crimson-falcon 1.0.1 → 1.1.0

data/lib/crimson-falcon/api/discover.rb

@@ -448,72 +448,6 @@ module Falcon
       return data, status_code, headers
     end
 
-    # Add external assets for external asset scanning.
-    # @param body [InventoryapiUserExternalAssetCreateRequestV1] Asset addition specification.
-    # @param [Hash] opts the optional parameters
-    # @return [InventoryapiUserExternalAssetCreateResponseV1]
-    def post_external_assets_inventory_v1(body, opts = {})
-      data, _status_code, _headers = post_external_assets_inventory_v1_with_http_info(body, opts)
-      data
-    end
-
-    # Add external assets for external asset scanning.
-    # @param body [InventoryapiUserExternalAssetCreateRequestV1] Asset addition specification.
-    # @param [Hash] opts the optional parameters
-    # @return [Array<(InventoryapiUserExternalAssetCreateResponseV1, Integer, Hash)>] InventoryapiUserExternalAssetCreateResponseV1 data, response status code and response headers
-    def post_external_assets_inventory_v1_with_http_info(body, opts = {})
-      if @api_client.config.debugging
-        @api_client.config.logger.debug 'Calling API: Discover.post_external_assets_inventory_v1 ...'
-      end
-      # verify the required parameter 'body' is set
-      if @api_client.config.client_side_validation && body.nil?
-        fail ArgumentError, "Missing the required parameter 'body' when calling Discover.post_external_assets_inventory_v1"
-      end
-      # resource path
-      local_var_path = '/fem/entities/external-asset-inventory/v1'
-
-      # query parameters
-      query_params = opts[:query_params] || {}
-
-      # header parameters
-      header_params = opts[:header_params] || {}
-      # HTTP header 'Accept' (if needed)
-      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
-      # HTTP header 'Content-Type'
-      content_type = @api_client.select_header_content_type(['application/json'])
-      if !content_type.nil?
-        header_params['Content-Type'] = content_type
-      end
-
-      # form parameters
-      form_params = opts[:form_params] || {}
-
-      # http body (model)
-      post_body = opts[:debug_body] || @api_client.object_to_http_body(body)
-
-      # return_type
-      return_type = opts[:debug_return_type] || 'InventoryapiUserExternalAssetCreateResponseV1'
-
-      # auth_names
-      auth_names = opts[:debug_auth_names] || ['oauth2']
-
-      new_options = opts.merge(
-        :operation => :"Discover.post_external_assets_inventory_v1",
-        :header_params => header_params,
-        :query_params => query_params,
-        :form_params => form_params,
-        :body => post_body,
-        :auth_names => auth_names,
-        :return_type => return_type
-      )
-
-      data, status_code, headers = @api_client.call_api(:POST, local_var_path, new_options)
-      if @api_client.config.debugging
-        @api_client.config.logger.debug "API called: Discover#post_external_assets_inventory_v1\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
-      end
-      return data, status_code, headers
-    end
-
     # Search for accounts in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of account IDs which match the filter criteria.
     # @param [Hash] opts the optional parameters
     # @option opts [Integer] :offset An offset used with the &#x60;limit&#x60; parameter to manage pagination of results. On your first request, don’t provide an &#x60;offset&#x60;. On subsequent requests, add previous &#x60;offset&#x60; with the previous &#x60;limit&#x60; to continue from that place in the results.
@@ -752,6 +686,7 @@ module Falcon
     end
 
     # Search for logins in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of login IDs which match the filter criteria.
+    # The API endpoint returns data only if the response set includes 10,000 or fewer items. This limit applies to the total API response size, regardless of your pagination sizes with the `limit` and `offset` parameters. If your response set includes more than 10,000 items, the CrowdStrike API returns an HTML 400 response instead. To avoid this issue, use the filter parameter to reduce the total number of items in the API response.
     # @param [Hash] opts the optional parameters
     # @option opts [Integer] :offset An offset used with the &#x60;limit&#x60; parameter to manage pagination of results. On your first request, don’t provide an &#x60;offset&#x60;. On subsequent requests, add previous &#x60;offset&#x60; with the previous &#x60;limit&#x60; to continue from that place in the results.
     # @option opts [Integer] :limit The number of login IDs to return in this response (min: 1, max: 100, default: 100). Use with the &#x60;offset&#x60; parameter to manage pagination of results.
@@ -764,6 +699,7 @@ module Falcon
     end
 
