crimson-falcon 1.0.0 → 1.1.0

data/lib/crimson-falcon/api/tailored_intelligence.rb

@@ -0,0 +1,373 @@
+=begin
+Crimson Falcon - Ruby Client SDK
+
+Code auto-generated by OpenAPI Generator; DO NOT EDIT.
+
+MIT License
+
+Copyright (c) 2023 Crowdstrike
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+=end
+
+require 'cgi'
+
+module Falcon
+  class TailoredIntelligence
+    attr_accessor :api_client
+
+    def initialize(api_client = ApiClient.default)
+      @api_client = api_client
+    end
+    # Get event body for the provided event ID
+    # @param id [String] Return the event body for event id.
+    # @param [Hash] opts the optional parameters
+    # @return [Array<Integer>]
+    def get_events_body(id, opts = {})
+      data, _status_code, _headers = get_events_body_with_http_info(id, opts)
+      data
+    end
+
+    # Get event body for the provided event ID
+    # @param id [String] Return the event body for event id.
+    # @param [Hash] opts the optional parameters
+    # @return [Array<(Array<Integer>, Integer, Hash)>] Array<Integer> data, response status code and response headers
+    def get_events_body_with_http_info(id, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: TailoredIntelligence.get_events_body ...'
+      end
+      # verify the required parameter 'id' is set
+      if @api_client.config.client_side_validation && id.nil?
+        fail ArgumentError, "Missing the required parameter 'id' when calling TailoredIntelligence.get_events_body"
+      end
+      # resource path
+      local_var_path = '/ti/events/entities/events-full-body/v2'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'id'] = id
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/octet-stream'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'Array<Integer>'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"TailoredIntelligence.get_events_body",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: TailoredIntelligence#get_events_body\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Get events entities for specified ids.
+    # @param body [MsaIdsRequest]
+    # @param [Hash] opts the optional parameters
+    # @return [DomainEventEntitiesResponse]
+    def get_events_entities(body, opts = {})
+      data, _status_code, _headers = get_events_entities_with_http_info(body, opts)
+      data
+    end
+
+    # Get events entities for specified ids.
+    # @param body [MsaIdsRequest]
+    # @param [Hash] opts the optional parameters
+    # @return [Array<(DomainEventEntitiesResponse, Integer, Hash)>] DomainEventEntitiesResponse data, response status code and response headers
+    def get_events_entities_with_http_info(body, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: TailoredIntelligence.get_events_entities ...'
+      end
+      # verify the required parameter 'body' is set
+      if @api_client.config.client_side_validation && body.nil?
+        fail ArgumentError, "Missing the required parameter 'body' when calling TailoredIntelligence.get_events_entities"
+      end
+      # resource path
+      local_var_path = '/ti/events/entities/events/GET/v2'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+      # HTTP header 'Content-Type'
+      content_type = @api_client.select_header_content_type(['application/json'])
+      if !content_type.nil?
+        header_params['Content-Type'] = content_type
+      end
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body] || @api_client.object_to_http_body(body)
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'DomainEventEntitiesResponse'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"TailoredIntelligence.get_events_entities",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:POST, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: TailoredIntelligence#get_events_entities\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Get rules entities for specified ids.
+    # @param body [MsaIdsRequest]
+    # @param [Hash] opts the optional parameters
+    # @return [DomainRuleEntitiesResponse]
+    def get_rules_entities(body, opts = {})
+      data, _status_code, _headers = get_rules_entities_with_http_info(body, opts)
+      data
+    end
+
+    # Get rules entities for specified ids.
+    # @param body [MsaIdsRequest]
+    # @param [Hash] opts the optional parameters
+    # @return [Array<(DomainRuleEntitiesResponse, Integer, Hash)>] DomainRuleEntitiesResponse data, response status code and response headers
+    def get_rules_entities_with_http_info(body, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: TailoredIntelligence.get_rules_entities ...'
+      end
+      # verify the required parameter 'body' is set
+      if @api_client.config.client_side_validation && body.nil?
+        fail ArgumentError, "Missing the required parameter 'body' when calling TailoredIntelligence.get_rules_entities"
+      end
+      # resource path
+      local_var_path = '/ti/rules/entities/rules/GET/v2'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+      # HTTP header 'Content-Type'
+      content_type = @api_client.select_header_content_type(['application/json'])
+      if !content_type.nil?
