crimson-falcon 0.3.0 → 0.4.1

data/lib/crimson-falcon/api/message_center_api.rb

@@ -105,7 +105,7 @@ module Falcon
     # Add an activity to case. Only activities of type comment are allowed via API
     # @param body [DomainActivityCreationRequest]
     # @param [Hash] opts the optional parameters
-    # @return [MsaReplyMetaOnly]
+    # @return [MsaspecResponseFields]
     def case_add_activity(body, opts = {})
       data, _status_code, _headers = case_add_activity_with_http_info(body, opts)
       data
@@ -114,7 +114,7 @@ module Falcon
     # Add an activity to case. Only activities of type comment are allowed via API
     # @param body [DomainActivityCreationRequest]
     # @param [Hash] opts the optional parameters
-    # @return [Array<(MsaReplyMetaOnly, Integer, Hash)>] MsaReplyMetaOnly data, response status code and response headers
+    # @return [Array<(MsaspecResponseFields, Integer, Hash)>] MsaspecResponseFields data, response status code and response headers
     def case_add_activity_with_http_info(body, opts = {})
       if @api_client.config.debugging
         @api_client.config.logger.debug 'Calling API: MessageCenterApi.case_add_activity ...'
@@ -146,7 +146,7 @@ module Falcon
       post_body = opts[:debug_body] || @api_client.object_to_http_body(body)
 
       # return_type
-      return_type = opts[:debug_return_type] || 'MsaReplyMetaOnly'
+      return_type = opts[:debug_return_type] || 'MsaspecResponseFields'
 
       # auth_names
       auth_names = opts[:debug_auth_names] || ['oauth2']
@@ -584,7 +584,7 @@ module Falcon
     # @option opts [String] :sort The property to sort on, followed by a dot (.), followed by the sort direction, either \&quot;asc\&quot; or \&quot;desc\&quot;.
     # @option opts [String] :filter Optional filter and sort criteria in the form of an FQL query. Allowed filters are:   activity.created_time activity.type
     # @option opts [String] :offset Starting index of overall result set from which to return ids.
-    # @return [MsaQueryResponse]
+    # @return [MsaspecQueryResponse]
     def query_activity_by_case_id(case_id, opts = {})
       data, _status_code, _headers = query_activity_by_case_id_with_http_info(case_id, opts)
       data
@@ -597,7 +597,7 @@ module Falcon
     # @option opts [String] :sort The property to sort on, followed by a dot (.), followed by the sort direction, either \&quot;asc\&quot; or \&quot;desc\&quot;.
     # @option opts [String] :filter Optional filter and sort criteria in the form of an FQL query. Allowed filters are:   activity.created_time activity.type
     # @option opts [String] :offset Starting index of overall result set from which to return ids.
-    # @return [Array<(MsaQueryResponse, Integer, Hash)>] MsaQueryResponse data, response status code and response headers
+    # @return [Array<(MsaspecQueryResponse, Integer, Hash)>] MsaspecQueryResponse data, response status code and response headers
     def query_activity_by_case_id_with_http_info(case_id, opts = {})
       if @api_client.config.debugging
         @api_client.config.logger.debug 'Calling API: MessageCenterApi.query_activity_by_case_id ...'
@@ -606,7 +606,7 @@ module Falcon
       if @api_client.config.client_side_validation && case_id.nil?
         fail ArgumentError, "Missing the required parameter 'case_id' when calling MessageCenterApi.query_activity_by_case_id"
       end
-      allowable_values = ["activity.created_time.asc", "activity.created_time.desc", "activity.type.asc", "activity.type.desc"]
+      allowable_values = ["activity.type.asc", "activity.type.desc"]
       if @api_client.config.client_side_validation && opts[:'sort'] && !allowable_values.include?(opts[:'sort'])
         fail ArgumentError, "invalid value for \"sort\", must be one of #{allowable_values}"
       end
@@ -633,7 +633,7 @@ module Falcon
       post_body = opts[:debug_body]
 
       # return_type
-      return_type = opts[:debug_return_type] || 'MsaQueryResponse'
+      return_type = opts[:debug_return_type] || 'MsaspecQueryResponse'
 