     # Search for logins in your environment by providing an FQL (Falcon Query Language) filter and paging details. Returns a set of login IDs which match the filter criteria.
+    # The API endpoint returns data only if the response set includes 10,000 or fewer items. This limit applies to the total API response size, regardless of your pagination sizes with the &#x60;limit&#x60; and &#x60;offset&#x60; parameters. If your response set includes more than 10,000 items, the CrowdStrike API returns an HTML 400 response instead. To avoid this issue, use the filter parameter to reduce the total number of items in the API response.
     # @param [Hash] opts the optional parameters
     # @option opts [Integer] :offset An offset used with the &#x60;limit&#x60; parameter to manage pagination of results. On your first request, don’t provide an &#x60;offset&#x60;. On subsequent requests, add previous &#x60;offset&#x60; with the previous &#x60;limit&#x60; to continue from that place in the results.
     # @option opts [Integer] :limit The number of login IDs to return in this response (min: 1, max: 100, default: 100). Use with the &#x60;offset&#x60; parameter to manage pagination of results.

data/lib/crimson-falcon/api/execution.rb

@@ -0,0 +1,122 @@
+=begin
+Crimson Falcon - Ruby Client SDK
+
+Code auto-generated by OpenAPI Generator; DO NOT EDIT.
+
+MIT License
+
+Copyright (c) 2023 Crowdstrike
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+=end
+
+require 'cgi'
+
+module Falcon
+  class Execution
+    attr_accessor :api_client
+
+    def initialize(api_client = ApiClient.default)
+      @api_client = api_client
+    end
+    # retrieve a large request body, such as a file, that has spilled into object storage
+    # @param id [String] Execution ID
+    # @param fn [String] function ref; form of $fn_id:$fn_version
+    # @param filename [String] filename to be retrieved
+    # @param sha256 [String] sha256 checksum for file to be retrieved
+    # @param [Hash] opts the optional parameters
+    # @return [Object]
+    def read_request_body(id, fn, filename, sha256, opts = {})
+      data, _status_code, _headers = read_request_body_with_http_info(id, fn, filename, sha256, opts)
+      data
+    end
+
+    # retrieve a large request body, such as a file, that has spilled into object storage
+    # @param id [String] Execution ID
+    # @param fn [String] function ref; form of $fn_id:$fn_version
+    # @param filename [String] filename to be retrieved
+    # @param sha256 [String] sha256 checksum for file to be retrieved
+    # @param [Hash] opts the optional parameters
+    # @return [Array<(Object, Integer, Hash)>] Object data, response status code and response headers
+    def read_request_body_with_http_info(id, fn, filename, sha256, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: Execution.read_request_body ...'
+      end
+      # verify the required parameter 'id' is set
+      if @api_client.config.client_side_validation && id.nil?
+        fail ArgumentError, "Missing the required parameter 'id' when calling Execution.read_request_body"
+      end
+      # verify the required parameter 'fn' is set
+      if @api_client.config.client_side_validation && fn.nil?
+        fail ArgumentError, "Missing the required parameter 'fn' when calling Execution.read_request_body"
+      end
+      # verify the required parameter 'filename' is set
+      if @api_client.config.client_side_validation && filename.nil?
+        fail ArgumentError, "Missing the required parameter 'filename' when calling Execution.read_request_body"
+      end
+      # verify the required parameter 'sha256' is set
+      if @api_client.config.client_side_validation && sha256.nil?
+        fail ArgumentError, "Missing the required parameter 'sha256' when calling Execution.read_request_body"
+      end
+      # resource path
+      local_var_path = '/faas-gateway/entities/execution-request-body/v2'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'id'] = id
+      query_params[:'fn'] = fn
+      query_params[:'filename'] = filename
+      query_params[:'sha256'] = sha256
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['text/csv', 'text/plain', 'application/octet-stream', 'application/json'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'Object'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"Execution.read_request_body",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: Execution#read_request_body\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+  end
+end

data/lib/crimson-falcon/api/exposure_management.rb

@@ -582,6 +582,72 @@ module Falcon
       return data, status_code, headers
     end
 