+        header_params['Content-Type'] = content_type
+      end
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body] || @api_client.object_to_http_body(body)
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'DomainRuleEntitiesResponse'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"TailoredIntelligence.get_rules_entities",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:POST, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: TailoredIntelligence#get_rules_entities\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Get events ids that match the provided filter criteria.
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :offset Starting index of overall result set from which to return ids.
+    # @option opts [Integer] :limit Number of ids to return.
+    # @option opts [String] :sort Possible order by fields: source_type, created_date, updated_date. Ex: &#39;updated_date|desc&#39;.
+    # @option opts [String] :filter FQL query specifying the filter parameters. Special value &#39;*&#39; means to not filter on anything.
+    # @option opts [String] :q Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed).
+    # @return [DomainQueryResponse]
+    def query_events(opts = {})
+      data, _status_code, _headers = query_events_with_http_info(opts)
+      data
+    end
+
+    # Get events ids that match the provided filter criteria.
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :offset Starting index of overall result set from which to return ids.
+    # @option opts [Integer] :limit Number of ids to return.
+    # @option opts [String] :sort Possible order by fields: source_type, created_date, updated_date. Ex: &#39;updated_date|desc&#39;.
+    # @option opts [String] :filter FQL query specifying the filter parameters. Special value &#39;*&#39; means to not filter on anything.
+    # @option opts [String] :q Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed).
+    # @return [Array<(DomainQueryResponse, Integer, Hash)>] DomainQueryResponse data, response status code and response headers
+    def query_events_with_http_info(opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: TailoredIntelligence.query_events ...'
+      end
+      # resource path
+      local_var_path = '/ti/events/queries/events/v2'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'offset'] = opts[:'offset'] if !opts[:'offset'].nil?
+      query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
+      query_params[:'sort'] = opts[:'sort'] if !opts[:'sort'].nil?
+      query_params[:'filter'] = opts[:'filter'] if !opts[:'filter'].nil?
+      query_params[:'q'] = opts[:'q'] if !opts[:'q'].nil?
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'DomainQueryResponse'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"TailoredIntelligence.query_events",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: TailoredIntelligence#query_events\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Get rules ids that match the provided filter criteria.
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :offset Starting index of overall result set from which to return ids.
+    # @option opts [Integer] :limit Number of ids to return.
+    # @option opts [String] :sort Possible order by fields: name, value, rule_type, customer_id, created_date, updated_date. Ex: &#39;updated_date|asc&#39;.
+    # @option opts [String] :filter FQL query specifying the filter parameters. Special value &#39;*&#39; means to not filter on anything.
+    # @option opts [String] :q Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed).
+    # @return [DomainQueryResponse]
+    def query_rules(opts = {})
+      data, _status_code, _headers = query_rules_with_http_info(opts)
+      data
+    end
+
+    # Get rules ids that match the provided filter criteria.
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :offset Starting index of overall result set from which to return ids.
+    # @option opts [Integer] :limit Number of ids to return.
+    # @option opts [String] :sort Possible order by fields: name, value, rule_type, customer_id, created_date, updated_date. Ex: &#39;updated_date|asc&#39;.
+    # @option opts [String] :filter FQL query specifying the filter parameters. Special value &#39;*&#39; means to not filter on anything.
+    # @option opts [String] :q Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed).
+    # @return [Array<(DomainQueryResponse, Integer, Hash)>] DomainQueryResponse data, response status code and response headers
+    def query_rules_with_http_info(opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: TailoredIntelligence.query_rules ...'
+      end
+      # resource path
+      local_var_path = '/ti/rules/queries/rules/v2'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'offset'] = opts[:'offset'] if !opts[:'offset'].nil?
+      query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
+      query_params[:'sort'] = opts[:'sort'] if !opts[:'sort'].nil?
+      query_params[:'filter'] = opts[:'filter'] if !opts[:'filter'].nil?
+      query_params[:'q'] = opts[:'q'] if !opts[:'q'].nil?