       # auth_names
       auth_names = opts[:debug_auth_names] || ['oauth2']
@@ -661,7 +661,7 @@ module Falcon
     # @option opts [String] :sort The property to sort on, followed by a dot (.), followed by the sort direction, either \&quot;asc\&quot; or \&quot;desc\&quot;.
     # @option opts [String] :filter Optional filter and sort criteria in the form of an FQL query. Allowed filters are:   _all activity.body case.aids case.assigner.display_name case.assigner.first_name case.assigner.last_name case.assigner.uid case.assigner.uuid case.body case.created_time case.detections.id case.hosts case.id case.incidents.id case.ip_addresses case.key case.last_modified_time case.status case.title case.type
     # @option opts [String] :offset Starting index of overall result set from which to return ids.
-    # @return [MsaQueryResponse]
+    # @return [MsaspecQueryResponse]
     def query_cases_ids_by_filter(opts = {})
       data, _status_code, _headers = query_cases_ids_by_filter_with_http_info(opts)
       data
@@ -673,12 +673,12 @@ module Falcon
     # @option opts [String] :sort The property to sort on, followed by a dot (.), followed by the sort direction, either \&quot;asc\&quot; or \&quot;desc\&quot;.
     # @option opts [String] :filter Optional filter and sort criteria in the form of an FQL query. Allowed filters are:   _all activity.body case.aids case.assigner.display_name case.assigner.first_name case.assigner.last_name case.assigner.uid case.assigner.uuid case.body case.created_time case.detections.id case.hosts case.id case.incidents.id case.ip_addresses case.key case.last_modified_time case.status case.title case.type
     # @option opts [String] :offset Starting index of overall result set from which to return ids.
-    # @return [Array<(MsaQueryResponse, Integer, Hash)>] MsaQueryResponse data, response status code and response headers
+    # @return [Array<(MsaspecQueryResponse, Integer, Hash)>] MsaspecQueryResponse data, response status code and response headers
     def query_cases_ids_by_filter_with_http_info(opts = {})
       if @api_client.config.debugging
         @api_client.config.logger.debug 'Calling API: MessageCenterApi.query_cases_ids_by_filter ...'
       end
-      allowable_values = ["case.created_time.asc", "case.created_time.desc", "case.id.asc", "case.id.desc", "case.last_modified_time.asc", "case.last_modified_time.desc", "case.status.asc", "case.status.desc", "case.type.asc", "case.type.desc"]
+      allowable_values = ["case.id.asc", "case.id.desc"]
       if @api_client.config.client_side_validation && opts[:'sort'] && !allowable_values.include?(opts[:'sort'])
         fail ArgumentError, "invalid value for \"sort\", must be one of #{allowable_values}"
       end
@@ -704,7 +704,7 @@ module Falcon
       post_body = opts[:debug_body]
 
       # return_type
-      return_type = opts[:debug_return_type] || 'MsaQueryResponse'
+      return_type = opts[:debug_return_type] || 'MsaspecQueryResponse'
 
       # auth_names
       auth_names = opts[:debug_auth_names] || ['oauth2']

data/lib/crimson-falcon/api/ods_api.rb

@@ -617,6 +617,68 @@ module Falcon
       return data, status_code, headers
     end
 
+    # Get Scans by IDs.
+    # @param ids [Array<String>] The scan IDs to retrieve the scan entities
+    # @param [Hash] opts the optional parameters
+    # @return [EntitiesODSScanResponseV2]
+    def get_scans_by_scan_ids_v2(ids, opts = {})
+      data, _status_code, _headers = get_scans_by_scan_ids_v2_with_http_info(ids, opts)
+      data
+    end
+
+    # Get Scans by IDs.
+    # @param ids [Array<String>] The scan IDs to retrieve the scan entities
+    # @param [Hash] opts the optional parameters
+    # @return [Array<(EntitiesODSScanResponseV2, Integer, Hash)>] EntitiesODSScanResponseV2 data, response status code and response headers
+    def get_scans_by_scan_ids_v2_with_http_info(ids, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: OdsApi.get_scans_by_scan_ids_v2 ...'
+      end
+      # verify the required parameter 'ids' is set
+      if @api_client.config.client_side_validation && ids.nil?
+        fail ArgumentError, "Missing the required parameter 'ids' when calling OdsApi.get_scans_by_scan_ids_v2"
+      end
+      # resource path
+      local_var_path = '/ods/entities/scans/v2'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'ids'] = @api_client.build_collection_param(ids, :multi)
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'EntitiesODSScanResponseV2'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"OdsApi.get_scans_by_scan_ids_v2",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: OdsApi#get_scans_by_scan_ids_v2\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
     # Get ScheduledScans by IDs.
     # @param ids [Array<String>] The scan IDs to retrieve the scan entities
     # @param [Hash] opts the optional parameters
@@ -752,7 +814,7 @@ module Falcon
 
