crimson-falcon 1.0.1 → 1.2.0

data/lib/crimson-falcon/api/intel.rb

@@ -840,7 +840,7 @@ module Falcon
     # @option opts [Integer] :offset Set the starting row number to return actors from. Defaults to 0.
     # @option opts [Integer] :limit Set the number of actors to return. The value must be between 1 and 5000.
     # @option opts [String] :sort Order fields in ascending or descending order.  Ex: created_date|asc.
-    # @option opts [String] :filter Filter your query by specifying FQL filter parameters. Filter parameters include:  actor_type, capabilities, capability, capability.id, capability.slug, capability.value, created_date, description, ecrime_kill_chain.attribution, ecrime_kill_chain.crimes, ecrime_kill_chain.customers, ecrime_kill_chain.marketing, ecrime_kill_chain.monetization, ecrime_kill_chain.services_offered, ecrime_kill_chain.services_used, ecrime_kill_chain.technical_tradecraft, ecrime_kill_chain.victims, first_activity_date, group, group.id, group.slug, group.value, id, kill_chain.actions_and_objectives, kill_chain.actions_on_objectives, kill_chain.command_and_control, kill_chain.delivery, kill_chain.exploitation, kill_chain.installation, kill_chain.objectives, kill_chain.reconnaissance, kill_chain.weaponization, known_as, last_activity_date, last_modified_date, motivations, motivations.id, motivations.slug, motivations.value, name, objectives, origins, origins.id, origins.slug, origins.value, region, region.id, region.slug, region.value, short_description, slug, status, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, target_regions, target_regions.id, target_regions.slug, target_regions.value.
+    # @option opts [String] :filter Filter your query by specifying FQL filter parameters. Filter parameters include:  actor_type, animal_classifier, capabilities, capability, capability.id, capability.slug, capability.value, created_date, description, ecrime_kill_chain.attribution, ecrime_kill_chain.crimes, ecrime_kill_chain.customers, ecrime_kill_chain.marketing, ecrime_kill_chain.monetization, ecrime_kill_chain.services_offered, ecrime_kill_chain.services_used, ecrime_kill_chain.technical_tradecraft, ecrime_kill_chain.victims, first_activity_date, group, group.id, group.slug, group.value, id, kill_chain.actions_and_objectives, kill_chain.actions_on_objectives, kill_chain.command_and_control, kill_chain.delivery, kill_chain.exploitation, kill_chain.installation, kill_chain.objectives, kill_chain.reconnaissance, kill_chain.weaponization, known_as, last_activity_date, last_modified_date, motivations, motivations.id, motivations.slug, motivations.value, name, objectives, origins, origins.id, origins.slug, origins.value, region, region.id, region.slug, region.value, short_description, slug, status, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, target_regions, target_regions.id, target_regions.slug, target_regions.value.
     # @option opts [String] :q Perform a generic substring search across all fields.
     # @option opts [Array<String>] :fields The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like:  \\_\\_\\&lt;collection\\&gt;\\_\\_.  Ex: slug \\_\\_full\\_\\_.  Defaults to \\_\\_basic\\_\\_.
     # @return [DomainActorsResponse]
@@ -854,7 +854,7 @@ module Falcon
     # @option opts [Integer] :offset Set the starting row number to return actors from. Defaults to 0.
     # @option opts [Integer] :limit Set the number of actors to return. The value must be between 1 and 5000.
     # @option opts [String] :sort Order fields in ascending or descending order.  Ex: created_date|asc.
-    # @option opts [String] :filter Filter your query by specifying FQL filter parameters. Filter parameters include:  actor_type, capabilities, capability, capability.id, capability.slug, capability.value, created_date, description, ecrime_kill_chain.attribution, ecrime_kill_chain.crimes, ecrime_kill_chain.customers, ecrime_kill_chain.marketing, ecrime_kill_chain.monetization, ecrime_kill_chain.services_offered, ecrime_kill_chain.services_used, ecrime_kill_chain.technical_tradecraft, ecrime_kill_chain.victims, first_activity_date, group, group.id, group.slug, group.value, id, kill_chain.actions_and_objectives, kill_chain.actions_on_objectives, kill_chain.command_and_control, kill_chain.delivery, kill_chain.exploitation, kill_chain.installation, kill_chain.objectives, kill_chain.reconnaissance, kill_chain.weaponization, known_as, last_activity_date, last_modified_date, motivations, motivations.id, motivations.slug, motivations.value, name, objectives, origins, origins.id, origins.slug, origins.value, region, region.id, region.slug, region.value, short_description, slug, status, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, target_regions, target_regions.id, target_regions.slug, target_regions.value.