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'DomainQueryResponse'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"TailoredIntelligence.query_rules",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: TailoredIntelligence#query_rules\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+  end
+end

data/lib/crimson-falcon/api/threatgraph.rb

@@ -74,7 +74,7 @@ module Falcon
         fail ArgumentError, "Missing the required parameter 'edge_type' when calling Threatgraph.combined_edges_get"
       end
       # verify enum value
-      allowable_values = ["attributed_by_process", "invalidated_by_process", "queried_on_customer", "connected_from_process", "triggering_domain", "has_attributed_process", "generated_failed_authentication_to_azure_app", "protected_by_shield", "associated_by_ip6", "macro_executed_by_process", "queried_on_sensor", "created_quarantined_file", "user", "generated_ldap_search_against_dc", "quarantined_file", "connected_to_accessory", "self_diagnostic_to_agent", "failed_to_authenticate_to_adfs_app", "network_close_ip4", "implicated_sensor", "ipv4_listen", "created_by_user", "failed_to_authenticate_to_azure_app", "wrote_module", "accessed_azure_application", "queried_dns", "connected_ip4", "trigger_process", "known_by_sha256", "attributed_on", "invalidated_firewall_rule", "associated_by_service_ticket", "closed_ip6_socket", "triggering_network", "attributed_from_module", "set_rule", "generated_failed_authentication_to_adfs_app", "involved_service_account", "disconnected_from_host", "set_firewall_rule", "reports_aggregate_indicator", "deleted_rule", "registered_by_incident", "triggered_indicator", "dns", "associated_vmware_sensor", "ipv6", "associated_module", "uninstalled_app", "network_listen_ip6", "accessed_ping_fed_application", "duplicates_app", "associated_idp_indicator", "generated_failed_authentication_to_service_account", "accessed_ad_computer", "generated_dce_rpc_request_against_dc", "opened_ip6_socket", "cert_is_presented_by", "renewed_to_generate", "associated_by_aggregate_indicator", "invalid_from_process", "installed_by_app", "device", "customer_user_to_sensor_user", "resolved_from_domain", "associated_by_certificate", "member_of_full_command_line", "connected_on_customer", "established_session", "established_on_ip4", "generated_by_renewing", "blocked_module", "wmicreated_process", "ipv6_listen", "initiated_by_azure_ad_user", "initiated_by_user", "connection_killed_by_app", "duplicated_by_app", "registered_scheduledtask", "associated_by_ip", "child_process", "parent_process", "attributed_to", "ip6_socket_closed_by_process", "invalid_firewall_rule", "created_by_process", "triggered_by_control_graph", "associated_by_azure_app", "generated_dce_rpc_epm_request_against_dc", "network_listen_ip4", "ip4_socket_closed_by_app", "killed_ip4_connection", "customer_agent_has_user", "connected_from_app", "assigned_to_sensor", "associated_k8s_sensor", "connection_killed_by_process", "injected_code_into_process", "generated_failed_authentication_to_okta_app", "extracted_file", "associated_quarantined_module", "witnessed_process", "blocked_by_sensor", "associated_by_incident", "unmounted_on_host", "executed_macro_script", "associated_by_app", "ipv4", "containerized_app", "connected_to_wifi_ap", "associated_with_sensor", "user_session", "loaded_module", "blocked_by_app", "denied_by_process", "failed_to_authenticate_ad_user", "presented_by_cloud", "denied_firewall_rule", "ipv6_close", "bundles_module", "established_on_sensor", "accessed_okta_application", "attributed_from_domain", "blocked_dns", "accessed_adfs_application", "customer_has_sensor", "assigned_ipv4_address", "dns_request", "primary_module_of_process", "initiated_by_okta_user", "allowed_firewall_rule", "established_on_ip6", "network_connect_ip4", "created_by_incident", "cert_presented", "associated_user_session", "resolved_to_ip6", "unmounted_from_host", "module_written", "customer_ioc", "authenticated_from_incident", "ip4_socket_opened_by_process", "control_graph", "accessed_service_account", "queried_by_process", "linking_event", "implicated