crimson-falcon 1.0.1 → 1.2.0

data/lib/crimson-falcon/models/day.rb

@@ -0,0 +1,270 @@
+=begin
+Crimson Falcon - Ruby Client SDK
+
+Code auto-generated by OpenAPI Generator; DO NOT EDIT.
+
+MIT License
+
+Copyright (c) 2023 Crowdstrike
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+=end
+
+require 'date'
+require 'time'
+
+module Falcon
+  class Day
+    # Live cost of executing the query
+    attr_accessor :live_cost
+
+    # Number of executions of the query
+    attr_accessor :query_count
+
+    # Static cost of executing the query
+    attr_accessor :static_cost
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    def self.attribute_map
+      {
+        :'live_cost' => :'liveCost',
+        :'query_count' => :'queryCount',
+        :'static_cost' => :'staticCost'
+      }
+    end
+
+    # Returns all the JSON keys this model knows about
+    def self.acceptable_attributes
+      attribute_map.values
+    end
+
+    # Attribute type mapping.
+    def self.openapi_types
+      {
+        :'live_cost' => :'Integer',
+        :'query_count' => :'Integer',
+        :'static_cost' => :'Integer'
+      }
+    end
+
+    # List of attributes with nullable: true
+    def self.openapi_nullable
+      Set.new([
+      ])
+    end
+
+    # Initializes the object
+    # @param [Hash] attributes Model attributes in the form of hash
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `Falcon::Day` initialize method"
+      end
+
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          fail ArgumentError, "`#{k}` is not a valid attribute in `Falcon::Day`. Please check the name to make sure it's valid. List of attributes: " + self.class.attribute_map.keys.inspect
+        end
+        h[k.to_sym] = v
+      }
+
+      if attributes.key?(:'live_cost')
+        self.live_cost = attributes[:'live_cost']
+      end
+
+      if attributes.key?(:'query_count')
+        self.query_count = attributes[:'query_count']
+      end
+
+      if attributes.key?(:'static_cost')
+        self.static_cost = attributes[:'static_cost']
+      end
+    end
+
+    # Show invalid properties with the reasons. Usually used together with valid?
+    # @return Array for valid properties with the reasons
+    def list_invalid_properties
+      invalid_properties = Array.new
+      if @live_cost.nil?
+        invalid_properties.push('invalid value for "live_cost", live_cost cannot be nil.')
+      end
+
+      if @query_count.nil?
+        invalid_properties.push('invalid value for "query_count", query_count cannot be nil.')
+      end
+
+      if @static_cost.nil?
+        invalid_properties.push('invalid value for "static_cost", static_cost cannot be nil.')
+      end
+
+      invalid_properties
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    def valid?
+      return false if @live_cost.nil?
+      return false if @query_count.nil?
+      return false if @static_cost.nil?
+      true
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param [Object] Object to be compared
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          live_cost == o.live_cost &&
+          query_count == o.query_count &&
+          static_cost == o.static_cost
+    end
+
+    # @see the `==` method
+    # @param [Object] Object to be compared
+    def eql?(o)
+      self == o
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    def hash
+      [live_cost, query_count, static_cost].hash
+    end
+
+    # Builds the object from hash
+    # @param [Hash] attributes Model attributes in the form of hash
+    # @return [Object] Returns the model itself