+    # @option opts [String] :filter Filter your query by specifying FQL filter parameters. Filter parameters include:  actor_type, animal_classifier, capabilities, capability, capability.id, capability.slug, capability.value, created_date, description, ecrime_kill_chain.attribution, ecrime_kill_chain.crimes, ecrime_kill_chain.customers, ecrime_kill_chain.marketing, ecrime_kill_chain.monetization, ecrime_kill_chain.services_offered, ecrime_kill_chain.services_used, ecrime_kill_chain.technical_tradecraft, ecrime_kill_chain.victims, first_activity_date, group, group.id, group.slug, group.value, id, kill_chain.actions_and_objectives, kill_chain.actions_on_objectives, kill_chain.command_and_control, kill_chain.delivery, kill_chain.exploitation, kill_chain.installation, kill_chain.objectives, kill_chain.reconnaissance, kill_chain.weaponization, known_as, last_activity_date, last_modified_date, motivations, motivations.id, motivations.slug, motivations.value, name, objectives, origins, origins.id, origins.slug, origins.value, region, region.id, region.slug, region.value, short_description, slug, status, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, target_regions, target_regions.id, target_regions.slug, target_regions.value.
     # @option opts [String] :q Perform a generic substring search across all fields.
     # @option opts [Array<String>] :fields The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like:  \\_\\_\\&lt;collection\\&gt;\\_\\_.  Ex: slug \\_\\_full\\_\\_.  Defaults to \\_\\_basic\\_\\_.
     # @return [Array<(DomainActorsResponse, Integer, Hash)>] DomainActorsResponse data, response status code and response headers
@@ -913,7 +913,7 @@ module Falcon
     # @option opts [Integer] :offset Set the starting row number to return actors IDs from. Defaults to 0.
     # @option opts [Integer] :limit Set the number of actor IDs to return. The value must be between 1 and 5000.
     # @option opts [String] :sort Order fields in ascending or descending order.  Ex: created_date|asc.
-    # @option opts [String] :filter Filter your query by specifying FQL filter parameters. Filter parameters include:  actor_type, capabilities, capability, capability.id, capability.slug, capability.value, created_date, description, ecrime_kill_chain.attribution, ecrime_kill_chain.crimes, ecrime_kill_chain.customers, ecrime_kill_chain.marketing, ecrime_kill_chain.monetization, ecrime_kill_chain.services_offered, ecrime_kill_chain.services_used, ecrime_kill_chain.technical_tradecraft, ecrime_kill_chain.victims, first_activity_date, group, group.id, group.slug, group.value, id, kill_chain.actions_and_objectives, kill_chain.actions_on_objectives, kill_chain.command_and_control, kill_chain.delivery, kill_chain.exploitation, kill_chain.installation, kill_chain.objectives, kill_chain.reconnaissance, kill_chain.weaponization, known_as, last_activity_date, last_modified_date, motivations, motivations.id, motivations.slug, motivations.value, name, objectives, origins, origins.id, origins.slug, origins.value, region, region.id, region.slug, region.value, short_description, slug, status, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, target_regions, target_regions.id, target_regions.slug, target_regions.value.