     # Query scan hosts.
     # @param [Hash] opts the optional parameters
-    # @option opts [String] :filter A FQL compatible query string. Terms: [id profile_id host_id scan_id host_scan_id filecount.scanned filecount.malicious filecount.quarantined filecount.skipped affected_hosts_count status severity completed_on started_on last_updated]
+    # @option opts [String] :filter A FQL compatible query string. Terms: [id profile_id host_id scan_id host_scan_id filecount.scanned filecount.malicious filecount.quarantined filecount.skipped affected_hosts_count status severity completed_on started_on last_updated scan_control_reason]
     # @option opts [Integer] :offset Index of the starting resource (default to 0)
     # @option opts [Integer] :limit The max number of resources to return (default to 500)
     # @option opts [String] :sort The property to sort on, followed by a |, followed by the sort direction, either \&quot;asc\&quot; or \&quot;desc\&quot; (default to 'last_updated|desc')
@@ -764,7 +826,7 @@ module Falcon
 
     # Query scan hosts.
     # @param [Hash] opts the optional parameters
-    # @option opts [String] :filter A FQL compatible query string. Terms: [id profile_id host_id scan_id host_scan_id filecount.scanned filecount.malicious filecount.quarantined filecount.skipped affected_hosts_count status severity completed_on started_on last_updated]
+    # @option opts [String] :filter A FQL compatible query string. Terms: [id profile_id host_id scan_id host_scan_id filecount.scanned filecount.malicious filecount.quarantined filecount.skipped affected_hosts_count status severity completed_on started_on last_updated scan_control_reason]
     # @option opts [Integer] :offset Index of the starting resource (default to 0)
     # @option opts [Integer] :limit The max number of resources to return (default to 500)
     # @option opts [String] :sort The property to sort on, followed by a |, followed by the sort direction, either \&quot;asc\&quot; or \&quot;desc\&quot; (default to 'last_updated|desc')
@@ -773,7 +835,7 @@ module Falcon
       if @api_client.config.debugging
         @api_client.config.logger.debug 'Calling API: OdsApi.query_scan_host_metadata ...'
       end
-      allowable_values = ["id|asc", "id|desc", "scan_id|asc", "scan_id|desc", "host_id|asc", "host_id|desc", "filecount.scanned|asc", "filecount.scanned|desc", "filecount.malicious|asc", "filecount.malicious|desc", "filecount.quarantined|asc", "filecount.quarantined|desc", "filecount.skipped|asc", "filecount.skipped|desc", "status|asc", "status|desc", "severity|asc", "severity|desc", "started_on|asc", "started_on|desc", "completed_on|asc", "completed_on|desc", "last_updated|asc", "last_updated|desc"]
+      allowable_values = ["id|asc", "id|desc", "scan_id|asc", "scan_id|desc", "host_id|asc", "host_id|desc", "filecount.scanned|asc", "filecount.scanned|desc", "filecount.malicious|asc", "filecount.malicious|desc", "filecount.quarantined|asc", "filecount.quarantined|desc", "filecount.skipped|asc", "filecount.skipped|desc", "status|asc", "status|desc", "severity|asc", "severity|desc", "started_on|asc", "started_on|desc", "completed_on|asc", "completed_on|desc", "last_updated|asc", "last_updated|desc", "scan_control_reason.keyword|asc", "scan_control_reason.keyword|desc"]
       if @api_client.config.client_side_validation && opts[:'sort'] && !allowable_values.include?(opts[:'sort'])
         fail ArgumentError, "invalid value for \"sort\", must be one of #{allowable_values}"
       end
@@ -823,7 +885,7 @@ module Falcon
 
     # Query Scans.
     # @param [Hash] opts the optional parameters
-    # @option opts [String] :filter A FQL compatible query string. Terms: [id profile_id description.keyword initiated_from filecount.scanned filecount.malicious filecount.quarantined filecount.skipped affected_hosts_count status severity scan_started_on scan_completed_on created_on created_by last_updated]
+    # @option opts [String] :filter A FQL compatible query string. Terms: [id profile_id description.keyword initiated_from filecount.scanned filecount.malicious filecount.quarantined filecount.skipped affected_hosts_count status severity scan_started_on scan_completed_on created_on created_by last_updated targeted_host_count missing_host_count]
     # @option opts [Integer] :offset Index of the starting resource (default to 0)
     # @option opts [Integer] :limit The max number of resources to return (default to 500)
     # @option opts [String] :sort The property to sort on, followed by a |, followed by the sort direction, either \&quot;asc\&quot; or \&quot;desc\&quot; (default to 'created_on|desc')
@@ -835,7 +897,7 @@ module Falcon
 
