crimson-falcon 1.0.1 → 1.1.0

data/lib/crimson-falcon/models/domain_azure_client_service_principal_v1.rb

@@ -49,7 +49,7 @@ module Falcon
 
     attr_accessor :encrypted_private_key
 
-    attr_accessor :object_id
+    attr_accessor :is_shared_client
 
     attr_accessor :public_certificate
 
@@ -59,6 +59,8 @@ module Falcon
 
     attr_accessor :x5t
 
+    attr_accessor :obj_id
+
     # Attribute mapping from ruby-style variable name to JSON key.
     def self.attribute_map
       {
@@ -70,11 +72,12 @@ module Falcon
         :'cspm_enabled' => :'cspm_enabled',
         :'default_subscription_id' => :'default_subscription_id',
         :'encrypted_private_key' => :'encrypted_private_key',
-        :'object_id' => :'object_id',
+        :'is_shared_client' => :'is_shared_client',
         :'public_certificate' => :'public_certificate',
         :'resource_permissions' => :'resource_permissions',
         :'tenant_id' => :'tenant_id',
-        :'x5t' => :'x5t'
+        :'x5t' => :'x5t',
+        :'obj_id' => :'obj_id'
       }
     end
 
@@ -90,15 +93,16 @@ module Falcon
         :'behavior_assessment_override' => :'Boolean',
         :'cid' => :'String',
         :'client_id' => :'String',
-        :'conditions' => :'Array<DomainCondition>',
+        :'conditions' => :'Array<StatemgmtCondition>',
         :'cspm_enabled' => :'Boolean',
         :'default_subscription_id' => :'String',
         :'encrypted_private_key' => :'String',
-        :'object_id' => :'String',
+        :'is_shared_client' => :'Boolean',
         :'public_certificate' => :'String',
-        :'resource_permissions' => :'Array<DomainAzureResourcePermission>',
+        :'resource_permissions' => :'Array<AzureResourcePermission>',
         :'tenant_id' => :'String',
-        :'x5t' => :'String'
+        :'x5t' => :'String',
+        :'obj_id' => :'String'
       }
     end
 
@@ -157,8 +161,8 @@ module Falcon
         self.encrypted_private_key = attributes[:'encrypted_private_key']
       end
 
-      if attributes.key?(:'object_id')
-        self.object_id = attributes[:'object_id']
+      if attributes.key?(:'is_shared_client')
+        self.is_shared_client = attributes[:'is_shared_client']
       end
 
       if attributes.key?(:'public_certificate')
@@ -178,6 +182,10 @@ module Falcon
       if attributes.key?(:'x5t')
         self.x5t = attributes[:'x5t']
       end
+
+      if attributes.key?(:'obj_id')
+        self.obj_id = attributes[:'obj_id']
+      end
     end
 
     # Show invalid properties with the reasons. Usually used together with valid?
@@ -192,6 +200,10 @@ module Falcon
         invalid_properties.push('invalid value for "cspm_enabled", cspm_enabled cannot be nil.')
       end
 
+      if @is_shared_client.nil?
+        invalid_properties.push('invalid value for "is_shared_client", is_shared_client cannot be nil.')
+      end
+
       if @tenant_id.nil?
         invalid_properties.push('invalid value for "tenant_id", tenant_id cannot be nil.')
       end
@@ -204,6 +216,7 @@ module Falcon
     def valid?
       return false if @cid.nil?
       return false if @cspm_enabled.nil?
+      return false if @is_shared_client.nil?
       return false if @tenant_id.nil?
       true
     end
@@ -221,11 +234,12 @@ module Falcon
           cspm_enabled == o.cspm_enabled &&
           default_subscription_id == o.default_subscription_id &&
           encrypted_private_key == o.encrypted_private_key &&
-          object_id == o.object_id &&
+          is_shared_client == o.is_shared_client &&
           public_certificate == o.public_certificate &&
           resource_permissions == o.resource_permissions &&
           tenant_id == o.tenant_id &&
-          x5t == o.x5t
+          x5t == o.x5t &&
+          obj_id == o.obj_id
     end
 