+    # @option opts [String] :filter Filter your query by specifying FQL filter parameters. Filter parameters include:  actor_type, animal_classifier, capabilities, capability, capability.id, capability.slug, capability.value, created_date, description, ecrime_kill_chain.attribution, ecrime_kill_chain.crimes, ecrime_kill_chain.customers, ecrime_kill_chain.marketing, ecrime_kill_chain.monetization, ecrime_kill_chain.services_offered, ecrime_kill_chain.services_used, ecrime_kill_chain.technical_tradecraft, ecrime_kill_chain.victims, first_activity_date, group, group.id, group.slug, group.value, id, kill_chain.actions_and_objectives, kill_chain.actions_on_objectives, kill_chain.command_and_control, kill_chain.delivery, kill_chain.exploitation, kill_chain.installation, kill_chain.objectives, kill_chain.reconnaissance, kill_chain.weaponization, known_as, last_activity_date, last_modified_date, motivations, motivations.id, motivations.slug, motivations.value, name, objectives, origins, origins.id, origins.slug, origins.value, region, region.id, region.slug, region.value, short_description, slug, status, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, target_regions, target_regions.id, target_regions.slug, target_regions.value.
     # @option opts [String] :q Perform a generic substring search across all fields.
     # @return [MsaQueryResponse]
     def query_intel_actor_ids(opts = {})
@@ -926,7 +926,7 @@ module Falcon
     # @option opts [Integer] :offset Set the starting row number to return actors IDs from. Defaults to 0.
     # @option opts [Integer] :limit Set the number of actor IDs to return. The value must be between 1 and 5000.
     # @option opts [String] :sort Order fields in ascending or descending order.  Ex: created_date|asc.
-    # @option opts [String] :filter Filter your query by specifying FQL filter parameters. Filter parameters include:  actor_type, capabilities, capability, capability.id, capability.slug, capability.value, created_date, description, ecrime_kill_chain.attribution, ecrime_kill_chain.crimes, ecrime_kill_chain.customers, ecrime_kill_chain.marketing, ecrime_kill_chain.monetization, ecrime_kill_chain.services_offered, ecrime_kill_chain.services_used, ecrime_kill_chain.technical_tradecraft, ecrime_kill_chain.victims, first_activity_date, group, group.id, group.slug, group.value, id, kill_chain.actions_and_objectives, kill_chain.actions_on_objectives, kill_chain.command_and_control, kill_chain.delivery, kill_chain.exploitation, kill_chain.installation, kill_chain.objectives, kill_chain.reconnaissance, kill_chain.weaponization, known_as, last_activity_date, last_modified_date, motivations, motivations.id, motivations.slug, motivations.value, name, objectives, origins, origins.id, origins.slug, origins.value, region, region.id, region.slug, region.value, short_description, slug, status, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, target_regions, target_regions.id, target_regions.slug, target_regions.value.
+    # @option opts [String] :filter Filter your query by specifying FQL filter parameters. Filter parameters include:  actor_type, animal_classifier, capabilities, capability, capability.id, capability.slug, capability.value, created_date, description, ecrime_kill_chain.attribution, ecrime_kill_chain.crimes, ecrime_kill_chain.customers, ecrime_kill_chain.marketing, ecrime_kill_chain.monetization, ecrime_kill_chain.services_offered, ecrime_kill_chain.services_used, ecrime_kill_chain.technical_tradecraft, ecrime_kill_chain.victims, first_activity_date, group, group.id, group.slug, group.value, id, kill_chain.actions_and_objectives, kill_chain.actions_on_objectives, kill_chain.command_and_control, kill_chain.delivery, kill_chain.exploitation, kill_chain.installation, kill_chain.objectives, kill_chain.reconnaissance, kill_chain.weaponization, known_as, last_activity_date, last_modified_date, motivations, motivations.id, motivations.slug, motivations.value, name, objectives, origins, origins.id, origins.slug, origins.value, region, region.id, region.slug, region.value, short_description, slug, status, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, target_regions, target_regions.id, target_regions.slug, target_regions.value.
     # @option opts [String] :q Perform a generic substring search across all fields.
     # @return [Array<(MsaQueryResponse, Integer, Hash)>] MsaQueryResponse data, response status code and response headers
     def query_intel_actor_ids_with_http_info(opts = {})
@@ -1135,7 +1135,7 @@ module Falcon
     # @option opts [Integer] :offset Set the starting row number to return reports from. Defaults to 0.
     # @option opts [Integer] :limit Set the number of reports to return. The value must be between 1 and 5000.
     # @option opts [String] :sort Order fields in ascending or descending order. Ex: created_date|asc.
-    # @option opts [String] :filter Filter your query by specifying FQL filter parameters. Filter parameters include:  actors, actors.id, actors.name, actors.slug, actors.url, created_date, description, id, last_modified_date, malware, malware.community_identifiers, malware.family_name, malware.slug, motivations, motivations.id, motivations.slug, motivations.value, name, name.raw, short_description, slug, sub_type, sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, tags.value, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, type, type.id, type.name, type.slug, url.