     # Query Scans.
     # @param [Hash] opts the optional parameters
-    # @option opts [String] :filter A FQL compatible query string. Terms: [id profile_id description.keyword initiated_from filecount.scanned filecount.malicious filecount.quarantined filecount.skipped affected_hosts_count status severity scan_started_on scan_completed_on created_on created_by last_updated]
+    # @option opts [String] :filter A FQL compatible query string. Terms: [id profile_id description.keyword initiated_from filecount.scanned filecount.malicious filecount.quarantined filecount.skipped affected_hosts_count status severity scan_started_on scan_completed_on created_on created_by last_updated targeted_host_count missing_host_count]
     # @option opts [Integer] :offset Index of the starting resource (default to 0)
     # @option opts [Integer] :limit The max number of resources to return (default to 500)
     # @option opts [String] :sort The property to sort on, followed by a |, followed by the sort direction, either \&quot;asc\&quot; or \&quot;desc\&quot; (default to 'created_on|desc')
@@ -844,7 +906,7 @@ module Falcon
       if @api_client.config.debugging
         @api_client.config.logger.debug 'Calling API: OdsApi.query_scans ...'
       end
-      allowable_values = ["id|asc", "id|desc", "initiated_from|asc", "initiated_from|desc", "description.keyword|asc", "description.keyword|desc", "filecount.scanned|asc", "filecount.scanned|desc", "filecount.malicious|asc", "filecount.malicious|desc", "filecount.quarantined|asc", "filecount.quarantined|desc", "filecount.skipped|asc", "filecount.skipped|desc", "affected_hosts_count|asc", "affected_hosts_count|desc", "status|asc", "status|desc", "severity|asc", "severity|desc", "scan_started_on|asc", "scan_started_on|desc", "scan_completed_on|asc", "scan_completed_on|desc", "created_on|asc", "created_on|desc", "created_by|asc", "created_by|desc", "last_updated|asc", "last_updated|desc"]
+      allowable_values = ["id|asc", "id|desc", "initiated_from|asc", "initiated_from|desc", "description.keyword|asc", "description.keyword|desc", "filecount.scanned|asc", "filecount.scanned|desc", "filecount.malicious|asc", "filecount.malicious|desc", "filecount.quarantined|asc", "filecount.quarantined|desc", "filecount.skipped|asc", "filecount.skipped|desc", "affected_hosts_count|asc", "affected_hosts_count|desc", "status|asc", "status|desc", "severity|asc", "severity|desc", "scan_started_on|asc", "scan_started_on|desc", "scan_completed_on|asc", "scan_completed_on|desc", "created_on|asc", "created_on|desc", "created_by|asc", "created_by|desc", "last_updated|asc", "last_updated|desc", "targeted_host_count|asc", "targeted_host_count|desc", "missing_host_count|asc", "missing_host_count|desc"]
       if @api_client.config.client_side_validation && opts[:'sort'] && !allowable_values.include?(opts[:'sort'])
         fail ArgumentError, "invalid value for \"sort\", must be one of #{allowable_values}"
       end

data/lib/crimson-falcon/api/real_time_response_admin_api.rb

@@ -211,6 +211,10 @@ module Falcon
       if @api_client.config.client_side_validation && description.nil?
         fail ArgumentError, "Missing the required parameter 'description' when calling RealTimeResponseAdminApi.r_tr_create_put_files"
       end
+      if @api_client.config.client_side_validation && !opts[:'name'].nil? && opts[:'name'].to_s.length > 32766
+        fail ArgumentError, 'invalid value for "opts[:"name"]" when calling RealTimeResponseAdminApi.r_tr_create_put_files, the character length must be smaller than or equal to 32766.'
+      end
+
       if @api_client.config.client_side_validation && !opts[:'comments_for_audit_log'].nil? && opts[:'comments_for_audit_log'].to_s.length > 4096
         fail ArgumentError, 'invalid value for "opts[:"comments_for_audit_log"]" when calling RealTimeResponseAdminApi.r_tr_create_put_files, the character length must be smaller than or equal to 4096.'
       end
@@ -301,6 +305,10 @@ module Falcon
       if @api_client.config.client_side_validation && permission_type.nil?
         fail ArgumentError, "Missing the required parameter 'permission_type' when calling RealTimeResponseAdminApi.r_tr_create_scripts"
       end
+      if @api_client.config.client_side_validation && !opts[:'name'].nil? && opts[:'name'].to_s.length > 32766
+        fail ArgumentError, 'invalid value for "opts[:"name"]" when calling RealTimeResponseAdminApi.r_tr_create_scripts, the character length must be smaller than or equal to 32766.'
+      end
+
       if @api_client.config.client_side_validation && !opts[:'comments_for_audit_log'].nil? && opts[:'comments_for_audit_log'].to_s.length > 4096
         fail ArgumentError, 'invalid value for "opts[:"comments_for_audit_log"]" when calling RealTimeResponseAdminApi.r_tr_create_scripts, the character length must be smaller than or equal to 4096.'
       end
@@ -547,6 +555,68 @@ module Falcon
       return data, status_code, headers
     end
 