     # @see the `==` method
@@ -237,7 +251,7 @@ module Falcon
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [account_type, behavior_assessment_override, cid, client_id, conditions, cspm_enabled, default_subscription_id, encrypted_private_key, object_id, public_certificate, resource_permissions, tenant_id, x5t].hash
+      [account_type, behavior_assessment_override, cid, client_id, conditions, cspm_enabled, default_subscription_id, encrypted_private_key, is_shared_client, public_certificate, resource_permissions, tenant_id, x5t, obj_id].hash
     end
 
     # Builds the object from hash

data/lib/crimson-falcon/models/domain_behavior.rb

@@ -68,6 +68,8 @@ module Falcon
 
     attr_accessor :objective
 
+    attr_accessor :pattern_description
+
     attr_accessor :pattern_disposition
 
     attr_accessor :pattern_disposition_details
@@ -111,6 +113,7 @@ module Falcon
         :'ioc_type' => :'ioc_type',
         :'ioc_value' => :'ioc_value',
         :'objective' => :'objective',
+        :'pattern_description' => :'pattern_description',
         :'pattern_disposition' => :'pattern_disposition',
         :'pattern_disposition_details' => :'pattern_disposition_details',
         :'pattern_id' => :'pattern_id',
@@ -151,6 +154,7 @@ module Falcon
         :'ioc_type' => :'String',
         :'ioc_value' => :'String',
         :'objective' => :'String',
+        :'pattern_description' => :'String',
         :'pattern_disposition' => :'Integer',
         :'pattern_disposition_details' => :'PatterndispositionPatternDisposition',
         :'pattern_id' => :'Integer',
@@ -266,6 +270,10 @@ module Falcon
         self.objective = attributes[:'objective']
       end
 
+      if attributes.key?(:'pattern_description')
+        self.pattern_description = attributes[:'pattern_description']
+      end
+
       if attributes.key?(:'pattern_disposition')
         self.pattern_disposition = attributes[:'pattern_disposition']
       end
@@ -362,6 +370,7 @@ module Falcon
           ioc_type == o.ioc_type &&
           ioc_value == o.ioc_value &&
           objective == o.objective &&
+          pattern_description == o.pattern_description &&
           pattern_disposition == o.pattern_disposition &&
           pattern_disposition_details == o.pattern_disposition_details &&
           pattern_id == o.pattern_id &&
@@ -384,7 +393,7 @@ module Falcon
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [aid, alert_ids, behavior_id, cid, cmdline, compound_tto, detection_ids, display_name, domain, exclusion_type, filepath, grouping_ids, incident_id, incident_ids, ioc_source, ioc_type, ioc_value, objective, pattern_disposition, pattern_disposition_details, pattern_id, sha256, tactic, tactic_id, technique, technique_id, template_instance_id, timestamp, user_name].hash
+      [aid, alert_ids, behavior_id, cid, cmdline, compound_tto, detection_ids, display_name, domain, exclusion_type, filepath, grouping_ids, incident_id, incident_ids, ioc_source, ioc_type, ioc_value, objective, pattern_description, pattern_disposition, pattern_disposition_details, pattern_id, sha256, tactic, tactic_id, technique, technique_id, template_instance_id, timestamp, user_name].hash
     end
 