+    # @option opts [String] :filter Filter your query by specifying FQL filter parameters. Filter parameters include:  actors, actors.animal_classifier, actors.id, actors.name, actors.slug, actors.url, created_date, description, id, last_modified_date, malware, malware.community_identifiers, malware.family_name, malware.slug, motivations, motivations.id, motivations.slug, motivations.value, name, name.raw, short_description, slug, sub_type, sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, tags.value, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, type, type.id, type.name, type.slug, url.
     # @option opts [String] :q Perform a generic substring search across all fields.
     # @option opts [Array<String>] :fields The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like:  \\_\\_\\&lt;collection\\&gt;\\_\\_.  Ex: slug \\_\\_full\\_\\_.  Defaults to \\_\\_basic\\_\\_.
     # @return [DomainNewsResponse]
@@ -1149,7 +1149,7 @@ module Falcon
     # @option opts [Integer] :offset Set the starting row number to return reports from. Defaults to 0.
     # @option opts [Integer] :limit Set the number of reports to return. The value must be between 1 and 5000.
     # @option opts [String] :sort Order fields in ascending or descending order. Ex: created_date|asc.
-    # @option opts [String] :filter Filter your query by specifying FQL filter parameters. Filter parameters include:  actors, actors.id, actors.name, actors.slug, actors.url, created_date, description, id, last_modified_date, malware, malware.community_identifiers, malware.family_name, malware.slug, motivations, motivations.id, motivations.slug, motivations.value, name, name.raw, short_description, slug, sub_type, sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, tags.value, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, type, type.id, type.name, type.slug, url.
+    # @option opts [String] :filter Filter your query by specifying FQL filter parameters. Filter parameters include:  actors, actors.animal_classifier, actors.id, actors.name, actors.slug, actors.url, created_date, description, id, last_modified_date, malware, malware.community_identifiers, malware.family_name, malware.slug, motivations, motivations.id, motivations.slug, motivations.value, name, name.raw, short_description, slug, sub_type, sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, tags.value, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, type, type.id, type.name, type.slug, url.
     # @option opts [String] :q Perform a generic substring search across all fields.
     # @option opts [Array<String>] :fields The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like:  \\_\\_\\&lt;collection\\&gt;\\_\\_.  Ex: slug \\_\\_full\\_\\_.  Defaults to \\_\\_basic\\_\\_.
     # @return [Array<(DomainNewsResponse, Integer, Hash)>] DomainNewsResponse data, response status code and response headers
@@ -1208,7 +1208,7 @@ module Falcon
     # @option opts [Integer] :offset Set the starting row number to return report IDs from. Defaults to 0.
     # @option opts [Integer] :limit Set the number of report IDs to return. The value must be between 1 and 5000.
     # @option opts [String] :sort Order fields in ascending or descending order.  Ex: created_date|asc.
-    # @option opts [String] :filter Filter your query by specifying FQL filter parameters. Filter parameters include:  actors, actors.id, actors.name, actors.slug, actors.url, created_date, description, id, last_modified_date, malware, malware.community_identifiers, malware.family_name, malware.slug, motivations, motivations.id, motivations.slug, motivations.value, name, name.raw, short_description, slug, sub_type, sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, tags.value, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, type, type.id, type.name, type.slug, url.
+    # @option opts [String] :filter Filter your query by specifying FQL filter parameters. Filter parameters include:  actors, actors.animal_classifier, actors.id, actors.name, actors.slug, actors.url, created_date, description, id, last_modified_date, malware, malware.community_identifiers, malware.family_name, malware.slug, motivations, motivations.id, motivations.slug, motivations.value, name, name.raw, short_description, slug, sub_type, sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, tags.value, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, type, type.id, type.name, type.slug, url.