+    # Get Falcon scripts with metadata and content of script
+    # @param ids [Array<String>] IDs of the Falcon scripts you want to retrieve
+    # @param [Hash] opts the optional parameters
+    # @return [EmpowerapiMsaFalconScriptResponse]
+    def r_tr_get_falcon_scripts(ids, opts = {})
+      data, _status_code, _headers = r_tr_get_falcon_scripts_with_http_info(ids, opts)
+      data
+    end
+
+    # Get Falcon scripts with metadata and content of script
+    # @param ids [Array<String>] IDs of the Falcon scripts you want to retrieve
+    # @param [Hash] opts the optional parameters
+    # @return [Array<(EmpowerapiMsaFalconScriptResponse, Integer, Hash)>] EmpowerapiMsaFalconScriptResponse data, response status code and response headers
+    def r_tr_get_falcon_scripts_with_http_info(ids, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: RealTimeResponseAdminApi.r_tr_get_falcon_scripts ...'
+      end
+      # verify the required parameter 'ids' is set
+      if @api_client.config.client_side_validation && ids.nil?
+        fail ArgumentError, "Missing the required parameter 'ids' when calling RealTimeResponseAdminApi.r_tr_get_falcon_scripts"
+      end
+      # resource path
+      local_var_path = '/real-time-response/entities/falcon-scripts/v1'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'ids'] = @api_client.build_collection_param(ids, :multi)
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'EmpowerapiMsaFalconScriptResponse'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"RealTimeResponseAdminApi.r_tr_get_falcon_scripts",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: RealTimeResponseAdminApi#r_tr_get_falcon_scripts\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
     # Get put-files based on the ID's given. These are used for the RTR `put` command.
     # @param ids [Array<String>] File IDs
     # @param [Hash] opts the optional parameters
@@ -795,6 +865,81 @@ module Falcon
       return data, status_code, headers
     end
 
+    # Get a list of Falcon script IDs available to the user to run
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :filter Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our [FQL documentation in Falcon](https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-feature-guide).
+    # @option opts [Integer] :offset Starting index of overall result set from which to return ids.
+    # @option opts [Integer] :limit Number of ids to return.
+    # @option opts [String] :sort Sort by spec. Ex: &#39;created_at|asc&#39;.
+    # @return [EmpowerapiMsaIDListResponse]
+    def r_tr_list_falcon_scripts(opts = {})
+      data, _status_code, _headers = r_tr_list_falcon_scripts_with_http_info(opts)
+      data
+    end
+
+    # Get a list of Falcon script IDs available to the user to run
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :filter Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our [FQL documentation in Falcon](https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-feature-guide).
+    # @option opts [Integer] :offset Starting index of overall result set from which to return ids.
+    # @option opts [Integer] :limit Number of ids to return.
+    # @option opts [String] :sort Sort by spec. Ex: &#39;created_at|asc&#39;.
+    # @return [Array<(EmpowerapiMsaIDListResponse, Integer, Hash)>] EmpowerapiMsaIDListResponse data, response status code and response headers
+    def r_tr_list_falcon_scripts_with_http_info(opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: RealTimeResponseAdminApi.r_tr_list_falcon_scripts ...'
+      end
+      if @api_client.config.client_side_validation && !opts[:'limit'].nil? && opts[:'limit'] > 100
+        fail ArgumentError, 'invalid value for "opts[:"limit"]" when calling RealTimeResponseAdminApi.r_tr_list_falcon_scripts, must be smaller than or equal to 100.'
+      end
+
+      allowable_values = ["created_timestamp", "modified_timestamp", "name"]
+      if @api_client.config.client_side_validation && opts[:'sort'] && !allowable_values.include?(opts[:'sort'])
+        fail ArgumentError, "invalid value for \"sort\", must be one of #{allowable_values}"
+      end
+      # resource path
+      local_var_path = '/real-time-response/queries/falcon-scripts/v1'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'filter'] = opts[:'filter'] if !opts[:'filter'].nil?
+      query_params[:'offset'] = opts[:'offset'] if !opts[:'offset'].nil?
+      query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
+      query_params[:'sort'] = opts[:'sort'] if !opts[:'sort'].nil?
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'EmpowerapiMsaIDListResponse'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"RealTimeResponseAdminApi.r_tr_list_falcon_scripts",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: RealTimeResponseAdminApi#r_tr_list_falcon_scripts\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
     # Get a list of put-file ID's that are available to the user for the `put` command.
     # @param [Hash] opts the optional parameters
     # @option opts [String] :filter Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our [FQL documentation in Falcon](https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-feature-guide).
@@ -964,6 +1109,10 @@ module Falcon
       if @api_client.config.client_side_validation && id.nil?
         fail ArgumentError, "Missing the required parameter 'id' when calling RealTimeResponseAdminApi.r_tr_update_scripts"
       end
+      if @api_client.config.client_side_validation && !opts[:'name'].nil? && opts[:'name'].to_s.length > 32766
+        fail ArgumentError, 'invalid value for "opts[:"name"]" when calling RealTimeResponseAdminApi.r_tr_update_scripts, the character length must be smaller than or equal to 32766.'
+      end
+
       if @api_client.config.client_side_validation && !opts[:'comments_for_audit_log'].nil? && opts[:'comments_for_audit_log'].to_s.length > 4096
         fail ArgumentError, 'invalid value for "opts[:"comments_for_audit_log"]" when calling RealTimeResponseAdminApi.r_tr_update_scripts, the character length must be smaller than or equal to 4096.'
       end

