crimson-falcon 0.3.0 → 0.4.0

data/lib/crimson-falcon/models/detections_api_detections_count.rb

@@ -0,0 +1,266 @@
+=begin
+Crimson Falcon - Ruby Client SDK
+
+Code auto-generated by OpenAPI Generator; DO NOT EDIT.
+
+MIT License
+
+Copyright (c) 2023 Crowdstrike
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+=end
+
+require 'date'
+require 'time'
+
+module Falcon
+  class DetectionsApiDetectionsCount
+    attr_accessor :resources
+
+    attr_accessor :errors
+
+    attr_accessor :meta
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    def self.attribute_map
+      {
+        :'resources' => :'Resources',
+        :'errors' => :'errors',
+        :'meta' => :'meta'
+      }
+    end
+
+    # Returns all the JSON keys this model knows about
+    def self.acceptable_attributes
+      attribute_map.values
+    end
+
+    # Attribute type mapping.
+    def self.openapi_types
+      {
+        :'resources' => :'Array<ModelsAPIDetectionCount>',
+        :'errors' => :'Array<MsaspecError>',
+        :'meta' => :'MsaspecMetaInfo'
+      }
+    end
+
+    # List of attributes with nullable: true
+    def self.openapi_nullable
+      Set.new([
+      ])
+    end
+
+    # Initializes the object
+    # @param [Hash] attributes Model attributes in the form of hash
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `Falcon::DetectionsApiDetectionsCount` initialize method"
+      end
+
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          fail ArgumentError, "`#{k}` is not a valid attribute in `Falcon::DetectionsApiDetectionsCount`. Please check the name to make sure it's valid. List of attributes: " + self.class.attribute_map.keys.inspect
+        end
+        h[k.to_sym] = v
+      }
+
+      if attributes.key?(:'resources')
+        if (value = attributes[:'resources']).is_a?(Array)
+          self.resources = value
+        end
+      end
+
+      if attributes.key?(:'errors')
+        if (value = attributes[:'errors']).is_a?(Array)
+          self.errors = value
+        end
+      end
+
+      if attributes.key?(:'meta')
+        self.meta = attributes[:'meta']
+      end
+    end
+
+    # Show invalid properties with the reasons. Usually used together with valid?
+    # @return Array for valid properties with the reasons
+    def list_invalid_properties
+      invalid_properties = Array.new
+      if @resources.nil?
+        invalid_properties.push('invalid value for "resources", resources cannot be nil.')
+      end
+
+      if @meta.nil?
+        invalid_properties.push('invalid value for "meta", meta cannot be nil.')
+      end
+
+      invalid_properties
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    def valid?
+      return false if @resources.nil?
+      return false if @meta.nil?
+      true
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param [Object] Object to be compared
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          resources == o.resources &&
+          errors == o.errors &&
+          meta == o.meta
+    end
+
+    # @see the `==` method
+    # @param [Object] Object to be compared
+    def eql?(o)
+      self == o
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    def hash
+      [resources, errors, meta].hash
+    end
+
+    # Builds the object from hash
+    # @param [Hash] attributes Model attributes in the form of hash
+    # @return [Object] Returns the model itself
+    def self.build_from_hash(attributes)
+      new.build_from_hash(attributes)
+    end
+
+    # Builds the object from hash
+    # @param [Hash] attributes Model attributes in the form of hash
+    # @return [Object] Returns the model itself
+    def build_from_hash(attributes)
+      return nil unless attributes.is_a?(Hash)
+      attributes = attributes.transform_keys(&:to_sym)
+      self.class.openapi_types.each_pair do |key, type|
+        if attributes[self.class.attribute_map[key]].nil? && self.class.openapi_nullable.include?(key)
+          self.send("#{key}=", nil)
+        elsif type =~ /\AArray<(.*)>/i
+          # check to ensure the input is an array given that the attribute
+          # is documented as an array but the input is not
+          if attributes[self.class.attribute_map[key]].is_a?(Array)
+            self.send("#{key}=", attributes[self.class.attribute_map[key]].map { |v| _deserialize($1, v) })
+          end
+        elsif !attributes[self.class.attribute_map[key]].nil?
+          self.send("#{key}=", _deserialize(type, attributes[self.class.attribute_map[key]]))
+        end
+      end
+
+      self
+    end
+
+    # Deserializes the data based on type
+    # @param string type Data type
+    # @param string value Value to be deserialized
+    # @return [Object] Deserialized data
+    def _deserialize(type, value)
+      case type.to_sym
+      when :Time
+        Time.parse(value)
+      when :Date
+        Date.parse(value)
+      when :String
+        value.to_s
+      when :Integer
+        value.to_i
+      when :Float
+        value.to_f
+      when :Boolean
+        if value.to_s =~ /\A(true|t|yes|y|1)\z/i
+          true
+        else
+          false
+        end
+      when :Object
+        # generic object (usually a Hash), return directly
+        value
+      when /\AArray<(?<inner_type>.+)>\z/
+        inner_type = Regexp.last_match[:inner_type]
+        value.map { |v| _deserialize(inner_type, v) }
+      when /\AHash<(?<k_type>.+?), (?<v_type>.+)>\z/
+        k_type = Regexp.last_match[:k_type]
+        v_type = Regexp.last_match[:v_type]
+        {}.tap do |hash|
+          value.each do |k, v|
+            hash[_deserialize(k_type, k)] = _deserialize(v_type, v)
+          end
+        end
+      else # model
+        # models (e.g. Pet) or oneOf
+        klass = Falcon.const_get(type)
+        klass.respond_to?(:openapi_one_of) ? klass.build(value) : klass.build_from_hash(value)
+      end
+    end
+
+    # Returns the string representation of the object
+    # @return [String] String presentation of the object
+    def to_s
+      to_hash.to_s
+    end
+
+    # to_body is an alias to to_hash (backward compatibility)
+    # @return [Hash] Returns the object in the form of hash
+    def to_body
+      to_hash
+    end
+
+    # Returns the object in the form of hash
+    # @return [Hash] Returns the object in the form of hash
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      hash
+    end
+
+    # Outputs non-array value in the form of hash
+    # For object, use to_hash. Otherwise, just return the value
+    # @param [Object] value Any valid value
+    # @return [Hash] Returns the value in the form of hash
+    def _to_hash(value)
+      if value.is_a?(Array)
+        value.compact.map { |v| _to_hash(v) }
+      elsif value.is_a?(Hash)
+        {}.tap do |hash|
+          value.each { |k, v| hash[k] = _to_hash(v) }
+        end
+      elsif value.respond_to? :to_hash
+        value.to_hash
+      else
+        value
+      end
+    end
+  end
+end