+    def self.build_from_hash(attributes)
+      new.build_from_hash(attributes)
+    end
+
+    # Builds the object from hash
+    # @param [Hash] attributes Model attributes in the form of hash
+    # @return [Object] Returns the model itself
+    def build_from_hash(attributes)
+      return nil unless attributes.is_a?(Hash)
+      attributes = attributes.transform_keys(&:to_sym)
+      self.class.openapi_types.each_pair do |key, type|
+        if attributes[self.class.attribute_map[key]].nil? && self.class.openapi_nullable.include?(key)
+          self.send("#{key}=", nil)
+        elsif type =~ /\AArray<(.*)>/i
+          # check to ensure the input is an array given that the attribute
+          # is documented as an array but the input is not
+          if attributes[self.class.attribute_map[key]].is_a?(Array)
+            self.send("#{key}=", attributes[self.class.attribute_map[key]].map { |v| _deserialize($1, v) })
+          end
+        elsif !attributes[self.class.attribute_map[key]].nil?
+          self.send("#{key}=", _deserialize(type, attributes[self.class.attribute_map[key]]))
+        end
+      end
+
+      self
+    end
+
+    # Deserializes the data based on type
+    # @param string type Data type
+    # @param string value Value to be deserialized
+    # @return [Object] Deserialized data
+    def _deserialize(type, value)
+      case type.to_sym
+      when :Time
+        Time.parse(value)
+      when :Date
+        Date.parse(value)
+      when :String
+        value.to_s
+      when :Integer
+        value.to_i
+      when :Float
+        value.to_f
+      when :Boolean
+        if value.to_s =~ /\A(true|t|yes|y|1)\z/i
+          true
+        else
+          false
+        end
+      when :Object
+        # generic object (usually a Hash), return directly
+        value
+      when /\AArray<(?<inner_type>.+)>\z/
+        inner_type = Regexp.last_match[:inner_type]
+        value.map { |v| _deserialize(inner_type, v) }
+      when /\AHash<(?<k_type>.+?), (?<v_type>.+)>\z/
+        k_type = Regexp.last_match[:k_type]
+        v_type = Regexp.last_match[:v_type]
+        {}.tap do |hash|
+          value.each do |k, v|
+            hash[_deserialize(k_type, k)] = _deserialize(v_type, v)
+          end
+        end
+      else # model
+        # models (e.g. Pet) or oneOf
+        klass = Falcon.const_get(type)
+        klass.respond_to?(:openapi_one_of) ? klass.build(value) : klass.build_from_hash(value)
+      end
+    end
+
+    # Returns the string representation of the object
+    # @return [String] String presentation of the object
+    def to_s
+      to_hash.to_s
+    end
+
+    # to_body is an alias to to_hash (backward compatibility)
+    # @return [Hash] Returns the object in the form of hash
+    def to_body
+      to_hash
+    end
+
+    # Returns the object in the form of hash
+    # @return [Hash] Returns the object in the form of hash
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      hash
+    end
+
+    # Outputs non-array value in the form of hash
+    # For object, use to_hash. Otherwise, just return the value
+    # @param [Object] value Any valid value
+    # @return [Hash] Returns the value in the form of hash
+    def _to_hash(value)
+      if value.is_a?(Array)
+        value.compact.map { |v| _to_hash(v) }
+      elsif value.is_a?(Hash)
+        {}.tap do |hash|
+          value.each { |k, v| hash[k] = _to_hash(v) }
+        end
+      elsif value.respond_to? :to_hash
+        value.to_hash
+      else
+        value
+      end
+    end
+  end
+end

