crimson-falcon 1.0.1 → 1.2.0

data/lib/crimson-falcon/api/activity_monitor.rb

@@ -0,0 +1,120 @@
+=begin
+Crimson Falcon - Ruby Client SDK
+
+Code auto-generated by OpenAPI Generator; DO NOT EDIT.
+
+MIT License
+
+Copyright (c) 2023 Crowdstrike
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+=end
+
+require 'cgi'
+
+module Falcon
+  class ActivityMonitor
+    attr_accessor :api_client
+
+    def initialize(api_client = ApiClient.default)
+      @api_client = api_client
+    end
+    # GET Activity Monitor
+    # Get a list of all events in monitor
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :integration_id Integration ID
+    # @option opts [String] :actor Actor
+    # @option opts [String] :category Comma separated list of categories
+    # @option opts [String] :projection Comma separated list of projections
+    # @option opts [Time] :from_date From Date
+    # @option opts [Time] :to_date To Date
+    # @option opts [Integer] :limit Max number of logs to fetch
+    # @option opts [Integer] :skip Number of logs to skip
+    # @return [GetActivityMonitor]
+    def get_activity_monitor_v3(opts = {})
+      data, _status_code, _headers = get_activity_monitor_v3_with_http_info(opts)
+      data
+    end
+
+    # GET Activity Monitor
+    # Get a list of all events in monitor
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :integration_id Integration ID
+    # @option opts [String] :actor Actor
+    # @option opts [String] :category Comma separated list of categories
+    # @option opts [String] :projection Comma separated list of projections
+    # @option opts [Time] :from_date From Date
+    # @option opts [Time] :to_date To Date
+    # @option opts [Integer] :limit Max number of logs to fetch
+    # @option opts [Integer] :skip Number of logs to skip
+    # @return [Array<(GetActivityMonitor, Integer, Hash)>] GetActivityMonitor data, response status code and response headers
+    def get_activity_monitor_v3_with_http_info(opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: ActivityMonitor.get_activity_monitor_v3 ...'
+      end
+      # resource path
+      local_var_path = '/saas-security/entities/monitor/v3'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'integration_id'] = opts[:'integration_id'] if !opts[:'integration_id'].nil?
+      query_params[:'actor'] = opts[:'actor'] if !opts[:'actor'].nil?
+      query_params[:'category'] = opts[:'category'] if !opts[:'category'].nil?
+      query_params[:'projection'] = opts[:'projection'] if !opts[:'projection'].nil?
+      query_params[:'from_date'] = opts[:'from_date'] if !opts[:'from_date'].nil?
+      query_params[:'to_date'] = opts[:'to_date'] if !opts[:'to_date'].nil?
+      query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
+      query_params[:'skip'] = opts[:'skip'] if !opts[:'skip'].nil?
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'GetActivityMonitor'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"ActivityMonitor.get_activity_monitor_v3",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: ActivityMonitor#get_activity_monitor_v3\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+  end
+end