     # @option opts [String] :q Perform a generic substring search across all fields.
     # @return [MsaQueryResponse]
     def query_intel_report_ids(opts = {})
@@ -1221,7 +1221,7 @@ module Falcon
     # @option opts [Integer] :offset Set the starting row number to return report IDs from. Defaults to 0.
     # @option opts [Integer] :limit Set the number of report IDs to return. The value must be between 1 and 5000.
     # @option opts [String] :sort Order fields in ascending or descending order.  Ex: created_date|asc.
-    # @option opts [String] :filter Filter your query by specifying FQL filter parameters. Filter parameters include:  actors, actors.id, actors.name, actors.slug, actors.url, created_date, description, id, last_modified_date, malware, malware.community_identifiers, malware.family_name, malware.slug, motivations, motivations.id, motivations.slug, motivations.value, name, name.raw, short_description, slug, sub_type, sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, tags.value, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, type, type.id, type.name, type.slug, url.
+    # @option opts [String] :filter Filter your query by specifying FQL filter parameters. Filter parameters include:  actors, actors.animal_classifier, actors.id, actors.name, actors.slug, actors.url, created_date, description, id, last_modified_date, malware, malware.community_identifiers, malware.family_name, malware.slug, motivations, motivations.id, motivations.slug, motivations.value, name, name.raw, short_description, slug, sub_type, sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, tags.value, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, type, type.id, type.name, type.slug, url.
     # @option opts [String] :q Perform a generic substring search across all fields.
     # @return [Array<(MsaQueryResponse, Integer, Hash)>] MsaQueryResponse data, response status code and response headers
     def query_intel_report_ids_with_http_info(opts = {})
@@ -1432,6 +1432,79 @@ module Falcon
       return data, status_code, headers
     end
 
+    # Get malware entities that match provided FQL filters.
+    # @param [Hash] opts the optional parameters
+    # @option opts [Integer] :offset Set the starting row number to return malware IDs from. Defaults to 0.
+    # @option opts [Integer] :limit Set the number of malware IDs to return. The value must be between 1 and 5000.
+    # @option opts [String] :sort Order fields in ascending or descending order.  Ex: created_date|asc.
+    # @option opts [String] :filter Filter your query by specifying FQL filter parameters.
+    # @option opts [String] :q Perform a generic substring search across all fields.
+    # @option opts [Array<String>] :fields The fields to return
+    # @return [DomainMalwareResponse]
+    def query_malware_entities(opts = {})
+      data, _status_code, _headers = query_malware_entities_with_http_info(opts)
+      data
+    end
+
+    # Get malware entities that match provided FQL filters.
+    # @param [Hash] opts the optional parameters
+    # @option opts [Integer] :offset Set the starting row number to return malware IDs from. Defaults to 0.
+    # @option opts [Integer] :limit Set the number of malware IDs to return. The value must be between 1 and 5000.
+    # @option opts [String] :sort Order fields in ascending or descending order.  Ex: created_date|asc.
+    # @option opts [String] :filter Filter your query by specifying FQL filter parameters.
+    # @option opts [String] :q Perform a generic substring search across all fields.
+    # @option opts [Array<String>] :fields The fields to return
+    # @return [Array<(DomainMalwareResponse, Integer, Hash)>] DomainMalwareResponse data, response status code and response headers
+    def query_malware_entities_with_http_info(opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: Intel.query_malware_entities ...'
+      end
+      # resource path
+      local_var_path = '/intel/combined/malware/v1'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'offset'] = opts[:'offset'] if !opts[:'offset'].nil?
+      query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
+      query_params[:'sort'] = opts[:'sort'] if !opts[:'sort'].nil?
+      query_params[:'filter'] = opts[:'filter'] if !opts[:'filter'].nil?
+      query_params[:'q'] = opts[:'q'] if !opts[:'q'].nil?
+      query_params[:'fields'] = @api_client.build_collection_param(opts[:'fields'], :multi) if !opts[:'fields'].nil?