_by_incident", "associated_to_ad_computer", "set_by_process", "primary_module", "associated_by_ad_group", "connected_from_host", "assigned_ipv6_address", "ip6_socket_opened_by_process", "associated_by_indicator", "ipv4_close", "denied_by_firewall_rule", "parent_of_command_line", "uncontainerized_by_sensor", "associated_by_control_graph", "associated_by_idp_session", "shield_activated_on_host", "failed_to_authenticate_to_service_account", "attributed_on_module", "script", "disconnected_from_accessory", "opened_ip4_socket", "attributed_on_domain", "rule_set_by_process", "customer_sensor_to_sensor", "allowed_by_process", "blocked_ip6", "mounted_on_host", "loaded_by_process", "associated_mobile_indicator", "generated_by_session", "network_close_ip6", "triggered_mobile_indicator", "authenticated_host", "module", "closed_ip4_socket", "initiated_by_ad_computer", "network_connect_ip6", "rooted_control_graph", "established_on_host_name", "associated_by_ad_computer", "connected_on_sensor", "established_on_ad_computer", "deleted_by_process", "associated_vmware_cluster", "accessed_by_session", "known_by_md5", "indexed", "executed_by_process", "associated_indicator", "failed_to_authenticate_to_ping_app", "command_line_parent_process", "created_service", "associated_firewall_rule", "associated_incident", "associated_by_azure_ad_user", "ip6_socket_closed_by_app", "associated_by_domain", "generated_failed_authentication_to_ping_app", "received_from_cloud", "associated_k8s_cluster", "generated_failed_authentication_to_ad_computer", "performed_psexec_against_dc", "accessed_by_kerberos_ticket", "detected_module", "wmicreated_by_incident", "associated_by_okta_user", "executed_script", "associated_root_process", "disconnect_from_wifi_ap", "associated_by_host", "killed_ip6_connection", "associated_mobile_forensics_report", "has_app_installed", "attributed_to_actor", "app_uninstalled_from_host", "failed_to_authenticate_to_ad_computer", "installed_on_host", "associated_primary_module", "parented_by_process", "associated_by_ad_user", "uncontainerized_app", "mounted_to_host", "has_attribution", "blocked_by_process", "triggered_xdr", "detection", "connected_ip6", "triggered_control_graph", "queried_by_sensor", "ip4_socket_closed_by_process", "executed_app", "has_firmware", "associated_by_ip4", "installed_app", "injected_thread", "containerized_by_sensor", "witnessed_by_sensor", "resolved_to_ip4", "associated_control_graph", "associated_quarantined_file", "blocked_ip4", "associated_by_host_name", "participating_process", "bundled_in_app", "had_code_injected_by_process", "established_user_session", "failed_to_authenticate_to_okta_app", "triggered_detection", "initiated_session", "injected_thread_from_process", "generated_service_ticket", "triggered_by_process", "associated_to_sensor", "written_by_process", "associated_with_process", "shell_io_redirect", "agent_to_self_diagnostic", "involved_ad_computer"]
+      allowable_values = ["accessed_ad_computer", "accessed_adfs_application", "accessed_azure_application", "accessed_by_kerberos_ticket", "accessed_by_process", "accessed_by_session", "accessed_okta_application", "accessed_ping_fed_application", "accessed_service_account", "accessed_web", "agent_to_self_diagnostic", "allowed_by_process", "allowed_firewall_rule", "app_uninstalled_from_host", "assigned_ipv4_address", "assigned_ipv6_address", "assigned_to_sensor", "associated_by_ad_computer", "associated_by_ad_group", "associated_by_ad_user", "associated_by_aggregate_indicator", "associated_by_app", "associated_by_azure_ad_user", "associated_by_azure_app", "associated_by_certificate", "associated_by_control_graph", "associated_by_domain", "associated_by_host", "associated_by_host_name", "associated_by_idp_session", "associated_by_incident", "associated_by_indicator", "associated_by_ip", "associated_by_ip4", "associated_by_ip6", "associated_by_okta_user", "associated_by_service_ticket", "associated_control_graph", "associated_firewall_rule", "associated_idp_indicator", "associated_incident", "associated_indicator", "associated_k8s_cluster", "associated_k