     # Builds the object from hash

data/lib/crimson-falcon/models/domain_botnet_config_source.rb

@@ -0,0 +1,351 @@
+=begin
+Crimson Falcon - Ruby Client SDK
+
+Code auto-generated by OpenAPI Generator; DO NOT EDIT.
+
+MIT License
+
+Copyright (c) 2023 Crowdstrike
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+=end
+
+require 'date'
+require 'time'
+
+module Falcon
+  class DomainBotnetConfigSource
+    # Populated for action botnets. List of action key value pairs, defined as the action and its type
+    attr_accessor :actions
+
+    # Populated for spam botnets. The body of the spam template. If this contains replaceable variables, keep the variable names in the template as they appear in the raw config
+    attr_accessor :body
+
+    # The botnet's name
+    attr_accessor :botnet
+
+    # The type of botnet: `action`, `inject`, or `spam`
+    attr_accessor :config_type
+
+    # Populated for inject botnets. List of inject targets and their data
+    attr_accessor :injects
+
+    # Optional sub-botnet differentiator
+    attr_accessor :sub_botnet
+
+    # Populated for spam botnets. The subject of the spam template. If this contains replaceable variables, keep the variable names in the template as they appear in the raw config
+    attr_accessor :subject
+
+    # Populated for spam botnets. List of key value pairs for any replaceable variables in the spam template
+    attr_accessor :variables
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    def self.attribute_map
+      {
+        :'actions' => :'actions',
+        :'body' => :'body',
+        :'botnet' => :'botnet',
+        :'config_type' => :'config_type',
+        :'injects' => :'injects',
+        :'sub_botnet' => :'sub_botnet',
+        :'subject' => :'subject',
+        :'variables' => :'variables'
+      }
+    end
+
+    # Returns all the JSON keys this model knows about
+    def self.acceptable_attributes
+      attribute_map.values
+    end
+
+    # Attribute type mapping.
+    def self.openapi_types
+      {
+        :'actions' => :'Array<DomainKeyValuePair>',
+        :'body' => :'String',
+        :'botnet' => :'String',
+        :'config_type' => :'String',
+        :'injects' => :'Array<DomainBotnetInject>',
+        :'sub_botnet' => :'String',
+        :'subject' => :'String',
+        :'variables' => :'Array<DomainKeyValuePair>'
+      }
+    end
+
+    # List of attributes with nullable: true
+    def self.openapi_nullable
+      Set.new([
+      ])
+    end
+
+    # Initializes the object
+    # @param [Hash] attributes Model attributes in the form of hash
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `Falcon::DomainBotnetConfigSource` initialize method"
+      end
+
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          fail ArgumentError, "`#{k}` is not a valid attribute in `Falcon::DomainBotnetConfigSource`. Please check the name to make sure it's valid. List of attributes: " + self.class.attribute_map.keys.inspect
+        end
+        h[k.to_sym] = v
+      }
+
+      if attributes.key?(:'actions')
+        if (value = attributes[:'actions']).is_a?(Array)
+          self.actions = value
+        end
+      end
+
+      if attributes.key?(:'body')
+        self.body = attributes[:'body']
+      end
+
+      if attributes.key?(:'botnet')
+        self.botnet = attributes[:'botnet']
+      end
+
+      if attributes.key?(:'config_type')
+        self.config_type = attributes[:'config_type']
+      end
+
+      if attributes.key?(:'injects')
+        if (value = attributes[:'injects']).is_a?(Array)
+          self.injects = value
+        end
+      end
+
+      if attributes.key?(:'sub_botnet')
+        self.sub_botnet = attributes[:'sub_botnet']
+      end
+
+      if attributes.key?(:'subject')
+        self.subject = attributes[:'subject']
+      end
+
+      if attributes.key?(:'variables')
+        if (value = attributes[:'variables']).is_a?(Array)
+          self.variables = value
+        end
+      end
+    end
+
+    # Show invalid properties with the reasons. Usually used together with valid?
+    # @return Array for valid properties with the reasons
+    def list_invalid_properties
+      invalid_properties = Array.new
+      if @actions.nil?
+        invalid_properties.push('invalid value for "actions", actions cannot be nil.')
+      end
+
+      if @body.nil?
+        invalid_properties.push('invalid value for "body", body cannot be nil.')
+      end
+
+      if @botnet.nil?
+        invalid_properties.push('invalid value for "botnet", botnet cannot be nil.')
+      end
+
+      if @config_type.nil?
+        invalid_properties.push('invalid value for "config_type", config_type cannot be nil.')
+      end
+
+      if @injects.nil?
+        invalid_properties.push('invalid value for "injects", injects cannot be nil.')
+      end
+
+      if @sub_botnet.nil?
+        invalid_properties.push('invalid value for "sub_botnet", sub_botnet cannot be nil.')
+      end
+
+      if @subject.nil?
