crimson-falcon 0.3.0 → 0.4.0

data/lib/crimson-falcon/api/d4c_registration_api.rb

@@ -36,6 +36,72 @@ module Falcon
     def initialize(api_client = ApiClient.default)
       @api_client = api_client
     end
+    # Creates a new GCP account with newly-uploaded service account or connects with existing service account with only the following fields: parent_id, parent_type and service_account_id
+    # @param body [RegistrationGCPAccountExtRequestV2]
+    # @param [Hash] opts the optional parameters
+    # @return [RegistrationGCPAccountResponseExtV2]
+    def connect_d4_cgcp_account(body, opts = {})
+      data, _status_code, _headers = connect_d4_cgcp_account_with_http_info(body, opts)
+      data
+    end
+
+    # Creates a new GCP account with newly-uploaded service account or connects with existing service account with only the following fields: parent_id, parent_type and service_account_id
+    # @param body [RegistrationGCPAccountExtRequestV2]
+    # @param [Hash] opts the optional parameters
+    # @return [Array<(RegistrationGCPAccountResponseExtV2, Integer, Hash)>] RegistrationGCPAccountResponseExtV2 data, response status code and response headers
+    def connect_d4_cgcp_account_with_http_info(body, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: D4cRegistrationApi.connect_d4_cgcp_account ...'
+      end
+      # verify the required parameter 'body' is set
+      if @api_client.config.client_side_validation && body.nil?
+        fail ArgumentError, "Missing the required parameter 'body' when calling D4cRegistrationApi.connect_d4_cgcp_account"
+      end
+      # resource path
+      local_var_path = '/cloud-connect-gcp/entities/account/v2'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+      # HTTP header 'Content-Type'
+      content_type = @api_client.select_header_content_type(['application/json'])
+      if !content_type.nil?
+        header_params['Content-Type'] = content_type
+      end
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body] || @api_client.object_to_http_body(body)
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'RegistrationGCPAccountResponseExtV2'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"D4cRegistrationApi.connect_d4_cgcp_account",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:POST, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: D4cRegistrationApi#connect_d4_cgcp_account\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
     # Creates a new account in our system for a customer and generates a script for them to run in their AWS cloud environment to grant us access.
     # @param body [RegistrationAWSAccountCreateRequestD4CExtV2]
     # @param [Hash] opts the optional parameters
@@ -295,6 +361,64 @@ module Falcon
       return data, status_code, headers
     end
 
+    # Deletes a GCP account from the system.
+    # @param [Hash] opts the optional parameters
+    # @option opts [Array<String>] :ids Hierarchical Resource IDs of accounts
+    # @return [MsaBaseEntitiesResponse]
+    def delete_d4_cgcp_account(opts = {})
+      data, _status_code, _headers = delete_d4_cgcp_account_with_http_info(opts)
+      data
+    end
+
+    # Deletes a GCP account from the system.
+    # @param [Hash] opts the optional parameters
+    # @option opts [Array<String>] :ids Hierarchical Resource IDs of accounts
+    # @return [Array<(MsaBaseEntitiesResponse, Integer, Hash)>] MsaBaseEntitiesResponse data, response status code and response headers
+    def delete_d4_cgcp_account_with_http_info(opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: D4cRegistrationApi.delete_d4_cgcp_account ...'
+      end
+      # resource path
+      local_var_path = '/cloud-connect-gcp/entities/account/v1'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'ids'] = @api_client.build_collection_param(opts[:'ids'], :multi) if !opts[:'ids'].nil?
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'MsaBaseEntitiesResponse'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"D4cRegistrationApi.delete_d4_cgcp_account",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:DELETE, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: D4cRegistrationApi#delete_d4_cgcp_account\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
     # Returns JSON object(s) that contain the base64 encoded certificate for a service principal.
     # @param tenant_id [Array<String>] Azure Tenant ID
     # @param [Hash] opts the optional parameters
@@ -423,15 +547,10 @@ module Falcon
         fail ArgumentError, "invalid value for 'opts[:\"status\"]' when calling D4cRegistrationApi.get_d4_c_aws_account, must conform to the pattern #{pattern}."
       end
 
