crimson-falcon 0.4.1 → 1.0.0

data/spec/api/intel_spec.rb

@@ -0,0 +1,366 @@
+=begin
+Crimson Falcon - Ruby Client SDK
+
+Code auto-generated by OpenAPI Generator; DO NOT EDIT.
+
+MIT License
+
+Copyright (c) 2023 Crowdstrike
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+=end
+
+require 'spec_helper'
+require 'json'
+
+# Unit tests for Falcon::Intel
+# Automatically generated by openapi-generator (https://openapi-generator.tech)
+# Please update as you see appropriate
+describe 'Intel' do
+  before(:all) do
+    # run before each test
+    @api_instance = Falcon::Intel.new
+  end
+
+  after(:all) do
+    # run after each test
+  end
+
+  describe 'test an instance of Intel' do
+    it 'should create an instance of Intel' do
+      expect(@api_instance).to be_instance_of(Falcon::Intel)
+    end
+  end
+
+  # unit tests for get_intel_actor_entities
+  # Retrieve specific actors using their actor IDs.
+  # @param ids The IDs of the actors you want to retrieve.
+  # @param [Hash] opts the optional parameters
+  # @option opts [Array<String>] :fields The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like:  \\_\\_\\&lt;collection\\&gt;\\_\\_.  Ex: slug \\_\\_full\\_\\_.  Defaults to \\_\\_basic\\_\\_.
+  # @return [DomainActorsResponse]
+  describe 'get_intel_actor_entities test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for get_intel_indicator_entities
+  # Retrieve specific indicators using their indicator IDs.
+  # @param body
+  # @param [Hash] opts the optional parameters
+  # @return [DomainPublicIndicatorsV3Response]
+  describe 'get_intel_indicator_entities test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for get_intel_report_entities
+  # Retrieve specific reports using their report IDs.
+  # @param ids The IDs of the reports you want to retrieve.
+  # @param [Hash] opts the optional parameters
+  # @option opts [Array<String>] :fields The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like:  \\_\\_\\&lt;collection\\&gt;\\_\\_.  Ex: slug \\_\\_full\\_\\_.  Defaults to \\_\\_basic\\_\\_.
+  # @return [DomainNewsResponse]
+  describe 'get_intel_report_entities test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for get_intel_report_pdf
+  # Return a Report PDF attachment
+  # @param [Hash] opts the optional parameters
+  # @option opts [String] :id The ID of the report you want to download as a PDF.
+  # @option opts [String] :ids The ID of the report you want to download as a PDF. This parameter is used only if no id parameter given.
+  # @return [File]
+  describe 'get_intel_report_pdf test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for get_intel_rule_entities
+  # Retrieve details for rule sets for the specified ids.
+  # @param ids The ids of rules to return.
+  # @param [Hash] opts the optional parameters
+  # @return [DomainRulesResponse]
+  describe 'get_intel_rule_entities test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for get_intel_rule_file
+  # Download earlier rule sets.
+  # @param id The ID of the rule set.
+  # @param [Hash] opts the optional parameters
+  # @option opts [String] :accept Choose the format you want the rule set in.
+  # @option opts [String] :format Choose the format you want the rule set in. Valid formats are zip and gzip. Defaults to zip.
+  # @return [File]
+  describe 'get_intel_rule_file test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for get_latest_intel_rule_file
+  # Download the latest rule set.
+  # @param type The rule news report type. Accepted values:  snort-suricata-master  snort-suricata-update  snort-suricata-changelog  yara-master  yara-update  yara-changelog  common-event-format  netwitness  cql-master  cql-update  cql-changelog
+  # @param [Hash] opts the optional parameters
+  # @option opts [String] :accept Choose the format you want the rule set in.
+  # @option opts [String] :if_none_match Download the latest rule set only if it doesn&#39;t have an ETag matching the given ones.
+  # @option opts [String] :if_modified_since Download the latest rule set only if the rule was modified after this date. http, ANSIC and RFC850 formats accepted
+  # @option opts [String] :format Choose the format you want the rule set in. Valid formats are zip and gzip. Defaults to zip.
+  # @option opts [String] :if_modified_since2 Download Only if changed since
+  # @return [File]
+  describe 'get_latest_intel_rule_file test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for get_malware_entities
+  # Get malware entities for specified ids.