8s_sensor", "associated_mobile_forensics_report", "associated_mobile_indicator", "associated_module", "associated_primary_module", "associated_quarantined_file", "associated_quarantined_module", "associated_root_process", "associated_to_ad_computer", "associated_to_sensor", "associated_user_session", "associated_vmware_cluster", "associated_vmware_sensor", "associated_with_process", "associated_with_sensor", "attributed_by_process", "attributed_from_domain", "attributed_from_module", "attributed_on", "attributed_on_domain", "attributed_on_module", "attributed_to", "attributed_to_actor", "authenticated_from_incident", "authenticated_host", "blocked_by_app", "blocked_by_process", "blocked_by_sensor", "blocked_dns", "blocked_ip4", "blocked_ip6", "blocked_module", "bundled_in_app", "bundles_module", "cert_is_presented_by", "cert_presented", "child_process", "closed_ip4_socket", "closed_ip6_socket", "command_line_parent_process", "connected_from_app", "connected_from_host", "connected_from_process", "connected_ip4", "connected_ip6", "connected_on_customer", "connected_on_sensor", "connected_to_accessory", "connected_to_wifi_ap", "connection_killed_by_app", "connection_killed_by_process", "containerized_app", "containerized_by_sensor", "control_graph", "created_by_incident", "created_by_process", "created_by_user", "created_quarantined_file", "created_service", "customer_agent_has_user", "customer_has_sensor", "customer_ioc", "customer_sensor_to_sensor", "customer_user_to_sensor_user", "deleted_by_process", "deleted_rule", "denied_by_firewall_rule", "denied_by_process", "denied_firewall_rule", "detected_module", "detection", "device", "disconnect_from_wifi_ap", "disconnected_from_accessory", "disconnected_from_host", "dns", "dns_request", "duplicated_by_app", "duplicates_app", "established_on_ad_computer", "established_on_host_name", "established_on_ip4", "established_on_ip6", "established_on_sensor", "established_session", "established_user_session", "executed_app", "executed_by_process", "executed_macro_script", "executed_script", "extracted_file", "failed_to_authenticate_ad_user", "failed_to_authenticate_to_ad_computer", "failed_to_authenticate_to_adfs_app", "failed_to_authenticate_to_azure_app", "failed_to_authenticate_to_okta_app", "failed_to_authenticate_to_ping_app", "failed_to_authenticate_to_service_account", "generated_by_renewing", "generated_by_session", "generated_dce_rpc_epm_request_against_dc", "generated_dce_rpc_request_against_dc", "generated_failed_authentication_to_ad_computer", "generated_failed_authentication_to_adfs_app", "generated_failed_authentication_to_azure_app", "generated_failed_authentication_to_okta_app", "generated_failed_authentication_to_ping_app", "generated_failed_authentication_to_service_account", "generated_ldap_search_against_dc", "generated_service_ticket", "had_code_injected_by_process", "has_app_installed", "has_attributed_process", "has_attribution", "has_firmware", "implicated_by_incident", "implicated_sensor", "indexed", "initiated_by_ad_computer", "initiated_by_azure_ad_user", "initiated_by_okta_user", "initiated_by_user", "initiated_session", "injected_code_into_process", "injected_thread", "injected_thread_from_process", "installed_app", "installed_by_app", "installed_on_host", "invalid_firewall_rule", "invalid_from_process", "invalidated_by_process", "invalidated_firewall_rule", "involved_ad_computer", "involved_service_account", "ip4_socket_closed_by_app", "ip4_socket_closed_by_process", "ip4_socket_opened_by_process", "ip6_socket_closed_by_app", "ip6_socket_closed_by_process", "ip6_socket_opened_by_process", "ipv4", "ipv4_close", "ipv4_listen", "ipv6", "ipv6_close", "ipv6_listen", "killed_ip4_connection", "killed_ip6_connection", "known_by_md5", "known_by_sha256", "linking_event", "loaded_by_process", "loaded_module", "macro_executed_by_process", "member_of_full_command_line", "module", "module_written", "mounted_on_host", "mounted_to_host", "network_close_ip4", "network_close_ip6", "network_connect_ip4", "network_connect_ip6", "network_listen_ip4", "network_listen_ip6", "opened_ip