data/lib/crimson-falcon/models/detects_external_alert.rb

@@ -80,6 +80,12 @@ module Falcon
     # Vertex key which triggers the formation of the Alert
     attr_accessor :id
 
+    # Linked Case Ids are cases that are associated with this alert
+    attr_accessor :linked_case_ids
+
+    # References to MITRE ATT&CK, which is a public framework for tracking and modeling adversary tools techniques and procedures
+    attr_accessor :mitre_attack
+
     # Pattern Name coming either from Taxonomy or directly from the ingested Alert
     attr_accessor :name
 
@@ -95,6 +101,9 @@ module Falcon
     # Product specifies the SKU that this Alert belongs to e.g. mobile, idp, epp
     attr_accessor :product
 
+    # Alert resolution. Could be one of the following values: true_positive, false_positive, ignored
+    attr_accessor :resolution
+
     # Scenario was used pre-Handrails to display additional killchain context for UI alerts. With handrails, this field is mostly  obsolete in favor of tactic/technique. Still, it can be useful for determining specific pattern types that are not straightforward to distinguish from other fields alone
     attr_accessor :scenario
 
@@ -165,11 +174,14 @@ module Falcon
         :'email_sent' => :'email_sent',
         :'external' => :'external',
         :'id' => :'id',
+        :'linked_case_ids' => :'linked_case_ids',
+        :'mitre_attack' => :'mitre_attack',
         :'name' => :'name',
         :'objective' => :'objective',
         :'pattern_id' => :'pattern_id',
         :'platform' => :'platform',
         :'product' => :'product',
+        :'resolution' => :'resolution',
         :'scenario' => :'scenario',
         :'seconds_to_resolved' => :'seconds_to_resolved',
         :'seconds_to_triaged' => :'seconds_to_triaged',
@@ -214,11 +226,14 @@ module Falcon
         :'email_sent' => :'Boolean',
         :'external' => :'Boolean',
         :'id' => :'String',
+        :'linked_case_ids' => :'Array<String>',
+        :'mitre_attack' => :'Array<DetectsMitreAttackMapping>',
         :'name' => :'String',
         :'objective' => :'String',
         :'pattern_id' => :'Integer',
         :'platform' => :'String',
         :'product' => :'String',
+        :'resolution' => :'String',
         :'scenario' => :'String',
         :'seconds_to_resolved' => :'Integer',
         :'seconds_to_triaged' => :'Integer',
@@ -326,6 +341,18 @@ module Falcon
         self.id = attributes[:'id']
       end
 
+      if attributes.key?(:'linked_case_ids')
+        if (value = attributes[:'linked_case_ids']).is_a?(Array)
+          self.linked_case_ids = value
+        end
+      end
+
+      if attributes.key?(:'mitre_attack')
+        if (value = attributes[:'mitre_attack']).is_a?(Array)
+          self.mitre_attack = value
+        end
+      end
+
       if attributes.key?(:'name')
         self.name = attributes[:'name']
       end
@@ -346,6 +373,10 @@ module Falcon
         self.product = attributes[:'product']
       end
 
+      if attributes.key?(:'resolution')
+        self.resolution = attributes[:'resolution']
+      end
+
       if attributes.key?(:'scenario')
         self.scenario = attributes[:'scenario']
       end
@@ -489,6 +520,14 @@ module Falcon
         invalid_properties.push('invalid value for "id", id cannot be nil.')
       end
 
+      if @linked_case_ids.nil?
+        invalid_properties.push('invalid value for "linked_case_ids", linked_case_ids cannot be nil.')
+      end
+
+      if @mitre_attack.nil?
+        invalid_properties.push('invalid value for "mitre_attack", mitre_attack cannot be nil.')
+      end
+
       if @name.nil?
         invalid_properties.push('invalid value for "name", name cannot be nil.')
       end
@@ -509,6 +548,10 @@ module Falcon
         invalid_properties.push('invalid value for "product", product cannot be nil.')
       end
 
+      if @resolution.nil?
+        invalid_properties.push('invalid value for "resolution", resolution cannot be nil.')
+      end
+
       if @scenario.nil?
         invalid_properties.push('invalid value for "scenario", scenario cannot be nil.')
       end
@@ -599,11 +642,14 @@ module Falcon
       return false if @email_sent.nil?
       return false if @external.nil?
       return false if @id.nil?
+      return false if @linked_case_ids.nil?
+      return false if @mitre_attack.nil?
       return false if @name.nil?
       return false if @objective.nil?
       return false if @pattern_id.nil?
       return false if @platform.nil?
       return false if @product.nil?
+      return false if @resolution.nil?
       return false if @scenario.nil?
       return false if @seconds_to_resolved.nil?
       return false if @seconds_to_triaged.nil?
@@ -645,11 +691,14 @@ module Falcon
           email_sent == o.email_sent &&
           external == o.external &&
           id == o.id &&
+          linked_case_ids == o.linked_case_ids &&
+          mitre_attack == o.mitre_attack &&
           name == o.name &&
           objective == o.objective &&
           pattern_id == o.pattern_id &&
           platform == o.platform &&
           product == o.product &&
+          resolution == o.resolution &&
           scenario == o.scenario &&
           seconds_to_resolved == o.seconds_to_resolved &&
           seconds_to_triaged == o.seconds_to_triaged &&
@@ -678,7 +727,7 @@ module Falcon
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [agent_id, aggregate_id, assigned_to_name, assigned_to_uid, assigned_to_uuid, cid, composite_id, confidence, crawled_timestamp, created_timestamp, data_domains, description, display_name, email_sent, external, id, name, objective, pattern_id, platform, product, scenario, seconds_to_resolved, seconds_to_triaged, severity, severity_name, show_in_ui, source_products, source_vendors, status, tactic, tactic_id, tags, technique, technique_id, timestamp, type, updated_timestamp].hash
+      [agent_id, aggregate_id, assigned_to_name, assigned_to_uid, assigned_to_uuid, cid, composite_id, confidence, crawled_timestamp, created_timestamp, data_domains, description, display_name, email_sent, external, id, linked_case_ids, mitre_attack, name, objective, pattern_id, platform, product, resolution, scenario, seconds_to_resolved, seconds_to_triaged, severity, severity_name, show_in_ui, source_products, source_vendors, status, tactic, tactic_id, tags, technique, technique_id, timestamp, type, updated_timestamp].hash
     end
 