+  # @param ids Malware family name in lower case with spaces, dots and slashes replaced with dashes
+  # @param [Hash] opts the optional parameters
+  # @return [DomainMalwareResponse]
+  describe 'get_malware_entities test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for get_malware_mitre_report
+  # Export Mitre ATT&amp;CK information for a given malware family.
+  # @param id Malware family name in lower case with spaces replaced with dashes
+  # @param format Supported report formats: CSV, JSON or JSON_NAVIGATOR
+  # @param [Hash] opts the optional parameters
+  # @option opts [String] :x_cs_useruuid User id
+  # @return [nil]
+  describe 'get_malware_mitre_report test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for get_mitre_report
+  # Export Mitre ATT&amp;CK information for a given actor.
+  # @param actor_id Actor ID(derived from the actor&#39;s name)
+  # @param format Supported report formats: CSV or JSON
+  # @param [Hash] opts the optional parameters
+  # @return [nil]
+  describe 'get_mitre_report test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for get_vulnerabilities
+  # Get vulnerabilities
+  # @param body
+  # @param [Hash] opts the optional parameters
+  # @return [DomainVulnerabilityResponse]
+  describe 'get_vulnerabilities test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for post_mitre_attacks
+  # Retrieves report and observable IDs associated with the given actor and attacks
+  # @param body
+  # @param [Hash] opts the optional parameters
+  # @return [nil]
+  describe 'post_mitre_attacks test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for query_intel_actor_entities
+  # Get info about actors that match provided FQL filters.
+  # @param [Hash] opts the optional parameters
+  # @option opts [Integer] :offset Set the starting row number to return actors from. Defaults to 0.
+  # @option opts [Integer] :limit Set the number of actors to return. The value must be between 1 and 5000.
+  # @option opts [String] :sort Order fields in ascending or descending order.  Ex: created_date|asc.
+  # @option opts [String] :filter Filter your query by specifying FQL filter parameters. Filter parameters include:  actor_type, capabilities, capability, capability.id, capability.slug, capability.value, created_date, description, ecrime_kill_chain.attribution, ecrime_kill_chain.crimes, ecrime_kill_chain.customers, ecrime_kill_chain.marketing, ecrime_kill_chain.monetization, ecrime_kill_chain.services_offered, ecrime_kill_chain.services_used, ecrime_kill_chain.technical_tradecraft, ecrime_kill_chain.victims, first_activity_date, group, group.id, group.slug, group.value, id, kill_chain.actions_and_objectives, kill_chain.actions_on_objectives, kill_chain.command_and_control, kill_chain.delivery, kill_chain.exploitation, kill_chain.installation, kill_chain.objectives, kill_chain.reconnaissance, kill_chain.weaponization, known_as, last_activity_date, last_modified_date, motivations, motivations.id, motivations.slug, motivations.value, name, objectives, origins, origins.id, origins.slug, origins.value, region, region.id, region.slug, region.value, short_description, slug, status, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, target_regions, target_regions.id, target_regions.slug, target_regions.value.
+  # @option opts [String] :q Perform a generic substring search across all fields.
+  # @option opts [Array<String>] :fields The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like:  \\_\\_\\&lt;collection\\&gt;\\_\\_.  Ex: slug \\_\\_full\\_\\_.  Defaults to \\_\\_basic\\_\\_.
+  # @return [DomainActorsResponse]
+  describe 'query_intel_actor_entities test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for query_intel_actor_ids
+  # Get actor IDs that match provided FQL filters.
+  # @param [Hash] opts the optional parameters
+  # @option opts [Integer] :offset Set the starting row number to return actors IDs from. Defaults to 0.
+  # @option opts [Integer] :limit Set the number of actor IDs to return. The value must be between 1 and 5000.
+  # @option opts [String] :sort Order fields in ascending or descending order.  Ex: created_date|asc.
+  # @option opts [String] :filter Filter your query by specifying FQL filter parameters. Filter parameters include:  actor_type, capabilities, capability, capability.id, capability.slug, capability.value, created_date, description, ecrime_kill_chain.attribution, ecrime_kill_chain.crimes, ecrime_kill_chain.customers, ecrime_kill_chain.marketing, ecrime_kill_chain.monetization, ecrime_kill_chain.services_offered, ecrime_kill_chain.services_used, ecrime_kill_chain.technical_tradecraft, ecrime_kill_chain.victims, first_activity_date, group, group.id, group.slug, group.value, id, kill_chain.actions_and_objectives, kill_chain.actions_on_objectives, kill_chain.command_and_control, kill_chain.delivery, kill_chain.exploitation, kill_chain.installation, kill_chain.objectives, kill_chain.reconnaissance, kill_chain.weaponization, known_as, last_activity_date, last_modified_date, motivations, motivations.id, motivations.slug, motivations.value, name, objectives, origins, origins.id, origins.slug, origins.value, region, region.id, region.slug, region.value, short_description, slug, status, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, target_regions, target_regions.id, target_regions.slug, target_regions.value.
