crimson-falcon 1.0.1 → 1.1.0

data/lib/crimson-falcon/models/api_query_metadata_json.rb

@@ -0,0 +1,553 @@
+=begin
+Crimson Falcon - Ruby Client SDK
+
+Code auto-generated by OpenAPI Generator; DO NOT EDIT.
+
+MIT License
+
+Copyright (c) 2023 Crowdstrike
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+=end
+
+require 'date'
+require 'time'
+
+module Falcon
+  class ApiQueryMetadataJSON
+    attr_accessor :costs
+
+    attr_accessor :digest_flow
+
+    # Number of events in the result set
+    attr_accessor :event_count
+
+    attr_accessor :extra_data
+
+    # Order of the returned fields
+    attr_accessor :field_order
+
+    attr_accessor :filter_query
+
+    # True if this is an aggregate query
+    attr_accessor :is_aggregate
+
+    # How soon to poll the query after it has been submitted to expected results
+    attr_accessor :poll_after
+
+    # Number of bytes processed to return results
+    attr_accessor :processed_bytes
+
+    # Number of events processed in result set
+    attr_accessor :processed_events
+
+    # Timestamp of the end of the query
+    attr_accessor :query_end
+
+    attr_accessor :query_spent
+
+    # Timestampt of when the query started
+    attr_accessor :query_start
+
+    # Number of milliseconds the query was queued before execution
+    attr_accessor :queued_millis
+
+    attr_accessor :quota_total_spent
+
+    # Number of the host returning the response
+    attr_accessor :responder_v_host
+
+    # Size of the buffer used to store the result
+    attr_accessor :result_buffer_size
+
+    # Time spent executing the query in milliseconds
+    attr_accessor :time_millis
+
+    # Total amount of work to execute the query
+    attr_accessor :total_work
+
+    # Deprecated: Use warnings in the message root instead
+    attr_accessor :warning
+
+    # Use 'warnings' in the message root instead
+    attr_accessor :warnings
+
+    # Estimate of the work done to complete the query
+    attr_accessor :work_done
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    def self.attribute_map
+      {
+        :'costs' => :'costs',
+        :'digest_flow' => :'digestFlow',
+        :'event_count' => :'eventCount',
+        :'extra_data' => :'extraData',
+        :'field_order' => :'fieldOrder',
+        :'filter_query' => :'filterQuery',
+        :'is_aggregate' => :'isAggregate',
+        :'poll_after' => :'pollAfter',
+        :'processed_bytes' => :'processedBytes',
+        :'processed_events' => :'processedEvents',
+        :'query_end' => :'queryEnd',
+        :'query_spent' => :'querySpent',
+        :'query_start' => :'queryStart',
+        :'queued_millis' => :'queuedMillis',
+        :'quota_total_spent' => :'quotaTotalSpent',
+        :'responder_v_host' => :'responderVHost',
+        :'result_buffer_size' => :'resultBufferSize',
+        :'time_millis' => :'timeMillis',
+        :'total_work' => :'totalWork',
+        :'warning' => :'warning',
+        :'warnings' => :'warnings',
+        :'work_done' => :'workDone'
+      }
+    end
+
+    # Returns all the JSON keys this model knows about
+    def self.acceptable_attributes
+      attribute_map.values
+    end
+
+    # Attribute type mapping.
+    def self.openapi_types
+      {
+        :'costs' => :'Costs',
+        :'digest_flow' => :'DigestFlow',
+        :'event_count' => :'Integer',
+        :'extra_data' => :'Object',
+        :'field_order' => :'Array<String>',
+        :'filter_query' => :'Object',
+        :'is_aggregate' => :'Boolean',
+        :'poll_after' => :'Integer',
+        :'processed_bytes' => :'Integer',
+        :'processed_events' => :'Integer',
+        :'query_end' => :'Integer',
+        :'query_spent' => :'QuerySpent',
+        :'query_start' => :'Integer',
+        :'queued_millis' => :'Integer',
+        :'quota_total_spent' => :'QuotaTotalSpent',
+        :'responder_v_host' => :'Integer',
+        :'result_buffer_size' => :'Integer',
+        :'time_millis' => :'Integer',
+        :'total_work' => :'Integer',
+        :'warning' => :'String',
+        :'warnings' => :'Array<String>',
+        :'work_done' => :'Integer'
+      }
+    end
+
+    # List of attributes with nullable: true
+    def self.openapi_nullable
+      Set.new([
+      ])