4_socket", "opened_ip6_socket", "parent_of_command_line", "parent_process", "parented_by_process", "participating_process", "performed_psexec_against_dc", "presented_by_cloud", "primary_module", "primary_module_of_process", "protected_by_shield", "quarantined_file", "queried_by_process", "queried_by_sensor", "queried_dns", "queried_on_customer", "queried_on_sensor", "received_from_cloud", "registered_by_incident", "registered_scheduledtask", "renewed_to_generate", "reports_aggregate_indicator", "resolved_from_domain", "resolved_to_ip4", "resolved_to_ip6", "rooted_control_graph", "rule_set_by_process", "script", "self_diagnostic_to_agent", "set_by_process", "set_firewall_rule", "set_rule", "shell_io_redirect", "shield_activated_on_host", "trigger_process", "triggered_by_control_graph", "triggered_by_process", "triggered_control_graph", "triggered_detection", "triggered_indicator", "triggered_mobile_indicator", "triggered_xdr", "triggering_domain", "triggering_network", "uncontainerized_app", "uncontainerized_by_sensor", "uninstalled_app", "unmounted_from_host", "unmounted_on_host", "user", "user_session", "witnessed_by_sensor", "witnessed_process", "wmicreated_by_incident", "wmicreated_process", "written_by_process", "wrote_module"]
       if @api_client.config.client_side_validation && !allowable_values.include?(edge_type)
         fail ArgumentError, "invalid value for \"edge_type\", must be one of #{allowable_values}"
       end
@@ -248,7 +248,7 @@ module Falcon
         fail ArgumentError, "Missing the required parameter 'vertex_type' when calling Threatgraph.combined_summary_get"
       end
       # verify enum value
-      allowable_values = ["accessory", "accessories", "actor", "ad_computer", "ad-computers", "adfs_application", "adfs-applications", "ad_group", "ad-groups", "aggregate_indicator", "aggregate-indicators", "sensor", "devices", "mobile_app", "mobile-apps", "azure_application", "azure-applications", "azure_ad_user", "azure-ad-users", "containerized_app", "containerized-apps", "certificate", "certificates", "command_line", "command-lines", "control_graph", "control-graphs", "detection", "detections", "domain", "domains", "extracted_file", "extracted-files", "firmware", "firmwares", "mobile_fs_volume", "mobile-fs-volumes", "firewall", "firewalls", "firewall_rule_match", "firewall_rule_matches", "host_name", "host-names", "detection_index", "detection-indices", "idp_indicator", "idp-indicators", "idp_session", "idp-sessions", "incident", "incidents", "indicator", "indicators", "ipv4", "ipv6", "k8s_cluster", "k8s_clusters", "legacy_detection", "legacy-detections", "mobile_os_forensics_report", "mobile_os_forensics_reports", "mobile_indicator", "mobile-indicators", "module", "modules", "macro_script", "macro_scripts", "okta_application", "okta-applications", "okta_user", "okta-users", "process", "processes", "ping_fed_application", "ping-fed-applications", "quarantined_file", "quarantined-files", "script", "scripts", "shield", "shields", "sensor_self_diagnostic", "sensor-self-diagnostics", "kerberos_ticket", "kerberos-tickets", "user_id", "users", "user_session", "user-sessions", "vmware_cluster", "vmware_clusters", "wifi_access_point", "wifi-access-points", "xdr", "any-vertex"]
+      allowable_values = ["accessory", "accessories", "actor", "ad_computer", "ad-computers", "adfs_application", "adfs-applications", "ad_group", "ad-groups", "aggregate_indicator", "aggregate-indicators", "sensor", "devices", "mobile_app", "mobile-apps", "azure_application", "azure-applications", "azure_ad_user", "azure-ad-users", "containerized_app", "containerized-apps", "certificate", "certificates", "command_line", "command-lines", "control_graph", "control-graphs", "detection", "detections", "domain", "domains", "extracted_file", "extracted-files", "firmware", "firmwares", "mobile_fs_volume", "mobile-fs-volumes", "firewall", "firewalls", "firewall_rule_match", "firewall_rule_matches", "host_name", "host-names", "detection_index", "detection-indices", "idp_indicator", "idp-indicators", "idp_session", "idp-sessions", "incident", "incidents", "indicator", "indicators", "ipv4", "ipv6", "k8s_cluster", "k8s_clusters", "legacy_detection", "legacy-detections", "mobile_os_forensics_report", "mobile_os_forensics_reports", "mobile_indicator", "mobile-indicators", "module", "modules", "macro_script", "macro_scripts", "okta_application", "okta-applications", "okta_user", "okta-users", "process", "processes", "ping_fed_application", "ping-fed-applications", "quarantined_file", "quarantined-files", "script", "scripts", "shield", "shields", "sensor_self_diagnostic", "sensor-self-diagnostics", "kerberos_ticket", "kerberos-tickets", "user_id", "users", "user_session", "user-sessions", "vmware_cluster", "vmware_clusters", "web_access", "wifi_access_point", "wifi-access-points", "xdr", "any-vertex"]
       if @api_client.config.client_side_validation && !allowable_values.include?(vertex_type)
         fail ArgumentError, "invalid value for \"vertex_type\", must be one of #{allowable_values}"
       end
@@ -335,7 +335,7 @@ module Falcon
         fail ArgumentError, "Missing the required parameter 'vertex_type' when calling Threatgraph.entities_vertices_get"
       end
       # verify enum value
-      allowable_values = ["accessory", "accessories", "actor", "ad_computer", "ad-computers", "adfs_application", "adfs-applications", "ad_group", "ad-groups", "aggregate_indicator", "aggregate-indicators", "sensor", "devices", "mobile_app", "mobile-apps", "azure_application", "azure-applications", "azure_ad_user", "azure-ad-users", "containerized_app", "containerized-apps", "certificate", "certificates", "command_line", "command-lines", "control_graph", "control-graphs", "detection", "detections", "domain", "domains", "extracted_file", "extracted-files", "firmware", "firmwares", "mobile_fs_volume", "mobile-fs-volumes", "firewall", "firewalls", "firewall_rule_match", "firewall_rule_matches", "host_name", "host-names", "detection_index", "detection-indices", "idp_indicator", "idp-indicators", "idp_session", "idp-sessions", "incident", "incidents", "indicator", "indicators", "ipv4", "ipv6", "k8s_cluster", "k8s_clusters", "legacy_detection", "legacy-detections", "mobile_os_forensics_report", "mobile_os_forensics_reports", "mobile_indicator", "mobile-indicators", "module", "modules", "macro_script", "macro_scripts", "okta_application", "okta-applications", "okta_user", "okta-users", "process", "processes", "ping_fed_application", "ping-fed-applications", "quarantined_file", "quarantined-files", "script", "scripts", "shield", "shields", "sensor_self_diagnostic", "sensor-self-diagnostics", "kerberos_ticket", "kerberos-tickets", "user_id", "users", "user_session", "user-sessions", "vmware_cluster", "vmware_clusters", "wifi_access_point", "wifi-access-points", "xdr", "any-vertex"]
+      allowable_values = ["accessory", "accessories", "actor", "ad_computer", "ad-computers", "adfs_application", "adfs-applications", "ad_group", "ad-groups", "aggregate_indicator", "aggregate-indicators", "sensor", "devices", "mobile_app", "mobile-apps", "azure_application", "azure-applications", "azure_ad_user", "azure-ad-users", "containerized_app", "containerized-apps", "certificate", "certificates", "command_line", "command-lines", "control_graph", "control-graphs", "detection", "detections", "domain", "domains", "extracted_file", "extracted-files", "firmware", "firmwares", "mobile_fs_volume", "mobile-fs-volumes", "firewall", "firewalls", "firewall_rule_match", "firewall_rule_matches", "host_name", "host-names", "detection_index", "detection-indices", "idp_indicator", "idp-indicators", "idp_session", "idp-sessions", "incident", "incidents", "indicator", "indicators", "ipv4", "ipv6", "k8s_cluster", "k8s_clusters", "legacy_detection", "legacy-detections", "mobile_os_forensics_report", "mobile_os_forensics_reports", "mobile_indicator", "mobile-indicators", "module", "modules", "macro_script", "macro_scripts", "okta_application", "okta-applications", "okta_user", "okta-users", "process", "processes", "ping_fed_application", "ping-fed-applications", "quarantined_file", "quarantined-files", "script", "scripts", "shield", "shields", "sensor_self_diagnostic", "sensor-self-diagnostics", "kerberos_ticket", "kerberos-tickets", "user_id", "users", "user_session", "user-sessions", "vmware_cluster", "vmware_clusters", "web_access", "wifi_access_point", "wifi-access-points", "xdr", "any-vertex"]