+  # @option opts [String] :q Perform a generic substring search across all fields.
+  # @return [MsaQueryResponse]
+  describe 'query_intel_actor_ids test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for query_intel_indicator_entities
+  # Get info about indicators that match provided FQL filters.
+  # @param [Hash] opts the optional parameters
+  # @option opts [Integer] :offset Set the starting row number to return indicators from. Defaults to 0.
+  # @option opts [Integer] :limit Set the number of indicators to return. The number must be between 1 and 10000
+  # @option opts [String] :sort Order fields in ascending or descending order.  Ex: published_date|asc.
+  # @option opts [String] :filter Filter your query by specifying FQL filter parameters. Filter parameters include:  _marker, actors, deleted, domain_types, id, indicator, ip_address_types, kill_chains, labels, labels.created_on, labels.last_valid_on, labels.name, last_updated, malicious_confidence, malware_families, published_date, reports, scope, targets, threat_types, type, vulnerabilities.
+  # @option opts [String] :q Perform a generic substring search across all fields.
+  # @option opts [Boolean] :include_deleted If true, include both published and deleted indicators in the response. Defaults to false.
+  # @option opts [Boolean] :include_relations If true, include related indicators in the response. Defaults to true.
+  # @return [DomainPublicIndicatorsV3Response]
+  describe 'query_intel_indicator_entities test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for query_intel_indicator_ids
+  # Get indicators IDs that match provided FQL filters.
+  # @param [Hash] opts the optional parameters
+  # @option opts [Integer] :offset Set the starting row number to return indicator IDs from. Defaults to 0.
+  # @option opts [Integer] :limit Set the number of indicator IDs to return. The number must be between 1 and 10000
+  # @option opts [String] :sort Order fields in ascending or descending order.  Ex: published_date|asc.
+  # @option opts [String] :filter Filter your query by specifying FQL filter parameters. Filter parameters include:  _marker, actors, deleted, domain_types, id, indicator, ip_address_types, kill_chains, labels, labels.created_on, labels.last_valid_on, labels.name, last_updated, malicious_confidence, malware_families, published_date, reports, scope, targets, threat_types, type, vulnerabilities.
+  # @option opts [String] :q Perform a generic substring search across all fields.
+  # @option opts [Boolean] :include_deleted If true, include both published and deleted indicators in the response. Defaults to false.
+  # @option opts [Boolean] :include_relations If true, include related indicators in the response. Defaults to true.
+  # @return [MsaQueryResponse]
+  describe 'query_intel_indicator_ids test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for query_intel_report_entities
+  # Get info about reports that match provided FQL filters.
+  # @param [Hash] opts the optional parameters
+  # @option opts [Integer] :offset Set the starting row number to return reports from. Defaults to 0.
+  # @option opts [Integer] :limit Set the number of reports to return. The value must be between 1 and 5000.
+  # @option opts [String] :sort Order fields in ascending or descending order. Ex: created_date|asc.
+  # @option opts [String] :filter Filter your query by specifying FQL filter parameters. Filter parameters include:  actors, actors.id, actors.name, actors.slug, actors.url, created_date, description, id, last_modified_date, malware, malware.community_identifiers, malware.family_name, malware.slug, motivations, motivations.id, motivations.slug, motivations.value, name, name.raw, short_description, slug, sub_type, sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, tags.value, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, type, type.id, type.name, type.slug, url.
+  # @option opts [String] :q Perform a generic substring search across all fields.
+  # @option opts [Array<String>] :fields The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like:  \\_\\_\\&lt;collection\\&gt;\\_\\_.  Ex: slug \\_\\_full\\_\\_.  Defaults to \\_\\_basic\\_\\_.
+  # @return [DomainNewsResponse]
+  describe 'query_intel_report_entities test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for query_intel_report_ids
+  # Get report IDs that match provided FQL filters.