+    # Add external assets for external asset scanning.
+    # @param body [InventoryapiUserExternalAssetCreateRequestV1] Asset addition specification.
+    # @param [Hash] opts the optional parameters
+    # @return [InventoryapiUserExternalAssetCreateResponseV1]
+    def post_external_assets_inventory_v1(body, opts = {})
+      data, _status_code, _headers = post_external_assets_inventory_v1_with_http_info(body, opts)
+      data
+    end
+
+    # Add external assets for external asset scanning.
+    # @param body [InventoryapiUserExternalAssetCreateRequestV1] Asset addition specification.
+    # @param [Hash] opts the optional parameters
+    # @return [Array<(InventoryapiUserExternalAssetCreateResponseV1, Integer, Hash)>] InventoryapiUserExternalAssetCreateResponseV1 data, response status code and response headers
+    def post_external_assets_inventory_v1_with_http_info(body, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: ExposureManagement.post_external_assets_inventory_v1 ...'
+      end
+      # verify the required parameter 'body' is set
+      if @api_client.config.client_side_validation && body.nil?
+        fail ArgumentError, "Missing the required parameter 'body' when calling ExposureManagement.post_external_assets_inventory_v1"
+      end
+      # resource path
+      local_var_path = '/fem/entities/external-asset-inventory/v1'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+      # HTTP header 'Content-Type'
+      content_type = @api_client.select_header_content_type(['application/json'])
+      if !content_type.nil?
+        header_params['Content-Type'] = content_type
+      end
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body] || @api_client.object_to_http_body(body)
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'InventoryapiUserExternalAssetCreateResponseV1'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"ExposureManagement.post_external_assets_inventory_v1",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:POST, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: ExposureManagement#post_external_assets_inventory_v1\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
     # Retrieves a list of IDs for ecosystem subsidiaries. Use these IDs with the /entities/ecosystem-subsidiaries/v1 endpoints.
     # @param [Hash] opts the optional parameters
     # @option opts [Integer] :offset Starting index of result set from which to return subsidiaries (default to 0)

data/lib/crimson-falcon/api/falconx_sandbox.rb

@@ -823,8 +823,8 @@ module Falcon
     # @option opts [Integer] :limit Maximum number of submission IDs to return. Max: 5000.
     # @option opts [String] :sort Sort order: `asc` or `desc`.
     # @return [MsaspecQueryResponse]
-    def query_submissions_mixin0(opts = {})
-      data, _status_code, _headers = query_submissions_mixin0_with_http_info(opts)
+    def query_submissions(opts = {})
+      data, _status_code, _headers = query_submissions_with_http_info(opts)
       data
     end
 
@@ -835,9 +835,9 @@ module Falcon
     # @option opts [Integer] :limit Maximum number of submission IDs to return. Max: 5000.
     # @option opts [String] :sort Sort order: `asc` or `desc`.
     # @return [Array<(MsaspecQueryResponse, Integer, Hash)>] MsaspecQueryResponse data, response status code and response headers
-    def query_submissions_mixin0_with_http_info(opts = {})
+    def query_submissions_with_http_info(opts = {})
       if @api_client.config.debugging
-        @api_client.config.logger.debug 'Calling API: FalconxSandbox.query_submissions_mixin0 ...'
+        @api_client.config.logger.debug 'Calling API: FalconxSandbox.query_submissions ...'
       end
       # resource path
       local_var_path = '/falconx/queries/submissions/v1'
@@ -867,7 +867,7 @@ module Falcon
       auth_names = opts[:debug_auth_names] || ['oauth2']
 
       new_options = opts.merge(
-        :operation => :"FalconxSandbox.query_submissions_mixin0",
+        :operation => :"FalconxSandbox.query_submissions",
         :header_params => header_params,
         :query_params => query_params,
         :form_params => form_params,
@@ -878,13 +878,13 @@ module Falcon
 
       data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
       if @api_client.config.debugging
-        @api_client.config.logger.debug "API called: FalconxSandbox#query_submissions_mixin0\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+        @api_client.config.logger.debug "API called: FalconxSandbox#query_submissions\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
       end
       return data, status_code, headers
     end
 
