or list of strings. - groups -- Group IDs to exclude. List of strings. - value -- Value to exclude. String + comment : str + String comment describing why the exclusion is entered. + excluded_from : str or list[str] + Exclusion sources to apply. + groups : str or list[str] + Group IDs to exclude. + value : str + Value to exclude. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/createMLExclusionsV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = exclusion_payload(passed_keywords=kwargs) @@ -625,20 +779,30 @@ def create_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[s def delete_exclusions(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete the ML Exclusions by ID. - Keyword arguments: - comment -- Explains why this exclusions was deleted. String. - ids -- List of exclusion IDs to delete. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/deleteMLExclusionsV1 + + Keyword arguments + ----------------- + comment : str + Explains why this exclusions was deleted. + ids : str or list[str] + List of exclusion IDs to delete. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -652,8 +816,16 @@ def delete_exclusions(self: object, parameters: dict = None, **kwargs) -> Union[ def update_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update the ML Exclusions. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/updateMLExclusionsV1 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "comment": "string", "groups": [ @@ -663,20 +835,23 @@ def update_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[s "is_descendant_process": boolean, "value": "string" } - comment -- String comment describing why the exclusion is entered. - groups -- Group IDs to exclude. List of strings. - id -- Exclusion ID to update. String. - is_descendant_process -- Flag indicating if this is a descendant process. Boolean. - value -- Value to exclude. String + comment : str + String comment describing why the exclusion is entered. + groups : str or list[str] + Group IDs to exclude. + id : str + Exclusion ID to update. + is_descendant_process : bool + Flag indicating if this is a descendant process. + value : str + Value to exclude. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/updateMLExclusionsV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = exclusion_payload(passed_keywords=kwargs) @@ -694,33 +869,43 @@ def update_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[s def query_exclusions(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search for ML Exclusions. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - An asterisk wildcard '*' includes all results. - AVAILABLE FILTERS - applied_globally last_modified - created_by modified_by - created_on value - limit -- The maximum number of detections to return in this response. - [Integer, default: 100; max: 500] - Use with the offset parameter to manage pagination of results. - offset -- The first detection to return, where 0 is the latest detection. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. last_behavior|asc). - Available sort fields: - applied_globally last_modified - created_by modified_by - created_on value - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/queryMLExclusionsV1 + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + An asterisk wildcard '*' includes all results. + AVAILABLE FILTERS + applied_globally last_modified + created_by modified_by + created_on value + limit : int + The maximum number of detections to return in this response. + [Integer, default: 100; max: 500] + Use with the offset parameter to manage pagination of results. + offset : int + The first detection to return, where 0 is the latest detection. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. last_behavior|asc). + Available sort fields: + applied_globally last_modified + created_by modified_by + created_on value + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -730,6 +915,115 @@ def query_exclusions(self: object, parameters: dict = None, **kwargs) -> Union[D params=parameters ) + @force_default(defaults=["body"], default_types=["dict"]) + def exclusions_sdmf_query_v1(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Execute an SDMF data frame query against exclusion entities. + + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ml-exclusions/exclusions_sdmf_query_v1 + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "control_info": { + "deadline": "string", + "duration": "string", + "execution_context": { + "catalog_version": "string", + "execution_options": "string", + "extensions": "string", + "queried_cids": [ + "string" + ] + }, + "execution_details": { + "driver_calls": "string" + }, + "is_export_request": true, + "pagination_info": { + "limit": 0, + "offset": "string" + }, + "partial_results": true, + "query_stats": { + "execution_stats": { + "visited_entities": 0, + "visited_relationships": 0 + }, + "total_hits": { + "relation": "string", + "total": 0 + } + }, + "store_headers": "string" + }, + "id": "string", + "nodes": [ + { + "alias": "string", + "id": "string", + "operator": "string", + "res_id": "string", + "schema": { + "base": [ + "string" + ], + "facets": [ + "string" + ], + "fields": [ + { + "facets": [ + "string" + ], + "is_relationship": true, + "is_required": true, + "multiplicity": "string", + "name": "string", + "scope": "string", + "type": "string" + } + ], + "res_id": "string" + } + } + ], + "res_id": "string" + } + control_info : dict + The control_info value. + id : str + The id value. + nodes : list + The nodes value. + res_id : str + The res_id value. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = exclusions_sdmf_query_v1_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="exclusions_sdmf_query_v1", + body=body + ) + # These method names align to the operation IDs in the API but # do not conform to snake_case / PEP8 and are defined here for # backwards compatibility / ease of use purposes diff --git a/src/falconpy/ml_exclusions.pyi b/src/falconpy/ml_exclusions.pyi index 138321aa3..429a3fb0d 100644 --- a/src/falconpy/ml_exclusions.pyi +++ b/src/falconpy/ml_exclusions.pyi @@ -179,6 +179,16 @@ class MLExclusions(ServiceClass): parameters: Optional[dict] = None, ) -> Union[Dict[str, Union[int, dict]], Result]: ... + def exclusions_sdmf_query_v1( + self, + *, + control_info: Optional[dict] = None, + id: Optional[str] = None, + nodes: Optional[list] = None, + res_id: Optional[str] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + getMLExclusionsV1 = get_exclusions createMLExclusionsV1 = create_exclusions deleteMLExclusionsV1 = delete_exclusions diff --git a/src/falconpy/mobile_enrollment.py b/src/falconpy/mobile_enrollment.py index 3d44ab3e3..bbc4f7fc6 100644 --- a/src/falconpy/mobile_enrollment.py +++ b/src/falconpy/mobile_enrollment.py @@ -72,7 +72,7 @@ def device_enroll(self: object, https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mobile-enrollment/RequestDeviceEnrollmentV3 Keyword arguments - ---- + ----------------- action_name : str Action to perform. Allowed values: enroll, re-enroll. body : dict @@ -93,11 +93,11 @@ def device_enroll(self: object, Full parameters payload, not required if using `action_name` keyword. Arguments - ---- + --------- This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -127,7 +127,7 @@ def device_enroll_v4(self: object, https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mobile-enrollment/RequestDeviceEnrollmentV4 Keyword arguments - ---- + ----------------- action_name : str Action to perform. Allowed values: enroll, re-enroll. body : dict @@ -151,11 +151,11 @@ def device_enroll_v4(self: object, Full parameters payload, not required if using `action_name` keyword. Arguments - ---- + --------- This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary containing API response. """ diff --git a/src/falconpy/models.py b/src/falconpy/models.py new file mode 100644 index 000000000..ce8c24be1 --- /dev/null +++ b/src/falconpy/models.py @@ -0,0 +1,136 @@ +"""CrowdStrike Falcon Models API interface class. + + _______ __ _______ __ __ __ +| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----. +|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__| +|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____| +|: 1 | |: 1 | +|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy +`-------' `-------' + +OAuth2 API - Customer SDK + +This is free and unencumbered software released into the public domain. + +Anyone is free to copy, modify, publish, use, compile, sell, or +distribute this software, either in source code form or as a compiled +binary, for any purpose, commercial or non-commercial, and by any +means. + +In jurisdictions that recognize copyright laws, the author or authors +of this software dedicate any and all copyright interest in the +software to the public domain. We make this dedication for the benefit +of the public at large and to the detriment of our heirs and +successors. We intend this dedication to be an overt act of +relinquishment in perpetuity of all present and future rights to this +software under copyright law. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR +OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, +ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR +OTHER DEALINGS IN THE SOFTWARE. + +For more information, please refer to +""" +from typing import Dict, Union +from ._util import force_default, process_service_request, handle_single_argument +from ._result import Result +from ._service_class import ServiceClass +from ._endpoint._models import _models_endpoints as Endpoints + + +class Models(ServiceClass): + """The only requirement to instantiate an instance of this class is one of the following. + + - a valid client_id and client_secret provided as keywords. + - a credential dictionary with client_id and client_secret containing valid API credentials + { + "client_id": "CLIENT_ID_HERE", + "client_secret": "CLIENT_SECRET_HERE" + } + - a previously-authenticated instance of the authentication service class (oauth2.py) + - a valid token provided by the authentication service class (oauth2.py) + """ + + @force_default(defaults=["parameters"], default_types=["dict"]) + def entities_models_v1(self: object, + *args, + parameters: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Get Model Entities by IDs. + + HTTP Method: GET + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/models/EntitiesModelsV1 + + Keyword arguments + ----------------- + ids : str or list[str] + IDs of models to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. + """ + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="EntitiesModelsV1", + keywords=kwargs, + params=handle_single_argument(args, parameters, "ids") + ) + + @force_default(defaults=["parameters"], default_types=["dict"]) + def queries_models_v1(self: object, + parameters: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Query models based on the provided filters. + + HTTP Method: GET + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/models/QueriesModelsV1 + + Keyword arguments + ----------------- + offset : int + Starting index of overall result set from which to return ids. + limit : int + Number of IDs to return. Offset + limit should NOT be above 10K. + filter : str + FQL query specifying the filter parameters. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="QueriesModelsV1", + keywords=kwargs, + params=parameters + ) + EntitiesModelsV1 = entities_models_v1 + QueriesModelsV1 = queries_models_v1 diff --git a/src/falconpy/models.pyi b/src/falconpy/models.pyi new file mode 100644 index 000000000..ba636741f --- /dev/null +++ b/src/falconpy/models.pyi @@ -0,0 +1,26 @@ +"""Type stubs for models.""" +from typing import Dict, List, Optional, Union +from ._service_class import ServiceClass +from ._result import Result + + +class Models(ServiceClass): + + def entities_models_v1( + self, + *args: Union[str, List[str]], + ids: Optional[Union[str, List[str]]] = None, + parameters: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def queries_models_v1( + self, + *, + offset: Optional[int] = None, + limit: Optional[int] = None, + filter: Optional[str] = None, + parameters: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + EntitiesModelsV1 = entities_models_v1 + QueriesModelsV1 = queries_models_v1 diff --git a/src/falconpy/mssp.py b/src/falconpy/mssp.py index 9515c89c3..1af417ddd 100644 --- a/src/falconpy/mssp.py +++ b/src/falconpy/mssp.py @@ -61,19 +61,28 @@ class FlightControl(ServiceClass): def get_children(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get link to child customer by child CID(s). - Keyword arguments: - ids -- CID of a child customer. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/getChildren + + Keyword arguments + ----------------- + ids : str or list[str] + CID of a child customer. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -87,24 +96,33 @@ def get_children(self: object, *args, parameters: dict = None, **kwargs) -> Unio def get_children_v2(self: object, *args, body: dict = None, **kwargs) -> dict: """Get link to child customer by child CID(s). - Keyword arguments: - body -- full body payload, not required when ids keyword is provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/getChildrenV2 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when ids keyword is provided. { "ids": [ "string" ] } - ids -- ID(s) of the indicator entities to retrieve. String or list of strings. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/getChildrenV2 + ids : str or list[str] + ID(s) of the indicator entities to retrieve. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_arguments=args, @@ -125,20 +143,29 @@ def get_cid_group_members_by_v1(self: object, *args, parameters: dict = None, ** ** DEPRECATED ** - Keyword arguments: - cid_group_ids -- CID group IDs to search for. String or list of strings. - parameters -- full parameters payload, not required if `cid_group_ids` is provided - as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be - 'cid_group_ids'. All others are ignored. - - Returns: dict object containing API response - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/getCIDGroupMembersBy + + Keyword arguments + ----------------- + cid_group_ids : str or list[str] + CID group IDs to search for. + parameters : dict + full parameters payload, not required if `cid_group_ids` is provided + as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'cid_group_ids'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -152,21 +179,30 @@ def get_cid_group_members_by_v1(self: object, *args, parameters: dict = None, ** def get_cid_group_members_by(self: object, *args, parameters: dict = None, **kwargs) -> dict: """Get CID Group members by CID Group IDs. - Keyword arguments: - ids -- CID group IDs to search for. String or list of strings. - The keyword `cid_group_ids` will also be accepted for this argument. - parameters -- full parameters payload, not required if `cid_group_ids` is provided - as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/getCIDGroupMembersByV2 + + Keyword arguments + ----------------- + ids : str or list[str] + CID group IDs to search for. String or list of strings. + The keyword `cid_group_ids` will also be accepted for this argument. + parameters : dict + full parameters payload, not required if `cid_group_ids` is provided + as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("cid_group_ids", None) and not kwargs.get("ids", None): kwargs["ids"] = kwargs.get("cid_group_ids") @@ -183,8 +219,16 @@ def get_cid_group_members_by(self: object, *args, parameters: dict = None, **kwa def add_cid_group_members(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Add new CID Group member. - Keyword arguments: - body -- full body payload, not required if sha256 is provided as a keyword. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/addCIDGroupMembers + + Keyword arguments + ----------------- + body : dict + full body payload, not required if sha256 is provided as a keyword. { "resources": [ { @@ -195,17 +239,17 @@ def add_cid_group_members(self: object, body: dict = None, **kwargs) -> Union[Di } ] } - cid_group_id -- ID of the CID group to update. String. - cids -- CIDs to add to the group. String or list of strings. + cid_group_id : str + ID of the CID group to update. + cids : str or list[str] + CIDs to add to the group. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/addCIDGroupMembers + Returns + ------- + dict + Dictionary object containing API response. """ if not body: item = generic_payload_list(submitted_keywords=kwargs, payload_value="cids") @@ -227,8 +271,16 @@ def delete_cid_group_members_v1(self: object, body: dict = None, **kwargs) -> Un *DEPRECATED* Please use delete_cid_group_members. - Keyword arguments: - body -- full body payload, not required if sha256 is provided as a keyword. + HTTP Method: DELETE + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/deleteCIDGroupMembers + + Keyword arguments + ----------------- + body : dict + full body payload, not required if sha256 is provided as a keyword. { "resources": [ { @@ -239,17 +291,17 @@ def delete_cid_group_members_v1(self: object, body: dict = None, **kwargs) -> Un } ] } - cid_group_id -- ID of the CID group to update. String. - cids -- CIDs to remove from the group. String or list of strings. + cid_group_id : str + ID of the CID group to update. + cids : str or list[str] + CIDs to remove from the group. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: DELETE - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/deleteCIDGroupMembers + Returns + ------- + dict + Dictionary object containing API response. """ if not body: item = generic_payload_list(submitted_keywords=kwargs, payload_value="cids") @@ -268,8 +320,16 @@ def delete_cid_group_members_v1(self: object, body: dict = None, **kwargs) -> Un def delete_cid_group_members(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete CID Group members entry. - Keyword arguments: - body -- full body payload, not required if sha256 is provided as a keyword. + HTTP Method: DELETE + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/deleteCIDGroupMembers + + Keyword arguments + ----------------- + body : dict + full body payload, not required if sha256 is provided as a keyword. { "resources": [ { @@ -280,17 +340,17 @@ def delete_cid_group_members(self: object, body: dict = None, **kwargs) -> Union } ] } - cid_group_id -- ID of the CID group to update. String. - cids -- CIDs to remove from the group. String or list of strings. + cid_group_id : str + ID of the CID group to update. + cids : str or list[str] + CIDs to remove from the group. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: DELETE - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/deleteCIDGroupMembers + Returns + ------- + dict + Dictionary object containing API response. """ if not body: item = generic_payload_list(submitted_keywords=kwargs, payload_value="cids") @@ -311,20 +371,29 @@ def get_cid_group_by_id_v1(self: object, *args, parameters: dict = None, **kwarg ** DEPRECATED ** - Keyword arguments: - cid_group_ids -- CID group IDs to search for. String or list of strings. - parameters -- full parameters payload, not required if `cid_group_ids` is provided - as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be - 'cid_group_ids'. All others are ignored. - - Returns: dict object containing API response - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/getCIDGroupById + + Keyword arguments + ----------------- + cid_group_ids : str or list[str] + CID group IDs to search for. + parameters : dict + full parameters payload, not required if `cid_group_ids` is provided + as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'cid_group_ids'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -338,21 +407,30 @@ def get_cid_group_by_id_v1(self: object, *args, parameters: dict = None, **kwarg def get_cid_group_by_id(self: object, *args, parameters: dict = None, **kwargs) -> dict: """Get CID Group(s) by ID(s). - Keyword arguments: - ids -- CID group IDs to search for. String or list of strings. - The keyword `cid_group_ids` will also be accepted for this argument. - parameters -- full parameters payload, not required if `cid_group_ids` is provided - as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be - 'cid_group_ids'. All others are ignored. - - Returns: dict object containing API response - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/getCIDGroupByIdV2 + + Keyword arguments + ----------------- + ids : str or list[str] + CID group IDs to search for. String or list of strings. + The keyword `cid_group_ids` will also be accepted for this argument. + parameters : dict + full parameters payload, not required if `cid_group_ids` is provided + as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'cid_group_ids'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("cid_group_ids", None) and not kwargs.get("ids", None): kwargs["ids"] = kwargs.get("cid_group_ids") @@ -369,8 +447,16 @@ def get_cid_group_by_id(self: object, *args, parameters: dict = None, **kwargs) def create_cid_groups(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create new CID Group(s). Maximum 500 CID Group(s) allowed. - Keyword arguments: - body -- full body payload, not required if sha256 is provided as a keyword. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/createCIDGroups + + Keyword arguments + ----------------- + body : dict + full body payload, not required if sha256 is provided as a keyword. { "resources": [ { @@ -381,19 +467,21 @@ def create_cid_groups(self: object, body: dict = None, **kwargs) -> Union[Dict[s } ] } - cid -- CID to initially add to the group. String. - cid_group_id -- CID Group ID. String. - description -- Description for the CID group. String. - name -- Name of the CID group. String. + cid : str + CID to initially add to the group. + cid_group_id : str + CID Group ID. + description : str + Description for the CID group. + name : str + Name of the CID group. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/createCIDGroups + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = mssp_payload(passed_keywords=kwargs) @@ -413,20 +501,29 @@ def delete_cid_groups(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete CID Group(s) by ID(s). - Keyword arguments: - cid_group_ids -- CID group IDs to search for. String or list of strings. - parameters -- full parameters payload, not required if `cid_group_ids` is provided - as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be - 'cid_group_ids'. All others are ignored. - - Returns: dict object containing API response - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/deleteCIDGroups + + Keyword arguments + ----------------- + cid_group_ids : str or list[str] + CID group IDs to search for. + parameters : dict + full parameters payload, not required if `cid_group_ids` is provided + as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'cid_group_ids'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -444,8 +541,16 @@ def update_cid_groups(self: object, body: dict = None, **kwargs) -> Union[Dict[s CID Group member(s) remain unaffected. - Keyword arguments: - body -- full body payload, not required if sha256 is provided as a keyword. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/updateCIDGroups + + Keyword arguments + ----------------- + body : dict + full body payload, not required if sha256 is provided as a keyword. { "resources": [ { @@ -456,19 +561,21 @@ def update_cid_groups(self: object, body: dict = None, **kwargs) -> Union[Dict[s } ] } - cid -- CID to initially add to the group. String. - cid_group_id -- CID Group ID. String. - description -- Description for the CID group. String. - name -- Name of the CID group. String. + cid : str + CID to initially add to the group. + cid_group_id : str + CID Group ID. + description : str + Description for the CID group. + name : str + Name of the CID group. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/updateCIDGroups + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = mssp_payload(passed_keywords=kwargs) @@ -486,20 +593,28 @@ def get_roles_by_id(self: object, *args, parameters: dict = None, **kwargs) -> U MSSP Role assignment is of the format :. - Keyword arguments: - ids -- MSSP Role assignment is of the format :. - String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/getRolesByID + + Keyword arguments + ----------------- + ids : str or list[str] + MSSP Role assignment is of the format :. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -516,8 +631,16 @@ def add_role(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union It does not revoke existing role(s) between User Group and CID Group. User Group ID and CID Group ID have to be specified in request. - Keyword arguments: - body -- full body payload, not required if sha256 is provided as a keyword. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/addRole + + Keyword arguments + ----------------- + body : dict + full body payload, not required if sha256 is provided as a keyword. { "resources": [ { @@ -530,19 +653,21 @@ def add_role(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union } ] } - cid_group_id -- CID Group ID. String. - id -- Role Assignment ID. String. - role_ids -- Role IDs to be assigned. - user_group_ids -- User Group ID. String. + cid_group_id : str + CID Group ID. + id : str + Role Assignment ID. + role_ids : str or list[str] + Role IDs to be assigned. + user_group_ids : str + User Group ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/addRole + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = mssp_payload(passed_keywords=kwargs) @@ -563,8 +688,16 @@ def delete_roles(self: object, body: dict = None, **kwargs) -> Union[Dict[str, U else association between User Group and CID Group is dissolved completely (if there are no roles specified). - Keyword arguments: - body -- full body payload, not required if sha256 is provided as a keyword. + HTTP Method: DELETE + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/deletedRoles + + Keyword arguments + ----------------- + body : dict + full body payload, not required if sha256 is provided as a keyword. { "resources": [ { @@ -577,19 +710,21 @@ def delete_roles(self: object, body: dict = None, **kwargs) -> Union[Dict[str, U } ] } - cid_group_id -- CID Group ID. String. - id -- Role Assignment ID. String. - role_ids -- Role IDs to be assigned. - user_group_ids -- User Group ID. String. + cid_group_id : str + CID Group ID. + id : str + Role Assignment ID. + role_ids : str or list[str] + Role IDs to be assigned. + user_group_ids : str + User Group ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: DELETE - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/deletedRoles + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = mssp_payload(passed_keywords=kwargs) @@ -611,20 +746,29 @@ def get_user_group_members_by_id_v1(self: object, ** DEPRECATED ** - Keyword arguments: - user_group_ids -- User group IDs to search for. String or list of strings. - parameters -- full parameters payload, not required if `user_group_ids` is provided - as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be - 'user_group_ids'. All others are ignored. - - Returns: dict object containing API response - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/getUserGroupMembersByID + + Keyword arguments + ----------------- + user_group_ids : str or list[str] + User group IDs to search for. + parameters : dict + full parameters payload, not required if `user_group_ids` is provided + as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'user_group_ids'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -642,21 +786,30 @@ def get_user_group_members_by_id(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get User Group members by User Group ID(s). - Keyword arguments: - ids -- User group IDs to search for. String or list of strings. - The keyword `user_group_ids` will also be accepted for this argument. - parameters -- full parameters payload, not required if `user_group_ids` is provided - as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be - 'user_group_ids'. All others are ignored. - - Returns: dict object containing API response - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/getUserGroupMembersByIDV2 + + Keyword arguments + ----------------- + ids : str or list[str] + User group IDs to search for. String or list of strings. + The keyword `user_group_ids` will also be accepted for this argument. + parameters : dict + full parameters payload, not required if `user_group_ids` is provided + as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'user_group_ids'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("user_group_ids", None) and not kwargs.get("ids", None): kwargs["ids"] = kwargs.get("user_group_ids") @@ -673,8 +826,16 @@ def get_user_group_members_by_id(self: object, def add_user_group_members(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Add new User Group member. Maximum 500 members allowed per User Group. - Keyword arguments: - body -- full body payload, not required if sha256 is provided as a keyword. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/addUserGroupMembers + + Keyword arguments + ----------------- + body : dict + full body payload, not required if sha256 is provided as a keyword. { "resources": [ { @@ -685,17 +846,17 @@ def add_user_group_members(self: object, body: dict = None, **kwargs) -> Union[D } ] } - user_group_ids -- User Group ID. String. - user_uuids -- User UUIDs to assign to group. String or list of strings. + user_group_ids : str + User Group ID. + user_uuids : str or list[str] + User UUIDs to assign to group. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/addUserGroupMembers + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = mssp_payload(passed_keywords=kwargs) @@ -711,8 +872,16 @@ def add_user_group_members(self: object, body: dict = None, **kwargs) -> Union[D def delete_user_group_members(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete User Group members entry. - Keyword arguments: - body -- full body payload, not required if sha256 is provided as a keyword. + HTTP Method: DELETE + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/deleteUserGroupMembers + + Keyword arguments + ----------------- + body : dict + full body payload, not required if sha256 is provided as a keyword. { "resources": [ { @@ -723,17 +892,17 @@ def delete_user_group_members(self: object, body: dict = None, **kwargs) -> Unio } ] } - user_group_ids -- User Group ID. String. - user_uuids -- User UUIDs to remove from group. String or list of strings. + user_group_ids : str + User Group ID. + user_uuids : str or list[str] + User UUIDs to remove from group. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: DELETE - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/deleteUserGroupMembers + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = mssp_payload(passed_keywords=kwargs) @@ -751,20 +920,29 @@ def get_user_groups_by_id_v1(self: object, *args, parameters: dict = None, **kwa ** DEPRECATED ** - Keyword arguments: - user_group_ids -- User group IDs to search for. String or list of strings. - parameters -- full parameters payload, not required if `user_group_ids` is provided - as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be - 'user_group_ids'. All others are ignored. - - Returns: dict object containing API response - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/getUserGroupsByID + + Keyword arguments + ----------------- + user_group_ids : str or list[str] + User group IDs to search for. + parameters : dict + full parameters payload, not required if `user_group_ids` is provided + as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'user_group_ids'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -778,21 +956,30 @@ def get_user_groups_by_id_v1(self: object, *args, parameters: dict = None, **kwa def get_user_groups_by_id(self: object, *args, parameters: dict = None, **kwargs) -> dict: """Get User Groups by ID(s). - Keyword arguments: - ids -- User group IDs to search for. String or list of strings. - The keyword `user_group_ids` will also be accepted for this argument. - parameters -- full parameters payload, not required if `user_group_ids` is provided - as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be - 'user_group_ids'. All others are ignored. - - Returns: dict object containing API response - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/getUserGroupsByIDV2 + + Keyword arguments + ----------------- + ids : str or list[str] + User group IDs to search for. String or list of strings. + The keyword `user_group_ids` will also be accepted for this argument. + parameters : dict + full parameters payload, not required if `user_group_ids` is provided + as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'user_group_ids'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("user_group_ids", None) and not kwargs.get("ids", None): kwargs["ids"] = kwargs.get("user_group_ids") @@ -809,8 +996,16 @@ def get_user_groups_by_id(self: object, *args, parameters: dict = None, **kwargs def create_user_groups(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create new User Group(s). Maximum 500 User Group(s) allowed per customer. - Keyword arguments: - body -- full body payload, not required if sha256 is provided as a keyword. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/createUserGroup + + Keyword arguments + ----------------- + body : dict + full body payload, not required if sha256 is provided as a keyword. { "resources": [ { @@ -821,19 +1016,21 @@ def create_user_groups(self: object, body: dict = None, **kwargs) -> Union[Dict[ } ] } - cid -- CID to initially add to the group. String. - description -- Description for the CID group. String. - name -- Name of the CID group. String. - user_group_id -- User Group ID. String. + cid : str + CID to initially add to the group. + description : str + Description for the CID group. + name : str + Name of the CID group. + user_group_id : str + User Group ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/createUserGroup + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = mssp_payload(passed_keywords=kwargs) @@ -853,20 +1050,29 @@ def delete_user_groups(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete User Group(s) by ID(s). - Keyword arguments: - user_group_ids -- User group IDs to delete. String or list of strings. - parameters -- full parameters payload, not required if `user_group_ids` is provided - as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be - 'user_group_ids'. All others are ignored. - - Returns: dict object containing API response - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/deleteUserGroups + + Keyword arguments + ----------------- + user_group_ids : str or list[str] + User group IDs to delete. + parameters : dict + full parameters payload, not required if `user_group_ids` is provided + as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'user_group_ids'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -884,8 +1090,16 @@ def update_user_groups(self: object, body: dict = None, **kwargs) -> Union[Dict[ User Group member(s) remain unaffected. - Keyword arguments: - body -- full body payload, not required if sha256 is provided as a keyword. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/updateUserGroups + + Keyword arguments + ----------------- + body : dict + full body payload, not required if sha256 is provided as a keyword. { "resources": [ { @@ -896,19 +1110,21 @@ def update_user_groups(self: object, body: dict = None, **kwargs) -> Union[Dict[ } ] } - cid -- CID to initially add to the group. String. - description -- Description for the CID group. String. - name -- Name of the CID group. String. - user_group_id -- User Group ID to update. String. + cid : str + CID to initially add to the group. + description : str + Description for the CID group. + name : str + Name of the CID group. + user_group_id : str + User Group ID to update. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/updateUserGroups + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = mssp_payload(passed_keywords=kwargs) @@ -924,23 +1140,33 @@ def update_user_groups(self: object, body: dict = None, **kwargs) -> Union[Dict[ def query_children(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query for customers linked as children. - Keyword arguments: - filter -- FQL formatted string used to limit results. String. Supported filter: cid - limit -- The maximum number of records to return in this response. [Integer, 1-1000] - Use with the offset parameter to manage pagination of results. Default: 10 - offset -- The offset to start retrieving records from. String. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. (Ex: `last_modified_timestamp|desc`) - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/queryChildren + + Keyword arguments + ----------------- + filter : str + FQL formatted string used to limit results. String. Supported filter: cid + limit : int + The maximum number of records to return in this response. [Integer, 1-1000] + Use with the offset parameter to manage pagination of results. Default: 10 + offset : int + The offset to start retrieving records from. String. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. (Ex: `last_modified_timestamp|desc`) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -957,23 +1183,33 @@ def query_cid_group_members(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Query a CID Groups members by associated CID. - Keyword arguments: - cid -- CID to lookup associated CID group ID - limit -- The maximum number of records to return in this response. [Integer, 1-1000] - Use with the offset parameter to manage pagination of results. Default: 10 - offset -- The offset to start retrieving records from. String. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. (Ex: `last_modified_timestamp|desc`) - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/queryCIDGroupMembers + + Keyword arguments + ----------------- + cid : str + CID to lookup associated CID group ID + limit : int + The maximum number of records to return in this response. [Integer, 1-1000] + Use with the offset parameter to manage pagination of results. Default: 10 + offset : int + The offset to start retrieving records from. String. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. (Ex: `last_modified_timestamp|desc`) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -987,23 +1223,33 @@ def query_cid_group_members(self: object, def query_cid_groups(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query a CID Groups. - Keyword arguments: - name -- Name to lookup groups for - limit -- The maximum number of records to return in this response. [Integer, 1-1000] - Use with the offset parameter to manage pagination of results. Default: 10 - offset -- The offset to start retrieving records from. String. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. (Ex: `last_modified_timestamp|desc`) - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/queryCIDGroups + + Keyword arguments + ----------------- + name : str + Name to lookup groups for + limit : int + The maximum number of records to return in this response. [Integer, 1-1000] + Use with the offset parameter to manage pagination of results. Default: 10 + offset : int + The offset to start retrieving records from. String. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. (Ex: `last_modified_timestamp|desc`) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1019,25 +1265,37 @@ def query_roles(self: object, parameters: dict = None, **kwargs) -> Union[Dict[s At least one of CID Group ID or User Group ID should also be provided. Role ID is optional. - Keyword arguments: - user_group_id -- User group ID to fetch MSSP role for - cid_group_id -- CID group ID to fetch MSSP role for - role_id -- Role ID to fetch MSSP role for - limit -- The maximum number of records to return in this response. [Integer, 1-1000] - Use with the offset parameter to manage pagination of results. Default: 10 - offset -- The offset to start retrieving records from. String. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. (Ex: `last_modified_timestamp|desc`) - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/queryRoles + + Keyword arguments + ----------------- + user_group_id : str + User group ID to fetch MSSP role for + cid_group_id : str + CID group ID to fetch MSSP role for + role_id : str + Role ID to fetch MSSP role for + limit : int + The maximum number of records to return in this response. [Integer, 1-1000] + Use with the offset parameter to manage pagination of results. Default: 10 + offset : int + The offset to start retrieving records from. String. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. (Ex: `last_modified_timestamp|desc`) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1054,23 +1312,33 @@ def query_user_group_members(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Query User Group member by User UUID. - Keyword arguments: - user_uuid -- User UUID to lookup associated user group ID - limit -- The maximum number of records to return in this response. [Integer, 1-1000] - Use with the offset parameter to manage pagination of results. Default: 10 - offset -- The offset to start retrieving records from. String. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. (Ex: `last_modified_timestamp|desc`) - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/queryRoles + + Keyword arguments + ----------------- + user_uuid : str + User UUID to lookup associated user group ID + limit : int + The maximum number of records to return in this response. [Integer, 1-1000] + Use with the offset parameter to manage pagination of results. Default: 10 + offset : int + The offset to start retrieving records from. String. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. (Ex: `last_modified_timestamp|desc`) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1084,23 +1352,33 @@ def query_user_group_members(self: object, def query_user_groups(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query User Groups. - Keyword arguments: - name -- Name to lookup groups for - limit -- The maximum number of records to return in this response. [Integer, 1-1000] - Use with the offset parameter to manage pagination of results. Default: 10 - offset -- The offset to start retrieving records from. String. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. (Ex: `last_modified_timestamp|desc`) - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/queryUserGroups + + Keyword arguments + ----------------- + name : str + Name to lookup groups for + limit : int + The maximum number of records to return in this response. [Integer, 1-1000] + Use with the offset parameter to manage pagination of results. Default: 10 + offset : int + The offset to start retrieving records from. String. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. (Ex: `last_modified_timestamp|desc`) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/network_scan_global_configs.py b/src/falconpy/network_scan_global_configs.py index ba10f81f1..d83430d8c 100644 --- a/src/falconpy/network_scan_global_configs.py +++ b/src/falconpy/network_scan_global_configs.py @@ -59,16 +59,24 @@ class NetworkScanGlobalConfigs(ServiceClass): def get_global_configs(self: object) -> Union[Dict[str, Union[int, dict]], Result]: """Get global configuration settings for network scanning for the CID. - Keyword arguments: This method does not accept keyword arguments. - - Arguments: This method does not accept arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-global-configs/get_global_configs + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Arguments + --------- + This method does not accept arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -80,8 +88,16 @@ def get_global_configs(self: object) -> Union[Dict[str, Union[int, dict]], Resul def update_global_configs(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update global configuration settings for network scanning using provided specifications. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-global-configs/update_global_configs + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "auto_confirm_ownership": { "min_managed_assets": integer @@ -120,25 +136,29 @@ def update_global_configs(self: object, body: dict = None, **kwargs) -> Union[Di } ] } - auto_confirm_ownership -- Conditions for auto confirmation of network ownership. Dictionary. - max_concurrent_tasks -- Maximum number of scan tasks to run in parallel. Integer. - network_scanning_enabled -- Flag to enable or disable network scanning. - Setting to False attempts to stop ongoing scans - and prevents further scans from executing. Boolean. - scan_exclusion -- Scan target exclusions including common as well as zone-level exclusions - (individual IPs, IP ranges, CIDRs). Required. Dictionary. - scanners -- List of assets that will act as eligible scanners. List of dictionaries. - scanners_exclusion -- List of assets that will always be excluded from being selected - as scanners. List of dictionaries. + auto_confirm_ownership : dict + Conditions for auto confirmation of network ownership. + max_concurrent_tasks : int + Maximum number of scan tasks to run in parallel. + network_scanning_enabled : bool + Flag to enable or disable network scanning. + Setting to False attempts to stop ongoing scans + and prevents further scans from executing. + scan_exclusion : dict (required) + Scan target exclusions including common as well as zone-level exclusions + (individual IPs, IP ranges, CIDRs) + scanners : list[dict] + List of assets that will act as eligible scanners. + scanners_exclusion : list[dict] + List of assets that will always be excluded from being selected + as scanners. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-global-configs/update_global_configs + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = network_scan_global_configs_payload(passed_keywords=kwargs) diff --git a/src/falconpy/network_scan_networks.py b/src/falconpy/network_scan_networks.py index ccfcabc13..ba95a3b86 100644 --- a/src/falconpy/network_scan_networks.py +++ b/src/falconpy/network_scan_networks.py @@ -63,8 +63,16 @@ def aggregate_networks(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Return network aggregations. - Keyword arguments: - body -- Full body payload as a list of dictionaries in JSON format. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-networks/aggregate_networks + + Keyword arguments + ----------------- + body : list + Full body payload as a list of dictionaries in JSON format. Not required if using other keywords. [ { "date_ranges": [ @@ -99,33 +107,49 @@ def aggregate_networks(self: object, "type": "string" } ] - date_ranges -- Array of date range specifications for date-based aggregations. List of dictionaries. - exclude -- Fields to exclude from the aggregation. String. - field -- The field to aggregate on. String. - filter -- FQL query to filter the data before aggregating. String. - from -- Starting index for the aggregation. Integer. - include -- Fields to include in the aggregation. String. - interval -- Time interval for date histogram aggregations (e.g., day, week, month). String. - max_doc_count -- Maximum document count for bucket inclusion. Integer. - min_doc_count -- Minimum document count for bucket inclusion. Integer. - missing -- The value to use for documents missing the aggregation field. String. - name -- The name of the aggregation query. String. - q -- Full-text search query string. String. - ranges -- Numeric range specifications for range aggregations. List of dictionaries. - size -- The maximum number of results to return per aggregate. Integer. - sort -- The field to sort aggregate results on. String. - sub_aggregates -- Nested sub-aggregation specifications. List of dictionaries. - time_zone -- The time zone to use for date aggregations. String. - type -- The type of aggregate query to perform. String. + date_ranges : list[dict] + Array of date range specifications for date-based aggregations. + exclude : str + Fields to exclude from the aggregation. + field : str + The field to aggregate on. + filter : str + FQL query to filter the data before aggregating. + from : int + Starting index for the aggregation. + include : str + Fields to include in the aggregation. + interval : str + Time interval for date histogram aggregations (e.g., day, week, month) + max_doc_count : int + Maximum document count for bucket inclusion. + min_doc_count : int + Minimum document count for bucket inclusion. + missing : str + The value to use for documents missing the aggregation field. + name : str + The name of the aggregation query. + q : str + Full-text search query. + ranges : list[dict] + Numeric range specifications for range aggregations. + size : int + The maximum number of results to return per aggregate. + sort : str + The field to sort aggregate results on. + sub_aggregates : list[dict] + Nested sub-aggregation specifications. + time_zone : str + The time zone to use for date aggregations. + type : str + The type of aggregate query to perform. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-networks/aggregate_networks + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -145,19 +169,28 @@ def get_networks(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get networks by their IDs. - Keyword arguments: - ids -- IDs of networks to be retrieved (Min: 1, Max: 100). String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-networks/get_networks + + Keyword arguments + ----------------- + ids : str or list[str] + IDs of networks to be retrieved (Min: 1, Max: 100) + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -174,8 +207,16 @@ def create_networks(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create networks using provided specifications. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-networks/create_networks + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "name": "string", "scanner_aids": [ @@ -185,21 +226,24 @@ def create_networks(self: object, "subnet": "string", "zone_id": "string" } - name -- The name given to the network. Required. String. - scanner_aids -- The set of scanners assigned to the network. List of strings. - scanner_assignment_type -- The scanner assignment type for the network. - Allowed values: local, zone, manual. String. - subnet -- The subnet included in the network. Required. String. - zone_id -- The zone to which the network is assigned. Required. String. + name : str (required) + The name given to the network. + scanner_aids : str or list[str] + The set of scanners assigned to the network. + scanner_assignment_type : str + The scanner assignment type for the network. + Allowed values: local, zone, manual. + subnet : str (required) + The subnet included in the network. + zone_id : str (required) + The zone to which the network is assigned. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-networks/create_networks + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = network_scan_network_create_payload(passed_keywords=kwargs) @@ -218,8 +262,16 @@ def update_networks(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update networks using provided specifications. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-networks/update_networks + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "id": "string", "name": "string", @@ -230,23 +282,27 @@ def update_networks(self: object, "scanner_assignment_type": "string", "zone_id": "string" } - id -- The unique identifier of the network to update. Required. String. - name -- The name given to the network. String. - ownership -- Indicates ownership of the network. - Allowed values: unknown, confirmed, denied. String. - scanner_aids -- The set of scanners assigned to the network. List of strings. - scanner_assignment_type -- The scanner assignment type for the network. - Allowed values: local, zone, manual. String. - zone_id -- The zone to which the network is assigned. String. + id : str (required) + The unique identifier of the network to update. + name : str + The name given to the network. + ownership : str + Indicates ownership of the network. + Allowed values: unknown, confirmed, denied. + scanner_aids : str or list[str] + The set of scanners assigned to the network. + scanner_assignment_type : str + The scanner assignment type for the network. + Allowed values: local, zone, manual. + zone_id : str + The zone to which the network is assigned. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-networks/update_networks + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = network_scan_network_update_payload(passed_keywords=kwargs) @@ -266,19 +322,28 @@ def delete_networks(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete networks by their IDs. - Keyword arguments: - ids -- IDs of networks to be deleted (Min: 1, Max: 100). String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-networks/delete_networks + + Keyword arguments + ----------------- + ids : str or list[str] + IDs of networks to be deleted (Min: 1, Max: 100) + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -295,24 +360,34 @@ def query_networks(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get network IDs by filter. - Keyword arguments: - offset -- An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide - an offset. On subsequent requests, add previous offset with the previous limit to continue from that place in - the results Integer. - limit -- The number of network IDs to return in this response - (Min: 1, Max: 100, Default: 100). Integer. - sort -- Sort networks by their properties. A single sort field is allowed. String. - filter -- Search for networks by providing an FQL filter. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-networks/query_networks + + Keyword arguments + ----------------- + offset : int + An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide + an offset. On subsequent requests, add previous offset with the previous limit to continue from that place in + the results. + limit : int + The number of network IDs to return in this response + (Min: 1, Max: 100, Default: 100) + sort : str + Sort networks by their properties. A single sort field is allowed. + filter : str + Search for networks by providing an FQL filter. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/network_scan_scan_run_reports.py b/src/falconpy/network_scan_scan_run_reports.py index 447ff1741..43fa99071 100644 --- a/src/falconpy/network_scan_scan_run_reports.py +++ b/src/falconpy/network_scan_scan_run_reports.py @@ -63,19 +63,28 @@ def get_scan_run_reports(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Download the scan run report in CSV format for the specified scan run ID. - Keyword arguments: - id -- Scan run ID for which report is to be fetched. Required. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-scan-run-reports/get_scan_run_reports + + Keyword arguments + ----------------- + id : str (required) + Scan run ID for which report is to be fetched. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/network_scan_scan_runs.py b/src/falconpy/network_scan_scan_runs.py index ed5010105..132a5e18e 100644 --- a/src/falconpy/network_scan_scan_runs.py +++ b/src/falconpy/network_scan_scan_runs.py @@ -63,8 +63,16 @@ def aggregate_scan_runs(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Return scan-runs aggregations. - Keyword arguments: - body -- Full body payload as a list of dictionaries in JSON format. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-scan-runs/aggregate_scan_runs + + Keyword arguments + ----------------- + body : list + Full body payload as a list of dictionaries in JSON format. [{ "date_ranges": [{}], "exclude": "string", @@ -85,14 +93,14 @@ def aggregate_scan_runs(self: object, "type": "string" }] - This method only supports keywords for providing arguments. - Returns: dict object containing API response. - HTTP Method: POST + This method only supports keywords for providing arguments. - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-scan-runs/aggregate_scan_runs + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -112,19 +120,28 @@ def get_scan_runs(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get scan-runs by their IDs. - Keyword arguments: - ids -- IDs of scan-runs to be retrieved (Min: 1, Max: 100). String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-scan-runs/get_scan_runs + + Keyword arguments + ----------------- + ids : str or list[str] + IDs of scan-runs to be retrieved (Min: 1, Max: 100) + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -141,8 +158,16 @@ def create_scan_runs(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create scan-runs using provided specifications. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-scan-runs/create_scan_runs + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "config": { "additional_tcp_ports": ["string"], @@ -198,17 +223,17 @@ def create_scan_runs(self: object, }, "scan_id": "string" } - config -- The scan run configuration. Dictionary. - scan_id -- The scan ID based on which to create a scan run. String. + config : dict + The scan run configuration. + scan_id : str + The scan ID based on which to create a scan run. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-scan-runs/create_scan_runs + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = scan_run_create_payload(passed_keywords=kwargs) @@ -227,23 +252,31 @@ def update_scan_runs(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update scan-runs using provided specifications. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-scan-runs/update_scan_runs + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "action": "string", "id": "string" } - action -- The action to be performed for the scan run. Allowed value: stop. String. - id -- The ID of the scan run to update. String. + action : str + The action to be performed for the scan run. Allowed value: stop. + id : str + The ID of the scan run to update. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-scan-runs/update_scan_runs + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = scan_run_update_payload(passed_keywords=kwargs) @@ -262,24 +295,34 @@ def query_scan_runs(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get scan-run IDs by filter. - Keyword arguments: - offset -- An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide - an offset. On subsequent requests, add previous offset with the previous limit to continue from that place in - the results Integer. - limit -- The number of scan-run IDs to return in this response (Min: 1, Max: 100, - Default: 100). Integer. - sort -- Sort scan-runs by their properties. A single sort field is allowed. String. - filter -- Search for scan-runs by providing an FQL filter. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-scan-runs/query_scan_runs + + Keyword arguments + ----------------- + offset : int + An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide + an offset. On subsequent requests, add previous offset with the previous limit to continue from that place in + the results. + limit : int + The number of scan-run IDs to return in this response (Min: 1, Max: 100, + Default: 100) + sort : str + Sort scan-runs by their properties. A single sort field is allowed. + filter : str + Search for scan-runs by providing an FQL filter. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/network_scan_scanners.py b/src/falconpy/network_scan_scanners.py index 23e583f43..5549eb499 100644 --- a/src/falconpy/network_scan_scanners.py +++ b/src/falconpy/network_scan_scanners.py @@ -63,8 +63,16 @@ def aggregate_scanners(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Return scanners aggregations. - Keyword arguments: - body -- Full body payload as a list of dictionaries in JSON format. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-scanners/aggregate_scanners + + Keyword arguments + ----------------- + body : list + Full body payload as a list of dictionaries in JSON format. [{ "date_ranges": [{}], "exclude": "string", @@ -85,14 +93,14 @@ def aggregate_scanners(self: object, "type": "string" }] - This method only supports keywords for providing arguments. - Returns: dict object containing API response. - HTTP Method: POST + This method only supports keywords for providing arguments. - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-scanners/aggregate_scanners + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -112,19 +120,28 @@ def get_scanners(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get scanners by their IDs. - Keyword arguments: - ids -- IDs of scanners to be retrieved (Min: 1, Max: 100). String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-scanners/get_scanners + + Keyword arguments + ----------------- + ids : str or list[str] + IDs of scanners to be retrieved (Min: 1, Max: 100) + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -141,26 +158,34 @@ def update_scanners(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update scanners using provided specifications. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-scanners/update_scanners + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "action": "string", "aids": [ "string" ] } - action -- The action to take on the provided set of scanners. - Allowed values: add, remove. Required. String. - aids -- The AIDs of scanners to act on. Required. List of strings. + action : str (required) + The action to take on the provided set of scanners. + Allowed values: add, remove. + aids : str or list[str] (required) + The AIDs of scanners to act on. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-scanners/update_scanners + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = network_scan_scanners_payload(passed_keywords=kwargs) @@ -179,24 +204,34 @@ def query_scanners(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get scanner IDs by filter. - Keyword arguments: - offset -- An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide - an offset. On subsequent requests, add previous offset with the previous limit to continue from that place in - the results Integer. - limit -- The number of scanner IDs to return in this response (Min: 1, Max: 100, - Default: 100). Integer. - sort -- Sort scanners by their properties. A single sort field is allowed. String. - filter -- Search for scanners by providing an FQL filter. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-scanners/query_scanners + + Keyword arguments + ----------------- + offset : int + An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide + an offset. On subsequent requests, add previous offset with the previous limit to continue from that place in + the results. + limit : int + The number of scanner IDs to return in this response (Min: 1, Max: 100, + Default: 100) + sort : str + Sort scanners by their properties. A single sort field is allowed. + filter : str + Search for scanners by providing an FQL filter. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/network_scan_scans.py b/src/falconpy/network_scan_scans.py index 01b628cde..4cddbab88 100644 --- a/src/falconpy/network_scan_scans.py +++ b/src/falconpy/network_scan_scans.py @@ -63,8 +63,16 @@ def aggregate_scans(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Return scans aggregations. - Keyword arguments: - body -- Full body payload as a list of dictionaries in JSON format. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-scans/aggregate_scansMixin0 + + Keyword arguments + ----------------- + body : list + Full body payload as a list of dictionaries in JSON format. Not required if using other keywords. [ { "date_ranges": [ @@ -99,33 +107,49 @@ def aggregate_scans(self: object, "type": "string" } ] - date_ranges -- Array of date range specifications for date-based aggregations. List of dictionaries. - exclude -- Fields to exclude from the aggregation. String. - field -- The field to aggregate on. String. - filter -- FQL query to filter the data before aggregating. String. - from -- Starting index for the aggregation. Integer. - include -- Fields to include in the aggregation. String. - interval -- Time interval for date histogram aggregations (e.g., day, week, month). String. - max_doc_count -- Maximum document count for bucket inclusion. Integer. - min_doc_count -- Minimum document count for bucket inclusion. Integer. - missing -- The value to use for documents missing the aggregation field. String. - name -- The name of the aggregation query. String. - q -- Full-text search query string. String. - ranges -- Numeric range specifications for range aggregations. List of dictionaries. - size -- The maximum number of results to return per aggregate. Integer. - sort -- The field to sort aggregate results on. String. - sub_aggregates -- Nested sub-aggregation specifications. List of dictionaries. - time_zone -- The time zone to use for date aggregations. String. - type -- The type of aggregate query to perform. String. + date_ranges : list[dict] + Array of date range specifications for date-based aggregations. + exclude : str + Fields to exclude from the aggregation. + field : str + The field to aggregate on. + filter : str + FQL query to filter the data before aggregating. + from : int + Starting index for the aggregation. + include : str + Fields to include in the aggregation. + interval : str + Time interval for date histogram aggregations (e.g., day, week, month) + max_doc_count : int + Maximum document count for bucket inclusion. + min_doc_count : int + Minimum document count for bucket inclusion. + missing : str + The value to use for documents missing the aggregation field. + name : str + The name of the aggregation query. + q : str + Full-text search query. + ranges : list[dict] + Numeric range specifications for range aggregations. + size : int + The maximum number of results to return per aggregate. + sort : str + The field to sort aggregate results on. + sub_aggregates : list[dict] + Nested sub-aggregation specifications. + time_zone : str + The time zone to use for date aggregations. + type : str + The type of aggregate query to perform. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-scans/aggregate_scansMixin0 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -145,19 +169,28 @@ def get_scans(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get scans by their IDs. - Keyword arguments: - ids -- IDs of scans to be retrieved (Min: 1, Max: 100). String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-scans/get_scans + + Keyword arguments + ----------------- + ids : str or list[str] + IDs of scans to be retrieved (Min: 1, Max: 100) + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -174,8 +207,16 @@ def create_scans(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create scans using provided specifications. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-scans/create_scans + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "block_windows": { "intervals": [ @@ -233,29 +274,40 @@ def create_scans(self: object, "target_type": "string", "template_id": "string" } - block_windows -- Block Windows configuration attached to the scan. Dictionary. - credentialed -- Indicates if the scan is credentialed. Boolean. - credentials -- The credentials for this scan. Dictionary. - description -- Description of the scan. String. - fragile_device_detection -- Indicates if the scan includes fragile-device detection. Required. Boolean. - name -- Name of the scan. Required. String. - scheduling -- Scheduling configuration attached to the scan. Dictionary. - target_asset -- The target asset for this scan (AIDs to be targeted). Dictionary. - target_asset_filter -- The target asset filter for this scan (FQL-based filter). Dictionary. - target_external_ip -- The target external IP for this scan. Dictionary. - target_ip -- The target IP for this scan. Dictionary. - target_type -- The type of the target for this scan. Required. String. - Allowed values: ip, asset, asset_filter, asset_vuln, external_ip. - template_id -- Template identifier for the scan. Required. String. + block_windows : dict + Block Windows configuration attached to the scan. + credentialed : bool + Indicates if the scan is credentialed. + credentials : dict + The credentials for this scan. + description : str + Description of the scan. + fragile_device_detection : bool (required) + Indicates if the scan includes fragile-device detection. + name : str (required) + Name of the scan. + scheduling : dict + Scheduling configuration attached to the scan. + target_asset : dict + The target asset for this scan (AIDs to be targeted) + target_asset_filter : dict + The target asset filter for this scan (FQL-based filter) + target_external_ip : dict + The target external IP for this scan. + target_ip : dict + The target IP for this scan. + target_type : str + The type of the target for this scan. Required. String. + Allowed values: ip, asset, asset_filter, asset_vuln, external_ip. + template_id : str (required) + Template identifier for the scan. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-scans/create_scans + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = network_scan_scan_create_payload(passed_keywords=kwargs) @@ -274,8 +326,16 @@ def update_scans(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update scans using provided specifications. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-scans/update_scans + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "block_windows": { "intervals": [ @@ -334,30 +394,42 @@ def update_scans(self: object, "target_type": "string", "template_id": "string" } - block_windows -- Block Windows configuration attached to the scan. Dictionary. - credentialed -- Indicates if the scan is credentialed. Required. Boolean. - credentials -- The credentials for this scan. Dictionary. - description -- Description of the scan. String. - fragile_device_detection -- Indicates if the scan includes fragile device detection. Boolean. - id -- ID of the scan to update. Required. String. - name -- Name of the scan. String. - scheduling -- Scheduling configuration attached to the scan. Dictionary. - target_asset -- The target asset associated with this scan (AIDs to be targeted). Dictionary. - target_asset_filter -- The target asset filter associated with this scan (FQL-based filter). Dictionary. - target_external_ip -- The target external IP associated with this scan. Dictionary. - target_ip -- The target IP associated with this scan. Dictionary. - target_type -- The type of the target scan. String. - Allowed values: ip, asset, asset_filter, asset_vuln, external_ip. - template_id -- Template ID of the scan. String. + block_windows : dict + Block Windows configuration attached to the scan. + credentialed : bool (required) + Indicates if the scan is credentialed. + credentials : dict + The credentials for this scan. + description : str + Description of the scan. + fragile_device_detection : bool + Indicates if the scan includes fragile device detection. + id : str (required) + ID of the scan to update. + name : str + Name of the scan. + scheduling : dict + Scheduling configuration attached to the scan. + target_asset : dict + The target asset associated with this scan (AIDs to be targeted) + target_asset_filter : dict + The target asset filter associated with this scan (FQL-based filter) + target_external_ip : dict + The target external IP associated with this scan. + target_ip : dict + The target IP associated with this scan. + target_type : str + The type of the target scan. String. + Allowed values: ip, asset, asset_filter, asset_vuln, external_ip. + template_id : str + Template ID of the scan. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-scans/update_scans + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = network_scan_scan_update_payload(passed_keywords=kwargs) @@ -377,19 +449,28 @@ def delete_scans(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete scans by their IDs. - Keyword arguments: - ids -- IDs of scans to be deleted (Min: 1, Max: 100). String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-scans/delete_scans + + Keyword arguments + ----------------- + ids : str or list[str] + IDs of scans to be deleted (Min: 1, Max: 100) + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -406,24 +487,34 @@ def query_scans(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get scan IDs by filter. - Keyword arguments: - offset -- An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide - an offset. On subsequent requests, add previous offset with the previous limit to continue from that place in - the results Integer. - limit -- The number of scan IDs to return in this response - (Min: 1, Max: 100, Default: 100). Integer. - sort -- Sort scans by their properties. A single sort field is allowed. String. - filter -- Search for scans by providing an FQL filter. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-scans/query_scansMixin0 + + Keyword arguments + ----------------- + offset : int + An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide + an offset. On subsequent requests, add previous offset with the previous limit to continue from that place in + the results. + limit : int + The number of scan IDs to return in this response + (Min: 1, Max: 100, Default: 100) + sort : str + Sort scans by their properties. A single sort field is allowed. + filter : str + Search for scans by providing an FQL filter. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/network_scan_templates.py b/src/falconpy/network_scan_templates.py index 83a93d750..844f7f752 100644 --- a/src/falconpy/network_scan_templates.py +++ b/src/falconpy/network_scan_templates.py @@ -63,17 +63,23 @@ def get_template_configs(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get details on the network scan template configurations. - Keyword arguments: - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-templates/get_template_configs + + Keyword arguments + ----------------- + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -91,19 +97,28 @@ def get_templates(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get templates by their IDs. - Keyword arguments: - ids -- IDs of templates to be retrieved (Min: 1, Max: 100). String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-templates/get_templates + + Keyword arguments + ----------------- + ids : str or list[str] + IDs of templates to be retrieved (Min: 1, Max: 100) + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -120,8 +135,16 @@ def create_templates(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create templates using provided specifications. - Keyword arguments: - body -- Full body payload as a list of dictionaries in JSON format. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-templates/create_templates + + Keyword arguments + ----------------- + body : dict + Full body payload as a list of dictionaries in JSON format. Not required if using other keywords. [ { "active_check_level": "string", @@ -142,28 +165,36 @@ def create_templates(self: object, "type": "string" } ] - active_check_level -- The active check level associated with the template. - Allowed values: active_check_safe_only, active_check_all. Required. String. - additional_tcp_ports -- Additional TCP ports associated with the template. List of strings. - additional_udp_ports -- Additional UDP ports associated with the template. List of strings. - auto_include_new_detections -- Automatically include new detections in the template. Boolean. - detections -- Detections associated with the template. List of strings. - ignore_tcp_resets -- Ignore TCP resets associated with the template. Boolean. - name -- The name given to the template. Required. String. - ports_scan_level -- The port scan level associated with the template. - Allowed values: default, all_ports, custom. Required. String. - scan_intensity -- The scan intensity at which scans will run from this template. - Allowed values: basic, standard, cautious, maximum. Required. String. - type -- The type of the template. Allowed values: discovery, assessment. Required. String. + active_check_level : str (required) + The active check level associated with the template. + Allowed values: active_check_safe_only, active_check_all. + additional_tcp_ports : str or list[str] + Additional TCP ports associated with the template. + additional_udp_ports : str or list[str] + Additional UDP ports associated with the template. + auto_include_new_detections : bool + Automatically include new detections in the template. + detections : str or list[str] + Detections associated with the template. + ignore_tcp_resets : bool + Ignore TCP resets associated with the template. + name : str (required) + The name given to the template. + ports_scan_level : str (required) + The port scan level associated with the template. + Allowed values: default, all_ports, custom. + scan_intensity : str (required) + The scan intensity at which scans will run from this template. + Allowed values: basic, standard, cautious, maximum. + type : str (required) + The type of the template. Allowed values: discovery, assessment. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-templates/create_templates + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = network_scan_template_create_payload(passed_keywords=kwargs) @@ -182,8 +213,16 @@ def update_templates(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update templates using provided specifications. - Keyword arguments: - body -- Full body payload as a list of dictionaries in JSON format. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-templates/update_templates + + Keyword arguments + ----------------- + body : dict + Full body payload as a list of dictionaries in JSON format. Not required if using other keywords. [ { "active_check_level": "string", @@ -204,28 +243,36 @@ def update_templates(self: object, "scan_intensity": "string" } ] - active_check_level -- The active check level associated with the template. - Allowed values: active_check_safe_only, active_check_all. String. - additional_tcp_ports -- Additional TCP ports associated with the template. List of strings. - additional_udp_ports -- Additional UDP ports associated with the template. List of strings. - auto_include_new_detections -- Automatically include new detections in the template. Boolean. - detections -- Detections associated with the template. List of strings. - id -- The unique identifier of the template to update. Required. String. - ignore_tcp_resets -- Ignore TCP resets associated with the template. Boolean. - name -- The name given to the template. String. - ports_scan_level -- The port scan level associated with the template. - Allowed values: default, all_ports, custom. String. - scan_intensity -- The scan intensity at which scans will run from this template. - Allowed values: basic, standard, cautious, maximum. String. + active_check_level : str + The active check level associated with the template. + Allowed values: active_check_safe_only, active_check_all. + additional_tcp_ports : str or list[str] + Additional TCP ports associated with the template. + additional_udp_ports : str or list[str] + Additional UDP ports associated with the template. + auto_include_new_detections : bool + Automatically include new detections in the template. + detections : str or list[str] + Detections associated with the template. + id : str (required) + The unique identifier of the template to update. + ignore_tcp_resets : bool + Ignore TCP resets associated with the template. + name : str + The name given to the template. + ports_scan_level : str + The port scan level associated with the template. + Allowed values: default, all_ports, custom. + scan_intensity : str + The scan intensity at which scans will run from this template. + Allowed values: basic, standard, cautious, maximum. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-templates/update_templates + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = network_scan_template_update_payload(passed_keywords=kwargs) @@ -245,19 +292,28 @@ def delete_templates(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete templates by their IDs. - Keyword arguments: - ids -- IDs of templates to be deleted (Min: 1, Max: 100). String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-templates/delete_templates + + Keyword arguments + ----------------- + ids : str or list[str] + IDs of templates to be deleted (Min: 1, Max: 100) + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -274,24 +330,34 @@ def query_templates(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get template IDs by filter. - Keyword arguments: - offset -- An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide - an offset. On subsequent requests, add previous offset with the previous limit to continue from that place in - the results Integer. - limit -- The number of template IDs to return in this response - (Min: 1, Max: 100, Default: 100). Integer. - sort -- Sort templates by their properties. A single sort field is allowed. String. - filter -- Search for templates by providing an FQL filter. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-templates/query_templates + + Keyword arguments + ----------------- + offset : int + An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide + an offset. On subsequent requests, add previous offset with the previous limit to continue from that place in + the results. + limit : int + The number of template IDs to return in this response + (Min: 1, Max: 100, Default: 100) + sort : str + Sort templates by their properties. A single sort field is allowed. + filter : str + Search for templates by providing an FQL filter. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/network_scan_zones.py b/src/falconpy/network_scan_zones.py index 5789d32bb..4ddceab71 100644 --- a/src/falconpy/network_scan_zones.py +++ b/src/falconpy/network_scan_zones.py @@ -63,8 +63,16 @@ def aggregate_zones(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Return zone aggregations. - Keyword arguments: - body -- Full body payload as a list of dictionaries in JSON format. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-zones/aggregate_zones + + Keyword arguments + ----------------- + body : list + Full body payload as a list of dictionaries in JSON format. Not required if using other keywords. [ { "date_ranges": [ @@ -99,33 +107,49 @@ def aggregate_zones(self: object, "type": "string" } ] - date_ranges -- Array of date range specifications for date-based aggregations. List of dictionaries. - exclude -- Fields to exclude from the aggregation. String. - field -- The field to aggregate on. String. - filter -- FQL query to filter the data before aggregating. String. - from -- Starting index for the aggregation. Integer. - include -- Fields to include in the aggregation. String. - interval -- Time interval for date histogram aggregations (e.g., day, week, month). String. - max_doc_count -- Maximum document count for bucket inclusion. Integer. - min_doc_count -- Minimum document count for bucket inclusion. Integer. - missing -- The value to use for documents missing the aggregation field. String. - name -- The name of the aggregation query. String. - q -- Full-text search query string. String. - ranges -- Numeric range specifications for range aggregations. List of dictionaries. - size -- The maximum number of results to return per aggregate. Integer. - sort -- The field to sort aggregate results on. String. - sub_aggregates -- Nested sub-aggregation specifications. List of dictionaries. - time_zone -- The time zone to use for date aggregations. String. - type -- The type of aggregate query to perform. String. + date_ranges : list[dict] + Array of date range specifications for date-based aggregations. + exclude : str + Fields to exclude from the aggregation. + field : str + The field to aggregate on. + filter : str + FQL query to filter the data before aggregating. + from : int + Starting index for the aggregation. + include : str + Fields to include in the aggregation. + interval : str + Time interval for date histogram aggregations (e.g., day, week, month) + max_doc_count : int + Maximum document count for bucket inclusion. + min_doc_count : int + Minimum document count for bucket inclusion. + missing : str + The value to use for documents missing the aggregation field. + name : str + The name of the aggregation query. + q : str + Full-text search query. + ranges : list[dict] + Numeric range specifications for range aggregations. + size : int + The maximum number of results to return per aggregate. + sort : str + The field to sort aggregate results on. + sub_aggregates : list[dict] + Nested sub-aggregation specifications. + time_zone : str + The time zone to use for date aggregations. + type : str + The type of aggregate query to perform. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-zones/aggregate_zones + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -144,23 +168,33 @@ def combined_zones(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get zones by filter. - Keyword arguments: - offset -- An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide - an offset. On subsequent requests, add previous offset with the previous limit to continue from that place in - the results Integer. - limit -- The number of zones to return in this response (Min: 1, Max: 100, Default: 100). Integer. - sort -- Sort zones by their properties. A single sort field is allowed. String. - filter -- Search for zones by providing an FQL filter. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-zones/combined_zones + + Keyword arguments + ----------------- + offset : int + An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide + an offset. On subsequent requests, add previous offset with the previous limit to continue from that place in + the results. + limit : int + The number of zones to return in this response (Min: 1, Max: 100, Default: 100) + sort : str + Sort zones by their properties. A single sort field is allowed. + filter : str + Search for zones by providing an FQL filter. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -178,19 +212,28 @@ def get_zones(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get zones by their IDs. - Keyword arguments: - ids -- IDs of zones to be retrieved (Min: 1, Max: 100). String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-zones/get_zones + + Keyword arguments + ----------------- + ids : str or list[str] + IDs of zones to be retrieved (Min: 1, Max: 100) + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -207,8 +250,16 @@ def create_zones(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create zones using provided specifications. - Keyword arguments: - body -- Full body payload as a list of dictionaries in JSON format. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-zones/create_zones + + Keyword arguments + ----------------- + body : dict + Full body payload as a list of dictionaries in JSON format. Not required if using other keywords. [ { "name": "string", @@ -217,17 +268,17 @@ def create_zones(self: object, ] } ] - name -- The name given to the zone. Required. String. - scanners -- The set of scanner AIDs assigned to the zone. List of strings. + name : str (required) + The name given to the zone. + scanners : str or list[str] + The set of scanner AIDs assigned to the zone. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-zones/create_zones + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [network_scan_zone_create_payload(passed_keywords=kwargs)] @@ -246,8 +297,16 @@ def update_zones(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update zones using provided specifications. - Keyword arguments: - body -- Full body payload as a list of dictionaries in JSON format. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-zones/update_zones + + Keyword arguments + ----------------- + body : dict + Full body payload as a list of dictionaries in JSON format. Not required if using other keywords. [ { "id": "string", @@ -260,19 +319,21 @@ def update_zones(self: object, ] } ] - id -- The unique identifier of the zone to update. Required. String. - name -- The name given to the zone. String. - scanners_to_add -- The scanner AIDs to be added to the zone. List of strings. - scanners_to_remove -- The scanner AIDs to be removed from the zone. List of strings. + id : str (required) + The unique identifier of the zone to update. + name : str + The name given to the zone. + scanners_to_add : str or list[str] + The scanner AIDs to be added to the zone. + scanners_to_remove : str or list[str] + The scanner AIDs to be removed from the zone. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-zones/update_zones + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [network_scan_zone_update_payload(passed_keywords=kwargs)] @@ -292,19 +353,28 @@ def delete_zones(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete zones by their IDs. - Keyword arguments: - ids -- IDs of zones to be deleted (Min: 1, Max: 100). String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-zones/delete_zones + + Keyword arguments + ----------------- + ids : str or list[str] + IDs of zones to be deleted (Min: 1, Max: 100) + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -321,23 +391,33 @@ def query_zones(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get zone IDs by filter. - Keyword arguments: - offset -- An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide - an offset. On subsequent requests, add previous offset with the previous limit to continue from that place in - the results Integer. - limit -- The number of zone IDs to return in this response (Min: 1, Max: 100, Default: 100). Integer. - sort -- Sort zones by their properties. A single sort field is allowed. String. - filter -- Search for zones by providing an FQL filter. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/network-scan-zones/query_zones + + Keyword arguments + ----------------- + offset : int + An offset used with the limit parameter to manage pagination of results. On your first request, don’t provide + an offset. On subsequent requests, add previous offset with the previous limit to continue from that place in + the results. + limit : int + The number of zone IDs to return in this response (Min: 1, Max: 100, Default: 100) + sort : str + Sort zones by their properties. A single sort field is allowed. + filter : str + Search for zones by providing an FQL filter. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/ngsiem.py b/src/falconpy/ngsiem.py index 198ef541d..14cee07e6 100644 --- a/src/falconpy/ngsiem.py +++ b/src/falconpy/ngsiem.py @@ -61,6 +61,21 @@ bulk_update_saved_queries_from_template_payload, create_parser_extension_payload, update_parser_extension_payload, + add_dashboard_labels_payload, + add_file_labels_payload, + add_saved_query_labels_payload, + bulk_add_dashboard_labels_payload, + bulk_add_lookup_file_labels_payload, + bulk_add_saved_query_labels_payload, + bulk_remove_dashboard_labels_payload, + bulk_remove_lookup_file_labels_payload, + bulk_remove_saved_query_labels_payload, + bulk_update_dashboard_labels_payload, + bulk_update_lookup_file_labels_payload, + bulk_update_saved_query_labels_payload, + update_dashboard_labels_payload, + update_file_labels_payload, + update_saved_query_labels_payload, ) from ._result import Result from ._service_class import ServiceClass @@ -86,19 +101,27 @@ def upload_file(self: object, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Upload file to NGSIEM. - Keyword arguments: - lookup_file -- File to be uploaded. Binary data. (CSV format) - repository -- Name of the repository. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/UploadLookupV1 + + Keyword arguments + ----------------- + lookup_file : str + File to be uploaded. Binary data. (CSV format) + repository : str + Name of the repository. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if kwargs.get("lookup_file", None): lookup_file = kwargs.get("lookup_file", None) @@ -153,20 +176,28 @@ def get_file(self: object, **kwargs) -> Union[Dict[str, Union[int, dict]], Result, Response]: """Download lookup file from NGSIEM. - Keyword arguments: - repository -- Name of the repository. String. - filename -- Name of the lookup file. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - stream -- Enable streaming download of the returned file. Boolean. - - This method only supports keywords for providing arguments. - - Returns: binary object on SUCCESS, dict object containing API response on FAILURE. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/humio-auth-proxy/GetLookupV1 + + Keyword arguments + ----------------- + repository : str + Name of the repository. + filename : str + Name of the lookup file. + parameters : dict + Full parameters payload. Not required if using other keywords. + stream : bool + Enable streaming download of the returned file. + + This method only supports keywords for providing arguments. + + Returns + ------- + binary object on SUCCESS, dict object containing API response on FAILURE. """ repository = kwargs.get("repository", None) filename = kwargs.get("filename", None) @@ -198,23 +229,33 @@ def get_file_from_package_with_namespace(self: object, ) -> Union[Dict[str, Union[int, dict]], Result, Response]: """Download lookup file in namespaced package from NGSIEM. - Keyword arguments: - repository -- Name of repository. String. - namespace -- Name of namespace. String. - package -- Name of package. String. - filename -- Name of lookup file. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - stream -- Enable streaming download of the returned file. Boolean. - - This method only supports keywords for providing arguments. - - Returns: binary object on SUCCESS, dict object containing API response on FAILURE. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /humio-auth-proxy/GetLookupFromPackageWithNamespaceV1 + /humio-auth-proxy/GetLookupFromPackageWithNamespaceV1 + + Keyword arguments + ----------------- + repository : str + Name of repository. + namespace : str + Name of namespace. + package : str + Name of package. + filename : str + Name of lookup file. + parameters : dict + Full parameters payload. Not required if using other keywords. + stream : bool + Enable streaming download of the returned file. + + This method only supports keywords for providing arguments. + + Returns + ------- + binary object on SUCCESS, dict object containing API response on FAILURE. """ repository = kwargs.get("repository", False) filename = kwargs.get("filename", False) @@ -251,21 +292,30 @@ def get_file_from_package(self: object, **kwargs) -> Union[Dict[str, Union[int, dict]], Result, Response]: """Download lookup file in package from NGSIEM. - Keyword arguments: - repository -- Name of repository. String. - package -- Name of package. String. - filename -- Name of lookup file. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - stream -- Enable streaming download of the returned response. Boolean. - - This method only supports keywords for providing arguments. - - Returns: binary object on SUCCESS, dict object containing API response on FAILURE. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/humio-auth-proxy/GetLookupFromPackageV1 + + Keyword arguments + ----------------- + repository : str + Name of repository. + package : str + Name of package. + filename : str + Name of lookup file. + parameters : dict + Full parameters payload. Not required if using other keywords. + stream : bool + Enable streaming download of the returned response. + + This method only supports keywords for providing arguments. + + Returns + ------- + binary object on SUCCESS, dict object containing API response on FAILURE. """ repository = kwargs.get("repository", None) filename = kwargs.get("filename", None) @@ -300,13 +350,25 @@ def start_search(self: object, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Initiate search. - Keyword arguments: - allow_event_skipping -- Flag indicating if event skipping is allowed. Boolean. - arguments -- Search arguments in JSON format. Dictionary. - around -- Search proximity arguments. Dictionary. - autobucket_count -- Number of events per bucket. Integer. - body -- Full body payload as a JSON dictionary. - Not required if using the search argument or other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/humio-auth-proxy/StartSearchV1 + + Keyword arguments + ----------------- + allow_event_skipping : bool + Flag indicating if event skipping is allowed. + arguments : dict + Search arguments in JSON format. + around : dict + Search proximity arguments. + autobucket_count : int + Number of events per bucket. + body : dict + Full body payload as a JSON dictionary. + Not required if using the search argument or other keywords. { "allowEventSkipping": boolean, "arguments": {}, @@ -327,52 +389,61 @@ def start_search(self: object, "timeZoneOffsetMinutes": integer, "useIngestTime": boolean } - end -- Last event limit. String. - ingest_end -- Ingest maximum. Integer. - ingest_start -- Ingest start. Integer. - is_live -- Flag indicating if this is a live search. Boolean. - parameters -- Full parameters payload dictionary. Not required if using repository keyword. - query_string -- Search query string. String. - repository -- Name of repository. Required. String. - search -- Search to perform. JSON formatted string. Can be used instead of body. - Not required if using other keywords. - { - "allowEventSkipping": boolean, - "arguments": {}, - "around": { - "eventId": "string", - "numberOfEventsAfter": integer, - "numberOfEventsBefore": integer, - "timestamp": integer - }, - "autobucketCount": integer, - "end": "string", - "ingestEnd": "string", - "ingestStart": "string", - "isLive": boolean, - "queryString": "string", - "start": "string", - "timeZone": "string", - "timeZoneOffsetMinutes": integer, - "useIngestTime": boolean - } - start -- Search starting time range. Start. - timezone -- Timezone applied to the search. String. - timezone_offset_minutes -- Timezone offset. Integer. + end : str + Last event limit. + ingest_end : int + Ingest maximum. + ingest_start : int + Ingest start. + is_live : bool + Flag indicating if this is a live search. + parameters : dict + Full parameters payload dictionary. Not required if using repository keyword. + query_string : str + Search query. + repository : str (required) + Name of repository. + search : str + Search to perform. JSON formatted string. Can be used instead of body. + Not required if using other keywords. + { + "allowEventSkipping": boolean, + "arguments": {}, + "around": { + "eventId": "string", + "numberOfEventsAfter": integer, + "numberOfEventsBefore": integer, + "timestamp": integer + }, + "autobucketCount": integer, + "end": "string", + "ingestEnd": "string", + "ingestStart": "string", + "isLive": boolean, + "queryString": "string", + "start": "string", + "timeZone": "string", + "timeZoneOffsetMinutes": integer, + "useIngestTime": boolean + } + start : str + Search starting time range. Start. + timezone : str + Timezone applied to the search. + timezone_offset_minutes : int + Timezone offset. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/humio-auth-proxy/StartSearchV1 + Returns + ------- + dict + Dictionary object containing API response. """ repository = kwargs.get("repository", None) - search = kwargs.get("search", None) + search = kwargs.get("search", None) or body - if not body and not search: + if not search: search = ngsiem_search_payload(kwargs) if repository and search: @@ -403,24 +474,37 @@ def get_search_status(self: object, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get status of search. - Keyword arguments: - repository -- Name of repository. String. - id -- ID of the query. String. Can be used instead of search_id keyword. - search_id -- ID of the query. String. Can be used instead of id keyword. - paginationLimit -- Optional pagination limit. Integer. - paginationOffset -- Optional pagination offset. Integer. - pagination_limit -- Optional pagination limit (alias for paginationLimit). Integer. - pagination_offset -- Optional pagination offset (alias for paginationOffset). Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/humio-auth-proxy/GetSearchStatusV1 + + Keyword arguments + ----------------- + repository : str + Name of repository. + id : str + ID of the query. String. Can be used instead of search_id keyword. + search_id : str + ID of the query. String. Can be used instead of id keyword. + paginationLimit : int + Optional pagination limit. + paginationOffset : int + Optional pagination offset. + pagination_limit : int + Optional pagination limit (alias for paginationLimit) + pagination_offset : int + Optional pagination offset (alias for paginationOffset) + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ repository = kwargs.get("repository", None) search_id = kwargs.get("id", kwargs.get("search_id", None)) @@ -459,20 +543,29 @@ def stop_search(self: object, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Stop search. - Keyword arguments: - repository -- Name of repository. String. - id -- ID of the query. String. Can be used instead of search_id keyword. - search_id -- ID of the query. String. Can be used instead of id keyword. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/humio-auth-proxy/StopSearchV1 + + Keyword arguments + ----------------- + repository : str + Name of repository. + id : str + ID of the query. String. Can be used instead of search_id keyword. + search_id : str + ID of the query. String. Can be used instead of id keyword. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ repository = kwargs.get("repository", None) search_id = kwargs.get("id", kwargs.get("search_id", None)) @@ -503,22 +596,30 @@ def stop_search(self: object, def get_dashboard_template(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve Dashboard in NGSIEM as LogScale YAML Template. - Keyword arguments: - ids -- Dashboard ID value. String. - search_domain -- Name of search domain (view or repo). String. - Allowed options: - all falcon - third-party dashboards - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/GetDashboardTemplate + + Keyword arguments + ----------------- + ids : str or list[str] + Dashboard ID value. + search_domain : str + Name of search domain (view or repo). String. + Allowed options: + all falcon + third-party dashboards + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -535,24 +636,33 @@ def create_dashboard_from_template(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create Dashboard from LogScale YAML Template in NGSIEM. - Keyword arguments: - search_domain -- Name of search domain (view or repo). String. - Allowed options: - all - falcon - third-party - name -- Name of the dashboard. String. - yaml_template -- LogScale dashboard YAML template content, see schema at https://schemas.humio.com/. Binary data. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/CreateDashboardFromTemplate + + Keyword arguments + ----------------- + search_domain : str + Name of search domain (view or repo). String. + Allowed options: + all + falcon + third-party + name : str + Name of the dashboard. + yaml_template : bytes + LogScale dashboard YAML template content, see schema at https://schemas.humio.com/ + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ yaml_data = kwargs.get("yaml_template", None) file_extended = {} @@ -585,24 +695,33 @@ def update_dashboard_from_template(self: object, Please note a successful update will result in a new ID value being returned. - Keyword arguments: - search_domain -- Name of search domain (view or repo). String. - Allowed options: - all - falcon - third-party - name -- Name of the dashboard. String. - yaml_template -- LogScale dashboard YAML template content, see schema at https://schemas.humio.com/. Binary data. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/UpdateDashboardFromTemplate + + Keyword arguments + ----------------- + search_domain : str + Name of search domain (view or repo). String. + Allowed options: + all + falcon + third-party + name : str + Name of the dashboard. + yaml_template : bytes + LogScale dashboard YAML template content, see schema at https://schemas.humio.com/ + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ yaml_data = kwargs.get("yaml_template", None) file_extended = {} @@ -630,23 +749,31 @@ def update_dashboard_from_template(self: object, def delete_dashboard(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete Dashboard in NGSIEM. - Keyword arguments: - ids -- Dashboard ID to be removed. String. - search_domain -- name of search domain (view or repo). String. - Allowed options: - all - falcon - third-party - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/DeleteDashboard + + Keyword arguments + ----------------- + ids : str or list[str] + Dashboard ID to be removed. + search_domain : str + name of search domain (view or repo). String. + Allowed options: + all + falcon + third-party + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -660,23 +787,31 @@ def delete_dashboard(self: object, parameters: dict = None, **kwargs) -> Union[D def get_lookup_file(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve Lookup File in NGSIEM. - Keyword arguments: - filename -- Lookup file filename. String. - search_domain -- Name of search domain (view or repo). String. - Allowed options: - all falcon - third-party dashboards - parsers-repository - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/GetLookupFile + + Keyword arguments + ----------------- + filename : str + Lookup file filename. + search_domain : str + Name of search domain (view or repo). String. + Allowed options: + all falcon + third-party dashboards + parsers-repository + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -690,23 +825,32 @@ def get_lookup_file(self: object, parameters: dict = None, **kwargs) -> Union[Di def create_lookup_file(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create Lookup File in NGSIEM. - Keyword arguments: - search_domain -- Name of search domain (view or repo). String. - Allowed options: - all falcon - third-party parsers-repository - filename -- Filename of the lookup file to create. String. - file -- File content to upload. Binary data. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/CreateLookupFile + + Keyword arguments + ----------------- + search_domain : str + Name of search domain (view or repo). String. + Allowed options: + all falcon + third-party parsers-repository + filename : str + Filename of the lookup file to create. + file : bytes + File content to upload. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ file_name = kwargs.get("filename", None) file_data = kwargs.get("file", None) @@ -731,23 +875,32 @@ def create_lookup_file(self: object, parameters: dict = None, **kwargs) -> Union def update_lookup_file(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update Lookup File in NGSIEM. - Keyword arguments: - search_domain -- Name of search domain (view or repo). String. - Allowed options: - all falcon - third-party parsers-repository - filename -- Filename of the lookup file to create. String. - file -- File content to upload. Binary data. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/UpdateLookupFile + + Keyword arguments + ----------------- + search_domain : str + Name of search domain (view or repo). String. + Allowed options: + all falcon + third-party parsers-repository + filename : str + Filename of the lookup file to create. + file : bytes + File content to upload. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ file_name = kwargs.get("filename", None) file_data = kwargs.get("file", None) @@ -772,23 +925,31 @@ def update_lookup_file(self: object, parameters: dict = None, **kwargs) -> Union def delete_lookup_file(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete Lookup File in NGSIEM. - Keyword arguments: - filename -- Lookup file filename. String. - search_domain -- Name of search domain (view or repo). String. - Allowed options: - all falcon - third-party dashboards - parsers-repository - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/DeleteLookupFile + + Keyword arguments + ----------------- + filename : str or list[str] + Lookup file filename. + search_domain : str + Name of search domain (view or repo). String. + Allowed options: + all falcon + third-party dashboards + parsers-repository + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -802,23 +963,31 @@ def delete_lookup_file(self: object, parameters: dict = None, **kwargs) -> Union def clone_parser(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Clone an existing parser with a new name. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/CloneParser + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "new_name": "string", "source_id": "string" } - new_name -- The name for the cloned parser. String. Required. - source_id -- The ID of the source parser to clone. String. Required. + new_name : str (required) + The name for the cloned parser. + source_id : str (required) + The ID of the source parser to clone. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/CloneParser + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = ngsiem_clone_parser_payload(passed_keywords=kwargs) @@ -837,20 +1006,28 @@ def test_parser_from_template(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Test Parser from LogScale YAML Template in NGSIEM. - Keyword arguments: - yaml_template -- LogScale Parser YAML template content, see schema at https://schemas.humio.com/. Binary data. - schema_validation_enabled -- When true, schema validation is enforced (CPS) and validates against Crowdstrike Parsing - Standard. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/TestParserFromTemplate + + Keyword arguments + ----------------- + yaml_template : bytes + LogScale Parser YAML template content, see schema at https://schemas.humio.com/ + schema_validation_enabled : bool + When true, schema validation is enforced (CPS) and validates against Crowdstrike Parsing + Standard. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ yaml_data = kwargs.get("yaml_template", None) if yaml_data: @@ -872,20 +1049,28 @@ def test_parser_from_template(self: object, def get_parser_template(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve Parser in NGSIEM as LogScale YAML Template. - Keyword arguments: - ids -- Parser ID to retrieve. String. - repository -- Name of repository. String. - Allowed options: parsers-repository - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/GetParserTemplate + + Keyword arguments + ----------------- + ids : str + Parser ID to retrieve. + repository : str + Name of repository. String. + Allowed options: parsers-repository + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -902,21 +1087,30 @@ def create_parser_from_template(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create Parser from LogScale YAML Template in NGSIEM. - Keyword arguments: - repository -- Name of repository. String. - Allowed options: parsers-repository - name -- Name of the parser. String. - yaml_template -- LogScale dashboard YAML template content, see schema at https://schemas.humio.com/. Binary data. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/CreateParserFromTemplate + + Keyword arguments + ----------------- + repository : str + Name of repository. String. + Allowed options: parsers-repository + name : str + Name of the parser. + yaml_template : bytes + LogScale dashboard YAML template content, see schema at https://schemas.humio.com/ + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ yaml_data = kwargs.get("yaml_template", None) file_extended = {} @@ -944,20 +1138,28 @@ def create_parser_from_template(self: object, def get_parser(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve Parser in NGSIEM. - Keyword arguments: - ids -- Parser ID to retrieve. String. - repository -- Name of repository. String. - Allowed options: parsers-repository - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/GetParser + + Keyword arguments + ----------------- + ids : str + Parser ID to retrieve. + repository : str + Name of repository. String. + Allowed options: parsers-repository + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -971,8 +1173,16 @@ def get_parser(self: object, parameters: dict = None, **kwargs) -> Union[Dict[st def create_parser(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create Parser in NGSIEM. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/CreateParser + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "fields_to_be_removed_before_parsing": [ "string" @@ -1007,21 +1217,25 @@ def create_parser(self: object, body: dict = None, **kwargs) -> Union[Dict[str, } ] } - fields_to_be_removed_before_parsing -- List of fields to remove before parsing. String or list of strings. - fields_to_tag -- List of fields to tag. String or list of strings. - name -- Parser name. String. - repository -- Parser repository. String. - script -- Parser script. String. - test_cases -- List of test cases to apply to the parser. List of dictionaries. + fields_to_be_removed_before_parsing : str or list[str] + List of fields to remove before parsing. + fields_to_tag : str or list[str] + List of fields to tag. + name : str + Parser name. + repository : str + Parser repository. + script : str + Parser script. + test_cases : list[dict] + List of test cases to apply to the parser. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/CreateParser + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = ngsiem_parser_payload(passed_keywords=kwargs) @@ -1039,8 +1253,16 @@ def update_parser(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Please note that name changes are not supported, but rather should be created as a new parser. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/UpdateParser + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "fields_to_be_removed_before_parsing": [ "string" @@ -1075,22 +1297,27 @@ def update_parser(self: object, body: dict = None, **kwargs) -> Union[Dict[str, } ] } - fields_to_be_removed_before_parsing -- List of fields to remove before parsing. String or list of strings. - fields_to_tag -- List of fields to tag. String or list of strings. - id -- ID of the parser to be updated. String. - name -- Parser name. String. - repository -- Parser repository. String. - script -- Parser script. String. - test_cases -- List of test cases to apply to the parser. List of dictionaries. + fields_to_be_removed_before_parsing : str or list[str] + List of fields to remove before parsing. + fields_to_tag : str or list[str] + List of fields to tag. + id : str + ID of the parser to be updated. + name : str + Parser name. + repository : str + Parser repository. + script : str + Parser script. + test_cases : list[dict] + List of test cases to apply to the parser. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/UpdateParser + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = ngsiem_parser_payload(passed_keywords=kwargs) @@ -1112,21 +1339,30 @@ def update_parser_from_template(self: object, Please note that name changes are not supported, but rather should be created as a new parser. - Keyword arguments: - repository -- Name of repository. String. - Allowed options: parsers-repository - ids -- ID of the parser. String. - yaml_template -- LogScale Parser YAML template content, see schema at https://schemas.humio.com/. Binary data. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/UpdateParserFromTemplate + + Keyword arguments + ----------------- + repository : str + Name of repository. String. + Allowed options: parsers-repository + ids : str + ID of the parser. + yaml_template : bytes + LogScale Parser YAML template content, see schema at https://schemas.humio.com/ + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ yaml_data = kwargs.get("yaml_template", None) file_extended = {} @@ -1154,20 +1390,28 @@ def update_parser_from_template(self: object, def delete_parser(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete Parser in NGSIEM. - Keyword arguments: - ids -- Parser ID to be removed. String. - repository -- Name of repository. - Allowed options: parsers-repository - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/DeleteParser + + Keyword arguments + ----------------- + ids : str + Parser ID to be removed. + repository : str + Name of repository. + Allowed options: parsers-repository + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1186,23 +1430,31 @@ def update_parser_auto_update_policy(self: object, Enables or disables auto-updates for parsers. - Keyword arguments: - autoupdate_policy -- The auto update policy setting ('on' or 'off'). String. - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PUT + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/UpdateParserAutoUpdatePolicy + + Keyword arguments + ----------------- + autoupdate_policy : str + The auto update policy setting ('on' or 'off') + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "autoupdate_policy": "string", "reason": "string" } - reason -- Reason for changing the auto update policy. String. + reason : str + Reason for changing the auto update policy. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PUT - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/UpdateParserAutoUpdatePolicy + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = ngsiem_auto_update_policy_payload(passed_keywords=kwargs) @@ -1221,23 +1473,31 @@ def install_parser(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Provisions a pre-built parser with a specific version for the requesting customer ID (CID). The parser is installed as-is and cannot be modified by the customer. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/InstallParser + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "parser_id": "string", "version": "string" } - parser_id -- The unique identifier of the parser to install. String. - version -- The version of the parser to install. String. + parser_id : str + The unique identifier of the parser to install. + version : str + The version of the parser to install. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/InstallParser + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = ngsiem_install_parser_payload(passed_keywords=kwargs) @@ -1257,8 +1517,16 @@ def bulk_install_parsers(self: object, body: dict = None, **kwargs) -> Union[Dic customer ID (CID). The parsers are installed as-is and cannot be modified by the customer. Maximum 100 parsers per request. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/BulkInstallParsers + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "parsers": [ { @@ -1267,16 +1535,15 @@ def bulk_install_parsers(self: object, body: dict = None, **kwargs) -> Union[Dic } ] } - parsers -- List of parser objects containing parser_id and version. List of dictionaries. + parsers : list[dict] + List of parser objects containing parser_id and version. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/BulkInstallParsers + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = ngsiem_bulk_install_parsers_payload(passed_keywords=kwargs) @@ -1295,22 +1562,30 @@ def get_saved_query_template(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve Saved Query in NGSIEM as LogScale YAML Template. - Keyword arguments: - ids -- Saved query ID to retrieve. String. - search_domain -- Name of search domain (view or repo). - Allowed options: - all falcon - third-party dashboards - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/GetSavedQueryTemplate + + Keyword arguments + ----------------- + ids : str or list[str] + Saved query ID to retrieve. + search_domain : str + Name of search domain (view or repo). + Allowed options: + all falcon + third-party dashboards + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1324,23 +1599,31 @@ def get_saved_query_template(self: object, def create_saved_query(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create a Saved Query from LogScale YAML Template in NGSIEM. - Keyword arguments: - search_domain -- Name of search domain (view or repo). String. - Allowed options: - all - falcon - third-party - yaml_template -- LogScale saved query YAML template content, see schema at https://schemas.humio.com/. Binary data. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + HTTP Method: POST - This method only supports keywords for providing arguments. + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/CreateSavedQuery - Returns: dict object containing API response. + Keyword arguments + ----------------- + search_domain : str + Name of search domain (view or repo). String. + Allowed options: + all + falcon + third-party + yaml_template : bytes + LogScale saved query YAML template content, see schema at https://schemas.humio.com/ + parameters : dict + Full parameters payload. Not required if using other keywords. - HTTP Method: POST + This method only supports keywords for providing arguments. - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/CreateSavedQuery + Returns + ------- + dict + Dictionary object containing API response. """ yaml_data = kwargs.get("yaml_template", None) file_extended = {} @@ -1371,24 +1654,33 @@ def update_saved_query_from_template(self: object, Please note a successful update will result in a new ID value being returned. - Keyword arguments: - ids -- ID of the saved query to update. String. - search_domain -- Name of search domain (view or repo). String. - Allowed options: - all - falcon - third-party - yaml_template -- LogScale saved query YAML template content, see schema at https://schemas.humio.com/. Binary data. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/UpdateSavedQueryFromTemplate + + Keyword arguments + ----------------- + ids : str + ID of the saved query to update. + search_domain : str + Name of search domain (view or repo). String. + Allowed options: + all + falcon + third-party + yaml_template : bytes + LogScale saved query YAML template content, see schema at https://schemas.humio.com/ + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ yaml_data = kwargs.get("yaml_template", None) file_extended = {} @@ -1414,23 +1706,31 @@ def update_saved_query_from_template(self: object, def delete_saved_query(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete Saved Query in NGSIEM. - Keyword arguments: - ids -- Saved query ID to retrieve. String. - search_domain -- Name of search domain (view or repo). - Allowed options: - all - falcon - third-party - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/DeleteSavedQuery + + Keyword arguments + ----------------- + ids : str or list[str] + Saved query ID to retrieve. + search_domain : str + Name of search domain (view or repo). + Allowed options: + all + falcon + third-party + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1444,25 +1744,35 @@ def delete_saved_query(self: object, parameters: dict = None, **kwargs) -> Union def list_dashboards(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """List Dashboards in NGSIEM. - Keyword arguments: - limit -- Maximum number of results to return. Integer string. Default value: 50 - offset -- Number of results to offset the returned results by. Integer string. Default value: 0 - filter -- FQL filter to apply to the name of the content. String. - Only currently support text match on name field: name:~'value' - search_domain -- Name of search domain (view or repo). - Allowed options: - all falcon - third-party dashboards - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/ListDashboards + + Keyword arguments + ----------------- + limit : str + Maximum number of results to return. Integer string. Default value: 50 + offset : str + Number of results to offset the returned results by. Integer string. Default value: 0 + filter : str + FQL filter to apply to the name of the content. String. + Only currently support text match on name field: name:~'value' + search_domain : str + Name of search domain (view or repo). + Allowed options: + all falcon + third-party dashboards + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1476,26 +1786,36 @@ def list_dashboards(self: object, parameters: dict = None, **kwargs) -> Union[Di def list_lookup_files(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """List Lookup Files in NGSIEM. - Keyword arguments: - limit -- Maximum number of results to return. Integer string. Default value: 50 - offset -- Number of results to offset the returned results by. Integer string. Default value: 0 - filter -- FQL filter to apply to the name of the content. String. - Only currently support text match on name field: name:~'value' - search_domain -- Name of search domain (view or repo). - Allowed options: - all falcon - third-party dashboards - parsers-repository - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/ListLookupFiles + + Keyword arguments + ----------------- + limit : str + Maximum number of results to return. Integer string. Default value: 50 + offset : str + Number of results to offset the returned results by. Integer string. Default value: 0 + filter : str + FQL filter to apply to the name of the content. String. + Only currently support text match on name field: name:~'value' + search_domain : str + Name of search domain (view or repo). + Allowed options: + all falcon + third-party dashboards + parsers-repository + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1509,27 +1829,39 @@ def list_lookup_files(self: object, parameters: dict = None, **kwargs) -> Union[ def list_parsers(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """List Parsers in NGSIEM. - Keyword arguments: - limit -- Maximum number of results to return. Integer string. Default value: 50 - offset -- Number of results to offset the returned results by. Integer string. Default value: 0 - filter -- FQL filter to apply to the name of the content. String. - Only currently support text match on name field: name:~'value' - repository -- Name of repository. - Allowed options: parsers-repository - update_available -- Filter parsers by update availability. String. - Allowed values: true, false - parser_type -- Filter parsers by type. String. - Allowed values: ootb, custom - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/ListParsers + + Keyword arguments + ----------------- + limit : str + Maximum number of results to return. Integer string. Default value: 50 + offset : str + Number of results to offset the returned results by. Integer string. Default value: 0 + filter : str + FQL filter to apply to the name of the content. String. + Only currently support text match on name field: name:~'value' + repository : str + Name of repository. + Allowed options: parsers-repository + update_available : str + Filter parsers by update availability. String. + Allowed values: true, false + parser_type : str + Filter parsers by type. String. + Allowed values: ootb, custom + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1543,25 +1875,35 @@ def list_parsers(self: object, parameters: dict = None, **kwargs) -> Union[Dict[ def list_saved_queries(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get Saved Queries in NGSIEM. - Keyword arguments: - limit -- Maximum number of results to return. Integer string. Default value: 50 - offset -- Number of results to offset the returned results by. Integer string. Default value: 0 - filter -- FQL filter to apply to the name of the content. String. - Only currently support text match on name field: name:~'value' - search_domain -- name of search domain (view or repo). - Allowed options: - all falcon - third-party dashboards - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/ListSavedQueries + + Keyword arguments + ----------------- + limit : str + Maximum number of results to return. Integer string. Default value: 50 + offset : str + Number of results to offset the returned results by. Integer string. Default value: 0 + filter : str + FQL filter to apply to the name of the content. String. + Only currently support text match on name field: name:~'value' + search_domain : str + name of search domain (view or repo). + Allowed options: + all falcon + third-party dashboards + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1578,29 +1920,41 @@ def update_lookup_file_entries(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update entries in an existing Lookup File in NGSIEM. - Keyword arguments: - search_domain -- name of search domain (view or repo). String. - filename -- Filename of the lookup file to update. String. - file -- The file content for updating or appending the entries. Binary data. - update_mode -- How to update the file entries. String. - Available values: - append update - key_columns -- For update mode, the comma separated list of key columns to use when matching entries. String. - (REQUIRED when update_mode=update) - ignore_case -- For update mode, whether to ignore case when matching keys. String. - Available values: - true false - (REQUIRED when update_mode=update) - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/UpdateLookupFileEntries + + Keyword arguments + ----------------- + search_domain : str + name of search domain (view or repo) + filename : str + Filename of the lookup file to update. + file : bytes + The file content for updating or appending the entries. + update_mode : str + How to update the file entries. String. + Available values: + append update + key_columns : str + For update mode, the comma separated list of key columns to use when matching entries. String. + (REQUIRED when update_mode=update) + ignore_case : str + For update mode, whether to ignore case when matching keys. String. + Available values: + true false + (REQUIRED when update_mode=update) + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ file_name = kwargs.get("filename", None) file_data = kwargs.get("file", None) @@ -1628,21 +1982,31 @@ def list_data_connections(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """List and search data connections. - Keyword arguments: - filter -- Optional filter criteria in FQL format. String. - offset -- Starting position for pagination. Integer. - limit -- Maximum number of items to return. Integer. - sort -- Sort field and direction. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/ExternalListDataConnections + + Keyword arguments + ----------------- + filter : str + Optional filter criteria in FQL format. + offset : int + Starting position for pagination. + limit : int + Maximum number of items to return. + sort : str + Sort field and direction. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1656,21 +2020,31 @@ def list_data_connections(self: object, def list_data_connectors(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """List available data connectors. - Keyword arguments: - filter -- Optional filter criteria in FQL format. String. - offset -- Starting position for pagination. Integer. - limit -- Maximum number of items to return. Integer. - sort -- Sort field and direction. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/ExternalListDataConnectors + + Keyword arguments + ----------------- + filter : str + Optional filter criteria in FQL format. + offset : int + Starting position for pagination. + limit : int + Maximum number of items to return. + sort : str + Sort field and direction. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1688,19 +2062,28 @@ def get_provisioning_status(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get data connection provisioning status. - Keyword arguments: - ids -- Unique identifier of the data connection. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/ExternalGetDataConnectionStatus + + Keyword arguments + ----------------- + ids : str or list[str] + Unique identifier of the data connection. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1718,23 +2101,32 @@ def update_connection_status(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update data connection status. - Keyword arguments: - ids -- Unique identifier of the data connection. String or list of strings. - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/ExternalUpdateDataConnectionStatus + + Keyword arguments + ----------------- + ids : str + Unique identifier of the data connection. + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "status": "string" } - status -- The status of the data connection. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + status : str + The status of the data connection. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/ExternalUpdateDataConnectionStatus + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body["status"] = kwargs.get("status", None) @@ -1756,19 +2148,28 @@ def get_ingest_token(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get Ingest token for data connection. - Keyword arguments: - ids -- Unique identifier of the data connection. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/ExternalGetDataConnectionToken + + Keyword arguments + ----------------- + ids : str + Unique identifier of the data connection. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1786,19 +2187,28 @@ def regenerate_ingest_token(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Regenerate Ingest token for data connection. - Keyword arguments: - ids -- Unique identifier of the data connection. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/ExternalRegenerateDataConnectionToken + + Keyword arguments + ----------------- + ids : str + Unique identifier of the data connection. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1816,19 +2226,28 @@ def get_connection_by_id(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get data connection by ID. - Keyword arguments: - ids -- Unique identifier of the data connection. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/ExternalGetDataConnectionByID + + Keyword arguments + ----------------- + ids : str or list[str] + Unique identifier of the data connection. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1842,8 +2261,16 @@ def get_connection_by_id(self: object, def create_data_connection(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create a new data connection. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/ExternalCreateDataConnection + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "config": { "auth": {}, @@ -1867,29 +2294,40 @@ def create_data_connection(self: object, body: dict = None, **kwargs) -> Union[D "vendor_name": "string", "vendor_product_name": "string" } - config -- Configuration settings for the data connection, including auth and params. Dictionary. - config_id -- Identifier of the connector configuration to use. String. - connector_id -- Identifier of the connector for this data connection. String. - connector_type -- Type of the connector. String. - custom -- Custom properties for the data connection, such as connector-specific configuration - keys (e.g., PluginConfigID). Dictionary of string key/value pairs. - description -- Description of the data connection. String. - enable_host_enrichment -- Flag to enable host enrichment on ingested data. Boolean. - enable_user_enrichment -- Flag to enable user enrichment on ingested data. Boolean. - log_sources -- Log sources associated with this data connection. String or list of strings. - name -- Name of the data connection. String. - parser -- Parser to use for processing ingested data. String. - vendor_name -- Name of the vendor providing the data. String. - vendor_product_name -- Name of the vendor product providing the data. String. + config : dict + Configuration settings for the data connection, including auth and params. + config_id : str + Identifier of the connector configuration to use. + connector_id : str + Identifier of the connector for this data connection. + connector_type : str + Type of the connector. + custom : dict + Custom properties for the data connection, such as connector-specific configuration + keys (e.g., PluginConfigID). Dictionary of string key/value pairs. + description : str + Description of the data connection. + enable_host_enrichment : bool + Flag to enable host enrichment on ingested data. + enable_user_enrichment : bool + Flag to enable user enrichment on ingested data. + log_sources : str or list[str] + Log sources associated with this data connection. + name : str + Name of the data connection. + parser : str + Parser to use for processing ingested data. + vendor_name : str + Name of the vendor providing the data. + vendor_product_name : str + Name of the vendor product providing the data. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/ExternalCreateDataConnection + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = ngsiem_data_connection_payload(passed_keywords=kwargs) @@ -1909,9 +2347,18 @@ def update_data_connection(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update a data connection. - Keyword arguments: - ids -- Unique identifier of the data connection. String. - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/ExternalUpdateDataConnection + + Keyword arguments + ----------------- + ids : str + Unique identifier of the data connection. + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "config": { "auth": {}, @@ -1925,23 +2372,29 @@ def update_data_connection(self: object, "name": "string", "parser": "string" } - config -- Configuration settings for the data connection, including auth and params. Dictionary. - config_id -- Identifier of the connector configuration to use. String. - description -- Description of the data connection. String. - enable_host_enrichment -- Flag to enable host enrichment on ingested data. Boolean. - enable_user_enrichment -- Flag to enable user enrichment on ingested data. Boolean. - name -- Name of the data connection. String. - parser -- Parser to use for processing ingested data. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + config : dict + Configuration settings for the data connection, including auth and params. + config_id : str + Identifier of the connector configuration to use. + description : str + Description of the data connection. + enable_host_enrichment : bool + Flag to enable host enrichment on ingested data. + enable_user_enrichment : bool + Flag to enable user enrichment on ingested data. + name : str + Name of the data connection. + parser : str + Parser to use for processing ingested data. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/ExternalUpdateDataConnection + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = ngsiem_data_connection_payload(passed_keywords=kwargs) @@ -1962,19 +2415,28 @@ def delete_data_connection(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a data connection. - Keyword arguments: - ids -- Unique identifier of the data connection. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/ExternalDeleteDataConnection + + Keyword arguments + ----------------- + ids : str + Unique identifier of the data connection. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1992,19 +2454,28 @@ def list_connector_configs(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """List configurations for a data connector. - Keyword arguments: - ids -- Unique identifier of the data connector. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/ExternalListConnectorConfigs + + Keyword arguments + ----------------- + ids : str + Unique identifier of the data connector. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2018,8 +2489,16 @@ def list_connector_configs(self: object, def create_connector_config(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create a new configuration for a data connector. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/ExternalCreateConnectorConfig + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "config": { "auth": {}, @@ -2028,17 +2507,17 @@ def create_connector_config(self: object, body: dict = None, **kwargs) -> Union[ }, "connector_id": "string" } - config -- Configuration details for the connector including authentication and parameters. Dictionary. - connector_id -- Unique identifier of the data connector. String. + config : dict + Configuration details for the connector including authentication and parameters. + connector_id : str + Unique identifier of the data connector. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/ExternalCreateConnectorConfig + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = ngsiem_connector_config_payload(passed_keywords=kwargs) @@ -2058,9 +2537,18 @@ def patch_connector_config(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Patch configurations for a data connector. - Keyword arguments: - ids -- Unique id of the config to update. String. - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/ExternalPatchConnectorConfig + + Keyword arguments + ----------------- + ids : str + Unique id of the config to update. + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "config": { "auth": {}, @@ -2069,18 +2557,19 @@ def patch_connector_config(self: object, }, "connector_id": "string" } - config -- Configuration details for the connector including authentication and parameters. Dictionary. - connector_id -- Unique identifier of the data connector. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + config : dict + Configuration details for the connector including authentication and parameters. + connector_id : str + Unique identifier of the data connector. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/ExternalPatchConnectorConfig + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = ngsiem_connector_config_payload(passed_keywords=kwargs) @@ -2101,19 +2590,27 @@ def delete_connector_configs(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete data connection config. - Keyword arguments: - connector_id -- Unique identifier of the connector. String. - ids -- Unique identifiers of the config(s) to delete. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/ExternalDeleteConnectorConfigs + + Keyword arguments + ----------------- + connector_id : str + Unique identifier of the connector. + ids : str or list[str] + Unique identifiers of the config(s) to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2130,8 +2627,16 @@ def bulk_create_dashboards_from_template(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create Multiple Dashboards from YAML Templates. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/BulkCreateDashboardsFromTemplate + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "dashboard_items": [ { @@ -2141,17 +2646,17 @@ def bulk_create_dashboards_from_template(self: object, ], "search_domain": "string" } - dashboard_items -- List of dashboards to create. List. - search_domain -- The name of the search domain where the dashboards will be created. String. + dashboard_items : list + List of dashboards to create. + search_domain : str + The name of the search domain where the dashboards will be created. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/BulkCreateDashboardsFromTemplate + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = bulk_create_dashboards_from_template_payload(passed_keywords=kwargs) @@ -2170,8 +2675,16 @@ def bulk_create_lookup_files(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create Multiple Lookup Files. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/BulkCreateLookupFiles + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "lookup_files": [ { @@ -2181,17 +2694,17 @@ def bulk_create_lookup_files(self: object, ], "search_domain": "string" } - lookup_files -- List of lookup files to create. List. - search_domain -- The name of the search domain where the lookup files will be created. String. + lookup_files : list + List of lookup files to create. + search_domain : str + The name of the search domain where the lookup files will be created. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/BulkCreateLookupFiles + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = bulk_create_lookup_files_payload(passed_keywords=kwargs) @@ -2210,8 +2723,16 @@ def bulk_create_saved_queries_from_template(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create Multiple Saved Queries from LogScale YAML Templates. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/BulkCreateSavedQueriesFromTemplate + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "saved_query_items": [ { @@ -2220,17 +2741,17 @@ def bulk_create_saved_queries_from_template(self: object, ], "search_domain": "string" } - saved_query_items -- List of saved queries to create. List. - search_domain -- The name of the search domain where saved queries will be created. String. + saved_query_items : list + List of saved queries to create. + search_domain : str + The name of the search domain where saved queries will be created. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/BulkCreateSavedQueriesFromTemplate + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = bulk_create_saved_queries_from_template_payload(passed_keywords=kwargs) @@ -2249,20 +2770,28 @@ def bulk_get_lookup_files(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve Multiple Lookup Files by Filenames in NGSIEM. - Keyword arguments: - filename -- Lookup file filename(s) (required, multiple allowed). List. - search_domain -- name of search domain (view or repo). Available values: all, falcon, third-party, dashboards, - parsers-repository. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/BulkGetLookupFiles + + Keyword arguments + ----------------- + filename : str or list[str] + Lookup file filename(s) (required, multiple allowed) + search_domain : str + name of search domain (view or repo). Available values: all, falcon, third-party, dashboards, + parsers-repository. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -2279,8 +2808,16 @@ def bulk_update_dashboards_from_template(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update Multiple Dashboards from YAML Templates. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/BulkUpdateDashboardsFromTemplate + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "dashboard_items": [ { @@ -2290,17 +2827,17 @@ def bulk_update_dashboards_from_template(self: object, ], "search_domain": "string" } - dashboard_items -- Array of dashboards to update with their IDs and YAML templates. List. - search_domain -- The name of the search domain containing the dashboards. String. + dashboard_items : list + Array of dashboards to update with their IDs and YAML templates. + search_domain : str + The name of the search domain containing the dashboards. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/BulkUpdateDashboardsFromTemplate + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = bulk_update_dashboards_from_template_payload(passed_keywords=kwargs) @@ -2319,8 +2856,16 @@ def bulk_update_lookup_files(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update Multiple Lookup Files. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/BulkUpdateLookupFiles + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "lookup_files": [ { @@ -2330,17 +2875,17 @@ def bulk_update_lookup_files(self: object, ], "search_domain": "string" } - lookup_files -- List of lookup files to update. List. - search_domain -- The name of the search domain containing the lookup files. String. + lookup_files : list + List of lookup files to update. + search_domain : str + The name of the search domain containing the lookup files. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/BulkUpdateLookupFiles + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = bulk_update_lookup_files_payload(passed_keywords=kwargs) @@ -2359,8 +2904,16 @@ def bulk_update_saved_queries_from_template(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update Multiple Saved Queries from LogScale YAML Templates. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/BulkUpdateSavedQueriesFromTemplate + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "saved_query_items": [ { @@ -2370,17 +2923,17 @@ def bulk_update_saved_queries_from_template(self: object, ], "search_domain": "string" } - saved_query_items -- Array of saved queries to update with their IDs and YAML templates. List. - search_domain -- The name of the search domain containing the saved queries. String. + saved_query_items : list + Array of saved queries to update with their IDs and YAML templates. + search_domain : str + The name of the search domain containing the saved queries. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/BulkUpdateSavedQueriesFromTemplate + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = bulk_update_saved_queries_from_template_payload(passed_keywords=kwargs) @@ -2399,8 +2952,16 @@ def create_parser_extension(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create a Parser extension in NGSIEM for the provided base parser. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/CreateParserExtension + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "base_parser_id": "string", "extension_name": "string", @@ -2431,21 +2992,25 @@ def create_parser_extension(self: object, } ] } - base_parser_id -- The base_parser_id value. String. - extension_name -- The extension_name value. String. - parser_id -- The parser_id value. String. - post_processing_script -- The post_processing_script value. String. - pre_processing_script -- The pre_processing_script value. String. - test_cases -- The test_cases value. List. + base_parser_id : str + The base_parser_id value. + extension_name : str + The extension_name value. + parser_id : str + The parser_id value. + post_processing_script : str + The post_processing_script value. + pre_processing_script : str + The pre_processing_script value. + test_cases : list + The test_cases value. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/CreateParserExtension + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = create_parser_extension_payload(passed_keywords=kwargs) @@ -2464,8 +3029,16 @@ def update_parser_extension(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update an existing Parser extension in NGSIEM. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/UpdateParserExtension + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "extension_id": "string", "post_processing_script": "string", @@ -2494,19 +3067,21 @@ def update_parser_extension(self: object, } ] } - extension_id -- The unique identifier of the parser extension to update. String. - post_processing_script -- Optional - update postprocessing logic. String. - pre_processing_script -- Optional - update preprocessing logic. String. - test_cases -- Optional - update test cases. List. + extension_id : str + The unique identifier of the parser extension to update. + post_processing_script : str + Optional - update postprocessing logic. + pre_processing_script : str + Optional - update preprocessing logic. + test_cases : list + Optional - update test cases. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/UpdateParserExtension + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = update_parser_extension_payload(passed_keywords=kwargs) @@ -2518,15 +3093,870 @@ def update_parser_extension(self: object, body=body ) + @force_default(defaults=["body"], default_types=["dict"]) + def add_dashboard_labels(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Add multiple labels to a single dashboard. + + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/addDashboardLabels + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "id": "string", + "labels": [ + "string" + ], + "search_domain": "string" + } + id : str + The unique identifier of the dashboard. + labels : list + The labels to add (max 10 labels, max 60 chars each) + search_domain : str + The search domain (view or repository) containing the dashboard. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = add_dashboard_labels_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="addDashboardLabels", + body=body + ) + + @force_default(defaults=["body"], default_types=["dict"]) + def add_file_labels(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Add multiple labels to a single file. + + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/addFileLabels + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "filename": "string", + "labels": [ + "string" + ], + "search_domain": "string" + } + filename : str + The name of the lookup file. + labels : list + The labels to add (max 10 total labels per file, max 60 chars each) + search_domain : str + The search domain (view or repository) containing the file. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = add_file_labels_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="addFileLabels", + body=body + ) + + @force_default(defaults=["body"], default_types=["dict"]) + def add_saved_query_labels(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Add multiple labels to a saved query. + + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/addSavedQueryLabels + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "id": "string", + "labels": [ + "string" + ], + "search_domain": "string" + } + id : str + The unique identifier of the saved query. + labels : list + The labels to add (max 10 labels, max 60 chars each) + search_domain : str + The search domain (view or repository) containing the saved query. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = add_saved_query_labels_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="addSavedQueryLabels", + body=body + ) + + @force_default(defaults=["body"], default_types=["dict"]) + def bulk_add_dashboard_labels(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Add labels to multiple dashboards (max 100 items, non-transactional). + + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/bulkAddDashboardLabels + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "items": [ + { + "id": "string", + "labels": [ + "string" + ] + } + ], + "search_domain": "string" + } + items : list + List of dashboards with labels to add/remove/replace (max 100 items) + search_domain : str + The search domain (view or repository) containing the dashboards. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = bulk_add_dashboard_labels_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="bulkAddDashboardLabels", + body=body + ) + + @force_default(defaults=["body"], default_types=["dict"]) + def bulk_add_lookup_file_labels(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Add labels to multiple lookup files (max 100 items, non-transactional). + + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/bulkAddLookupFileLabels + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "items": [ + { + "filename": "string", + "labels": [ + "string" + ] + } + ], + "search_domain": "string" + } + items : list + List of files with labels to add/remove/replace (max 100 items) + search_domain : str + The search domain (view or repository) containing the files. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = bulk_add_lookup_file_labels_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="bulkAddLookupFileLabels", + body=body + ) + + @force_default(defaults=["body"], default_types=["dict"]) + def bulk_add_saved_query_labels(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Add labels to multiple saved queries (max 100 items, non-transactional). + + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/bulkAddSavedQueryLabels + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "items": [ + { + "id": "string", + "labels": [ + "string" + ] + } + ], + "search_domain": "string" + } + items : list + List of saved queries with labels to add/remove/replace (max 100 items) + search_domain : str + The search domain (view or repository) containing the saved queries. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = bulk_add_saved_query_labels_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="bulkAddSavedQueryLabels", + body=body + ) + + @force_default(defaults=["body"], default_types=["dict"]) + def bulk_remove_dashboard_labels(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Remove labels from multiple dashboards (max 100 items, non-transactional). + + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/bulkRemoveDashboardLabels + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "items": [ + { + "id": "string", + "labels": [ + "string" + ] + } + ], + "search_domain": "string" + } + items : list + List of dashboards with labels to add/remove/replace (max 100 items) + search_domain : str + The search domain (view or repository) containing the dashboards. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = bulk_remove_dashboard_labels_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="bulkRemoveDashboardLabels", + body=body + ) + + @force_default(defaults=["body"], default_types=["dict"]) + def bulk_remove_lookup_file_labels(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Remove labels from multiple lookup files (max 100 items, non-transactional). + + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/bulkRemoveLookupFileLabels + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "items": [ + { + "filename": "string", + "labels": [ + "string" + ] + } + ], + "search_domain": "string" + } + items : list + List of files with labels to add/remove/replace (max 100 items) + search_domain : str + The search domain (view or repository) containing the files. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = bulk_remove_lookup_file_labels_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="bulkRemoveLookupFileLabels", + body=body + ) + + @force_default(defaults=["body"], default_types=["dict"]) + def bulk_remove_saved_query_labels(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Remove labels from multiple saved queries (max 100 items, non-transactional). + + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/bulkRemoveSavedQueryLabels + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "items": [ + { + "id": "string", + "labels": [ + "string" + ] + } + ], + "search_domain": "string" + } + items : list + List of saved queries with labels to add/remove/replace (max 100 items) + search_domain : str + The search domain (view or repository) containing the saved queries. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = bulk_remove_saved_query_labels_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="bulkRemoveSavedQueryLabels", + body=body + ) + + @force_default(defaults=["body"], default_types=["dict"]) + def bulk_update_dashboard_labels(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Replace all labels on multiple dashboards (max 100 items, non-transactional). + + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/bulkUpdateDashboardLabels + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "items": [ + { + "id": "string", + "labels": [ + "string" + ] + } + ], + "search_domain": "string" + } + items : list + List of dashboards with labels to add/remove/replace (max 100 items) + search_domain : str + The search domain (view or repository) containing the dashboards. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = bulk_update_dashboard_labels_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="bulkUpdateDashboardLabels", + body=body + ) + + @force_default(defaults=["body"], default_types=["dict"]) + def bulk_update_lookup_file_labels(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Replace all labels on multiple lookup files (max 100 items, non-transactional). + + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/bulkUpdateLookupFileLabels + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "items": [ + { + "filename": "string", + "labels": [ + "string" + ] + } + ], + "search_domain": "string" + } + items : list + List of files with labels to add/remove/replace (max 100 items) + search_domain : str + The search domain (view or repository) containing the files. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = bulk_update_lookup_file_labels_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="bulkUpdateLookupFileLabels", + body=body + ) + + @force_default(defaults=["body"], default_types=["dict"]) + def bulk_update_saved_query_labels(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Replace all labels on multiple saved queries (max 100 items, non-transactional). + + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/bulkUpdateSavedQueryLabels + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "items": [ + { + "id": "string", + "labels": [ + "string" + ] + } + ], + "search_domain": "string" + } + items : list + List of saved queries with labels to add/remove/replace (max 100 items) + search_domain : str + The search domain (view or repository) containing the saved queries. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = bulk_update_saved_query_labels_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="bulkUpdateSavedQueryLabels", + body=body + ) + + @force_default(defaults=["parameters"], default_types=["dict"]) + def remove_dashboard_labels(self: object, + parameters: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Remove multiple labels from a single dashboard. + + HTTP Method: DELETE + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/removeDashboardLabels + + Keyword arguments + ----------------- + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="removeDashboardLabels", + keywords=kwargs, + params=parameters + ) + + @force_default(defaults=["parameters"], default_types=["dict"]) + def remove_file_labels(self: object, + parameters: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Remove multiple labels from a single file. + + HTTP Method: DELETE + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/removeFileLabels + + Keyword arguments + ----------------- + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="removeFileLabels", + keywords=kwargs, + params=parameters + ) + + @force_default(defaults=["parameters"], default_types=["dict"]) + def remove_saved_query_labels(self: object, + parameters: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Remove multiple labels from a saved query. + + HTTP Method: DELETE + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/removeSavedQueryLabels + + Keyword arguments + ----------------- + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="removeSavedQueryLabels", + keywords=kwargs, + params=parameters + ) + + @force_default(defaults=["body"], default_types=["dict"]) + def update_dashboard_labels(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Replace all labels on a single dashboard. + + HTTP Method: PUT + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/updateDashboardLabels + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "id": "string", + "labels": [ + "string" + ], + "search_domain": "string" + } + id : str + The unique identifier of the dashboard. + labels : list + The new labels (replaces all existing, max 10 labels, max 60 chars each) + search_domain : str + The search domain (view or repository) containing the dashboard. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = update_dashboard_labels_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="updateDashboardLabels", + body=body + ) + + @force_default(defaults=["body"], default_types=["dict"]) + def update_file_labels(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Replace all labels on a single file. + + HTTP Method: PUT + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/updateFileLabels + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "filename": "string", + "labels": [ + "string" + ], + "search_domain": "string" + } + filename : str + The name of the lookup file. + labels : list + The new labels (replaces all existing labels, max 10 labels, max 60 chars each) + search_domain : str + The search domain (view or repository) containing the file. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = update_file_labels_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="updateFileLabels", + body=body + ) + + @force_default(defaults=["body"], default_types=["dict"]) + def update_saved_query_labels(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Replace all labels on a single saved query. + + HTTP Method: PUT + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ngsiem/updateSavedQueryLabels + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "id": "string", + "labels": [ + "string" + ], + "search_domain": "string" + } + id : str + The unique identifier of the saved query. + labels : list + The new labels (replaces all existing labels, max 10 labels, max 60 chars each) + search_domain : str + The search domain (view or repository) containing the saved query. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = update_saved_query_labels_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="updateSavedQueryLabels", + body=body + ) + + addDashboardLabels = add_dashboard_labels + addFileLabels = add_file_labels + addSavedQueryLabels = add_saved_query_labels + bulkAddDashboardLabels = bulk_add_dashboard_labels + bulkAddLookupFileLabels = bulk_add_lookup_file_labels + bulkAddSavedQueryLabels = bulk_add_saved_query_labels BulkCreateDashboardsFromTemplate = bulk_create_dashboards_from_template BulkCreateLookupFiles = bulk_create_lookup_files BulkCreateSavedQueriesFromTemplate = bulk_create_saved_queries_from_template BulkGetLookupFiles = bulk_get_lookup_files + bulkRemoveDashboardLabels = bulk_remove_dashboard_labels + bulkRemoveLookupFileLabels = bulk_remove_lookup_file_labels + bulkRemoveSavedQueryLabels = bulk_remove_saved_query_labels + bulkUpdateDashboardLabels = bulk_update_dashboard_labels BulkUpdateDashboardsFromTemplate = bulk_update_dashboards_from_template + bulkUpdateLookupFileLabels = bulk_update_lookup_file_labels BulkUpdateLookupFiles = bulk_update_lookup_files BulkUpdateSavedQueriesFromTemplate = bulk_update_saved_queries_from_template + bulkUpdateSavedQueryLabels = bulk_update_saved_query_labels CreateParserExtension = create_parser_extension + removeDashboardLabels = remove_dashboard_labels + removeFileLabels = remove_file_labels + removeSavedQueryLabels = remove_saved_query_labels + updateDashboardLabels = update_dashboard_labels + updateFileLabels = update_file_labels UpdateParserExtension = update_parser_extension + updateSavedQueryLabels = update_saved_query_labels UploadLookupV1 = upload_file GetLookupV1 = get_file GetLookupFromPackageWithNamespaceV1 = get_file_from_package_with_namespace diff --git a/src/falconpy/ngsiem.pyi b/src/falconpy/ngsiem.pyi index 2e02b5561..722dcb68e 100644 --- a/src/falconpy/ngsiem.pyi +++ b/src/falconpy/ngsiem.pyi @@ -517,15 +517,186 @@ class NGSIEM(ServiceClass): body: Optional[dict] = None, ) -> Union[Dict[str, Union[int, dict]], Result]: ... + def add_dashboard_labels( + self, + *, + id: Optional[str] = None, + labels: Optional[Union[str, List[str]]] = None, + search_domain: Optional[str] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def add_file_labels( + self, + *, + filename: Optional[str] = None, + labels: Optional[Union[str, List[str]]] = None, + search_domain: Optional[str] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def add_saved_query_labels( + self, + *, + id: Optional[str] = None, + labels: Optional[Union[str, List[str]]] = None, + search_domain: Optional[str] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def bulk_add_dashboard_labels( + self, + *, + items: Optional[list] = None, + search_domain: Optional[str] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def bulk_add_lookup_file_labels( + self, + *, + items: Optional[list] = None, + search_domain: Optional[str] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def bulk_add_saved_query_labels( + self, + *, + items: Optional[list] = None, + search_domain: Optional[str] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def bulk_remove_dashboard_labels( + self, + *, + items: Optional[list] = None, + search_domain: Optional[str] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def bulk_remove_lookup_file_labels( + self, + *, + items: Optional[list] = None, + search_domain: Optional[str] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def bulk_remove_saved_query_labels( + self, + *, + items: Optional[list] = None, + search_domain: Optional[str] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def bulk_update_dashboard_labels( + self, + *, + items: Optional[list] = None, + search_domain: Optional[str] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def bulk_update_lookup_file_labels( + self, + *, + items: Optional[list] = None, + search_domain: Optional[str] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def bulk_update_saved_query_labels( + self, + *, + items: Optional[list] = None, + search_domain: Optional[str] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def remove_dashboard_labels( + self, + *, + id: Optional[str] = None, + labels: Optional[Union[str, List[str]]] = None, + search_domain: Optional[str] = None, + parameters: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def remove_file_labels( + self, + *, + filename: Optional[str] = None, + labels: Optional[Union[str, List[str]]] = None, + search_domain: Optional[str] = None, + parameters: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def remove_saved_query_labels( + self, + *, + id: Optional[str] = None, + labels: Optional[Union[str, List[str]]] = None, + search_domain: Optional[str] = None, + parameters: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def update_dashboard_labels( + self, + *, + id: Optional[str] = None, + labels: Optional[Union[str, List[str]]] = None, + search_domain: Optional[str] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def update_file_labels( + self, + *, + filename: Optional[str] = None, + labels: Optional[Union[str, List[str]]] = None, + search_domain: Optional[str] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def update_saved_query_labels( + self, + *, + id: Optional[str] = None, + labels: Optional[Union[str, List[str]]] = None, + search_domain: Optional[str] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + addDashboardLabels = add_dashboard_labels + addFileLabels = add_file_labels + addSavedQueryLabels = add_saved_query_labels + bulkAddDashboardLabels = bulk_add_dashboard_labels + bulkAddLookupFileLabels = bulk_add_lookup_file_labels + bulkAddSavedQueryLabels = bulk_add_saved_query_labels BulkCreateDashboardsFromTemplate = bulk_create_dashboards_from_template BulkCreateLookupFiles = bulk_create_lookup_files BulkCreateSavedQueriesFromTemplate = bulk_create_saved_queries_from_template BulkGetLookupFiles = bulk_get_lookup_files + bulkRemoveDashboardLabels = bulk_remove_dashboard_labels + bulkRemoveLookupFileLabels = bulk_remove_lookup_file_labels + bulkRemoveSavedQueryLabels = bulk_remove_saved_query_labels + bulkUpdateDashboardLabels = bulk_update_dashboard_labels BulkUpdateDashboardsFromTemplate = bulk_update_dashboards_from_template + bulkUpdateLookupFileLabels = bulk_update_lookup_file_labels BulkUpdateLookupFiles = bulk_update_lookup_files BulkUpdateSavedQueriesFromTemplate = bulk_update_saved_queries_from_template + bulkUpdateSavedQueryLabels = bulk_update_saved_query_labels CreateParserExtension = create_parser_extension + removeDashboardLabels = remove_dashboard_labels + removeFileLabels = remove_file_labels + removeSavedQueryLabels = remove_saved_query_labels + updateDashboardLabels = update_dashboard_labels + updateFileLabels = update_file_labels UpdateParserExtension = update_parser_extension + updateSavedQueryLabels = update_saved_query_labels UploadLookupV1 = upload_file GetLookupV1 = get_file GetLookupFromPackageWithNamespaceV1 = get_file_from_package_with_namespace diff --git a/src/falconpy/oauth2.py b/src/falconpy/oauth2.py index d055ee55a..b7d406ace 100644 --- a/src/falconpy/oauth2.py +++ b/src/falconpy/oauth2.py @@ -38,6 +38,7 @@ # pylint: disable=R0902,R0913 from logging import Logger from typing import Dict, Optional, Union +import requests from ._auth_object import FalconInterface from ._error import CannotRevokeToken from ._util import ( @@ -65,6 +66,16 @@ class OAuth2(FalconInterface): OAuth2 is the only Service Class that inherits directly from the FalconAuth object. This means the OAuth2 class does not maintain an auth_object, as it is one. + + Provide a `session` keyword to reuse an existing `requests.Session` for connection + pooling across login, token renewal and logout. FalconPy never closes a session + provided this way; the caller retains ownership of its lifecycle. Example: + + with requests.Session() as session: + auth = OAuth2(client_id=client_id, client_secret=client_secret, session=session) + hosts = Hosts(auth_object=auth) + response = hosts.query_devices_by_filter(limit=10) + # session is closed here by the caller's `with` block, not by FalconPy """ def __init__(self, @@ -83,7 +94,8 @@ def __init__(self, debug_record_count: Optional[int] = None, sanitize_log: Optional[bool] = None, pythonic: Optional[bool] = None, - environment: Optional[Dict[str, str]] = None + environment: Optional[Dict[str, str]] = None, + session: Optional[requests.Session] = None ): """Construct an instance of the class. @@ -92,7 +104,7 @@ def __init__(self, such as the base URL, SSL verification, and timeout. Keyword arguments - ---- + ----------------- base_url : str CrowdStrike API URL to use for requests. [Default: US-1] ssl_verify : bool @@ -114,13 +126,20 @@ def __init__(self, Amount of time (in seconds) between now and the token expiration before a refresh of the token is performed. Default: 120, Max: 1200 Values over 1200 will be reset to the maximum. + session : requests.Session + Existing HTTP session to reuse for connection pooling across login, every API + call, token renewal and logout. FalconPy never closes a session provided this + way; the caller retains ownership of its lifecycle (for example, by using it as + a context manager). A single Session is not guaranteed safe for concurrent use + across threads without external synchronization. When omitted (default), + behavior is unchanged and a new connection is used for each request. Arguments - ---- + --------- This method only supports keywords to specify arguments. Returns - ---- + ------- class (OAuth2) A constructed instance of the OAuth2 Service Class. """ @@ -139,22 +158,23 @@ class (OAuth2) debug_record_count=debug_record_count, sanitize_log=sanitize_log, pythonic=pythonic, - environment=environment + environment=environment, + session=session ) def logout(self) -> Union[Dict[str, Union[int, dict]], Result]: """Revoke the current token. Keyword arguments - ---- + ----------------- This method does not accept keyword arguments. Arguments - ---- + --------- This method does not accept arguments. Returns - ---- + ------- dict Dictionary object containing API response. """ @@ -183,11 +203,11 @@ def revoke(self, HTTP Method: POST Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/oauth2/oauth2RevokeToken Keyword arguments - ---- + ----------------- client_id : str Client ID of the token to be revoked. token : str @@ -196,11 +216,11 @@ def revoke(self, Flag indicating if the underlying authentication state is changed by this request. Arguments - ---- + --------- When not specified as a keyword, token is assumed as the only accepted argument. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -212,20 +232,20 @@ def token(self, alter_state: bool = False) -> Union[Dict[str, Union[int, dict]], HTTP Method: POST Swagger URL - ---- + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/oauth2/oauth2AccessToken Keyword arguments - ---- + ----------------- alter_state : bool Flag indicating if the underlying authentication state is changed by this request. Arguments - ---- + --------- When not specified as a keyword, alter_state is assumed as the only accepted argument. Returns - ---- + ------- dict Dictionary object containing API response. """ diff --git a/src/falconpy/ods.py b/src/falconpy/ods.py index f771ddd0d..6feb11d78 100644 --- a/src/falconpy/ods.py +++ b/src/falconpy/ods.py @@ -64,8 +64,16 @@ class ODS(ServiceClass): def aggregate_scan_hosts(self: object, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get aggregates on ODS scan-hosts data. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ods/aggregate-query-scan-host-metadata + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -100,38 +108,44 @@ def aggregate_scan_hosts(self: object, body: list = None, **kwargs) -> Union[Dic "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ods/aggregate-query-scan-host-metadata + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -147,8 +161,16 @@ def aggregate_scan_hosts(self: object, body: list = None, **kwargs) -> Union[Dic def aggregate_scans(self: object, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get aggregates on ODS scan data. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ods/aggregate-scans + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -183,38 +205,44 @@ def aggregate_scans(self: object, body: list = None, **kwargs) -> Union[Dict[str "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ods/aggregate-scans + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -230,8 +258,16 @@ def aggregate_scans(self: object, body: list = None, **kwargs) -> Union[Dict[str def aggregate_scheduled_scans(self: object, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get aggregates on ODS scheduled-scan data. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ods/aggregate-scheduled-scans + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -266,38 +302,44 @@ def aggregate_scheduled_scans(self: object, body: list = None, **kwargs) -> Unio "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ods/aggregate-scheduled-scans + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -317,19 +359,28 @@ def get_malicious_files(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve malicious files by IDs. - Keyword arguments: - ids -- The scan IDs to retrieve the scan entities. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ods/get-malicious-files-by-ids + + Keyword arguments + ----------------- + ids : str or list[str] + The scan IDs to retrieve the scan entities. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -343,24 +394,33 @@ def get_malicious_files(self: object, def cancel_scans(self: object, *args, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Cancel ODS scans for the given scan IDs. - Keyword arguments: - body -- full body payload, not required if ids is provided as a keyword. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ods/cancel-scans + + Keyword arguments + ----------------- + body : dict + full body payload, not required if ids is provided as a keyword. { "ids": [ "string" ] } - ids -- ID(s) of the scans to cancel. String or list of strings. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ods/cancel-scans + ids : str or list[str] + ID(s) of the scans to cancel. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list( @@ -379,19 +439,28 @@ def cancel_scans(self: object, *args, body: dict = None, **kwargs) -> Union[Dict def get_scan_hosts(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get scan hosts by IDs. - Keyword arguments: - ids -- The scan host IDs to retrieve. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ods/get-scan-host-metadata-by-ids + + Keyword arguments + ----------------- + ids : str or list[str] + The scan host IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -448,19 +517,28 @@ def get_scan_hosts(self: object, *args, parameters: dict = None, **kwargs) -> Un def get_scans_v1(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get scans by IDs. - Keyword arguments: - ids -- The scan IDs to retrieve. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ods/get-scans-by-scan-ids + + Keyword arguments + ----------------- + ids : str or list[str] + The scan IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -474,19 +552,28 @@ def get_scans_v1(self: object, *args, parameters: dict = None, **kwargs) -> Unio def get_scans(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get scans by IDs. - Keyword arguments: - ids -- The scan IDs to retrieve. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ods/get-scans-by-scan-ids-v2 + + Keyword arguments + ----------------- + ids : str or list[str] + The scan IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -500,8 +587,16 @@ def get_scans(self: object, *args, parameters: dict = None, **kwargs) -> Union[D def create_scan(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create ODS scan and start it. - Keyword arguments: - body -- full body payload, not required if ids is provided as a keyword. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ods/create-scan + + Keyword arguments + ----------------- + body : dict + full body payload, not required if ids is provided as a keyword. { "cloud_ml_level_detection": 0, "cloud_ml_level_prevention": 0, @@ -528,37 +623,54 @@ def create_scan(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Un "sensor_ml_level_detection": 0, "sensor_ml_level_prevention": 0 } - cloud_ml_level_detection -- ML detection level. Integer. - cloud_ml_level_prevention -- ML prevention level. Integer. - cpu_priority -- Scan host CPU priority. Integer. - description -- Scan description. String. - endpoint_notification -- Flag indicating if the endpoint should be notified. Boolean. - file_paths -- File paths to be scanned. List of strings. - host_groups -- Host group IDs to scan. List of strings. - hosts -- Host AIDs to scan. List of strings. - ignored_by_channelfile -- Flag indicating if this scan is ignored by channelfiles. Boolean. - Overrides the value specified in the schedule dictionary. - initiated_from -- Endpoint the scan was initiated from. String. - interval -- Scan schedule interval in seconds. Integer. Overrides the value specified in - the schedule dictionary. - max_duration -- Maximum duration in seconds for the scan. Integer. - max_file_size -- Maximum file size for files scanned. Integer. - pause_duration -- Time in seconds to pause during the scan. Integer. - quarantine -- Quarantine malicious files identified by the scan. Boolean. - scan_exclusions -- List of file path globs to exclude from the scan. List of strings. - start_timestamp -- Starting timestamp for the scan. String. Overrides the value specified - in the schedule dictionary. - sensor_ml_level_detection -- Endpoint sensor ML detection level. Integer. - sensor_ml_level_prevention -- Endpoint sensor ML prevention level. Integer. + cloud_ml_level_detection : int + ML detection level. + cloud_ml_level_prevention : int + ML prevention level. + cpu_priority : int + Scan host CPU priority. + description : str + Scan description. + endpoint_notification : bool + Flag indicating if the endpoint should be notified. + file_paths : str or list[str] + File paths to be scanned. + host_groups : str or list[str] + Host group IDs to scan. + hosts : str or list[str] + Host AIDs to scan. + ignored_by_channelfile : dict + Flag indicating if this scan is ignored by channelfiles. Boolean. + Overrides the value specified in the schedule. + initiated_from : str + Endpoint the scan was initiated from. + interval : dict + Scan schedule interval in seconds. Integer. Overrides the value specified in + the schedule. + max_duration : int + Maximum duration in seconds for the scan. + max_file_size : int + Maximum file size for files scanned. + pause_duration : int + Time in seconds to pause during the scan. + quarantine : bool + Quarantine malicious files identified by the scan. + scan_exclusions : str or list[str] + List of file path globs to exclude from the scan. + start_timestamp : dict + Starting timestamp for the scan. String. Overrides the value specified + in the schedule. + sensor_ml_level_detection : int + Endpoint sensor ML detection level. + sensor_ml_level_prevention : int + Endpoint sensor ML prevention level. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ods/create-scan + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = scheduled_scan_payload(passed_keywords=kwargs) @@ -579,19 +691,28 @@ def get_scheduled_scans(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get scheduled scans by IDs. - Keyword arguments: - ids -- The scan IDs to retrieve. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ods/get-scheduled-scans-by-scan-ids + + Keyword arguments + ----------------- + ids : str or list[str] + The scan IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -605,8 +726,16 @@ def get_scheduled_scans(self: object, def schedule_scan(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create ODS scan and start or schedule scan for the given scan request. - Keyword arguments: - body -- full body payload, not required if ids is provided as a keyword. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ods/schedule-scan + + Keyword arguments + ----------------- + body : dict + full body payload, not required if ids is provided as a keyword. { "cloud_ml_level_detection": 0, "cloud_ml_level_prevention": 0, @@ -638,43 +767,61 @@ def schedule_scan(self: object, body: dict = None, **kwargs) -> Union[Dict[str, "sensor_ml_level_detection": 0, "sensor_ml_level_prevention": 0 } - cloud_ml_level_detection -- ML detection level. Integer. - cloud_ml_level_prevention -- ML prevention level. Integer. - cpu_priority -- Scan host CPU priority. Integer. - description -- Scan description. String. - endpoint_notification -- Flag indicating if the endpoint should be notified. Boolean. - file_paths -- File paths to be scanned. List of strings. - host_groups -- Host group IDs to scan. List of strings. - ignored_by_channelfile -- Flag indicating if this scan is ignored by channelfiles. Boolean. - Overrides the value specified in the schedule dictionary. - initiated_from -- Endpoint the scan was initiated from. String. - interval -- Scan schedule interval in seconds. Integer. Overrides the value specified in - the schedule dictionary. - max_duration -- Maximum duration in seconds for the scan. Integer. - max_file_size -- Maximum file size for files scanned. Integer. - pause_duration -- Time in seconds to pause during the scan. Integer. - quarantine -- Quarantine malicious files identified by the scan. Boolean. - scan_exclusions -- List of file path globs to exclude from the scan. List of strings. - scan_inclusions -- List of file path globs to include the scan. List of strings. - schedule -- Details related to the scan schedule. Dictionary. - { - "ignored_by_channelfile": true, - "interval": 0, - "start_timestamp": "string" - } - start_timestamp -- Starting timestamp for the scan. String. Overrides the value specified - in the schedule dictionary. - sensor_ml_level_detection -- Endpoint sensor ML detection level. Integer. - sensor_ml_level_prevention -- Endpoint sensor ML prevention level. Integer. + cloud_ml_level_detection : int + ML detection level. + cloud_ml_level_prevention : int + ML prevention level. + cpu_priority : int + Scan host CPU priority. + description : str + Scan description. + endpoint_notification : bool + Flag indicating if the endpoint should be notified. + file_paths : str or list[str] + File paths to be scanned. + host_groups : str or list[str] + Host group IDs to scan. + ignored_by_channelfile : dict + Flag indicating if this scan is ignored by channelfiles. Boolean. + Overrides the value specified in the schedule. + initiated_from : str + Endpoint the scan was initiated from. + interval : dict + Scan schedule interval in seconds. Integer. Overrides the value specified in + the schedule. + max_duration : int + Maximum duration in seconds for the scan. + max_file_size : int + Maximum file size for files scanned. + pause_duration : int + Time in seconds to pause during the scan. + quarantine : bool + Quarantine malicious files identified by the scan. + scan_exclusions : str or list[str] + List of file path globs to exclude from the scan. + scan_inclusions : str or list[str] + List of file path globs to include the scan. + schedule : dict + Details related to the scan schedule. Dictionary. + { + "ignored_by_channelfile": true, + "interval": 0, + "start_timestamp": "string" + } + start_timestamp : dict + Starting timestamp for the scan. String. Overrides the value specified + in the schedule. + sensor_ml_level_detection : int + Endpoint sensor ML detection level. + sensor_ml_level_prevention : int + Endpoint sensor ML prevention level. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ods/schedule-scan + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = scheduled_scan_payload(passed_keywords=kwargs) @@ -695,20 +842,30 @@ def delete_scheduled_scans(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete ODS scheduled scans for the given IDs. - Keyword arguments: - filter -- A FQL compatible query string. String. - ids -- List of scan IDs to delete. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ods/delete-scheduled-scans + + Keyword arguments + ----------------- + filter : str + A FQL compatible query. + ids : str or list[str] + List of scan IDs to delete. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -722,34 +879,44 @@ def delete_scheduled_scans(self: object, def query_malicious_files(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query for malicious files. - Keyword arguments: - filter -- A FQL compatible query string. String. - Available filters: - id filename - cid hash - scan_id pattern_id - host_id severity - host_scan_id quarantined - filepath last_updated - limit -- The maximum number of records to return. [Integer, 1-500] - offset -- The integer offset to start retrieving records from. Integer. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. id|desc or filename|asc). - Available sort fields: - id hash - scan_id pattern_id - host_id severity - host_scan_id last_updated - filename - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ods/query-malicious-files + + Keyword arguments + ----------------- + filter : str + A FQL compatible query string. String. + Available filters: + id filename + cid hash + scan_id pattern_id + host_id severity + host_scan_id quarantined + filepath last_updated + limit : int (1-500) + The maximum number of records to return. + offset : int + The integer offset to start retrieving records from. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. id|desc or filename|asc). + Available sort fields: + id hash + scan_id pattern_id + host_id severity + host_scan_id last_updated + filename + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -763,37 +930,47 @@ def query_malicious_files(self: object, parameters: dict = None, **kwargs) -> Un def query_scan_hosts(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query for scan hosts. - Keyword arguments: - filter -- A FQL compatible query string. String. - Available filters: - id filecount.quarantined - cid filecount.skipped - profile_id affected_hosts_count - host_id status - scan_id severity - host_scan_id completed_on - filecount.scanned started_on - filecount.malicious last_updated - limit -- The maximum number of records to return. [Integer, 1-500] - offset -- The integer offset to start retrieving records from. Integer. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. id|desc or status|asc). - Available sort fields: - id filecount.skipped - scan_id status - host_id severity - filecount.scanned started_on - filecount.malicious completed_on - filecount.quarantined last_updated - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ods/query-scan-host-metadata + + Keyword arguments + ----------------- + filter : str + A FQL compatible query string. String. + Available filters: + id filecount.quarantined + cid filecount.skipped + profile_id affected_hosts_count + host_id status + scan_id severity + host_scan_id completed_on + filecount.scanned started_on + filecount.malicious last_updated + limit : int (1-500) + The maximum number of records to return. + offset : int + The integer offset to start retrieving records from. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. id|desc or status|asc). + Available sort fields: + id filecount.skipped + scan_id status + host_id severity + filecount.scanned started_on + filecount.malicious completed_on + filecount.quarantined last_updated + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -807,42 +984,52 @@ def query_scan_hosts(self: object, parameters: dict = None, **kwargs) -> Union[D def query_scans(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query for scans. - Keyword arguments: - filter -- A FQL compatible query string. String. - Available filters: - id filecount.quarantined - cid filecount.skipped - profile_id created_by - initiated_from status - affected_hosts_count severity - description.keyword scan_completed_on - filecount.scanned scan_started_on - filecount.malicious created_on - last_updated description - targeted_host_count missing_host_count - targeted_platforms targeted_platforms.keyword - limit -- The maximum number of records to return. [Integer, 1-500] - offset -- The integer offset to start retrieving records from. Integer. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. id|desc or status|asc). - Available sort fields: - id affected_hosts_count - initiated_from status - description.keyword severity - filecount.scanned scan_started_on - filecount.malicious scan_completed_on - filecount.quarantined created_on - filecount.skipped created_by - last_updated description - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ods/query-scans + + Keyword arguments + ----------------- + filter : str + A FQL compatible query string. String. + Available filters: + id filecount.quarantined + cid filecount.skipped + profile_id created_by + initiated_from status + affected_hosts_count severity + description.keyword scan_completed_on + filecount.scanned scan_started_on + filecount.malicious created_on + last_updated description + targeted_host_count missing_host_count + targeted_platforms targeted_platforms.keyword + limit : int (1-500) + The maximum number of records to return. + offset : int + The integer offset to start retrieving records from. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. id|desc or status|asc). + Available sort fields: + id affected_hosts_count + initiated_from status + description.keyword severity + filecount.scanned scan_started_on + filecount.malicious scan_completed_on + filecount.quarantined created_on + filecount.skipped created_by + last_updated description + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -856,39 +1043,50 @@ def query_scans(self: object, parameters: dict = None, **kwargs) -> Union[Dict[s def query_scheduled_scans(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query for scheduled scans. - Keyword arguments: - filter -- A FQL compatible query string. String. - Available filters: - channel_file_status created_by - created_on deleted - description description.keyword - id initiated_from - last_updated schedule.Interval - schedule.start_timestamp status - targeted_platforms - limit -- The maximum number of records to return. [Integer, 1-500] - offset -- The integer offset to start retrieving records from. Integer. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. id|desc or status|asc). - Available sort fields: - created_by|asc created_by|desc - created_on|asc created_on|desc - description.keyword|asc description.keyword|desc - description|asc description|desc - id|asc id|desc - last_updated|asc last_updated|desc - schedule.interval|asc schedule.interval|desc - schedule.start_timestamp|asc schedule.start_timestamp|desc - status|asc status|desc - targeted_host_count|asc targeted_host_count|desc - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/ods/query-scheduled-scans + + Keyword arguments + ----------------- + filter : str + A FQL compatible query string. String. + Available filters: + channel_file_status created_by + created_on deleted + description description.keyword + id initiated_from + last_updated schedule.Interval + schedule.start_timestamp status + targeted_platforms + limit : int (1-500) + The maximum number of records to return. + offset : int + The integer offset to start retrieving records from. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. id|desc or status|asc). + Available sort fields: + created_by|asc created_by|desc + created_on|asc created_on|desc + description.keyword|asc description.keyword|desc + description|asc description|desc + id|asc id|desc + last_updated|asc last_updated|desc + schedule.interval|asc schedule.interval|desc + schedule.start_timestamp|asc schedule.start_timestamp|desc + status|asc status|desc + targeted_host_count|asc targeted_host_count|desc + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/prevention_policy.py b/src/falconpy/prevention_policy.py index f6cd246f4..eb928f78d 100644 --- a/src/falconpy/prevention_policy.py +++ b/src/falconpy/prevention_policy.py @@ -65,25 +65,36 @@ def query_combined_policy_members(self: object, Returns a set of host details which match the filter criteria. - Keyword arguments: - id -- The ID of the Prevention Policy to search for members of - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /prevention-policies/queryCombinedPreventionPolicyMembers + /prevention-policies/queryCombinedPreventionPolicyMembers + + Keyword arguments + ----------------- + id : str + The ID of the Prevention Policy to search for members of + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -102,28 +113,38 @@ def query_combined_policies(self: object, Returns a set of Prevention Policies which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. - created_by modified_timestamp - created_timestamp name - enabled platform_name - modified_by precedence - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- [GET] https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /prevention-policies/queryCombinedPreventionPolicies + /prevention-policies/queryCombinedPreventionPolicies + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. + created_by modified_timestamp + created_timestamp name + enabled platform_name + modified_by precedence + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -141,15 +162,26 @@ def perform_policies_action(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Perform the specified action on the Prevention Policies specified in the request. - Keyword arguments: - action_name -- action to perform: 'add-host-group', 'add-rule-group', 'disable', - 'enable', 'remove-host-group', or 'remove-rule-group'. - action_parameters -- Action specific parameter options. List of dictionaries. - { - "name": "string", - "value": "string" - } - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html# + /prevention-policies/performPreventionPoliciesAction + + Keyword arguments + ----------------- + action_name : str + action to perform: 'add-host-group', 'add-rule-group', 'disable', + 'enable', 'remove-host-group', or 'remove-rule-group'. + action_parameters : list + Action specific parameter options. List of dictionaries. + { + "name": "string", + "value": "string" + } + body : dict + full body payload, not required if keywords are used. { "action_parameters": [ { @@ -161,20 +193,20 @@ def perform_policies_action(self: object, "string" ] } - group_id -- Host Group ID to apply the policy to. String. - Overridden if action_parameters is provided. - ids -- Prevention policy ID(s) to perform actions against. String or list of strings. - parameters - full parameters payload, not required if action_name is provide as a keyword. + group_id : str + Host Group ID to apply the policy to. String. + Overridden if action_parameters is provided. + ids : str or list[str] + Prevention policy ID(s) to perform actions against. + parameters : dict + full parameters payload, not required if action_name is provide as a keyword. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /prevention-policies/performPreventionPoliciesAction + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, payload_value="ids") @@ -204,26 +236,34 @@ def set_policies_precedence(self: object, body: dict = None, **kwargs) -> Union[ have the lowest. You must specify all non-Default Policies for a platform when updating precedence. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html# + /prevention-policies/setPreventionPoliciesPrecedence + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "ids": [ "string" ], "platform_name": "Windows" } - ids -- Prevention policy ID(s) to perform actions against. String or list of strings. - platform_name -- OS platform name. (Windows, Mac, Linux, Android, iOS) + ids : str or list[str] + Prevention policy ID(s) to perform actions against. + platform_name : str + OS platform name. (Windows, Mac, Linux, Android, iOS) This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /prevention-policies/setPreventionPoliciesPrecedence + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, payload_value="ids") @@ -241,19 +281,28 @@ def set_policies_precedence(self: object, body: dict = None, **kwargs) -> Union[ def get_policies(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve a set of Prevention Policies by specifying their IDs. - Keyword arguments: - ids -- List of Prevention Policy IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/prevention-policies/getPreventionPolicies + + Keyword arguments + ----------------- + ids : str or list[str] + List of Prevention Policy IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -267,8 +316,16 @@ def get_policies(self: object, *args, parameters: dict = None, **kwargs) -> Unio def create_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create Prevention Policies by specifying details about the policy to create. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/prevention-policies/createPreventionPolicies + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "resources": [ { @@ -285,25 +342,28 @@ def create_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str } ] } - clone_id -- Prevention Policy ID to clone. String. - description -- Prevention Policy description. String. - name -- Prevention Policy name. String. - platform_name -- Name of the operating system platform. String. - Allowed values: Windows, Mac, Linux, iOS, Android - settings -- Prevention policy specific settings. List of dictionaries. - { - "id": "string", - "value": {} - } + clone_id : str + Prevention Policy ID to clone. + description : str + Prevention Policy description. + name : str + Prevention Policy name. + platform_name : str + Name of the operating system platform. String. + Allowed values: Windows, Mac, Linux, iOS, Android + settings : list + Prevention policy specific settings. List of dictionaries. + { + "id": "string", + "value": {} + } This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/prevention-policies/createPreventionPolicies + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = prevention_policy_payload(passed_keywords=kwargs) @@ -319,19 +379,28 @@ def create_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str def delete_policies(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a set of Prevention Policies by specifying their IDs. - Keyword arguments: - ids -- List of Prevention Policy IDs to delete. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/prevention-policies/deletePreventionPolicies + + Keyword arguments + ----------------- + ids : str or list[str] + List of Prevention Policy IDs to delete. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -345,8 +414,16 @@ def delete_policies(self: object, *args, parameters: dict = None, **kwargs) -> U def update_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update Prevention Policies by specifying the ID of the policy and details to update. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/prevention-policies/updatePreventionPolicies + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "resources": [ { @@ -362,23 +439,25 @@ def update_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str } ] } - description -- Prevention Policy description. String. - id -- Prevention Policy ID to update. String. - name -- Prevention Policy name. String. - settings -- Prevention policy specific settings. List of dictionaries. - { - "id": "string", - "value": "string" - } + description : str + Prevention Policy description. + id : str + Prevention Policy ID to update. + name : str + Prevention Policy name. + settings : list + Prevention policy specific settings. List of dictionaries. + { + "id": "string", + "value": "string" + } This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/prevention-policies/updatePreventionPolicies + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = prevention_policy_payload(passed_keywords=kwargs) @@ -396,25 +475,36 @@ def query_policy_members(self: object, parameters: dict = None, **kwargs) -> Uni Returns a set of Agent IDs which match the filter criteria. - Keyword arguments: - id -- The ID of the Prevention Policy to search for members of - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /prevention-policies/queryPreventionPolicyMembers + /prevention-policies/queryPreventionPolicyMembers + + Keyword arguments + ----------------- + id : str + The ID of the Prevention Policy to search for members of + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -430,27 +520,37 @@ def query_policies(self: object, parameters: dict = None, **kwargs) -> Union[Dic Returns a set of Prevention Policy IDs which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. - created_by modified_timestamp - created_timestamp name - enabled platform_name - modified_by precedence - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/prevention-policies/queryPreventionPolicies + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. + created_by modified_timestamp + created_timestamp name + enabled platform_name + modified_by precedence + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/profile_groups.py b/src/falconpy/profile_groups.py index cf21c8020..51ef447f3 100644 --- a/src/falconpy/profile_groups.py +++ b/src/falconpy/profile_groups.py @@ -72,10 +72,19 @@ def group_actions_v1_mixin0(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Perform actions on profile groups (add/remove roles, user groups, FGA objects). - Keyword arguments: - action_name -- Action to perform. Available values: add_roles, remove_roles, add_user_groups, remove_user_groups, - add_fga_objects, remove_fga_objects. String. - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/profile-groups/GroupActionsV1Mixin0 + + Keyword arguments + ----------------- + action_name : str + Action to perform. Available values: add_roles, remove_roles, add_user_groups, remove_user_groups, + add_fga_objects, remove_fga_objects. + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "action_parameters": [ { @@ -88,19 +97,21 @@ def group_actions_v1_mixin0(self: object, "string" ] } - action_parameters -- The action_parameters value. List. - filter -- The filter value. String. - ids -- The ids value. List. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + action_parameters : list + The action_parameters value. + filter : str + The filter value. + ids : str or list[str] + The ids value. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/profile-groups/GroupActionsV1Mixin0 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = group_actions_v1_mixin0_payload(passed_keywords=kwargs) @@ -122,9 +133,18 @@ def group_users_actions_v1_mixin0(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Add or remove users from profile groups. - Keyword arguments: - action_name -- Action to perform. Available values: add_users, remove_users. String. - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/profile-groups/GroupUsersActionsV1Mixin0 + + Keyword arguments + ----------------- + action_name : str + Action to perform. Available values: add_users, remove_users. + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "action_parameters": [ { @@ -137,19 +157,21 @@ def group_users_actions_v1_mixin0(self: object, "string" ] } - action_parameters -- The action_parameters value. List. - filter -- The filter value. String. - ids -- The ids value. List. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + action_parameters : list + The action_parameters value. + filter : str + The filter value. + ids : str or list[str] + The ids value. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/profile-groups/GroupUsersActionsV1Mixin0 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = group_users_actions_v1_mixin0_payload(passed_keywords=kwargs) @@ -170,23 +192,30 @@ def get_group_users_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get a list of groups with users that belong to them. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/profile-groups/GetGroupUsersV1 + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "ids": [ "string" ] } - ids -- Profile Group IDs to get users for. List. + ids : str or list[str] + Profile Group IDs to get users for. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/profile-groups/GetGroupUsersV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = get_group_users_v1_payload(passed_keywords=kwargs) @@ -205,23 +234,30 @@ def get_groups_v1_mixin0(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get profile groups by IDs with full details. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/profile-groups/GetGroupsV1Mixin0 + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "ids": [ "string" ] } - ids -- Profile Group IDs to retrieve. List. + ids : str or list[str] + Profile Group IDs to retrieve. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/profile-groups/GetGroupsV1Mixin0 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = get_groups_v1_mixin0_payload(passed_keywords=kwargs) @@ -240,25 +276,34 @@ def create_group_v1_mixin0(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Create a new profile group. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/profile-groups/CreateGroupV1Mixin0 + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "cid": "string", "description": "string", "name": "string" } - cid -- CID for the new profile group in a Flight Control environment. String. - description -- Optional description for the group. String. - name -- Name for the new profile group. String. + cid : str + CID for the new profile group in a Flight Control environment. + description : str + Optional description for the group. + name : str + Name for the new profile group. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/profile-groups/CreateGroupV1Mixin0 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = create_group_v1_mixin0_payload(passed_keywords=kwargs) @@ -278,19 +323,28 @@ def delete_groups_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete profile groups by IDs. - Keyword arguments: - ids -- Group IDs to delete String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/profile-groups/DeleteGroupsV1 + + Keyword arguments + ----------------- + ids : str or list[str] + Group IDs to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -308,25 +362,35 @@ def update_group_v1_mixin0(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update profile group metadata (name, description). - Keyword arguments: - id -- ID of the group to update. String. - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/profile-groups/UpdateGroupV1Mixin0 + + Keyword arguments + ----------------- + id : str + ID of the group to update. + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "description": "string", "name": "string" } - description -- New description for the group. String. - name -- New name for the group. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + description : str + New description for the group. + name : str + New name for the group. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/profile-groups/UpdateGroupV1Mixin0 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = update_group_v1_mixin0_payload(passed_keywords=kwargs) @@ -347,23 +411,30 @@ def get_user_groups_v1(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get a list of users with the groups that they belong to. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/profile-groups/GetUserGroupsV1 + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "ids": [ "string" ] } - ids -- User UUIDs to get groups for. List. + ids : str or list[str] + User UUIDs to get groups for. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/profile-groups/GetUserGroupsV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = get_user_groups_v1_payload(passed_keywords=kwargs) @@ -382,21 +453,31 @@ def query_groups_v1_mixin0(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Query profile group IDs with FQL filtering, pagination, and sorting. - Keyword arguments: - filter -- FQL filter expression to filter groups by name or cid. String. - sort -- Sort by field|direction (name, updated_at, member_count). String. - offset -- Number of groups to skip. Integer. - limit -- Maximum groups to return [1-500]. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/profile-groups/QueryGroupsV1Mixin0 + + Keyword arguments + ----------------- + filter : str + FQL filter expression to filter groups by name or cid. + sort : str + Sort by field|direction (name, updated_at, member_count) + offset : int + Number of groups to skip. + limit : int + Maximum groups to return [1-500] + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/quarantine.py b/src/falconpy/quarantine.py index 4ee69bb4a..4f81f0e27 100644 --- a/src/falconpy/quarantine.py +++ b/src/falconpy/quarantine.py @@ -64,20 +64,29 @@ def action_update_count(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Return the count of potentially affected quarantined files for each action. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - An asterisk wildcard '*' includes all results. - parameters - full parameters payload, not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/quarantine/ActionUpdateCount + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + An asterisk wildcard '*' includes all results. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -91,8 +100,16 @@ def action_update_count(self: object, def get_aggregate_files(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get quarantine file aggregates as specified via json in request body. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/quarantine/GetAggregateFiles + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. { "date_ranges": [ { @@ -125,38 +142,44 @@ def get_aggregate_files(self: object, body: dict = None, **kwargs) -> Union[Dict "time_zone": "string", "type": "string" } - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/quarantine/GetAggregateFiles + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = aggregate_payload(submitted_keywords=kwargs) @@ -172,24 +195,33 @@ def get_aggregate_files(self: object, body: dict = None, **kwargs) -> Union[Dict def get_quarantine_files(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get quarantine file metadata for specified ids. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/quarantine/GetQuarantineFiles + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "ids": [ "string" ] } - ids -- List of quarantine IDs to retrieve metadata for. String or list of strings. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/quarantine/GetQuarantineFiles + ids : str or list[str] + List of quarantine IDs to retrieve metadata for. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, @@ -210,11 +242,21 @@ def update_quarantined_detects_by_id(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Apply action by quarantine file ids. - Keyword arguments: - action -- Action to perform against the quarantined file. String. - Allowed values: 'release', 'unrelease', 'delete' - comment -- Comment to list along with action taken. String. - body -- full body payload, not required when using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/quarantine/UpdateQuarantinedDetectsByIds + + Keyword arguments + ----------------- + action : str + Action to perform against the quarantined file. String. + Allowed values: 'release', 'unrelease', 'delete' + comment : str + Comment to list along with action taken. + body : dict + full body payload, not required when using other keywords. { "action": "string", "comment": "string", @@ -222,16 +264,15 @@ def update_quarantined_detects_by_id(self: object, "string" ] } - ids -- List of quarantine IDs to perform an action on. String or list of strings. + ids : str or list[str] + List of quarantine IDs to perform an action on. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/quarantine/UpdateQuarantinedDetectsByIds + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, @@ -253,49 +294,54 @@ def update_quarantined_detects_by_id(self: object, def query_quarantine_files(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get quarantine file ids that match the provided filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - Special value '*' means to not filter on anything. - Available filters - adversary_id behaviors.username - behaviors.behavior_id device.country - behaviors.ioc_type device.device_id - behaviors.ioc_value device.hostname - behaviors.tree_root_hash status - - Available range filters - first_behavior max_confidence - last_behavior max_severity - - q -- Match phrase_prefix query criteria, searches all filter string fields. - sha256 hostname - state username - paths.path date_updated - paths.state date_created - - limit -- The maximum number of records to return in this response. Integer. - Use with the offset parameter to manage pagination of results. - - offset -- Starting index of overall result set from which to return ids. - Use with the limit parameter to manage pagination of results. - - parameters - full parameters payload, not required if using other keywords. - - sort -- The property to sort by. FQL syntax (e.g. date_created|asc). - Available sort fields - date_created paths.state - date_updated state - hostname username - paths.path - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/quarantine/QueryQuarantineFiles + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Special value '*' means to not filter on anything. + Available filters + adversary_id behaviors.username + behaviors.behavior_id device.country + behaviors.ioc_type device.device_id + behaviors.ioc_value device.hostname + behaviors.tree_root_hash status + Available range filters + first_behavior max_confidence + last_behavior max_severity + q : str + Match phrase_prefix query criteria, searches all filter string fields. + sha256 hostname + state username + paths.path date_updated + paths.state date_created + limit : int + The maximum number of records to return in this response. Integer. + Use with the offset parameter to manage pagination of results. + offset : str + Starting index of overall result set from which to return ids. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. date_created|asc). + Available sort fields + date_created paths.state + date_updated state + hostname username + paths.path + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -312,27 +358,36 @@ def update_quarantined_detects_by_query(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Apply quarantine file actions by query. - Keyword arguments: - action -- Action to perform against the quarantined file. String. - Allowed values: 'release', 'unrelease', 'delete' - comment -- Comment to list along with action taken. String. - body -- full body payload, not required when using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/quarantine/UpdateQfByQuery + + Keyword arguments + ----------------- + action : str + Action to perform against the quarantined file. String. + Allowed values: 'release', 'unrelease', 'delete' + comment : str + Comment to list along with action taken. + body : dict + full body payload, not required when using other keywords. { "action": "string", "comment": "string", "filter": "string", "q": "string" } - ids -- List of quarantine IDs to perform an action on. String or list of strings. + ids : str or list[str] + List of quarantine IDs to perform an action on. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/quarantine/UpdateQfByQuery + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = {} diff --git a/src/falconpy/quick_scan.py b/src/falconpy/quick_scan.py index 90c9f3f0d..72e59668f 100644 --- a/src/falconpy/quick_scan.py +++ b/src/falconpy/quick_scan.py @@ -60,8 +60,16 @@ class QuickScan(ServiceClass): def get_scans_aggregates(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get scans aggregations as specified via json in request body. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/quick-scan/GetScansAggregates + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. { "date_ranges": [ { @@ -90,31 +98,34 @@ def get_scans_aggregates(self: object, body: dict = None, **kwargs) -> Union[Dic "time_zone": "string", "type": "string" } - date_ranges -- List of dictionaries. - field -- String. - filter -- FQL syntax. String. - interval -- String. - min_doc_count -- Minimum number of documents required to match. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + field : str + filter : str + FQL syntax. + interval : str + min_doc_count : int + Minimum number of documents required to match. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str + String. + This method does not support body payload validation. This method only supports keywords for providing arguments. - This method does not support body payload validation. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/quick-scan/GetScansAggregates + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = aggregate_payload(submitted_keywords=kwargs) @@ -133,19 +144,28 @@ def get_scans(self: object, *args, parameters: dict = None, **kwargs) -> Union[D Time required for analysis increases with the number of samples in a volume but usually it should take less than 1 minute. - Keyword arguments: - ids -- One or more remediation IDs. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/quick-scan/GetScans + + Keyword arguments + ----------------- + ids : str or list[str] + One or more remediation IDs. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -159,25 +179,34 @@ def get_scans(self: object, *args, parameters: dict = None, **kwargs) -> Union[D def scan_samples(self: object, *args, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get scans aggregations as specified via json in request body. - Keyword arguments: - body -- full body payload, not required when samples keyword is provided. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/quick-scan/ScanSamples + + Keyword arguments + ----------------- + body : dict + full body payload, not required when samples keyword is provided. { "samples": [ "string" ] } - samples -- SHA256(s) of the samples to scan. Must have been previously submitted using - SampleUploadV3 (SampleUploads class). String or list of strings. - - Arguments: When not specified, the first argument to this method is assumed to be - 'samples'. All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/quick-scan/ScanSamples + samples : str or list[str] + SHA256(s) of the samples to scan. Must have been previously submitted using + SampleUploadV3 (SampleUploads class) + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'samples'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_arguments=args, @@ -200,21 +229,31 @@ def query_submissions(self: object, parameters: dict = None, **kwargs) -> Union[ Returns a set of volume IDs that match your criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return. [integer, 1-5000] - offset -- The integer offset to start retrieving records from. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/quick-scan/QuerySubmissionsMixin0 + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int (1-5000) + The maximum number of records to return. + offset : str + The integer offset to start retrieving records from. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/quick_scan_pro.py b/src/falconpy/quick_scan_pro.py index 1d6807e7d..6898312b6 100644 --- a/src/falconpy/quick_scan_pro.py +++ b/src/falconpy/quick_scan_pro.py @@ -65,23 +65,33 @@ class QuickScanPro(ServiceClass): def upload_file(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Upload a file to be further analyzed with QuickScan Pro. The samples expire after 90 days. - Keyword arguments: - file -- Binary file to be uploaded. Max file size: 256 MB. - scan -- If true, after upload, it starts scanning immediately. Default scan mode is 'false' - file_name -- Name of the file uploaded. Defaults to "UploadedFile". - password -- MULTIPART ONLY - Password for encrypted archives (use for multipart/form-data uploads). - If 'scan' is true, the value is used for the scan just starting. String. - x_file_password -- OCTET-STREAM ONLY - Password for encrypted archives (use for octet-stream uploads). - If 'scan' is true, the value is used for the scan just starting. String. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/quick-scan-pro/UploadFileQuickScanPro + + Keyword arguments + ----------------- + file : str + Binary file to be uploaded. Max file size: 256 MB. + scan : str + If true, after upload, it starts scanning immediately. Default scan mode is 'false' + file_name : str + Name of the file uploaded. Defaults to "UploadedFile". + password : str + MULTIPART ONLY - Password for encrypted archives (use for multipart/form-data uploads). + If 'scan' is true, the value is used for the scan just starting. + x_file_password : str + OCTET-STREAM ONLY - Password for encrypted archives (use for octet-stream uploads). + If 'scan' is true, the value is used for the scan just starting. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ header_payload = json.loads(json.dumps(self.headers)) if kwargs.get("x_file_password"): @@ -116,19 +126,28 @@ def upload_file(self: object, parameters: dict = None, **kwargs) -> Union[Dict[s def delete_file(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete file by its sha256 identifier. - Keyword arguments: - ids -- File's SHA256 to be deleted. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/quick-scan-pro/DeleteFile + + Keyword arguments + ----------------- + ids : str or list[str] + File's SHA256 to be deleted. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -142,19 +161,28 @@ def delete_file(self: object, *args, parameters: dict = None, **kwargs) -> Union def get_scan_result(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get the result of an QuickScan Pro scan. - Keyword arguments: - ids -- Scan IDs previously created by the LaunchScan operation. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/quick-scan-pro/GetScanResult + + Keyword arguments + ----------------- + ids : str or list[str] + Scan IDs previously created by the LaunchScan operation. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -168,8 +196,16 @@ def get_scan_result(self: object, *args, parameters: dict = None, **kwargs) -> U def launch_scan(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Start scanning a file uploaded through '/quickscanpro/entities/files/v1'. - Keyword arguments: - body -- Full body payload in dictionary format. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/quick-scan-pro/LaunchScan + + Keyword arguments + ----------------- + body : dict + Full body payload in dictionary format. Not required if using other keywords. { "resources": [ { @@ -177,16 +213,15 @@ def launch_scan(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Un } ] } - sha256 -- SHA256 hash of the file to be scanned. String. + sha256 : str + SHA256 hash of the file to be scanned. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/quick-scan-pro/LaunchScan + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body["resources"] = [] @@ -212,19 +247,28 @@ def delete_scan_result(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete the result of an QuickScan Pro scan. - Keyword arguments: - ids -- Scan IDs previously created by the LaunchScan operation. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/quick-scan-pro/DeleteScanResult + + Keyword arguments + ----------------- + ids : str or list[str] + Scan IDs previously created by the LaunchScan operation. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -238,22 +282,32 @@ def delete_scan_result(self: object, def query_scan_results(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get QuickScan Pro scan jobs for a given FQL filter. - Keyword arguments: - filter -- FQL query which contains the SHA256 field. String. - offset -- The offset to start retrieving IDs from. Integer. - limit -- Maximum number of IDs to return. Max: 5000. Integer. - sort -- Sort order in FQL format: `asc` or `desc`. - Supported field: `created_timestamp`. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/quick-scan-pro/QueryScanResults + + Keyword arguments + ----------------- + filter : str + FQL query which contains the SHA256 field. + offset : int + The offset to start retrieving IDs from. + limit : int + Maximum number of IDs to return. Max: 5000. + sort : str + Sort order in FQL format: `asc` or `desc`. + Supported field: `created_timestamp` + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/real_time_response.py b/src/falconpy/real_time_response.py index 2399c956e..460adcbb8 100644 --- a/src/falconpy/real_time_response.py +++ b/src/falconpy/real_time_response.py @@ -66,8 +66,16 @@ def aggregate_sessions(self: object, body: list = None, **kwargs) -> Union[Dict[ date_range term - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/RTR-AggregateSessions + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -102,40 +110,46 @@ def aggregate_sessions(self: object, body: list = None, **kwargs) -> Union[Dict[ "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str + String. + This method does not support body payload validation. This method only supports keywords for providing arguments. - This method does not support body payload validation. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/RTR-AggregateSessions + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -155,8 +169,16 @@ def batch_active_responder_command(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Batch executes a RTR active-responder command across hosts mapped to a given batch ID. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/BatchActiveResponderCmd + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "base_command": "string", "batch_id": "string", @@ -166,33 +188,39 @@ def batch_active_responder_command(self: object, ], "persist_all": true } - base_command -- Active-Responder command type we are going to execute, - for example: `get` or `cp`. String. - Refer to the RTR documentation for the full list of commands. - batch_id -- Batch ID to execute the command on. Received from batch_init_session. String. - command_string -- Full command string for the command. For example `get some_file.txt`. - host_timeout_duration -- Timeout duration for how long a host has time to complete processing. - Default value is a bit less than the overall timeout value. - It cannot be greater than the overall request timeout. Maximum is < 10 minutes. - Example, `10s`. Valid units: `ns, us, ms, s, m, h`. - optional_hosts -- List of a subset of hosts we want to run the command on. - If this list is supplied, only these hosts will receive the command. - parameters -- full parameters payload in JSON format. Not required if using other keywords. - persist_all -- Boolean. - timeout -- Timeout for how long to wait for the request in seconds. - Default timeout: 30 seconds Max timeout: 10 minutes - timeout_duration -- Timeout duration for how long to wait for the request in duration - syntax. Example: `10s`. Default value: `30s`. Maximum is `10m`. - Valid units: `ns`, `us`, `ms`, `s`, `m`, `h` + base_command : str + Active-Responder command type we are going to execute, + for example: `get` or `cp`. String. + Refer to the RTR documentation for the full list of commands. + batch_id : str + Batch ID to execute the command on. Received from batch_init_session. + command_string : str + Full command string for the command. For example `get some_file.txt`. + host_timeout_duration : str + Timeout duration for how long a host has time to complete processing. + Default value is a bit less than the overall timeout value. + It cannot be greater than the overall request timeout. Maximum is < 10 minutes. + Example, `10s`. Valid units: `ns, us, ms, s, m, h`. + optional_hosts : str or list[str] + List of a subset of hosts we want to run the command on. + If this list is supplied, only these hosts will receive the command. + parameters : dict + Full parameters payload. Not required if using other keywords. + persist_all : bool + timeout : int + Timeout for how long to wait for the request in seconds. + Default timeout: 30 seconds Max timeout: 10 minutes + timeout_duration : str + Timeout duration for how long to wait for the request in duration + syntax. Example: `10s`. Default value: `30s`. Maximum is `10m`. + Valid units: `ns`, `us`, `ms`, `s`, `m`, `h` This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/BatchActiveResponderCmd + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = command_payload(passed_keywords=kwargs) @@ -214,8 +242,16 @@ def batch_command(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Batch executes a RTR read-only command across the hosts mapped to the given batch ID. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/BatchCmd + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "base_command": "string", "batch_id": "string", @@ -225,33 +261,39 @@ def batch_command(self: object, ], "persist_all": true } - base_command -- Active-Responder command type we are going to execute, - for example: `get` or `cp`. String. - Refer to the RTR documentation for the full list of commands. - batch_id -- Batch ID to execute the command on. Received from batch_init_session. String. - command_string -- Full command string for the command. For example `get some_file.txt`. - host_timeout_duration -- Timeout duration for how long a host has time to complete processing. - Default value is a bit less than the overall timeout value. - It cannot be greater than the overall request timeout. Maximum is < 10 minutes. - Example, `10s`. Valid units: `ns, us, ms, s, m, h`. - optional_hosts -- List of a subset of hosts we want to run the command on. - If this list is supplied, only these hosts will receive the command. - parameters -- full parameters payload in JSON format. Not required if using other keywords. - persist_all -- Boolean. - timeout -- Timeout for how long to wait for the request in seconds. - Default timeout: 30 seconds Max timeout: 10 minutes - timeout_duration -- Timeout duration for how long to wait for the request in duration - syntax. Example: `10s`. Default value: `30s`. Maximum is `10m`. - Valid units: `ns`, `us`, `ms`, `s`, `m`, `h` + base_command : str + Active-Responder command type we are going to execute, + for example: `get` or `cp`. String. + Refer to the RTR documentation for the full list of commands. + batch_id : str + Batch ID to execute the command on. Received from batch_init_session. + command_string : str + Full command string for the command. For example `get some_file.txt`. + host_timeout_duration : str + Timeout duration for how long a host has time to complete processing. + Default value is a bit less than the overall timeout value. + It cannot be greater than the overall request timeout. Maximum is < 10 minutes. + Example, `10s`. Valid units: `ns, us, ms, s, m, h`. + optional_hosts : str or list[str] + List of a subset of hosts we want to run the command on. + If this list is supplied, only these hosts will receive the command. + parameters : dict + Full parameters payload. Not required if using other keywords. + persist_all : bool + timeout : int + Timeout for how long to wait for the request in seconds. + Default timeout: 30 seconds Max timeout: 10 minutes + timeout_duration : str + Timeout duration for how long to wait for the request in duration + syntax. Example: `10s`. Default value: `30s`. Maximum is `10m`. + Valid units: `ns`, `us`, `ms`, `s`, `m`, `h` This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/BatchCmd + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = command_payload(passed_keywords=kwargs) @@ -275,24 +317,35 @@ def batch_get_command_status(self: object, Will return successful files when they are finished processing. - Keyword arguments: - timeout -- Timeout for how long to wait for the request in seconds. - Default timeout: 30 seconds Max timeout: 10 minutes - timeout_duration -- Timeout duration for how long to wait for the request in duration - syntax. Example: `10s`. Maximum is `10m`. - Valid units: `ns`, `us`, `ms`, `s`, `m`, `h` - batch_get_cmd_req_id -- Batch Get Command Request ID received from batch_command. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be - 'batch_get_cmd_req_id'. All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/BatchGetCmdStatus + + Keyword arguments + ----------------- + timeout : int + Timeout for how long to wait for the request in seconds. + Default timeout: 30 seconds Max timeout: 10 minutes + timeout_duration : str + Timeout duration for how long to wait for the request in duration + syntax. Example: `10s`. Maximum is `10m`. + Valid units: `ns`, `us`, `ms`, `s`, `m`, `h` + batch_get_cmd_req_id : str + Batch Get Command Request ID received from batch_command. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'batch_get_cmd_req_id'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -312,8 +365,16 @@ def batch_get_command(self: object, After this call is made batch_get_command_status is used to query for the results. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/BatchGetCmd + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "batch_id": "string", "file_path": "string", @@ -322,29 +383,34 @@ def batch_get_command(self: object, ] } - batch_id -- Batch ID to execute the command on. Received from batch_init_session. String. - file_path -- Full path to the file that is to be retrieved from each host in the batch. - host_timeout_duration -- Timeout duration for how long a host has time to complete processing. - Default value is a bit less than the overall timeout value. - It cannot be greater than the overall request timeout. Maximum is < 10 minutes. - Example, `10s`. Valid units: `ns, us, ms, s, m, h`. - optional_hosts -- List of a subset of hosts we want to run the command on. - If this list is supplied, only these hosts will receive the command. - parameters -- full parameters payload in JSON format. Not required if using other keywords. - timeout -- Timeout for how long to wait for the request in seconds. - Default timeout: 30 seconds Max timeout: 10 minutes - timeout_duration -- Timeout duration for how long to wait for the request in duration - syntax. Example: `10s`. Default value: `30s`. Maximum is `10m`. - Valid units: `ns`, `us`, `ms`, `s`, `m`, `h` + batch_id : str + Batch ID to execute the command on. Received from batch_init_session. + file_path : str + Full path to the file that is to be retrieved from each host in the batch. + host_timeout_duration : str + Timeout duration for how long a host has time to complete processing. + Default value is a bit less than the overall timeout value. + It cannot be greater than the overall request timeout. Maximum is < 10 minutes. + Example, `10s`. Valid units: `ns, us, ms, s, m, h`. + optional_hosts : str or list[str] + List of a subset of hosts we want to run the command on. + If this list is supplied, only these hosts will receive the command. + parameters : dict + Full parameters payload. Not required if using other keywords. + timeout : int + Timeout for how long to wait for the request in seconds. + Default timeout: 30 seconds Max timeout: 10 minutes + timeout_duration : str + Timeout duration for how long to wait for the request in duration + syntax. Example: `10s`. Default value: `30s`. Maximum is `10m`. + Valid units: `ns`, `us`, `ms`, `s`, `m`, `h` This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/BatchGetCmd + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = command_payload(passed_keywords=kwargs) @@ -368,8 +434,16 @@ def batch_init_sessions(self: object, Before any RTR commands can be used, an active session is needed on the host. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/BatchInitSessions + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "existing_batch_id": "string", "host_ids": [ @@ -378,30 +452,35 @@ def batch_init_sessions(self: object, "queue_offline": boolean } - existing_batch_id -- Optional batch ID. Use an existing batch ID if you want to - initialize new hosts and add them to the existing batch. String. - host_ids -- List of host agent ID's to initialize a RTR session on. List of strings. - host_timeout_duration -- Timeout duration for how long a host has time to complete processing. - Default value is a bit less than the overall timeout value. - It cannot be greater than the overall request timeout. Maximum is < 10 minutes. - Example, `10s`. Valid units: `ns, us, ms, s, m, h`. - queue_offline -- Boolean indicating if the command should be queued for execution when - the host returns online. - parameters -- full parameters payload in JSON format. Not required if using other keywords. - timeout -- Timeout for how long to wait for the request in seconds. - Default timeout: 30 seconds Max timeout: 10 minutes - timeout_duration -- Timeout duration for how long to wait for the request in duration - syntax. Example: `10s`. Default value: `30s`. Maximum is `10m`. - Valid units: `ns`, `us`, `ms`, `s`, `m`, `h` + existing_batch_id : str + Optional batch ID. Use an existing batch ID if you want to + initialize new hosts and add them to the existing batch. + host_ids : str or list[str] + List of host agent ID's to initialize a RTR session on. + host_timeout_duration : str + Timeout duration for how long a host has time to complete processing. + Default value is a bit less than the overall timeout value. + It cannot be greater than the overall request timeout. Maximum is < 10 minutes. + Example, `10s`. Valid units: `ns, us, ms, s, m, h`. + queue_offline : bool + Boolean indicating if the command should be queued for execution when + the host returns online. + parameters : dict + Full parameters payload. Not required if using other keywords. + timeout : int + Timeout for how long to wait for the request in seconds. + Default timeout: 30 seconds Max timeout: 10 minutes + timeout_duration : str + Timeout duration for how long to wait for the request in duration + syntax. Example: `10s`. Default value: `30s`. Maximum is `10m`. + Valid units: `ns`, `us`, `ms`, `s`, `m`, `h` This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/BatchInitSessions + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = command_payload(passed_keywords=kwargs) @@ -425,32 +504,43 @@ def batch_refresh_sessions(self: object, RTR sessions will expire after 10 minutes unless refreshed. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/BatchRefreshSessions + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "batch_id": "string", "hosts_to_remove": [ "string" ] } - batch_id -- Batch ID to execute the command on. Received from batch_init_session. String. - hosts_to_remove -- Hosts to remove from the batch session. Heartbeats will no longer happen - on these hosts and the sessions will expire. - parameters -- full parameters payload in JSON format. Not required if using other keywords. - timeout -- Timeout for how long to wait for the request in seconds. - Default timeout: 30 seconds Max timeout: 10 minutes - timeout_duration -- Timeout duration for how long to wait for the request in duration - syntax. Example: `10s`. Default value: `30s`. Maximum is `10m`. - Valid units: `ns`, `us`, `ms`, `s`, `m`, `h` + batch_id : str + Batch ID to execute the command on. Received from batch_init_session. + hosts_to_remove : str or list[str] + Hosts to remove from the batch session. Heartbeats will no longer happen + on these hosts and the sessions will expire. + parameters : dict + Full parameters payload. Not required if using other keywords. + timeout : int + Timeout for how long to wait for the request in seconds. + Default timeout: 30 seconds Max timeout: 10 minutes + timeout_duration : str + Timeout duration for how long to wait for the request in duration + syntax. Example: `10s`. Default value: `30s`. Maximum is `10m`. + Valid units: `ns`, `us`, `ms`, `s`, `m`, `h` This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/BatchRefreshSessions + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = command_payload(passed_keywords=kwargs) @@ -472,22 +562,32 @@ def check_active_responder_command_status(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get status of an executed active-responder command on a single host. - Keyword arguments: - cloud_request_id -- Cloud Request ID of the executed command to query. - sequence_id -- Sequence ID that we want to retrieve. Command responses are - chunked across sequences. Default value: 0 - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be - 'cloud_request_id'. All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /real-time-response/RTR-CheckActiveResponderCommandStatus + /real-time-response/RTR-CheckActiveResponderCommandStatus + + Keyword arguments + ----------------- + cloud_request_id : str + Cloud Request ID of the executed command to query. + sequence_id : int + Sequence ID that we want to retrieve. Command responses are + chunked across sequences. Default value: 0 + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'cloud_request_id'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not kwargs.get("sequence_id", None) and not parameters.get("sequence_id", None): parameters["sequence_id"] = 0 @@ -507,8 +607,16 @@ def execute_active_responder_command(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Execute an active responder command on a single host. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/RTR-ExecuteActiveResponderCommand + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "base_command": "string", "command_string": "string", @@ -517,23 +625,27 @@ def execute_active_responder_command(self: object, "persist": boolean, "session_id": "string" } - base_command -- Active-Responder command type we are going to execute, - for example: `get` or `cp`. String. - Refer to the RTR documentation for the full list of commands. - command_string -- Full command string for the command. For example `get some_file.txt`. - device_id -- ID of the device to execute the command on. String. - id -- Command sequence. Integer. - persist -- Execute this command when host returns to service. Boolean. - session_id -- RTR session ID. String. + base_command : str + Active-Responder command type we are going to execute, + for example: `get` or `cp`. String. + Refer to the RTR documentation for the full list of commands. + command_string : str + Full command string for the command. For example `get some_file.txt`. + device_id : str + ID of the device to execute the command on. + id : int + Command sequence. + persist : bool + Execute this command when host returns to service. + session_id : str + RTR session ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/RTR-ExecuteActiveResponderCommand + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = command_payload(passed_keywords=kwargs) @@ -553,21 +665,31 @@ def check_command_status(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get status of an executed command on a single host. - Keyword arguments: - cloud_request_id -- Cloud Request ID of the executed command to query. - sequence_id -- Sequence ID that we want to retrieve. Command responses are - chunked across sequences. Default value: 0 - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be - 'cloud_request_id'. All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/RTR-CheckCommandStatus + + Keyword arguments + ----------------- + cloud_request_id : str + Cloud Request ID of the executed command to query. + sequence_id : int + Sequence ID that we want to retrieve. Command responses are + chunked across sequences. Default value: 0 + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'cloud_request_id'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not kwargs.get("sequence_id", None) and not parameters.get("sequence_id", None): parameters["sequence_id"] = 0 @@ -584,8 +706,16 @@ def check_command_status(self: object, def execute_command(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Execute a command on a single host. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/RTR-ExecuteCommand + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "base_command": "string", "command_string": "string", @@ -594,23 +724,27 @@ def execute_command(self: object, body: dict = None, **kwargs) -> Union[Dict[str "persist": boolean, "session_id": "string" } - base_command -- Active-Responder command type we are going to execute, - for example: `get` or `cp`. String. - Refer to the RTR documentation for the full list of commands. - command_string -- Full command string for the command. For example `get some_file.txt`. - device_id -- ID of the device to execute the command on. String. - id -- Command sequence. Integer. - persist -- Execute this command when host returns to service. Boolean. - session_id -- RTR session ID. String. + base_command : str + Active-Responder command type we are going to execute, + for example: `get` or `cp`. String. + Refer to the RTR documentation for the full list of commands. + command_string : str + Full command string for the command. For example `get some_file.txt`. + device_id : str + ID of the device to execute the command on. + id : int + Command sequence. + persist : bool + Execute this command when host returns to service. + session_id : str + RTR session ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/RTR-ExecuteCommand + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = command_payload(passed_keywords=kwargs) @@ -629,22 +763,31 @@ def get_extracted_file_contents(self: object, ) -> Union[Dict[str, Union[str, int, dict]], Result, Response]: """Get RTR extracted file contents for specified session and sha256. - Keyword arguments: - session_id -- RTR Session ID. String. - sha256 -- Extracted SHA256 value. String. - filename -- Filename to use for the archive name and the file within the archive. String. - stream -- Enabling streaming download for the requested file. Boolean. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - This method only supports keywords for providing arguments. - - Returns: 7zip compressed binary object on SUCCESS - dict object containing API response on FAILURE. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/RTR-GetExtractedFileContents + + Keyword arguments + ----------------- + session_id : str + RTR Session ID. + sha256 : str + Extracted SHA256 value. + filename : str + Filename to use for the archive name and the file within the archive. + stream : bool + Enabling streaming download for the requested file. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + This method only supports keywords for providing arguments. + + Returns + ------- + 7zip compressed binary object on SUCCESS + dict object containing API response on FAILURE. """ return process_service_request( calling_object=self, @@ -659,19 +802,28 @@ def get_extracted_file_contents(self: object, def list_files(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get a list of files for the specified RTR session. - Keyword arguments: - session_id -- RTR Session ID. String. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be - 'session_id'. All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/RTR-ListFiles + + Keyword arguments + ----------------- + session_id : str + RTR Session ID. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'session_id'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -685,19 +837,28 @@ def list_files(self: object, *args, parameters: dict = None, **kwargs) -> Union[ def list_files_v2(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get a list of files for the specified RTR session. - Keyword arguments: - session_id -- RTR Session ID. String. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be - 'session_id'. All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/RTR-ListFilesV2 + + Keyword arguments + ----------------- + session_id : str + RTR Session ID. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'session_id'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -711,19 +872,27 @@ def list_files_v2(self: object, *args, parameters: dict = None, **kwargs) -> Uni def delete_file(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a RTR session file. - Keyword arguments: - ids -- RTR Session file ID. String. - session_id -- RTR Session ID. String. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/RTR-DeleteFile + + Keyword arguments + ----------------- + ids : str + RTR Session file ID. + session_id : str + RTR Session ID. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -737,19 +906,27 @@ def delete_file(self: object, parameters: dict = None, **kwargs) -> Union[Dict[s def delete_file_v2(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a RTR session file. - Keyword arguments: - ids -- RTR Session file ID. String. - session_id -- RTR Session ID. String. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/RTR-DeleteFileV2 + + Keyword arguments + ----------------- + ids : str + RTR Session file ID. + session_id : str + RTR Session ID. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -763,26 +940,33 @@ def delete_file_v2(self: object, parameters: dict = None, **kwargs) -> Union[Dic def pulse_session(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Refresh a session timeout on a single host. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/RTR-PulseSession + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "device_id": "string", "origin": "string", "queue_offline": true } - device_id -- The host agent ID to initialize the RTR session on. String. - RTR will retrieve an existing session for the calling user on this host. - origin -- String. - queue_offline -- Boolean. + device_id : str + The host agent ID to initialize the RTR session on. String. + RTR will retrieve an existing session for the calling user on this host. + origin : str + queue_offline : bool This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/RTR-PulseSession + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = command_payload(passed_keywords=kwargs) @@ -798,25 +982,31 @@ def pulse_session(self: object, body: dict = None, **kwargs) -> Union[Dict[str, def list_sessions(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get session metadata by session id. - Keyword arguments: - body -- full body payload, not required if ids are provided as keyword. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/RTR-ListSessions + + Keyword arguments + ----------------- + body : dict + full body payload, not required if ids are provided as keyword. { "ids": [ "string" ] } - ids -- List of RTR sessions to retrieve. - RTR will only return the sessions that were created by the calling user. - String or list of strings. + ids : str or list[str] + List of RTR sessions to retrieve. + RTR will only return the sessions that were created by the calling user. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/RTR-ListSessions + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, payload_value="ids") @@ -832,25 +1022,31 @@ def list_sessions(self: object, body: dict = None, **kwargs) -> Union[Dict[str, def list_queued_sessions(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get session metadata by session id. - Keyword arguments: - body -- full body payload, not required if ids are provided as keyword. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/RTR-ListQueuedSessions + + Keyword arguments + ----------------- + body : dict + full body payload, not required if ids are provided as keyword. { "ids": [ "string" ] } - ids -- List of RTR sessions to retrieve. - RTR will only return the sessions that were created by the calling user. - String or list of strings. + ids : str or list[str] + List of RTR sessions to retrieve. + RTR will only return the sessions that were created by the calling user. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/RTR-ListQueuedSessions + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, payload_value="ids") @@ -866,31 +1062,40 @@ def list_queued_sessions(self: object, body: dict = None, **kwargs) -> Union[Dic def init_session(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Initialize a new session with the RTR cloud. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/RTR-InitSession + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "device_id": "string", "origin": "string", "queue_offline": true } - device_id -- The host agent ID to initialize the RTR session on. String. - RTR will retrieve an existing session for the calling user on this host. - origin -- String. - queue_offline -- Boolean. - timeout -- Timeout for how long to wait for the request in seconds. Integer. - Default: 30 Maximum: 600 - timeout_duration -- Timeout duration for how long to wait for the request in duration syntax. - Example: 10s Valid units: ns, us, ms, s, m, h - Maximum is 10 minutes. Integer. + device_id : str + The host agent ID to initialize the RTR session on. String. + RTR will retrieve an existing session for the calling user on this host. + origin : str + queue_offline : bool + timeout : int + Timeout for how long to wait for the request in seconds. Integer. + Default: 30 Maximum: 600 + timeout_duration : str + Timeout duration for how long to wait for the request in duration syntax. + Example: 10s Valid units: ns, us, ms, s, m, h + Maximum is 10 minutes. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/RTR-InitSession + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = command_payload(passed_keywords=kwargs) @@ -906,19 +1111,28 @@ def init_session(self: object, body: dict = None, **kwargs) -> Union[Dict[str, U def delete_session(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a session. - Keyword arguments: - session_id -- RTR Session ID to delete. String. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be - 'session_id'. All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/RTR-DeleteSession + + Keyword arguments + ----------------- + session_id : str + RTR Session ID to delete. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'session_id'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -933,19 +1147,27 @@ def delete_session(self: object, *args, parameters: dict = None, **kwargs) -> Un def delete_queued_session(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a queued session. - Keyword arguments: - cloud_request_id -- Cloud Request ID of the executed command to query. String. - session_id -- RTR Session ID to delete. String. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/RTR-DeleteQueuedSession + + Keyword arguments + ----------------- + cloud_request_id : str + Cloud Request ID of the executed command to query. + session_id : str + RTR Session ID to delete. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -959,25 +1181,35 @@ def delete_queued_session(self: object, parameters: dict = None, **kwargs) -> Un def list_all_sessions(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get a list of session_ids. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - “user_id” can accept a special value `@me` which will restrict results to - records with current user’s ID. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. Example: `date_created|asc` - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response/RTR-ListAllSessions + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + “user_id” can accept a special value `@me` which will restrict results to + records with current user’s ID. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : str + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. Example: `date_created|asc` + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/real_time_response_admin.py b/src/falconpy/real_time_response_admin.py index cf58da598..514295055 100644 --- a/src/falconpy/real_time_response_admin.py +++ b/src/falconpy/real_time_response_admin.py @@ -64,8 +64,16 @@ def batch_admin_command(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Batch executes a RTR administrator command across the hosts mapped to a given batch ID. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response-admin/BatchAdminCmd + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "base_command": "string", "batch_id": "string", @@ -75,33 +83,39 @@ def batch_admin_command(self: object, ], "persist_all": true } - base_command -- Active-Responder command type we are going to execute, - for example: `get` or `cp`. String. - Refer to the RTR documentation for the full list of commands. - batch_id -- Batch ID to execute the command on. Received from batch_init_session. String. - command_string -- Full command string for the command. For example `get some_file.txt`. - host_timeout_duration -- Timeout duration for how long a host has time to complete processing. - Default value is slightly less than the overall timeout value. - This value cannot be greater than the overall request timeout. Max < 10 minutes. - Example: 10s Valid units: ns, us, ms, s, m, h - optional_hosts -- List of a subset of hosts we want to run the command on. - If this list is supplied, only these hosts will receive the command. - parameters -- full parameters payload in JSON format. Not required if using other keywords. - persist_all -- Boolean. - timeout -- Timeout for how long to wait for the request in seconds. - Default timeout: 30 seconds Max timeout: 10 minutes - timeout_duration -- Timeout duration for how long to wait for the request in duration - syntax. Example: `10s`. Default value: `30s`. Maximum is `10m`. - Valid units: `ns`, `us`, `ms`, `s`, `m`, `h` + base_command : str + Active-Responder command type we are going to execute, + for example: `get` or `cp`. String. + Refer to the RTR documentation for the full list of commands. + batch_id : str + Batch ID to execute the command on. Received from batch_init_session. + command_string : str + Full command string for the command. For example `get some_file.txt`. + host_timeout_duration : str + Timeout duration for how long a host has time to complete processing. + Default value is slightly less than the overall timeout value. + This value cannot be greater than the overall request timeout. Max < 10 minutes. + Example: 10s Valid units: ns, us, ms, s, m, h + optional_hosts : str or list[str] + List of a subset of hosts we want to run the command on. + If this list is supplied, only these hosts will receive the command. + parameters : dict + Full parameters payload. Not required if using other keywords. + persist_all : bool + timeout : int + Timeout for how long to wait for the request in seconds. + Default timeout: 30 seconds Max timeout: 10 minutes + timeout_duration : str + Timeout duration for how long to wait for the request in duration + syntax. Example: `10s`. Default value: `30s`. Maximum is `10m`. + Valid units: `ns`, `us`, `ms`, `s`, `m`, `h` This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response-admin/BatchAdminCmd + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = command_payload(passed_keywords=kwargs) @@ -123,22 +137,32 @@ def check_admin_command_status(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get status of an executed RTR administrator command on a single host. - Keyword arguments: - cloud_request_id -- Cloud Request ID of the executed command to query. - sequence_id -- Sequence ID that we want to retrieve. Command responses are - chunked across sequences. Default value: 0 - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be - 'cloud_request_id'. All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /real-time-response-admin/RTR_CheckAdminCommandStatus + /real-time-response-admin/RTR_CheckAdminCommandStatus + + Keyword arguments + ----------------- + cloud_request_id : str + Cloud Request ID of the executed command to query. + sequence_id : int + Sequence ID that we want to retrieve. Command responses are + chunked across sequences. Default value: 0 + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'cloud_request_id'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not kwargs.get("sequence_id", None) and not parameters.get("sequence_id", None): parameters["sequence_id"] = 0 @@ -155,8 +179,17 @@ def check_admin_command_status(self: object, def execute_admin_command(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Execute a RTR administrator command on a single host. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html# + /real-time-response-admin/RTR_ExecuteAdminCommand + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "base_command": "string", "command_string": "string", @@ -165,24 +198,27 @@ def execute_admin_command(self: object, body: dict = None, **kwargs) -> Union[Di "persist": boolean, "session_id": "string" } - base_command -- Active-Responder command type we are going to execute, - for example: `get` or `cp`. String. - Refer to the RTR documentation for the full list of commands. - command_string -- Full command string for the command. For example `get some_file.txt`. - device_id -- ID of the device to execute the command on. String. - id -- Command sequence. Integer. - persist -- Execute this command when host returns to service. Boolean. - session_id -- RTR session ID. String. + base_command : str + Active-Responder command type we are going to execute, + for example: `get` or `cp`. String. + Refer to the RTR documentation for the full list of commands. + command_string : str + Full command string for the command. For example `get some_file.txt`. + device_id : str + ID of the device to execute the command on. + id : int + Command sequence. + persist : bool + Execute this command when host returns to service. + session_id : str + RTR session ID. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /real-time-response-admin/RTR_ExecuteAdminCommand + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = command_payload(passed_keywords=kwargs) @@ -202,19 +238,28 @@ def get_falcon_scripts(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get Falcon scripts with metadata and content of script. - Keyword arguments: - ids -- List of Falcon Script IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response-admin/RTR_GetFalconScripts + + Keyword arguments + ----------------- + ids : str or list[str] + List of Falcon Script IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -232,19 +277,28 @@ def get_put_file_contents(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get put-file contents for a given put file ID. - Keyword arguments: - id -- Put file ID to retrieve. String. - parameters -- full parameters payload, not required if id is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response-admin/RTR-GetPutFileContents + + Keyword arguments + ----------------- + id : str + Put file ID to retrieve. + parameters : dict + full parameters payload, not required if id is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -258,19 +312,28 @@ def get_put_file_contents(self: object, def get_put_files(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get put-files based on the ID's given. These are used for the RTR `put` command. - Keyword arguments: - ids -- List of File IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response-admin/RTR_GetPut_Files + + Keyword arguments + ----------------- + ids : str or list[str] + List of File IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -288,19 +351,28 @@ def get_put_files_v2(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get put-files based on the ID's given. These are used for the RTR `put` command. - Keyword arguments: - ids -- List of File IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response-admin/RTR-GetPut-FilesV2 + + Keyword arguments + ----------------- + ids : str or list[str] + List of File IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -318,27 +390,37 @@ def create_put_files(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Upload a new put-file to use for the RTR `put` command. - Keyword arguments: - data -- full formData payload, not required if other keywords are used. - { - "description": "string", - "name": "string", - "comments_for_audit_log": "string" - } - files -- File to be uploaded. List of tuples. *REQUIRED* - Ex: [('file', ('file.ext', open('file.ext','rb').read(), 'application/script'))] - description -- File description. String. - name -- File name (if different than actual file name). String. - comments_for_audit_log -- Audit log comment. String. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response-admin/RTR-CreatePut-Files + + Keyword arguments + ----------------- + data : str + full formData payload, not required if other keywords are used. + { + "description": "string", + "name": "string", + "comments_for_audit_log": "string" + } + files : str + File to be uploaded. List of tuples. *REQUIRED* + Ex: [('file', ('file.ext', open('file.ext','rb').read(), 'application/script'))] + description : str + File description. + name : str + File name (if different than actual file name) + comments_for_audit_log : str + Audit log comment. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not data: data = data_payload(passed_keywords=kwargs) @@ -359,19 +441,28 @@ def delete_put_files(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a put-file based on the ID given. Can only delete one file at a time. - Keyword arguments: - ids -- File ID to delete. String. Only one file can be deleted per request. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response-admin/RTR_DeletePut_Files + + Keyword arguments + ----------------- + ids : str + File ID to delete. String. Only one file can be deleted per request. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -389,27 +480,37 @@ def create_put_files_v2(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Upload a new put-file to use for the RTR `put` command. - Keyword arguments: - data -- full formData payload, not required if other keywords are used. formData. - { - "description": "string", - "name": "string", - "comments_for_audit_log": "string" - } - files -- File to be uploaded. List of tuples. *REQUIRED* - Ex: [('file', ('file.ext', open('file.ext','rb').read(), 'application/script'))] - description -- File description. String. - name -- File name (if different than actual file name). String. - comments_for_audit_log -- Audit log comment. String. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response-admin/RTR-CreatePut-FilesV2 + + Keyword arguments + ----------------- + data : str + full formData payload, not required if other keywords are used. formData. + { + "description": "string", + "name": "string", + "comments_for_audit_log": "string" + } + files : str + File to be uploaded. List of tuples. *REQUIRED* + Ex: [('file', ('file.ext', open('file.ext','rb').read(), 'application/script'))] + description : str + File description. + name : str + File name (if different than actual file name) + comments_for_audit_log : str + Audit log comment. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not data: data = data_payload(passed_keywords=kwargs) @@ -428,19 +529,28 @@ def get_scripts(self: object, *args, parameters: dict = None, **kwargs) -> Union These are used for the RTR `runscript` command. - Keyword arguments: - ids -- List of Script IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response-admin/RTR-GetScripts + + Keyword arguments + ----------------- + ids : str or list[str] + List of Script IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -456,19 +566,28 @@ def get_scripts_v2(self: object, *args, parameters: dict = None, **kwargs) -> Un These are used for the RTR `runscript` command. - Keyword arguments: - ids -- List of Script IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response-admin/RTR-GetScriptsV2 + + Keyword arguments + ----------------- + ids : str or list[str] + List of Script IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -486,38 +605,51 @@ def create_scripts(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Upload a new custom-script to use for the RTR `runscript` command. - Keyword arguments: - data -- full formData payload, not required if other keywords are used. - { - "description": "string", - "name": "string", - "comments_for_audit_log": "string", - "content": "string", - "platform": "string", - "permission_type": "string" - } - files -- File to be uploaded. List of tuples. *REQUIRED* - Ex: [('file', ('file.ext', open('file.ext','rb').read(), 'application/script'))] - description -- File description. String. - name -- File name (if different than actual file name). String. - comments_for_audit_log -- Audit log comment. String. - permission_type -- Permission for the custom-script. - Valid permission values: - `private` - usable by only the user who uploaded it - `group` - usable by all RTR Admins - `public` - usable by all active-responders and RTR admins - content -- The script text that you want to use to upload. - platform -- Platforms for the file. Currently supports: windows, mac, linux. - If no platform is provided, it will default to 'windows'. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response-admin/RTR-CreateScripts + + Keyword arguments + ----------------- + data : str + full formData payload, not required if other keywords are used. + { + "description": "string", + "name": "string", + "comments_for_audit_log": "string", + "content": "string", + "platform": "string", + "permission_type": "string" + } + files : str + File to be uploaded. List of tuples. *REQUIRED* + Ex: [('file', ('file.ext', open('file.ext','rb').read(), 'application/script'))] + description : str + File description. + name : str + File name (if different than actual file name) + comments_for_audit_log : str + Audit log comment. + permission_type : str + Permission for the custom-script. + Valid permission values: + `private` - usable by only the user who uploaded it + `group` - usable by all RTR Admins + `public` - usable by all active-responders and RTR admins + content : str + The script text that you want to use to upload. + platform : str + Platforms for the file. Currently supports: windows, mac, linux. + If no platform is provided, it will default to 'windows'. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not data: data = data_payload(passed_keywords=kwargs) @@ -534,19 +666,28 @@ def create_scripts(self: object, def delete_scripts(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a custom-script based on the ID given. Can only delete one script at a time. - Keyword arguments: - ids -- Script ID to delete. String. Only one file can be deleted per request. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response-admin/RTR_DeleteScripts + + Keyword arguments + ----------------- + ids : str + Script ID to delete. String. Only one file can be deleted per request. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -564,38 +705,51 @@ def create_scripts_v2(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Upload a new custom-script to use for the RTR `runscript` command. - Keyword arguments: - data -- full formData payload, not required if other keywords are used. formData. - { - "description": "string", - "name": "string", - "comments_for_audit_log": "string", - "content": "string", - "platform": "string", - "permission_type": "string" - } - files -- File to be uploaded. List of tuples. *REQUIRED* - Ex: [('file', ('file.ext', open('file.ext','rb').read(), 'application/script'))] - description -- File description. String. - name -- File name (if different than actual file name). String. - comments_for_audit_log -- Audit log comment. String. - permission_type -- Permission for the custom-script. STring. - Valid permission values: - `private` - usable by only the user who uploaded it - `group` - usable by all RTR Admins - `public` - usable by all active-responders and RTR admins - content -- The script text that you want to use to upload. String. - platform -- Platforms for the file. Currently supports: windows, mac, linux. String. - If no platform is provided, it will default to 'windows'. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response-admin/RTR-CreateScriptsV2 + + Keyword arguments + ----------------- + data : str + full formData payload, not required if other keywords are used. formData. + { + "description": "string", + "name": "string", + "comments_for_audit_log": "string", + "content": "string", + "platform": "string", + "permission_type": "string" + } + files : str + File to be uploaded. List of tuples. *REQUIRED* + Ex: [('file', ('file.ext', open('file.ext','rb').read(), 'application/script'))] + description : str + File description. + name : str + File name (if different than actual file name) + comments_for_audit_log : str + Audit log comment. + permission_type : str + Permission for the custom-script. STring. + Valid permission values: + `private` - usable by only the user who uploaded it + `group` - usable by all RTR Admins + `public` - usable by all active-responders and RTR admins + content : str + The script text that you want to use to upload. + platform : str + Platforms for the file. Currently supports: windows, mac, linux. String. + If no platform is provided, it will default to 'windows'. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not data: data = data_payload(passed_keywords=kwargs) @@ -616,40 +770,54 @@ def update_scripts_v2(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Upload a new scripts to replace an existing one. - Keyword arguments: - data -- full formData payload, not required if other keywords are used. formData. - { - "id": "string", - "description": "string", - "name": "string", - "comments_for_audit_log": "string", - "content": "string", - "platform": "string", - "permission_type": "string" - } - files -- File to be uploaded. List of tuples. *REQUIRED* - Ex: [('file', ('file.ext', open('file.ext','rb').read(), 'application/script'))] - description -- File description. String. - id -- Script ID to be updated. String. - name -- File name (if different than actual file name). String. - comments_for_audit_log -- Audit log comment. String. - permission_type -- Permission for the custom-script. String. - Valid permission values: - `private` - usable by only the user who uploaded it - `group` - usable by all RTR Admins - `public` - usable by all active-responders and RTR admins - content -- The script text that you want to use to upload. String. - platform -- Platforms for the file. Currently supports: windows, mac, linux. String. - If no platform is provided, it will default to 'windows'. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response-admin/RTR-UpdateScriptsV2 + + Keyword arguments + ----------------- + data : str + full formData payload, not required if other keywords are used. formData. + { + "id": "string", + "description": "string", + "name": "string", + "comments_for_audit_log": "string", + "content": "string", + "platform": "string", + "permission_type": "string" + } + files : str + File to be uploaded. List of tuples. *REQUIRED* + Ex: [('file', ('file.ext', open('file.ext','rb').read(), 'application/script'))] + description : str + File description. + id : str + Script ID to be updated. + name : str + File name (if different than actual file name) + comments_for_audit_log : str + Audit log comment. + permission_type : str + Permission for the custom-script. String. + Valid permission values: + `private` - usable by only the user who uploaded it + `group` - usable by all RTR Admins + `public` - usable by all active-responders and RTR admins + content : str + The script text that you want to use to upload. + platform : str + Platforms for the file. Currently supports: windows, mac, linux. String. + If no platform is provided, it will default to 'windows'. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not data: data = data_payload(passed_keywords=kwargs) @@ -670,40 +838,54 @@ def update_scripts(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Upload a new scripts to replace an existing one. - Keyword arguments: - data -- full formData payload, not required if other keywords are used. - { - "id": "string", - "description": "string", - "name": "string", - "comments_for_audit_log": "string", - "content": "string", - "platform": "string", - "permission_type": "string" - } - files -- File to be uploaded. List of tuples. *REQUIRED* - Ex: [('file', ('file.ext', open('file.ext','rb').read(), 'application/script'))] - description -- File description. String. - id -- Script ID to be updated. String. - name -- File name (if different than actual file name). String. - comments_for_audit_log -- Audit log comment. String. - permission_type -- Permission for the custom-script. - Valid permission values: - `private` - usable by only the user who uploaded it - `group` - usable by all RTR Admins - `public` - usable by all active-responders and RTR admins - content -- The script text that you want to use to upload. - platform -- Platforms for the file. Currently supports: windows, mac, linux. - If no platform is provided, it will default to 'windows'. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PATCH Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response-admin/RTR-UpdateScripts + + Keyword arguments + ----------------- + data : str + full formData payload, not required if other keywords are used. + { + "id": "string", + "description": "string", + "name": "string", + "comments_for_audit_log": "string", + "content": "string", + "platform": "string", + "permission_type": "string" + } + files : str + File to be uploaded. List of tuples. *REQUIRED* + Ex: [('file', ('file.ext', open('file.ext','rb').read(), 'application/script'))] + description : str + File description. + id : str + Script ID to be updated. + name : str + File name (if different than actual file name) + comments_for_audit_log : str + Audit log comment. + permission_type : str + Permission for the custom-script. + Valid permission values: + `private` - usable by only the user who uploaded it + `group` - usable by all RTR Admins + `public` - usable by all active-responders and RTR admins + content : str + The script text that you want to use to upload. + platform : str + Platforms for the file. Currently supports: windows, mac, linux. + If no platform is provided, it will default to 'windows'. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not data: data = data_payload(passed_keywords=kwargs) @@ -720,23 +902,33 @@ def update_scripts(self: object, def list_falcon_scripts(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get a list of Falcon script IDs available to the user to run. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of IDs to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving IDs from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. Ex: `created_at|asc` - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response-admin/RTR_ListFalconScripts + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of IDs to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving IDs from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. Ex: `created_at|asc` + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -750,23 +942,33 @@ def list_falcon_scripts(self: object, parameters: dict = None, **kwargs) -> Unio def list_put_files(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get a list of put-file ID's that are available to the user for the `put` command. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. Ex: `created_at|desc` - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response-admin/RTR-ListPut-Files + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : str + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. Ex: `created_at|desc` + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -782,23 +984,33 @@ def list_scripts(self: object, parameters: dict = None, **kwargs) -> Union[Dict[ Only displays scripts the user has permissions to access. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. Ex: `created_at|desc` - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response-admin/RTR-ListScripts + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : str + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. Ex: `created_at|desc` + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/real_time_response_audit.py b/src/falconpy/real_time_response_audit.py index 5b1ac9617..59c0d5406 100644 --- a/src/falconpy/real_time_response_audit.py +++ b/src/falconpy/real_time_response_audit.py @@ -59,27 +59,38 @@ class RealTimeResponseAudit(ServiceClass): def audit_sessions(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get all the RTR sessions created for a customer during a specified time period. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of sessions to return in this response. Integer. - Use with the offset parameter to manage pagination of results. - offset -- Starting index of overall result set from which to return ids. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. date_created|asc). - Available sort fields: created_at, updated_at, deleted_at - with_command_info -- Retrieve sessions with command information included. By default - sessions are returned without command information which includes - cloud request IDs and log fields. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/real-time-response-audit/RTRAuditSessions + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : str + The maximum number of sessions to return in this response. Integer. + Use with the offset parameter to manage pagination of results. + offset : str + Starting index of overall result set from which to return ids. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. date_created|asc). + Available sort fields: created_at, updated_at, deleted_at + with_command_info : bool + Retrieve sessions with command information included. By default + sessions are returned without command information which includes + cloud request IDs and log fields. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/recon.py b/src/falconpy/recon.py index 8ee5347c0..a878ed5d3 100644 --- a/src/falconpy/recon.py +++ b/src/falconpy/recon.py @@ -72,8 +72,16 @@ def aggregate_notifications_exposed_data_records(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get notification aggregates as specified via JSON in request body. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/AggregateNotificationsExposedDataRecordsV1 + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -108,38 +116,44 @@ def aggregate_notifications_exposed_data_records(self: object, "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/AggregateNotificationsExposedDataRecordsV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: # Issue 664: Recon aggregate requires a list. @@ -156,8 +170,16 @@ def aggregate_notifications_exposed_data_records(self: object, def aggregate_notifications(self: object, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get notification aggregates as specified via JSON in request body. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/AggregateNotificationsV1 + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -192,38 +214,44 @@ def aggregate_notifications(self: object, body: list = None, **kwargs) -> Union[ "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/AggregateNotificationsV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: # Issue 664: Recon aggregate requires a list. @@ -240,23 +268,31 @@ def aggregate_notifications(self: object, body: list = None, **kwargs) -> Union[ def preview_rule(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get notification aggregates as specified via JSON in request body. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/PreviewRuleV1 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "filter": "string", "topic": "string" } - filter -- Rule filter. String. - topic -- Rule topic. String. + filter : str + Rule filter. + topic : str + Rule topic. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/PreviewRuleV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = recon_rule_preview_payload(passed_keywords=kwargs) @@ -272,19 +308,28 @@ def preview_rule(self: object, body: dict = None, **kwargs) -> Union[Dict[str, U def get_actions(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get actions based on their IDs. IDs can be retrieved using the GET query_actions. - Keyword arguments: - ids -- List of action IDs to retrieve details for. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/GetActionsV1 + + Keyword arguments + ----------------- + ids : str or list[str] + List of action IDs to retrieve details for. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -300,19 +345,29 @@ def create_actions(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Accepts a list of actions that will be attached to the monitoring rule. - Keyword arguments: - actions -- List of actions to attach to the monitoring rule. - When provided, actions overrides other passed keywords excluding body. - List of dictionaries in the following format: - { - "frequency": "string", - "recipients": [ - "string" - ], - "type": "string" - } - content_format -- Content format. String. - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/CreateActionsV1 + + Keyword arguments + ----------------- + actions : list + List of actions to attach to the monitoring rule. + When provided, actions overrides other passed keywords excluding body. + List of dictionaries in the following format: + { + "frequency": "string", + "recipients": [ + "string" + ], + "type": "string" + } + content_format : str + Content format. + body : dict + full body payload, not required when using other keywords. { "actions": [ { @@ -327,22 +382,25 @@ def create_actions(self: object, body: dict = None, **kwargs) -> Union[Dict[str, ], "rule_id": "string" } - frequency - Frequency of the action. String. Used when only one - action is being handled. - recipients -- UUIDs of the recipients. List of strings. Used when - only one action is being handled. - rule_id -- Rule ID to attach the action to. Always required. - trigger_matchless -- Trigger on no matches. Boolean. - type -- Action type, used when only one action is being handled. + frequency : str + Frequency of the action. String. Used when only one + action is being handled. + recipients : str + UUIDs of the recipients. List of strings. Used when + only one action is being handled. + rule_id : str (required) + Rule ID to attach the action to. Always. + trigger_matchless : bool + Trigger on no matches. + type : str + Action type, used when only one action is being handled. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/CreateActionsV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = recon_action_payload(passed_keywords=kwargs) @@ -358,19 +416,28 @@ def create_actions(self: object, body: dict = None, **kwargs) -> Union[Dict[str, def delete_action(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete an action from a monitoring rule based on the action ID. - Keyword arguments: - ids -- List of action IDs to delete. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/DeleteActionV1 + + Keyword arguments + ----------------- + ids : str or list[str] + List of action IDs to delete. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -384,8 +451,16 @@ def delete_action(self: object, *args, parameters: dict = None, **kwargs) -> Uni def update_action(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update an action for a monitoring rule. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/UpdateActionV1 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. { "content_format": "string", "frequency": "string", @@ -396,21 +471,25 @@ def update_action(self: object, body: dict = None, **kwargs) -> Union[Dict[str, "status": "string", "trigger_matchless": "string" } - content_format -- Content format. String. - frequency - Frequency of the action. String. - id -- Action ID. String. - recipients -- UUIDs of the recipients. List of strings. - status -- Action status. String. - trigger_matchless -- Trigger on no match. Boolean. + content_format : str + Content format. + frequency : str + Frequency of the action. + id : str + Action ID. + recipients : str or list[str] + UUIDs of the recipients. + status : str + Action status. + trigger_matchless : bool + Trigger on no match. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/UpdateActionV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = recon_action_update_payload(passed_keywords=kwargs) @@ -437,19 +516,27 @@ def get_export_job_file_contents(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Download the file associated with a job ID. - Keyword arguments: - ids -- Export job ID to retrieve details for. String. - parameters - full parameters payload, not required if id is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: binary object or dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/GetFileContentForExportJobsV1 + + Keyword arguments + ----------------- + ids : str + Export job ID to retrieve details for. + parameters : dict + full parameters payload, not required if id is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + binary object or dict object containing API response. """ return process_service_request( calling_object=self, @@ -466,19 +553,28 @@ def get_export_jobs(self: object, *args, parameters: dict = None, **kwargs) -> U Export jobs can be launched by calling CreateExportJobsV1. When a job is complete, use the job ID to download the file(s) associated with it using GetFileContentForExportJobsV1. - Keyword arguments: - ids -- Export job IDs. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/GetExportJobsV1 + + Keyword arguments + ----------------- + ids : str or list[str] + Export job IDs. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -492,8 +588,16 @@ def get_export_jobs(self: object, *args, parameters: dict = None, **kwargs) -> U def create_export_jobs(self: object, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Launch asynchronous export job. Use the job ID to poll the status of the job using GetExportJobsV1. - Keyword arguments: - body -- List of dictionaries. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/CreateExportJobsV1 + + Keyword arguments + ----------------- + body : dict + Full body payload. Not required if using other keywords. [ { "entity": "string", @@ -503,21 +607,24 @@ def create_export_jobs(self: object, body: list = None, **kwargs) -> Union[Dict[ "sort": "string" } ] - entity -- String. Only launches a single job when used. - export_type -- Type of export. String. Only launches a single job when used. - filter -- FQL filter. String. Only launches a single job when used. - human_readable -- Should the content be in human readable format. String. - Only launches a single job when used. - sort -- FQL formatted sort string. Only launches a single job when used. + entity : str + String. Only launches a single job when used. + export_type : str + Type of export. String. Only launches a single job when used. + filter : str + FQL filter. String. Only launches a single job when used. + human_readable : bool + Should the content be in human readable format. String. + Only launches a single job when used. + sort : str + FQL formatted sort string. Only launches a single job when used. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/CreateExportJobsV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = recon_export_job_payload(passed_keywords=kwargs) @@ -538,19 +645,28 @@ def delete_export_jobs(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete export jobs based on IDs. - Keyword arguments: - ids -- List of export job IDs to delete. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/DeleteExportJobsV1 + + Keyword arguments + ----------------- + ids : str or list[str] + List of export job IDs to delete. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -571,19 +687,28 @@ def get_notifications_detailed_translated(self: object, Get detailed notifications based on their IDs. These include the translated raw intelligence content that generated the match or part of it. - Keyword arguments: - ids -- List of notification IDs to retrieve details for. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/GetNotificationsDetailedTranslatedV1 + + Keyword arguments + ----------------- + ids : str or list[str] + List of notification IDs to retrieve details for. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -604,19 +729,28 @@ def get_notifications_detailed(self: object, Get detailed notifications based on their IDs. These include the raw intelligence content that generated the match or part of it. - Keyword arguments: - ids -- List of notification IDs to retrieve details for. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/GetNotificationsDetailedV1 + + Keyword arguments + ----------------- + ids : str or list[str] + List of notification IDs to retrieve details for. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -634,19 +768,28 @@ def get_notifications_exposed_data_records(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get monitoring rules rules by provided IDs. - Keyword arguments: - ids -- List of notification IDs to retrieve details for. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/GetNotificationsExposedDataRecordsV1 + + Keyword arguments + ----------------- + ids : str or list[str] + List of notification IDs to retrieve details for. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -668,19 +811,28 @@ def get_notifications_translated(self: object, This endpoint will return translated notification content. The only target language available is English. - Keyword arguments: - ids -- List of notification IDs to retrieve details for. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/GetNotificationsTranslatedV1 + + Keyword arguments + ----------------- + ids : str or list[str] + List of notification IDs to retrieve details for. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -700,19 +852,28 @@ def get_notifications(self: object, IDs can be retrieved using get_notifications. - Keyword arguments: - ids -- List of notification IDs to retrieve details for. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/GetNotificationsV1 + + Keyword arguments + ----------------- + ids : str or list[str] + List of notification IDs to retrieve details for. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -732,19 +893,28 @@ def delete_notifications(self: object, Notifications cannot be recovered after they are deleted. - Keyword arguments: - ids -- List of notification IDs to retrieve details for. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/DeleteNotificationsV1 + + Keyword arguments + ----------------- + ids : str or list[str] + List of notification IDs to retrieve details for. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -758,9 +928,18 @@ def delete_notifications(self: object, def update_notifications(self: object, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update notification status or assignee. Accepts bulk requests. - Keyword arguments: - assigned_to_uuid - UUID of the assigned user. String. - body -- full body payload, not required when using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/UpdateNotificationsV1 + + Keyword arguments + ----------------- + assigned_to_uuid : str + UUID of the assigned user. + body : dict + full body payload, not required when using other keywords. [ { "assigned_to_uuid": "string", @@ -768,19 +947,18 @@ def update_notifications(self: object, body: list = None, **kwargs) -> Union[Dic "status": "string" } ] - id -- Notification ID. String. - status -- Notification status. String. + id : str + Notification ID. + status : str + Notification status. String. + This method does not support body payload validation. This method only supports keywords for providing arguments. - This method does not support body payload validation. - - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/UpdateNotificationsV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = recon_notifications_payload(passed_keywords=kwargs) @@ -796,19 +974,28 @@ def update_notifications(self: object, body: list = None, **kwargs) -> Union[Dic def get_rules(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get monitoring rules rules by provided IDs. - Keyword arguments: - ids -- List of rule IDs to retrieve details for. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/GetRulesV1 + + Keyword arguments + ----------------- + ids : str or list[str] + List of rule IDs to retrieve details for. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -822,8 +1009,16 @@ def get_rules(self: object, *args, parameters: dict = None, **kwargs) -> Union[D def create_rules(self: object, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create monitoring rules. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/CreateRulesV1 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. [ { "breach_monitoring_enabled": true, @@ -835,24 +1030,28 @@ def create_rules(self: object, body: list = None, **kwargs) -> Union[Dict[str, U "topic": "string" } ] - breach_monitoring_enabled -- Enable breach monitoring. Boolean. - filter -- Rule filter. String. - name -- Rule name. String. - permissions -- String. (private / public) - priority -- String. (high / medium / low) - substring_matching_enabled -- Enable substring matching. Boolean. - topic -- Rule topic. String. + breach_monitoring_enabled : bool + Enable breach monitoring. + filter : str + Rule filter. + name : str + Rule name. + permissions : str + String. (private / public) + priority : str + String. (high / medium / low) + substring_matching_enabled : bool + Enable substring matching. + topic : str + Rule topic. String. + This method does not support body payload validation. This method only supports keywords for providing arguments. - This method does not support body payload validation. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/CreateRulesV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = recon_rules_payload(passed_keywords=kwargs) @@ -868,20 +1067,30 @@ def create_rules(self: object, body: list = None, **kwargs) -> Union[Dict[str, U def delete_rules(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete monitoring rules. - Keyword arguments: - ids -- List of rule IDs to delete. String or list of strings. - notificationsDeletionRequested -- Should notifications generated by this rule be deleted. Boolean. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/DeleteRulesV1 + + Keyword arguments + ----------------- + ids : str or list[str] + List of rule IDs to delete. + notificationsDeletionRequested : bool + Should notifications generated by this rule be deleted. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -895,8 +1104,16 @@ def delete_rules(self: object, *args, parameters: dict = None, **kwargs) -> Unio def update_rules(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update monitoring rules. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/UpdateRulesV1 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when using other keywords. [ { "breach_monitoring_enabled": true, @@ -908,24 +1125,28 @@ def update_rules(self: object, body: dict = None, **kwargs) -> Union[Dict[str, U "substring_matching_enabled": true } ] - breach_monitoring_enabled -- Enable breach monitoring. Boolean. - filter -- Rule filter. String. - name -- Rule name. String. - permissions -- String. (private / public) - priority -- String. (high / medium / low) - id -- Rule ID. String. - substring_matching_enabled -- Enable substring matching. Boolean. + breach_monitoring_enabled : bool + Enable breach monitoring. + filter : str + Rule filter. + name : str + Rule name. + permissions : str + String. (private / public) + priority : str + String. (high / medium / low) + id : str + Rule ID. + substring_matching_enabled : bool + Enable substring matching. Boolean. + This method does not support body payload validation. This method only supports keywords for providing arguments. - This method does not support body payload validation. - - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/UpdateRulesV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = recon_rules_payload(passed_keywords=kwargs) @@ -943,30 +1164,41 @@ def query_actions(self: object, parameters: dict = None, **kwargs) -> Union[Dict Use the IDs from this response to get the action entities with get_actions. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - Available filters - cid rule_id - created_timestamp status - frequency type - id updated_timestamp - recipients user_uuid - limit -- The maximum number of IDs to return. [integer, 1-500] - offset -- The first item to return, where 0 is the latest item. (Integer) - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - q -- Free text search across all indexed fields. - sort -- The property to sort by. FQL syntax. - (e.g. created_timestamp|asc, updated_timestamp|desc). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/QueryActionsV1 + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Available filters + cid rule_id + created_timestamp status + frequency type + id updated_timestamp + recipients user_uuid + limit : int (1-500) + The maximum number of IDs to return. + offset : int + The first item to return, where 0 is the latest item. (Integer) + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Free text search across all indexed fields. + sort : str + The property to sort by. FQL syntax. + (e.g. created_timestamp|asc, updated_timestamp|desc). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -986,53 +1218,64 @@ def query_notifications_exposed_data_records(self: object, Use the IDs from this response to get the notification entities with get_notifications_exposed_data_records. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - Available filters - id phone_number - cid company - user_uuid job_position - created_date file.name - exposure_date file.complete_data_set - rule.id file.download_urls - rule.name location.postal_code - rule.topic location.city - notification_id location.state - notification_group_id location.federal_district - source_category location.federal_admin_region - site location.country_code - site_id social.twitter_id - author social.facebook_id - author_id social.vk_id - user_id social.vk_token - user_name social.aim_id - credentials_url social.icq_id - credentials_domain social.msn_id - credentials_ip social.instagram_id - email social.skype_id - domain financial.credit_card - hash_type financial.bank_account - display_name financial.crypto_currency_addresses - full_name login_id - user_ip credential_status - bot.operating_system.hardware_id - bot.bot_id - _all - limit -- The maximum number of IDs to return. [integer, 1-500] - offset -- The first item to return, where 0 is the latest item. (Integer) - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - q -- Free text search across all indexed fields. - sort -- The property to sort by. FQL syntax. (e.g. created_date|asc, updated_date|desc) - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/QueryNotificationsExposedDataRecordsV1 + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Available filters + id phone_number + cid company + user_uuid job_position + created_date file.name + exposure_date file.complete_data_set + rule.id file.download_urls + rule.name location.postal_code + rule.topic location.city + notification_id location.state + notification_group_id location.federal_district + source_category location.federal_admin_region + site location.country_code + site_id social.twitter_id + author social.facebook_id + author_id social.vk_id + user_id social.vk_token + user_name social.aim_id + credentials_url social.icq_id + credentials_domain social.msn_id + credentials_ip social.instagram_id + email social.skype_id + domain financial.credit_card + hash_type financial.bank_account + display_name financial.crypto_currency_addresses + full_name login_id + user_ip credential_status + bot.operating_system.hardware_id + bot.bot_id + _all + limit : int (1-500) + The maximum number of IDs to return. + offset : int + The first item to return, where 0 is the latest item. (Integer) + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Free text search across all indexed fields. + sort : str + The property to sort by. FQL syntax. (e.g. created_date|asc, updated_date|desc) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1049,30 +1292,41 @@ def query_notifications(self: object, parameters: dict = None, **kwargs) -> Unio Use the IDs from this response to get the notification entities with get_notifications or get_notifications detailed. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - Available filters - cid rule_topic - created_date rule_priority - id status - item_type type - rule_name updated_date - rule_id user_uuid - limit -- The maximum number of IDs to return. [integer, 1-500] - offset -- The first item to return, where 0 is the latest item. (Integer) - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - q -- Free text search across all indexed fields. - sort -- The property to sort by. FQL syntax. (e.g. created_date|asc, updated_date|desc) - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/QueryNotificationsV1 + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Available filters + cid rule_topic + created_date rule_priority + id status + item_type type + rule_name updated_date + rule_id user_uuid + limit : int (1-500) + The maximum number of IDs to return. + offset : int + The first item to return, where 0 is the latest item. (Integer) + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Free text search across all indexed fields. + sort : str + The property to sort by. FQL syntax. (e.g. created_date|asc, updated_date|desc) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -1088,40 +1342,52 @@ def query_rules(self: object, parameters: dict = None, **kwargs) -> Union[Dict[s Use the IDs from this response to fetch the rules with get_rules. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - Available filters - cid priority - created_timestamp permissions - filter status - id topic - last_updated_timestamp user_uuid - limit -- The maximum number of IDs to return. [integer, 1-500] - offset -- The first item to return, where 0 is the latest item. (Integer) - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - q -- Free text search across all indexed fields. - secondary_sort -- Possible order by fields: - created_timestamp last_updated_timestamp, - permissions priority - template_priority topic - Ex: last_updated_timestamp|desc - The keyword "secondarySort" will also be accepted for this value. - sort -- The property to sort by. FQL syntax. - Possible order by fields: - created_timestamp last_updated_timestamp, - permissions priority - template_priority topic - (e.g. created_timestamp|asc, last_updated_timestamp|desc) - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/recon/QueryRulesV1 + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Available filters + cid priority + created_timestamp permissions + filter status + id topic + last_updated_timestamp user_uuid + limit : int (1-500) + The maximum number of IDs to return. + offset : int + The first item to return, where 0 is the latest item. (Integer) + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Free text search across all indexed fields. + secondary_sort : str + Possible order by fields: + created_timestamp last_updated_timestamp, + permissions priority + template_priority topic + Ex: last_updated_timestamp|desc + The keyword "secondarySort" will also be accepted for this value. + sort : str + The property to sort by. FQL syntax. + Possible order by fields: + created_timestamp last_updated_timestamp, + permissions priority + template_priority topic + (e.g. created_timestamp|asc, last_updated_timestamp|desc) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ kwargs["secondarySort"] = kwargs.get("secondarySort", kwargs.get("secondary-sort", None)) return process_service_request( diff --git a/src/falconpy/recon.pyi b/src/falconpy/recon.pyi index d52ff87aa..4cb3f8fa1 100644 --- a/src/falconpy/recon.pyi +++ b/src/falconpy/recon.pyi @@ -198,6 +198,7 @@ class Recon(ServiceClass): *, breach_monitor_only: Optional[bool] = None, breach_monitoring_enabled: Optional[bool] = None, + exposed_data_match_type: Optional[str] = None, filter: Optional[str] = None, lookback_period: Optional[int] = None, match_on_tsq_result_types: Optional[Union[str, List[str]]] = None, @@ -207,6 +208,7 @@ class Recon(ServiceClass): priority: Optional[str] = None, substring_matching_enabled: Optional[bool] = None, topic: Optional[str] = None, + tsq_match_edit_distance: Optional[str] = None, body: Optional[dict] = None, ) -> Union[Dict[str, Union[int, dict]], Result]: ... @@ -223,6 +225,7 @@ class Recon(ServiceClass): *, breach_monitor_only: Optional[bool] = None, breach_monitoring_enabled: Optional[bool] = None, + exposed_data_match_type: Optional[str] = None, filter: Optional[str] = None, id: Optional[str] = None, match_on_tsq_result_types: Optional[Union[str, List[str]]] = None, @@ -230,6 +233,7 @@ class Recon(ServiceClass): permissions: Optional[str] = None, priority: Optional[str] = None, substring_matching_enabled: Optional[bool] = None, + tsq_match_edit_distance: Optional[str] = None, body: Optional[dict] = None, ) -> Union[Dict[str, Union[int, dict]], Result]: ... diff --git a/src/falconpy/report_executions.py b/src/falconpy/report_executions.py index b27f047b1..b4d88833b 100644 --- a/src/falconpy/report_executions.py +++ b/src/falconpy/report_executions.py @@ -60,19 +60,27 @@ class ReportExecutions(ServiceClass): def get_download(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get report entity download. - Keyword arguments: - ids -- ID of the report entity to retrieve. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: binary object on SUCCESS, dict object containing API response on FAILURE. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/report-executions/report-executions-download.get + + Keyword arguments + ----------------- + ids : str + ID of the report entity to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + binary object on SUCCESS, dict object containing API response on FAILURE. """ return process_service_request( calling_object=self, @@ -86,24 +94,33 @@ def get_download(self: object, *args, parameters: dict = None, **kwargs) -> Unio def retry_reports(self: object, *args, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retries a report execution. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/report-executions/report-executions.retry + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. [ { "id": "string" } ] - ids -- ID of the report to re-attempt execution. String or list of strings. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/report-executions/report-executions.retry + ids : str or list[str] + ID of the report to re-attempt execution. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = reports_payload(passed_arguments=args, passed_keywords=kwargs) @@ -119,19 +136,28 @@ def retry_reports(self: object, *args, body: list = None, **kwargs) -> Union[Dic def get_reports(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve report details for the provided report IDs. - Keyword arguments: - ids -- ID(s) of the reports to retrieve. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/report-executions/report-executions.get + + Keyword arguments + ----------------- + ids : str or list[str] + ID(s) of the reports to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -145,25 +171,36 @@ def get_reports(self: object, *args, parameters: dict = None, **kwargs) -> Union def query_reports(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Find all report execution IDs matching the query with filter. - Keyword arguments: - filter -- FQL query specifying the filter parameters. - Filter term criteria: type, scheduled_report_id, status. - Filter range criteria: created_on, last_updated_on, expiration_on; - use any common date format, such as '2010-05-15T14:55:21.892315096Z'. - limit -- The maximum number of ids to return. - offset -- Starting integer index of overall result set from which to return ids. - parameters - full parameters payload, not required if using other keywords. - q -- Match query criteria, which includes all the filter string fields. - sort -- The property to sort by. FQL syntax. (e.g. created_on.asc, last_updated_on.desc) - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/report-executions/report-executions.query + + Keyword arguments + ----------------- + filter : str + FQL query specifying the filter parameters. + Filter term criteria: type, scheduled_report_id, status. + Filter range criteria: created_on, last_updated_on, expiration_on; + use any common date format, such as '2010-05-15T14:55:21.892315096Z'. + limit : int + The maximum number of ids to return. + offset : str + Starting integer index of overall result set from which to return ids. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Match query criteria, which includes all the filter string fields. + sort : str + The property to sort by. FQL syntax. (e.g. created_on.asc, last_updated_on.desc) + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/response_policies.py b/src/falconpy/response_policies.py index 0ebe132af..28fa87081 100644 --- a/src/falconpy/response_policies.py +++ b/src/falconpy/response_policies.py @@ -65,24 +65,35 @@ def query_combined_policy_members(self: object, Returns a set of host details which match the filter criteria. - Keyword arguments: - id -- The ID of the Response Policy to search for members of - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/response-policies/queryCombinedRTResponsePolicyMembers + + Keyword arguments + ----------------- + id : str + The ID of the Response Policy to search for members of + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -101,23 +112,33 @@ def query_combined_policies(self: object, Returns a set of Response Policies which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/response-policies/queryCombinedRTResponsePolicies + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -135,15 +156,25 @@ def perform_policies_action(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Perform the specified action on the Response Policies specified in the request. - Keyword arguments: - action_name -- action to perform: 'add-host-group', 'add-rule-group', 'disable', - 'enable', 'remove-host-group', or 'remove-rule-group'. - action_parameters -- Action specific parameter options. List of dictionaries. - { - "name": "string", - "value": "string" - } - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/response-policies/performRTResponsePoliciesAction + + Keyword arguments + ----------------- + action_name : str + action to perform: 'add-host-group', 'add-rule-group', 'disable', + 'enable', 'remove-host-group', or 'remove-rule-group'. + action_parameters : list + Action specific parameter options. List of dictionaries. + { + "name": "string", + "value": "string" + } + body : dict + full body payload, not required if keywords are used. { "action_parameters": [ { @@ -155,19 +186,20 @@ def perform_policies_action(self: object, "string" ] } - group_id -- Host Group ID to apply the policy to. String. - Overridden if action_parameters is provided. - ids -- Response policy ID(s) to perform actions against. String or list of strings. - parameters - full parameters payload, not required if action_name is provide as a keyword. + group_id : str + Host Group ID to apply the policy to. String. + Overridden if action_parameters is provided. + ids : str or list[str] + Response policy ID(s) to perform actions against. + parameters : dict + full parameters payload, not required if action_name is provide as a keyword. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/response-policies/performRTResponsePoliciesAction + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, payload_value="ids") @@ -197,25 +229,33 @@ def set_policies_precedence(self: object, body: dict = None, **kwargs) -> Union[ have the lowest. You must specify all non-Default Policies for a platform when updating precedence. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/response-policies/setRTResponsePoliciesPrecedence + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "ids": [ "string" ], "platform_name": "string" } - ids -- Prevention policy ID(s) to perform actions against. String or list of strings. - platform_name -- OS platform name. (Linux, Mac, Windows) + ids : str or list[str] + Prevention policy ID(s) to perform actions against. + platform_name : str + OS platform name. (Linux, Mac, Windows) This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/response-policies/setRTResponsePoliciesPrecedence + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, payload_value="ids") @@ -233,19 +273,28 @@ def set_policies_precedence(self: object, body: dict = None, **kwargs) -> Union[ def get_policies(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve a set of Response Policies by specifying their IDs. - Keyword arguments: - ids -- List of Response Policy IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/response-policies/getRTResponsePolicies + + Keyword arguments + ----------------- + ids : str or list[str] + List of Response Policy IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -259,8 +308,16 @@ def get_policies(self: object, *args, parameters: dict = None, **kwargs) -> Unio def create_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create Response Policies by specifying details about the policy to create. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/response-policies/createRTResponsePolicies + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "resources": [ { @@ -277,24 +334,27 @@ def create_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str } ] } - clone_id -- Response Policy ID to clone. String. - description -- Response Policy description. String. - name -- Response Policy name. String. - platform_name -- Name of the operating system platform. String. - settings -- Response policy specific settings. List of dictionaries. - { - "id": "string", - "value": {} - } + clone_id : str + Response Policy ID to clone. + description : str + Response Policy description. + name : str + Response Policy name. + platform_name : str + Name of the operating system platform. + settings : list + Response policy specific settings. List of dictionaries. + { + "id": "string", + "value": {} + } This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/response-policies/createRTResponsePolicies + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = response_policy_payload(passed_keywords=kwargs) @@ -310,19 +370,28 @@ def create_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str def delete_policies(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a set of Response Policies by specifying their IDs. - Keyword arguments: - ids -- List of Response Policy IDs to delete. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/response-policies/deleteRTResponsePolicies + + Keyword arguments + ----------------- + ids : str or list[str] + List of Response Policy IDs to delete. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -336,8 +405,16 @@ def delete_policies(self: object, *args, parameters: dict = None, **kwargs) -> U def update_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update Response Policies by specifying the ID of the policy and details to update. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/response-policies/updateRTResponsePolicies + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "resources": [ { @@ -353,23 +430,25 @@ def update_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str } ] } - description -- Response Policy description. String. - id -- Response Policy ID to update. String. - name -- Response Policy name. String. - settings -- Response policy specific settings. List of dictionaries. - { - "id": "string", - "value": "string" - } + description : str + Response Policy description. + id : str + Response Policy ID to update. + name : str + Response Policy name. + settings : list + Response policy specific settings. List of dictionaries. + { + "id": "string", + "value": "string" + } This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/response-policies/updateRTResponsePolicies + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = response_policy_payload(passed_keywords=kwargs) @@ -387,24 +466,35 @@ def query_policy_members(self: object, parameters: dict = None, **kwargs) -> Uni Returns a set of Agent IDs which match the filter criteria. - Keyword arguments: - id -- The ID of the Response Policy to search for members of - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/response-policies/queryRTResponsePolicyMembers + + Keyword arguments + ----------------- + id : str + The ID of the Response Policy to search for members of + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -420,23 +510,33 @@ def query_policies(self: object, parameters: dict = None, **kwargs) -> Union[Dic This returns a set of Response Policy IDs that match the given criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/response-policies/queryRTResponsePolicies + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/saas_security.py b/src/falconpy/saas_security.py index 4a1fbd590..31cae8fb6 100644 --- a/src/falconpy/saas_security.py +++ b/src/falconpy/saas_security.py @@ -59,35 +59,48 @@ class SaasSecurity(ServiceClass): def get_metrics(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """GET Metrics. - Keyword arguments: - status -- Exposure status. String. - Available values: - Passed Failed - Dismissed Pending - Can't Run Stale - limit -- The maximum number of objects to return. Integer. - offset -- The starting index of the results. Integer. - integration_id -- Comma separated list of integration IDs. String. - impact -- Impact. String. - Available values: - 1 2 3 - compliance -- Compliance. Boolean. - check_type -- Check Type. String. - Available values: - apps devices - users assets - permissions Falcon Shield Security Check - custom - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/saas-security/GetMetricsV3 + + Keyword arguments + ----------------- + status : str + Exposure status. String. + Available values: + Passed Failed + Dismissed Pending + Can't Run Stale + limit : int + The maximum number of objects to return. + offset : int + The starting index of the results. + integration_id : str + Comma separated list of integration IDs. + impact : str + Impact. String. + Available values: + 1 2 3 + compliance : bool + Compliance. + check_type : str + Check Type. String. + Available values: + apps devices + users assets + permissions Falcon Shield Security Check + custom + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -101,29 +114,43 @@ def get_metrics(self: object, parameters: dict = None, **kwargs) -> Union[Dict[s def get_alerts(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """GET Alert by ID or GET Alerts. - Keyword arguments: - id -- Alert ID. String - limit -- The maximum number of objects to return. Integer. - offset -- The starting index of the results. Integer. - last_id -- The last id of the alert you want to get. String. - type -- The type of alert you want to get. String. - Available values: - configuration_drift check_degraded - integration_failure Threat - integration_id -- Comma separated list of integration ID's of the alert you want to get. String - from_date -- The start date of the alert you want to get (in YYYY-MM-DD format). String. - to_date -- The end date of the alert you want to get (in YYYY-MM-DD format). String. - ascending -- Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/saas-security/GetAlertsV3 + + Keyword arguments + ----------------- + id : str + Alert ID. + limit : int + The maximum number of objects to return. + offset : int + The starting index of the results. + last_id : str + The last id of the alert you want to get. + type : str + The type of alert you want to get. String. + Available values: + configuration_drift check_degraded + integration_failure Threat + integration_id : str + Comma separated list of integration ID's of the alert you want to get. + from_date : str + The start date of the alert you want to get (in YYYY-MM-DD format) + to_date : str + The end date of the alert you want to get (in YYYY-MM-DD format) + ascending : bool + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -141,19 +168,28 @@ def get_application_users(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """GET Application Users. - Keyword arguments: - item_id -- Item ID in format: 'integration_id|||app_id' (item_id). String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'item_id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/saas-security/GetAppInventoryUsers + + Keyword arguments + ----------------- + item_id : str + Item ID in format: 'integration_id|||app_id' (item_id) + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'item_id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -170,31 +206,47 @@ def get_application_inventory(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """GET Applications Inventory. - Keyword arguments: - type -- Comma separated list of app types. String. - limit -- The maximum number of objects to return. Integer. - offset -- The starting index of the results Integer. - status -- Comma separated list of application statuses. String. - Available values: - approved in review - rejected unclassified - access_level -- Comma separated list of access levels. String. - scopes -- Comma separated list of scopes. String. - users -- Users. Format: 'is equal value' or 'contains value' or 'value' (implies 'is equal value'). String. - groups -- Comma separated list of groups. String - last_activity -- Last activity was within or was not within the last 'value' days. String. - Format: 'was value' or 'was not value' or 'value' (implies 'was value'). 'value' is an integer - integration_id -- Comma separated list of integration IDs. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/saas-security/GetAppInventory + + Keyword arguments + ----------------- + type : str + Comma separated list of app types. + limit : int + The maximum number of objects to return. + offset : int + The starting index of the results. + status : str + Comma separated list of application statuses. String. + Available values: + approved in review + rejected unclassified + access_level : str + Comma separated list of access levels. + scopes : str + Comma separated list of scopes. + users : str + Users. Format: 'is equal value' or 'contains value' or 'value' (implies 'is equal value') + groups : str + Comma separated list of groups. + last_activity : str + Last activity was within or was not within the last 'value' days. String. + Format: 'was value' or 'was not value' or 'value' (implies 'was value'). 'value' is an. + integration_id : str + Comma separated list of integration IDs. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -208,20 +260,29 @@ def get_application_inventory(self: object, def get_security_check(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """GET Security Check Affected. - Keyword arguments: - id -- Security Check ID. String. - limit -- The maximum number of objects to return. Integer. - offset -- The starting index of the results. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/saas-security/GetSecurityCheckAffectedV3 + + Keyword arguments + ----------------- + id : str + Security Check ID. + limit : int + The maximum number of objects to return. + offset : int + The starting index of the results. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -239,25 +300,35 @@ def dismiss_affected_entity(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """POST Dismiss Affected Entity. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/saas-security/DismissAffectedEntityV3 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "entities": "string", "reason": "string" } - entities -- Entities. String. - reason -- Reason for dismiss. String. - id -- Security Check ID. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + entities : str + Entities. + reason : str + Reason for dismiss. + id : str + Security Check ID. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/saas-security/DismissAffectedEntityV3 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: keys = ["entities", "reason"] @@ -282,23 +353,32 @@ def dismiss_security_check(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """POST Dismiss Security Check by ID. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/saas-security/DismissSecurityCheckV3 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "reason": "string" } - reason -- The reason for dismissal. String. - id -- Security Check ID. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + reason : str + The reason for dismissal. + id : str + Security Check ID. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/saas-security/DismissSecurityCheckV3 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: if kwargs.get("reason", None) is not None: @@ -317,37 +397,52 @@ def dismiss_security_check(self: object, def get_security_checks(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """GET Security Check by ID or GET List Security Checks. - Keyword arguments: - id -- Security Check ID. String - limit -- The maximum number of objects to return. Integer. - offset -- The starting index of the results. Integer. - status -- Exposure status. String. - Available values: - Passsed Failed - Dismissed Pending - Can't Run Stale - integration_id -- Comma separated list of integration IDs. String. - impact -- Impact. String. - Available values: - Low Medium High - compliance -- Compliance. Boolean. - check_type -- Check Type. String. - Available values: - apps devices - users assets - permissions Falcon Shield Security Check - custom - check_tags -- Comma separated list of check tags names or ids. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/saas-security/GetSecurityChecksV3 + + Keyword arguments + ----------------- + id : str + Security Check ID. + limit : int + The maximum number of objects to return. + offset : int + The starting index of the results. + status : str + Exposure status. String. + Available values: + Passsed Failed + Dismissed Pending + Can't Run Stale + integration_id : str + Comma separated list of integration IDs. + impact : str + Impact. String. + Available values: + Low Medium High + compliance : bool + Compliance. + check_type : str + Check Type. String. + Available values: + apps devices + users assets + permissions Falcon Shield Security Check + custom + check_tags : str + Comma separated list of check tags names or ids. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -365,19 +460,28 @@ def get_security_check_compliance(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """GET Compliance. - Keyword arguments: - id -- Security Check ID. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/saas-security/GetSecurityCheckComplianceV3 + + Keyword arguments + ----------------- + id : str + Security Check ID. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -395,19 +499,28 @@ def complete_integration_upload(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """POST Data Upload Transaction Completion. - Keyword arguments: - id -- Integration ID. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/saas-security/IntegrationBuilderEndTransactionV3 + + Keyword arguments + ----------------- + id : str + Integration ID. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -425,19 +538,28 @@ def reset_integration_builder(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Reset. - Keyword arguments: - id -- Integration ID. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/saas-security/IntegrationBuilderResetV3 + + Keyword arguments + ----------------- + id : str + Integration ID. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -455,19 +577,28 @@ def get_integration_builder_status(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """GET Status. - Keyword arguments: - id -- Integration ID. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/saas-security/IntegrationBuilderGetStatusV3 + + Keyword arguments + ----------------- + id : str + Integration ID. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -485,24 +616,33 @@ def upload_integration_builder(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """POST Upload. - Keyword arguments: - body -- Full body payload provided as a dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/saas-security/IntegrationBuilderUploadV3 + + Keyword arguments + ----------------- + body : dict + Full body payload provided as a dictionary. Not required if using other keywords. { "data": "string" } - data -- String. - id -- Integration ID. String. - source_id -- Source ID. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + data : str + id : str + Integration ID. + source_id : str + Source ID. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/saas-security/IntegrationBuilderUploadV3 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: if kwargs.get("data", None) is not None: @@ -521,31 +661,49 @@ def upload_integration_builder(self: object, def get_asset_inventory(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """GET Data Inventory. - Keyword arguments: - integration_id -- Comma separated list of integration IDs. String. - limit -- The maximum number of objects to return. Integer. - offset -- The starting index of the results. Integer. - resource_type -- Comma separated list of resource types. String. - access_level -- Comma separated list of access levels. String. - last_accessed -- Last accessed date was within or was not within the last 'value' days. String. - Format: 'was value' or 'was not value' or 'value' (implies 'was value'). 'value' is an integer - last_modified -- Last modified date was within or was not within the last 'value' days. String. - Format: 'was value' or 'was not value' or 'value' (implies 'was value'). 'value' is an integer - resource_name -- Resource name contains 'value' (case insensitive). String. - password_protected -- Password protected. Boolean. - resource_owner -- Resource owner contains 'value' (case insensitive). String. - resource_owner_enabled -- Resource owner enabled. Boolean. - unmanaged_domain -- Comma separated list of unmanaged domains. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/saas-security/GetAssetInventoryV3 + + Keyword arguments + ----------------- + integration_id : str + Comma separated list of integration IDs. + limit : int + The maximum number of objects to return. + offset : int + The starting index of the results. + resource_type : str + Comma separated list of resource types. + access_level : str + Comma separated list of access levels. + last_accessed : str + Last accessed date was within or was not within the last 'value' days. String. + Format: 'was value' or 'was not value' or 'value' (implies 'was value'). 'value' is an. + last_modified : str + Last modified date was within or was not within the last 'value' days. String. + Format: 'was value' or 'was not value' or 'value' (implies 'was value'). 'value' is an. + resource_name : str + Resource name contains 'value' (case insensitive) + password_protected : bool + Password protected. + resource_owner : str + Resource owner contains 'value' (case insensitive) + resource_owner_enabled : bool + Resource owner enabled. + unmanaged_domain : str + Comma separated list of unmanaged domains. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -559,23 +717,35 @@ def get_asset_inventory(self: object, parameters: dict = None, **kwargs) -> Unio def get_device_inventory(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """GET Device Inventory. - Keyword arguments: - integration_id -- Comma separated integration ID's. String. - limit -- The maximum number of objects to return. Integer. - offset -- The starting index of the results. Integer. - email -- Email. String. - privileged_only -- Privileged Only. Boolean. - unassociated_devices -- Unassociated Devices. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/saas-security/GetDeviceInventoryV3 + + Keyword arguments + ----------------- + integration_id : str + Comma separated integration ID's. + limit : int + The maximum number of objects to return. + offset : int + The starting index of the results. + email : str + Email. + privileged_only : bool + Privileged Only. + unassociated_devices : bool + Unassociated Devices. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -589,18 +759,25 @@ def get_device_inventory(self: object, parameters: dict = None, **kwargs) -> Uni def get_integrations(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """GET Integrations. - Keyword arguments: - saas_id -- Comma separated SaaS ID's. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/saas-security/GetIntegrationsV3 + + Keyword arguments + ----------------- + saas_id : str + Comma separated SaaS ID's. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -614,25 +791,39 @@ def get_integrations(self: object, parameters: dict = None, **kwargs) -> Union[D def get_activity_monitor(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """GET Activity Monitor. - Keyword arguments: - integration_id -- Integration ID. String. - actor -- Actor. String. - category -- Comma separated list of categories. String. - projection -- Comma separated list of projections. String. - from_date -- From Date. String. - to_date -- To Date. String. - limit -- Max number of logs to fetch. Integer. - skip -- Number of logs to skip. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/saas-security/GetActivityMonitorV3 + + Keyword arguments + ----------------- + integration_id : str + Integration ID. + actor : str + Actor. + category : str + Comma separated list of categories. + projection : str + Comma separated list of projections. + from_date : str + From Date. + to_date : str + To Date. + limit : int + Max number of logs to fetch. + skip : int + Number of logs to skip. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -646,17 +837,23 @@ def get_activity_monitor(self: object, parameters: dict = None, **kwargs) -> Uni def get_supported_saas(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """GET Supported SaaS. - Keyword arguments: - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/saas-security/GetSupportedSaasV3 + + Keyword arguments + ----------------- + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -670,22 +867,33 @@ def get_supported_saas(self: object, parameters: dict = None, **kwargs) -> Union def get_system_logs(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """GET System Logs. - Keyword arguments: - from_date -- From Date (in YYYY-MM-DD format). String. - limit -- The maximum number of objects to return. Integer. - offset -- The starting index of the results. Integer. - to_date -- To Date (in YYYY-MM-DD format). String. - total_count -- Fetch Total Count?. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/saas-security/GetSystemLogsV3 + + Keyword arguments + ----------------- + from_date : str + From Date (in YYYY-MM-DD format) + limit : int + The maximum number of objects to return. + offset : int + The starting index of the results. + to_date : str + To Date (in YYYY-MM-DD format) + total_count : bool + Fetch Total Count? + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -699,17 +907,23 @@ def get_system_logs(self: object, parameters: dict = None, **kwargs) -> Union[Di def get_system_users(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """GET System Users. - Keyword arguments: - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/saas-security/GetSystemUsersV3 + + Keyword arguments + ----------------- + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -723,22 +937,33 @@ def get_system_users(self: object, parameters: dict = None, **kwargs) -> Union[D def get_user_inventory(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """GET User Inventory. - Keyword arguments: - integration_id -- Comma separated integration ID's. String. - limit -- The maximum number of objects to return. Integer. - offset -- The starting index of the results. Integer. - email -- Email. String. - privileged_only -- Privileged Only. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/saas-security/GetUserInventoryV3 + + Keyword arguments + ----------------- + integration_id : str + Comma separated integration ID's. + limit : int + The maximum number of objects to return. + offset : int + The starting index of the results. + email : str + Email. + privileged_only : bool + Privileged Only. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/sample_uploads.py b/src/falconpy/sample_uploads.py index 4531a3545..dd196746b 100644 --- a/src/falconpy/sample_uploads.py +++ b/src/falconpy/sample_uploads.py @@ -67,21 +67,32 @@ class SampleUploads(ServiceClass): def list_archive(self: object, *args, parameters: dict = None, **kwargs) -> object: """Retrieve the archive files in chunks. - Keyword arguments: - id -- The SHA256 of the archive. String. - limit -- Maximum number of files to retrieve. Integer. Default: 100. - offset -- Starting offset from which to retrieve files. - parameters -- Full parameters payload, not required if id is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sample-uploads/ArchiveListV1 + + Keyword arguments + ----------------- + id : str + The SHA256 of the archive. + limit : int + Maximum number of files to retrieve. Integer. Default: 100. + offset : str + Starting offset from which to retrieve files. + parameters : dict + Full parameters payload, not required if id is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -98,20 +109,30 @@ def get_archive(self: object, *args, parameters: dict = None, **kwargs) -> objec Status `done` means that archive was processed successfully. Status `error` means that archive was not processed successfully. - Keyword arguments: - id -- The SHA256 of the archive. String. - include_files -- Flag indicating if processed archives should also be returned. Boolean. - parameters -- Full parameters payload, not required if id is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sample-uploads/ArchiveGetV1 + + Keyword arguments + ----------------- + id : str + The SHA256 of the archive. + include_files : bool + Flag indicating if processed archives should also be returned. + parameters : dict + Full parameters payload, not required if id is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -125,19 +146,28 @@ def get_archive(self: object, *args, parameters: dict = None, **kwargs) -> objec def delete_archive(self: object, *args, parameters: dict = None, **kwargs) -> dict: """Remove an archive that was uploaded previously. - Keyword arguments: - id -- The archive SHA256. String. - parameters -- full parameters payload, not required if id is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sample-uploads/ArchiveDeleteV1 + + Keyword arguments + ----------------- + id : str + The archive SHA256. + parameters : dict + full parameters payload, not required if id is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -161,27 +191,39 @@ def upload_archive_v1(self: object, ** DEPRECATED ** - Leverage the ArchiveUploadV2 operation instead. - Keyword arguments: - body -- Content of the uploaded archive in binary format. 7zip / zip only. - comment -- A descriptive comment to identify the file for other users. String. - name -- Name of the archive. String. - file_type -- Archive file format. String. "zip", "7zip". Defaults to "zip". - is_confidential -- Defines the visibility of this file in Falcon MalQuery, either - via the API or the Falcon console. - True = File is only shown to users within your customer account. - False = File can be seen by other CrowdStrike customers. - Defaults to True. - parameters -- full parameters payload, not required if using other keywords. - password -- Archive password. String. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sample-uploads/ArchiveUploadV1 + + Keyword arguments + ----------------- + body : dict + Content of the uploaded archive in binary format. 7zip / zip only. + comment : str + A descriptive comment to identify the file for other users. + name : str + Name of the archive. + file_type : str + Archive file format. String. "zip", "7zip". Defaults to "zip". + is_confidential : bool + Defines the visibility of this file in Falcon MalQuery, either + via the API or the Falcon console. + True = File is only shown to users within your customer account. + False = File can be seen by other CrowdStrike customers. + Defaults to True. + parameters : dict + Full parameters payload. Not required if using other keywords. + password : str + Archive password. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ # Try to find the binary object they provided us if not body: @@ -211,28 +253,40 @@ def upload_archive(self: object, After uploading, use ExtractionCreateV1 to copy the file to internal storage making it available for content analysis. - Keyword arguments: - comment -- A descriptive comment to identify the file for other users. String. - file_data -- Content of the uploaded archive in binary format. - 'archive' and 'file' are also accepted as this parameter. - name -- Name of the archive. String. Required. - file_type -- Archive file format. String. "zip", "7zip". Defaults to "zip". - is_confidential -- Defines the visibility of this file in Falcon MalQuery, either - via the API or the Falcon console. - True = File is only shown to users within your customer account. - False = File can be seen by other CrowdStrike customers. - Defaults to True. - parameters -- full parameters payload, not required if using other keywords. - password -- Archive password. String. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sample-uploads/ArchiveUploadV2 + + Keyword arguments + ----------------- + comment : str + A descriptive comment to identify the file for other users. + file_data : str + Content of the uploaded archive in binary format. + 'archive' and 'file' are also accepted as this parameter. + name : str (required) + Name of the archive. + file_type : str + Archive file format. String. "zip", "7zip". Defaults to "zip". + is_confidential : str + Defines the visibility of this file in Falcon MalQuery, either + via the API or the Falcon console. + True = File is only shown to users within your customer account. + False = File can be seen by other CrowdStrike customers. + Defaults to True. + parameters : dict + Full parameters payload. Not required if using other keywords. + password : str + Archive password. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ method_args = ["name", "archive", "file", "file_data", "is_confidential", "comment", "password"] kwargs = params_to_keywords(method_args, @@ -282,21 +336,32 @@ def list_extraction(self: object, *args, parameters: dict = None, **kwargs) -> o Status `done` means that all files were processed successfully. Status `error` means that at least one of the files could not be processed. - Keyword arguments: - id -- The extraction operation ID. String. - limit -- Maximum number of file extractions to retrieve. Integer. Default: 0. - offset -- Starting offset from where to retrieve extractions. - parameters -- Full parameters payload, not required if id is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sample-uploads/ExtractionListV1 + + Keyword arguments + ----------------- + id : str + The extraction operation ID. + limit : int + Maximum number of file extractions to retrieve. Integer. Default: 0. + offset : str + Starting offset from where to retrieve extractions. + parameters : dict + Full parameters payload, not required if id is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -313,20 +378,30 @@ def get_extraction(self: object, *args, parameters: dict = None, **kwargs) -> ob Status `done` means that all files were processed successfully. Status `error` means that at least one of the files could not be processed. - Keyword arguments: - id -- The extraction operation ID. String. - include_files -- Flag indicating if processed archives should also be returned. Boolean. - parameters -- Full parameters payload, not required if id is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sample-uploads/ExtractionGetV1 + + Keyword arguments + ----------------- + id : str + The extraction operation ID. + include_files : bool + Flag indicating if processed archives should also be returned. + parameters : dict + Full parameters payload, not required if id is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -344,8 +419,16 @@ def create_extraction(self: object, ) -> dict: """Extract files from an uploaded archive and copy them to internal storage for analysis. - Keyword arguments: - body -- Full body payload in JSON format. Not required if using other keywords. Dictionary. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sample-uploads/ExtractionCreateV1 + + Keyword arguments + ----------------- + body : dict + Full body payload in JSON format. Not required if using other keywords. { "extract_all": true, "files": [ @@ -357,18 +440,19 @@ def create_extraction(self: object, ], "sha256": "string" } - extract_all -- Flag indicating if all files should be extracted. Boolean. - files -- List of files to be extracted from the archive. List of dictionaries. - sha256 -- SHA256 Archive ID of the archive. String. + extract_all : bool + Flag indicating if all files should be extracted. + files : list[dict] + List of files to be extracted from the archive. + sha256 : str + SHA256 Archive ID of the archive. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sample-uploads/ExtractionCreateV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = extraction_payload(passed_keywords=kwargs) @@ -390,22 +474,33 @@ def get_sample(self: object, ) -> Union[Dict[str, Union[int, dict]], Result, Response]: """Retrieve the file associated with the given ID (SHA256). - Keyword arguments: - ids -- List of SHA256s to retrieve. String or list of strings. - parameters -- Full parameters payload, not required if ids is provided as a keyword. - password_protected -- Flag whether the sample should be zipped and password protected - with the pass of 'infected'. Defaults to False. - stream -- Enable streaming download of the file. Boolean. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sample-uploads/GetSampleV3 + + Keyword arguments + ----------------- + ids : str + List of SHA256s to retrieve. + parameters : dict + Full parameters payload, not required if ids is provided as a keyword. + password_protected : bool + Flag whether the sample should be zipped and password protected + with the pass of 'infected'. Defaults to False. + stream : bool + Enable streaming download of the file. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -427,49 +522,57 @@ def upload_sample(self: object, After uploading, call the specific analysis API endpoint. - Keyword arguments: - comment -- A descriptive comment to identify the file for other users. String. - file_data -- Content of the uploaded sample in binary format. Max file size is 256 MB. - 'sample' and 'upfile' are also accepted as this parameter. - - Accepted File Formats: - Portable executables: .exe, .scr, .pif, .dll, .com, .cpl, etc. - Office documents: .doc, .docx, .ppt, .pps, .pptx, .ppsx, .xls, - .xlsx, .rtf, .pub - PDF - APK - Executable JAR - Windows script component: .sct - Windows shortcut: .lnk - Windows help: .chm - HTML application: .hta - Windows script file: .wsf - Javascript: .js - Visual Basic: .vbs, .vbe - Shockwave Flash: .swf - Perl: .pl - Powershell: .ps1, .psd1, .psm1 - Scalable vector graphics: .svg - Python: .py - Linux ELF executables - Email files: MIME RFC 822 .eml, Outlook .msg - file_name -- Name of the file. String. - is_confidential -- Defines the visibility of this file in Falcon MalQuery, either - via the API or the Falcon console. - True = File is only shown to users within your customer account. - False = File can be seen by other CrowdStrike customers. - Defaults to True. - parameters -- full parameters payload, not required if using other keywords. - - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sample-uploads/UploadSampleV3 + + Keyword arguments + ----------------- + comment : str + A descriptive comment to identify the file for other users. + file_data : str + Content of the uploaded sample in binary format. Max file size is 256 MB. + 'sample' and 'upfile' are also accepted as this parameter. + Accepted File Formats: + Portable executables: .exe, .scr, .pif, .dll, .com, .cpl, etc. + Office documents: .doc, .docx, .ppt, .pps, .pptx, .ppsx, .xls, + .xlsx, .rtf, .pub + PDF + APK + Executable JAR + Windows script component: .sct + Windows shortcut: .lnk + Windows help: .chm + HTML application: .hta + Windows script file: .wsf + Javascript: .js + Visual Basic: .vbs, .vbe + Shockwave Flash: .swf + Perl: .pl + Powershell: .ps1, .psd1, .psm1 + Scalable vector graphics: .svg + Python: .py + Linux ELF executables + Email files: MIME RFC 822 .eml, Outlook .msg + file_name : str + Name of the file. + is_confidential : str + Defines the visibility of this file in Falcon MalQuery, either + via the API or the Falcon console. + True = File is only shown to users within your customer account. + False = File can be seen by other CrowdStrike customers. + Defaults to True. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ # Check for raw parameters dictionary and convert it's contents to keywords method_args = ["file_name", "sample", "upfile", "file_data", "is_confidential", "comment"] @@ -511,19 +614,28 @@ def upload_sample(self: object, def delete_sample(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Remove a sample, including file, meta and submissions from the collection. - Keyword arguments: - ids -- List of SHA256s to delete. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sample-uploads/DeleteSampleV3 + + Keyword arguments + ----------------- + ids : str + List of SHA256s to delete. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/scanning_orchestrator.py b/src/falconpy/scanning_orchestrator.py new file mode 100644 index 000000000..0f1e68163 --- /dev/null +++ b/src/falconpy/scanning_orchestrator.py @@ -0,0 +1,477 @@ +"""CrowdStrike Falcon ScanningOrchestrator API interface class. + + _______ __ _______ __ __ __ +| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----. +|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__| +|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____| +|: 1 | |: 1 | +|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy +`-------' `-------' + +OAuth2 API - Customer SDK + +This is free and unencumbered software released into the public domain. + +Anyone is free to copy, modify, publish, use, compile, sell, or +distribute this software, either in source code form or as a compiled +binary, for any purpose, commercial or non-commercial, and by any +means. + +In jurisdictions that recognize copyright laws, the author or authors +of this software dedicate any and all copyright interest in the +software to the public domain. We make this dedication for the benefit +of the public at large and to the detriment of our heirs and +successors. We intend this dedication to be an overt act of +relinquishment in perpetuity of all present and future rights to this +software under copyright law. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR +OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, +ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR +OTHER DEALINGS IN THE SOFTWARE. + +For more information, please refer to +""" +from typing import Dict, Union +from ._util import force_default, process_service_request, handle_single_argument +from ._payload import create_schedules_payload, trigger_scan_by_schedule_payload, update_schedules_payload +from ._result import Result +from ._service_class import ServiceClass +from ._endpoint._scanning_orchestrator import _scanning_orchestrator_endpoints as Endpoints + + +class ScanningOrchestrator(ServiceClass): + """The only requirement to instantiate an instance of this class is one of the following. + + - a valid client_id and client_secret provided as keywords. + - a credential dictionary with client_id and client_secret containing valid API credentials + { + "client_id": "CLIENT_ID_HERE", + "client_secret": "CLIENT_SECRET_HERE" + } + - a previously-authenticated instance of the authentication service class (oauth2.py) + - a valid token provided by the authentication service class (oauth2.py) + """ + + @force_default(defaults=["parameters"], default_types=["dict"]) + def get_combined_schedules(self: object, + parameters: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Get combined scanning schedules. + + HTTP Method: GET + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/scanning-orchestrator/get_combined_schedules + + Keyword arguments + ----------------- + limit : int + Number of results to return. + offset : int + Starting offset for pagination. + sort : str + Sort field and direction. Available fields: scan_product, provider_type, enabled, name, created_at. Example: + name|asc. + filter : str + FQL filter expression. Available fields: scan_product, provider_type, enabled, name, created_at. Example: + enabled:true. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="get_combined_schedules", + keywords=kwargs, + params=parameters + ) + + @force_default(defaults=["body"], default_types=["dict"]) + def trigger_scan_by_schedule(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Trigger scan by schedule IDs. + + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/scanning-orchestrator/trigger_scan_by_schedule + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "ids": [ + "string" + ] + } + ids : list + The ids value. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = trigger_scan_by_schedule_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="trigger_scan_by_schedule", + body=body + ) + + @force_default(defaults=["parameters"], default_types=["dict"]) + def get_schedules(self: object, + *args, + parameters: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Get scanning schedules. + + HTTP Method: GET + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/scanning-orchestrator/get_schedules + + Keyword arguments + ----------------- + ids : str or list[str] + Schedule IDs to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. + """ + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="get_schedules", + keywords=kwargs, + params=handle_single_argument(args, parameters, "ids") + ) + + @force_default(defaults=["body"], default_types=["dict"]) + def create_schedules(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Create scanning schedules. + + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/scanning-orchestrator/create_schedules + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "resources": [ + { + "account_ids": [ + "string" + ], + "all_accounts": true, + "all_regions": true, + "cadence": { + "unit": "string", + "value": 0 + }, + "cloud_group_ids": [ + "string" + ], + "dspm_scanning_config": { + "classification_scan_mode": "string", + "scan_type": "string" + }, + "enable": true, + "name": "string", + "provider_type": "string", + "scan_product": "string", + "selected_regions": [ + "string" + ], + "service_names": [ + "string" + ] + } + ] + } + resources : list + The resources value. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = create_schedules_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="create_schedules", + body=body + ) + + @force_default(defaults=["parameters"], default_types=["dict"]) + def delete_schedules(self: object, + *args, + parameters: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Delete scanning schedules. + + HTTP Method: DELETE + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/scanning-orchestrator/delete_schedules + + Keyword arguments + ----------------- + ids : str or list[str] + Schedule IDs to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. + """ + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="delete_schedules", + keywords=kwargs, + params=handle_single_argument(args, parameters, "ids") + ) + + @force_default(defaults=["body"], default_types=["dict"]) + def update_schedules(self: object, + body: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Update scanning schedules. + + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/scanning-orchestrator/update_schedules + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. + { + "resources": [ + { + "asset_filter": { + "aws": { + "account_ids": [ + "string" + ], + "all_accounts": true, + "all_regions": true, + "regions": [ + "string" + ], + "service_names": [ + "string" + ] + }, + "azure": { + "all_locations": true, + "all_subscriptions": true, + "locations": [ + "string" + ], + "service_names": [ + "string" + ], + "subscription_ids": [ + "string" + ] + }, + "cloud_groups": { + "cloud_group_ids": [ + "string" + ], + "provider_account_ids": [ + "string" + ], + "service_names": [ + "string" + ] + }, + "gcp": { + "all_projects": true, + "all_regions": true, + "project_ids": [ + "string" + ], + "regions": [ + "string" + ], + "service_names": [ + "string" + ] + }, + "provider_type": "string", + "scan_product": "string" + }, + "cadence": { + "unit": "string", + "value": 0 + }, + "enable": true, + "id": "string", + "name": "string", + "scan_config": { + "dspm_scanning_config": { + "classification_scan_mode": "string", + "scan_type": "string" + } + } + } + ] + } + resources : list + The resources value. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + if not body: + body = update_schedules_payload(passed_keywords=kwargs) + + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="update_schedules", + body=body + ) + + @force_default(defaults=["parameters"], default_types=["dict"]) + def get_service_types(self: object, + parameters: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Get allowed service types. + + HTTP Method: GET + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/scanning-orchestrator/get_service_types + + Keyword arguments + ----------------- + scan_product : str + Scan product filter. Available values: dspm_scanning, vulnerability_scanning. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="get_service_types", + keywords=kwargs, + params=parameters + ) + + @force_default(defaults=["parameters"], default_types=["dict"]) + def search_schedules(self: object, + parameters: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Search scanning schedules. + + HTTP Method: GET + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/scanning-orchestrator/search_schedules + + Keyword arguments + ----------------- + limit : int + Number of results to return. + offset : int + Starting offset for pagination. + sort : str + Sort field and direction. Available fields: scan_product, provider_type, enabled, name, created_at. Example: + name|asc. + filter : str + FQL filter expression. Available fields: scan_product, provider_type, enabled, name, created_at. Example: + enabled:true. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="search_schedules", + keywords=kwargs, + params=parameters + ) diff --git a/src/falconpy/scanning_orchestrator.pyi b/src/falconpy/scanning_orchestrator.pyi new file mode 100644 index 000000000..8a89a49b4 --- /dev/null +++ b/src/falconpy/scanning_orchestrator.pyi @@ -0,0 +1,85 @@ +"""Type stubs for scanning_orchestrator.""" +from typing import Dict, List, Optional, Union +from ._service_class import ServiceClass +from ._result import Result + + +class ScanningOrchestrator(ServiceClass): + + def get_combined_schedules( + self, + *, + limit: Optional[int] = None, + offset: Optional[int] = None, + sort: Optional[str] = None, + filter: Optional[str] = None, + parameters: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def trigger_scan_by_schedule( + self, + *, + ids: Optional[Union[str, List[str]]] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def get_schedules( + self, + *args: Union[str, List[str]], + ids: Optional[Union[str, List[str]]] = None, + parameters: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def create_schedules( + self, + *, + account_ids: Optional[Union[str, List[str]]] = None, + all_accounts: Optional[bool] = None, + all_regions: Optional[bool] = None, + cadence: Optional[dict] = None, + cloud_group_ids: Optional[Union[str, List[str]]] = None, + dspm_scanning_config: Optional[dict] = None, + enable: Optional[bool] = None, + name: Optional[str] = None, + provider_type: Optional[dict] = None, + scan_product: Optional[dict] = None, + selected_regions: Optional[Union[str, List[str]]] = None, + service_names: Optional[Union[str, List[str]]] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def delete_schedules( + self, + *args: Union[str, List[str]], + ids: Optional[Union[str, List[str]]] = None, + parameters: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def update_schedules( + self, + *, + asset_filter: Optional[dict] = None, + cadence: Optional[dict] = None, + enable: Optional[bool] = None, + id: Optional[str] = None, + name: Optional[str] = None, + scan_config: Optional[dict] = None, + body: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def get_service_types( + self, + *, + scan_product: Optional[str] = None, + parameters: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def search_schedules( + self, + *, + limit: Optional[int] = None, + offset: Optional[int] = None, + sort: Optional[str] = None, + filter: Optional[str] = None, + parameters: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... diff --git a/src/falconpy/scheduled_reports.py b/src/falconpy/scheduled_reports.py index 0f7e288b8..cf4619400 100644 --- a/src/falconpy/scheduled_reports.py +++ b/src/falconpy/scheduled_reports.py @@ -60,24 +60,33 @@ class ScheduledReports(ServiceClass): def launch(self: object, *args, body: list = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Launch scheduled report executions for the provided ID(s). - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/scheduled-reports/scheduled-reports.launch + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. [ { "id": "string" } ] - ids -- ID of the report to launch. String or list of strings. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/scheduled-reports/scheduled-reports.launch + ids : str or list[str] + ID of the report to launch. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = reports_payload(passed_arguments=args, passed_keywords=kwargs) @@ -93,19 +102,28 @@ def launch(self: object, *args, body: list = None, **kwargs) -> Union[Dict[str, def get_reports(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve scheduled reports for the provided report IDs. - Keyword arguments: - ids -- ID(s) of the reports to retrieve. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/scheduled-reports/scheduled-reports.get + + Keyword arguments + ----------------- + ids : str or list[str] + ID(s) of the reports to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -119,28 +137,39 @@ def get_reports(self: object, *args, parameters: dict = None, **kwargs) -> Union def query_reports(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Find all report IDs matching the query with filter. - Keyword arguments: - filter -- FQL query specifying the filter parameters. - Filter term criteria: type, trigger_reference, recipients, user_uuid, - cid, trigger_params.metadata. - Filter range criteria: created_on, modified_on; - use any common date format, such as '2010-05-15T14:55:21.892315096Z'. - limit -- The maximum number of ids to return. - offset -- Starting integer index of overall result set from which to return ids. - parameters - full parameters payload, not required if using other keywords. - q -- Match query criteria, which includes all the filter string fields. - sort -- The property to sort by. FQL syntax. (e.g. created_on.asc, last_updated_on.desc) - Possible sort fields: created_on, last_updated_on, last_execution_on, - next_execution_on - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/scheduled-reports/scheduled-reports.query + + Keyword arguments + ----------------- + filter : str + FQL query specifying the filter parameters. + Filter term criteria: type, trigger_reference, recipients, user_uuid, + cid, trigger_params.metadata. + Filter range criteria: created_on, modified_on; + use any common date format, such as '2010-05-15T14:55:21.892315096Z'. + limit : int + The maximum number of ids to return. + offset : str + Starting integer index of overall result set from which to return ids. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Match query criteria, which includes all the filter string fields. + sort : str + The property to sort by. FQL syntax. (e.g. created_on.asc, last_updated_on.desc) + Possible sort fields: created_on, last_updated_on, last_execution_on, + next_execution_on + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/sensor_download.py b/src/falconpy/sensor_download.py index 0cd978e32..9631e3e5a 100644 --- a/src/falconpy/sensor_download.py +++ b/src/falconpy/sensor_download.py @@ -65,22 +65,32 @@ def get_combined_sensor_installers_by_query(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve all metadata for installers from provided query. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return. [integer, 1-5000] - offset -- The first item to return, where 0 is the latest item. (Integer) - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. status.desc or hostname.asc). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sensor-download/GetCombinedSensorInstallersByQuery + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int (1-5000) + The maximum number of records to return. + offset : int + The first item to return, where 0 is the latest item. (Integer) + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. status.desc or hostname.asc). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -99,22 +109,32 @@ def get_combined_sensor_installers_by_query_v2(self: object, Also provides architectural details. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return. [integer, 1-5000] - offset -- The first item to return, where 0 is the latest item. (Integer) - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. status.desc or hostname.asc). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sensor-download/GetCombinedSensorInstallersByQueryV2 + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int (1-5000) + The maximum number of records to return. + offset : int + The first item to return, where 0 is the latest item. (Integer) + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. status.desc or hostname.asc). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -135,23 +155,34 @@ def download_sensor_installer(self: object, The path will be created for the user if it does not already exist. - Keyword arguments: - download_path -- Path to the folder to save installer file. - Must be present to cause a file download. - id -- SHA256 of the installer to download. - file_name -- Name to use for saved file. Must be present to cause a file download. - parameters - Full parameters payload, not required if id is provided as a keyword. - stream -- Enable streaming download of the file. Boolean. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: binary object on SUCCESS, dict object containing API response on FAILURE. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sensor-download/DownloadSensorInstallerById + + Keyword arguments + ----------------- + download_path : str + Path to the folder to save installer file. + Must be present to cause a file download. + id : str + SHA256 of the installer to download. + file_name : str + Name to use for saved file. Must be present to cause a file download. + parameters : dict + Full parameters payload, not required if id is provided as a keyword. + stream : bool + Enable streaming download of the file. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + binary object on SUCCESS, dict object containing API response on FAILURE. """ returned = process_service_request( calling_object=self, @@ -182,23 +213,34 @@ def download_sensor_installer_v2(self: object, The path will be created for the user if it does not already exist. - Keyword arguments: - download_path -- Path to the folder to save installer file. - Must be present to cause a file download. - id -- SHA256 of the installer to download. - file_name -- Name to use for saved file. Must be present to cause a file download. - parameters -- Full parameters payload, not required if id is provided as a keyword. - stream -- Enable streaming download of the file. Boolean. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: binary object on SUCCESS, dict object containing API response on FAILURE. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sensor-download/DownloadSensorInstallerByIdV2 + + Keyword arguments + ----------------- + download_path : str + Path to the folder to save installer file. + Must be present to cause a file download. + id : str + SHA256 of the installer to download. + file_name : str + Name to use for saved file. Must be present to cause a file download. + parameters : dict + Full parameters payload, not required if id is provided as a keyword. + stream : bool + Enable streaming download of the file. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + binary object on SUCCESS, dict object containing API response on FAILURE. """ returned = process_service_request( calling_object=self, @@ -228,19 +270,28 @@ def get_sensor_installer_entities(self: object, (Examples: release_date, version). - Keyword arguments: - ids -- List of SHA256s for installers to retrieve details for. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sensor-download/GetSensorInstallersEntities + + Keyword arguments + ----------------- + ids : str or list[str] + List of SHA256s for installers to retrieve details for. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -260,19 +311,28 @@ def get_sensor_installer_entities_v2(self: object, (Examples: release_date, version). - Keyword arguments: - ids -- List of SHA256s for installers to retrieve details for. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sensor-download/GetSensorInstallersEntitiesV2 + + Keyword arguments + ----------------- + ids : str or list[str] + List of SHA256s for installers to retrieve details for. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -287,12 +347,20 @@ def get_sensor_installer_ccid(self: object) -> Union[Dict[str, Union[int, dict]] This method does not accept arguments. - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sensor-download/GetSensorInstallersCCIDByQuery + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -307,22 +375,32 @@ def get_sensor_installers_by_query(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve a list of SHA256 for installers based on the filter. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return. [integer, 1-500] - offset -- The first item to return, where 0 is the latest item. (Integer) - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. version|ASC, release_date|DESC). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sensor-download/GetSensorInstallersByQuery + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int (1-500) + The maximum number of records to return. + offset : int + The first item to return, where 0 is the latest item. (Integer) + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. version|ASC, release_date|DESC). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -339,22 +417,32 @@ def get_sensor_installers_by_query_v2(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve a list of SHA256 for installers based on the filter. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return. [integer, 1-500] - offset -- The first item to return, where 0 is the latest item. (Integer) - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. version|ASC, release_date|DESC). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sensor-download/GetSensorInstallersByQueryV2 + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int (1-500) + The maximum number of records to return. + offset : int + The first item to return, where 0 is the latest item. (Integer) + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. version|ASC, release_date|DESC). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -371,21 +459,31 @@ def get_combined_sensor_installers_by_query_v3(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get sensor installer details by provided query. - Keyword arguments: - offset -- The first item to return, where 0 is the latest item. Integer. - limit -- The number of items to return in this response (default: 100, max: 500). Integer. - sort -- Sort items using their properties. String. - filter -- Filter items using a query in Falcon Query Language (FQL). String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sensor-download/GetCombinedSensorInstallersByQueryV3 + + Keyword arguments + ----------------- + offset : int + The first item to return, where 0 is the latest item. + limit : int + The number of items to return in this response (default: 100, max: 500) + sort : str + Sort items using their properties. + filter : str + Filter items using a query in Falcon Query Language (FQL) + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -403,19 +501,28 @@ def download_sensor_installer_v3(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Download sensor installer by SHA256 ID. - Keyword arguments: - id -- SHA256 of the installer to download. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sensor-download/DownloadSensorInstallerByIdV3 + + Keyword arguments + ----------------- + id : str + SHA256 of the installer to download. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -433,19 +540,28 @@ def get_sensor_installer_entities_v3(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get sensor installer details by provided SHA256 IDs. - Keyword arguments: - ids -- The IDs of the installers. String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sensor-download/GetSensorInstallersEntitiesV3 + + Keyword arguments + ----------------- + ids : str or list[str] + The IDs of the installers. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -463,22 +579,34 @@ def get_sensor_installers_by_query_v3(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get sensor installer IDs by provided query. - Keyword arguments: - offset -- The first item to return, where 0 is the latest item. Integer. - limit -- The number of items to return in this response (default: 100, max: 500). Integer. - sort -- Sort items using their properties. String. - filter -- Filter items using a query in Falcon Query Language (FQL). String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sensor-download/GetSensorInstallersByQueryV3 + + Keyword arguments + ----------------- + offset : int + The first item to return, where 0 is the latest item. + limit : int + The number of items to return in this response (default: 100, max: 500) + sort : str + Sort items using their properties. + filter : str + Filter items using a query in Falcon Query Language (FQL) + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/sensor_update_policy.py b/src/falconpy/sensor_update_policy.py index 38fcc4079..6ce76990f 100644 --- a/src/falconpy/sensor_update_policy.py +++ b/src/falconpy/sensor_update_policy.py @@ -64,24 +64,32 @@ def reveal_uninstall_token(self: object, body: dict = None, **kwargs) -> Union[D To retrieve the bulk maintenance token pass the value 'MAINTENANCE' as the value for 'device_id'. - Keyword arguments: - audit_message -- Message to list in the audit log for this action. String. - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sensor-update-policies/revealUninstallToken + + Keyword arguments + ----------------- + audit_message : str + Message to list in the audit log for this action. + body : dict + full body payload, not required if keywords are used. { "audit_message": "string", "device_id": "string" } - device_id -- Device ID to retrieve the uninstall token for. Pass the value "MAINTENANCE" - to retrieve the bulk maintenance token. + device_id : str + Device ID to retrieve the uninstall token for. Pass the value "MAINTENANCE" + to retrieve the bulk maintenance token. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sensor-update-policies/revealUninstallToken + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = {} @@ -102,21 +110,28 @@ def increment_uninstall_token(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Increment a bulk maintenance token. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/maintenance-token/incrementUninstallToken + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using other keywords. { "audit_message": "string" } - audit_message -- The audit message for the token increment operation. String. + audit_message : str + The audit message for the token increment operation. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/maintenance-token/incrementUninstallToken + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = maintenance_token_payload(passed_keywords=kwargs) @@ -136,22 +151,32 @@ def query_combined_builds(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve available builds for use with Sensor Update Policies. - Keyword arguments: - platform -- The platform to return builds for. String. - Allowed values: "linux", "linuxarm64", "mac", "windows", "zlinux" - parameters -- full parameters payload, not required if platform is provided as a keyword. - stage -- The stages to return builds for. String or list of strings. - - Arguments: When not specified, the first argument to this method is assumed to be - 'platform'. All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /sensor-update-policies/queryCombinedSensorUpdateBuilds + /sensor-update-policies/queryCombinedSensorUpdateBuilds + + Keyword arguments + ----------------- + platform : str + The platform to return builds for. String. + Allowed values: "linux", "linuxarm64", "mac", "windows", "zlinux" + parameters : dict + full parameters payload, not required if platform is provided as a keyword. + stage : str or list[str] + The stages to return builds for. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'platform'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -165,23 +190,32 @@ def query_combined_builds(self: object, def query_combined_kernels(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve kernel compatibility info for Sensor Update Builds. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters -- full parameters payload, not required if platform is provided as a keyword. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /sensor-update-policies/queryCombinedSensorUpdateKernels + /sensor-update-policies/queryCombinedSensorUpdateKernels + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + full parameters payload, not required if platform is provided as a keyword. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -200,25 +234,36 @@ def query_combined_policy_members(self: object, Returns a set of host details which match the filter criteria. - Keyword arguments: - id -- The ID of the Sensor Update Policy to search for members of - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /sensor-update-policies/queryCombinedSensorUpdatePolicyMembers + /sensor-update-policies/queryCombinedSensorUpdatePolicyMembers + + Keyword arguments + ----------------- + id : str + The ID of the Sensor Update Policy to search for members of + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -237,28 +282,38 @@ def query_combined_policies(self: object, Returns a set of Sensor Update Policies which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. - created_by modified_timestamp - created_timestamp name - enabled platform_name - modified_by precedence - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /sensor-update-policies/queryCombinedSensorUpdatePolicies + /sensor-update-policies/queryCombinedSensorUpdatePolicies + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. + created_by modified_timestamp + created_timestamp name + enabled platform_name + modified_by precedence + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -278,28 +333,38 @@ def query_combined_policies_v2(self: object, Provides additional support for uninstall protection. Returns a set of Sensor Update Policies which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. - created_by modified_timestamp - created_timestamp name - enabled platform_name - modified_by precedence - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /sensor-update-policies/queryCombinedSensorUpdatePoliciesV2 + /sensor-update-policies/queryCombinedSensorUpdatePoliciesV2 + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. + created_by modified_timestamp + created_timestamp name + enabled platform_name + modified_by precedence + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -317,15 +382,26 @@ def perform_policies_action(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Perform the specified action on the Sensor Update Policies specified in the request. - Keyword arguments: - action_name -- action to perform: 'add-host-group', 'add-rule-group', 'disable', 'enable', - 'remove-rule-group' or 'remove-host-group'. - action_parameters -- Action specific parameter options. List of dictionaries. - { - "name": "string", - "value": "string" - } - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html# + /sensor-update-policies/performSensorUpdatePoliciesAction + + Keyword arguments + ----------------- + action_name : str + action to perform: 'add-host-group', 'add-rule-group', 'disable', 'enable', + 'remove-rule-group' or 'remove-host-group'. + action_parameters : list + Action specific parameter options. List of dictionaries. + { + "name": "string", + "value": "string" + } + body : dict + full body payload, not required if keywords are used. { "action_parameters": [ { @@ -337,20 +413,20 @@ def perform_policies_action(self: object, "string" ] } - group_id -- Host Group ID to apply the policy to. String. - Overridden if action_parameters is specified. - ids -- Sensor Update policy ID(s) to perform actions against. String or list of strings. - parameters - full parameters payload, not required if action_name is provided as a keyword. + group_id : str + Host Group ID to apply the policy to. String. + Overridden if action_parameters is specified. + ids : str or list[str] + Sensor Update policy ID(s) to perform actions against. + parameters : dict + full parameters payload, not required if action_name is provided as a keyword. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /sensor-update-policies/performSensorUpdatePoliciesAction + Returns + ------- + dict + Dictionary object containing API response. """ _allowed_actions = ['add-host-group', 'add-rule-group', 'disable', 'enable', 'remove-host-group', 'remove-rule-group'] @@ -390,26 +466,34 @@ def set_policies_precedence(self: object, body: dict = None, **kwargs) -> Union[ the lowest. You must specify all non-Default Policies for a platform when updating precedence. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html# + /sensor-update-policies/setSensorUpdatePoliciesPrecedence + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "ids": [ "string" ], "platform_name": "Windows" } - ids -- Sensor Update policy ID(s) to perform actions against. String or list of strings. - platform_name -- OS platform name. + ids : str or list[str] + Sensor Update policy ID(s) to perform actions against. + platform_name : str + OS platform name. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /sensor-update-policies/setSensorUpdatePoliciesPrecedence + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, payload_value="ids") @@ -427,19 +511,28 @@ def set_policies_precedence(self: object, body: dict = None, **kwargs) -> Union[ def get_policies(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve a set of Sensor Update Policies by specifying their IDs. - Keyword arguments: - ids -- List of Sensor Update Policy IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sensor-update-policies/getSensorUpdatePolicies + + Keyword arguments + ----------------- + ids : str or list[str] + List of Sensor Update Policy IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -453,8 +546,17 @@ def get_policies(self: object, *args, parameters: dict = None, **kwargs) -> Unio def create_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create Sensor Update Policies by specifying details about the policy to create. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html# + /sensor-update-policies/createSensorUpdatePolicies + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "resources": [ { @@ -467,25 +569,27 @@ def create_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str } ] } - build -- Build policy applies to. String. - description -- Sensor Update Policy description. String. - name -- Sensor Update Policy name. String. - platform_name -- Name of the operating system platform. String. - settings -- Sensor update policy specific settings. Dictionary. - OVERRIDES the value of the "build" keyword if provided. - { - "build": "string" - } + build : str + Build policy applies to. + description : str + Sensor Update Policy description. + name : str + Sensor Update Policy name. + platform_name : str + Name of the operating system platform. + settings : dict + Sensor update policy specific settings. Dictionary. + OVERRIDES the value of the "build" keyword if provided. + { + "build": "string" + } This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /sensor-update-policies/createSensorUpdatePolicies + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = sensor_policy_payload(passed_keywords=kwargs) @@ -501,20 +605,29 @@ def create_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str def delete_policies(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Delete a set of Sensor Update Policies by specifying their IDs. - Keyword arguments: - ids -- List of Sensor Update Policy IDs to delete. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /sensor-update-policies/deleteSensorUpdatePolicies + /sensor-update-policies/deleteSensorUpdatePolicies + + Keyword arguments + ----------------- + ids : str or list[str] + List of Sensor Update Policy IDs to delete. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -528,8 +641,17 @@ def delete_policies(self: object, *args, parameters: dict = None, **kwargs) -> U def update_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update Sensor Update Policies by specifying the ID of the policy and details to update. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html# + /sensor-update-policies/updateSensorUpdatePolicies + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "resources": [ { @@ -542,25 +664,27 @@ def update_policies(self: object, body: dict = None, **kwargs) -> Union[Dict[str } ] } - build -- Build policy applies to . String. - description -- Sensor Update Policy description. String. - id -- Sensor Update Policy ID to update. String. - name -- Sensor Update Policy name. String. - settings -- Sensor Update policy specific settings. Dictionary. - OVERRIDES the value of the "build" keyword if provided. - { - "build": "string" - } + build : str + Build policy applies to. + description : str + Sensor Update Policy description. + id : str + Sensor Update Policy ID to update. + name : str + Sensor Update Policy name. + settings : dict + Sensor Update policy specific settings. Dictionary. + OVERRIDES the value of the "build" keyword if provided. + { + "build": "string" + } This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /sensor-update-policies/updateSensorUpdatePolicies + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = sensor_policy_payload(passed_keywords=kwargs) @@ -578,20 +702,29 @@ def get_policies_v2(self: object, *args, parameters: dict = None, **kwargs) -> U Provides additional support for uninstall protection. - Keyword arguments: - ids -- List of Sensor Update Policy IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /sensor-update-policies/getSensorUpdatePoliciesV2 + /sensor-update-policies/getSensorUpdatePoliciesV2 + + Keyword arguments + ----------------- + ids : str or list[str] + List of Sensor Update Policy IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -607,8 +740,17 @@ def create_policies_v2(self: object, body: dict = None, **kwargs) -> Union[Dict[ Provides additional support for uninstall protection. - Keyword arguments: - body -- full body payload, not required if keywords are used. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html# + /sensor-update-policies/createSensorUpdatePoliciesV2 + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "resources": [ { @@ -642,52 +784,58 @@ def create_policies_v2(self: object, body: dict = None, **kwargs) -> Union[Dict[ } ] } - build -- Build policy applies to. String. - description -- Sensor Update Policy description. String. - name -- Sensor Update Policy name. String. - platform_name -- Name of the operating system platform. String. - scheduler -- Scheduler settings. Dictionary. - settings -- Sensor update policy specific settings. Dictionary. - OVERRIDES the value of the "build" and "uninstall_protection" - keywords if provided. + build : str + Build policy applies to. + description : str + Sensor Update Policy description. + name : str + Sensor Update Policy name. + platform_name : str + Name of the operating system platform. + scheduler : dict + Scheduler settings. + settings : dict + Sensor update policy specific settings. Dictionary. + OVERRIDES the value of the "build" and "uninstall_protection" + keywords if provided. + { + "build": "string", + "scheduler": { + "enabled": true, + "schedules": [ + { + "days": [ + 0 + ], + "end": "string", + "start": "string" + } + ], + "timezone": "string" + }, + "show_early_adopter_builds": true, + "uninstall_protection": "ENABLED", + "variants": [ { "build": "string", - "scheduler": { - "enabled": true, - "schedules": [ - { - "days": [ - 0 - ], - "end": "string", - "start": "string" - } - ], - "timezone": "string" - }, - "show_early_adopter_builds": true, - "uninstall_protection": "ENABLED", - "variants": [ - { - "build": "string", - "platform": "string" - } - ] + "platform": "string" } - show_early_adopter_builds -- Enable early adopter builds. Boolean. - uninstall_protection -- Boolean indicating if uninstall protection should be enabled. - String. Allowed values: "ENABLED", "DISABLED" - variants -- List of variants. List of dictionaries. + ] + } + show_early_adopter_builds : bool + Enable early adopter builds. + uninstall_protection : str + Boolean indicating if uninstall protection should be enabled. + String. Allowed values: "ENABLED", "DISABLED" + variants : list[dict] + List of variants. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /sensor-update-policies/createSensorUpdatePoliciesV2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = sensor_policy_payload(passed_keywords=kwargs) @@ -704,8 +852,18 @@ def update_policies_v2(self: object, body: dict = None, **kwargs) -> Union[Dict[ """Update Sensor Update Policies by specifying the ID of the policy and update details. Provides additional support for uninstall protection. - Keyword arguments: - body -- full body payload, not required if keywords are used. + + HTTP Method: PATCH + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html# + /sensor-update-policies/updateSensorUpdatePoliciesV2 + + Keyword arguments + ----------------- + body : dict + full body payload, not required if keywords are used. { "resources": [ { @@ -739,31 +897,37 @@ def update_policies_v2(self: object, body: dict = None, **kwargs) -> Union[Dict[ } ] } - build -- Build policy applies to . String. - description -- Sensor Update Policy description. String. - id -- Sensor Update Policy ID to update. String. - name -- Sensor Update Policy name. String. - scheduler -- Schedule settings. Dictionary. - settings -- Sensor Update policy specific settings. Dictionary. - OVERRIDES the value of the "build" keyword if provided. - { - "build": "string", - "uninstall_protection": "ENABLED" - } - show_early_adopter_builds -- Display early adopter builds. Boolean. - uninstall_protection -- Boolean indicating if uninstall protection should be enabled. - String. Allowed values: "ENABLED", "DISABLED" - variants -- Allowed variants list. List of dictionaries. + build : str + Build policy applies to. + description : str + Sensor Update Policy description. + id : str + Sensor Update Policy ID to update. + name : str + Sensor Update Policy name. + scheduler : dict + Schedule settings. + settings : dict + Sensor Update policy specific settings. Dictionary. + OVERRIDES the value of the "build" keyword if provided. + { + "build": "string", + "uninstall_protection": "ENABLED" + } + show_early_adopter_builds : bool + Display early adopter builds. + uninstall_protection : str + Boolean indicating if uninstall protection should be enabled. + String. Allowed values: "ENABLED", "DISABLED" + variants : list[dict] + Allowed variants. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: PATCH - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /sensor-update-policies/updateSensorUpdatePoliciesV2 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = sensor_policy_payload(passed_keywords=kwargs) @@ -783,25 +947,35 @@ def query_kernels(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve kernel compatibility info for Sensor Update Builds. - Keyword arguments: - distinct_field -- The field name to get distinct values for. If you do not - specify a value for this field it will default to `id`. - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /sensor-update-policies/querySensorUpdateKernelsDistinct + /sensor-update-policies/querySensorUpdateKernelsDistinct + + Keyword arguments + ----------------- + distinct_field : str + The field name to get distinct values for. If you do not + specify a value for this field it will default to `id`. + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -818,25 +992,36 @@ def query_policy_members(self: object, parameters: dict = None, **kwargs) -> Uni Returns a set of Agent IDs which match the filter criteria. - Keyword arguments: - id -- The ID of the Sensor Update Policy to search for members of - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /sensor-update-policies/querySensorUpdatePolicyMembers + /sensor-update-policies/querySensorUpdatePolicyMembers + + Keyword arguments + ----------------- + id : str + The ID of the Sensor Update Policy to search for members of + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -852,28 +1037,38 @@ def query_policies(self: object, parameters: dict = None, **kwargs) -> Union[Dic Returns a set of Sensor Update Policy IDs which match the filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - limit -- The maximum number of records to return in this response. [Integer, 1-5000] - Use with the offset parameter to manage pagination of results. - offset -- The offset to start retrieving records from. Integer. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax. - created_by modified_timestamp - created_timestamp name - enabled platform_name - modified_by precedence - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /sensor-update-policies/querySensorUpdatePolicies + /sensor-update-policies/querySensorUpdatePolicies + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + limit : int + The maximum number of records to return in this response. [Integer, 1-5000] + Use with the offset parameter to manage pagination of results. + offset : int + The offset to start retrieving records from. Integer. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax. + created_by modified_timestamp + created_timestamp name + enabled platform_name + modified_by precedence + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/sensor_usage.py b/src/falconpy/sensor_usage.py index cf02ecad0..ae4fca9b2 100644 --- a/src/falconpy/sensor_usage.py +++ b/src/falconpy/sensor_usage.py @@ -61,33 +61,40 @@ def get_weekly_usage(self: object, parameters: dict = None, **kwargs) -> Union[D Each data point represents the average of how many unique AIDs were seen per week for the previous 28 days. - Keyword arguments: - filter -- The FQL search filter. - Allowed fields: - event_date - A specified date that will be final date of the results returned. - Specified date cannot be after the default. - Format: '2024-06-11' - Default: the current date, minus 2 days, in UTC - period - An integer surrounded by single quotes representing the number of days to return. - Format: '30' - Default: '28' - Minimum: '1' - Maximum: '395' - selected_cids - A comma delimited list of CIDs to return data for. - Caller must be a parent CID or have special access enabled. - Format: 'cid_1,cid_2,cid_3' - Default: for parent CIDs the default is the parent and all children, - otherwise the current CID - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sensor-usage-api/GetSensorUsageWeekly + + Keyword arguments + ----------------- + filter : str + The FQL search filter. + Allowed fields: + event_date - A specified date that will be final date of the results returned. + Specified date cannot be after the default. + Format: '2024-06-11' + Default: the current date, minus 2 days, in UTC + period - An integer surrounded by single quotes representing the number of days to return. + Format: '30' + Default: '28' + Minimum: '1' + Maximum: '395' + selected_cids - A comma delimited list of CIDs to return data for. + Caller must be a parent CID or have special access enabled. + Format: 'cid_1,cid_2,cid_3' + Default: for parent CIDs the default is the parent and all children, + otherwise the current CID + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -103,34 +110,41 @@ def get_hourly_usage(self: object, parameters: dict = None, **kwargs) -> Union[D Each data point represents the average of how many unique AIDs were seen per week for the previous 28 days. - Keyword arguments: - filter -- The FQL search filter. - Allowed fields: - event_date - A specified date that will be final date of the results returned. - Specified date cannot be after the default. - Format: '2024-06-11' - Default: the current date, minus 2 days, in UTC - period - An integer surrounded by single quotes representing the number of days to return. - Format: '30' - Default: '28' - Minimum: '1' - Maximum: '395' - selected_cids - A comma delimited list of CIDs to return data for. - Caller must be a parent CID or have special access enabled. - Format: 'cid_1,cid_2,cid_3' - Default: for parent CIDs the default is the parent and all children, - otherwise the current CID - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/sensor-usage-api/GetSensorUsageWeekly Endpoint is not in Swagger file, but allows you to pull `hourly` usage which is used to determine cloud usage + + Keyword arguments + ----------------- + filter : str + The FQL search filter. + Allowed fields: + event_date - A specified date that will be final date of the results returned. + Specified date cannot be after the default. + Format: '2024-06-11' + Default: the current date, minus 2 days, in UTC + period - An integer surrounded by single quotes representing the number of days to return. + Format: '30' + Default: '28' + Minimum: '1' + Maximum: '395' + selected_cids - A comma delimited list of CIDs to return data for. + Caller must be a parent CID or have special access enabled. + Format: 'cid_1,cid_2,cid_3' + Default: for parent CIDs the default is the parent and all children, + otherwise the current CID + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/sensor_visibility_exclusions.py b/src/falconpy/sensor_visibility_exclusions.py index 91a098152..4514496ec 100644 --- a/src/falconpy/sensor_visibility_exclusions.py +++ b/src/falconpy/sensor_visibility_exclusions.py @@ -60,19 +60,28 @@ class SensorVisibilityExclusions(ServiceClass): def get_exclusions(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get a set of Sensor Visibility Exclusions by specifying their IDs. - Keyword arguments: - ids -- List of exclusion IDs to retrieve. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- /sensor-visibility-exclusions/getSensorVisibilityExclusionsV1 + + Keyword arguments + ----------------- + ids : str or list[str] + List of exclusion IDs to retrieve. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -86,8 +95,16 @@ def get_exclusions(self: object, *args, parameters: dict = None, **kwargs) -> Un def create_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Create the Sensor Visibility exclusions. - Keyword arguments: - body -- full body payload, not required when ids keyword is provided. + HTTP Method: POST + + Swagger URL + ----------- + /sensor-visibility-exclusions/createSVExclusionsV1 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when ids keyword is provided. { "comment": "string", "groups": [ @@ -95,18 +112,19 @@ def create_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[s ], "value": "string" } - comment -- String comment describing why the exclusion is entered. - groups -- Group IDs to exclude. List of strings. - value -- Value to exclude. String + comment : str + String comment describing why the exclusion is entered. + groups : str or list[str] + Group IDs to exclude. + value : str + Value to exclude. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - /sensor-visibility-exclusions/createSVExclusionsV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = exclusion_payload(passed_keywords=kwargs) @@ -126,20 +144,30 @@ def delete_exclusions(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Delete the Sensor Visibility exclusions by ID. - Keyword arguments: - comment -- Explains why this exclusions was deleted. String. - ids -- List of exclusion IDs to delete. String or list of strings. - parameters -- full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- /sensor-visibility-exclusions/deleteSensorVisibilityExclusionsV1 + + Keyword arguments + ----------------- + comment : str + Explains why this exclusions was deleted. + ids : str or list[str] + List of exclusion IDs to delete. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -153,8 +181,16 @@ def delete_exclusions(self: object, def update_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Update the Sensor Visibility Exclusions. - Keyword arguments: - body -- full body payload, not required when ids keyword is provided. + HTTP Method: POST + + Swagger URL + ----------- + /sensor-visibility-exclusions/updateSensorVisibilityExclusionsV1 + + Keyword arguments + ----------------- + body : dict + full body payload, not required when ids keyword is provided. { "comment": "string", "groups": [ @@ -164,21 +200,24 @@ def update_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[s "is_descendant_process": boolean, "value": "string" } - comment -- String comment describing why the exclusion is entered. - groups -- Group IDs to exclude. List of strings. - id -- Exclusion ID to update. String. - is_descendant_process -- Flag to determine if an exclusion should - apply to all descendant processes. Boolean. - value -- Value to exclude. String + comment : str + String comment describing why the exclusion is entered. + groups : str or list[str] + Group IDs to exclude. + id : str + Exclusion ID to update. + is_descendant_process : bool + Flag to determine if an exclusion should + apply to all descendant processes. + value : str + Value to exclude. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - /sensor-visibility-exclusions/updateSensorVisibilityExclusionsV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = exclusion_payload(passed_keywords=kwargs) @@ -194,33 +233,43 @@ def update_exclusions(self: object, body: dict = None, **kwargs) -> Union[Dict[s def query_exclusions(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search for Sensor Visibility Exclusions. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - An asterisk wildcard '*' includes all results. - AVAILABLE FILTERS - applied_globally last_modified - created_by modified_by - created_on value - limit -- The maximum number of detections to return in this response. - [Integer, default: 100; max: 500] - Use with the offset parameter to manage pagination of results. - offset -- The first detection to return, where 0 is the latest detection. - Use with the limit parameter to manage pagination of results. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. FQL syntax (e.g. last_behavior|asc). - Available sort fields: - applied_globally last_modified - created_by modified_by - created_on value - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- /sensor-visibility-exclusions/querySensorVisibilityExclusionsV1 + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + An asterisk wildcard '*' includes all results. + AVAILABLE FILTERS + applied_globally last_modified + created_by modified_by + created_on value + limit : int + The maximum number of detections to return in this response. + [Integer, default: 100; max: 500] + Use with the offset parameter to manage pagination of results. + offset : int + The first detection to return, where 0 is the latest detection. + Use with the limit parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. FQL syntax (e.g. last_behavior|asc). + Available sort fields: + applied_globally last_modified + created_by modified_by + created_on value + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/serverless_exports.py b/src/falconpy/serverless_exports.py index 7d4263574..5fb0f5d20 100644 --- a/src/falconpy/serverless_exports.py +++ b/src/falconpy/serverless_exports.py @@ -64,19 +64,28 @@ def download_export_file(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Download an export file. - Keyword arguments: - id -- Export job ID. String. Required. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/serverless-exports/DownloadExportFileMixin0 + + Keyword arguments + ----------------- + id : str (required) + Export job ID. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -93,19 +102,25 @@ def read_export_jobs(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Read export jobs entities. - Keyword arguments: - ids -- Export Job IDs to read. Allowed up to 100 IDs per request. - String or list of strings. Required. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/serverless-exports/ReadExportJobsMixin0 + + Keyword arguments + ----------------- + ids : str or list[str] (required) + Export Job IDs to read. Allowed up to 100 IDs per request. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -125,9 +140,17 @@ def launch_export_job(self: object, Maximum of 1 job in progress per resource. Use expand_vulnerabilities=true to get detailed vulnerability information. - Keyword arguments: - body -- Full body payload as a JSON formatted dictionary. Not required if using - other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/serverless-exports/LaunchExportJobMixin0 + + Keyword arguments + ----------------- + body : dict + Full body payload as a JSON formatted dictionary. Not required if using + other keywords. { "expand_vulnerabilities": boolean, "format": "string", @@ -135,22 +158,25 @@ def launch_export_job(self: object, "resource": "string", "sort": "string" } - expand_vulnerabilities -- Flag to include detailed vulnerability information. Boolean. - format -- The export file format. String. - fql -- Filter the export using Falcon Query Language (FQL). String. - resource -- The resource to export. Supported resources: - function.detections, function.vulnerabilities-expanded, - function.vulnerabilities. String. - sort -- The fields to sort the records on. String. + expand_vulnerabilities : bool + Flag to include detailed vulnerability information. + format : str + The export file format. + fql : str + Filter the export using Falcon Query Language (FQL) + resource : str + The resource to export. Supported resources: + function.detections, function.vulnerabilities-expanded, + function.vulnerabilities. + sort : str + The fields to sort the records on. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/serverless-exports/LaunchExportJobMixin0 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = serverless_exports_launch_payload(passed_keywords=kwargs) @@ -170,21 +196,30 @@ def query_export_jobs(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Query export jobs entities. - Keyword arguments: - filter -- Filter exports using a query in Falcon Query Language (FQL). - Only the last 100 jobs are returned. - Supported filter fields: resource, status. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be - 'filter'. All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/serverless-exports/QueryExportJobsMixin0 + + Keyword arguments + ----------------- + filter : str + Filter exports using a query in Falcon Query Language (FQL). + Only the last 100 jobs are returned. + Supported filter fields: resource, status. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be + 'filter'. All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/serverless_vulnerabilities.py b/src/falconpy/serverless_vulnerabilities.py index 4969e8760..7e0d0db5d 100644 --- a/src/falconpy/serverless_vulnerabilities.py +++ b/src/falconpy/serverless_vulnerabilities.py @@ -59,44 +59,54 @@ class ServerlessVulnerabilities(ServiceClass): def get_vulnerabilities(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve all lambda vulnerabilities that match the given query and return in the SARIF format. - Keyword arguments: - filter -- Filter lambda vulnerabilities using a query in Falcon Query Language (FQL). String. - Supported filters: - application_name function_name - application_name_version function_resource_id - cid is_supported - cloud_account_id is_valid_asset_id - cloud_account_name layer - cloud_provider region - cve_id runtime - cve_reachable severity - cvss_base_score timestamp - exprt_rating type - first_seen_timestamp - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - sort -- The fields to sort the records on. - Supported columns: - application_name first_seen_timestamp - application_name_version function_resource_id - cid is_supported - cloud_account_id layer - cloud_account_name region - cloud_provider runtime - cve_id severity - cvss_base_score timestamp - exprt_rating type - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /serverless-vulnerabilities/GetCombinedVulnerabilitiesSARIF + /serverless-vulnerabilities/GetCombinedVulnerabilitiesSARIF + + Keyword arguments + ----------------- + filter : str + Filter lambda vulnerabilities using a query in Falcon Query Language (FQL). String. + Supported filters: + application_name function_name + application_name_version function_resource_id + cid is_supported + cloud_account_id is_valid_asset_id + cloud_account_name layer + cloud_provider region + cve_id runtime + cve_reachable severity + cvss_base_score timestamp + exprt_rating type + first_seen_timestamp + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + sort : str + The fields to sort the records on. + Supported columns: + application_name first_seen_timestamp + application_name_version function_resource_id + cid is_supported + cloud_account_id layer + cloud_account_name region + cloud_provider runtime + cve_id severity + cvss_base_score timestamp + exprt_rating type + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/spans.py b/src/falconpy/spans.py new file mode 100644 index 000000000..e2b1b3ac1 --- /dev/null +++ b/src/falconpy/spans.py @@ -0,0 +1,138 @@ +"""CrowdStrike Falcon Spans API interface class. + + _______ __ _______ __ __ __ +| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----. +|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__| +|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____| +|: 1 | |: 1 | +|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy +`-------' `-------' + +OAuth2 API - Customer SDK + +This is free and unencumbered software released into the public domain. + +Anyone is free to copy, modify, publish, use, compile, sell, or +distribute this software, either in source code form or as a compiled +binary, for any purpose, commercial or non-commercial, and by any +means. + +In jurisdictions that recognize copyright laws, the author or authors +of this software dedicate any and all copyright interest in the +software to the public domain. We make this dedication for the benefit +of the public at large and to the detriment of our heirs and +successors. We intend this dedication to be an overt act of +relinquishment in perpetuity of all present and future rights to this +software under copyright law. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR +OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, +ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR +OTHER DEALINGS IN THE SOFTWARE. + +For more information, please refer to +""" +from typing import Dict, Union +from ._util import force_default, process_service_request, handle_single_argument +from ._result import Result +from ._service_class import ServiceClass +from ._endpoint._spans import _spans_endpoints as Endpoints + + +class Spans(ServiceClass): + """The only requirement to instantiate an instance of this class is one of the following. + + - a valid client_id and client_secret provided as keywords. + - a credential dictionary with client_id and client_secret containing valid API credentials + { + "client_id": "CLIENT_ID_HERE", + "client_secret": "CLIENT_SECRET_HERE" + } + - a previously-authenticated instance of the authentication service class (oauth2.py) + - a valid token provided by the authentication service class (oauth2.py) + """ + + @force_default(defaults=["parameters"], default_types=["dict"]) + def entities_spans_v1(self: object, + *args, + parameters: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Retrieve spans for the provided ids. + + HTTP Method: GET + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/spans/EntitiesSpansV1 + + Keyword arguments + ----------------- + ids : str or list[str] + IDs of entities to retrieve. Maximum of 1000 ids per request. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. + """ + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="EntitiesSpansV1", + keywords=kwargs, + params=handle_single_argument(args, parameters, "ids") + ) + + @force_default(defaults=["parameters"], default_types=["dict"]) + def queries_spans_v1(self: object, + parameters: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Query spans based on the provided filters. + + HTTP Method: GET + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/spans/QueriesSpansV1 + + Keyword arguments + ----------------- + offset : int + Starting index of overall result set from which to return ids. + limit : int + Number of IDs to return. + sort : str + Possible order by fields. E.g.: 'start_time|desc' + filter : str + FQL query specifying the filter parameters. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="QueriesSpansV1", + keywords=kwargs, + params=parameters + ) + EntitiesSpansV1 = entities_spans_v1 + QueriesSpansV1 = queries_spans_v1 diff --git a/src/falconpy/spans.pyi b/src/falconpy/spans.pyi new file mode 100644 index 000000000..908a171c0 --- /dev/null +++ b/src/falconpy/spans.pyi @@ -0,0 +1,27 @@ +"""Type stubs for spans.""" +from typing import Dict, List, Optional, Union +from ._service_class import ServiceClass +from ._result import Result + + +class Spans(ServiceClass): + + def entities_spans_v1( + self, + *args: Union[str, List[str]], + ids: Optional[Union[str, List[str]]] = None, + parameters: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def queries_spans_v1( + self, + *, + offset: Optional[int] = None, + limit: Optional[int] = None, + sort: Optional[str] = None, + filter: Optional[str] = None, + parameters: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + EntitiesSpansV1 = entities_spans_v1 + QueriesSpansV1 = queries_spans_v1 diff --git a/src/falconpy/spotlight_evaluation_logic.py b/src/falconpy/spotlight_evaluation_logic.py index b71ebd76a..3e5f13c4b 100644 --- a/src/falconpy/spotlight_evaluation_logic.py +++ b/src/falconpy/spotlight_evaluation_logic.py @@ -65,28 +65,38 @@ def query_evaluation_logic_combined(self: object, Returns a set of evaluation logic entities which match the filter criteria. - Keyword arguments: - after -- A pagination token used with the limit parameter to manage pagination of results. - On your first request, don't provide an after token. On subsequent requests, - provide the after token from the previous response to continue from that place in - the results. - filter -- Filter items using a query in Falcon Query Language (FQL). - Wildcards '*' are unsupported. - limit -- The number of items to return in this response (default: 100, max: 400). - Use with the after parameter to manage pagination of results. Integer. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. - FQL syntax (e.g. created_timestamp|desc, closed_timestamp|asc). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /spotlight-evaluation-logic/combinedQueryEvaluationLogic + /spotlight-evaluation-logic/combinedQueryEvaluationLogic + + Keyword arguments + ----------------- + after : str + A pagination token used with the limit parameter to manage pagination of results. + On your first request, don't provide an after token. On subsequent requests, + provide the after token from the previous response to continue from that place in + the results. + filter : str + Filter items using a query in Falcon Query Language (FQL). + Wildcards '*' are unsupported. + limit : int + The number of items to return in this response (default: 100, max: 400). + Use with the after parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. + FQL syntax (e.g. created_timestamp|desc, closed_timestamp|asc). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not kwargs.get("filter", None) and not parameters.get("filter", None): fail_msg = [ @@ -116,19 +126,28 @@ def get_evaluation_logic(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get details on evaluation logic items by providing one or more IDs. - Keyword arguments: - ids -- One or more evaluation logic IDs (max: 400). String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/spotlight-evaluation-logic/getEvaluationLogic + + Keyword arguments + ----------------- + ids : str or list[str] + One or more evaluation logic IDs (max: 400) + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -147,27 +166,37 @@ def query_evaluation_logic(self: object, Returns a set of evaluation logic IDs which match the filter criteria. - Keyword arguments: - after -- A pagination token used with the limit parameter to manage pagination of results. - On your first request, don't provide an after token. On subsequent requests, - provide the after token from the previous response to continue from that place in - the results. - filter -- Filter items using a query in Falcon Query Language (FQL). - Wildcards '*' are unsupported. - limit -- The number of items to return in this response (default: 100, max: 400). - Use with the after parameter to manage pagination of results. Integer. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. - FQL syntax (e.g. created_timestamp|desc, closed_timestamp|asc). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/spotlight-evaluation-logic/queryEvaluationLogic + + Keyword arguments + ----------------- + after : str + A pagination token used with the limit parameter to manage pagination of results. + On your first request, don't provide an after token. On subsequent requests, + provide the after token from the previous response to continue from that place in + the results. + filter : str + Filter items using a query in Falcon Query Language (FQL). + Wildcards '*' are unsupported. + limit : int + The number of items to return in this response (default: 100, max: 400). + Use with the after parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. + FQL syntax (e.g. created_timestamp|desc, closed_timestamp|asc). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -184,36 +213,48 @@ def get_supported_evaluations(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Perform a combined query and get for RiskSupportedEvaluation entities. - Keyword arguments: - after -- A pagination token used with the limit parameter to manage pagination - of results. On your first request, don't provide an after token. On - subsequent requests, provide the after token from the previous response - to continue from that place in the results. String. - filter -- Filter items using a query in Falcon Query Language (FQL). String. - Wildcards * and empty filter values are unsupported. - Available filter fields that support exact match: - id risk_id - risk_provider finding_provider - platform - Available filter fields that support range comparisons (>, <, >=, <=): - created_timestamp updated_timestamp - limit -- The number of items to return in this response (default: 100, max: 400). - Use with the after parameter to manage pagination of results. Integer. - offset -- Starting index of overall result set from which to return ids. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - risk_provider -- Zero or more risk providers. Zero means all. String or list of strings. - Supported values: S (for Falcon sensor). - sort -- Sort vulnerabilities by their properties. String. - Available sort options: created_timestamp|asc/desc, updated_timestamp|asc/desc. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/spotlight-supported-evaluation/combinedSupportedEvaluationExt + + Keyword arguments + ----------------- + after : str + A pagination token used with the limit parameter to manage pagination + of results. On your first request, don't provide an after token. On + subsequent requests, provide the after token from the previous response + to continue from that place in the results. + filter : str + Filter items using a query in Falcon Query Language (FQL). String. + Wildcards * and empty filter values are unsupported. + Available filter fields that support exact match: + id risk_id + risk_provider finding_provider + platform + Available filter fields that support range comparisons (>, <, >=, <=): + created_timestamp updated_timestamp + limit : int + The number of items to return in this response (default: 100, max: 400). + Use with the after parameter to manage pagination of results. + offset : str + Starting index of overall result set from which to return ids. + parameters : dict + Full parameters payload. Not required if using other keywords. + risk_provider : str or list[str] + Zero or more risk providers. Zero means all. String or list of strings. + Supported values: S (for Falcon sensor). + sort : str + Sort vulnerabilities by their properties. String. + Available sort options: created_timestamp|asc/desc, updated_timestamp|asc/desc. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/spotlight_vulnerabilities.py b/src/falconpy/spotlight_vulnerabilities.py index e8ee22d05..c8840a2d0 100644 --- a/src/falconpy/spotlight_vulnerabilities.py +++ b/src/falconpy/spotlight_vulnerabilities.py @@ -65,32 +65,43 @@ def query_vulnerabilities_combined(self: object, Returns a set of Vulnerability IDs which match the filter criteria. - Keyword arguments: - after -- A pagination token used with the limit parameter to manage pagination of results. - On your first request, don't provide an after token. On subsequent requests, - provide the after token from the previous response to continue from that place in - the results. - facet -- Select various details blocks to be returned for each vulnerability entry. - Supported values: - cve_details host_info - remediation_details evaluation_logic - filter -- Filter items using a query in Falcon Query Language (FQL). - Wildcards '*' are unsupported. - limit -- The number of items to return in this response (default: 100, max: 5000). - Use with the after parameter to manage pagination of results. Integer. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. - FQL syntax (e.g. created_timestamp|desc, closed_timestamp|asc). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /spotlight-vulnerabilities/combinedQueryVulnerabilities + /spotlight-vulnerabilities/combinedQueryVulnerabilities + + Keyword arguments + ----------------- + after : str + A pagination token used with the limit parameter to manage pagination of results. + On your first request, don't provide an after token. On subsequent requests, + provide the after token from the previous response to continue from that place in + the results. + facet : str or list[str] + Select various details blocks to be returned for each vulnerability entry. + Supported values: + cve_details host_info + remediation_details evaluation_logic + filter : str + Filter items using a query in Falcon Query Language (FQL). + Wildcards '*' are unsupported. + limit : int + The number of items to return in this response (default: 100, max: 5000). + Use with the after parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. + FQL syntax (e.g. created_timestamp|desc, closed_timestamp|asc). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not kwargs.get("filter", None) and not parameters.get("filter", None): fail_msg = [ @@ -125,28 +136,38 @@ def query_installed_patches_combined(self: object, Returns a set of host entities containing installed patch details. - Keyword arguments: - after -- A pagination token used with the limit parameter to manage pagination of results. - On your first request, don't provide an after token. On subsequent requests, - provide the after token from the previous response to continue from that place in - the results. - filter -- Filter items using a query in Falcon Query Language (FQL). - Wildcards '*' are unsupported. - limit -- The number of items to return in this response. - Use with the after parameter to manage pagination of results. Integer. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. - FQL syntax (e.g. published_date|desc, hostname|asc). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /spotlight-vulnerabilities/combinedQueryInstalledPatches + /spotlight-vulnerabilities/combinedQueryInstalledPatches + + Keyword arguments + ----------------- + after : str + A pagination token used with the limit parameter to manage pagination of results. + On your first request, don't provide an after token. On subsequent requests, + provide the after token from the previous response to continue from that place in + the results. + filter : str + Filter items using a query in Falcon Query Language (FQL). + Wildcards '*' are unsupported. + limit : int + The number of items to return in this response. + Use with the after parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. + FQL syntax (e.g. published_date|desc, hostname|asc). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not kwargs.get("filter", None) and not parameters.get("filter", None): fail_msg = [ @@ -176,19 +197,28 @@ def get_vulnerabilities(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get details on vulnerabilities by providing one or more IDs. - Keyword arguments: - ids -- One or more vulnerability IDs (max: 400). String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/spotlight-vulnerabilities/getVulnerabilities + + Keyword arguments + ----------------- + ids : str or list[str] + One or more vulnerability IDs (max: 400) + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -204,38 +234,48 @@ def query_vulnerabilities(self: object, parameters: dict = None, **kwargs) -> U Returns a set of Vulnerability IDs which match the filter criteria. - Keyword arguments: - after -- A pagination token used with the limit parameter to manage pagination of results. - On your first request, don't provide an after token. On subsequent requests, - provide the after token from the previous response to continue from that place in - the results. - filter -- Filter items using a query in Falcon Query Language (FQL). Wildcards * and empty filter values are - unsupported. - Available filter fields that supports match (~): N/A - Available filter fields that supports exact match: aid, cid, last_seen_within, status, cve.id, - cve.is_cisa_kev, cve.remediation_level, - cve.cps_rating, cve.exprt_rating, cve.exploit_status_to_include, cve.severity, cve.base_score, cve.types, - host_info.asset_criticality, - host_info.asset_roles, host_info.internet_exposure, host_info.tags, host_info.groups, - host_info.product_type_desc, host_info.platform_name, - suppression_info.is_suppressed, suppression_info.reason, host_info.instance_state - Available filter fields that supports wildcard (*): N/A - Available filter fields that supports range comparisons (>, <, >=, <=): created_timestamp, closed_timestamp, - updated_timestamp, cve.base_score - limit -- The number of items to return in this response (default: 100, max: 400). - Use with the after parameter to manage pagination of results. Integer. - parameters - full parameters payload, not required if using other keywords. - sort -- The property to sort by. - FQL syntax (e.g. created_timestamp|desc, closed_timestamp|asc). - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/spotlight-vulnerabilities/queryVulnerabilities + + Keyword arguments + ----------------- + after : str + A pagination token used with the limit parameter to manage pagination of results. + On your first request, don't provide an after token. On subsequent requests, + provide the after token from the previous response to continue from that place in + the results. + filter : str + Filter items using a query in Falcon Query Language (FQL). Wildcards * and empty filter values are + unsupported. + Available filter fields that supports match (~): N/A + Available filter fields that supports exact match: aid, cid, last_seen_within, status, cve.id, + cve.is_cisa_kev, cve.remediation_level, + cve.cps_rating, cve.exprt_rating, cve.exploit_status_to_include, cve.severity, cve.base_score, cve.types, + host_info.asset_criticality, + host_info.asset_roles, host_info.internet_exposure, host_info.tags, host_info.groups, + host_info.product_type_desc, host_info.platform_name, + suppression_info.is_suppressed, suppression_info.reason, host_info.instance_state + Available filter fields that supports wildcard (*): N/A + Available filter fields that supports range comparisons (>, <, >=, <=): created_timestamp, closed_timestamp, + updated_timestamp, cve.base_score + limit : int + The number of items to return in this response (default: 100, max: 400). + Use with the after parameter to manage pagination of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + sort : str + The property to sort by. + FQL syntax (e.g. created_timestamp|desc, closed_timestamp|asc). + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -253,19 +293,28 @@ def get_remediations(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get details on remediations by providing one or more IDs. - Keyword arguments: - ids -- One or more remediation IDs. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- This endpoint is not published in swagger. + + Keyword arguments + ----------------- + ids : str or list[str] + One or more remediation IDs. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -283,19 +332,28 @@ def get_remediations_v2(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get details on remediations by providing one or more IDs. - Keyword arguments: - ids -- One or more remediation IDs. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/spotlight-vulnerabilities/getRemediationsV2 + + Keyword arguments + ----------------- + ids : str or list[str] + One or more remediation IDs. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/spotlight_vulnerability_metadata.py b/src/falconpy/spotlight_vulnerability_metadata.py index 8339709a2..e8274f65e 100644 --- a/src/falconpy/spotlight_vulnerability_metadata.py +++ b/src/falconpy/spotlight_vulnerability_metadata.py @@ -59,45 +59,57 @@ class SpotlightVulnerabilityMetadata(ServiceClass): def get_cve_metadata(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Perform a combined query and get operation for retrieving Risk (vulnerability metadata) entities. - Keyword arguments: - after -- A pagination token used with the `limit` parameter to manage pagination of results. String. - On your first request, don't provide an `after` token. On subsequent requests, provide - the `after` token from the previous response to continue from that place in the results. - offset -- Starting index of overall result set from which to return IDs. String. - limit -- The number of items to return in this response (default: 100, max: 400). Integer. - Use with the after parameter to manage pagination of results. - sort -- Sort vulnerabilities by their properties. String. - Can be used in a format |asc for ascending order or |desc for descending order. - Available sort options: - created_timestamp|asc/desc - updated_timestamp|asc/desc - filter -- Filter items using a query in Falcon Query Language (FQL). String. Required. - Wildcards * and empty filter values are unsupported. - Available filter fields that supports exact match: - id provider - cve_ids cwe_ids - impact.cvss_v2.base_metrics.vector impact.cvss_v2.temporal_metrics.vector - impact.cvss_v3.base_metrics.integrity_impact impact.cvss_v3.base_metrics.vector - impact.cvss_v3.temporal_metrics.vector - Available filter fields that supports range comparisons (>, <, >=, <=): - created_timestamp impact.cvss_v2.base_metrics.base_score - impact.cvss_v3.base_metrics.base_score impact.cvss_v2.temporal_metrics.temporal_score - impact.cvss_v3.temporal_metrics.temporal_score source_created_timestamp - source_updated_timestamp updated_timestamp - risk_provider -- Zero or more risk providers. Zero means all. String or list of strings. - Supported values: - S - Falcon sensor - See RiskProvider for all values. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/spotlight-vulnerability-metadata/combineVulnMetadataExt + + Keyword arguments + ----------------- + after : str + A pagination token used with the `limit` parameter to manage pagination of results. String. + On your first request, don't provide an `after` token. On subsequent requests, provide + the `after` token from the previous response to continue from that place in the results. + offset : str + Starting index of overall result set from which to return IDs. + limit : int + The number of items to return in this response (default: 100, max: 400). Integer. + Use with the after parameter to manage pagination of results. + sort : str + Sort vulnerabilities by their properties. String. + Can be used in a format |asc for ascending order or |desc for descending order. + Available sort options: + created_timestamp|asc/desc + updated_timestamp|asc/desc + filter : str + Filter items using a query in Falcon Query Language (FQL). String. Required. + Wildcards * and empty filter values are unsupported. + Available filter fields that supports exact match: + id provider + cve_ids cwe_ids + impact.cvss_v2.base_metrics.vector impact.cvss_v2.temporal_metrics.vector + impact.cvss_v3.base_metrics.integrity_impact impact.cvss_v3.base_metrics.vector + impact.cvss_v3.temporal_metrics.vector + Available filter fields that supports range comparisons (>, <, >=, <=): + created_timestamp impact.cvss_v2.base_metrics.base_score + impact.cvss_v3.base_metrics.base_score impact.cvss_v2.temporal_metrics.temporal_score + impact.cvss_v3.temporal_metrics.temporal_score source_created_timestamp + source_updated_timestamp updated_timestamp + risk_provider : str or list[str] + Zero or more risk providers. Zero means all. String or list of strings. + Supported values: + S - Falcon sensor + See RiskProvider for all values. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/stream.py b/src/falconpy/stream.py new file mode 100644 index 000000000..df0d20dd5 --- /dev/null +++ b/src/falconpy/stream.py @@ -0,0 +1,96 @@ +"""CrowdStrike Falcon Stream API interface class. + + _______ __ _______ __ __ __ +| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----. +|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__| +|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____| +|: 1 | |: 1 | +|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy +`-------' `-------' + +OAuth2 API - Customer SDK + +This is free and unencumbered software released into the public domain. + +Anyone is free to copy, modify, publish, use, compile, sell, or +distribute this software, either in source code form or as a compiled +binary, for any purpose, commercial or non-commercial, and by any +means. + +In jurisdictions that recognize copyright laws, the author or authors +of this software dedicate any and all copyright interest in the +software to the public domain. We make this dedication for the benefit +of the public at large and to the detriment of our heirs and +successors. We intend this dedication to be an overt act of +relinquishment in perpetuity of all present and future rights to this +software under copyright law. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR +OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, +ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR +OTHER DEALINGS IN THE SOFTWARE. + +For more information, please refer to +""" +from typing import Dict, Union +from ._util import force_default, process_service_request, handle_single_argument +from ._result import Result +from ._service_class import ServiceClass +from ._endpoint._stream import _stream_endpoints as Endpoints + + +class Stream(ServiceClass): + """The only requirement to instantiate an instance of this class is one of the following. + + - a valid client_id and client_secret provided as keywords. + - a credential dictionary with client_id and client_secret containing valid API credentials + { + "client_id": "CLIENT_ID_HERE", + "client_secret": "CLIENT_SECRET_HERE" + } + - a previously-authenticated instance of the authentication service class (oauth2.py) + - a valid token provided by the authentication service class (oauth2.py) + """ + + @force_default(defaults=["parameters"], default_types=["dict"]) + def stream_invocation_response_v1(self: object, + *args, + parameters: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Retrieve the stream of results for an invocation. + + HTTP Method: GET + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/stream/StreamInvocationResponseV1 + + Keyword arguments + ----------------- + id : str or list[str] + Invocation ID. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. + """ + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="StreamInvocationResponseV1", + keywords=kwargs, + params=handle_single_argument(args, parameters, "id") + ) + StreamInvocationResponseV1 = stream_invocation_response_v1 diff --git a/src/falconpy/stream.pyi b/src/falconpy/stream.pyi new file mode 100644 index 000000000..f16e5ca00 --- /dev/null +++ b/src/falconpy/stream.pyi @@ -0,0 +1,16 @@ +"""Type stubs for stream.""" +from typing import Dict, List, Optional, Union +from ._service_class import ServiceClass +from ._result import Result + + +class Stream(ServiceClass): + + def stream_invocation_response_v1( + self, + *args: Union[str, List[str]], + id: Optional[str] = None, + parameters: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + StreamInvocationResponseV1 = stream_invocation_response_v1 diff --git a/src/falconpy/tailored_intelligence.py b/src/falconpy/tailored_intelligence.py index 763e7f757..0380e70a7 100644 --- a/src/falconpy/tailored_intelligence.py +++ b/src/falconpy/tailored_intelligence.py @@ -60,19 +60,29 @@ class TailoredIntelligence(ServiceClass): def get_event_body(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get the event body for the provided event ID. - Keyword arguments: - id -- Event ID to retrieve the body for. String. Required. - parameters - full parameters payload, not required if 'id' keyword is provided. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: binary object containing the body content. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/tailored-intelligence/GetEventsBody + + Keyword arguments + ----------------- + id : str (required) + Event ID to retrieve the body for. + Authorization : str + Bearer Token. + parameters : dict + full parameters payload, not required if 'id' keyword is provided. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + binary object containing the body content. """ return process_service_request( calling_object=self, @@ -86,19 +96,30 @@ def get_event_body(self: object, *args, parameters: dict = None, **kwargs) -> Un def get_event_entities(self: object, *args, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get events entities for specified IDs. - Keyword arguments: - ids -- Event ID to retrieve. String or list of strings. - parameters - full parameters payload, not required if 'id' keyword is provided. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/tailored-intelligence/GetEventsEntities + + Keyword arguments + ----------------- + ids : str or list[str] + Event ID to retrieve. + Authorization : str + Bearer Token. + parameters : dict + full parameters payload, not required if 'id' keyword is provided. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ body = handle_single_argument(args, body, "ids") @@ -122,24 +143,37 @@ def get_event_entities(self: object, *args, body: dict = None, **kwargs) -> Unio def query_events(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query for event IDs that match the provided filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - Providing just a wildcard will return all results. - limit -- The maximum number of records to return. [integer] - offset -- Starting index of overall result set from which to return IDs. String. - parameters - full parameters payload, not required if using other keywords. - q -- Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed) - sort -- The property to sort by. FQL syntax (e.g. updated_date|desc). - Available fields: created_date, source_type, updated_date - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/tailored-intelligence/QueryEvents + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Providing just a wildcard will return all results. + limit : int + The maximum number of records to return. + offset : str + Starting index of overall result set from which to return IDs. + Authorization : str + Bearer Token. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed) + sort : str + The property to sort by. FQL syntax (e.g. updated_date|desc). + Available fields: created_date, source_type, updated_date + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -153,19 +187,30 @@ def query_events(self: object, parameters: dict = None, **kwargs) -> Union[Dict[ def get_rule_entities(self: object, *args, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get rule entities for specified IDs. - Keyword arguments: - ids -- Rule ID to retrieve. String or list of strings. - parameters - full parameters payload, not required if 'id' keyword is provided. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/tailored-intelligence/GetRulesEntities + + Keyword arguments + ----------------- + ids : str or list[str] + Rule ID to retrieve. + Authorization : str + Bearer Token. + parameters : dict + full parameters payload, not required if 'id' keyword is provided. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ body = handle_single_argument(args, body, "ids") @@ -189,28 +234,41 @@ def get_rule_entities(self: object, *args, body: dict = None, **kwargs) -> Union def query_rules(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Query for rule IDs that match the provided filter criteria. - Keyword arguments: - filter -- The filter expression that should be used to limit the results. FQL syntax. - Providing just a wildcard will return all results. - limit -- The maximum number of records to return. [integer] - offset -- Starting index of overall result set from which to return IDs. String. - parameters - full parameters payload, not required if using other keywords. - q -- Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed) - sort -- The property to sort by. FQL syntax (e.g. updated_date|desc). - Available fields - created_date source_type - customer_id updated_date - name value - rule_type - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/tailored-intelligence/QueryRules + + Keyword arguments + ----------------- + filter : str + The filter expression that should be used to limit the results. FQL syntax. + Providing just a wildcard will return all results. + limit : int + The maximum number of records to return. + offset : str + Starting index of overall result set from which to return IDs. + Authorization : str + Bearer Token. + parameters : dict + Full parameters payload. Not required if using other keywords. + q : str + Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed) + sort : str + The property to sort by. FQL syntax (e.g. updated_date|desc). + Available fields + created_date source_type + customer_id updated_date + name value + rule_type + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/threatgraph.py b/src/falconpy/threatgraph.py index 50ff526e2..48c0745e4 100644 --- a/src/falconpy/threatgraph.py +++ b/src/falconpy/threatgraph.py @@ -59,168 +59,181 @@ class ThreatGraph(ServiceClass): def get_edges(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve edges for a given vertex id. One edge type must be specified. - Keyword arguments: - direction -- The direction of edges that you would like to retrieve. - edge_type -- The type of edges that you would like to retrieve. String. - Available values: - accessed_ad_computer accessed_adfs_application - accessed_azure_application accessed_by_kerberos_ticket - accessed_by_process accessed_by_session - accessed_classified_file accessed_okta_application - accessed_ping_fed_application accessed_service_account - accessed_web agent_process - agent_to_self_diagnostic ai_agent_used_by - ai_runs_on allowed_by_process - allowed_firewall_rule app_uninstalled_from_host - assigned_ipv4_address assigned_ipv6_address - assigned_to_sensor associated_by_ad_computer - associated_by_ad_group associated_by_ad_user - associated_by_aggregate_indicator associated_by_app - associated_by_azure_ad_user associated_by_azure_app - associated_by_certificate associated_by_control_graph - associated_by_domain associated_by_host - associated_by_host_name associated_by_idp_session - associated_by_incident associated_by_indicator - associated_by_ip associated_by_ip4 - associated_by_ip6 associated_by_okta_user - associated_by_service_ticket associated_control_graph - associated_firewall_rule associated_idp_indicator - associated_incident associated_indicator - associated_k8s_cluster associated_k8s_sensor - associated_mobile_forensics_report associated_mobile_indicator - associated_module associated_primary_module - associated_quarantined_file associated_quarantined_module - associated_root_process associated_to_ad_computer - associated_to_sensor associated_user_session - associated_vmware_cluster associated_vmware_sensor - associated_with_process associated_with_sensor - attributed_by_process attributed_from_domain - attributed_from_module attributed_on - attributed_on_domain attributed_on_module - attributed_to attributed_to_actor - authenticated_from_incident authenticated_host - blocked_by_app blocked_by_process - blocked_by_sensor blocked_dns - blocked_ip4 blocked_ip6 - blocked_module bundled_in_app - bundles_module cert_is_presented_by - cert_presented child_process - child_session classified_file_accessed_by - closed_ip4_socket closed_ip6_socket - command_line_parent_process connected_from_app - connected_from_host connected_from_process - connected_ip4 connected_ip6 - connected_mcp connected_on_customer - connected_on_sensor connected_to_accessory - connected_to_wifi_ap connection_killed_by_app - connection_killed_by_process containerized_app - containerized_by_sensor control_graph - created_by_incident created_by_process - created_by_user created_quarantined_file - created_service customer_agent_has_user - customer_has_sensor customer_ioc - customer_sensor_to_sensor customer_user_to_sensor_user - deleted_by_process deleted_rule - denied_by_firewall_rule denied_by_process - denied_firewall_rule detected_module - detection device - disconnect_from_wifi_ap disconnected_from_accessory - disconnected_from_host dns - dns_request duplicated_by_app - duplicates_app established_on_ad_computer - established_on_host_name established_on_ip4 - established_on_ip6 established_on_sensor - established_session established_user_session - executed_app executed_by_process - executed_macro_script executed_script - extracted_file failed_to_authenticate_ad_user - failed_to_authenticate_to_ad_computer failed_to_authenticate_to_adfs_app - failed_to_authenticate_to_azure_app failed_to_authenticate_to_okta_app - failed_to_authenticate_to_ping_app failed_to_authenticate_to_service_account - generated_by_renewing generated_by_session - generated_dce_rpc_epm_request_against_dc generated_dce_rpc_request_against_dc - generated_failed_authentication_to_ad_computer generated_failed_authentication_to_adfs_app - generated_failed_authentication_to_azure_app generated_failed_authentication_to_okta_app - generated_failed_authentication_to_ping_app generated_failed_authentication_to_service_account - generated_ldap_search_against_dc generated_service_ticket - had_code_injected_by_process has_app_installed - has_attributed_process has_attribution - has_firmware implicated_by_incident - implicated_sensor indexed - initiated_by_ad_computer initiated_by_azure_ad_user - initiated_by_okta_user initiated_by_user - initiated_session injected_code_into_process - injected_thread injected_thread_from_process - installed_app installed_by_app - installed_on_host invalid_firewall_rule - invalid_from_process invalidated_by_process - invalidated_firewall_rule invokes_model - involved_ad_computer involved_service_account - ip4_socket_closed_by_app ip4_socket_closed_by_process - ip4_socket_opened_by_process ip6_socket_closed_by_app - ip6_socket_closed_by_process ip6_socket_opened_by_process - ipv4 ipv4_close - ipv4_listen ipv6 - ipv6_close ipv6_listen - killed_ip4_connection killed_ip6_connection - known_by_md5 known_by_sha256 - linking_event loaded_by_process - loaded_module loaded_skill - macro_executed_by_process mcp_tool_call - member_of_full_command_line module - module_written mounted_on_host - mounted_to_host network_close_ip4 - network_close_ip6 network_connect_ip4 - network_connect_ip6 network_listen_ip4 - network_listen_ip6 opened_ip4_socket - opened_ip6_socket parent_of_command_line - parent_process parented_by_process - participating_process performed_psexec_against_dc - presented_by_cloud primary_module - primary_module_of_process process_ai_agent - protected_by_shield quarantined_file - queried_by_process queried_by_sensor - queried_dns queried_on_customer - queried_on_sensor received_from_cloud - registered_by_incident registered_scheduledtask - renewed_to_generate reports_aggregate_indicator - resolved_from_domain resolved_to_ip4 - resolved_to_ip6 rooted_control_graph - rule_set_by_process script - self_diagnostic_to_agent session_on_sensor - session_process set_by_process - set_firewall_rule set_rule - shell_io_redirect shield_activated_on_host - submitted_prompt tool_spawned_process - trigger_process triggered_by_control_graph - triggered_by_process triggered_control_graph - triggered_custom_ioa triggered_detection - triggered_indicator triggered_mobile_indicator - triggered_xdr triggering_domain - triggering_network uncontainerized_app - uncontainerized_by_sensor uninstalled_app - unmounted_from_host unmounted_on_host - used_tool user - user_session uses_ai_agent - witnessed_by_sensor witnessed_process - wmicreated_by_incident wmicreated_process - written_by_process wrote_module - ids -- Vertex ID to get details for. Only one value is supported. String. - limit -- How many edges to return in a single request [1-100]. Integer. - nano -- Return nano-precision entity timestamps. Boolean. - offset -- The offset to use to retrieve the next page of results. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - scope -- Scope of the request. String. - Available values: cspm, customer, cwpp, device, global - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/threatgraph/combined_edges_get + + Keyword arguments + ----------------- + direction : str + The direction of edges that you would like to retrieve. + edge_type : str + The type of edges that you would like to retrieve. String. + Available values: + accessed_ad_computer accessed_adfs_application + accessed_azure_application accessed_by_kerberos_ticket + accessed_by_process accessed_by_session + accessed_classified_file accessed_okta_application + accessed_ping_fed_application accessed_service_account + accessed_web agent_process + agent_to_self_diagnostic ai_agent_used_by + ai_runs_on allowed_by_process + allowed_firewall_rule app_uninstalled_from_host + assigned_ipv4_address assigned_ipv6_address + assigned_to_sensor associated_by_ad_computer + associated_by_ad_group associated_by_ad_user + associated_by_aggregate_indicator associated_by_app + associated_by_azure_ad_user associated_by_azure_app + associated_by_certificate associated_by_control_graph + associated_by_domain associated_by_host + associated_by_host_name associated_by_idp_session + associated_by_incident associated_by_indicator + associated_by_ip associated_by_ip4 + associated_by_ip6 associated_by_okta_user + associated_by_service_ticket associated_control_graph + associated_firewall_rule associated_idp_indicator + associated_incident associated_indicator + associated_k8s_cluster associated_k8s_sensor + associated_mobile_forensics_report associated_mobile_indicator + associated_module associated_primary_module + associated_quarantined_file associated_quarantined_module + associated_root_process associated_to_ad_computer + associated_to_sensor associated_user_session + associated_vmware_cluster associated_vmware_sensor + associated_with_process associated_with_sensor + attributed_by_process attributed_from_domain + attributed_from_module attributed_on + attributed_on_domain attributed_on_module + attributed_to attributed_to_actor + authenticated_from_incident authenticated_host + blocked_by_app blocked_by_process + blocked_by_sensor blocked_dns + blocked_ip4 blocked_ip6 + blocked_module bundled_in_app + bundles_module cert_is_presented_by + cert_presented child_process + child_session classified_file_accessed_by + closed_ip4_socket closed_ip6_socket + command_line_parent_process connected_from_app + connected_from_host connected_from_process + connected_ip4 connected_ip6 + connected_mcp connected_on_customer + connected_on_sensor connected_to_accessory + connected_to_wifi_ap connection_killed_by_app + connection_killed_by_process containerized_app + containerized_by_sensor control_graph + created_by_incident created_by_process + created_by_user created_quarantined_file + created_service customer_agent_has_user + customer_has_sensor customer_ioc + customer_sensor_to_sensor customer_user_to_sensor_user + deleted_by_process deleted_rule + denied_by_firewall_rule denied_by_process + denied_firewall_rule detected_module + detection device + disconnect_from_wifi_ap disconnected_from_accessory + disconnected_from_host dns + dns_request duplicated_by_app + duplicates_app established_on_ad_computer + established_on_host_name established_on_ip4 + established_on_ip6 established_on_sensor + established_session established_user_session + executed_app executed_by_process + executed_macro_script executed_script + extracted_file failed_to_authenticate_ad_user + failed_to_authenticate_to_ad_computer failed_to_authenticate_to_adfs_app + failed_to_authenticate_to_azure_app failed_to_authenticate_to_okta_app + failed_to_authenticate_to_ping_app failed_to_authenticate_to_service_account + generated_by_renewing generated_by_session + generated_dce_rpc_epm_request_against_dc generated_dce_rpc_request_against_dc + generated_failed_authentication_to_ad_computer generated_failed_authentication_to_adfs_app + generated_failed_authentication_to_azure_app generated_failed_authentication_to_okta_app + generated_failed_authentication_to_ping_app generated_failed_authentication_to_service_account + generated_ldap_search_against_dc generated_service_ticket + had_code_injected_by_process has_app_installed + has_attributed_process has_attribution + has_firmware implicated_by_incident + implicated_sensor indexed + initiated_by_ad_computer initiated_by_azure_ad_user + initiated_by_okta_user initiated_by_user + initiated_session injected_code_into_process + injected_thread injected_thread_from_process + installed_app installed_by_app + installed_on_host invalid_firewall_rule + invalid_from_process invalidated_by_process + invalidated_firewall_rule invokes_model + involved_ad_computer involved_service_account + ip4_socket_closed_by_app ip4_socket_closed_by_process + ip4_socket_opened_by_process ip6_socket_closed_by_app + ip6_socket_closed_by_process ip6_socket_opened_by_process + ipv4 ipv4_close + ipv4_listen ipv6 + ipv6_close ipv6_listen + killed_ip4_connection killed_ip6_connection + known_by_md5 known_by_sha256 + linking_event loaded_by_process + loaded_module loaded_skill + macro_executed_by_process mcp_tool_call + member_of_full_command_line module + module_written mounted_on_host + mounted_to_host network_close_ip4 + network_close_ip6 network_connect_ip4 + network_connect_ip6 network_listen_ip4 + network_listen_ip6 opened_ip4_socket + opened_ip6_socket parent_of_command_line + parent_process parented_by_process + participating_process performed_psexec_against_dc + presented_by_cloud primary_module + primary_module_of_process process_ai_agent + protected_by_shield quarantined_file + queried_by_process queried_by_sensor + queried_dns queried_on_customer + queried_on_sensor received_from_cloud + registered_by_incident registered_scheduledtask + renewed_to_generate reports_aggregate_indicator + resolved_from_domain resolved_to_ip4 + resolved_to_ip6 rooted_control_graph + rule_set_by_process script + self_diagnostic_to_agent session_on_sensor + session_process set_by_process + set_firewall_rule set_rule + shell_io_redirect shield_activated_on_host + submitted_prompt tool_spawned_process + trigger_process triggered_by_control_graph + triggered_by_process triggered_control_graph + triggered_custom_ioa triggered_detection + triggered_indicator triggered_mobile_indicator + triggered_xdr triggering_domain + triggering_network uncontainerized_app + uncontainerized_by_sensor uninstalled_app + unmounted_from_host unmounted_on_host + used_tool user + user_session uses_ai_agent + witnessed_by_sensor witnessed_process + wmicreated_by_incident wmicreated_process + written_by_process wrote_module + ids : str + Vertex ID to get details for. Only one value is supported. + limit : int + How many edges to return in a single request [1-100] + nano : bool + Return nano-precision entity timestamps. + offset : str + The offset to use to retrieve the next page of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + scope : str + Scope of the request. String. + Available values: cspm, customer, cwpp, device, global + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -236,23 +249,34 @@ def get_ran_on(self: object, parameters: dict = None, **kwargs) -> Union[Dict[st (Such as hashes, domain names, and ip addresses that have been seen on devices in your environment.) - Keyword arguments: - limit -- How many edges to return in a single request [1-100]. Integer. - nano -- Return nano-precision entity timestamps. Boolean. - offset -- The offset to use to retrieve the next page of results. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - type -- The type of indicator that you would like to retrieve. String. - Available values: domain, ipv4, ipv6, md5, sha1, sha256 - value -- The value of the indicator to search by. String. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/threatgraph/combined_ran_on_get + + Keyword arguments + ----------------- + limit : int + How many edges to return in a single request [1-100] + nano : bool + Return nano-precision entity timestamps. + offset : str + The offset to use to retrieve the next page of results. + parameters : dict + Full parameters payload. Not required if using other keywords. + type : str + The type of indicator that you would like to retrieve. String. + Available values: domain, ipv4, ipv6, md5, sha1, sha256 + value : str + The value of the indicator to search by. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -270,184 +294,194 @@ def get_summary(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve summary for a given vertex ID. - Keyword arguments: - ids -- Vertex ID to get details for. String or list of strings. - scope -- Scope of the request. String. - Available values: cspm, customer, cwpp, device, global - nano -- Return nano-precision entity timestamps. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - vertex_type -- Type of vertex to get properties for. String. - Allowed values: - accessories accessory - actor ad-computers - ad-groups ad_computer - ad_group adfs-applications - adfs_application aggregate-indicators - aggregate_indicator ai-agents - ai-models ai-prompts - ai-sessions ai-skills - ai-tools ai_agent - ai_model ai_prompt - ai_session ai_skill - ai_tool any-vertex - azure-ad-users azure-applications - azure_ad_user azure_application - certificate certificates - command-lines command_line - containerized-apps containerized_app - control-graphs control_graph - custom_ioa custom_ioas - detection detection-indices - detection_index detections - devices domain - domains extracted-files - extracted_file fdp-classified-files - fdp_classified_files firewall - firewall_rule_match firewall_rule_matches - firewalls firmware - firmwares host-names - host_name idp-indicators - idp-sessions idp_indicator - idp_session incident - incidents indicator - indicators ipv4 - ipv6 k8s_cluster - k8s_clusters kerberos-tickets - kerberos_ticket legacy-detections - legacy_detection macro_script - macro_scripts mcp-servers - mcp_server mobile-apps - mobile-fs-volumes mobile-indicators - mobile_app mobile_fs_volume - mobile_indicator mobile_os_forensics_report - mobile_os_forensics_reports module - modules okta-applications - okta-users okta_application - okta_user ping-fed-applications - ping_fed_application process - processes quarantined-files - quarantined_file script - scripts sensor - sensor-self-diagnostics sensor_self_diagnostic - shield shields - user-sessions user_id - user_session users - vmware_cluster vmware_clusters - web_access wifi-access-points - wifi_access_point xdr - actor ad-computers - ad-groups ad_computer - ad_group adfs-applications - adfs_application aggregate-indicators - aggregate_indicator ai-agents - ai-models ai-prompts - ai-sessions ai-skills - ai-tools ai_agent - ai_model ai_prompt - ai_session ai_skill - ai_tool any-vertex - azure-ad-users azure-applications - azure_ad_user azure_application - certificate certificates - command-lines command_line - containerized-apps containerized_app - control-graphs control_graph - custom_ioa custom_ioas - detection detection-indices - detection_index detections - devices domain - domains extracted-files - extracted_file firewall - firewall_rule_match firewall_rule_matches - firewalls firmware - firmwares host-names - host_name idp-indicators - idp-sessions idp_indicator - idp_session incident - incidents indicator - indicators ipv4 - ipv6 k8s_cluster - k8s_clusters kerberos-tickets - kerberos_ticket legacy-detections - legacy_detection macro_script - macro_scripts mcp-servers - mcp_server mobile-apps - mobile-fs-volumes mobile-indicators - mobile_app mobile_fs_volume - mobile_indicator mobile_os_forensics_report - mobile_os_forensics_reports module - modules okta-applications - okta-users okta_application - okta_user ping-fed-applications - ping_fed_application process - processes quarantined-files - quarantined_file script - scripts sensor - sensor-self-diagnostics sensor_self_diagnostic - shield shields - user-sessions user_id - user_session users - vmware_cluster vmware_clusters - web_access wifi-access-points - wifi_access_point xdr - ad-computers indicator - ad-groups indicators - ad_computer ipv4 - ad_group ipv6 - adfs-applications k8s_cluster - adfs_application k8s_clusters - aggregate-indicators kerberos-tickets - aggregate_indicator kerberos_ticket - any-vertex legacy-detections - azure-ad-users legacy_detection - azure-applications macro_script - azure_ad_user macro_scripts - azure_application mobile-apps - certificate mobile-fs-volumes - certificates mobile-indicators - command-lines mobile_app - command_line mobile_fs_volume - containerized-apps mobile_indicator - containerized_app mobile_os_forensics_report - control-graphs mobile_os_forensics_reports - control_graph module - customer modules - customers okta-applications - detection okta-users - detection-indices okta_application - detection_index okta_user - detections ping-fed-applications - devices ping_fed_application - direct process - directs processes - domain quarantined-files - domains quarantined_file - extracted-files script - extracted_file scripts - firewall sensor - firewall_rule_match sensor-self-diagnostics - firewall_rule_matches sensor_self_diagnostic - firewalls tag - firmware tags - firmwares user-sessions - host-names user_id - host_name user_session - hunting-leads users - hunting_lead wifi-access-points - idp-indicators wifi_access_point - idp-sessions xdr - idp_indicator shield - shields custom_ioa - custom_ioas - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/threatgraph/combined_summary_get + + Keyword arguments + ----------------- + ids : str or list[str] + Vertex ID to get details for. + scope : str + Scope of the request. String. + Available values: cspm, customer, cwpp, device, global + nano : bool + Return nano-precision entity timestamps. + parameters : dict + Full parameters payload. Not required if using other keywords. + vertex_type : str + Type of vertex to get properties for. String. + Allowed values: + accessories accessory + actor ad-computers + ad-groups ad_computer + ad_group adfs-applications + adfs_application aggregate-indicators + aggregate_indicator ai-agents + ai-models ai-prompts + ai-sessions ai-skills + ai-tools ai_agent + ai_model ai_prompt + ai_session ai_skill + ai_tool any-vertex + azure-ad-users azure-applications + azure_ad_user azure_application + certificate certificates + command-lines command_line + containerized-apps containerized_app + control-graphs control_graph + custom_ioa custom_ioas + detection detection-indices + detection_index detections + devices domain + domains extracted-files + extracted_file fdp-classified-files + fdp_classified_files firewall + firewall_rule_match firewall_rule_matches + firewalls firmware + firmwares host-names + host_name idp-indicators + idp-sessions idp_indicator + idp_session incident + incidents indicator + indicators ipv4 + ipv6 k8s_cluster + k8s_clusters kerberos-tickets + kerberos_ticket legacy-detections + legacy_detection macro_script + macro_scripts mcp-servers + mcp_server mobile-apps + mobile-fs-volumes mobile-indicators + mobile_app mobile_fs_volume + mobile_indicator mobile_os_forensics_report + mobile_os_forensics_reports module + modules okta-applications + okta-users okta_application + okta_user ping-fed-applications + ping_fed_application process + processes quarantined-files + quarantined_file script + scripts sensor + sensor-self-diagnostics sensor_self_diagnostic + shield shields + user-sessions user_id + user_session users + vmware_cluster vmware_clusters + web_access wifi-access-points + wifi_access_point xdr + actor ad-computers + ad-groups ad_computer + ad_group adfs-applications + adfs_application aggregate-indicators + aggregate_indicator ai-agents + ai-models ai-prompts + ai-sessions ai-skills + ai-tools ai_agent + ai_model ai_prompt + ai_session ai_skill + ai_tool any-vertex + azure-ad-users azure-applications + azure_ad_user azure_application + certificate certificates + command-lines command_line + containerized-apps containerized_app + control-graphs control_graph + custom_ioa custom_ioas + detection detection-indices + detection_index detections + devices domain + domains extracted-files + extracted_file firewall + firewall_rule_match firewall_rule_matches + firewalls firmware + firmwares host-names + host_name idp-indicators + idp-sessions idp_indicator + idp_session incident + incidents indicator + indicators ipv4 + ipv6 k8s_cluster + k8s_clusters kerberos-tickets + kerberos_ticket legacy-detections + legacy_detection macro_script + macro_scripts mcp-servers + mcp_server mobile-apps + mobile-fs-volumes mobile-indicators + mobile_app mobile_fs_volume + mobile_indicator mobile_os_forensics_report + mobile_os_forensics_reports module + modules okta-applications + okta-users okta_application + okta_user ping-fed-applications + ping_fed_application process + processes quarantined-files + quarantined_file script + scripts sensor + sensor-self-diagnostics sensor_self_diagnostic + shield shields + user-sessions user_id + user_session users + vmware_cluster vmware_clusters + web_access wifi-access-points + wifi_access_point xdr + ad-computers indicator + ad-groups indicators + ad_computer ipv4 + ad_group ipv6 + adfs-applications k8s_cluster + adfs_application k8s_clusters + aggregate-indicators kerberos-tickets + aggregate_indicator kerberos_ticket + any-vertex legacy-detections + azure-ad-users legacy_detection + azure-applications macro_script + azure_ad_user macro_scripts + azure_application mobile-apps + certificate mobile-fs-volumes + certificates mobile-indicators + command-lines mobile_app + command_line mobile_fs_volume + containerized-apps mobile_indicator + containerized_app mobile_os_forensics_report + control-graphs mobile_os_forensics_reports + control_graph module + customer modules + customers okta-applications + detection okta-users + detection-indices okta_application + detection_index okta_user + detections ping-fed-applications + devices ping_fed_application + direct process + directs processes + domain quarantined-files + domains quarantined_file + extracted-files script + extracted_file scripts + firewall sensor + firewall_rule_match sensor-self-diagnostics + firewall_rule_matches sensor_self_diagnostic + firewalls tag + firmware tags + firmwares user-sessions + host-names user_id + host_name user_session + hunting-leads users + hunting_lead wifi-access-points + idp-indicators wifi_access_point + idp-sessions xdr + idp_indicator shield + shields custom_ioa + custom_ioas + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -470,184 +504,194 @@ def get_vertices_v1(self: object, to release of the ThreatGraph OAuth 2.0 APIs. If you’re not currently using this endpoint, use the get_vertices method instead. - Keyword arguments: - ids -- Vertex ID to get details for. String or list of strings. - scope -- Scope of the request. String. - Available values: cspm, customer, cwpp, device, global - nano -- Return nano-precision entity timestamps. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - vertex_type -- Type of vertex to get properties for. String. - Allowed values: - accessories accessory - actor ad-computers - ad-groups ad_computer - ad_group adfs-applications - adfs_application aggregate-indicators - aggregate_indicator ai-agents - ai-models ai-prompts - ai-sessions ai-skills - ai-tools ai_agent - ai_model ai_prompt - ai_session ai_skill - ai_tool any-vertex - azure-ad-users azure-applications - azure_ad_user azure_application - certificate certificates - command-lines command_line - containerized-apps containerized_app - control-graphs control_graph - custom_ioa custom_ioas - detection detection-indices - detection_index detections - devices domain - domains extracted-files - extracted_file fdp-classified-files - fdp_classified_files firewall - firewall_rule_match firewall_rule_matches - firewalls firmware - firmwares host-names - host_name idp-indicators - idp-sessions idp_indicator - idp_session incident - incidents indicator - indicators ipv4 - ipv6 k8s_cluster - k8s_clusters kerberos-tickets - kerberos_ticket legacy-detections - legacy_detection macro_script - macro_scripts mcp-servers - mcp_server mobile-apps - mobile-fs-volumes mobile-indicators - mobile_app mobile_fs_volume - mobile_indicator mobile_os_forensics_report - mobile_os_forensics_reports module - modules okta-applications - okta-users okta_application - okta_user ping-fed-applications - ping_fed_application process - processes quarantined-files - quarantined_file script - scripts sensor - sensor-self-diagnostics sensor_self_diagnostic - shield shields - user-sessions user_id - user_session users - vmware_cluster vmware_clusters - web_access wifi-access-points - wifi_access_point xdr - actor ad-computers - ad-groups ad_computer - ad_group adfs-applications - adfs_application aggregate-indicators - aggregate_indicator ai-agents - ai-models ai-prompts - ai-sessions ai-skills - ai-tools ai_agent - ai_model ai_prompt - ai_session ai_skill - ai_tool any-vertex - azure-ad-users azure-applications - azure_ad_user azure_application - certificate certificates - command-lines command_line - containerized-apps containerized_app - control-graphs control_graph - custom_ioa custom_ioas - detection detection-indices - detection_index detections - devices domain - domains extracted-files - extracted_file firewall - firewall_rule_match firewall_rule_matches - firewalls firmware - firmwares host-names - host_name idp-indicators - idp-sessions idp_indicator - idp_session incident - incidents indicator - indicators ipv4 - ipv6 k8s_cluster - k8s_clusters kerberos-tickets - kerberos_ticket legacy-detections - legacy_detection macro_script - macro_scripts mcp-servers - mcp_server mobile-apps - mobile-fs-volumes mobile-indicators - mobile_app mobile_fs_volume - mobile_indicator mobile_os_forensics_report - mobile_os_forensics_reports module - modules okta-applications - okta-users okta_application - okta_user ping-fed-applications - ping_fed_application process - processes quarantined-files - quarantined_file script - scripts sensor - sensor-self-diagnostics sensor_self_diagnostic - shield shields - user-sessions user_id - user_session users - vmware_cluster vmware_clusters - web_access wifi-access-points - wifi_access_point xdr - ad-computers indicator - ad-groups indicators - ad_computer ipv4 - ad_group ipv6 - adfs-applications k8s_cluster - adfs_application k8s_clusters - aggregate-indicators kerberos-tickets - aggregate_indicator kerberos_ticket - any-vertex legacy-detections - azure-ad-users legacy_detection - azure-applications macro_script - azure_ad_user macro_scripts - azure_application mobile-apps - certificate mobile-fs-volumes - certificates mobile-indicators - command-lines mobile_app - command_line mobile_fs_volume - containerized-apps mobile_indicator - containerized_app mobile_os_forensics_report - control-graphs mobile_os_forensics_reports - control_graph module - customer modules - customers okta-applications - detection okta-users - detection-indices okta_application - detection_index okta_user - detections ping-fed-applications - devices ping_fed_application - direct process - directs processes - domain quarantined-files - domains quarantined_file - extracted-files script - extracted_file scripts - firewall sensor - firewall_rule_match sensor-self-diagnostics - firewall_rule_matches sensor_self_diagnostic - firewalls tag - firmware tags - firmwares user-sessions - host-names user_id - host_name user_session - hunting-leads users - hunting_lead wifi-access-points - idp-indicators wifi_access_point - idp-sessions xdr - idp_indicator shield - shields custom_ioa - custom_ioas - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/threatgraph/entities_vertices_get + + Keyword arguments + ----------------- + ids : str or list[str] + Vertex ID to get details for. + scope : str + Scope of the request. String. + Available values: cspm, customer, cwpp, device, global + nano : bool + Return nano-precision entity timestamps. + parameters : dict + Full parameters payload. Not required if using other keywords. + vertex_type : str + Type of vertex to get properties for. String. + Allowed values: + accessories accessory + actor ad-computers + ad-groups ad_computer + ad_group adfs-applications + adfs_application aggregate-indicators + aggregate_indicator ai-agents + ai-models ai-prompts + ai-sessions ai-skills + ai-tools ai_agent + ai_model ai_prompt + ai_session ai_skill + ai_tool any-vertex + azure-ad-users azure-applications + azure_ad_user azure_application + certificate certificates + command-lines command_line + containerized-apps containerized_app + control-graphs control_graph + custom_ioa custom_ioas + detection detection-indices + detection_index detections + devices domain + domains extracted-files + extracted_file fdp-classified-files + fdp_classified_files firewall + firewall_rule_match firewall_rule_matches + firewalls firmware + firmwares host-names + host_name idp-indicators + idp-sessions idp_indicator + idp_session incident + incidents indicator + indicators ipv4 + ipv6 k8s_cluster + k8s_clusters kerberos-tickets + kerberos_ticket legacy-detections + legacy_detection macro_script + macro_scripts mcp-servers + mcp_server mobile-apps + mobile-fs-volumes mobile-indicators + mobile_app mobile_fs_volume + mobile_indicator mobile_os_forensics_report + mobile_os_forensics_reports module + modules okta-applications + okta-users okta_application + okta_user ping-fed-applications + ping_fed_application process + processes quarantined-files + quarantined_file script + scripts sensor + sensor-self-diagnostics sensor_self_diagnostic + shield shields + user-sessions user_id + user_session users + vmware_cluster vmware_clusters + web_access wifi-access-points + wifi_access_point xdr + actor ad-computers + ad-groups ad_computer + ad_group adfs-applications + adfs_application aggregate-indicators + aggregate_indicator ai-agents + ai-models ai-prompts + ai-sessions ai-skills + ai-tools ai_agent + ai_model ai_prompt + ai_session ai_skill + ai_tool any-vertex + azure-ad-users azure-applications + azure_ad_user azure_application + certificate certificates + command-lines command_line + containerized-apps containerized_app + control-graphs control_graph + custom_ioa custom_ioas + detection detection-indices + detection_index detections + devices domain + domains extracted-files + extracted_file firewall + firewall_rule_match firewall_rule_matches + firewalls firmware + firmwares host-names + host_name idp-indicators + idp-sessions idp_indicator + idp_session incident + incidents indicator + indicators ipv4 + ipv6 k8s_cluster + k8s_clusters kerberos-tickets + kerberos_ticket legacy-detections + legacy_detection macro_script + macro_scripts mcp-servers + mcp_server mobile-apps + mobile-fs-volumes mobile-indicators + mobile_app mobile_fs_volume + mobile_indicator mobile_os_forensics_report + mobile_os_forensics_reports module + modules okta-applications + okta-users okta_application + okta_user ping-fed-applications + ping_fed_application process + processes quarantined-files + quarantined_file script + scripts sensor + sensor-self-diagnostics sensor_self_diagnostic + shield shields + user-sessions user_id + user_session users + vmware_cluster vmware_clusters + web_access wifi-access-points + wifi_access_point xdr + ad-computers indicator + ad-groups indicators + ad_computer ipv4 + ad_group ipv6 + adfs-applications k8s_cluster + adfs_application k8s_clusters + aggregate-indicators kerberos-tickets + aggregate_indicator kerberos_ticket + any-vertex legacy-detections + azure-ad-users legacy_detection + azure-applications macro_script + azure_ad_user macro_scripts + azure_application mobile-apps + certificate mobile-fs-volumes + certificates mobile-indicators + command-lines mobile_app + command_line mobile_fs_volume + containerized-apps mobile_indicator + containerized_app mobile_os_forensics_report + control-graphs mobile_os_forensics_reports + control_graph module + customer modules + customers okta-applications + detection okta-users + detection-indices okta_application + detection_index okta_user + detections ping-fed-applications + devices ping_fed_application + direct process + directs processes + domain quarantined-files + domains quarantined_file + extracted-files script + extracted_file scripts + firewall sensor + firewall_rule_match sensor-self-diagnostics + firewall_rule_matches sensor_self_diagnostic + firewalls tag + firmware tags + firmwares user-sessions + host-names user_id + host_name user_session + hunting-leads users + hunting_lead wifi-access-points + idp-indicators wifi_access_point + idp-sessions xdr + idp_indicator shield + shields custom_ioa + custom_ioas + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -666,184 +710,194 @@ def get_vertices(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve metadata for a given vertex ID. - Keyword arguments: - ids -- Vertex ID to get details for. String or list of strings. - scope -- Scope of the request. String. - Available values: cspm, customer, cwpp, device, global - nano -- Return nano-precision entity timestamps. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - vertex_type -- Type of vertex to get properties for. String. - Allowed values: - accessories accessory - actor ad-computers - ad-groups ad_computer - ad_group adfs-applications - adfs_application aggregate-indicators - aggregate_indicator ai-agents - ai-models ai-prompts - ai-sessions ai-skills - ai-tools ai_agent - ai_model ai_prompt - ai_session ai_skill - ai_tool any-vertex - azure-ad-users azure-applications - azure_ad_user azure_application - certificate certificates - command-lines command_line - containerized-apps containerized_app - control-graphs control_graph - custom_ioa custom_ioas - detection detection-indices - detection_index detections - devices domain - domains extracted-files - extracted_file fdp-classified-files - fdp_classified_files firewall - firewall_rule_match firewall_rule_matches - firewalls firmware - firmwares host-names - host_name idp-indicators - idp-sessions idp_indicator - idp_session incident - incidents indicator - indicators ipv4 - ipv6 k8s_cluster - k8s_clusters kerberos-tickets - kerberos_ticket legacy-detections - legacy_detection macro_script - macro_scripts mcp-servers - mcp_server mobile-apps - mobile-fs-volumes mobile-indicators - mobile_app mobile_fs_volume - mobile_indicator mobile_os_forensics_report - mobile_os_forensics_reports module - modules okta-applications - okta-users okta_application - okta_user ping-fed-applications - ping_fed_application process - processes quarantined-files - quarantined_file script - scripts sensor - sensor-self-diagnostics sensor_self_diagnostic - shield shields - user-sessions user_id - user_session users - vmware_cluster vmware_clusters - web_access wifi-access-points - wifi_access_point xdr - actor ad-computers - ad-groups ad_computer - ad_group adfs-applications - adfs_application aggregate-indicators - aggregate_indicator ai-agents - ai-models ai-prompts - ai-sessions ai-skills - ai-tools ai_agent - ai_model ai_prompt - ai_session ai_skill - ai_tool any-vertex - azure-ad-users azure-applications - azure_ad_user azure_application - certificate certificates - command-lines command_line - containerized-apps containerized_app - control-graphs control_graph - custom_ioa custom_ioas - detection detection-indices - detection_index detections - devices domain - domains extracted-files - extracted_file firewall - firewall_rule_match firewall_rule_matches - firewalls firmware - firmwares host-names - host_name idp-indicators - idp-sessions idp_indicator - idp_session incident - incidents indicator - indicators ipv4 - ipv6 k8s_cluster - k8s_clusters kerberos-tickets - kerberos_ticket legacy-detections - legacy_detection macro_script - macro_scripts mcp-servers - mcp_server mobile-apps - mobile-fs-volumes mobile-indicators - mobile_app mobile_fs_volume - mobile_indicator mobile_os_forensics_report - mobile_os_forensics_reports module - modules okta-applications - okta-users okta_application - okta_user ping-fed-applications - ping_fed_application process - processes quarantined-files - quarantined_file script - scripts sensor - sensor-self-diagnostics sensor_self_diagnostic - shield shields - user-sessions user_id - user_session users - vmware_cluster vmware_clusters - web_access wifi-access-points - wifi_access_point xdr - ad-computers indicator - ad-groups indicators - ad_computer ipv4 - ad_group ipv6 - adfs-applications k8s_cluster - adfs_application k8s_clusters - aggregate-indicators kerberos-tickets - aggregate_indicator kerberos_ticket - any-vertex legacy-detections - azure-ad-users legacy_detection - azure-applications macro_script - azure_ad_user macro_scripts - azure_application mobile-apps - certificate mobile-fs-volumes - certificates mobile-indicators - command-lines mobile_app - command_line mobile_fs_volume - containerized-apps mobile_indicator - containerized_app mobile_os_forensics_report - control-graphs mobile_os_forensics_reports - control_graph module - customer modules - customers okta-applications - detection okta-users - detection-indices okta_application - detection_index okta_user - detections ping-fed-applications - devices ping_fed_application - direct process - directs processes - domain quarantined-files - domains quarantined_file - extracted-files script - extracted_file scripts - firewall sensor - firewall_rule_match sensor-self-diagnostics - firewall_rule_matches sensor_self_diagnostic - firewalls tag - firmware tags - firmwares user-sessions - host-names user_id - host_name user_session - hunting-leads users - hunting_lead wifi-access-points - idp-indicators wifi_access_point - idp-sessions xdr - idp_indicator shield - shields custom_ioa - custom_ioas - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/threatgraph/entities_vertices_getv2 + + Keyword arguments + ----------------- + ids : str or list[str] + Vertex ID to get details for. + scope : str + Scope of the request. String. + Available values: cspm, customer, cwpp, device, global + nano : bool + Return nano-precision entity timestamps. + parameters : dict + Full parameters payload. Not required if using other keywords. + vertex_type : str + Type of vertex to get properties for. String. + Allowed values: + accessories accessory + actor ad-computers + ad-groups ad_computer + ad_group adfs-applications + adfs_application aggregate-indicators + aggregate_indicator ai-agents + ai-models ai-prompts + ai-sessions ai-skills + ai-tools ai_agent + ai_model ai_prompt + ai_session ai_skill + ai_tool any-vertex + azure-ad-users azure-applications + azure_ad_user azure_application + certificate certificates + command-lines command_line + containerized-apps containerized_app + control-graphs control_graph + custom_ioa custom_ioas + detection detection-indices + detection_index detections + devices domain + domains extracted-files + extracted_file fdp-classified-files + fdp_classified_files firewall + firewall_rule_match firewall_rule_matches + firewalls firmware + firmwares host-names + host_name idp-indicators + idp-sessions idp_indicator + idp_session incident + incidents indicator + indicators ipv4 + ipv6 k8s_cluster + k8s_clusters kerberos-tickets + kerberos_ticket legacy-detections + legacy_detection macro_script + macro_scripts mcp-servers + mcp_server mobile-apps + mobile-fs-volumes mobile-indicators + mobile_app mobile_fs_volume + mobile_indicator mobile_os_forensics_report + mobile_os_forensics_reports module + modules okta-applications + okta-users okta_application + okta_user ping-fed-applications + ping_fed_application process + processes quarantined-files + quarantined_file script + scripts sensor + sensor-self-diagnostics sensor_self_diagnostic + shield shields + user-sessions user_id + user_session users + vmware_cluster vmware_clusters + web_access wifi-access-points + wifi_access_point xdr + actor ad-computers + ad-groups ad_computer + ad_group adfs-applications + adfs_application aggregate-indicators + aggregate_indicator ai-agents + ai-models ai-prompts + ai-sessions ai-skills + ai-tools ai_agent + ai_model ai_prompt + ai_session ai_skill + ai_tool any-vertex + azure-ad-users azure-applications + azure_ad_user azure_application + certificate certificates + command-lines command_line + containerized-apps containerized_app + control-graphs control_graph + custom_ioa custom_ioas + detection detection-indices + detection_index detections + devices domain + domains extracted-files + extracted_file firewall + firewall_rule_match firewall_rule_matches + firewalls firmware + firmwares host-names + host_name idp-indicators + idp-sessions idp_indicator + idp_session incident + incidents indicator + indicators ipv4 + ipv6 k8s_cluster + k8s_clusters kerberos-tickets + kerberos_ticket legacy-detections + legacy_detection macro_script + macro_scripts mcp-servers + mcp_server mobile-apps + mobile-fs-volumes mobile-indicators + mobile_app mobile_fs_volume + mobile_indicator mobile_os_forensics_report + mobile_os_forensics_reports module + modules okta-applications + okta-users okta_application + okta_user ping-fed-applications + ping_fed_application process + processes quarantined-files + quarantined_file script + scripts sensor + sensor-self-diagnostics sensor_self_diagnostic + shield shields + user-sessions user_id + user_session users + vmware_cluster vmware_clusters + web_access wifi-access-points + wifi_access_point xdr + ad-computers indicator + ad-groups indicators + ad_computer ipv4 + ad_group ipv6 + adfs-applications k8s_cluster + adfs_application k8s_clusters + aggregate-indicators kerberos-tickets + aggregate_indicator kerberos_ticket + any-vertex legacy-detections + azure-ad-users legacy_detection + azure-applications macro_script + azure_ad_user macro_scripts + azure_application mobile-apps + certificate mobile-fs-volumes + certificates mobile-indicators + command-lines mobile_app + command_line mobile_fs_volume + containerized-apps mobile_indicator + containerized_app mobile_os_forensics_report + control-graphs mobile_os_forensics_reports + control_graph module + customer modules + customers okta-applications + detection okta-users + detection-indices okta_application + detection_index okta_user + detections ping-fed-applications + devices ping_fed_application + direct process + directs processes + domain quarantined-files + domains quarantined_file + extracted-files script + extracted_file scripts + firewall sensor + firewall_rule_match sensor-self-diagnostics + firewall_rule_matches sensor_self_diagnostic + firewalls tag + firmware tags + firmwares user-sessions + host-names user_id + host_name user_session + hunting-leads users + hunting_lead wifi-access-points + idp-indicators wifi_access_point + idp-sessions xdr + idp_indicator shield + shields custom_ioa + custom_ioas + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -859,12 +913,20 @@ def get_edge_types(self: object) -> Union[Dict[str, Union[int, dict]], Result]: This method does not accept arguments. - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/threatgraph/queries_edgetypes_get + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/tools.py b/src/falconpy/tools.py new file mode 100644 index 000000000..af7443691 --- /dev/null +++ b/src/falconpy/tools.py @@ -0,0 +1,138 @@ +"""CrowdStrike Falcon Tools API interface class. + + _______ __ _______ __ __ __ +| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----. +|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__| +|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____| +|: 1 | |: 1 | +|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy +`-------' `-------' + +OAuth2 API - Customer SDK + +This is free and unencumbered software released into the public domain. + +Anyone is free to copy, modify, publish, use, compile, sell, or +distribute this software, either in source code form or as a compiled +binary, for any purpose, commercial or non-commercial, and by any +means. + +In jurisdictions that recognize copyright laws, the author or authors +of this software dedicate any and all copyright interest in the +software to the public domain. We make this dedication for the benefit +of the public at large and to the detriment of our heirs and +successors. We intend this dedication to be an overt act of +relinquishment in perpetuity of all present and future rights to this +software under copyright law. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR +OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, +ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR +OTHER DEALINGS IN THE SOFTWARE. + +For more information, please refer to +""" +from typing import Dict, Union +from ._util import force_default, process_service_request, handle_single_argument +from ._result import Result +from ._service_class import ServiceClass +from ._endpoint._tools import _tools_endpoints as Endpoints + + +class Tools(ServiceClass): + """The only requirement to instantiate an instance of this class is one of the following. + + - a valid client_id and client_secret provided as keywords. + - a credential dictionary with client_id and client_secret containing valid API credentials + { + "client_id": "CLIENT_ID_HERE", + "client_secret": "CLIENT_SECRET_HERE" + } + - a previously-authenticated instance of the authentication service class (oauth2.py) + - a valid token provided by the authentication service class (oauth2.py) + """ + + @force_default(defaults=["parameters"], default_types=["dict"]) + def entities_tools_v1(self: object, + *args, + parameters: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Retrieve tools entities for the provided id. + + HTTP Method: GET + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/tools/EntitiesToolsV1 + + Keyword arguments + ----------------- + ids : str or list[str] + IDs of entities to retrieve. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. + """ + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="EntitiesToolsV1", + keywords=kwargs, + params=handle_single_argument(args, parameters, "ids") + ) + + @force_default(defaults=["parameters"], default_types=["dict"]) + def queries_tools_v1(self: object, + parameters: dict = None, + **kwargs + ) -> Union[Dict[str, Union[int, dict]], Result]: + """Query tools based on the provided filters. + + HTTP Method: GET + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/tools/QueriesToolsV1 + + Keyword arguments + ----------------- + offset : int + Starting index of overall result set from which to return ids. + limit : int + Number of IDs to return. Offset + limit should NOT be above 10K. + sort : str + Possible order by fields: id, name, description, category. Ex: 'name|desc' + filter : str + FQL query specifying the filter parameters. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. + """ + return process_service_request( + calling_object=self, + endpoints=Endpoints, + operation_id="QueriesToolsV1", + keywords=kwargs, + params=parameters + ) + EntitiesToolsV1 = entities_tools_v1 + QueriesToolsV1 = queries_tools_v1 diff --git a/src/falconpy/tools.pyi b/src/falconpy/tools.pyi new file mode 100644 index 000000000..678096cad --- /dev/null +++ b/src/falconpy/tools.pyi @@ -0,0 +1,27 @@ +"""Type stubs for tools.""" +from typing import Dict, List, Optional, Union +from ._service_class import ServiceClass +from ._result import Result + + +class Tools(ServiceClass): + + def entities_tools_v1( + self, + *args: Union[str, List[str]], + ids: Optional[Union[str, List[str]]] = None, + parameters: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + def queries_tools_v1( + self, + *, + offset: Optional[int] = None, + limit: Optional[int] = None, + sort: Optional[str] = None, + filter: Optional[str] = None, + parameters: Optional[dict] = None, + ) -> Union[Dict[str, Union[int, dict]], Result]: ... + + EntitiesToolsV1 = entities_tools_v1 + QueriesToolsV1 = queries_tools_v1 diff --git a/src/falconpy/unidentified_containers.py b/src/falconpy/unidentified_containers.py index 78f9f72c0..a3bf9b676 100644 --- a/src/falconpy/unidentified_containers.py +++ b/src/falconpy/unidentified_containers.py @@ -63,31 +63,40 @@ def read_count_by_date_range(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Return the count of Unidentified Containers over the last 7 days. - Keyword arguments: - filter -- Filter Unidentified Containers using a query in Falcon Query Language (FQL). String. - Supported filters: - assessed_images_count last_seen - cid namespace - cloud_account_id node_name - cloud_name severity - cloud_region unassessed_images_count - cluster_id visible_to_k8s - cluster_name - containers_impacted_count - detections_count - image_assessment_detections_count - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /unidentified-containers/ReadUnidentifiedContainersByDateRangeCount + /unidentified-containers/ReadUnidentifiedContainersByDateRangeCount + + Keyword arguments + ----------------- + filter : str + Filter Unidentified Containers using a query in Falcon Query Language (FQL). String. + Supported filters: + assessed_images_count last_seen + cid namespace + cloud_account_id node_name + cloud_name severity + cloud_region unassessed_images_count + cluster_id visible_to_k8s + cluster_name + containers_impacted_count + detections_count + image_assessment_detections_count + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -101,31 +110,40 @@ def read_count_by_date_range(self: object, def read_count(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Return the total count of Unidentified Containers over a time period. - Keyword arguments: - filter -- Filter Unidentified Containers using a query in Falcon Query Language (FQL). String. - Supported filters: - assessed_images_count last_seen - cid namespace - cloud_account_id node_name - cloud_name severity - cloud_region unassessed_images_count - cluster_id visible_to_k8s - cluster_name - containers_impacted_count - detections_count - image_assessment_detections_count - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'filter'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /unidentified-containers/ReadUnidentifiedContainersCount + /unidentified-containers/ReadUnidentifiedContainersCount + + Keyword arguments + ----------------- + filter : str + Filter Unidentified Containers using a query in Falcon Query Language (FQL). String. + Supported filters: + assessed_images_count last_seen + cid namespace + cloud_account_id node_name + cloud_name severity + cloud_region unassessed_images_count + cluster_id visible_to_k8s + cluster_name + containers_impacted_count + detections_count + image_assessment_detections_count + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'filter'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -139,33 +157,43 @@ def read_count(self: object, *args, parameters: dict = None, **kwargs) -> Union[ def search_and_read(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search Unidentified Containers by the provided search criteria. - Keyword arguments: - filter -- Search Unidentified Containers using a query in Falcon Query Language (FQL). String. - Supported filters: - assessed_images_count last_seen - cid namespace - cloud_account_id node_name - cloud_name severity - cloud_region unassessed_images_count - cluster_id visible_to_k8s - cluster_name - containers_impacted_count - detections_count - image_assessment_detections_count - limit -- The upper-bound on the number of records to retrieve. Integer. - offset -- The offset from where to begin. Integer. - sort -- The fields to sort the records on. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html# - /unidentified-containers/SearchAndReadUnidentifiedContainers + /unidentified-containers/SearchAndReadUnidentifiedContainers + + Keyword arguments + ----------------- + filter : str + Search Unidentified Containers using a query in Falcon Query Language (FQL). String. + Supported filters: + assessed_images_count last_seen + cid namespace + cloud_account_id node_name + cloud_name severity + cloud_region unassessed_images_count + cluster_id visible_to_k8s + cluster_name + containers_impacted_count + detections_count + image_assessment_detections_count + limit : int + The upper-bound on the number of records to retrieve. + offset : int + The offset from where to begin. + sort : str + The fields to sort the records on. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/user_management.py b/src/falconpy/user_management.py index 0eb14c474..646258a23 100644 --- a/src/falconpy/user_management.py +++ b/src/falconpy/user_management.py @@ -66,8 +66,16 @@ def aggregate_users(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get user aggregates. - Keyword arguments: - body -- full body payload, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/aggregateUsersV1 + + Keyword arguments + ----------------- + body : list + full body payload, not required when using other keywords. [ { "date_ranges": [ @@ -106,39 +114,46 @@ def aggregate_users(self: object, "type": "string" } ] - date_ranges -- If peforming a date range query specify the from and to date ranges. - These can be in common date formats like 2019-07-18 or now. - List of dictionaries. - exclude -- Fields to exclude. String. - extended_bounds -- Extended bounds. Dictionary containing "min" and "max" as strings. - field -- Term you want to aggregate on. If doing a date_range query, - this is the date field you want to apply the date ranges to. String. - filter -- Optional filter criteria in the form of an FQL query. - For more information about FQL queries, see our FQL documentation in Falcon. - String. - from -- Integer. - include -- Fields to include. String. - interval -- String. - max_doc_count -- Maximum number of documents. Integer. - min_doc_count -- Minimum number of documents. Integer. - missing -- String. - name -- Scan name. String. - q -- FQL syntax. String. - ranges -- List of dictionaries. - size -- Integer. - sort -- FQL syntax. String. - sub_aggregates -- List of strings. - time_zone -- String. - type -- String. + date_ranges : list[dict] + If peforming a date range query specify the from and to date ranges. + These can be in common date formats like 2019-07-18 or now. + exclude : str + Fields to exclude. + extended_bounds : dict + Extended bounds. Dictionary containing "min" and "max" as strings. + field : str + Term you want to aggregate on. If doing a date_range query, + this is the date field you want to apply the date ranges to. + filter : str + Optional filter criteria in the form of an FQL query. + For more information about FQL queries, see our FQL documentation in Falcon. + from : int + include : str + Fields to include. + interval : str + max_doc_count : int + Maximum number of documents. + min_doc_count : int + Minimum number of documents. + missing : str + name : str + Scan name. + q : str + FQL syntax. + ranges : list[dict] + size : int + sort : str + FQL syntax. + sub_aggregates : list[str] + time_zone : str + type : str This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/aggregateUsersV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = [aggregate_payload(submitted_keywords=kwargs)] @@ -167,7 +182,7 @@ def get_user_grants_v1(self: object, https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/combinedUserRolesV1 Keyword arguments - ---- + ----------------- cid : str Customer ID to get grants for. An empty CID value returns Role IDs for the user against the current CID in view. @@ -191,12 +206,12 @@ def get_user_grants_v1(self: object, Must be provided as a keyword, argument or part of the `parameters` payload. Arguments - ---- + --------- When not specified, the first argument to this method is assumed to be `user_uuid`. All others are ignored. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -221,7 +236,7 @@ def get_user_grants(self: object, *args, parameters: dict = None, **kwargs) -> U https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/CombinedUserRolesV2 Keyword arguments - ---- + ----------------- cid : str Customer ID to get grants for. An empty CID value returns Role IDs for the user against the current CID in view. @@ -245,12 +260,12 @@ def get_user_grants(self: object, *args, parameters: dict = None, **kwargs) -> U Must be provided as a keyword, argument or part of the `parameters` payload. Arguments - ---- + --------- When not specified, the first argument to this method is assumed to be `user_uuid`. All others are ignored. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -277,7 +292,7 @@ def get_roles_mssp(self: object, https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/entitiesRolesGETV2 Keyword arguments - ---- + ----------------- cid : str Customer ID to get available roles for. Providing no value for `cid` returns results for the current CID. @@ -288,12 +303,12 @@ def get_roles_mssp(self: object, Full parameters payload in JSON format, not required if `ids` is provided as a keyword. Arguments - ---- + --------- When not specified, the first argument to this method is assumed to be `ids`. All others are ignored. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -337,7 +352,7 @@ def get_roles_mssp_v1(self: object, https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/entitiesRolesV1 Keyword arguments - ---- + ----------------- cid : str Customer ID to get available roles for. Providing no value for `cid` returns results for the current CID. @@ -348,12 +363,12 @@ def get_roles_mssp_v1(self: object, Full parameters payload in JSON format, not required if `ids` is provided as a keyword. Arguments - ---- + --------- When not specified, the first argument to this method is assumed to be `ids`. All others are ignored. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -375,7 +390,7 @@ def user_action(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Un https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/userActionV1 Keyword arguments - ---- + ----------------- action_name : str (required) Action to perform. Allowed values: reset_2fa, reset_password. Must be provided as a keyword or as part of the `body` payload. @@ -397,11 +412,11 @@ def user_action(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Un Must be provided as a keyword or as part of the `body` payload. Arguments - ---- + --------- This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -432,7 +447,7 @@ def user_roles_action(self: object, body: dict = None, **kwargs) -> Union[Dict[s https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/userRolesActionV1 Keyword arguments - ---- + ----------------- action : str (required) Action to perform. Allowed values: grant, revoke. Must be provided as a keyword or as part of the `body` payload. @@ -457,11 +472,11 @@ def user_roles_action(self: object, body: dict = None, **kwargs) -> Union[Dict[s Must be provided as a keyword or as part of the `body` payload. Arguments - ---- + --------- This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -490,7 +505,7 @@ def retrieve_users(self: object, *args, body: dict = None, **kwargs) -> Union[Di https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/retrieveUsersGETV1 Keyword arguments - ---- + ----------------- body : str Full body payload in JSON format. Not required if `ids` is provided as an argument or keyword. @@ -504,12 +519,12 @@ def retrieve_users(self: object, *args, body: dict = None, **kwargs) -> Union[Di Must be provided as an argument, keyword, or part of the `body` payload. Arguments - ---- + --------- When not specified, the first argument to this method is assumed to be `ids`. All others are ignored. The `ids` keyword takes precedence. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -540,7 +555,7 @@ def create_user_mssp(self: object, body: dict = None, **kwargs) -> Union[Dict[st https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/createUserV1 Keyword arguments - ---- + ----------------- body : str Full body payload in JSON format, not required when using other keywords. { @@ -569,11 +584,11 @@ def create_user_mssp(self: object, body: dict = None, **kwargs) -> Union[Dict[st the activation email to set their own password. Arguments - ---- + --------- This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -608,7 +623,7 @@ def delete_user_mssp(self: object, https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/deleteUserV1 Keyword arguments - ---- + ----------------- user_uuid : str (required) User ID to delete. Must be provided as a keyword or as part of the `parameters` payload. @@ -616,12 +631,12 @@ def delete_user_mssp(self: object, Full parameters payload in JSON format, not required if `user_uuid` keyword is provided. Arguments - ---- + --------- When not specified, the first argument to this method is assumed to be `user_uuid`. All others are ignored. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -647,7 +662,7 @@ def update_user_mssp(self: object, https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/updateUserV1 Keyword arguments - ---- + ----------------- body : str Full body payload in JSON format, not required if `first_name` and `last_name` keywords are provided. @@ -666,11 +681,11 @@ def update_user_mssp(self: object, Must be provided as a keyword or as part of the `parameters` payload. Arguments - ---- + --------- This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -701,7 +716,7 @@ def query_roles(self: object, *args, parameters: dict = None, **kwargs) -> Union https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/queriesRolesV1 Keyword arguments - ---- + ----------------- action : str Actionable purpose of the query. Default: grant cid : str @@ -714,12 +729,12 @@ def query_roles(self: object, *args, parameters: dict = None, **kwargs) -> Union all role IDs available for the customer. Arguments - ---- + --------- When not specified, the first argument to this method is assumed to be `user_uuid`. All others are ignored. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -743,7 +758,7 @@ def query_users(self: object, parameters: dict = None, **kwargs) -> Union[Dict[s https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/queryUserV1 Keyword arguments - ---- + ----------------- filter : str The filter expression that should be used to limit the results. FQL format. Allowed values: @@ -765,11 +780,11 @@ def query_users(self: object, parameters: dict = None, **kwargs) -> Union[Dict[s last_login_at, last_name, name, status, temporarily_assigned_cids, uid Arguments - ---- + --------- This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -793,7 +808,7 @@ def get_roles(self: object, *args, parameters: dict = None, **kwargs) -> Union[D https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/GetRoles Keyword arguments - ---- + ----------------- ids : str or list[str] (required) List of role IDs to retrieve. Comma-delimited strings accepted. Must be provided as a keyword, argument or part of the `parameters` payload. @@ -801,12 +816,12 @@ def get_roles(self: object, *args, parameters: dict = None, **kwargs) -> Union[D Full parameters payload in JSON format, not required if `ids` is provided as a keyword. Arguments - ---- + --------- When not specified, the first argument to this method is assumed to be `ids`. All others are ignored. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -834,7 +849,7 @@ def grant_user_role_ids(self: object, https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/GrantUserRoleIds Keyword arguments - ---- + ----------------- body : str Full body payload, not required when `role_ids` keyword is used. { @@ -852,11 +867,11 @@ def grant_user_role_ids(self: object, Must be provided as a keyword or as part of the `parameters` payload. Arguments - ---- + --------- This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -889,7 +904,7 @@ def revoke_user_role_ids(self: object, parameters: dict = None, **kwargs) -> Uni https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/RevokeUserRoleIds Keyword arguments - ---- + ----------------- ids : str or list[str] (required) List of role IDs. Must be provided as a keyword or as part of the `parameters` payload. @@ -899,11 +914,11 @@ def revoke_user_role_ids(self: object, parameters: dict = None, **kwargs) -> Uni User ID to revoke roles for. Arguments - ---- + --------- This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -928,15 +943,15 @@ def get_available_role_ids(self: object) -> Union[Dict[str, Union[int, dict]], R https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/GetAvailableRoleIds Keyword arguments - ---- + ----------------- This method does not accept keywords. Arguments - ---- + --------- This method does not accept arguments. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -964,7 +979,7 @@ def get_user_role_ids(self: object, https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/GetUserRoleIds Keyword arguments - ---- + ----------------- user_uuid : str (required) User ID to retrieve roles for. Must be provided as a keyword or as part of the `parameters` payload. @@ -972,12 +987,12 @@ def get_user_role_ids(self: object, Full parameters payload in JSON format, not required if `user_uuid` keyword is provided. Arguments - ---- + --------- When not specified, the first argument to this method is assumed to be `user_uuid`. All others are ignored. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -1001,7 +1016,7 @@ def retrieve_user(self: object, *args, parameters: dict = None, **kwargs) -> Uni https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/RetrieveUser Keyword arguments - ---- + ----------------- ids : str or list[str] (required) List of User IDs to retrieve. Comma-delimited strings accepted. Must be provided as a keyword or as part of the `parameters` payload. @@ -1009,12 +1024,12 @@ def retrieve_user(self: object, *args, parameters: dict = None, **kwargs) -> Uni Full parameters payload in JSON format, not required if `ids` is provided as a keyword. Arguments - ---- + --------- When not specified, the first argument to this method is assumed to be `ids`. All others are ignored. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -1040,7 +1055,7 @@ def create_user(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Un https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/CreateUser Keyword arguments - ---- + ----------------- body : str Full body payload in JSON format, not required when using other keywords. { @@ -1065,11 +1080,11 @@ def create_user(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Un the activation email to set their own password. Arguments - ---- + --------- This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -1100,7 +1115,7 @@ def delete_user(self: object, *args, parameters: dict = None, **kwargs) -> Union https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/DeleteUser Keyword arguments - ---- + ----------------- user_uuid : str (required) User ID to delete. Must be provided as a keyword or as part of the `parameters` payload. @@ -1108,12 +1123,12 @@ def delete_user(self: object, *args, parameters: dict = None, **kwargs) -> Union Full parameters payload in JSON format, not required if `user_uuid` keyword is provided. Arguments - ---- + --------- When not specified, the first argument to this method is assumed to be `user_uuid`. All others are ignored. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -1141,7 +1156,7 @@ def update_user(self: object, https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/UpdateUser Keyword arguments - ---- + ----------------- body : str Full body payload in JSON format, not required `first_name` and `last_name` keywords are provided. @@ -1160,11 +1175,11 @@ def update_user(self: object, Must be provided as a keyword or as part of the `parameters` payload. Arguments - ---- + --------- This method only supports keywords for providing arguments. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -1194,15 +1209,15 @@ def retrieve_emails_by_cid(self: object) -> Union[Dict[str, Union[int, dict]], R https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/RetrieveEmailsByCID Keyword arguments - ---- + ----------------- This method does not accept keywords. Arguments - ---- + --------- This method does not accept arguments. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -1225,15 +1240,15 @@ def retrieve_user_uuids_by_cid(self: object) -> Union[Dict[str, Union[int, dict] https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/RetrieveUserUUIDsByCID Keyword arguments - ---- + ----------------- This method does not accept keywords. Arguments - ---- + --------- This method does not accept arguments. Returns - ---- + ------- dict Dictionary containing API response. """ @@ -1259,7 +1274,7 @@ def retrieve_user_uuid(self: object, https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/RetrieveUserUUID Keyword arguments - ---- + ----------------- uid : str or list[str] (required) List of User IDs to retrieve. Must be provided as a keyword or as part of the `parameters` payload. @@ -1267,12 +1282,12 @@ def retrieve_user_uuid(self: object, Full parameters payload in JSON format, not required if `uid` is provided as a keyword. Arguments - ---- + --------- When not specified, the first argument to this method is assumed to be `uid`. All others are ignored. Returns - ---- + ------- dict Dictionary containing API response. """ diff --git a/src/falconpy/workflows.py b/src/falconpy/workflows.py index 9b8f398a8..22f952c32 100644 --- a/src/falconpy/workflows.py +++ b/src/falconpy/workflows.py @@ -76,25 +76,36 @@ class Workflows(ServiceClass): def search_activities(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search workflow activities based on the provided filter. - Keyword arguments: - filter -- FQL query specifying filter parameters. String. - offset -- Starting pagination offset of records to return. String. - limit -- Maximum number of records to return. Integer. - sort -- FQL formatted sort (ex: name.desc,time.asc). String. - If direction is omitted, defaults to descending. - skip_artifact_resolution -- When true, skip Foundry artifact resolution and return the latest version of the activity, - regardless of whether the associated Foundry app is - installed. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowActivitiesCombined + + Keyword arguments + ----------------- + filter : str + FQL query specifying filter parameters. + offset : str + Starting pagination offset of records to return. + limit : int + Maximum number of records to return. + sort : str + FQL formatted sort (ex: name.desc,time.asc). String. + If direction is omitted, defaults to descending. + skip_artifact_resolution : bool + When true, skip Foundry artifact resolution and return the latest version of the activity, + regardless of whether the associated Foundry app is + installed. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -111,22 +122,32 @@ def search_activities_content(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Search for activities by name. Returns all supported activities if no filter specified. - Keyword arguments: - filter -- FQL query specifying filter parameters. String. - offset -- Starting pagination offset of records to return. String. - limit -- Maximum number of records to return. Integer. - sort -- FQL formatted sort (ex: name.desc,time.asc). String. - If direction is omitted, defaults to descending. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowActivitiesContentCombined + + Keyword arguments + ----------------- + filter : str + FQL query specifying filter parameters. + offset : str + Starting pagination offset of records to return. + limit : int + Maximum number of records to return. + sort : str + FQL formatted sort (ex: name.desc,time.asc). String. + If direction is omitted, defaults to descending. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -140,22 +161,32 @@ def search_activities_content(self: object, def search_definitions(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search workflow definitions based on the provided filter. - Keyword arguments: - filter -- FQL query specifying filter parameters. String. - offset -- Starting pagination offset of records to return. String. - limit -- Maximum number of records to return. Integer. - sort -- FQL formatted sort (ex: name.desc,time.asc). String. - If direction is omitted, defaults to descending. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowDefinitionsCombined + + Keyword arguments + ----------------- + filter : str + FQL query specifying filter parameters. + offset : str + Starting pagination offset of records to return. + limit : int + Maximum number of records to return. + sort : str + FQL formatted sort (ex: name.desc,time.asc). String. + If direction is omitted, defaults to descending. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -169,22 +200,32 @@ def search_definitions(self: object, parameters: dict = None, **kwargs) -> Union def search_executions(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search workflow executions based on the provided filter. - Keyword arguments: - filter -- FQL query specifying filter parameters. String. - offset -- Starting pagination offset of records to return. String. - limit -- Maximum number of records to return. Integer. - sort -- FQL formatted sort (ex: name.desc,time.asc). String. - If direction is omitted, defaults to descending. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowExecutionsCombined + + Keyword arguments + ----------------- + filter : str + FQL query specifying filter parameters. + offset : str + Starting pagination offset of records to return. + limit : int + Maximum number of records to return. + sort : str + FQL formatted sort (ex: name.desc,time.asc). String. + If direction is omitted, defaults to descending. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -198,20 +239,29 @@ def search_executions(self: object, parameters: dict = None, **kwargs) -> Union[ def search_triggers(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Search workflow triggers based on the provided filter. - Keyword arguments: - filter -- FQL query specifying filter parameters. String. - offset -- Starting pagination offset of records to return. String. - limit -- Maximum number of records to return. Integer. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowTriggersCombined + + Keyword arguments + ----------------- + filter : str + FQL query specifying filter parameters. + offset : str + Starting pagination offset of records to return. + limit : int + Maximum number of records to return. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -229,20 +279,35 @@ def export_definition(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Export a workflow definition for the given definition ID. - Keyword arguments: - id -- ID of workflow definitions to return details for. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - sanitize -- Sanitize PII from workflow before it's exported. Boolean. - - Arguments: When not specified, the first argument to this method is assumed to be 'id'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowDefinitionsExport + + Keyword arguments + ----------------- + id : str + ID of workflow definitions to return details for. + include_mocks : bool + when enabled, includes referenced node-mocks inline in the exported YAML. Each + mock's output_data field is a JSON-encoded string rather than native YAML. + version : int + version of the definition to export (e.g. 0 for draft); omit for active/published. + parameters : dict + Full parameters payload. Not required if using other keywords. + sanitize : bool + Sanitize PII from workflow before it's exported. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'id'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -256,23 +321,33 @@ def export_definition(self: object, def import_definition(self: object, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Import a workflow definition based on the provided model. - Keyword arguments: - data_file -- A workflow definition in YAML format to import. Can be the file location or file contents. - Supports string or binary data. - name -- Workflow name to override. String. - validate_only -- When enabled, prevents saving workflow after validating. Boolean. - include_activity_metadata -- When true, populates the definition model with Activity metadata which includes Activity - Dependency and Vendor. Boolean. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowDefinitionsImport + + Keyword arguments + ----------------- + data_file : bytes + A workflow definition in YAML format to import. Can be the file location or file contents. + Supports string or. + name : str + Workflow name to override. + validate_only : bool + When enabled, prevents saving workflow after validating. + include_activity_metadata : bool + When true, populates the definition model with Activity metadata which includes Activity + Dependency and Vendor. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ data_file = kwargs.get("data_file", None) content_type = "application/x-yaml" @@ -323,24 +398,37 @@ def update_definition(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Update a workflow definition based on the provided model. - Keyword arguments: - validate_only -- When enabled, prevents saving workflow after validating. Boolean. - body -- Full body payload in JSON format, not required when using other keywords. - definition -- Full workflow definition. Dictionary. - change_log -- Optional description to outline changes made during the update. String. - enabled -- Specifies if the new definition should be enabled upon creation. - flight_control -- Flight control parameters. Dictionary. - id -- Used to identify documents across versions. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: PUT Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowDefinitionsUpdate + + Keyword arguments + ----------------- + validate_only : bool + When enabled, prevents saving workflow after validating. + body : dict + Full body payload in JSON format, not required when using other keywords. + definition : dict + Full workflow definition. + change_log : str + Optional description to outline changes made during the update. + enabled : bool + Specifies if the new definition should be enabled upon creation. + flight_control : dict + Flight control parameters. + id : str + Used to identify documents across versions. + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = workflow_definition_payload(passed_keywords=kwargs) @@ -362,32 +450,43 @@ def execute(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Execute an on-demand workflow. Response will contain the execution ID. - Keyword arguments: - body -- full body payload, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowExecute + + Keyword arguments + ----------------- + body : dict + full body payload, not required if using other keywords. { Workflow schema } - definition_id -- Definition ID to execute. Either a name or ID can be specified. - String or List of Strings. - execution_cid -- CID(s) to execute on. This can be a child for Flight Control scenarios. - If unset, the definition CID is used. String or List of strings. - name -- Workflow name to execute. Either a name or ID can be specified. String. - parameters -- Full parameters payload in dictionary (JSON) format. Not required - if you are using other keywords. Dictionary. - key -- Key used to help deduplicate executions. If unset a new UUID is used. String. - depth -- Used to record the execution depth to help limit execution loops when a workflow - triggers another. The maximum depth is 4. Integer. - source_event_url -- Used to record a URL to the source that led to trigger the workflow. - String. + definition_id : str or list[str] + Definition ID to execute. Either a name or ID can be specified. + execution_cid : str or list[str] + CID(s) to execute on. This can be a child for Flight Control scenarios. + If unset, the definition CID is used. + name : str + Workflow name to execute. Either a name or ID can be specified. + parameters : dict + Full parameters payload in dictionary (JSON) format. Not required + if you are using other keywords. + key : str + Key used to help deduplicate executions. If unset a new UUID is used. + depth : int + Used to record the execution depth to help limit execution loops when a workflow + triggers another. The maximum depth is 4. + source_event_url : str + Used to record a URL to the source that led to trigger the workflow. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowExecute + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -406,31 +505,43 @@ def execute_internal(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Execute an on-demand workflow. Response will contain the execution ID. - Keyword arguments: - batch_size -- Used to set the size of the batch. Integer. - body -- full body payload, not required if using other keywords. - {} - definition_id -- Definition ID to execute. Either a name or ID can be specified. - String or List of Strings. - execution_cid -- CID(s) to execute on. This can be a child for Flight Control scenarios. - If unset, the definition CID is used. String or List of strings. - name -- Workflow name to execute. Either a name or ID can be specified. String. - parameters -- Full parameters payload in dictionary (JSON) format. Not required - if you are using other keywords. Dictionary. - key -- Key used to help deduplicate executions. If unset a new UUID is used. String. - depth -- Used to record the execution depth to help limit execution loops when a workflow - triggers another. The maximum depth is 4. Integer. - source_event_url -- Used to record a URL to the source that led to trigger the workflow. - String. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowExecuteInternal + + Keyword arguments + ----------------- + batch_size : int + Used to set the size of the batch. + body : dict + full body payload, not required if using other keywords. + {} + definition_id : str or list[str] + Definition ID to execute. Either a name or ID can be specified. + execution_cid : str or list[str] + CID(s) to execute on. This can be a child for Flight Control scenarios. + If unset, the definition CID is used. + name : str + Workflow name to execute. Either a name or ID can be specified. + parameters : dict + Full parameters payload in dictionary (JSON) format. Not required + if you are using other keywords. + key : str + Key used to help deduplicate executions. If unset a new UUID is used. + depth : int + Used to record the execution depth to help limit execution loops when a workflow + triggers another. The maximum depth is 4. + source_event_url : str + Used to record a URL to the source that led to trigger the workflow. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -449,8 +560,16 @@ def mock_execute(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Execute a workflow definition with mocks. - Keyword arguments: - body -- full body payload, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowMockExecute + + Keyword arguments + ----------------- + body : dict + full body payload, not required if using other keywords. { "definition" { Workflow schema @@ -458,33 +577,38 @@ def mock_execute(self: object, "mocks": "string", "on_demand_trigger": "string" } - definition_id -- Definition ID to execute. Either a name or ID can be specified. - String or List of Strings. - execution_cid -- CID(s) to execute on. This can be a child for Flight Control scenarios. - If unset, the definition CID is used. String or List of strings. - ignore_activity_mock_references -- When enabled, treats all activity mocks in the definition as disabled for this mock - execution. Mocks provided in the request body are treated normally. Boolean. - name -- Workflow name to execute. Either a name or ID can be specified. String. - parameters -- Full parameters payload in dictionary (JSON) format. Not required - if you are using other keywords. Dictionary. - key -- Key used to help deduplicate executions. If unset a new UUID is used. String. - depth -- Used to record the execution depth to help limit execution loops when a workflow - triggers another. The maximum depth is 4. Integer. - skip_validation -- When enabled, skips validating mocks from the request body against the mocked entity's - output schema. Mocks provided in the definition by reference are not validated in any case. - Boolean. - source_event_url -- Used to record a URL to the source that led to trigger the workflow. - String. - validate_only -- PRevent execution after validating mocks against definition. Boolean. + definition_id : str + Definition ID to execute. Either a name or ID can be specified. + execution_cid : str or list[str] + CID(s) to execute on. This can be a child for Flight Control scenarios. + If unset, the definition CID is used. + ignore_activity_mock_references : bool + When enabled, treats all activity mocks in the definition as disabled for this mock + execution. Mocks provided in the request body are treated normally. + name : str + Workflow name to execute. Either a name or ID can be specified. + parameters : dict + Full parameters payload in dictionary (JSON) format. Not required + if you are using other keywords. + key : str + Key used to help deduplicate executions. If unset a new UUID is used. + depth : int + Used to record the execution depth to help limit execution loops when a workflow + triggers another. The maximum depth is 4. + skip_validation : bool + When enabled, skips validating mocks from the request body against the mocked entity's + output schema. Mocks provided in the definition by reference are not validated in any case. + source_event_url : str + Used to record a URL to the source that led to trigger the workflow. + validate_only : bool + PRevent execution after validating mocks against definition. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowMockExecute + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = workflow_mock_payload(passed_keywords=kwargs) @@ -506,11 +630,21 @@ def execution_action(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Allow a user to resume/retry a failed workflow execution. - Keyword arguments: - action_name -- Action to perform. String. - Allowed values: resume - action_parameters -- List of actions to perform. List of dictionaries. - body -- full body payload, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowExecutionsAction + + Keyword arguments + ----------------- + action_name : str + Action to perform. String. + Allowed values: resume + action_parameters : list[dict] + List of actions to perform. + body : dict + full body payload, not required if using other keywords. { "action_parameters": [ { @@ -522,18 +656,19 @@ def execution_action(self: object, "string" ] } - ids -- Execution IDs. String or List of Strings. - name -- For single action parameter actions. Specifies the action parameter name. String. - value -- For single action parameter actions. Specifies the action parameter value. String. + ids : str or list[str] + Execution IDs. + name : str + For single action parameter actions. Specifies the action parameter name. + value : str + For single action parameter actions. Specifies the action parameter value. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowExecutionsAction + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = simple_action_parameter(kwargs, @@ -559,19 +694,28 @@ def execution_results(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Retrieve results for a specified execution. - Keyword arguments: - ids -- Workflow execution ID to retrieve results for. String or List of Strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowExecutionResults + + Keyword arguments + ----------------- + ids : str or list[str] + Workflow execution ID to retrieve results for. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -589,19 +733,28 @@ def get_human_input(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Get one or more specific human inputs by their IDs. - Keyword arguments: - ids -- IDs of human inputs to read. String or List of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowGetHumanInputV1 + + Keyword arguments + ----------------- + ids : str or list[str] + IDs of human inputs to read. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -622,25 +775,35 @@ def update_human_input(self: object, Provides an input in response to a human input action. Depending on action configuration, one or more of Approve, Decline, and/or Escalate are permitted. - Keyword arguments: - body -- Full body payload in JSON format, not required when using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowUpdateHumanInputV1 + + Keyword arguments + ----------------- + body : dict + Full body payload in JSON format, not required when using other keywords. { "input": "string", "note": "string" } - id -- ID of human input to provide an input to. String. - input -- Input to insert. String. - note -- Optional note to append. String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. + id : str + ID of human input to provide an input to. + input : str + Input to insert. + note : str + Optional note to append. + parameters : dict + Full parameters payload. Not required if using other keywords. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowUpdateHumanInputV1 + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = workflow_human_input(passed_keywords=kwargs) @@ -658,27 +821,33 @@ def update_human_input(self: object, def deprovision(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Deprovision a system definition that was previously provisioned on a target CID. - Keyword arguments: - body -- full body payload, not required if using other keywords. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowSystemDefinitionsDeProvision + + Keyword arguments + ----------------- + body : dict + full body payload, not required if using other keywords. { "definition_id": "string", "deprovision_all": boolean, "template_id": "string", "template_name": "string" } - definition_id -- String. - deprovision_all -- Boolean. - template_id -- String. - template_name -- String. + definition_id : str + deprovision_all : bool + template_id : str + template_name : str This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowSystemDefinitionsDeProvision + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = workflow_deprovision_payload(passed_keywords=kwargs) @@ -700,9 +869,17 @@ def promote(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[ multi-instance, the customer scope definition ID must be supplied to determine which customer workflow should be update. - Keyword arguments: - activities -- Dictionary. - body -- Template to use for update. Not required if using other keywords. Dictionary. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowSystemDefinitionsPromote + + Keyword arguments + ----------------- + activities : dict + body : dict + Template to use for update. Not required if using other keywords. { "customer_definition_id": "string", "name": "string", @@ -742,23 +919,22 @@ def promote(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[ "template_name": "string", "template_version": "string" } - conditions -- List of dictionaries. - customer_definition_id -- String. - name -- String. - parameters -- Dictionary. Overrides specified activities, conditions and trigger keywords. - template_id -- String. - template_name -- String. - template_version -- String. - trigger -- Dictionary. + conditions : list[dict] + customer_definition_id : str + name : str + parameters : dict + Dictionary. Overrides specified activities, conditions and trigger keywords. + template_id : str + template_name : str + template_version : str + trigger : dict This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowSystemDefinitionsPromote + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = workflow_template_payload(passed_keywords=kwargs) @@ -775,9 +951,17 @@ def promote(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[ def provision(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Provision a system definition onto the target CID by using the template and provided parameters. - Keyword arguments: - activities -- Dictionary. - body -- Template to provision. Not required if using other keywords. Dictionary. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowSystemDefinitionsProvision + + Keyword arguments + ----------------- + activities : dict + body : dict + Template to provision. Not required if using other keywords. { "name": "string", "parameters": { @@ -816,23 +1000,26 @@ def provision(self: object, body: dict = None, **kwargs) -> Union[Dict[str, Unio "template_name": "string", "template_version": "string" } - conditions -- List of dictionaries. - name -- Optional name to be set on the customer scope definition. Must be unique within a given CID. String. - parameters -- Runtime parameters to be interpolated to template model. Dictionary. - Overrides specified activities, conditions and trigger keywords. - template_id -- ID of the system definition template that was previously created. String. - template_name -- Name of the system definition template to provision. String. - template_version -- Version of system definition template, if omitted the latest version will be used. String. - trigger -- Dictionary. + conditions : list[dict] + name : str + Optional name to be set on the customer scope definition. Must be unique within a given CID. + parameters : dict + Runtime parameters to be interpolated to template model. Dictionary. + Overrides specified activities, conditions and trigger keywords. + template_id : str + ID of the system definition template that was previously created. + template_name : str + Name of the system definition template to provision. + template_version : str + Version of system definition template, if omitted the latest version will be used. + trigger : dict This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowSystemDefinitionsProvision + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = workflow_template_payload(passed_keywords=kwargs) @@ -855,26 +1042,35 @@ def workflow_definition_action(self: object, When a definition is disabled it will not execute against any new trigger events. - Keyword arguments: - action_name -- action to perform, 'enable', 'disable', or 'cancel'. - body -- full body payload, not required if ids are provided as keyword. - You must use body if you are going to specify action_parameters. + HTTP Method: POST + + Swagger URL + ----------- + https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowDefinitionsAction + + Keyword arguments + ----------------- + action_name : str + action to perform, 'enable', 'disable', or 'cancel'. + body : dict + full body payload, not required if ids are provided as keyword. + You must use body if you are going to specify action_parameters. { "ids": [ "string" ] } - ids -- IDs of workflow definitions to perform the action against. String or list of strings. - parameters - full parameters payload, not required if action_name is provide as a keyword. + ids : str or list[str] + IDs of workflow definitions to perform the action against. + parameters : dict + full parameters payload, not required if action_name is provide as a keyword. This method only supports keywords for providing arguments. - Returns: dict object containing API response. - - HTTP Method: POST - - Swagger URL - https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowDefinitionsAction + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = generic_payload_list(submitted_keywords=kwargs, payload_value="ids") @@ -901,28 +1097,40 @@ def execute_single_activity_node(self: object, Results in an execution where test_mode=true and single_node_execution=true, associated with a definition ID if provided. - Keyword arguments: - execution_cid -- CID(s) to execute on. String or list of strings. - This can be a child if this is a flight control enabled definition. - definition_id -- Definition ID to execute. String. - name -- Workflow name to execute. String. - Either a name or an ID, or the definition itself in the request body, can be specified. - key -- Key used to help deduplicate executions, if unset a new UUID is used. String. - depth -- Used to record the execution depth to help limit execution loops when a workflow triggers another. Integer. - The maximum depth is 4. - body -- full body payload, not required if ids are provided as keyword. - Please visit the Swagger URL to view the full payload. It's long. - definition -- Dictionary. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: POST Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowExecuteSingleNodeV1 + + Keyword arguments + ----------------- + execution_cid : str or list[str] + CID(s) to execute on. String or list of strings. + This can be a child if this is a flight control enabled definition. + definition_id : str + Definition ID to execute. + name : str + Workflow name to execute. String. + Either a name or an ID, or the definition itself in the request body, can be specified. + key : str + Key used to help deduplicate executions, if unset a new UUID is used. + depth : int + Used to record the execution depth to help limit execution loops when a workflow triggers another. Integer. + The maximum depth is 4. + body : dict + full body payload, not required if ids are provided as keyword. + Please visit the Swagger URL to view the full payload. It's long. + definition : dict + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ if not body: body = {} @@ -944,21 +1152,31 @@ def query_child_executions(self: object, parameters: dict = None, **kwargs) -> U Returns the set of child workflow execution IDs which match the filter criteria. - Keyword arguments: - filter -- FQL query specifying filter parameters. String. - offset -- Starting pagination offset of records to return. String. - limit -- Maximum number of records to return. Integer. - sort -- Sort items by providing a comma separated list of property and direction (eg name.desc,time.asc). String. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/v1.child-executions.query + + Keyword arguments + ----------------- + filter : str + FQL query specifying filter parameters. + offset : str + Starting pagination offset of records to return. + limit : int + Maximum number of records to return. + sort : str + Sort items by providing a comma separated list of property and direction (eg name.desc,time.asc) + parameters : dict + Full parameters payload. Not required if using other keywords. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -976,19 +1194,28 @@ def workflow_definitions_delete(self: object, ) -> Union[Dict[str, Union[int, dict]], Result]: """Accept a list of workflow definition IDs and deletes those definitions and all their associated versions. - Keyword arguments: - ids -- IDs of the workflow definitions to delete String or list of strings. - parameters -- Full parameters payload dictionary. Not required if using other keywords. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: dict object containing API response. - HTTP Method: DELETE Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/workflows/WorkflowDefinitionsDelete + + Keyword arguments + ----------------- + ids : str or list[str] + IDs of the workflow definitions to delete. + parameters : dict + Full parameters payload. Not required if using other keywords. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/src/falconpy/workflows.pyi b/src/falconpy/workflows.pyi index bc37814f2..6870a047a 100644 --- a/src/falconpy/workflows.pyi +++ b/src/falconpy/workflows.pyi @@ -61,6 +61,8 @@ class Workflows(ServiceClass): *args: Union[str, List[str]], id: Optional[str] = None, sanitize: Optional[bool] = None, + include_mocks: Optional[bool] = None, + version: Optional[int] = None, parameters: Optional[dict] = None, ) -> Union[Dict[str, Union[int, dict]], Result]: ... diff --git a/src/falconpy/zero_trust_assessment.py b/src/falconpy/zero_trust_assessment.py index 4b729069e..505abc86d 100644 --- a/src/falconpy/zero_trust_assessment.py +++ b/src/falconpy/zero_trust_assessment.py @@ -59,20 +59,28 @@ class ZeroTrustAssessment(ServiceClass): def get_assessment(self: object, *args, parameters: dict = None, **kwargs) -> Union[Dict[str, Union[int, dict]], Result]: """Get Zero Trust Assessment data for one or more hosts by providing agent IDs (AID). - Keyword arguments: - ids -- One or more agent IDs, which you can find in the data.zta file, - or the Falcon console. String or list of strings. - parameters - full parameters payload, not required if ids is provided as a keyword. - - Arguments: When not specified, the first argument to this method is assumed to be 'ids'. - All others are ignored. - - Returns: binary object on SUCCESS, dict object containing API response on FAILURE. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/zero-trust-assessment/getAssessmentV1 + + Keyword arguments + ----------------- + ids : str or list[str] + One or more agent IDs, which you can find in the data.zta file, + or the Falcon console. + parameters : dict + full parameters payload, not required if ids is provided as a keyword. + + Arguments + --------- + When not specified, the first argument to this method is assumed to be 'ids'. + All others are ignored. + + Returns + ------- + binary object on SUCCESS, dict object containing API response on FAILURE. """ return process_service_request( calling_object=self, @@ -87,12 +95,20 @@ def get_audit(self: object) -> Union[Dict[str, Union[int, dict]], Result]: This method does not accept arguments. - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/zero-trust-assessment/getAuditV1 + + Keyword arguments + ----------------- + This method does not accept keyword arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, @@ -104,24 +120,33 @@ def get_audit(self: object) -> Union[Dict[str, Union[int, dict]], Result]: def get_assessments_by_score(self: object, parameters: dict = None, **kwargs) -> dict: """Get Zero Trust Assessment data for one or more hosts by providing a customer ID (CID) and a range of scores. - Keyword arguments: - after - Pagination token used with the limit parameter to manage pagination of results. - On your first request, do not provide an after token. On subsequent requests, - provide the after token from the previous response to continue from that place - in the resultset. String. - filter - FQL formatted query specifying the filter to apply to the search. String. - limit - The number of scores to return in this response. Integer. - Min: 1, Max: 1,000, Default: 100 - parameters - Full parameters payload provided as a JSON dictionary. - - This method only supports keywords for providing arguments. - - Returns: dict object containing API response. - HTTP Method: GET Swagger URL + ----------- https://assets.falcon.crowdstrike.com/support/api/swagger.html#/zero-trust-assessment/getAssessmentsByScoreV1 + + Keyword arguments + ----------------- + after : str + Pagination token used with the limit parameter to manage pagination of results. + On your first request, do not provide an after token. On subsequent requests, + provide the after token from the previous response to continue from that place + in the resultset. + filter : str + FQL formatted query specifying the filter to apply to the search. + limit : int + The number of scores to return in this response. Integer. + Min: 1, Max: 1,000, Default: 100 + parameters : dict + Full parameters payload provided as a JSON. + + This method only supports keywords for providing arguments. + + Returns + ------- + dict + Dictionary object containing API response. """ return process_service_request( calling_object=self, diff --git a/tests/test_agent_invocation.py b/tests/test_agent_invocation.py new file mode 100644 index 000000000..69bbef432 --- /dev/null +++ b/tests/test_agent_invocation.py @@ -0,0 +1,33 @@ +# test_agent_invocation.py +# This class tests the agent_invocation service class + +import os +import sys + +from tests import test_authorization as Authorization + +sys.path.append(os.path.abspath('src')) +from falconpy import AgentInvocation + +auth = Authorization.TestAuthorization() +config = auth.getConfigObject() +falcon = AgentInvocation(auth_object=config) +AllowedResponses = [200, 201, 207, 400, 403, 404, 429] + + +class TestAgentInvocation: + def test_all_code_paths(self): + error_checks = True + tests = { + "InvokePublishedAgentExternalV1": falcon.invoke_published_agent_external_v1(credit_cents_limit="string", + deadline_seconds="string", + id="string", messages="string"), + "GetAgentInvocationV3": falcon.get_agent_invocation_v3(id="12345678"), + "InvokeAgentVersionExternalV1": falcon.invoke_agent_version_external_v1(credit_cents_limit="string", + deadline_seconds="string", id="string", + messages="string", version_id="string"), + } + for key in tests: + if tests[key]["status_code"] not in AllowedResponses: + error_checks = False + assert error_checks diff --git a/tests/test_agent_templates.py b/tests/test_agent_templates.py new file mode 100644 index 000000000..7ab1dca27 --- /dev/null +++ b/tests/test_agent_templates.py @@ -0,0 +1,28 @@ +# test_agent_templates.py +# This class tests the agent_templates service class + +import os +import sys + +from tests import test_authorization as Authorization + +sys.path.append(os.path.abspath('src')) +from falconpy import AgentTemplates + +auth = Authorization.TestAuthorization() +config = auth.getConfigObject() +falcon = AgentTemplates(auth_object=config) +AllowedResponses = [200, 201, 207, 400, 403, 404, 429] + + +class TestAgentTemplates: + def test_all_code_paths(self): + error_checks = True + tests = { + "EntitiesAgentTemplatesV1": falcon.entities_agent_templates_v1(ids="12345678"), + "QueriesAgentTemplatesV1": falcon.queries_agent_templates_v1(offset=1, limit=1, filter="string", sort="string"), + } + for key in tests: + if tests[key]["status_code"] not in AllowedResponses: + error_checks = False + assert error_checks diff --git a/tests/test_agent_versions.py b/tests/test_agent_versions.py new file mode 100644 index 000000000..95b8093ce --- /dev/null +++ b/tests/test_agent_versions.py @@ -0,0 +1,28 @@ +# test_agent_versions.py +# This class tests the agent_versions service class + +import os +import sys + +from tests import test_authorization as Authorization + +sys.path.append(os.path.abspath('src')) +from falconpy import AgentVersions + +auth = Authorization.TestAuthorization() +config = auth.getConfigObject() +falcon = AgentVersions(auth_object=config) +AllowedResponses = [200, 201, 207, 400, 403, 404, 429] + + +class TestAgentVersions: + def test_all_code_paths(self): + error_checks = True + tests = { + "GetAgentVersionsV1": falcon.get_agent_versions_v1(ids="12345678"), + "QueryAgentVersionsV1": falcon.query_agent_versions_v1(offset=1, limit=1, sort="string", filter="string"), + } + for key in tests: + if tests[key]["status_code"] not in AllowedResponses: + error_checks = False + assert error_checks diff --git a/tests/test_api_request.py b/tests/test_api_request.py index 52614eed2..c84e4dff0 100644 --- a/tests/test_api_request.py +++ b/tests/test_api_request.py @@ -24,6 +24,7 @@ log_api_activity, log_api_payloads, perform_request, + sanitize_dictionary, ) auth = Authorization.TestAuthorization() @@ -241,3 +242,49 @@ def test_perform_request_ssl_disabled_warning_with_logging(self): ) logger.removeHandler(handler) assert result is not None + + +class TestSanitizeDictionary: + """Cover _util/_functions.py sanitize_dictionary redaction and truncation.""" + + def test_resources_list_is_truncated_to_record_max(self): + """A resources list must be trimmed to the requested record maximum.""" + dirty = {"body": {"resources": [f"record{idx}" for idx in range(10)]}} + cleaned = sanitize_dictionary(dirty, record_max=3) + assert cleaned["body"]["resources"] == ["record0", "record1", "record2"] + + def test_resources_list_keeps_at_least_one_record(self): + """A record maximum below one must still retain a single record.""" + dirty = {"body": {"resources": ["only", "extra"]}} + cleaned = sanitize_dictionary(dirty, record_max=0) + assert cleaned["body"]["resources"] == ["only"] + + def test_non_list_resources_are_left_alone(self): + """Resources that are not a list must not be truncated.""" + dirty = {"body": {"resources": {"key": "value"}}} + cleaned = sanitize_dictionary(dirty, record_max=1) + assert cleaned["body"]["resources"] == {"key": "value"} + + def test_empty_resources_list_is_left_alone(self): + """An empty resources list must be returned untouched.""" + cleaned = sanitize_dictionary({"body": {"resources": []}}, record_max=1) + assert cleaned["body"]["resources"] == [] + + def test_credentials_and_authorization_are_redacted(self): + """Confidential keys must be redacted at the top level and within the body.""" + dirty = { + "client_id": "real_id", + "client_secret": "real_secret", + "Authorization": "Bearer real_token", + "body": {"access_token": "real_token", "resources": ["kept"]}, + } + cleaned = sanitize_dictionary(dirty, record_max=5) + assert cleaned["client_id"] == "REDACTED" + assert cleaned["client_secret"] == "REDACTED" + assert cleaned["Authorization"] == "Bearer REDACTED" + assert cleaned["body"]["access_token"] == "REDACTED" + assert cleaned["body"]["resources"] == ["kept"] + + def test_non_dictionary_input_is_returned_unchanged(self): + """A non-dictionary argument must pass straight through.""" + assert sanitize_dictionary("plain string") == "plain string" diff --git a/tests/test_authentications.py b/tests/test_authentications.py index ef1c0c03e..86720ac7f 100644 --- a/tests/test_authentications.py +++ b/tests/test_authentications.py @@ -411,6 +411,25 @@ def test_confirm_base_url_none_raises(self): except InvalidBaseURL: pass + def test_confirm_base_url_accepts_dashed_region_names(self): + """Every region name must resolve identically with and without dashes.""" + dashed = { + "us-1": "US1", + "us-2": "US2", + "us-3": "US3", + "eu-1": "EU1", + "us-gov-1": "USGOV1", + "us-gov-2": "USGOV2", + } + for name, undashed in dashed.items(): + assert confirm_base_url_func(name) == confirm_base_url_func(undashed) + + def test_confirm_base_url_dashed_region_is_case_insensitive(self): + """A dashed region name must resolve regardless of case.""" + expected = "https://api.us-3.crowdstrike.com" + for variant in ["us-3", "US-3", "Us-3", "uS-3"]: + assert confirm_base_url_func(variant) == expected + def test_deprecated_operation_with_log(self): """deprecated_operation non-pythonic with logger.""" logger = logging.getLogger("test_deprecated_op") diff --git a/tests/test_case_management.py b/tests/test_case_management.py index 75e58e7f6..ef480dbed 100644 --- a/tests/test_case_management.py +++ b/tests/test_case_management.py @@ -126,7 +126,8 @@ def test_all_code_paths(self): "multivalued": True, "default_value": "1234567", "options": [{"id": "1234567", "value": "whatever"}], - "required": True + "required": True, + "entities_merge_post_v1": falcon.entities_merge_post_v1(destination_id="string", source_id="string"), } ), "entities_templates_delete_v1": falcon.delete_templates(ids="1234567890"), diff --git a/tests/test_cloud_security_detections.py b/tests/test_cloud_security_detections.py index 3afd79e9b..bd2fa7109 100644 --- a/tests/test_cloud_security_detections.py +++ b/tests/test_cloud_security_detections.py @@ -25,7 +25,8 @@ def test_all_code_paths(self): tests = { "cspm_evaluations_iom_entities": falcon.get_iom_entities(ids = "1234567"), "cspm_evaluations_iom_queries": falcon.query_iom_entities(), - "cspm_evaluations_combined_iom_by_rule": falcon.cspm_evaluations_combined_iom_by_rule() + "cspm_evaluations_combined_iom_by_rule": falcon.cspm_evaluations_combined_iom_by_rule(), + "cspm_evaluations_iom_entities_post": falcon.cspm_evaluations_iom_entities_post(ids="string"), } for key in tests: if tests[key]["status_code"] not in AllowedResponses: diff --git a/tests/test_correlation_rules_admin.py b/tests/test_correlation_rules_admin.py index 3afdc8e10..279337d7a 100644 --- a/tests/test_correlation_rules_admin.py +++ b/tests/test_correlation_rules_admin.py @@ -27,7 +27,9 @@ def test_all_code_paths(self): id="rule123", user_id="user456", user_uuid="uuid789" - ) + ), + "entities_rules_ownership_put_v2": falcon.entities_rules_ownership_put_v2(api_client_id="string", ids="string", + user_id="string", user_uuid="string"), } for key in tests: if tests[key]["status_code"] not in AllowedResponses: diff --git a/tests/test_data_protection_configuration.py b/tests/test_data_protection_configuration.py index 6a8c141b5..a93790422 100644 --- a/tests/test_data_protection_configuration.py +++ b/tests/test_data_protection_configuration.py @@ -190,7 +190,17 @@ def test_all_code_paths(self): filter="name:'test'", limit=50, offset=0 - ) + ), + "entities_web_location_group_create": falcon.entities_web_location_group_create(description="string", + name="string", + web_location_ids="string"), + "entities_web_location_group_delete": falcon.entities_web_location_group_delete(ids="12345678"), + "entities_web_location_group_get": falcon.entities_web_location_group_get(ids="12345678"), + "entities_web_location_group_patch": falcon.entities_web_location_group_patch(id="string", description="string", + name="string", + web_location_ids="string"), + "queries_web_location_group_get": falcon.queries_web_location_group_get(filter="string", type="string", + sort="string", limit=1, offset=1), } for key in tests: if tests[key]["status_code"] not in AllowedResponses: diff --git a/tests/test_foundry_lookup_files.py b/tests/test_foundry_lookup_files.py index 4ba3c3d08..7a0ce96d4 100644 --- a/tests/test_foundry_lookup_files.py +++ b/tests/test_foundry_lookup_files.py @@ -12,7 +12,7 @@ auth = Authorization.TestAuthorization() config = auth.getConfigObject() falcon = FoundryLookupFiles(auth_object=config) -AllowedResponses = [200, 201, 207, 400, 401, 403, 404, 429, 500] +AllowedResponses = [200, 201, 207, 400, 401, 403, 404, 415, 429, 500] class TestFoundryLookupFiles: @@ -45,4 +45,6 @@ def test_all_code_paths(self): for key in tests: if tests[key]["status_code"] not in AllowedResponses: error_checks = False + # print(f"\n{key}\n") + # print(tests[key]) assert error_checks diff --git a/tests/test_kubernetes_protection.py b/tests/test_kubernetes_protection.py index 38ec0fadc..dd6aa8324 100644 --- a/tests/test_kubernetes_protection.py +++ b/tests/test_kubernetes_protection.py @@ -87,7 +87,12 @@ def serviceKubeProtect_RunAllTests(self): "ReadNamespaceCount": falcon.read_namespace_count(filter="something"), "ReadClusterCombinedV2": falcon.read_clusters_combined_v2(filter="whatever"), "PostSearchKubernetesIOMEntities": falcon.search_kubernetes_ioms(limit=1), - "PostSearchKubernetesIOMEntitiesWithParams": falcon.search_kubernetes_ioms(pit="whatever", search_after="whatever") + "PostSearchKubernetesIOMEntitiesWithParams": falcon.search_kubernetes_ioms(pit="whatever", search_after="whatever"), + "PostAggregatesPods": falcon.post_aggregates_pods(date_ranges=[{"from": "string", "to": "string"}], + field="string", filter="string", interval="string", + min_doc_count=0, missing="string", name="string", q="string", + ranges=[{"From": 0, "To": 0}], size=0, sort="string", + sub_aggregates=["string"], time_zone="string", type="string"), } for key in tests: diff --git a/tests/test_ml_exclusions.py b/tests/test_ml_exclusions.py index 4aea16f44..a456e4a13 100644 --- a/tests/test_ml_exclusions.py +++ b/tests/test_ml_exclusions.py @@ -45,6 +45,13 @@ def serviceMLE_GenerateErrors(self): excluded_from="banana,apples" ), "delete_exclusion": falcon.delete_exclusions(ids="12345678"), + "exclusions_sdmf_query_v1": falcon.exclusions_sdmf_query_v1(id="string", nodes="string", res_id="string", + deadline="string", duration="string", + execution_context="string", + execution_details="string", + is_export_request="string", pagination_info="string", + partial_results="string", query_stats="string", + store_headers="string"), } for key in tests: if tests[key]["status_code"] not in AllowedResponses: @@ -135,6 +142,48 @@ def serviceMLE_V2Exclusions(self): return error_checks + def serviceMLE_EmptyLists(self): + error_checks = True + tests = { + "update_exclusion_empty_groups": falcon.update_exclusions( + comment="Unit Testing", + groups=[], + id="12345678", + value="Bananas" + ), + "update_exclusion_empty_excluded_from": falcon.update_exclusions( + comment="Unit Testing", + excluded_from=[], + id="12345678", + value="Bananas" + ), + "update_ml_exclusions_empty_groups": falcon.update_ml_exclusions( + comment="Unit Testing", + groups=[], + id="12345678", + value="test" + ), + "update_ml_exclusions_false_descendant": falcon.update_ml_exclusions( + comment="Unit Testing", + id="12345678", + is_descendant_process=False, + value="test" + ), + "update_exclusions_v2_empty_groups": falcon.update_exclusions_v2( + comment="Unit Testing", + groups=[], + id="12345678", + value="test" + ), + } + for key in tests: + if tests[key]["status_code"] not in AllowedResponses: + error_checks = False + # print(f"{key} failed with status {tests[key]['status_code']}") + # print(tests[key]) + + return error_checks + def test_Find(self): assert self.serviceMLE_ListExclusions() is True @@ -143,3 +192,6 @@ def test_Errors(self): def test_V2Exclusions(self): assert self.serviceMLE_V2Exclusions() is True + + def test_EmptyLists(self): + assert self.serviceMLE_EmptyLists() is True diff --git a/tests/test_models.py b/tests/test_models.py new file mode 100644 index 000000000..e6ad6311a --- /dev/null +++ b/tests/test_models.py @@ -0,0 +1,28 @@ +# test_models.py +# This class tests the models service class + +import os +import sys + +from tests import test_authorization as Authorization + +sys.path.append(os.path.abspath('src')) +from falconpy import Models + +auth = Authorization.TestAuthorization() +config = auth.getConfigObject() +falcon = Models(auth_object=config) +AllowedResponses = [200, 201, 207, 400, 403, 404, 429] + + +class TestModels: + def test_all_code_paths(self): + error_checks = True + tests = { + "EntitiesModelsV1": falcon.entities_models_v1(ids="12345678"), + "QueriesModelsV1": falcon.queries_models_v1(offset=1, limit=1, filter="string"), + } + for key in tests: + if tests[key]["status_code"] not in AllowedResponses: + error_checks = False + assert error_checks diff --git a/tests/test_ngsiem.py b/tests/test_ngsiem.py index bd6c1e19e..33346195e 100644 --- a/tests/test_ngsiem.py +++ b/tests/test_ngsiem.py @@ -67,6 +67,24 @@ def run_all_tests(self): pre_processing_script="string", test_cases="string"), "UpdateParserExtension": falcon.update_parser_extension(extension_id="string", post_processing_script="string", pre_processing_script="string", test_cases="string"), + "addDashboardLabels": falcon.add_dashboard_labels(id="string", labels="string", search_domain="string"), + "addFileLabels": falcon.add_file_labels(filename="string", labels="string", search_domain="string"), + "addSavedQueryLabels": falcon.add_saved_query_labels(id="string", labels="string", search_domain="string"), + "bulkAddDashboardLabels": falcon.bulk_add_dashboard_labels(items="string", search_domain="string"), + "bulkAddLookupFileLabels": falcon.bulk_add_lookup_file_labels(items="string", search_domain="string"), + "bulkAddSavedQueryLabels": falcon.bulk_add_saved_query_labels(items="string", search_domain="string"), + "bulkRemoveDashboardLabels": falcon.bulk_remove_dashboard_labels(items="string", search_domain="string"), + "bulkRemoveLookupFileLabels": falcon.bulk_remove_lookup_file_labels(items="string", search_domain="string"), + "bulkRemoveSavedQueryLabels": falcon.bulk_remove_saved_query_labels(items="string", search_domain="string"), + "bulkUpdateDashboardLabels": falcon.bulk_update_dashboard_labels(items="string", search_domain="string"), + "bulkUpdateLookupFileLabels": falcon.bulk_update_lookup_file_labels(items="string", search_domain="string"), + "bulkUpdateSavedQueryLabels": falcon.bulk_update_saved_query_labels(items="string", search_domain="string"), + "removeDashboardLabels": falcon.remove_dashboard_labels(), + "removeFileLabels": falcon.remove_file_labels(), + "removeSavedQueryLabels": falcon.remove_saved_query_labels(), + "updateDashboardLabels": falcon.update_dashboard_labels(id="string", labels="string", search_domain="string"), + "updateFileLabels": falcon.update_file_labels(filename="string", labels="string", search_domain="string"), + "updateSavedQueryLabels": falcon.update_saved_query_labels(id="string", labels="string", search_domain="string"), } for key in tests: if tests[key]["status_code"] not in AllowedResponses: @@ -390,3 +408,43 @@ def test_upload_file_non_response(self, monkeypatch): monkeypatch.setattr(ngsiem_mod, "process_service_request", lambda **kw: error_dict) result = falcon.upload_file(repository="search-all", lookup_file="tests/testfile.csv") assert result["status_code"] == 403 + + +class TestNGSIEMStartSearchBody: + """Confirm start_search honors the documented body keyword. Closes #1491.""" + + SEARCH = {"queryString": "#repo=fusion | head(1)", "start": "24h", "isLive": False} + + @staticmethod + def _capture(monkeypatch): + """Intercept process_service_request, recording the body it receives.""" + import falconpy.ngsiem as ngsiem_mod + + captured = {} + + def fake_request(**kwargs): + captured.update(kwargs) + return {"status_code": 200, "body": {"id": "job-1"}, "headers": {}} + + monkeypatch.setattr(ngsiem_mod, "process_service_request", fake_request) + return captured + + def test_body_keyword_reaches_the_api(self, monkeypatch): + """body= used to short-circuit into a local error without issuing a request.""" + captured = self._capture(monkeypatch) + result = falcon.start_search(repository="search-all", body=self.SEARCH) + assert captured["body"] == self.SEARCH + assert result["status_code"] == 200 + + def test_search_keyword_still_works(self, monkeypatch): + """The pre-existing search= path must be unaffected.""" + captured = self._capture(monkeypatch) + result = falcon.start_search(repository="search-all", search=self.SEARCH) + assert captured["body"] == self.SEARCH + assert result["status_code"] == 200 + + def test_neither_keyword_still_errors(self, monkeypatch): + """With no payload and no keywords, the local 500 is still correct.""" + self._capture(monkeypatch) + result = falcon.start_search(repository="search-all") + assert result["status_code"] == 500 diff --git a/tests/test_path_encoding.py b/tests/test_path_encoding.py new file mode 100644 index 000000000..198b76b13 --- /dev/null +++ b/tests/test_path_encoding.py @@ -0,0 +1,109 @@ +# test_path_encoding.py +# Tests URL path-segment encoding for caller-supplied path parameters. +# +# Path parameters are declared as a single path segment in the endpoint tables. +# A value containing a forward slash or a dot-segment sequence must not be able +# to introduce additional segments, because requests/urllib3 normalize the path +# before transmission and would otherwise retarget the call to a different route +# under the same host, method and authentication token. Closes #1488. +# +# These tests are fully mocked -- no live credentials and no network access. +import os +import sys +from requests import Request +# Import our sibling src folder into the path +sys.path.append(os.path.abspath('src')) +# flake8: noqa=E402 +from falconpy import APIHarness +from falconpy._util import encode_path_segment +from falconpy._util._functions import handle_path_variables +from falconpy._util._uber import scrub_target + +# A value documented as one object identifier that tries to escape its segment. +TRAVERSAL = "../integration_tasks/9" +ASPM_ROUTE = "https://api.example/aspm-api-gateway/api/v1/group/{}" + + +def wire_url(built: str) -> str: + """Return the URL requests would actually transmit, after normalization.""" + return Request("DELETE", built).prepare().url + + +class TestEncodePathSegment: + """Cover the encode_path_segment helper directly.""" + + def test_benign_identifiers_are_unchanged(self): + """Unreserved identifiers must survive byte-for-byte.""" + for benign in ["9", "abc-123", "0f7a2b9c4e5d6a7b8c9d0e1f2a3b4c5d"]: + assert encode_path_segment(benign) == benign + + def test_integers_are_coerced_without_encoding(self): + """Numeric identifiers stringify cleanly.""" + assert encode_path_segment(9) == "9" + assert encode_path_segment(0) == "0" + + def test_separators_are_escaped(self): + """A slash must not survive as a path separator.""" + assert encode_path_segment("a/b") == "a%2Fb" + assert encode_path_segment(TRAVERSAL) == "..%2Fintegration_tasks%2F9" + + def test_braces_are_escaped(self): + """Braces must not survive into a subsequent str.format call.""" + assert encode_path_segment("{evil}") == "%7Bevil%7D" + + +class TestServiceClassPathEncoding: + """handle_path_variables is the Service Class chokepoint.""" + + def test_benign_value_is_unchanged(self): + assert handle_path_variables({"path_id": "9"}, ASPM_ROUTE).endswith("/group/9") + + def test_traversal_stays_within_its_segment(self): + built = handle_path_variables({"path_id": TRAVERSAL}, ASPM_ROUTE) + assert "/group/" in wire_url(built) + assert not wire_url(built).endswith("/api/v1/integration_tasks/9") + + def test_partition_zero_is_still_interpolated(self): + """Zero is falsy but a legitimate partition value.""" + built = handle_path_variables({"partition": 0}, "https://api.example/streams/{}") + assert built.endswith("/streams/0") + + +class TestUberPathEncoding: + """scrub_target covers both the single-field and multi-field branches.""" + + def test_traversal_stays_within_its_segment(self): + built = scrub_target("DeleteGroup", ASPM_ROUTE, {"id": TRAVERSAL}) + assert "/group/" in wire_url(built) + + def test_multi_field_object_key_cannot_escape(self): + route = ("https://api.example/customobjects/v1/collections" + "/{collection_name}/objects/{object_key}") + built = scrub_target("GetObject", route, + {"collection_name": "c", "object_key": "../../schemas/v1"}) + assert "/objects/" in wire_url(built) + + +class TestLegacyHarnessPathEncoding: + """The legacy APIHarness interpolates path variables in its own handlers.""" + + def setup_method(self): + self.falcon = APIHarness(client_id="testing", client_secret="testing") + + def test_image_id_cannot_escape(self): + built = self.falcon._handle_container_image_id( + "https://api.example/container/images/{}", {"image_id": "../../v1/admin"} + ) + assert "/images/" in wire_url(built) + + def test_partition_cannot_escape(self): + built = self.falcon._handle_partition( + "https://api.example/streams/partition/{}", {"partition": "../../v1/admin"} + ) + assert "/partition/" in wire_url(built) + + def test_distinct_field_cannot_escape(self): + built = self.falcon._handle_distinct_field( + "https://api.example/policy/distinct/{}", {"distinct_field": "../../v1/admin"} + ) + assert "/distinct/" in wire_url(built) diff --git a/tests/test_result_object.py b/tests/test_result_object.py index 9920bc5eb..cba8bbe46 100644 --- a/tests/test_result_object.py +++ b/tests/test_result_object.py @@ -827,3 +827,88 @@ def test_base_result_next_returns_value(self): ) val = next(r) assert val == "item1" + + +def _static_result() -> Result: + """Build a Result from a fixed payload, with no API call involved.""" + return Result( + status_code=200, + headers={"Content-Type": "application/json"}, + body={ + "meta": {"trace_id": "abc"}, + "resources": ["alpha", "beta", "gamma"], + "errors": [] + } + ) + + +class TestResultContainerHelpers: + """Cover the Result and BaseResource container helpers without a live API call. + + The equivalent tests above build their Result from a live query_devices_by_filter + response, so they are skipped whenever that call is unavailable or rate limited. + These construct the payload directly so the code paths are always exercised. + """ + + def test_reverse_iteration(self): + """Result.__reversed__ must walk the resources list backwards.""" + assert list(reversed(_static_result())) == ["gamma", "beta", "alpha"] + + def test_getitem_by_position(self): + """Result.__getitem__ must index into the resources list.""" + result = _static_result() + assert result[0] == "alpha" + assert result[1] == "beta" + + def test_contains_is_an_exact_match(self): + """Result.__contains__ matches whole entries, not substrings.""" + result = _static_result() + assert "beta" in result + assert "bet" not in result + + def test_prune_returns_substring_matches(self): + """Result.prune returns entries containing the search string.""" + assert _static_result().prune("bet") == ["beta"] + + def test_resources_contains_filters_on_substring(self): + """Resources.contains is the substring filter behind prune.""" + assert _static_result().resources.contains("a") == ["alpha", "beta", "gamma"] + + def test_resources_contains_with_no_matches(self): + """A search string that matches nothing returns an empty list.""" + assert _static_result().resources.contains("zeta") == [] + + def test_base_resource_getitem_and_reversed(self): + """BaseResource exposes positional access and reverse iteration.""" + resources = _static_result().resources + assert resources[0] == "alpha" + assert list(resources.__reversed__()) == ["gamma", "beta", "alpha"] + + def test_simple_resource_contains_on_empty_data(self): + """Resources.contains must tolerate an empty resources list.""" + empty = Result( + status_code=200, + headers={"Content-Type": "application/json"}, + body={"meta": {"trace_id": "abc"}, "resources": [], "errors": []} + ) + assert empty.resources.contains("alpha") == [] + + def test_next_raises_stop_iteration_at_the_end(self): + """Result.__next__ must raise StopIteration once the position reaches the end.""" + single = Result( + status_code=200, + headers={"Content-Type": "application/json"}, + body={"meta": {"trace_id": "abc"}, "resources": ["only"], "errors": []} + ) + with pytest.raises(StopIteration): + next(single) + + def test_next_raises_stop_iteration_when_empty(self): + """Result.__next__ must raise StopIteration when there are no resources.""" + empty = Result( + status_code=200, + headers={"Content-Type": "application/json"}, + body={"meta": {"trace_id": "abc"}, "resources": [], "errors": []} + ) + with pytest.raises(StopIteration): + next(empty) diff --git a/tests/test_scanning_orchestrator.py b/tests/test_scanning_orchestrator.py new file mode 100644 index 000000000..55ce6cb15 --- /dev/null +++ b/tests/test_scanning_orchestrator.py @@ -0,0 +1,34 @@ +# test_scanning_orchestrator.py +# This class tests the scanning_orchestrator service class + +import os +import sys + +from tests import test_authorization as Authorization + +sys.path.append(os.path.abspath('src')) +from falconpy import ScanningOrchestrator + +auth = Authorization.TestAuthorization() +config = auth.getConfigObject() +falcon = ScanningOrchestrator(auth_object=config) +AllowedResponses = [200, 201, 207, 400, 403, 404, 429] + + +class TestScanningOrchestrator: + def test_all_code_paths(self): + error_checks = True + tests = { + "get_combined_schedules": falcon.get_combined_schedules(limit=1, offset=1, sort="string", filter="string"), + "trigger_scan_by_schedule": falcon.trigger_scan_by_schedule(ids="string"), + "get_schedules": falcon.get_schedules(ids="12345678"), + "create_schedules": falcon.create_schedules(resources="string"), + "delete_schedules": falcon.delete_schedules(ids="12345678"), + "update_schedules": falcon.update_schedules(resources="string"), + "get_service_types": falcon.get_service_types(scan_product="string"), + "search_schedules": falcon.search_schedules(limit=1, offset=1, sort="string", filter="string"), + } + for key in tests: + if tests[key]["status_code"] not in AllowedResponses: + error_checks = False + assert error_checks diff --git a/tests/test_sensor_visibility_exclusions.py b/tests/test_sensor_visibility_exclusions.py index 564a2c086..9afba5510 100644 --- a/tests/test_sensor_visibility_exclusions.py +++ b/tests/test_sensor_visibility_exclusions.py @@ -41,6 +41,11 @@ def sve_test_all_paths(self): id="12345678", value="Bananas" ), + "update_exclusion_empty_groups": falcon.update_exclusions(comment="Unit Testing", + groups=[], + id="12345678", + value="Bananas" + ), "delete_exclusion": falcon.delete_exclusions(ids="12345678"), } for key in tests: diff --git a/tests/test_session_connection_reuse.py b/tests/test_session_connection_reuse.py new file mode 100644 index 000000000..9299b4bd4 --- /dev/null +++ b/tests/test_session_connection_reuse.py @@ -0,0 +1,72 @@ +# test_session_connection_reuse.py +# Local-only demonstration of HTTP/1.1 connection reuse via requests.Session. +# +# No credentials and no internet access are required: this spins up a loopback +# HTTP server and shows that a shared requests.Session reuses one TCP connection +# across multiple requests, while separate module-level requests.get() calls do not. +import http.server +import threading +import requests +import pytest + + +class _CountingHandler(http.server.BaseHTTPRequestHandler): + """HTTP/1.1 handler that counts distinct accepted TCP connections.""" + + protocol_version = "HTTP/1.1" + + def setup(self): + super().setup() + # A new connection is only ever set up once per TCP socket, even + # when HTTP/1.1 keep-alive pipelines multiple requests over it. + self.server.connection_count += 1 + + def do_GET(self): # noqa: N802 (stdlib naming convention) + body = b"{}" + self.send_response(200) + self.send_header("Content-Type", "application/json") + self.send_header("Content-Length", str(len(body))) + self.end_headers() + self.wfile.write(body) + + def log_message(self, format, *args): # noqa: A002 (stdlib signature) + """Silence default request logging to keep test output clean.""" + + +@pytest.fixture +def local_http_server(): + """Start a threaded loopback HTTP/1.1 server on an ephemeral port.""" + server = http.server.ThreadingHTTPServer(("127.0.0.1", 0), _CountingHandler) + server.connection_count = 0 + thread = threading.Thread(target=server.serve_forever, daemon=True) + thread.start() + base_url = f"http://127.0.0.1:{server.server_port}" + try: + yield base_url, server + finally: + server.shutdown() + server.server_close() + thread.join(timeout=5) + + +class TestLocalConnectionReuseDemonstration: + """Demonstrate the requests/urllib3 connection-reuse mechanism on loopback HTTP. + + This is a stand-in for, not a replacement of, a real benchmark against the + live CrowdStrike API (not reachable from this environment). + """ + + def test_two_requests_without_session_open_two_connections(self, local_http_server): + """Two independent module-level requests.get() calls open two connections.""" + base_url, server = local_http_server + requests.get(base_url) + requests.get(base_url) + assert server.connection_count == 2 + + def test_two_requests_with_session_reuse_one_connection(self, local_http_server): + """Two calls through one requests.Session reuse a single connection.""" + base_url, server = local_http_server + with requests.Session() as session: + session.get(base_url) + session.get(base_url) + assert server.connection_count == 1 diff --git a/tests/test_session_support.py b/tests/test_session_support.py new file mode 100644 index 000000000..6e7db9262 --- /dev/null +++ b/tests/test_session_support.py @@ -0,0 +1,367 @@ +# test_session_support.py +# Tests optional requests.Session support for connection reuse. +# +# These tests are fully mocked (no live credentials, no network access to the +# real CrowdStrike API) and mirror the monkeypatch style already used in +# tests/test_uber_api_complete.py and tests/test_authentications.py. +import gc +import os +import sys +import concurrent.futures +from unittest.mock import MagicMock +import pytest +import requests +# Import our sibling src folder into the path +sys.path.append(os.path.abspath('src')) +# flake8: noqa=E402 +from falconpy import OAuth2, APIHarness, APIHarnessV2, Hosts, APIError, Result +from falconpy._auth_object._interface_config import InterfaceConfiguration +from falconpy._util import perform_request +import falconpy._util._functions as _funcs + + +class _FakeResponse: + """Minimal stand-in for requests.Response used by monkeypatch tests.""" + + def __init__(self, status_code=200, body=None, headers=None, content=None): + self.status_code = status_code + self.headers = headers or {"Content-Type": "application/json"} + self._body = body if body is not None else {"meta": {"trace_id": "abc"}, "resources": [], "errors": []} + self.content = content or b'{"resources":[]}' + + def json(self): + return self._body + + +def _login_response(token="fake_token_123", expires=1799, status=201): + body = {"access_token": token, "expires_in": expires} if status == 201 else {"errors": [{"message": "Denied"}]} + return _FakeResponse(status, body) + + +def _api_response(status=200, body=None): + return _FakeResponse(status, body) + + +def _revoke_response(status=200): + return _FakeResponse(status, {}) + + +def _spy_session(responses): + """Build a real requests.Session whose .request/.close are mocked for inspection.""" + session = requests.Session() + session.request = MagicMock(side_effect=lambda *a, **kw: next(responses)) + session.close = MagicMock() + return session, session.request + + +class TestSessionDefaultBehaviorUnchanged: + """Prove that omitting session= leaves existing behavior untouched.""" + + def test_no_session_uses_module_level_requests_request(self, monkeypatch): + """Login without a session must still call the module-level requests.request.""" + responses = iter([_login_response()]) + mock_request = MagicMock(side_effect=lambda *a, **kw: next(responses)) + monkeypatch.setattr(_funcs.requests, "request", mock_request) + session_class_mock = MagicMock(side_effect=AssertionError("Session should never be instantiated")) + monkeypatch.setattr(_funcs.requests, "Session", session_class_mock) + + oauth = OAuth2(client_id="fake_id", client_secret="fake_secret") + result = oauth.login() + + mock_request.assert_called_once() + session_class_mock.assert_not_called() + assert result["status_code"] == 201 + + def test_no_session_hosts_service_class_unchanged(self, monkeypatch): + """A Service Class without a session must still call the module-level requests.request.""" + responses = iter([_login_response(), _api_response()]) + mock_request = MagicMock(side_effect=lambda *a, **kw: next(responses)) + monkeypatch.setattr(_funcs.requests, "request", mock_request) + + hosts = Hosts(client_id="fake_id", client_secret="fake_secret") + result = hosts.query_devices_by_filter(limit=1) + + assert mock_request.call_count == 2 + assert result["status_code"] == 200 + assert result["body"] == {"meta": {"trace_id": "abc"}, "resources": [], "errors": []} + + +class TestSessionUsedThroughoutLifecycle: + """Prove a provided session is used for login, calls, renewal and logout.""" + + def test_session_used_for_login_and_renewal_and_logout(self, monkeypatch): + """The same session instance must service login, a renewal, and logout.""" + responses = iter([_login_response(), _login_response(token="renewed_token"), _revoke_response()]) + session, request_mock = _spy_session(responses) + monkeypatch.setattr(_funcs.requests, "request", MagicMock(side_effect=AssertionError("must use session"))) + + oauth = OAuth2(client_id="fake_id", client_secret="fake_secret", session=session) + assert oauth.login()["status_code"] == 201 + assert oauth.token()["status_code"] == 201 + oauth.logout() + + assert request_mock.call_count == 3 + assert oauth.session is session + session.close.assert_not_called() + + def test_close_never_called_including_after_object_teardown(self, monkeypatch): + """FalconPy must never close a caller-provided session, even after teardown.""" + responses = iter([_login_response(), _revoke_response()]) + session, request_mock = _spy_session(responses) + monkeypatch.setattr(_funcs.requests, "request", MagicMock(side_effect=AssertionError("must use session"))) + + oauth = OAuth2(client_id="fake_id", client_secret="fake_secret", session=session) + oauth.login() + oauth.logout() + del oauth + gc.collect() + + session.close.assert_not_called() + + def test_apiharnessv2_session_identity_across_multiple_calls(self, monkeypatch): + """APIHarnessV2 must reuse the same session for login and every command.""" + responses = iter([_login_response(), _api_response(), _api_response()]) + session, request_mock = _spy_session(responses) + monkeypatch.setattr(_funcs.requests, "request", MagicMock(side_effect=AssertionError("must use session"))) + + falcon = APIHarnessV2(client_id="fake_id", client_secret="fake_secret", session=session) + falcon.command("QueryDevicesByFilter", parameters={"limit": 1}) + falcon.command("QueryDevicesByFilter", parameters={"limit": 1}) + + assert falcon.session is session + assert request_mock.call_count == 3 + + def test_legacy_apiharness_session_param(self, monkeypatch): + """The legacy standalone APIHarness must also thread the session through.""" + responses = iter([_login_response(), _api_response()]) + session, request_mock = _spy_session(responses) + monkeypatch.setattr(_funcs.requests, "request", MagicMock(side_effect=AssertionError("must use session"))) + + uber = APIHarness(client_id="fake_id", client_secret="fake_secret", session=session) + uber.authenticate() + result = uber.command(action="QueryDevicesByFilter", parameters={"limit": 1}) + + assert isinstance(result, dict) + assert uber.session is session + assert request_mock.call_count == 2 + + def test_hosts_service_class_session_param(self, monkeypatch): + """A generated Service Class constructed directly from credentials must use the session.""" + responses = iter([_login_response(), _api_response()]) + session, request_mock = _spy_session(responses) + monkeypatch.setattr(_funcs.requests, "request", MagicMock(side_effect=AssertionError("must use session"))) + + hosts = Hosts(client_id="fake_id", client_secret="fake_secret", session=session) + result = hosts.query_devices_by_filter(limit=1) + + assert result["status_code"] == 200 + assert hosts.auth_object.session is session + assert request_mock.call_count == 2 + + def test_service_class_override_route_uses_session(self, monkeypatch): + """ServiceClass.override() (custom/override routes) must also use the session.""" + responses = iter([_login_response(), _api_response()]) + session, request_mock = _spy_session(responses) + monkeypatch.setattr(_funcs.requests, "request", MagicMock(side_effect=AssertionError("must use session"))) + + hosts = Hosts(client_id="fake_id", client_secret="fake_secret", session=session) + result = hosts.override("GET", "/devices/queries/devices-scroll/v1", parameters={"limit": 1}) + + assert result["status_code"] == 200 + assert request_mock.call_count == 2 + + +class TestSharedAuthObjectSessionPropagation: + """Prove a shared auth_object keeps carrying the same session for every consumer.""" + + def test_shared_oauth2_session_used_by_service_class(self, monkeypatch): + """A Service Class constructed via auth_object= must inherit that object's session.""" + responses = iter([_login_response(), _api_response()]) + session, request_mock = _spy_session(responses) + monkeypatch.setattr(_funcs.requests, "request", MagicMock(side_effect=AssertionError("must use session"))) + + auth = OAuth2(client_id="fake_id", client_secret="fake_secret", session=session) + hosts = Hosts(auth_object=auth) + result = hosts.query_devices_by_filter(limit=1) + + assert hosts.auth_object is auth + assert hosts.auth_object.session is session + assert result["status_code"] == 200 + + def test_shared_auth_object_across_two_service_classes_same_session(self, monkeypatch): + """Two Service Classes sharing one auth_object must share the same session and login once.""" + responses = iter([_login_response(), _api_response(), _api_response()]) + session, request_mock = _spy_session(responses) + monkeypatch.setattr(_funcs.requests, "request", MagicMock(side_effect=AssertionError("must use session"))) + + auth = OAuth2(client_id="fake_id", client_secret="fake_secret", session=session) + hosts_a = Hosts(auth_object=auth) + hosts_b = Hosts(auth_object=auth) + hosts_a.query_devices_by_filter(limit=1) + hosts_b.query_devices_by_filter(limit=1) + + # One login total (token reused), plus one API call per Service Class. + assert request_mock.call_count == 3 + assert hosts_a.auth_object is hosts_b.auth_object is auth + assert hosts_a.session is hosts_b.session is session + + +def _capture_call(monkeypatch, use_session, **perform_kwargs): + """Invoke perform_request either with a session or via the module-level requests.request.""" + fake_resp = _api_response(status=perform_kwargs.pop("_status", 200), body=perform_kwargs.pop("_body", None)) + mock_callable = MagicMock(return_value=fake_resp) + if use_session: + session = requests.Session() + session.request = mock_callable + perform_kwargs["session"] = session + else: + monkeypatch.setattr(_funcs.requests, "request", mock_callable) + result = perform_request(**perform_kwargs) + return mock_callable.call_args, result + + +def _base_kwargs(): + return dict(endpoint="https://api.crowdstrike.com/test", method="GET", + params={"limit": 1}, headers={"X-Test": "1"}, proxy={"https": "http://x:1"}, + timeout=30, verify=False) + + +class TestRequestArgumentParity: + """Prove request arguments and response handling are identical with/without a session.""" + + def test_params_body_headers_proxy_timeout_verify_are_identical(self, monkeypatch): + """The outgoing call and returned result must match whether or not a session is used.""" + call_no_session, result_no_session = _capture_call(monkeypatch, False, **_base_kwargs()) + call_with_session, result_with_session = _capture_call(monkeypatch, True, **_base_kwargs()) + + assert call_no_session.args == call_with_session.args + assert call_no_session.kwargs == call_with_session.kwargs + assert result_no_session == result_with_session + + def test_response_parsing_identical_for_success_and_error_bodies(self, monkeypatch): + """Both success and error response bodies must parse identically with/without a session.""" + for status, body in [(200, {"resources": ["a"], "errors": []}), + (403, {"resources": [], "errors": [{"message": "Access denied"}]})]: + kwargs = _base_kwargs() + kwargs["_status"] = status + kwargs["_body"] = body + _, result_no_session = _capture_call(monkeypatch, False, **dict(kwargs)) + _, result_with_session = _capture_call(monkeypatch, True, **dict(kwargs)) + assert result_no_session == result_with_session + + def test_stream_true_passthrough_identical(self, monkeypatch): + """The stream=True early-return branch must behave the same with/without a session.""" + kwargs = _base_kwargs() + kwargs["stream"] = True + _, result_no_session = _capture_call(monkeypatch, False, **dict(kwargs)) + _, result_with_session = _capture_call(monkeypatch, True, **dict(kwargs)) + assert isinstance(result_no_session, _FakeResponse) + assert isinstance(result_with_session, _FakeResponse) + assert result_no_session.status_code == result_with_session.status_code + + def test_files_upload_kwarg_identical(self, monkeypatch): + """The files= multipart upload kwarg must be forwarded identically with/without a session.""" + kwargs = _base_kwargs() + kwargs["method"] = "POST" + kwargs["files"] = [("file", ("test.txt", b"data", "text/plain"))] + call_no_session, _ = _capture_call(monkeypatch, False, **dict(kwargs)) + call_with_session, _ = _capture_call(monkeypatch, True, **dict(kwargs)) + assert call_no_session.kwargs["files"] == call_with_session.kwargs["files"] + + +class TestPythonicModeWithSession: + """Prove both pythonic and non-pythonic response modes still work with a session.""" + + def test_pythonic_true_with_session_success(self, monkeypatch): + """A successful call with a session and pythonic=True must return a Result.""" + responses = iter([_login_response(), _api_response(status=200)]) + session, _ = _spy_session(responses) + monkeypatch.setattr(_funcs.requests, "request", MagicMock(side_effect=AssertionError("must use session"))) + + hosts = Hosts(client_id="fake_id", client_secret="fake_secret", session=session, pythonic=True) + result = hosts.query_devices_by_filter(limit=1) + + assert isinstance(result, Result) + + def test_pythonic_true_with_session_raises_apierror_on_failure(self, monkeypatch): + """A failing call with a session and pythonic=True must raise APIError.""" + responses = iter([ + _login_response(), + _api_response(status=403, body={"resources": [], "errors": [{"message": "Access denied"}]}) + ]) + session, _ = _spy_session(responses) + monkeypatch.setattr(_funcs.requests, "request", MagicMock(side_effect=AssertionError("must use session"))) + + hosts = Hosts(client_id="fake_id", client_secret="fake_secret", session=session, pythonic=True) + with pytest.raises(APIError): + hosts.query_devices_by_filter(limit=1) + + def test_pythonic_false_with_session_returns_plain_dict(self, monkeypatch): + """Default (non-pythonic) mode with a session must still return a plain dict.""" + responses = iter([_login_response(), _api_response(status=200)]) + session, _ = _spy_session(responses) + monkeypatch.setattr(_funcs.requests, "request", MagicMock(side_effect=AssertionError("must use session"))) + + hosts = Hosts(client_id="fake_id", client_secret="fake_secret", session=session) + result = hosts.query_devices_by_filter(limit=1) + + assert isinstance(result, dict) and not isinstance(result, Result) + assert set(["status_code", "headers", "body"]).issubset(result.keys()) + + +class TestSessionConcurrencySmoke: + """Smoke test only: FalconPy itself must not crash under shared concurrent use. + + This does NOT prove raw socket-level thread-safety of requests.Session, which is a + property of requests/urllib3, not something FalconPy can guarantee. + """ + + def test_shared_session_survives_concurrent_calls(self, monkeypatch): + """A session shared across threads via one auth_object must not raise or corrupt state.""" + session = requests.Session() + session.request = MagicMock(side_effect=lambda *a, **kw: _login_response() if "/oauth2/token" in a[1] + else _api_response()) + monkeypatch.setattr(_funcs.requests, "request", MagicMock(side_effect=AssertionError("must use session"))) + + auth = OAuth2(client_id="fake_id", client_secret="fake_secret", session=session) + auth.login() + session.request.reset_mock() + + hosts = Hosts(auth_object=auth) + num_calls = 10 + with concurrent.futures.ThreadPoolExecutor(max_workers=5) as pool: + futures = [pool.submit(hosts.query_devices_by_filter, limit=1) for _ in range(num_calls)] + results = [f.result() for f in futures] + + assert all(r["status_code"] == 200 for r in results) + assert session.request.call_count == num_calls + + +class TestSessionPropertyMutators: + """Cover the session property setters on the auth object and its configuration.""" + + def test_interface_configuration_session_setter(self): + """InterfaceConfiguration.session must store the assigned session.""" + config = InterfaceConfiguration(base_url="https://api.crowdstrike.com") + assert config.session is None + session = requests.Session() + config.session = session + assert config.session is session + + def test_falcon_interface_session_setter_propagates_to_config(self): + """Assigning to FalconInterface.session must reach the underlying configuration.""" + session = requests.Session() + auth = OAuth2(client_id="fake_id", client_secret="fake_secret") + assert auth.session is None + + auth.session = session + assert auth.session is session + assert auth.config.session is session + + def test_falcon_interface_session_can_be_cleared(self): + """Clearing the session must restore the default (no session) behavior.""" + auth = OAuth2(client_id="fake_id", client_secret="fake_secret", session=requests.Session()) + assert auth.session is not None + auth.session = None + assert auth.session is None + assert auth.config.session is None diff --git a/tests/test_spans.py b/tests/test_spans.py new file mode 100644 index 000000000..ae236b1af --- /dev/null +++ b/tests/test_spans.py @@ -0,0 +1,28 @@ +# test_spans.py +# This class tests the spans service class + +import os +import sys + +from tests import test_authorization as Authorization + +sys.path.append(os.path.abspath('src')) +from falconpy import Spans + +auth = Authorization.TestAuthorization() +config = auth.getConfigObject() +falcon = Spans(auth_object=config) +AllowedResponses = [200, 201, 207, 400, 403, 404, 429] + + +class TestSpans: + def test_all_code_paths(self): + error_checks = True + tests = { + "EntitiesSpansV1": falcon.entities_spans_v1(ids="12345678"), + "QueriesSpansV1": falcon.queries_spans_v1(offset=1, limit=1, sort="string", filter="string"), + } + for key in tests: + if tests[key]["status_code"] not in AllowedResponses: + error_checks = False + assert error_checks diff --git a/tests/test_stream.py b/tests/test_stream.py new file mode 100644 index 000000000..6976ae6fb --- /dev/null +++ b/tests/test_stream.py @@ -0,0 +1,27 @@ +# test_stream.py +# This class tests the stream service class + +import os +import sys + +from tests import test_authorization as Authorization + +sys.path.append(os.path.abspath('src')) +from falconpy import Stream + +auth = Authorization.TestAuthorization() +config = auth.getConfigObject() +falcon = Stream(auth_object=config) +AllowedResponses = [200, 201, 207, 400, 403, 404, 429] + + +class TestStream: + def test_all_code_paths(self): + error_checks = True + tests = { + "StreamInvocationResponseV1": falcon.stream_invocation_response_v1(id="12345678"), + } + for key in tests: + if tests[key]["status_code"] not in AllowedResponses: + error_checks = False + assert error_checks diff --git a/tests/test_tools.py b/tests/test_tools.py new file mode 100644 index 000000000..026c4bd17 --- /dev/null +++ b/tests/test_tools.py @@ -0,0 +1,28 @@ +# test_tools.py +# This class tests the tools service class + +import os +import sys + +from tests import test_authorization as Authorization + +sys.path.append(os.path.abspath('src')) +from falconpy import Tools + +auth = Authorization.TestAuthorization() +config = auth.getConfigObject() +falcon = Tools(auth_object=config) +AllowedResponses = [200, 201, 207, 400, 403, 404, 429] + + +class TestTools: + def test_all_code_paths(self): + error_checks = True + tests = { + "EntitiesToolsV1": falcon.entities_tools_v1(ids="12345678"), + "QueriesToolsV1": falcon.queries_tools_v1(offset=1, limit=1, sort="string", filter="string"), + } + for key in tests: + if tests[key]["status_code"] not in AllowedResponses: + error_checks = False + assert error_checks diff --git a/tests/test_zero_trust_assessment.py b/tests/test_zero_trust_assessment.py index e4fc0bdc4..636c8971f 100644 --- a/tests/test_zero_trust_assessment.py +++ b/tests/test_zero_trust_assessment.py @@ -32,6 +32,56 @@ class ContextRequest: cs_cloud: str = field(default='') +class TestContextAuthenticationBaseURL: + """Confirm Context Authentication does not override an explicit base_url.""" + + EXPLICIT_URL = "https://api.dodo.crowdstrike.red" + + @staticmethod + def _context(cloud=None): + """Set a context variable exposing an access token and an optional cs_cloud.""" + holder = ContextRequest() if cloud is not None else BaselessContextRequest() + holder.access_token = "fake-token-for-testing" + if cloud is not None: + holder.cs_cloud = cloud + request_context = ContextVar("base-url-context", default=holder) + return request_context, request_context.set(holder) + + def test_explicit_base_url_survives_cs_cloud(self): + """An explicitly provided base_url must win over the context cs_cloud.""" + request_context, token = self._context(cloud="dodo-red") + try: + zta = ZeroTrustAssessment(base_url=self.EXPLICIT_URL) + assert zta.base_url == self.EXPLICIT_URL + assert zta.auth_style == "CONTEXT" + finally: + request_context.reset(token) + + def test_cs_cloud_still_applies_without_an_explicit_base_url(self): + """With no base_url supplied, the context cs_cloud must still be honored.""" + request_context, token = self._context(cloud="US2") + try: + assert ZeroTrustAssessment().base_url == "https://api.us-2.crowdstrike.com" + finally: + request_context.reset(token) + + def test_explicit_base_url_survives_a_context_without_cs_cloud(self): + """A context lacking cs_cloud must not reset an explicit base_url either.""" + request_context, token = self._context() + try: + assert ZeroTrustAssessment(base_url=self.EXPLICIT_URL).base_url == self.EXPLICIT_URL + finally: + request_context.reset(token) + + def test_uber_class_explicit_base_url_survives_cs_cloud(self): + """The Uber Class must honor an explicit base_url under Context Authentication.""" + request_context, token = self._context(cloud="dodo-red") + try: + assert APIHarnessV2(base_url=self.EXPLICIT_URL).base_url == self.EXPLICIT_URL + finally: + request_context.reset(token) + + class TestZeroTrustAssessment: def test_get_assessment(self): diff --git a/util/README.md b/util/README.md index 9bc46f879..0d9ae9504 100644 --- a/util/README.md +++ b/util/README.md @@ -19,6 +19,7 @@ All of these utilities are designed to be executed from within the repository ro | `lint.sh` | Lints the package source with `flake8` and `pylint` and returns the result. Execute from the root of the repository or pass the location you wish to lint as the first argument: `util/lint.sh /path/to/folder` | | `public-modules.sh` | Returns a list of all public FalconPy modules and the count of their available methods. Execute from the root of the repository folder or pass this location as the first argument.
`public-modules.sh /path/to/repo/home` | `run-tests.sh` | Runs a complete unit test series, reports code coverage and runs a bandit analysis.
Should be executed from the repository root: `util/run-tests.sh` | +| `session_benchmark.py` | Local loopback benchmark comparing per-request latency with and without a reused `requests.Session`, demonstrating the connection-reuse mechanism without requiring API credentials or internet access. Execute from the repository root: `util/session_benchmark.py` | | `unit-test.sh` | Runs a single unit test series and reports code coverage. Execute individual tests by specifying their module name. Example: `util/unit-test.sh real_time_response` | | `vcheck.sh` | Checks your installed version of FalconPy against the latest release version.
Will attempt to detect `Pipenv` / `Poetry`.
Can be executed locally (`util/vcheck.sh`) or online with:
`curl https://falconpy.io/vcheck --silent \| bash` | diff --git a/util/session_benchmark.py b/util/session_benchmark.py new file mode 100644 index 000000000..d8d607fdf --- /dev/null +++ b/util/session_benchmark.py @@ -0,0 +1,107 @@ +"""Local loopback benchmark demonstrating requests.Session connection reuse. + + _______ __ _______ __ __ __ +| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----. +|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__| +|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____| +|: 1 | |: 1 | +|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy +`-------' `-------' + +Compares per-request latency for module-level requests.request() calls (FalconPy's +default, no-session behavior) against a shared requests.Session (FalconPy's behavior +when session= is provided), both against a local unencrypted loopback HTTP server. + +DISCLAIMER: These numbers measure requests/urllib3 connection-reuse overhead on an +unencrypted loopback HTTP server. They do NOT reflect real network/TLS/API latency +to api.crowdstrike.com. They demonstrate the mechanism (avoided TCP/TLS handshakes +per request) that produces the improvement documented in the associated pull request; +absolute before/after numbers against the live API will vary with network conditions +and were not reproduced by this script. + +Execute from the root of the repository: util/session_benchmark.py +""" +import http.server +import statistics +import threading +import time +import requests + +REQUEST_COUNT = 100 +SIMULATED_SERVER_LATENCY_SECONDS = 0.0 + + +class _LatencyHandler(http.server.BaseHTTPRequestHandler): + """HTTP/1.1 handler that simulates a small amount of server-side processing time.""" + + protocol_version = "HTTP/1.1" + + def do_GET(self): # noqa: N802 (stdlib naming convention) + time.sleep(SIMULATED_SERVER_LATENCY_SECONDS) + body = b"{}" + self.send_response(200) + self.send_header("Content-Type", "application/json") + self.send_header("Content-Length", str(len(body))) + self.end_headers() + self.wfile.write(body) + + def log_message(self, format, *args): # noqa: A002 (stdlib signature) + """Silence default request logging to keep benchmark output clean.""" + + +def _start_server(): + server = http.server.ThreadingHTTPServer(("127.0.0.1", 0), _LatencyHandler) + thread = threading.Thread(target=server.serve_forever, daemon=True) + thread.start() + return server, thread + + +def _time_requests(count, request_callable, url): + durations = [] + for _ in range(count): + start = time.perf_counter() + request_callable(url) + durations.append((time.perf_counter() - start) * 1000) # milliseconds + return durations + + +def _report(label, durations): + print(f"{label}:") + print(f" min: {min(durations):.2f} ms") + print(f" median: {statistics.median(durations):.2f} ms") + print(f" mean: {statistics.mean(durations):.2f} ms") + quantiles = statistics.quantiles(durations, n=20) # 5th percentile buckets + print(f" p95: {quantiles[18]:.2f} ms") + print() + + +def main(): + """Run the loopback benchmark and print a comparison report.""" + server, thread = _start_server() + url = f"http://127.0.0.1:{server.server_port}" + + try: + # Baseline: matches FalconPy's default (no session) behavior. + no_session_durations = _time_requests(REQUEST_COUNT, lambda u: requests.request("GET", u), url) + + # With session: matches FalconPy's behavior when session= is provided. + with requests.Session() as session: + with_session_durations = _time_requests(REQUEST_COUNT, lambda u: session.request("GET", u), url) + finally: + server.shutdown() + server.server_close() + thread.join(timeout=5) + + print(f"Local loopback benchmark ({REQUEST_COUNT} requests per condition)") + print("=" * 60) + _report("Without session (requests.request per call)", no_session_durations) + _report("With session (requests.Session reused)", with_session_durations) + + speedup = statistics.mean(no_session_durations) / statistics.mean(with_session_durations) + print(f"Mean speedup: {speedup:.2f}x") + print() + print(__doc__.split("DISCLAIMER:")[1].split("Execute from")[0].strip()) + + +if __name__ == "__main__": + main()