+  # @param [Hash] opts the optional parameters
+  # @option opts [Integer] :offset Set the starting row number to return report IDs from. Defaults to 0.
+  # @option opts [Integer] :limit Set the number of report IDs to return. The value must be between 1 and 5000.
+  # @option opts [String] :sort Order fields in ascending or descending order.  Ex: created_date|asc.
+  # @option opts [String] :filter Filter your query by specifying FQL filter parameters. Filter parameters include:  actors, actors.id, actors.name, actors.slug, actors.url, created_date, description, id, last_modified_date, malware, malware.community_identifiers, malware.family_name, malware.slug, motivations, motivations.id, motivations.slug, motivations.value, name, name.raw, short_description, slug, sub_type, sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, tags.value, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, type, type.id, type.name, type.slug, url.
+  # @option opts [String] :q Perform a generic substring search across all fields.
+  # @return [MsaQueryResponse]
+  describe 'query_intel_report_ids test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for query_intel_rule_ids
+  # Search for rule IDs that match provided filter criteria.
+  # @param type The rule news report type. Accepted values:  snort-suricata-master  snort-suricata-update  snort-suricata-changelog  yara-master  yara-update  yara-changelog  common-event-format  netwitness  cql-master  cql-update  cql-changelog
+  # @param [Hash] opts the optional parameters
+  # @option opts [Integer] :offset Set the starting row number to return reports from. Defaults to 0.
+  # @option opts [Integer] :limit The number of rule IDs to return. Defaults to 10.
+  # @option opts [String] :sort Order fields in ascending or descending order.  Ex: created_date|asc.
+  # @option opts [Array<String>] :name Search by rule title.
+  # @option opts [Array<String>] :description Substring match on description field.
+  # @option opts [Array<String>] :tags Search for rule tags.
+  # @option opts [Integer] :min_created_date Filter results to those created on or after a certain date.
+  # @option opts [String] :max_created_date Filter results to those created on or before a certain date.
+  # @option opts [String] :q Perform a generic substring search across all fields.
+  # @return [MsaQueryResponse]
+  describe 'query_intel_rule_ids test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for query_malware
+  # Get malware family names that match provided FQL filters.
+  # @param [Hash] opts the optional parameters
+  # @option opts [Integer] :offset Set the starting row number to return malware IDs from. Defaults to 0.
+  # @option opts [Integer] :limit Set the number of malware IDs to return. The value must be between 1 and 5000.
+  # @option opts [String] :sort Order fields in ascending or descending order.  Ex: created_date|asc.
+  # @option opts [String] :filter Filter your query by specifying FQL filter parameters.
+  # @option opts [String] :q Perform a generic substring search across all fields.
+  # @return [DomainQueryResponse]
+  describe 'query_malware test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for query_mitre_attacks
+  # Gets MITRE tactics and techniques for the given actor, returning concatenation of id and tactic and technique ids, example: fancy-bear_TA0011_T1071
+  # @param [Hash] opts the optional parameters
+  # @option opts [String] :id The actor ID(derived from the actor&#39;s name) for which to retrieve a list of attacks, for example: fancy-bear. Only one value is allowed
+  # @option opts [Array<String>] :ids The actor ID(derived from the actor&#39;s name) for which to retrieve a list of attacks, for example: fancy-bear. Multiple values are allowed
+  # @return [DomainQueryMitreAttacksResponse]
+  describe 'query_mitre_attacks test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for query_mitre_attacks_for_malware
+  # Gets MITRE tactics and techniques for the given malware
+  # @param ids Malware family name in lower case with spaces replaced with dashes
+  # @param [Hash] opts the optional parameters
+  # @return [DomainQueryResponse]
+  describe 'query_mitre_attacks_for_malware test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for query_vulnerabilities
+  # Get vulnerabilities IDs
+  # @param [Hash] opts the optional parameters
+  # @option opts [String] :offset Starting index of result set from which to return IDs.
+  # @option opts [Integer] :limit Number of IDs to return.
+  # @option opts [String] :sort Order by fields.
+  # @option opts [String] :filter FQL query specifying the filter parameters.
+  # @option opts [String] :q Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed).
+  # @return [MsaQueryResponse]
+  describe 'query_vulnerabilities test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+end

data/spec/api/intelligence_indicator_graph_spec.rb

@@ -0,0 +1,66 @@
+=begin
+Crimson Falcon - Ruby Client SDK
+
+Code auto-generated by OpenAPI Generator; DO NOT EDIT.