       if @api_client.config.client_side_validation && !allowable_values.include?(vertex_type)
         fail ArgumentError, "invalid value for \"vertex_type\", must be one of #{allowable_values}"
       end
@@ -422,7 +422,7 @@ module Falcon
         fail ArgumentError, "Missing the required parameter 'vertex_type' when calling Threatgraph.entities_vertices_getv2"
       end
       # verify enum value
-      allowable_values = ["accessory", "accessories", "actor", "ad_computer", "ad-computers", "adfs_application", "adfs-applications", "ad_group", "ad-groups", "aggregate_indicator", "aggregate-indicators", "sensor", "devices", "mobile_app", "mobile-apps", "azure_application", "azure-applications", "azure_ad_user", "azure-ad-users", "containerized_app", "containerized-apps", "certificate", "certificates", "command_line", "command-lines", "control_graph", "control-graphs", "detection", "detections", "domain", "domains", "extracted_file", "extracted-files", "firmware", "firmwares", "mobile_fs_volume", "mobile-fs-volumes", "firewall", "firewalls", "firewall_rule_match", "firewall_rule_matches", "host_name", "host-names", "detection_index", "detection-indices", "idp_indicator", "idp-indicators", "idp_session", "idp-sessions", "incident", "incidents", "indicator", "indicators", "ipv4", "ipv6", "k8s_cluster", "k8s_clusters", "legacy_detection", "legacy-detections", "mobile_os_forensics_report", "mobile_os_forensics_reports", "mobile_indicator", "mobile-indicators", "module", "modules", "macro_script", "macro_scripts", "okta_application", "okta-applications", "okta_user", "okta-users", "process", "processes", "ping_fed_application", "ping-fed-applications", "quarantined_file", "quarantined-files", "script", "scripts", "shield", "shields", "sensor_self_diagnostic", "sensor-self-diagnostics", "kerberos_ticket", "kerberos-tickets", "user_id", "users", "user_session", "user-sessions", "vmware_cluster", "vmware_clusters", "wifi_access_point", "wifi-access-points", "xdr", "any-vertex"]
+      allowable_values = ["accessory", "accessories", "actor", "ad_computer", "ad-computers", "adfs_application", "adfs-applications", "ad_group", "ad-groups", "aggregate_indicator", "aggregate-indicators", "sensor", "devices", "mobile_app", "mobile-apps", "azure_application", "azure-applications", "azure_ad_user", "azure-ad-users", "containerized_app", "containerized-apps", "certificate", "certificates", "command_line", "command-lines", "control_graph", "control-graphs", "detection", "detections", "domain", "domains", "extracted_file", "extracted-files", "firmware", "firmwares", "mobile_fs_volume", "mobile-fs-volumes", "firewall", "firewalls", "firewall_rule_match", "firewall_rule_matches", "host_name", "host-names", "detection_index", "detection-indices", "idp_indicator", "idp-indicators", "idp_session", "idp-sessions", "incident", "incidents", "indicator", "indicators", "ipv4", "ipv6", "k8s_cluster", "k8s_clusters", "legacy_detection", "legacy-detections", "mobile_os_forensics_report", "mobile_os_forensics_reports", "mobile_indicator", "mobile-indicators", "module", "modules", "macro_script", "macro_scripts", "okta_application", "okta-applications", "okta_user", "okta-users", "process", "processes", "ping_fed_application", "ping-fed-applications", "quarantined_file", "quarantined-files", "script", "scripts", "shield", "shields", "sensor_self_diagnostic", "sensor-self-diagnostics", "kerberos_ticket", "kerberos-tickets", "user_id", "users", "user_session", "user-sessions", "vmware_cluster", "vmware_clusters", "web_access", "wifi_access_point", "wifi-access-points", "xdr", "any-vertex"]
       if @api_client.config.client_side_validation && !allowable_values.include?(vertex_type)
         fail ArgumentError, "invalid value for \"vertex_type\", must be one of #{allowable_values}"
       end