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'DomainMalwareResponse'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"Intel.query_malware_entities",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: Intel#query_malware_entities\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
     # Gets MITRE tactics and techniques for the given actor, returning concatenation of id and tactic and technique ids, example: fancy-bear_TA0011_T1071
     # @param [Hash] opts the optional parameters
     # @option opts [String] :id The actor ID(derived from the actor&#39;s name) for which to retrieve a list of attacks, for example: fancy-bear. Only one value is allowed
@@ -1560,7 +1633,7 @@ module Falcon
     # @option opts [String] :offset Starting index of result set from which to return IDs.
     # @option opts [Integer] :limit Number of IDs to return.
     # @option opts [String] :sort Order by fields.
-    # @option opts [String] :filter FQL query specifying the filter parameters.
+    # @option opts [String] :filter FQL query specifying the filter parameters. Filter parameters include:  _all, affected_products.product, affected_products.vendor, community_identifiers, cve, cvss_v3_base, cvss_v3_base.score, cvss_v3_base.severity, exploit_status, publish_date, related_actors, related_actors.animal_classifier, related_actors.name, related_reports.serial_id, related_reports.title, related_threats, related_threats.name, severity, updated_timestamp.
     # @option opts [String] :q Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed).
     # @return [MsaQueryResponse]
     def query_vulnerabilities(opts = {})
@@ -1573,7 +1646,7 @@ module Falcon
     # @option opts [String] :offset Starting index of result set from which to return IDs.
     # @option opts [Integer] :limit Number of IDs to return.
     # @option opts [String] :sort Order by fields.
-    # @option opts [String] :filter FQL query specifying the filter parameters.
+    # @option opts [String] :filter FQL query specifying the filter parameters. Filter parameters include:  _all, affected_products.product, affected_products.vendor, community_identifiers, cve, cvss_v3_base, cvss_v3_base.score, cvss_v3_base.severity, exploit_status, publish_date, related_actors, related_actors.animal_classifier, related_actors.name, related_reports.serial_id, related_reports.title, related_threats, related_threats.name, severity, updated_timestamp.
     # @option opts [String] :q Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed).
     # @return [Array<(MsaQueryResponse, Integer, Hash)>] MsaQueryResponse data, response status code and response headers
     def query_vulnerabilities_with_http_info(opts = {})

data/lib/crimson-falcon/api/intelligence_feeds.rb

@@ -0,0 +1,228 @@
+=begin
+Crimson Falcon - Ruby Client SDK
+
+Code auto-generated by OpenAPI Generator; DO NOT EDIT.
+
+MIT License
+
+Copyright (c) 2023 Crowdstrike
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+=end
+
+require 'cgi'
+
+module Falcon
+  class IntelligenceFeeds
+    attr_accessor :api_client
+
+    def initialize(api_client = ApiClient.default)
+      @api_client = api_client
+    end
+    # Downloads the content as a zip archive for a given feed item ID
+    # @param feed_item_id [String] Feed ID
+    # @param [Hash] opts the optional parameters
+    # @return [nil]
+    def download_feed_archive(feed_item_id, opts = {})
+      download_feed_archive_with_http_info(feed_item_id, opts)
+      nil
+    end
+
+    # Downloads the content as a zip archive for a given feed item ID
+    # @param feed_item_id [String] Feed ID
+    # @param [Hash] opts the optional parameters
+    # @return [Array<(nil, Integer, Hash)>] nil, response status code and response headers
+    def download_feed_archive_with_http_info(feed_item_id, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: IntelligenceFeeds.download_feed_archive ...'
+      end
+      # verify the required parameter 'feed_item_id' is set
+      if @api_client.config.client_side_validation && feed_item_id.nil?
+        fail ArgumentError, "Missing the required parameter 'feed_item_id' when calling IntelligenceFeeds.download_feed_archive"
+      end
+      # resource path
+      local_var_path = '/indicator-feed/entities/feed-download/v1'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'feed_item_id'] = feed_item_id
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type]
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"IntelligenceFeeds.download_feed_archive",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: IntelligenceFeeds#download_feed_archive\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Lists the accessible feed types for a given customer
+    # @param [Hash] opts the optional parameters
+    # @return [RestapiIndicatorGetFeedsResponse]
+    def list_feed_types(opts = {})
+      data, _status_code, _headers = list_feed_types_with_http_info(opts)
+      data
+    end
+
+    # Lists the accessible feed types for a given customer
+    # @param [Hash] opts the optional parameters
+    # @return [Array<(RestapiIndicatorGetFeedsResponse, Integer, Hash)>] RestapiIndicatorGetFeedsResponse data, response status code and response headers
+    def list_feed_types_with_http_info(opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: IntelligenceFeeds.list_feed_types ...'