data/lib/crimson-falcon/api/alerts.rb

@@ -36,6 +36,94 @@ module Falcon
     def initialize(api_client = ApiClient.default)
       @api_client = api_client
     end
+    # GET Alert by ID or GET Alerts
+    # Get a data on a specific alert or get a list of all alerts
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :id Alert ID
+    # @option opts [Integer] :limit The maximum number of objects to return
+    # @option opts [Integer] :offset The starting index of the results
+    # @option opts [String] :last_id The last id of the alert you want to get
+    # @option opts [String] :type The type of alert you want to get
+    # @option opts [String] :integration_id Comma separated list of integration ID's of the alert you want to get
+    # @option opts [Time] :from_date The start date of the alert you want to get (in YYYY-MM-DD format)
+    # @option opts [Time] :to_date The end date of the alert you want to get (in YYYY-MM-DD format)
+    # @option opts [Boolean] :ascending
+    # @return [GetAlertsResponse]
+    def get_alerts_v3(opts = {})
+      data, _status_code, _headers = get_alerts_v3_with_http_info(opts)
+      data
+    end
+
+    # GET Alert by ID or GET Alerts
+    # Get a data on a specific alert or get a list of all alerts
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :id Alert ID
+    # @option opts [Integer] :limit The maximum number of objects to return
+    # @option opts [Integer] :offset The starting index of the results
+    # @option opts [String] :last_id The last id of the alert you want to get
+    # @option opts [String] :type The type of alert you want to get
+    # @option opts [String] :integration_id Comma separated list of integration ID's of the alert you want to get
+    # @option opts [Time] :from_date The start date of the alert you want to get (in YYYY-MM-DD format)
+    # @option opts [Time] :to_date The end date of the alert you want to get (in YYYY-MM-DD format)
+    # @option opts [Boolean] :ascending
+    # @return [Array<(GetAlertsResponse, Integer, Hash)>] GetAlertsResponse data, response status code and response headers
+    def get_alerts_v3_with_http_info(opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: Alerts.get_alerts_v3 ...'
+      end
+      allowable_values = ["Unknown", "Configuration Drift", "Security Check Degraded", "Integration Failure", "Threat/IoC detected"]
+      if @api_client.config.client_side_validation && opts[:'type'] && !allowable_values.include?(opts[:'type'])
+        fail ArgumentError, "invalid value for \"type\", must be one of #{allowable_values}"
+      end
+      # resource path
+      local_var_path = '/saas-security/entities/alerts/v3'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+      query_params[:'id'] = opts[:'id'] if !opts[:'id'].nil?
+      query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
+      query_params[:'offset'] = opts[:'offset'] if !opts[:'offset'].nil?
+      query_params[:'last_id'] = opts[:'last_id'] if !opts[:'last_id'].nil?
+      query_params[:'type'] = opts[:'type'] if !opts[:'type'].nil?
+      query_params[:'integration_id'] = opts[:'integration_id'] if !opts[:'integration_id'].nil?
+      query_params[:'from_date'] = opts[:'from_date'] if !opts[:'from_date'].nil?
+      query_params[:'to_date'] = opts[:'to_date'] if !opts[:'to_date'].nil?
+      query_params[:'ascending'] = opts[:'ascending'] if !opts[:'ascending'].nil?
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'GetAlertsResponse'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['oauth2']
+
+      new_options = opts.merge(
+        :operation => :"Alerts.get_alerts_v3",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: Alerts#get_alerts_v3\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
     # Deprecated: please use version v2 of this endpoint. Retrieves all Alerts ids that match a given query.
     # @param [Hash] opts the optional parameters
     # @option opts [Integer] :offset The first detection to return, where &#x60;0&#x60; is the latest detection. Use with the &#x60;offset&#x60; parameter to manage pagination of results.
@@ -465,8 +553,8 @@ module Falcon
       return data, status_code, headers
     end
 