+    end
+
+    # Initializes the object
+    # @param [Hash] attributes Model attributes in the form of hash
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `Falcon::ApiQueryMetadataJSON` initialize method"
+      end
+
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          fail ArgumentError, "`#{k}` is not a valid attribute in `Falcon::ApiQueryMetadataJSON`. Please check the name to make sure it's valid. List of attributes: " + self.class.attribute_map.keys.inspect
+        end
+        h[k.to_sym] = v
+      }
+
+      if attributes.key?(:'costs')
+        self.costs = attributes[:'costs']
+      end
+
+      if attributes.key?(:'digest_flow')
+        self.digest_flow = attributes[:'digest_flow']
+      end
+
+      if attributes.key?(:'event_count')
+        self.event_count = attributes[:'event_count']
+      end
+
+      if attributes.key?(:'extra_data')
+        self.extra_data = attributes[:'extra_data']
+      end
+
+      if attributes.key?(:'field_order')
+        if (value = attributes[:'field_order']).is_a?(Array)
+          self.field_order = value
+        end
+      end
+
+      if attributes.key?(:'filter_query')
+        self.filter_query = attributes[:'filter_query']
+      end
+
+      if attributes.key?(:'is_aggregate')
+        self.is_aggregate = attributes[:'is_aggregate']
+      end
+
+      if attributes.key?(:'poll_after')
+        self.poll_after = attributes[:'poll_after']
+      end
+
+      if attributes.key?(:'processed_bytes')
+        self.processed_bytes = attributes[:'processed_bytes']
+      end
+
+      if attributes.key?(:'processed_events')
+        self.processed_events = attributes[:'processed_events']
+      end
+
+      if attributes.key?(:'query_end')
+        self.query_end = attributes[:'query_end']
+      end
+
+      if attributes.key?(:'query_spent')
+        self.query_spent = attributes[:'query_spent']
+      end
+
+      if attributes.key?(:'query_start')
+        self.query_start = attributes[:'query_start']
+      end
+
+      if attributes.key?(:'queued_millis')
+        self.queued_millis = attributes[:'queued_millis']
+      end
+
+      if attributes.key?(:'quota_total_spent')
+        self.quota_total_spent = attributes[:'quota_total_spent']
+      end
+
+      if attributes.key?(:'responder_v_host')
+        self.responder_v_host = attributes[:'responder_v_host']
+      end
+
+      if attributes.key?(:'result_buffer_size')
+        self.result_buffer_size = attributes[:'result_buffer_size']
+      end
+
+      if attributes.key?(:'time_millis')
+        self.time_millis = attributes[:'time_millis']
+      end
+
+      if attributes.key?(:'total_work')
+        self.total_work = attributes[:'total_work']
+      end
+
+      if attributes.key?(:'warning')
+        self.warning = attributes[:'warning']
+      end
+
+      if attributes.key?(:'warnings')
+        if (value = attributes[:'warnings']).is_a?(Array)
+          self.warnings = value
+        end
+      end
+
+      if attributes.key?(:'work_done')
+        self.work_done = attributes[:'work_done']
+      end
+    end
+
+    # Show invalid properties with the reasons. Usually used together with valid?
+    # @return Array for valid properties with the reasons
+    def list_invalid_properties
+      invalid_properties = Array.new
+      if @costs.nil?
+        invalid_properties.push('invalid value for "costs", costs cannot be nil.')
+      end
+
+      if @digest_flow.nil?
+        invalid_properties.push('invalid value for "digest_flow", digest_flow cannot be nil.')
+      end
+
+      if @event_count.nil?
+        invalid_properties.push('invalid value for "event_count", event_count cannot be nil.')
+      end
+
+      if @extra_data.nil?
+        invalid_properties.push('invalid value for "extra_data", extra_data cannot be nil.')
+      end
+
+      if @field_order.nil?
+        invalid_properties.push('invalid value for "field_order", field_order cannot be nil.')
+      end
+
+      if @filter_query.nil?
+        invalid_properties.push('invalid value for "filter_query", filter_query cannot be nil.')
+      end
+
+      if @is_aggregate.nil?
+        invalid_properties.push('invalid value for "is_aggregate", is_aggregate cannot be nil.')