data/lib/crimson-falcon/models/detects_alert.rb

@@ -32,72 +32,126 @@ require 'time'
 
 module Falcon
   class DetectsAlert
+    # Device or sensor ID for which the Alert was generated
     attr_accessor :agent_id
 
+    # Common linkage between multiple Alerts that belong so the same detection bouquet
     attr_accessor :aggregate_id
 
+    # Name of the person this Alert is assigned to
     attr_accessor :assigned_to_name
 
+    # UserID to which this Alert is assigned to
     attr_accessor :assigned_to_uid
 
+    # UUID to which this Alert is assigned to
     attr_accessor :assigned_to_uuid
 
+    # Unique ID of CrowdStrike customers
     attr_accessor :cid
 
+    # An opaque internal identifier that can uniquely identify an Alert
     attr_accessor :composite_id
 
+    # Confidence is a 1-100 integer value denoting the confidence that, when this Alert fires, it is indicative of malicious activity
     attr_accessor :confidence
 
+    # internal only
     attr_accessor :crawl_edge_ids
 
+    # internal only
     attr_accessor :crawl_vertex_ids
 
+    # indicates when ThreatGraph was crawled to gather info for this alert creation/update
     attr_accessor :crawled_timestamp
 
+    # indicates when the Alert was first written to backend store
     attr_accessor :created_timestamp
 
+    # Data Domains represents domains to which this alert belongs to
+    attr_accessor :data_domains
+
+    # Short, customer-visible summary of the detected activity
     attr_accessor :description
 
+    # Customer visible name for the Alert's pattern
     attr_accessor :display_name
 
+    # Boolean to know if we sent email regarding this Alert
     attr_accessor :email_sent
 
+    # internal only
+    attr_accessor :es_doc_id
+
+    # internal only
+    attr_accessor :es_doc_version
+
+    # internal only
+    attr_accessor :es_routing_id
+
+    # Boolean indicating if this Alert is internal or external
     attr_accessor :external
 
+    # Vertex key which triggers the formation of the Alert
     attr_accessor :id
 
+    # Pattern Name coming either from Taxonomy or directly from the ingested Alert
     attr_accessor :name
 
+    # End goal that an attack adversary intends to achieve according to MITRE
     attr_accessor :objective
 