-    # Retrieves all Alerts that match a particular FQL filter.
-    # @param body [DetectsapiPostCombinedAlertsV1RequestSwagger] &#x60;after&#x60; - Token used to access the next page. The &#x60;after&#x60; token will be populated only when the service expects more results expected on the next page.  Once you reach the last page (which usually has less than &#x60;limit&#x60; results), the &#x60;after&#x60; token will not be returned anymore.   The best way to retrieve all the results is to paginate them till you get to the last page where the &#x60;after&#x60; token blank.   This value is highly dependant on the &#x60;sort&#x60; parameter, so if you plan to change the sort order, you will have to re-start your search from the first page (without &#x60;after&#x60; parameter).  &#x60;filter&#x60; - Filter Alerts using a query in Falcon Query Language (FQL).Filter fields can be any keyword field that is part of #domain.Alert  An asterisk wildcard &#x60;*&#x60; includes all results.   Empty value means to not filter on anything. Most commonly used filter fields that supports exact match: cid, id, aggregate_id, product, type, pattern_id, platform ... Most commonly used filter fields that supports wildcard (*): assigned_to_name, assigned_to_uuid, tactic_id, technique ... Most commonly filter fields that supports range comparisons (&gt;, &lt;, &gt;&#x3D;, &lt;&#x3D;): severity, created_timestamp, timestamp, updated_timestamp... All filter fields and operations support negation (!).   The full list of valid filter options is extensive. Review it in our [documentation inside the Falcon console](https://falcon.crowdstrike.com/documentation/45/falcon-query-language-fql).  &#x60;limit&#x60; - The maximum number of detections to return in this response (default: 100; max: 1000). Use this parameter together with the &#x60;after&#x60; parameter to manage pagination of the results.  &#x60;sort&#x60; - Sort parameter takes the form of &#x60;&lt;field|direction&gt;&#x60;.   The sorting fields can be any keyword field that is part of #domain.Alert except for the text based fields. Most commonly used fields for sorting are: timestamp, created_timestamp, updated_timestamp, status, aggregate_id, assigned_to_name, assigned_to_uid, assigned_to_uuid, tactic_id, tactic, technique, technique_id, pattern_id or product.  By default all the results are sorted by the &#x60;created_timestamp&#x60; field in the descending order.  **Important:** The pagination is done on live data in the order defined by the &#x60;sort&#x60; field parameter (default: &#x60;created_timestamp|desc&#x60;), so if you want to avoid inconsistent results where the same record might appear on multiple pages (or none), sort only on the fields that do not change over time (e.g. created_timestamp, composite_id, ...).
+    # Retrieves all Alerts that match a particular FQL filter. This API is intended for retrieval of large amounts of Alerts(>10k) using a pagination based on a `after` token. If you need to use `offset` pagination, consider using GET /alerts/queries/alerts/* and POST /alerts/entities/alerts/* APIs.
+    # @param body [DetectsapiPostCombinedAlertsV1RequestSwagger] &#x60;after&#x60; - The &#x60;after&#x60; token is used for pagination of results. The &#x60;after&#x60; token is present when more results are available on the next page. To retrieve all Alerts:    - Use the &#x60;after&#x60; token in subsequent requests to fetch the next page.   - Continue this process until you reach a page without an &#x60;after&#x60; token, indicating the last page.  This value is highly dependant on the &#x60;sort&#x60; parameter, so if you plan to change the sort order, you will have to re-start your search from the first page (without &#x60;after&#x60; parameter).  &#x60;filter&#x60; - Filter Alerts using a query in Falcon Query Language (FQL).Filter fields can be any keyword field that is part of #domain.Alert  An asterisk wildcard &#x60;*&#x60; includes all results.   Empty value means to not filter on anything. Most commonly used filter fields that supports exact match: cid, id, aggregate_id, product, type, pattern_id, platform ... Most commonly used filter fields that supports wildcard (*): assigned_to_name, assigned_to_uuid, tactic_id, technique ... Most commonly filter fields that supports range comparisons (&gt;, &lt;, &gt;&#x3D;, &lt;&#x3D;): severity, created_timestamp, timestamp, updated_timestamp... All filter fields and operations support negation (!).   The full list of valid filter options is extensive. Review it in our [documentation inside the Falcon console](https://falcon.crowdstrike.com/documentation/45/falcon-query-language-fql).  &#x60;limit&#x60; - The maximum number of detections to return in this response (default: 100; max: 1000). Use this parameter together with the &#x60;after&#x60; parameter to manage pagination of the results.  &#x60;sort&#x60; - Sort parameter takes the form of &#x60;&lt;field|direction&gt;&#x60;.   The sorting fields can be any keyword field that is part of #domain.Alert except for the text based fields. Most commonly used fields for sorting are: timestamp, created_timestamp, updated_timestamp, status, aggregate_id, assigned_to_name, assigned_to_uid, assigned_to_uuid, tactic_id, tactic, technique, technique_id, pattern_id or product.  By default all the results are sorted by the &#x60;created_timestamp&#x60; field in the descending order.  **Important:** The pagination is done on live data in the order defined by the &#x60;sort&#x60; field parameter (default: &#x60;created_timestamp|desc&#x60;), so if you want to avoid inconsistent results where the same record might appear on multiple pages (or none), sort only on the fields that do not change over time (e.g. created_timestamp, composite_id, ...).
     # @param [Hash] opts the optional parameters
     # @return [DetectsapiPostCombinedAlertsV1ResponseSwagger]
     def post_combined_alerts_v1(body, opts = {})
@@ -474,8 +562,8 @@ module Falcon
       data
     end
 