+      end
+      # resource path
+      local_var_path = '/indicator-feed/entities/feed/v1'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'RestapiIndicatorGetFeedsResponse'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"IntelligenceFeeds.list_feed_types",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: IntelligenceFeeds#list_feed_types\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
+    # Queries the accessible feed types for a customer. Returns a list of feed item IDs which can be later downloaded
+    # @param feed_name [String] Feed Name
+    # @param feed_interval [String] Feed interval must be one of: dump|daily|hourly|minutely
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :since Since is a valid timestamp in RFC3399 format. Restrictions: minutely: now()-2h, hourly: now()-2d, daily: now()-5d; dump: now()-7d
+    # @return [RestapiIndicatorFeedQueryResponse]
+    def query_feed_archives(feed_name, feed_interval, opts = {})
+      data, _status_code, _headers = query_feed_archives_with_http_info(feed_name, feed_interval, opts)
+      data
+    end
+
+    # Queries the accessible feed types for a customer. Returns a list of feed item IDs which can be later downloaded
+    # @param feed_name [String] Feed Name
+    # @param feed_interval [String] Feed interval must be one of: dump|daily|hourly|minutely
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :since Since is a valid timestamp in RFC3399 format. Restrictions: minutely: now()-2h, hourly: now()-2d, daily: now()-5d; dump: now()-7d
+    # @return [Array<(RestapiIndicatorFeedQueryResponse, Integer, Hash)>] RestapiIndicatorFeedQueryResponse data, response status code and response headers
+    def query_feed_archives_with_http_info(feed_name, feed_interval, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: IntelligenceFeeds.query_feed_archives ...'
+      end
+      # verify the required parameter 'feed_name' is set
+      if @api_client.config.client_side_validation && feed_name.nil?
+        fail ArgumentError, "Missing the required parameter 'feed_name' when calling IntelligenceFeeds.query_feed_archives"
+      end
+      # verify the required parameter 'feed_interval' is set
+      if @api_client.config.client_side_validation && feed_interval.nil?
+        fail ArgumentError, "Missing the required parameter 'feed_interval' when calling IntelligenceFeeds.query_feed_archives"
+      end
+      # resource path
+      local_var_path = '/indicator-feed/queries/feed/v1'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'feed_name'] = feed_name
+      query_params[:'feed_interval'] = feed_interval
+      query_params[:'since'] = opts[:'since'] if !opts[:'since'].nil?
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'RestapiIndicatorFeedQueryResponse'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"IntelligenceFeeds.query_feed_archives",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: IntelligenceFeeds#query_feed_archives\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+  end
+end

data/lib/crimson-falcon/api/intelligence_indicator_graph.rb

@@ -36,33 +36,99 @@ module Falcon
     def initialize(api_client = ApiClient.default)
       @api_client = api_client
     end
+    # Get indicators based on their value.
+    # Look up intelligence data for multiple indicators. Supports various indicator types including domains, IP addresses, and file hashes (MD5, SHA1, SHA256). Provide up to 100 indicators in a single request.
+    # @param body [RestapiIndicatorsLookupRequest]
+    # @param [Hash] opts the optional parameters
+    # @return [RestapiLookupIndicatorResponse]
+    def lookup_indicators(body, opts = {})
+      data, _status_code, _headers = lookup_indicators_with_http_info(body, opts)
+      data
+    end
+
+    # Get indicators based on their value.
+    # Look up intelligence data for multiple indicators. Supports various indicator types including domains, IP addresses, and file hashes (MD5, SHA1, SHA256). Provide up to 100 indicators in a single request.