     # Submit an uploaded file or a URL for sandbox analysis. Time required for analysis varies but is usually less than 15 minutes.
-    # @param body [FalconxSubmissionParametersV1] Submit either a URL or a sample SHA256 for sandbox analysis. The sample file must have been previously uploaded through &#x60;/samples/entities/samples/v2&#x60;. You must specify a JSON object that includes the &#x60;falconx.SubmissionParametersV1&#x60; key/value pairs shown below.  **&#x60;environment_id&#x60;**: Specifies the sandbox environment used for analysis. Values:  - &#x60;400&#x60;: MacOS Catalina 10.15 - &#x60;410&#x60;: MacOS Sonoma ARM 64 bit - &#x60;300&#x60;: Linux Ubuntu 16.04, 64-bit - &#x60;200&#x60;: Android (static analysis) - &#x60;160&#x60;: Windows 10, 64-bit - &#x60;140&#x60;: Windows 11, 64-bit - &#x60;110&#x60;: Windows 7, 64-bit - &#x60;100&#x60;: Windows 7, 32-bit  **&#x60;sha256&#x60;** ID of the sample, which is a SHA256 hash value. Find a sample ID from the response when uploading a malware sample or search with &#x60;/falconx/queries/submissions/v1&#x60;.The &#x60;url&#x60; parameter must be unset if &#x60;sha256&#x60; is used.  **&#x60;url&#x60;** A web page or file URL. It can be HTTP(S) or FTP. The &#x60;sha256&#x60; parameter must be unset if &#x60;url&#x60; is used.  **&#x60;action_script&#x60;** (optional): Runtime script for sandbox analysis. Values:  - &#x60;default&#x60; - &#x60;default_maxantievasion&#x60; - &#x60;default_randomfiles&#x60; - &#x60;default_randomtheme&#x60; - &#x60;default_openie&#x60;  **&#x60;command_line&#x60;** (optional): Command line script passed to the submitted file at runtime. Max length: 2048 characters  **&#x60;document_password&#x60;** (optional): Auto-filled for Adobe or Office files that prompt for a password. Max length: 32 characters  **&#x60;enable_tor&#x60;** (optional): Deprecated, please use &#x60;network_settings&#x60; instead. If &#x60;true&#x60;, sandbox analysis routes network traffic via TOR. Default: &#x60;false&#x60;.  **&#x60;network_settings&#x60;** (optional): Specifies the sandbox network_settings used for analysis. Values:  - &#x60;default&#x60;: Fully operating network - &#x60;tor&#x60;: Route network traffic via TOR - &#x60;simulated&#x60;: Simulate network traffic - &#x60;offline&#x60;: No network traffic  **&#x60;submit_name&#x60;** (optional): Name of the malware sample that&#39;s used for file type detection and analysis  **&#x60;system_date&#x60;** (optional): Set a custom date in the format &#x60;yyyy-MM-dd&#x60; for the sandbox environment  **&#x60;system_time&#x60;** (optional): Set a custom time in the format &#x60;HH:mm&#x60; for the sandbox environment.
+    # @param body [FalconxSubmissionParametersV1] Submit either a URL or a sample SHA256 for sandbox analysis. The sample file must have been previously uploaded through &#x60;/samples/entities/samples/v2&#x60;. You must specify a JSON object that includes the &#x60;falconx.SubmissionParametersV1&#x60; key/value pairs shown below.  **&#x60;environment_id&#x60;**: Specifies the sandbox environment used for analysis. Values:  - &#x60;400&#x60;: MacOS Catalina 10.15 - &#x60;300&#x60;: Linux Ubuntu 16.04, 64-bit - deprecated - &#x60;310&#x60;: Linux Ubuntu 20, 64-bit - &#x60;200&#x60;: Android (static analysis) - &#x60;160&#x60;: Windows 10, 64-bit - &#x60;140&#x60;: Windows 11, 64-bit - &#x60;110&#x60;: Windows 7, 64-bit - &#x60;100&#x60;: Windows 7, 32-bit  **&#x60;sha256&#x60;** ID of the sample, which is a SHA256 hash value. Find a sample ID from the response when uploading a malware sample or search with &#x60;/falconx/queries/submissions/v1&#x60;.The &#x60;url&#x60; parameter must be unset if &#x60;sha256&#x60; is used.  **&#x60;url&#x60;** A web page or file URL. It can be HTTP(S) or FTP. The &#x60;sha256&#x60; parameter must be unset if &#x60;url&#x60; is used.  **&#x60;action_script&#x60;** (optional): Runtime script for sandbox analysis. Values:  - &#x60;default&#x60; - &#x60;default_maxantievasion&#x60; - &#x60;default_randomfiles&#x60; - &#x60;default_randomtheme&#x60; - &#x60;default_openie&#x60;  **&#x60;command_line&#x60;** (optional): Command line script passed to the submitted file at runtime. Max length: 2048 characters  **&#x60;document_password&#x60;** (optional): Auto-filled for Adobe or Office files that prompt for a password. Max length: 32 characters  **&#x60;enable_tor&#x60;** (optional): Deprecated, please use &#x60;network_settings&#x60; instead. If &#x60;true&#x60;, sandbox analysis routes network traffic via TOR. Default: &#x60;false&#x60;.  **&#x60;network_settings&#x60;** (optional): Specifies the sandbox network_settings used for analysis. Values:  - &#x60;default&#x60;: Fully operating network - &#x60;tor&#x60;: Route network traffic via TOR - &#x60;simulated&#x60;: Simulate network traffic - &#x60;offline&#x60;: No network traffic  **&#x60;submit_name&#x60;** (optional): Name of the malware sample that&#39;s used for file type detection and analysis  **&#x60;system_date&#x60;** (optional): Set a custom date in the format &#x60;yyyy-MM-dd&#x60; for the sandbox environment  **&#x60;system_time&#x60;** (optional): Set a custom time in the format &#x60;HH:mm&#x60; for the sandbox environment.
     # @param [Hash] opts the optional parameters
     # @option opts [String] :aid Agent ID
     # @return [FalconxSubmissionV1Response]
@@ -894,7 +894,7 @@ module Falcon
     end
 