-    # Retrieves all Alerts that match a particular FQL filter.
-    # @param body [DetectsapiPostCombinedAlertsV1RequestSwagger] &#x60;after&#x60; - Token used to access the next page. The &#x60;after&#x60; token will be populated only when the service expects more results expected on the next page.  Once you reach the last page (which usually has less than &#x60;limit&#x60; results), the &#x60;after&#x60; token will not be returned anymore.   The best way to retrieve all the results is to paginate them till you get to the last page where the &#x60;after&#x60; token blank.   This value is highly dependant on the &#x60;sort&#x60; parameter, so if you plan to change the sort order, you will have to re-start your search from the first page (without &#x60;after&#x60; parameter).  &#x60;filter&#x60; - Filter Alerts using a query in Falcon Query Language (FQL).Filter fields can be any keyword field that is part of #domain.Alert  An asterisk wildcard &#x60;*&#x60; includes all results.   Empty value means to not filter on anything. Most commonly used filter fields that supports exact match: cid, id, aggregate_id, product, type, pattern_id, platform ... Most commonly used filter fields that supports wildcard (*): assigned_to_name, assigned_to_uuid, tactic_id, technique ... Most commonly filter fields that supports range comparisons (&gt;, &lt;, &gt;&#x3D;, &lt;&#x3D;): severity, created_timestamp, timestamp, updated_timestamp... All filter fields and operations support negation (!).   The full list of valid filter options is extensive. Review it in our [documentation inside the Falcon console](https://falcon.crowdstrike.com/documentation/45/falcon-query-language-fql).  &#x60;limit&#x60; - The maximum number of detections to return in this response (default: 100; max: 1000). Use this parameter together with the &#x60;after&#x60; parameter to manage pagination of the results.  &#x60;sort&#x60; - Sort parameter takes the form of &#x60;&lt;field|direction&gt;&#x60;.   The sorting fields can be any keyword field that is part of #domain.Alert except for the text based fields. Most commonly used fields for sorting are: timestamp, created_timestamp, updated_timestamp, status, aggregate_id, assigned_to_name, assigned_to_uid, assigned_to_uuid, tactic_id, tactic, technique, technique_id, pattern_id or product.  By default all the results are sorted by the &#x60;created_timestamp&#x60; field in the descending order.  **Important:** The pagination is done on live data in the order defined by the &#x60;sort&#x60; field parameter (default: &#x60;created_timestamp|desc&#x60;), so if you want to avoid inconsistent results where the same record might appear on multiple pages (or none), sort only on the fields that do not change over time (e.g. created_timestamp, composite_id, ...).
+    # Retrieves all Alerts that match a particular FQL filter. This API is intended for retrieval of large amounts of Alerts(&gt;10k) using a pagination based on a &#x60;after&#x60; token. If you need to use &#x60;offset&#x60; pagination, consider using GET /alerts/queries/alerts/* and POST /alerts/entities/alerts/* APIs.
+    # @param body [DetectsapiPostCombinedAlertsV1RequestSwagger] &#x60;after&#x60; - The &#x60;after&#x60; token is used for pagination of results. The &#x60;after&#x60; token is present when more results are available on the next page. To retrieve all Alerts:    - Use the &#x60;after&#x60; token in subsequent requests to fetch the next page.   - Continue this process until you reach a page without an &#x60;after&#x60; token, indicating the last page.  This value is highly dependant on the &#x60;sort&#x60; parameter, so if you plan to change the sort order, you will have to re-start your search from the first page (without &#x60;after&#x60; parameter).  &#x60;filter&#x60; - Filter Alerts using a query in Falcon Query Language (FQL).Filter fields can be any keyword field that is part of #domain.Alert  An asterisk wildcard &#x60;*&#x60; includes all results.   Empty value means to not filter on anything. Most commonly used filter fields that supports exact match: cid, id, aggregate_id, product, type, pattern_id, platform ... Most commonly used filter fields that supports wildcard (*): assigned_to_name, assigned_to_uuid, tactic_id, technique ... Most commonly filter fields that supports range comparisons (&gt;, &lt;, &gt;&#x3D;, &lt;&#x3D;): severity, created_timestamp, timestamp, updated_timestamp... All filter fields and operations support negation (!).   The full list of valid filter options is extensive. Review it in our [documentation inside the Falcon console](https://falcon.crowdstrike.com/documentation/45/falcon-query-language-fql).  &#x60;limit&#x60; - The maximum number of detections to return in this response (default: 100; max: 1000). Use this parameter together with the &#x60;after&#x60; parameter to manage pagination of the results.  &#x60;sort&#x60; - Sort parameter takes the form of &#x60;&lt;field|direction&gt;&#x60;.   The sorting fields can be any keyword field that is part of #domain.Alert except for the text based fields. Most commonly used fields for sorting are: timestamp, created_timestamp, updated_timestamp, status, aggregate_id, assigned_to_name, assigned_to_uid, assigned_to_uuid, tactic_id, tactic, technique, technique_id, pattern_id or product.  By default all the results are sorted by the &#x60;created_timestamp&#x60; field in the descending order.  **Important:** The pagination is done on live data in the order defined by the &#x60;sort&#x60; field parameter (default: &#x60;created_timestamp|desc&#x60;), so if you want to avoid inconsistent results where the same record might appear on multiple pages (or none), sort only on the fields that do not change over time (e.g. created_timestamp, composite_id, ...).
     # @param [Hash] opts the optional parameters
     # @return [Array<(DetectsapiPostCombinedAlertsV1ResponseSwagger, Integer, Hash)>] DetectsapiPostCombinedAlertsV1ResponseSwagger data, response status code and response headers
     def post_combined_alerts_v1_with_http_info(body, opts = {})

data/lib/crimson-falcon/api/api_integrations.rb

@@ -133,7 +133,7 @@ module Falcon
       # header parameters
       header_params = opts[:header_params] || {}
       # HTTP header 'Accept' (if needed)
-      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
+      header_params['Accept'] = @api_client.select_header_accept(['*/*', 'application/json'])
       # HTTP header 'Content-Type'
       content_type = @api_client.select_header_content_type(['application/json'])
       if !content_type.nil?