     # Builds the object from hash

data/lib/crimson-falcon/models/detects_mitre_attack_mapping.rb

@@ -0,0 +1,275 @@
+=begin
+Crimson Falcon - Ruby Client SDK
+
+Code auto-generated by OpenAPI Generator; DO NOT EDIT.
+
+MIT License
+
+Copyright (c) 2023 Crowdstrike
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+=end
+
+require 'date'
+require 'time'
+
+module Falcon
+  class DetectsMitreAttackMapping
+    # Pattern ID for the pattern seen in the Alert
+    attr_accessor :pattern_id
+
+    # Tactic and Technique are references to MITRE ATT&CK, which is a public framework for tracking and modeling adversary tools techniques and procedures
+    attr_accessor :tactic
+
+    # Unique ID for the tactic seen in the Alert
+    attr_accessor :tactic_id
+
+    # Tactic and Technique are references to MITRE ATT&CK, which is a public framework for tracking and modeling adversary tools techniques and procedures
+    attr_accessor :technique
+
+    # Unique ID for the technique seen in the Alert
+    attr_accessor :technique_id
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    def self.attribute_map
+      {
+        :'pattern_id' => :'pattern_id',
+        :'tactic' => :'tactic',
+        :'tactic_id' => :'tactic_id',
+        :'technique' => :'technique',
+        :'technique_id' => :'technique_id'
+      }
+    end
+
+    # Returns all the JSON keys this model knows about
+    def self.acceptable_attributes
+      attribute_map.values
+    end
+
+    # Attribute type mapping.
+    def self.openapi_types
+      {
+        :'pattern_id' => :'Integer',
+        :'tactic' => :'String',
+        :'tactic_id' => :'String',
+        :'technique' => :'String',
+        :'technique_id' => :'String'
+      }
+    end
+
+    # List of attributes with nullable: true
+    def self.openapi_nullable
+      Set.new([
+      ])
+    end
+
+    # Initializes the object
+    # @param [Hash] attributes Model attributes in the form of hash
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `Falcon::DetectsMitreAttackMapping` initialize method"
+      end
+
+      # check to see if the attribute exists and convert string to symbol for hash key
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!self.class.attribute_map.key?(k.to_sym))
+          fail ArgumentError, "`#{k}` is not a valid attribute in `Falcon::DetectsMitreAttackMapping`. Please check the name to make sure it's valid. List of attributes: " + self.class.attribute_map.keys.inspect
+        end
+        h[k.to_sym] = v
+      }
+
+      if attributes.key?(:'pattern_id')
+        self.pattern_id = attributes[:'pattern_id']
+      end
+
+      if attributes.key?(:'tactic')
+        self.tactic = attributes[:'tactic']
+      end
+
+      if attributes.key?(:'tactic_id')
+        self.tactic_id = attributes[:'tactic_id']
+      end
+
+      if attributes.key?(:'technique')
+        self.technique = attributes[:'technique']
+      end
+
+      if attributes.key?(:'technique_id')
+        self.technique_id = attributes[:'technique_id']
+      end
+    end
+
+    # Show invalid properties with the reasons. Usually used together with valid?
+    # @return Array for valid properties with the reasons
+    def list_invalid_properties
+      invalid_properties = Array.new
+      invalid_properties
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    def valid?
+      true
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param [Object] Object to be compared
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          pattern_id == o.pattern_id &&
+          tactic == o.tactic &&
+          tactic_id == o.tactic_id &&
+          technique == o.technique &&
+          technique_id == o.technique_id
+    end
+
+    # @see the `==` method
+    # @param [Object] Object to be compared
+    def eql?(o)
+      self == o