+      end
+
+      if @poll_after.nil?
+        invalid_properties.push('invalid value for "poll_after", poll_after cannot be nil.')
+      end
+
+      if @processed_bytes.nil?
+        invalid_properties.push('invalid value for "processed_bytes", processed_bytes cannot be nil.')
+      end
+
+      if @processed_events.nil?
+        invalid_properties.push('invalid value for "processed_events", processed_events cannot be nil.')
+      end
+
+      if @query_end.nil?
+        invalid_properties.push('invalid value for "query_end", query_end cannot be nil.')
+      end
+
+      if @query_spent.nil?
+        invalid_properties.push('invalid value for "query_spent", query_spent cannot be nil.')
+      end
+
+      if @query_start.nil?
+        invalid_properties.push('invalid value for "query_start", query_start cannot be nil.')
+      end
+
+      if @queued_millis.nil?
+        invalid_properties.push('invalid value for "queued_millis", queued_millis cannot be nil.')
+      end
+
+      if @quota_total_spent.nil?
+        invalid_properties.push('invalid value for "quota_total_spent", quota_total_spent cannot be nil.')
+      end
+
+      if @responder_v_host.nil?
+        invalid_properties.push('invalid value for "responder_v_host", responder_v_host cannot be nil.')
+      end
+
+      if @result_buffer_size.nil?
+        invalid_properties.push('invalid value for "result_buffer_size", result_buffer_size cannot be nil.')
+      end
+
+      if @time_millis.nil?
+        invalid_properties.push('invalid value for "time_millis", time_millis cannot be nil.')
+      end
+
+      if @total_work.nil?
+        invalid_properties.push('invalid value for "total_work", total_work cannot be nil.')
+      end
+
+      if @warning.nil?
+        invalid_properties.push('invalid value for "warning", warning cannot be nil.')
+      end
+
+      if @warnings.nil?
+        invalid_properties.push('invalid value for "warnings", warnings cannot be nil.')
+      end
+
+      if @work_done.nil?
+        invalid_properties.push('invalid value for "work_done", work_done cannot be nil.')
+      end
+
+      invalid_properties
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    def valid?
+      return false if @costs.nil?
+      return false if @digest_flow.nil?
+      return false if @event_count.nil?
+      return false if @extra_data.nil?
+      return false if @field_order.nil?
+      return false if @filter_query.nil?
+      return false if @is_aggregate.nil?
+      return false if @poll_after.nil?
+      return false if @processed_bytes.nil?
+      return false if @processed_events.nil?
+      return false if @query_end.nil?
+      return false if @query_spent.nil?
+      return false if @query_start.nil?
+      return false if @queued_millis.nil?
+      return false if @quota_total_spent.nil?
+      return false if @responder_v_host.nil?
+      return false if @result_buffer_size.nil?
+      return false if @time_millis.nil?
+      return false if @total_work.nil?
+      return false if @warning.nil?
+      return false if @warnings.nil?
+      return false if @work_done.nil?
+      true
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param [Object] Object to be compared
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          costs == o.costs &&
+          digest_flow == o.digest_flow &&
+          event_count == o.event_count &&
+          extra_data == o.extra_data &&
+          field_order == o.field_order &&
+          filter_query == o.filter_query &&
+          is_aggregate == o.is_aggregate &&
+          poll_after == o.poll_after &&
+          processed_bytes == o.processed_bytes &&
+          processed_events == o.processed_events &&
+          query_end == o.query_end &&
+          query_spent == o.query_spent &&
+          query_start == o.query_start &&
+          queued_millis == o.queued_millis &&
+          quota_total_spent == o.quota_total_spent &&
+          responder_v_host == o.responder_v_host &&
+          result_buffer_size == o.result_buffer_size &&
+          time_millis == o.time_millis &&
+          total_work == o.total_work &&
+          warning == o.warning &&
+          warnings == o.warnings &&
+          work_done == o.work_done