-      allowable_values = ["false", "true"]
+      allowable_values = ["true", "false"]
       if @api_client.config.client_side_validation && opts[:'migrated'] && !allowable_values.include?(opts[:'migrated'])
         fail ArgumentError, "invalid value for \"migrated\", must be one of #{allowable_values}"
       end
-      pattern = Regexp.new(/^(true|false)$/)
-      if @api_client.config.client_side_validation && !opts[:'migrated'].nil? && opts[:'migrated'] !~ pattern
-        fail ArgumentError, "invalid value for 'opts[:\"migrated\"]' when calling D4cRegistrationApi.get_d4_c_aws_account, must conform to the pattern #{pattern}."
-      end
-
       # resource path
       local_var_path = '/cloud-connect-aws/entities/account/v2'
 
@@ -688,6 +807,69 @@ module Falcon
       return data, status_code, headers
     end
 
+    # Returns the service account id and client email for external clients.
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :id Service Account ID
+    # @return [RegistrationGCPServiceAccountResponseExtV1]
+    def get_d4_cgcp_service_accounts_ext(opts = {})
+      data, _status_code, _headers = get_d4_cgcp_service_accounts_ext_with_http_info(opts)
+      data
+    end
+
+    # Returns the service account id and client email for external clients.
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :id Service Account ID
+    # @return [Array<(RegistrationGCPServiceAccountResponseExtV1, Integer, Hash)>] RegistrationGCPServiceAccountResponseExtV1 data, response status code and response headers
+    def get_d4_cgcp_service_accounts_ext_with_http_info(opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: D4cRegistrationApi.get_d4_cgcp_service_accounts_ext ...'
+      end
+      pattern = Regexp.new(/^\d+$/)
+      if @api_client.config.client_side_validation && !opts[:'id'].nil? && opts[:'id'] !~ pattern
+        fail ArgumentError, "invalid value for 'opts[:\"id\"]' when calling D4cRegistrationApi.get_d4_cgcp_service_accounts_ext, must conform to the pattern #{pattern}."
+      end
+
+      # resource path
+      local_var_path = '/cloud-connect-gcp/entities/service-accounts/v1'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'id'] = opts[:'id'] if !opts[:'id'].nil?
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'RegistrationGCPServiceAccountResponseExtV1'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"D4cRegistrationApi.get_d4_cgcp_service_accounts_ext",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: D4cRegistrationApi#get_d4_cgcp_service_accounts_ext\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
     # Return a script for customer to run in their cloud environment to grant us access to their GCP environment
     # @param [Hash] opts the optional parameters
     # @option opts [String] :parent_type GCP Hierarchy Parent Type, organization/folder/project
@@ -750,6 +932,78 @@ module Falcon
       return data, status_code, headers
     end
 