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    def hash
+      [pattern_id, tactic, tactic_id, technique, technique_id].hash
+    end
+
+    # Builds the object from hash
+    # @param [Hash] attributes Model attributes in the form of hash
+    # @return [Object] Returns the model itself
+    def self.build_from_hash(attributes)
+      new.build_from_hash(attributes)
+    end
+
+    # Builds the object from hash
+    # @param [Hash] attributes Model attributes in the form of hash
+    # @return [Object] Returns the model itself
+    def build_from_hash(attributes)
+      return nil unless attributes.is_a?(Hash)
+      attributes = attributes.transform_keys(&:to_sym)
+      self.class.openapi_types.each_pair do |key, type|
+        if attributes[self.class.attribute_map[key]].nil? && self.class.openapi_nullable.include?(key)
+          self.send("#{key}=", nil)
+        elsif type =~ /\AArray<(.*)>/i
+          # check to ensure the input is an array given that the attribute
+          # is documented as an array but the input is not
+          if attributes[self.class.attribute_map[key]].is_a?(Array)
+            self.send("#{key}=", attributes[self.class.attribute_map[key]].map { |v| _deserialize($1, v) })
+          end
+        elsif !attributes[self.class.attribute_map[key]].nil?
+          self.send("#{key}=", _deserialize(type, attributes[self.class.attribute_map[key]]))
+        end
+      end
+
+      self
+    end
+
+    # Deserializes the data based on type
+    # @param string type Data type
+    # @param string value Value to be deserialized
+    # @return [Object] Deserialized data
+    def _deserialize(type, value)
+      case type.to_sym
+      when :Time
+        Time.parse(value)
+      when :Date
+        Date.parse(value)
+      when :String
+        value.to_s
+      when :Integer
+        value.to_i
+      when :Float
+        value.to_f
+      when :Boolean
+        if value.to_s =~ /\A(true|t|yes|y|1)\z/i
+          true
+        else
+          false
+        end
+      when :Object
+        # generic object (usually a Hash), return directly
+        value
+      when /\AArray<(?<inner_type>.+)>\z/
+        inner_type = Regexp.last_match[:inner_type]
+        value.map { |v| _deserialize(inner_type, v) }
+      when /\AHash<(?<k_type>.+?), (?<v_type>.+)>\z/
+        k_type = Regexp.last_match[:k_type]
+        v_type = Regexp.last_match[:v_type]
+        {}.tap do |hash|
+          value.each do |k, v|
+            hash[_deserialize(k_type, k)] = _deserialize(v_type, v)
+          end
+        end
+      else # model
+        # models (e.g. Pet) or oneOf
+        klass = Falcon.const_get(type)
+        klass.respond_to?(:openapi_one_of) ? klass.build(value) : klass.build_from_hash(value)
+      end
+    end
+
+    # Returns the string representation of the object
+    # @return [String] String presentation of the object
+    def to_s
+      to_hash.to_s
+    end
+
+    # to_body is an alias to to_hash (backward compatibility)
+    # @return [Hash] Returns the object in the form of hash
+    def to_body
+      to_hash
+    end
+
+    # Returns the object in the form of hash
+    # @return [Hash] Returns the object in the form of hash
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      hash
+    end
+
+    # Outputs non-array value in the form of hash
+    # For object, use to_hash. Otherwise, just return the value
+    # @param [Object] value Any valid value
+    # @return [Hash] Returns the value in the form of hash
+    def _to_hash(value)
+      if value.is_a?(Array)
+        value.compact.map { |v| _to_hash(v) }
+      elsif value.is_a?(Hash)
+        {}.tap do |hash|
+          value.each { |k, v| hash[k] = _to_hash(v) }
+        end
+      elsif value.respond_to? :to_hash
+        value.to_hash
+      else
+        value
+      end
+    end
+  end
+end