     # Submit an uploaded file or a URL for sandbox analysis. Time required for analysis varies but is usually less than 15 minutes.
-    # @param body [FalconxSubmissionParametersV1] Submit either a URL or a sample SHA256 for sandbox analysis. The sample file must have been previously uploaded through &#x60;/samples/entities/samples/v2&#x60;. You must specify a JSON object that includes the &#x60;falconx.SubmissionParametersV1&#x60; key/value pairs shown below.  **&#x60;environment_id&#x60;**: Specifies the sandbox environment used for analysis. Values:  - &#x60;400&#x60;: MacOS Catalina 10.15 - &#x60;410&#x60;: MacOS Sonoma ARM 64 bit - &#x60;300&#x60;: Linux Ubuntu 16.04, 64-bit - &#x60;200&#x60;: Android (static analysis) - &#x60;160&#x60;: Windows 10, 64-bit - &#x60;140&#x60;: Windows 11, 64-bit - &#x60;110&#x60;: Windows 7, 64-bit - &#x60;100&#x60;: Windows 7, 32-bit  **&#x60;sha256&#x60;** ID of the sample, which is a SHA256 hash value. Find a sample ID from the response when uploading a malware sample or search with &#x60;/falconx/queries/submissions/v1&#x60;.The &#x60;url&#x60; parameter must be unset if &#x60;sha256&#x60; is used.  **&#x60;url&#x60;** A web page or file URL. It can be HTTP(S) or FTP. The &#x60;sha256&#x60; parameter must be unset if &#x60;url&#x60; is used.  **&#x60;action_script&#x60;** (optional): Runtime script for sandbox analysis. Values:  - &#x60;default&#x60; - &#x60;default_maxantievasion&#x60; - &#x60;default_randomfiles&#x60; - &#x60;default_randomtheme&#x60; - &#x60;default_openie&#x60;  **&#x60;command_line&#x60;** (optional): Command line script passed to the submitted file at runtime. Max length: 2048 characters  **&#x60;document_password&#x60;** (optional): Auto-filled for Adobe or Office files that prompt for a password. Max length: 32 characters  **&#x60;enable_tor&#x60;** (optional): Deprecated, please use &#x60;network_settings&#x60; instead. If &#x60;true&#x60;, sandbox analysis routes network traffic via TOR. Default: &#x60;false&#x60;.  **&#x60;network_settings&#x60;** (optional): Specifies the sandbox network_settings used for analysis. Values:  - &#x60;default&#x60;: Fully operating network - &#x60;tor&#x60;: Route network traffic via TOR - &#x60;simulated&#x60;: Simulate network traffic - &#x60;offline&#x60;: No network traffic  **&#x60;submit_name&#x60;** (optional): Name of the malware sample that&#39;s used for file type detection and analysis  **&#x60;system_date&#x60;** (optional): Set a custom date in the format &#x60;yyyy-MM-dd&#x60; for the sandbox environment  **&#x60;system_time&#x60;** (optional): Set a custom time in the format &#x60;HH:mm&#x60; for the sandbox environment.
+    # @param body [FalconxSubmissionParametersV1] Submit either a URL or a sample SHA256 for sandbox analysis. The sample file must have been previously uploaded through &#x60;/samples/entities/samples/v2&#x60;. You must specify a JSON object that includes the &#x60;falconx.SubmissionParametersV1&#x60; key/value pairs shown below.  **&#x60;environment_id&#x60;**: Specifies the sandbox environment used for analysis. Values:  - &#x60;400&#x60;: MacOS Catalina 10.15 - &#x60;300&#x60;: Linux Ubuntu 16.04, 64-bit - deprecated - &#x60;310&#x60;: Linux Ubuntu 20, 64-bit - &#x60;200&#x60;: Android (static analysis) - &#x60;160&#x60;: Windows 10, 64-bit - &#x60;140&#x60;: Windows 11, 64-bit - &#x60;110&#x60;: Windows 7, 64-bit - &#x60;100&#x60;: Windows 7, 32-bit  **&#x60;sha256&#x60;** ID of the sample, which is a SHA256 hash value. Find a sample ID from the response when uploading a malware sample or search with &#x60;/falconx/queries/submissions/v1&#x60;.The &#x60;url&#x60; parameter must be unset if &#x60;sha256&#x60; is used.  **&#x60;url&#x60;** A web page or file URL. It can be HTTP(S) or FTP. The &#x60;sha256&#x60; parameter must be unset if &#x60;url&#x60; is used.  **&#x60;action_script&#x60;** (optional): Runtime script for sandbox analysis. Values:  - &#x60;default&#x60; - &#x60;default_maxantievasion&#x60; - &#x60;default_randomfiles&#x60; - &#x60;default_randomtheme&#x60; - &#x60;default_openie&#x60;  **&#x60;command_line&#x60;** (optional): Command line script passed to the submitted file at runtime. Max length: 2048 characters  **&#x60;document_password&#x60;** (optional): Auto-filled for Adobe or Office files that prompt for a password. Max length: 32 characters  **&#x60;enable_tor&#x60;** (optional): Deprecated, please use &#x60;network_settings&#x60; instead. If &#x60;true&#x60;, sandbox analysis routes network traffic via TOR. Default: &#x60;false&#x60;.  **&#x60;network_settings&#x60;** (optional): Specifies the sandbox network_settings used for analysis. Values:  - &#x60;default&#x60;: Fully operating network - &#x60;tor&#x60;: Route network traffic via TOR - &#x60;simulated&#x60;: Simulate network traffic - &#x60;offline&#x60;: No network traffic  **&#x60;submit_name&#x60;** (optional): Name of the malware sample that&#39;s used for file type detection and analysis  **&#x60;system_date&#x60;** (optional): Set a custom date in the format &#x60;yyyy-MM-dd&#x60; for the sandbox environment  **&#x60;system_time&#x60;** (optional): Set a custom time in the format &#x60;HH:mm&#x60; for the sandbox environment.
     # @param [Hash] opts the optional parameters
     # @option opts [String] :aid Agent ID
     # @return [Array<(FalconxSubmissionV1Response, Integer, Hash)>] FalconxSubmissionV1Response data, response status code and response headers