+    # Return a script for customer to run in their cloud environment to grant us access to their GCP environment as a downloadable attachment
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :parent_type GCP Hierarchy Parent Type, organization/folder/project
+    # @option opts [Array<String>] :ids Hierarchical Resource IDs of accounts
+    # @option opts [String] :status Account status to filter results by.
+    # @return [RegistrationGCPProvisionGetUserScriptResponseV1]
+    def get_d4_cgcp_user_scripts_attachment(opts = {})
+      data, _status_code, _headers = get_d4_cgcp_user_scripts_attachment_with_http_info(opts)
+      data
+    end
+
+    # Return a script for customer to run in their cloud environment to grant us access to their GCP environment as a downloadable attachment
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :parent_type GCP Hierarchy Parent Type, organization/folder/project
+    # @option opts [Array<String>] :ids Hierarchical Resource IDs of accounts
+    # @option opts [String] :status Account status to filter results by.
+    # @return [Array<(RegistrationGCPProvisionGetUserScriptResponseV1, Integer, Hash)>] RegistrationGCPProvisionGetUserScriptResponseV1 data, response status code and response headers
+    def get_d4_cgcp_user_scripts_attachment_with_http_info(opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: D4cRegistrationApi.get_d4_cgcp_user_scripts_attachment ...'
+      end
+      allowable_values = ["Folder", "Organization", "Project"]
+      if @api_client.config.client_side_validation && opts[:'parent_type'] && !allowable_values.include?(opts[:'parent_type'])
+        fail ArgumentError, "invalid value for \"parent_type\", must be one of #{allowable_values}"
+      end
+      allowable_values = ["operational", "provisioned"]
+      if @api_client.config.client_side_validation && opts[:'status'] && !allowable_values.include?(opts[:'status'])
+        fail ArgumentError, "invalid value for \"status\", must be one of #{allowable_values}"
+      end
+      # resource path
+      local_var_path = '/cloud-connect-gcp/entities/user-scripts-download/v1'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'parent_type'] = opts[:'parent_type'] if !opts[:'parent_type'].nil?
+      query_params[:'ids'] = @api_client.build_collection_param(opts[:'ids'], :multi) if !opts[:'ids'].nil?
+      query_params[:'status'] = opts[:'status'] if !opts[:'status'].nil?
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json', 'application/octet-stream'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'RegistrationGCPProvisionGetUserScriptResponseV1'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"D4cRegistrationApi.get_d4_cgcp_user_scripts_attachment",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: D4cRegistrationApi#get_d4_cgcp_user_scripts_attachment\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
     # Return information about Azure account registration
     # @param [Hash] opts the optional parameters
     # @option opts [Array<String>] :ids SubscriptionIDs of accounts to select for this status operation. If this is empty then all accounts are returned.
@@ -956,6 +1210,7 @@ module Falcon
     # @param [Hash] opts the optional parameters
     # @option opts [Array<String>] :subscription_ids Azure Subscription ID
     # @option opts [String] :template Template to be rendered
+    # @option opts [Boolean] :azure_management_group Use Azure Management Group
     # @return [RegistrationAzureProvisionGetUserScriptResponseV1]
     def get_discover_cloud_azure_user_scripts_attachment(tenant_id, opts = {})
       data, _status_code, _headers = get_discover_cloud_azure_user_scripts_attachment_with_http_info(tenant_id, opts)
@@ -967,6 +1222,7 @@ module Falcon
     # @param [Hash] opts the optional parameters
     # @option opts [Array<String>] :subscription_ids Azure Subscription ID
     # @option opts [String] :template Template to be rendered
+    # @option opts [Boolean] :azure_management_group Use Azure Management Group
     # @return [Array<(RegistrationAzureProvisionGetUserScriptResponseV1, Integer, Hash)>] RegistrationAzureProvisionGetUserScriptResponseV1 data, response status code and response headers
     def get_discover_cloud_azure_user_scripts_attachment_with_http_info(tenant_id, opts = {})
       if @api_client.config.debugging
@@ -984,6 +1240,7 @@ module Falcon
       query_params[:'tenant-id'] = @api_client.build_collection_param(tenant_id, :csv)
       query_params[:'subscription_ids'] = @api_client.build_collection_param(opts[:'subscription_ids'], :csv) if !opts[:'subscription_ids'].nil?
       query_params[:'template'] = opts[:'template'] if !opts[:'template'].nil?
+      query_params[:'azure_management_group'] = opts[:'azure_management_group'] if !opts[:'azure_management_group'].nil?
 