+    end
+
+    # @see the `==` method
+    # @param [Object] Object to be compared
+    def eql?(o)
+      self == o
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    def hash
+      [costs, digest_flow, event_count, extra_data, field_order, filter_query, is_aggregate, poll_after, processed_bytes, processed_events, query_end, query_spent, query_start, queued_millis, quota_total_spent, responder_v_host, result_buffer_size, time_millis, total_work, warning, warnings, work_done].hash
+    end
+
+    # Builds the object from hash
+    # @param [Hash] attributes Model attributes in the form of hash
+    # @return [Object] Returns the model itself
+    def self.build_from_hash(attributes)
+      new.build_from_hash(attributes)
+    end
+
+    # Builds the object from hash
+    # @param [Hash] attributes Model attributes in the form of hash
+    # @return [Object] Returns the model itself
+    def build_from_hash(attributes)
+      return nil unless attributes.is_a?(Hash)
+      attributes = attributes.transform_keys(&:to_sym)
+      self.class.openapi_types.each_pair do |key, type|
+        if attributes[self.class.attribute_map[key]].nil? && self.class.openapi_nullable.include?(key)
+          self.send("#{key}=", nil)
+        elsif type =~ /\AArray<(.*)>/i
+          # check to ensure the input is an array given that the attribute
+          # is documented as an array but the input is not
+          if attributes[self.class.attribute_map[key]].is_a?(Array)
+            self.send("#{key}=", attributes[self.class.attribute_map[key]].map { |v| _deserialize($1, v) })
+          end
+        elsif !attributes[self.class.attribute_map[key]].nil?
+          self.send("#{key}=", _deserialize(type, attributes[self.class.attribute_map[key]]))
+        end
+      end
+
+      self
+    end
+
+    # Deserializes the data based on type
+    # @param string type Data type
+    # @param string value Value to be deserialized
+    # @return [Object] Deserialized data
+    def _deserialize(type, value)
+      case type.to_sym
+      when :Time
+        Time.parse(value)
+      when :Date
+        Date.parse(value)
+      when :String
+        value.to_s
+      when :Integer
+        value.to_i
+      when :Float
+        value.to_f
+      when :Boolean
+        if value.to_s =~ /\A(true|t|yes|y|1)\z/i
+          true
+        else
+          false
+        end
+      when :Object
+        # generic object (usually a Hash), return directly
+        value
+      when /\AArray<(?<inner_type>.+)>\z/
+        inner_type = Regexp.last_match[:inner_type]
+        value.map { |v| _deserialize(inner_type, v) }
+      when /\AHash<(?<k_type>.+?), (?<v_type>.+)>\z/
+        k_type = Regexp.last_match[:k_type]
+        v_type = Regexp.last_match[:v_type]
+        {}.tap do |hash|
+          value.each do |k, v|
+            hash[_deserialize(k_type, k)] = _deserialize(v_type, v)
+          end
+        end
+      else # model
+        # models (e.g. Pet) or oneOf
+        klass = Falcon.const_get(type)
+        klass.respond_to?(:openapi_one_of) ? klass.build(value) : klass.build_from_hash(value)
+      end
+    end
+
+    # Returns the string representation of the object
+    # @return [String] String presentation of the object
+    def to_s
+      to_hash.to_s
+    end
+
+    # to_body is an alias to to_hash (backward compatibility)
+    # @return [Hash] Returns the object in the form of hash
+    def to_body
+      to_hash
+    end
+
+    # Returns the object in the form of hash
+    # @return [Hash] Returns the object in the form of hash
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      hash
+    end
+
+    # Outputs non-array value in the form of hash
+    # For object, use to_hash. Otherwise, just return the value
+    # @param [Object] value Any valid value
+    # @return [Hash] Returns the value in the form of hash
+    def _to_hash(value)
+      if value.is_a?(Array)
+        value.compact.map { |v| _to_hash(v) }
+      elsif value.is_a?(Hash)
+        {}.tap do |hash|
+          value.each { |k, v| hash[k] = _to_hash(v) }
+        end
+      elsif value.respond_to? :to_hash
+        value.to_hash
+      else
+        value
+      end
+    end
+  end
+end