data/lib/crimson-falcon/api/foundry_logscale.rb

@@ -41,7 +41,7 @@ module Falcon
     # @param [Hash] opts the optional parameters
     # @option opts [String] :app_id Application ID.
     # @option opts [Boolean] :include_schema_generation Include generated schemas in the response (default to false)
-    # @option opts [Boolean] :include_test_data Include test data when executing searches (default to false)
+    # @option opts [Boolean] :include_test_data Include test data when executing searches
     # @option opts [Boolean] :infer_json_types Whether to try to infer data types in json event response instead of returning map[string]string (default to false)
     # @option opts [Boolean] :match_response_schema Whether to validate search results against their schema (default to false)
     # @option opts [Boolean] :metadata Whether to include metadata in the response (default to false)
@@ -58,7 +58,7 @@ module Falcon
     # @param [Hash] opts the optional parameters
     # @option opts [String] :app_id Application ID.
     # @option opts [Boolean] :include_schema_generation Include generated schemas in the response (default to false)
-    # @option opts [Boolean] :include_test_data Include test data when executing searches (default to false)
+    # @option opts [Boolean] :include_test_data Include test data when executing searches
     # @option opts [Boolean] :infer_json_types Whether to try to infer data types in json event response instead of returning map[string]string (default to false)
     # @option opts [Boolean] :match_response_schema Whether to validate search results against their schema (default to false)
     # @option opts [Boolean] :metadata Whether to include metadata in the response (default to false)
@@ -143,7 +143,7 @@ module Falcon
     # @param [Hash] opts the optional parameters
     # @option opts [String] :app_id Application ID.
     # @option opts [Boolean] :include_schema_generation Include generated schemas in the response (default to false)
-    # @option opts [Boolean] :include_test_data Include test data when executing searches (default to false)
+    # @option opts [Boolean] :include_test_data Include test data when executing searches
     # @option opts [Boolean] :infer_json_types Whether to try to infer data types in json event response instead of returning map[string]string (default to false)
     # @option opts [Boolean] :match_response_schema Whether to validate search results against their schema (default to false)
     # @option opts [Boolean] :metadata Whether to include metadata in the response (default to false)
@@ -160,7 +160,7 @@ module Falcon
     # @param [Hash] opts the optional parameters
     # @option opts [String] :app_id Application ID.
     # @option opts [Boolean] :include_schema_generation Include generated schemas in the response (default to false)
-    # @option opts [Boolean] :include_test_data Include test data when executing searches (default to false)
+    # @option opts [Boolean] :include_test_data Include test data when executing searches
     # @option opts [Boolean] :infer_json_types Whether to try to infer data types in json event response instead of returning map[string]string (default to false)
     # @option opts [Boolean] :match_response_schema Whether to validate search results against their schema (default to false)
     # @option opts [Boolean] :metadata Whether to include metadata in the response (default to false)
@@ -245,7 +245,7 @@ module Falcon
     # @param [Hash] opts the optional parameters
     # @option opts [String] :app_id Application ID.
     # @option opts [Boolean] :detailed Whether to include search field details (default to false)
-    # @option opts [Boolean] :include_test_data Include test data when executing searches (default to false)
+    # @option opts [Boolean] :include_test_data Include test data when executing searches
     # @option opts [Boolean] :infer_json_types Whether to try to infer data types in json event response instead of returning map[string]string (default to false)
     # @option opts [Boolean] :match_response_schema Whether to validate search results against their schema (default to false)
     # @option opts [Boolean] :metadata Whether to include metadata in the response (default to false)
@@ -261,7 +261,7 @@ module Falcon
     # @param [Hash] opts the optional parameters
     # @option opts [String] :app_id Application ID.
     # @option opts [Boolean] :detailed Whether to include search field details (default to false)
-    # @option opts [Boolean] :include_test_data Include test data when executing searches (default to false)
+    # @option opts [Boolean] :include_test_data Include test data when executing searches
     # @option opts [Boolean] :infer_json_types Whether to try to infer data types in json event response instead of returning map[string]string (default to false)
     # @option opts [Boolean] :match_response_schema Whether to validate search results against their schema (default to false)
     # @option opts [Boolean] :metadata Whether to include metadata in the response (default to false)
@@ -340,7 +340,7 @@ module Falcon
     # @param [Hash] opts the optional parameters
     # @option opts [String] :app_id Application ID.
     # @option opts [Boolean] :detailed Whether to include search field details (default to false)
-    # @option opts [Boolean] :include_test_data Include test data when executing searches (default to false)
+    # @option opts [Boolean] :include_test_data Include test data when executing searches
     # @option opts [Boolean] :infer_json_types Whether to try to infer data types in json event response instead of returning map[string]string (default to false)
     # @option opts [Boolean] :match_response_schema Whether to validate search results against their schema (default to false)
     # @option opts [Boolean] :metadata Whether to include metadata in the response (default to false)
@@ -356,7 +356,7 @@ module Falcon
     # @param [Hash] opts the optional parameters
     # @option opts [String] :app_id Application ID.
     # @option opts [Boolean] :detailed Whether to include search field details (default to false)
-    # @option opts [Boolean] :include_test_data Include test data when executing searches (default to false)
+    # @option opts [Boolean] :include_test_data Include test data when executing searches
     # @option opts [Boolean] :infer_json_types Whether to try to infer data types in json event response instead of returning map[string]string (default to false)
     # @option opts [Boolean] :match_response_schema Whether to validate search results against their schema (default to false)
     # @option opts [Boolean] :metadata Whether to include metadata in the response (default to false)