       # header parameters
       header_params = opts[:header_params] || {}

data/lib/crimson-falcon/api/drift_indicators_api.rb

@@ -0,0 +1,350 @@
+=begin
+Crimson Falcon - Ruby Client SDK
+
+Code auto-generated by OpenAPI Generator; DO NOT EDIT.
+
+MIT License
+
+Copyright (c) 2023 Crowdstrike
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+=end
+
+require 'cgi'
+
+module Falcon
+  class DriftIndicatorsApi
+    attr_accessor :api_client
+
+    def initialize(api_client = ApiClient.default)
+      @api_client = api_client
+    end
+    # Returns the count of Drift Indicators by the date. by default it's for 7 days.
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :filter Filter drift indicators using a query in Falcon Query Language (FQL). Supported filters: cid,cloud_name,command_line,container_id,file_name,file_sha256,host_id,indicator_process_id,namespace,occurred_at,parent_process_id,pod_name,prevented,scheduler_name,severity,worker_node_name
+    # @option opts [Integer] :limit The upper-bound on the number of records to retrieve.
+    # @return [DriftindicatorsDriftIndicatorsFieldValue]
+    def get_drift_indicators_values_by_date(opts = {})
+      data, _status_code, _headers = get_drift_indicators_values_by_date_with_http_info(opts)
+      data
+    end
+
+    # Returns the count of Drift Indicators by the date. by default it's for 7 days.
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :filter Filter drift indicators using a query in Falcon Query Language (FQL). Supported filters: cid,cloud_name,command_line,container_id,file_name,file_sha256,host_id,indicator_process_id,namespace,occurred_at,parent_process_id,pod_name,prevented,scheduler_name,severity,worker_node_name
+    # @option opts [Integer] :limit The upper-bound on the number of records to retrieve.
+    # @return [Array<(DriftindicatorsDriftIndicatorsFieldValue, Integer, Hash)>] DriftindicatorsDriftIndicatorsFieldValue data, response status code and response headers
+    def get_drift_indicators_values_by_date_with_http_info(opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: DriftIndicatorsApi.get_drift_indicators_values_by_date ...'
+      end
+      # resource path
+      local_var_path = '/container-security/aggregates/drift-indicators/count-by-date/v1'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'filter'] = opts[:'filter'] if !opts[:'filter'].nil?
+      query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'DriftindicatorsDriftIndicatorsFieldValue'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"DriftIndicatorsApi.get_drift_indicators_values_by_date",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: DriftIndicatorsApi#get_drift_indicators_values_by_date\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Retrieve Drift Indicator entities identified by the provided IDs
+    # @param [Hash] opts the optional parameters
+    # @option opts [Array<String>] :ids Search Drift Indicators by ids - The maximum amount is 100 IDs
+    # @return [DriftindicatorsDriftEntityResponse]
+    def read_drift_indicator_entities(opts = {})
+      data, _status_code, _headers = read_drift_indicator_entities_with_http_info(opts)
+      data
+    end
+
+    # Retrieve Drift Indicator entities identified by the provided IDs
+    # @param [Hash] opts the optional parameters
+    # @option opts [Array<String>] :ids Search Drift Indicators by ids - The maximum amount is 100 IDs
+    # @return [Array<(DriftindicatorsDriftEntityResponse, Integer, Hash)>] DriftindicatorsDriftEntityResponse data, response status code and response headers
+    def read_drift_indicator_entities_with_http_info(opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: DriftIndicatorsApi.read_drift_indicator_entities ...'
+      end
+      # resource path
+      local_var_path = '/container-security/entities/drift-indicators/v1'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'ids'] = @api_client.build_collection_param(opts[:'ids'], :csv) if !opts[:'ids'].nil?
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'DriftindicatorsDriftEntityResponse'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"DriftIndicatorsApi.read_drift_indicator_entities",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: DriftIndicatorsApi#read_drift_indicator_entities\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Returns the total count of Drift indicators over a time period
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :filter Filter images using a query in Falcon Query Language (FQL). Supported filters:  cid,cloud_name,command_line,container_id,file_name,file_sha256,host_id,indicator_process_id,namespace,occurred_at,parent_process_id,pod_name,prevented,scheduler_name,severity,worker_node_name
+    # @return [DriftindicatorsDriftIndicatorsCountValue]
+    def read_drift_indicators_count(opts = {})
+      data, _status_code, _headers = read_drift_indicators_count_with_http_info(opts)
+      data
+    end
+
+    # Returns the total count of Drift indicators over a time period
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :filter Filter images using a query in Falcon Query Language (FQL). Supported filters:  cid,cloud_name,command_line,container_id,file_name,file_sha256,host_id,indicator_process_id,namespace,occurred_at,parent_process_id,pod_name,prevented,scheduler_name,severity,worker_node_name
+    # @return [Array<(DriftindicatorsDriftIndicatorsCountValue, Integer, Hash)>] DriftindicatorsDriftIndicatorsCountValue data, response status code and response headers
+    def read_drift_indicators_count_with_http_info(opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: DriftIndicatorsApi.read_drift_indicators_count ...'
+      end
+      # resource path