data/lib/crimson-falcon/models/api_rule_create_request_v1.rb

@@ -38,8 +38,12 @@ module Falcon
 
     attr_accessor :description
 
+    attr_accessor :mitre_attack
+
     attr_accessor :name
 
+    attr_accessor :notifications
+
     attr_accessor :operation
 
     attr_accessor :search
@@ -52,6 +56,8 @@ module Falcon
 
     attr_accessor :technique
 
+    attr_accessor :template_id
+
     attr_accessor :trigger_on_create
 
     # Attribute mapping from ruby-style variable name to JSON key.
@@ -60,13 +66,16 @@ module Falcon
         :'comment' => :'comment',
         :'customer_id' => :'customer_id',
         :'description' => :'description',
+        :'mitre_attack' => :'mitre_attack',
         :'name' => :'name',
+        :'notifications' => :'notifications',
         :'operation' => :'operation',
         :'search' => :'search',
         :'severity' => :'severity',
         :'status' => :'status',
         :'tactic' => :'tactic',
         :'technique' => :'technique',
+        :'template_id' => :'template_id',
         :'trigger_on_create' => :'trigger_on_create'
       }
     end
@@ -82,13 +91,16 @@ module Falcon
         :'comment' => :'String',
         :'customer_id' => :'String',
         :'description' => :'String',
+        :'mitre_attack' => :'Array<ModelMitreAttackMapping>',
         :'name' => :'String',
+        :'notifications' => :'Array<ApiCreateRuleNotifications>',
         :'operation' => :'ApiCreateRuleOperationV1',
         :'search' => :'ApiRuleSearchV1',
         :'severity' => :'Integer',
         :'status' => :'String',
         :'tactic' => :'String',
         :'technique' => :'String',
+        :'template_id' => :'String',
         :'trigger_on_create' => :'Boolean'
       }
     end
@@ -126,10 +138,22 @@ module Falcon
         self.description = attributes[:'description']
       end
 
+      if attributes.key?(:'mitre_attack')
+        if (value = attributes[:'mitre_attack']).is_a?(Array)
+          self.mitre_attack = value
+        end
+      end
+
       if attributes.key?(:'name')
         self.name = attributes[:'name']
       end
 
+      if attributes.key?(:'notifications')
+        if (value = attributes[:'notifications']).is_a?(Array)
+          self.notifications = value
+        end
+      end
+
       if attributes.key?(:'operation')
         self.operation = attributes[:'operation']
       end
@@ -154,6 +178,10 @@ module Falcon
         self.technique = attributes[:'technique']
       end
 
+      if attributes.key?(:'template_id')
+        self.template_id = attributes[:'template_id']
+      end
+
       if attributes.key?(:'trigger_on_create')
         self.trigger_on_create = attributes[:'trigger_on_create']
       end
@@ -187,6 +215,10 @@ module Falcon
         invalid_properties.push('invalid value for "status", status cannot be nil.')
       end
 
+      if @template_id.nil?
+        invalid_properties.push('invalid value for "template_id", template_id cannot be nil.')
+      end
+
       invalid_properties
     end
 
@@ -199,6 +231,7 @@ module Falcon
       return false if @search.nil?
       return false if @severity.nil?
       return false if @status.nil?
+      return false if @template_id.nil?
       true
     end
 
@@ -210,13 +243,16 @@ module Falcon
           comment == o.comment &&
           customer_id == o.customer_id &&
           description == o.description &&
+          mitre_attack == o.mitre_attack &&
           name == o.name &&
+          notifications == o.notifications &&
           operation == o.operation &&
           search == o.search &&
           severity == o.severity &&
           status == o.status &&
           tactic == o.tactic &&
           technique == o.technique &&
+          template_id == o.template_id &&
           trigger_on_create == o.trigger_on_create
     end
 
@@ -229,7 +265,7 @@ module Falcon
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [comment, customer_id, description, name, operation, search, severity, status, tactic, technique, trigger_on_create].hash
+      [comment, customer_id, description, mitre_attack, name, notifications, operation, search, severity, status, tactic, technique, template_id, trigger_on_create].hash
     end
 
     # Builds the object from hash