+    # Taxonomy patternID for this Alert
     attr_accessor :pattern_id
 
+    # Platform that this Alert was triggered on e.g. Android, Windows, etc..
     attr_accessor :platform
 
+    attr_accessor :poly_id
+
+    # Product specifies the SKU that this Alert belongs to e.g. mobile, idp, epp
     attr_accessor :product
 
+    # Scenario was used pre-Handrails to display additional killchain context for UI alerts. With handrails, this field is mostly  obsolete in favor of tactic/technique. Still, it can be useful for determining specific pattern types that are not straightforward to distinguish from other fields alone
     attr_accessor :scenario
 
+    # Severity is also a 1-100 integer value, but unlike confidence severity impacts how a Alert is displayed in the UI
     attr_accessor :severity
 
+    # Boolean indicating if this Alert will be shown in the UI or if it's hidden'
     attr_accessor :show_in_ui
 
+    # Source Products are products that produced events which contributed to this alert
+    attr_accessor :source_products
+
+    # Source Vendors are vendors that produced events which contributed to this alert
+    attr_accessor :source_vendors
+
+    # Could be one of the following - New, closed, in_progress, reopened
     attr_accessor :status
 
+    # Tactic and Technique are references to MITRE ATT&CK, which is a public framework for tracking and modeling adversary tools techniques and procedures
     attr_accessor :tactic
 
+    # Unique ID for the tactic seen in the Alert
     attr_accessor :tactic_id
 
+    # Tags are string values associated with the alert that can be added or removed through the API
     attr_accessor :tags
 
+    # Tactic and Technique are references to MITRE ATT&CK, which is a public framework for tracking and modeling adversary tools techniques and procedures
     attr_accessor :technique
 
+    # Unique ID for the technique seen in the Alert
     attr_accessor :technique_id
 
+    # stored value coming in directly from the ingested event or set by cloud in the absence of it
     attr_accessor :timestamp
 
+    # Type of definition Detections Extensibility use. Keyed-off of Pattern of the incoming events/Alerts
     attr_accessor :type
 
+    # indicates when the Alert was last modified
     attr_accessor :updated_timestamp
 
     # Attribute mapping from ruby-style variable name to JSON key.
@@ -115,19 +169,26 @@ module Falcon
         :'crawl_vertex_ids' => :'crawl_vertex_ids',
         :'crawled_timestamp' => :'crawled_timestamp',
         :'created_timestamp' => :'created_timestamp',
+        :'data_domains' => :'data_domains',
         :'description' => :'description',
         :'display_name' => :'display_name',
         :'email_sent' => :'email_sent',
+        :'es_doc_id' => :'es_doc_id',
+        :'es_doc_version' => :'es_doc_version',
+        :'es_routing_id' => :'es_routing_id',
         :'external' => :'external',
         :'id' => :'id',
         :'name' => :'name',
         :'objective' => :'objective',
         :'pattern_id' => :'pattern_id',
         :'platform' => :'platform',
+        :'poly_id' => :'poly_id',
         :'product' => :'product',
         :'scenario' => :'scenario',
         :'severity' => :'severity',
         :'show_in_ui' => :'show_in_ui',
+        :'source_products' => :'source_products',
+        :'source_vendors' => :'source_vendors',
         :'status' => :'status',
         :'tactic' => :'tactic',
         :'tactic_id' => :'tactic_id',
@@ -160,19 +221,26 @@ module Falcon
         :'crawl_vertex_ids' => :'Hash<String, Array<String>>',
         :'crawled_timestamp' => :'Time',
         :'created_timestamp' => :'Time',
+        :'data_domains' => :'Array<String>',
         :'description' => :'String',
         :'display_name' => :'String',
         :'email_sent' => :'Boolean',
+        :'es_doc_id' => :'String',
+        :'es_doc_version' => :'Integer',
+        :'es_routing_id' => :'String',
         :'external' => :'Boolean',
         :'id' => :'String',
         :'name' => :'String',
         :'objective' => :'String',
         :'pattern_id' => :'Integer',
         :'platform' => :'String',
+        :'poly_id' => :'String',
         :'product' => :'String',
         :'scenario' => :'String',
         :'severity' => :'Integer',
         :'show_in_ui' => :'Boolean',
+        :'source_products' => :'Array<String>',
+        :'source_vendors' => :'Array<String>',
         :'status' => :'String',
         :'tactic' => :'String',
         :'tactic_id' => :'String',
@@ -258,6 +326,12 @@ module Falcon
         self.created_timestamp = attributes[:'created_timestamp']
       end
 