+    # @param body [RestapiIndicatorsLookupRequest]
+    # @param [Hash] opts the optional parameters
+    # @return [Array<(RestapiLookupIndicatorResponse, Integer, Hash)>] RestapiLookupIndicatorResponse data, response status code and response headers
+    def lookup_indicators_with_http_info(body, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: IntelligenceIndicatorGraph.lookup_indicators ...'
+      end
+      # verify the required parameter 'body' is set
+      if @api_client.config.client_side_validation && body.nil?
+        fail ArgumentError, "Missing the required parameter 'body' when calling IntelligenceIndicatorGraph.lookup_indicators"
+      end
+      # resource path
+      local_var_path = '/intelligence/combined/lookup-indicators/v1'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+      # HTTP header 'Content-Type'
+      content_type = @api_client.select_header_content_type(['application/json'])
+      if !content_type.nil?
+        header_params['Content-Type'] = content_type
+      end
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body] || @api_client.object_to_http_body(body)
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'RestapiLookupIndicatorResponse'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"IntelligenceIndicatorGraph.lookup_indicators",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:POST, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: IntelligenceIndicatorGraph#lookup_indicators\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
     # Search indicators based on FQL filter.
-    # @param x_cs_useruuid [String] User ID.
     # @param body [RestapiIndicatorsQueryRequest]
     # @param [Hash] opts the optional parameters
+    # @option opts [String] :sort Parameter to specify the order(field examples: FileDetails.SHA256, URLDetails.URL, PublishDate, MaliciousConfidence) Ex: &#39;PublishDate|asc&#39;.
+    # @option opts [String] :filter FQL query specifying the filter parameters.
     # @option opts [Integer] :limit Limit
     # @option opts [String] :offset Offset
     # @return [RestapiIndicatorResponse]
-    def search_indicators(x_cs_useruuid, body, opts = {})
-      data, _status_code, _headers = search_indicators_with_http_info(x_cs_useruuid, body, opts)
+    def search_indicators(body, opts = {})
+      data, _status_code, _headers = search_indicators_with_http_info(body, opts)
       data
     end
 
     # Search indicators based on FQL filter.
-    # @param x_cs_useruuid [String] User ID.
     # @param body [RestapiIndicatorsQueryRequest]
     # @param [Hash] opts the optional parameters
+    # @option opts [String] :sort Parameter to specify the order(field examples: FileDetails.SHA256, URLDetails.URL, PublishDate, MaliciousConfidence) Ex: &#39;PublishDate|asc&#39;.
+    # @option opts [String] :filter FQL query specifying the filter parameters.
     # @option opts [Integer] :limit Limit
     # @option opts [String] :offset Offset
     # @return [Array<(RestapiIndicatorResponse, Integer, Hash)>] RestapiIndicatorResponse data, response status code and response headers
-    def search_indicators_with_http_info(x_cs_useruuid, body, opts = {})
+    def search_indicators_with_http_info(body, opts = {})
       if @api_client.config.debugging
         @api_client.config.logger.debug 'Calling API: IntelligenceIndicatorGraph.search_indicators ...'
       end
-      # verify the required parameter 'x_cs_useruuid' is set
-      if @api_client.config.client_side_validation && x_cs_useruuid.nil?
-        fail ArgumentError, "Missing the required parameter 'x_cs_useruuid' when calling IntelligenceIndicatorGraph.search_indicators"
-      end
       # verify the required parameter 'body' is set
       if @api_client.config.client_side_validation && body.nil?
         fail ArgumentError, "Missing the required parameter 'body' when calling IntelligenceIndicatorGraph.search_indicators"
@@ -72,6 +138,8 @@ module Falcon
 
       # query parameters
       query_params = opts[:query_params] || {}
+      query_params[:'sort'] = opts[:'sort'] if !opts[:'sort'].nil?
+      query_params[:'filter'] = opts[:'filter'] if !opts[:'filter'].nil?
       query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
       query_params[:'offset'] = opts[:'offset'] if !opts[:'offset'].nil?
 
@@ -84,7 +152,6 @@ module Falcon
       if !content_type.nil?
         header_params['Content-Type'] = content_type
       end
-      header_params[:'X-CS-USERUUID'] = x_cs_useruuid
 
       # form parameters
       form_params = opts[:form_params] || {}