+        invalid_properties.push('invalid value for "subject", subject cannot be nil.')
+      end
+
+      if @variables.nil?
+        invalid_properties.push('invalid value for "variables", variables cannot be nil.')
+      end
+
+      invalid_properties
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    def valid?
+      return false if @actions.nil?
+      return false if @body.nil?
+      return false if @botnet.nil?
+      return false if @config_type.nil?
+      return false if @injects.nil?
+      return false if @sub_botnet.nil?
+      return false if @subject.nil?
+      return false if @variables.nil?
+      true
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param [Object] Object to be compared
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          actions == o.actions &&
+          body == o.body &&
+          botnet == o.botnet &&
+          config_type == o.config_type &&
+          injects == o.injects &&
+          sub_botnet == o.sub_botnet &&
+          subject == o.subject &&
+          variables == o.variables
+    end
+
+    # @see the `==` method
+    # @param [Object] Object to be compared
+    def eql?(o)
+      self == o
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    def hash
+      [actions, body, botnet, config_type, injects, sub_botnet, subject, variables].hash
+    end
+
+    # Builds the object from hash
+    # @param [Hash] attributes Model attributes in the form of hash
+    # @return [Object] Returns the model itself
+    def self.build_from_hash(attributes)
+      new.build_from_hash(attributes)
+    end
+
+    # Builds the object from hash
+    # @param [Hash] attributes Model attributes in the form of hash
+    # @return [Object] Returns the model itself
+    def build_from_hash(attributes)
+      return nil unless attributes.is_a?(Hash)
+      attributes = attributes.transform_keys(&:to_sym)
+      self.class.openapi_types.each_pair do |key, type|
+        if attributes[self.class.attribute_map[key]].nil? && self.class.openapi_nullable.include?(key)
+          self.send("#{key}=", nil)
+        elsif type =~ /\AArray<(.*)>/i
+          # check to ensure the input is an array given that the attribute
+          # is documented as an array but the input is not
+          if attributes[self.class.attribute_map[key]].is_a?(Array)
+            self.send("#{key}=", attributes[self.class.attribute_map[key]].map { |v| _deserialize($1, v) })
+          end
+        elsif !attributes[self.class.attribute_map[key]].nil?
+          self.send("#{key}=", _deserialize(type, attributes[self.class.attribute_map[key]]))
+        end
+      end
+
+      self
+    end
+
+    # Deserializes the data based on type
+    # @param string type Data type
+    # @param string value Value to be deserialized
+    # @return [Object] Deserialized data
+    def _deserialize(type, value)
+      case type.to_sym
+      when :Time
+        Time.parse(value)
+      when :Date
+        Date.parse(value)
+      when :String
+        value.to_s
+      when :Integer
+        value.to_i
+      when :Float
+        value.to_f
+      when :Boolean
+        if value.to_s =~ /\A(true|t|yes|y|1)\z/i
+          true
+        else
+          false
+        end
+      when :Object
+        # generic object (usually a Hash), return directly
+        value
+      when /\AArray<(?<inner_type>.+)>\z/
+        inner_type = Regexp.last_match[:inner_type]
+        value.map { |v| _deserialize(inner_type, v) }
+      when /\AHash<(?<k_type>.+?), (?<v_type>.+)>\z/
+        k_type = Regexp.last_match[:k_type]
+        v_type = Regexp.last_match[:v_type]
+        {}.tap do |hash|
+          value.each do |k, v|
+            hash[_deserialize(k_type, k)] = _deserialize(v_type, v)
+          end
+        end
+      else # model
+        # models (e.g. Pet) or oneOf
+        klass = Falcon.const_get(type)
+        klass.respond_to?(:openapi_one_of) ? klass.build(value) : klass.build_from_hash(value)
+      end
+    end
+
+    # Returns the string representation of the object
+    # @return [String] String presentation of the object
+    def to_s
+      to_hash.to_s
+    end
+
+    # to_body is an alias to to_hash (backward compatibility)
+    # @return [Hash] Returns the object in the form of hash
+    def to_body
+      to_hash
+    end
+
+    # Returns the object in the form of hash
+    # @return [Hash] Returns the object in the form of hash
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      hash
+    end
+
+    # Outputs non-array value in the form of hash
+    # For object, use to_hash. Otherwise, just return the value
+    # @param [Object] value Any valid value
+    # @return [Hash] Returns the value in the form of hash
+    def _to_hash(value)
+      if value.is_a?(Array)
+        value.compact.map { |v| _to_hash(v) }
+      elsif value.is_a?(Hash)
+        {}.tap do |hash|
+          value.each { |k, v| hash[k] = _to_hash(v) }
+        end
+      elsif value.respond_to? :to_hash
+        value.to_hash
+      else
+        value
+      end
+    end
+  end
+end