+      local_var_path = '/container-security/aggregates/drift-indicators/count/v1'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'filter'] = opts[:'filter'] if !opts[:'filter'].nil?
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'DriftindicatorsDriftIndicatorsCountValue'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"DriftIndicatorsApi.read_drift_indicators_count",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: DriftIndicatorsApi#read_drift_indicators_count\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Retrieve Drift Indicators by the provided search criteria
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :filter Filter Drift Indicators using a query in Falcon Query Language (FQL). Supported filters:  cid, cloud_name, command_line, container_id, file_name, file_sha256, host_id, indicator_process_id, namespace, occurred_at, parent_process_id, pod_name, prevented, scheduler_name, severity, worker_node_name
+    # @option opts [Integer] :limit The upper-bound on the number of records to retrieve.
+    # @option opts [Integer] :offset The offset from where to begin.
+    # @option opts [String] :sort The fields to sort the records on.
+    # @return [DriftindicatorsDriftEntityResponse]
+    def search_and_read_drift_indicator_entities(opts = {})
+      data, _status_code, _headers = search_and_read_drift_indicator_entities_with_http_info(opts)
+      data
+    end
+
+    # Retrieve Drift Indicators by the provided search criteria
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :filter Filter Drift Indicators using a query in Falcon Query Language (FQL). Supported filters:  cid, cloud_name, command_line, container_id, file_name, file_sha256, host_id, indicator_process_id, namespace, occurred_at, parent_process_id, pod_name, prevented, scheduler_name, severity, worker_node_name
+    # @option opts [Integer] :limit The upper-bound on the number of records to retrieve.
+    # @option opts [Integer] :offset The offset from where to begin.
+    # @option opts [String] :sort The fields to sort the records on.
+    # @return [Array<(DriftindicatorsDriftEntityResponse, Integer, Hash)>] DriftindicatorsDriftEntityResponse data, response status code and response headers
+    def search_and_read_drift_indicator_entities_with_http_info(opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: DriftIndicatorsApi.search_and_read_drift_indicator_entities ...'
+      end
+      # resource path
+      local_var_path = '/container-security/combined/drift-indicators/v1'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'filter'] = opts[:'filter'] if !opts[:'filter'].nil?
+      query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
+      query_params[:'offset'] = opts[:'offset'] if !opts[:'offset'].nil?
+      query_params[:'sort'] = opts[:'sort'] if !opts[:'sort'].nil?
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'DriftindicatorsDriftEntityResponse'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"DriftIndicatorsApi.search_and_read_drift_indicator_entities",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: DriftIndicatorsApi#search_and_read_drift_indicator_entities\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Retrieve all drift indicators that match the given query
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :filter Filter Drift Indicators using a query in Falcon Query Language (FQL). Supported filters:  cid, cloud_name, command_line, container_id, file_name, file_sha256, host_id, indicator_process_id, namespace, occurred_at, parent_process_id, pod_name, prevented, scheduler_name, severity, worker_node_name
+    # @option opts [Integer] :limit The upper-bound on the number of records to retrieve.
+    # @option opts [Integer] :offset The offset from where to begin.
+    # @option opts [String] :sort The fields to sort the records on.
+    # @return [MsaspecQueryResponse]
+    def search_drift_indicators(opts = {})
+      data, _status_code, _headers = search_drift_indicators_with_http_info(opts)
+      data
+    end
+
+    # Retrieve all drift indicators that match the given query
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :filter Filter Drift Indicators using a query in Falcon Query Language (FQL). Supported filters:  cid, cloud_name, command_line, container_id, file_name, file_sha256, host_id, indicator_process_id, namespace, occurred_at, parent_process_id, pod_name, prevented, scheduler_name, severity, worker_node_name
+    # @option opts [Integer] :limit The upper-bound on the number of records to retrieve.
+    # @option opts [Integer] :offset The offset from where to begin.
+    # @option opts [String] :sort The fields to sort the records on.
+    # @return [Array<(MsaspecQueryResponse, Integer, Hash)>] MsaspecQueryResponse data, response status code and response headers
+    def search_drift_indicators_with_http_info(opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: DriftIndicatorsApi.search_drift_indicators ...'
+      end
+      # resource path
+      local_var_path = '/container-security/queries/drift-indicators/v1'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'filter'] = opts[:'filter'] if !opts[:'filter'].nil?
+      query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
+      query_params[:'offset'] = opts[:'offset'] if !opts[:'offset'].nil?
+      query_params[:'sort'] = opts[:'sort'] if !opts[:'sort'].nil?
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'MsaspecQueryResponse'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"DriftIndicatorsApi.search_drift_indicators",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: DriftIndicatorsApi#search_drift_indicators\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+  end
+end