data/lib/crimson-falcon/api/host_migration.rb

@@ -111,7 +111,7 @@ module Falcon
     # @option opts [Integer] :offset The offset to start retrieving records from
     # @option opts [Integer] :limit The maximum records to return. [1-10000]
     # @option opts [String] :sort The property to sort by.
-    # @option opts [String] :filter The filter expression that should be used to limit the results. Valid fields: groups, static_host_groups, status, target_cid, migration_id, created_time, host_migration_id, hostgroups, hostname, source_cid, id
+    # @option opts [String] :filter The filter expression that should be used to limit the results. Valid fields: migration_id, id, created_time, hostgroups, static_host_groups, hostname, status, groups, target_cid, source_cid, host_migration_id
     # @return [MsaspecQueryResponse]
     def get_host_migration_ids_v1(id, opts = {})
       data, _status_code, _headers = get_host_migration_ids_v1_with_http_info(id, opts)
@@ -125,7 +125,7 @@ module Falcon
     # @option opts [Integer] :offset The offset to start retrieving records from
     # @option opts [Integer] :limit The maximum records to return. [1-10000]
     # @option opts [String] :sort The property to sort by.
-    # @option opts [String] :filter The filter expression that should be used to limit the results. Valid fields: groups, static_host_groups, status, target_cid, migration_id, created_time, host_migration_id, hostgroups, hostname, source_cid, id
+    # @option opts [String] :filter The filter expression that should be used to limit the results. Valid fields: migration_id, id, created_time, hostgroups, static_host_groups, hostname, status, groups, target_cid, source_cid, host_migration_id
     # @return [Array<(MsaspecQueryResponse, Integer, Hash)>] MsaspecQueryResponse data, response status code and response headers
     def get_host_migration_ids_v1_with_http_info(id, opts = {})
       if @api_client.config.debugging
@@ -135,7 +135,7 @@ module Falcon
       if @api_client.config.client_side_validation && id.nil?
         fail ArgumentError, "Missing the required parameter 'id' when calling HostMigration.get_host_migration_ids_v1"
       end
-      allowable_values = ["groups|asc", "groups|desc", "groups", "static_host_groups|asc", "static_host_groups|desc", "static_host_groups", "status|asc", "status|desc", "status", "target_cid|asc", "target_cid|desc", "target_cid", "migration_id|asc", "migration_id|desc", "migration_id", "created_time|asc", "created_time|desc", "created_time", "host_migration_id|asc", "host_migration_id|desc", "host_migration_id", "hostgroups|asc", "hostgroups|desc", "hostgroups", "hostname|asc", "hostname|desc", "hostname", "source_cid|asc", "source_cid|desc", "source_cid", "id|asc", "id|desc", "id"]
+      allowable_values = ["target_cid|asc", "target_cid|desc", "target_cid", "source_cid|asc", "source_cid|desc", "source_cid", "host_migration_id|asc", "host_migration_id|desc", "host_migration_id", "groups|asc", "groups|desc", "groups", "static_host_groups|asc", "static_host_groups|desc", "static_host_groups", "hostname|asc", "hostname|desc", "hostname", "status|asc", "status|desc", "status", "migration_id|asc", "migration_id|desc", "migration_id", "id|asc", "id|desc", "id", "created_time|asc", "created_time|desc", "created_time", "hostgroups|asc", "hostgroups|desc", "hostgroups"]