data/lib/crimson-falcon/api/real_time_response_audit_api.rb

@@ -0,0 +1,113 @@
+=begin
+Crimson Falcon - Ruby Client SDK
+
+Code auto-generated by OpenAPI Generator; DO NOT EDIT.
+
+MIT License
+
+Copyright (c) 2023 Crowdstrike
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+=end
+
+require 'cgi'
+
+module Falcon
+  class RealTimeResponseAuditApi
+    attr_accessor :api_client
+
+    def initialize(api_client = ApiClient.default)
+      @api_client = api_client
+    end
+    # Get all the RTR sessions created for a customer in a specified duration
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :filter Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our [FQL documentation in Falcon](https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-feature-guide).
+    # @option opts [String] :sort how to sort the session IDs. e.g. sort=created_at|desc will sort the results based on createdAt in descending order
+    # @option opts [String] :limit number of sessions to be returned
+    # @option opts [String] :offset offset value to be used for paginated results
+    # @option opts [Boolean] :with_command_info get sessions with command info included; by default sessions are returned without command info which include cloud_request_ids and logs fields (default to false)
+    # @return [DomainSessionResponseWrapper]
+    def r_tr_audit_sessions(opts = {})
+      data, _status_code, _headers = r_tr_audit_sessions_with_http_info(opts)
+      data
+    end
+
+    # Get all the RTR sessions created for a customer in a specified duration
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :filter Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our [FQL documentation in Falcon](https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-feature-guide).
+    # @option opts [String] :sort how to sort the session IDs. e.g. sort=created_at|desc will sort the results based on createdAt in descending order
+    # @option opts [String] :limit number of sessions to be returned
+    # @option opts [String] :offset offset value to be used for paginated results
+    # @option opts [Boolean] :with_command_info get sessions with command info included; by default sessions are returned without command info which include cloud_request_ids and logs fields (default to false)
+    # @return [Array<(DomainSessionResponseWrapper, Integer, Hash)>] DomainSessionResponseWrapper data, response status code and response headers
+    def r_tr_audit_sessions_with_http_info(opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: RealTimeResponseAuditApi.r_tr_audit_sessions ...'
+      end
+      allowable_values = ["created_at", "updated_at", "deleted_at"]
+      if @api_client.config.client_side_validation && opts[:'sort'] && !allowable_values.include?(opts[:'sort'])
+        fail ArgumentError, "invalid value for \"sort\", must be one of #{allowable_values}"
+      end
+      # resource path
+      local_var_path = '/real-time-response-audit/combined/sessions/v1'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'filter'] = opts[:'filter'] if !opts[:'filter'].nil?
+      query_params[:'sort'] = opts[:'sort'] if !opts[:'sort'].nil?
+      query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
+      query_params[:'offset'] = opts[:'offset'] if !opts[:'offset'].nil?
+      query_params[:'with_command_info'] = opts[:'with_command_info'] if !opts[:'with_command_info'].nil?
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'DomainSessionResponseWrapper'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"RealTimeResponseAuditApi.r_tr_audit_sessions",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: RealTimeResponseAuditApi#r_tr_audit_sessions\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+  end
+end

data/lib/crimson-falcon/api/recon_api.rb

@@ -36,7 +36,7 @@ module Falcon
     def initialize(api_client = ApiClient.default)
       @api_client = api_client
     end
-    # Get notification exposed data record aggregates as specified via JSON in request body. The valid aggregation fields are: [cid notification_id created_date rule.id rule.name rule.topic source_category site author file.name]
+    # Get notification exposed data record aggregates as specified via JSON in request body. The valid aggregation fields are: [cid notification_id created_date rule.id rule.name rule.topic source_category site author file.name credential_status bot.operating_system.hardware_id bot.bot_id]
     # @param body [Array<MsaAggregateQueryRequest>]
     # @param [Hash] opts the optional parameters
     # @return [DomainAggregatesResponse]
@@ -45,7 +45,7 @@ module Falcon
       data
     end
 