+      if attributes.key?(:'data_domains')
+        if (value = attributes[:'data_domains']).is_a?(Array)
+          self.data_domains = value
+        end
+      end
+
       if attributes.key?(:'description')
         self.description = attributes[:'description']
       end
@@ -270,6 +344,18 @@ module Falcon
         self.email_sent = attributes[:'email_sent']
       end
 
+      if attributes.key?(:'es_doc_id')
+        self.es_doc_id = attributes[:'es_doc_id']
+      end
+
+      if attributes.key?(:'es_doc_version')
+        self.es_doc_version = attributes[:'es_doc_version']
+      end
+
+      if attributes.key?(:'es_routing_id')
+        self.es_routing_id = attributes[:'es_routing_id']
+      end
+
       if attributes.key?(:'external')
         self.external = attributes[:'external']
       end
@@ -294,6 +380,10 @@ module Falcon
         self.platform = attributes[:'platform']
       end
 
+      if attributes.key?(:'poly_id')
+        self.poly_id = attributes[:'poly_id']
+      end
+
       if attributes.key?(:'product')
         self.product = attributes[:'product']
       end
@@ -310,6 +400,18 @@ module Falcon
         self.show_in_ui = attributes[:'show_in_ui']
       end
 
+      if attributes.key?(:'source_products')
+        if (value = attributes[:'source_products']).is_a?(Array)
+          self.source_products = value
+        end
+      end
+
+      if attributes.key?(:'source_vendors')
+        if (value = attributes[:'source_vendors']).is_a?(Array)
+          self.source_vendors = value
+        end
+      end
+
       if attributes.key?(:'status')
         self.status = attributes[:'status']
       end
@@ -353,10 +455,6 @@ module Falcon
     # @return Array for valid properties with the reasons
     def list_invalid_properties
       invalid_properties = Array.new
-      if @id.nil?
-        invalid_properties.push('invalid value for "id", id cannot be nil.')
-      end
-
       if @type.nil?
         invalid_properties.push('invalid value for "type", type cannot be nil.')
       end
@@ -367,7 +465,6 @@ module Falcon
     # Check to see if the all the properties in the model are valid
     # @return true if the model is valid
     def valid?
-      return false if @id.nil?
       return false if @type.nil?
       true
     end
@@ -389,19 +486,26 @@ module Falcon
           crawl_vertex_ids == o.crawl_vertex_ids &&
           crawled_timestamp == o.crawled_timestamp &&
           created_timestamp == o.created_timestamp &&
+          data_domains == o.data_domains &&
           description == o.description &&
           display_name == o.display_name &&
           email_sent == o.email_sent &&
+          es_doc_id == o.es_doc_id &&
+          es_doc_version == o.es_doc_version &&
+          es_routing_id == o.es_routing_id &&
           external == o.external &&
           id == o.id &&
           name == o.name &&
           objective == o.objective &&
           pattern_id == o.pattern_id &&
           platform == o.platform &&
+          poly_id == o.poly_id &&
           product == o.product &&
           scenario == o.scenario &&
           severity == o.severity &&
           show_in_ui == o.show_in_ui &&
+          source_products == o.source_products &&
+          source_vendors == o.source_vendors &&
           status == o.status &&
           tactic == o.tactic &&
           tactic_id == o.tactic_id &&
@@ -422,7 +526,7 @@ module Falcon
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [agent_id, aggregate_id, assigned_to_name, assigned_to_uid, assigned_to_uuid, cid, composite_id, confidence, crawl_edge_ids, crawl_vertex_ids, crawled_timestamp, created_timestamp, description, display_name, email_sent, external, id, name, objective, pattern_id, platform, product, scenario, severity, show_in_ui, status, tactic, tactic_id, tags, technique, technique_id, timestamp, type, updated_timestamp].hash
+      [agent_id, aggregate_id, assigned_to_name, assigned_to_uid, assigned_to_uuid, cid, composite_id, confidence, crawl_edge_ids, crawl_vertex_ids, crawled_timestamp, created_timestamp, data_domains, description, display_name, email_sent, es_doc_id, es_doc_version, es_routing_id, external, id, name, objective, pattern_id, platform, poly_id, product, scenario, severity, show_in_ui, source_products, source_vendors, status, tactic, tactic_id, tags, technique, technique_id, timestamp, type, updated_timestamp].hash
     end
 
     # Builds the object from hash