+
+MIT License
+
+Copyright (c) 2023 Crowdstrike
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+=end
+
+require 'spec_helper'
+require 'json'
+
+# Unit tests for Falcon::IntelligenceIndicatorGraph
+# Automatically generated by openapi-generator (https://openapi-generator.tech)
+# Please update as you see appropriate
+describe 'IntelligenceIndicatorGraph' do
+  before(:all) do
+    # run before each test
+    @api_instance = Falcon::IntelligenceIndicatorGraph.new
+  end
+
+  after(:all) do
+    # run after each test
+  end
+
+  describe 'test an instance of IntelligenceIndicatorGraph' do
+    it 'should create an instance of IntelligenceIndicatorGraph' do
+      expect(@api_instance).to be_instance_of(Falcon::IntelligenceIndicatorGraph)
+    end
+  end
+
+  # unit tests for search_indicators
+  # Search indicators based on FQL filter.
+  # @param x_cs_useruuid User ID.
+  # @param body
+  # @param [Hash] opts the optional parameters
+  # @option opts [Integer] :limit Limit
+  # @option opts [String] :offset Offset
+  # @return [RestapiIndicatorResponse]
+  describe 'search_indicators test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+end

data/spec/api/ioa_exclusions_spec.rb

@@ -0,0 +1,113 @@
+=begin
+Crimson Falcon - Ruby Client SDK
+
+Code auto-generated by OpenAPI Generator; DO NOT EDIT.
+
+MIT License
+
+Copyright (c) 2023 Crowdstrike
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+=end
+
+require 'spec_helper'
+require 'json'
+
+# Unit tests for Falcon::IoaExclusions
+# Automatically generated by openapi-generator (https://openapi-generator.tech)
+# Please update as you see appropriate
+describe 'IoaExclusions' do
+  before(:all) do
+    # run before each test
+    @api_instance = Falcon::IoaExclusions.new
+  end
+
+  after(:all) do
+    # run after each test
+  end
+
+  describe 'test an instance of IoaExclusions' do
+    it 'should create an instance of IoaExclusions' do
+      expect(@api_instance).to be_instance_of(Falcon::IoaExclusions)
+    end
+  end
+
+  # unit tests for create_ioa_exclusions_v1
+  # Create the IOA exclusions
+  # @param body
+  # @param [Hash] opts the optional parameters
+  # @return [IoaExclusionsIoaExclusionsRespV1]
+  describe 'create_ioa_exclusions_v1 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for delete_ioa_exclusions_v1
+  # Delete the IOA exclusions by id
+  # @param ids The ids of the exclusions to delete
+  # @param [Hash] opts the optional parameters
+  # @option opts [String] :comment Explains why this exclusions was deleted
+  # @return [MsaQueryResponse]
+  describe 'delete_ioa_exclusions_v1 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for get_ioa_exclusions_v1
+  # Get a set of IOA Exclusions by specifying their IDs
+  # @param ids The ids of the exclusions to retrieve
+  # @param [Hash] opts the optional parameters
+  # @return [IoaExclusionsIoaExclusionsRespV1]
+  describe 'get_ioa_exclusions_v1 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for query_ioa_exclusions_v1
+  # Search for IOA exclusions.
+  # @param [Hash] opts the optional parameters
+  # @option opts [String] :filter The filter expression that should be used to limit the results. Filtered queries involving regex fields should specify their expressions in the `ifn_regex` and `cl_regex` parameters.
+  # @option opts [String] :ifn_regex The `ifn_regex` expression to filter exclusions by, used alongside expressions specified in the filter query parameter.
+  # @option opts [String] :cl_regex The `cl_regex` expression to filter exclusions by, used alongside expressions specified in the filter query parameter.
+  # @option opts [Integer] :offset The offset to start retrieving records from
+  # @option opts [Integer] :limit The maximum records to return. [1-500]
+  # @option opts [String] :sort The sort expression that should be used to sort the results.
+  # @return [MsaQueryResponse]
+  describe 'query_ioa_exclusions_v1 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for update_ioa_exclusions_v1
+  # Update the IOA exclusions
+  # @param body
+  # @param [Hash] opts the optional parameters
+  # @return [IoaExclusionsIoaExclusionsRespV1]
+  describe 'update_ioa_exclusions_v1 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+end