-    # Get notification exposed data record aggregates as specified via JSON in request body. The valid aggregation fields are: [cid notification_id created_date rule.id rule.name rule.topic source_category site author file.name]
+    # Get notification exposed data record aggregates as specified via JSON in request body. The valid aggregation fields are: [cid notification_id created_date rule.id rule.name rule.topic source_category site author file.name credential_status bot.operating_system.hardware_id bot.bot_id]
     # @param body [Array<MsaAggregateQueryRequest>]
     # @param [Hash] opts the optional parameters
     # @return [Array<(DomainAggregatesResponse, Integer, Hash)>] DomainAggregatesResponse data, response status code and response headers
@@ -1324,7 +1324,7 @@ module Falcon
     # @option opts [Integer] :offset Starting index of overall result set from which to return ids.
     # @option opts [Integer] :limit Number of IDs to return. Offset + limit should NOT be above 10K.
     # @option opts [String] :sort Possible order by fields: created_date, updated_date. Ex: &#39;updated_date|desc&#39;.
-    # @option opts [String] :filter FQL query to filter notifications by. Possible filter properties are: [id cid user_uuid created_date exposure_date rule.id rule.name rule.topic notification_id source_category site site_id author author_id user_id user_name credentials_url credentials_domain credentials_ip email domain hash_type display_name full_name user_ip phone_number company job_position file.name file.complete_data_set file.download_urls location.postal_code location.city location.state location.federal_district location.federal_admin_region location.country_code social.twitter_id social.facebook_id social.vk_id social.vk_token social.aim_id social.icq_id social.msn_id social.instagram_id social.skype_id financial.credit_card financial.bank_account financial.crypto_currency_addresses login_id _all]
+    # @option opts [String] :filter FQL query to filter notifications by. Possible filter properties are: [id cid user_uuid created_date exposure_date rule.id rule.name rule.topic notification_id source_category site site_id author author_id user_id user_name credentials_url credentials_domain credentials_ip email domain hash_type display_name full_name user_ip phone_number company job_position file.name file.complete_data_set file.download_urls location.postal_code location.city location.state location.federal_district location.federal_admin_region location.country_code social.twitter_id social.facebook_id social.vk_id social.vk_token social.aim_id social.icq_id social.msn_id social.instagram_id social.skype_id financial.credit_card financial.bank_account financial.crypto_currency_addresses login_id credential_status _all bot.operating_system.hardware_id bot.bot_id]
     # @option opts [String] :q Free text search across all indexed fields.
     # @return [DomainQueryResponse]
     def query_notifications_exposed_data_records_v1(opts = {})
@@ -1337,7 +1337,7 @@ module Falcon
     # @option opts [Integer] :offset Starting index of overall result set from which to return ids.
     # @option opts [Integer] :limit Number of IDs to return. Offset + limit should NOT be above 10K.
     # @option opts [String] :sort Possible order by fields: created_date, updated_date. Ex: &#39;updated_date|desc&#39;.
-    # @option opts [String] :filter FQL query to filter notifications by. Possible filter properties are: [id cid user_uuid created_date exposure_date rule.id rule.name rule.topic notification_id source_category site site_id author author_id user_id user_name credentials_url credentials_domain credentials_ip email domain hash_type display_name full_name user_ip phone_number company job_position file.name file.complete_data_set file.download_urls location.postal_code location.city location.state location.federal_district location.federal_admin_region location.country_code social.twitter_id social.facebook_id social.vk_id social.vk_token social.aim_id social.icq_id social.msn_id social.instagram_id social.skype_id financial.credit_card financial.bank_account financial.crypto_currency_addresses login_id _all]
+    # @option opts [String] :filter FQL query to filter notifications by. Possible filter properties are: [id cid user_uuid created_date exposure_date rule.id rule.name rule.topic notification_id source_category site site_id author author_id user_id user_name credentials_url credentials_domain credentials_ip email domain hash_type display_name full_name user_ip phone_number company job_position file.name file.complete_data_set file.download_urls location.postal_code location.city location.state location.federal_district location.federal_admin_region location.country_code social.twitter_id social.facebook_id social.vk_id social.vk_token social.aim_id social.icq_id social.msn_id social.instagram_id social.skype_id financial.credit_card financial.bank_account financial.crypto_currency_addresses login_id credential_status _all bot.operating_system.hardware_id bot.bot_id]