       if @api_client.config.client_side_validation && opts[:'sort'] && !allowable_values.include?(opts[:'sort'])
         fail ArgumentError, "invalid value for \"sort\", must be one of #{allowable_values}"
       end
@@ -325,7 +325,7 @@ module Falcon
     # @option opts [Integer] :offset The offset to start retrieving records from
     # @option opts [Integer] :limit The maximum records to return. [1-10000]
     # @option opts [String] :sort The property to sort by.
-    # @option opts [String] :filter The filter expression that should be used to limit the results. Valid fields: target_cid, status, migration_status, created_by, created_time, name, id, migration_id
+    # @option opts [String] :filter The filter expression that should be used to limit the results. Valid fields: migration_status, created_by, created_time, name, id, migration_id, target_cid, status
     # @return [MsaspecQueryResponse]
     def get_migration_ids_v1(opts = {})
       data, _status_code, _headers = get_migration_ids_v1_with_http_info(opts)
@@ -337,13 +337,13 @@ module Falcon
     # @option opts [Integer] :offset The offset to start retrieving records from
     # @option opts [Integer] :limit The maximum records to return. [1-10000]
     # @option opts [String] :sort The property to sort by.
-    # @option opts [String] :filter The filter expression that should be used to limit the results. Valid fields: target_cid, status, migration_status, created_by, created_time, name, id, migration_id
+    # @option opts [String] :filter The filter expression that should be used to limit the results. Valid fields: migration_status, created_by, created_time, name, id, migration_id, target_cid, status
     # @return [Array<(MsaspecQueryResponse, Integer, Hash)>] MsaspecQueryResponse data, response status code and response headers
     def get_migration_ids_v1_with_http_info(opts = {})
       if @api_client.config.debugging
         @api_client.config.logger.debug 'Calling API: HostMigration.get_migration_ids_v1 ...'
       end
-      allowable_values = ["name|asc", "name|desc", "name", "id|asc", "id|desc", "id", "migration_id|asc", "migration_id|desc", "migration_id", "target_cid|asc", "target_cid|desc", "target_cid", "status|asc", "status|desc", "status", "migration_status|asc", "migration_status|desc", "migration_status", "created_by|asc", "created_by|desc", "created_by", "created_time|asc", "created_time|desc", "created_time"]
+      allowable_values = ["status|asc", "status|desc", "status", "migration_status|asc", "migration_status|desc", "migration_status", "created_by|asc", "created_by|desc", "created_by", "created_time|asc", "created_time|desc", "created_time", "name|asc", "name|desc", "name", "id|asc", "id|desc", "id", "migration_id|asc", "migration_id|desc", "migration_id", "target_cid|asc", "target_cid|desc", "target_cid"]
       if @api_client.config.client_side_validation && opts[:'sort'] && !allowable_values.include?(opts[:'sort'])
         fail ArgumentError, "invalid value for \"sort\", must be one of #{allowable_values}"
       end