     # @option opts [String] :q Free text search across all indexed fields.
     # @return [Array<(DomainQueryResponse, Integer, Hash)>] DomainQueryResponse data, response status code and response headers
     def query_notifications_exposed_data_records_v1_with_http_info(opts = {})
@@ -1402,7 +1402,7 @@ module Falcon
     # @option opts [Integer] :offset Starting index of overall result set from which to return IDs.
     # @option opts [Integer] :limit Number of IDs to return. Offset + limit should NOT be above 10K.
     # @option opts [String] :sort Possible order by fields: &#x60;created_date&#x60;, &#x60;updated_date&#x60;. Ex: &#x60;updated_date|desc&#x60;.
-    # @option opts [String] :filter FQL query to filter notifications by. Possible filter properties are: [id cid user_uuid status rule_id rule_name rule_topic rule_priority item_type item_site typosquatting.id typosquatting.unicode_format typosquatting.punycode_format typosquatting.parent_domain.id typosquatting.parent_domain.unicode_format typosquatting.parent_domain.punycode_format typosquatting.base_domain.id typosquatting.base_domain.unicode_format typosquatting.base_domain.punycode_format typosquatting.base_domain.is_registered typosquatting.base_domain.whois.registrar.name typosquatting.base_domain.whois.registrar.status typosquatting.base_domain.whois.registrant.email typosquatting.base_domain.whois.registrant.name typosquatting.base_domain.whois.registrant.org typosquatting.base_domain.whois.name_servers created_date updated_date assigned_to_uuid]
+    # @option opts [String] :filter FQL query to filter notifications by. Possible filter properties are: [id cid user_uuid status rule_id rule_name rule_topic rule_priority item_type item_site typosquatting.id typosquatting.unicode_format typosquatting.punycode_format typosquatting.parent_domain.id typosquatting.parent_domain.unicode_format typosquatting.parent_domain.punycode_format typosquatting.base_domain.id typosquatting.base_domain.unicode_format typosquatting.base_domain.punycode_format typosquatting.base_domain.is_registered typosquatting.base_domain.whois.registrar.name typosquatting.base_domain.whois.registrar.status typosquatting.base_domain.whois.registrant.email typosquatting.base_domain.whois.registrant.name typosquatting.base_domain.whois.registrant.org typosquatting.base_domain.whois.name_servers created_date updated_date assigned_to_uuid breach_summary.credential_statuses breach_summary.is_retroactively_deduped]
     # @option opts [String] :q Free text search across all indexed fields.
     # @return [DomainQueryResponse]
     def query_notifications_v1(opts = {})
@@ -1415,7 +1415,7 @@ module Falcon
     # @option opts [Integer] :offset Starting index of overall result set from which to return IDs.
     # @option opts [Integer] :limit Number of IDs to return. Offset + limit should NOT be above 10K.
     # @option opts [String] :sort Possible order by fields: &#x60;created_date&#x60;, &#x60;updated_date&#x60;. Ex: &#x60;updated_date|desc&#x60;.
-    # @option opts [String] :filter FQL query to filter notifications by. Possible filter properties are: [id cid user_uuid status rule_id rule_name rule_topic rule_priority item_type item_site typosquatting.id typosquatting.unicode_format typosquatting.punycode_format typosquatting.parent_domain.id typosquatting.parent_domain.unicode_format typosquatting.parent_domain.punycode_format typosquatting.base_domain.id typosquatting.base_domain.unicode_format typosquatting.base_domain.punycode_format typosquatting.base_domain.is_registered typosquatting.base_domain.whois.registrar.name typosquatting.base_domain.whois.registrar.status typosquatting.base_domain.whois.registrant.email typosquatting.base_domain.whois.registrant.name typosquatting.base_domain.whois.registrant.org typosquatting.base_domain.whois.name_servers created_date updated_date assigned_to_uuid]
+    # @option opts [String] :filter FQL query to filter notifications by. Possible filter properties are: [id cid user_uuid status rule_id rule_name rule_topic rule_priority item_type item_site typosquatting.id typosquatting.unicode_format typosquatting.punycode_format typosquatting.parent_domain.id typosquatting.parent_domain.unicode_format typosquatting.parent_domain.punycode_format typosquatting.base_domain.id typosquatting.base_domain.unicode_format typosquatting.base_domain.punycode_format typosquatting.base_domain.is_registered typosquatting.base_domain.whois.registrar.name typosquatting.base_domain.whois.registrar.status typosquatting.base_domain.whois.registrant.email typosquatting.base_domain.whois.registrant.name typosquatting.base_domain.whois.registrant.org typosquatting.base_domain.whois.name_servers created_date updated_date assigned_to_uuid breach_summary.credential_statuses breach_summary.is_retroactively_deduped]
     # @option opts [String] :q Free text search across all indexed fields.
     # @return [Array<(DomainQueryResponse, Integer, Hash)>] DomainQueryResponse data, response status code and response headers
     def query_notifications_v1_with_http_info(opts = {})