crowdstrike-falconpy-dev 1.4.0__tar.gz → 1.4.2__tar.gz

{crowdstrike-falconpy-dev-1.4.0 → crowdstrike-falconpy-dev-1.4.2}/AUTHORS.md

@@ -28,7 +28,6 @@ These coders deserve accolades and laurels as well as cool titles and cartoons.
 
 | Name | Role |
 | :--- | :--- |
-| Šimon L., `@isimluk` | [Sanity Checker](https://xkcd.com/1926/) |
 | Josh Lang, `@jlangdev` | [Lint Purveyor](https://xkcd.com/1833/) |
 | Christopher Hammond, `@ChristopherHammond13` | [Technical Debt Collector](https://xkcd.com/2138/) |
 | Gabe Alford, `@redhatrises` | [Git Whisperer](https://xkcd.com/1597/) |
@@ -37,6 +36,9 @@ These coders deserve accolades and laurels as well as cool titles and cartoons.
 | Shane Shellenbarger, `@soggysec` | [Calamity Validator](https://xkcd.com/1700/) |
 | Steve Klassen, `@mrxinu` | [Dilemma Responder](https://xkcd.com/85/) |
 
+#### Honorable mentions
++ Šimon L., `@isimluk` ([Sanity Checker](https://xkcd.com/1926/))
+
 ## Contributors
 The following members of the community have made requests, suggestions, code contributions or provided feedback and reported bugs.
 This has been a critical element in the development of the FalconPy project.
@@ -90,6 +92,8 @@ This has been a critical element in the development of the FalconPy project.
 + Phil Massyn, `@massyn`
 + Russell Snyder, `@rusnyder`
 + `@PeroSoy`
++ Shubham, `@i-shubham01`
++ Don "Swanson" I., `@Don-Swanson-Adobe`
 
 
 ## Sponsors
@@ -98,11 +102,11 @@ Without the support of these executives, the FalconPy project would not have hap
 | Name | Role |
 | :-- | :-- |
 | Chris Kachigian, `@ckachigian` | Herder of Cats |
-| Rekha Das | Gatekeeper |
 | Robbie Coleman, `@erraggy` | Keymaster |
 | Mike Cryer | Colonel-in-Chief |
 
 #### Honorable mentions
++ Rekha Das
 + Jaime Franklin, `@franklinjff`
 + Shawn Wells, `@shawndwells`
 

{crowdstrike-falconpy-dev-1.4.0/src/crowdstrike_falconpy_dev.egg-info → crowdstrike-falconpy-dev-1.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: crowdstrike-falconpy-dev
-Version: 1.4.0
+Version: 1.4.2
 Summary: The CrowdStrike Falcon SDK for Python 3
 Home-page: https://github.com/CrowdStrike/falconpy
 Author: CrowdStrike
@@ -56,7 +56,7 @@ License-File: AUTHORS.md
 [![Release date](https://img.shields.io/github/release-date/CrowdStrike/falconpy)](https://github.com/CrowdStrike/falconpy/releases)
 [![Repo status](https://img.shields.io/osslifecycle/crowdstrike/falconpy?label=repo%20status)](https://github.com/CrowdStrike/falconpy/graphs/code-frequency)
 [![Commit activity](https://img.shields.io/github/commits-since/CrowdStrike/falconpy/latest)](https://github.com/CrowdStrike/falconpy/commits/main)
-![GitHub forks](https://img.shields.io/github/forks/crowdstrike/falconpy)
+![GitHub forks](https://img.shields.io/github/forks/crowdstrike/falconpy?style=flat)
 
 The FalconPy SDK contains a collection of Python classes that abstract CrowdStrike Falcon OAuth2 API interaction, removing duplicative code and allowing developers to focus on just the logic of their solution requirements.
 
@@ -130,6 +130,7 @@ For each CrowdStrike Falcon API service collection, a matching Service Class is
 
 - Closely follows Python and OpenAPI best practice for code style and syntax. PEP-8 compliant.
 - Completely abstracts token management, automatically refreshing your token when it expires.
+- Interact with newly released API operations not yet available in the library via the `override` method.
 - Provides simple programmatic patterns for interacting with CrowdStrike Falcon APIs.
 - Supports [cloud region autodiscovery](https://www.falconpy.io/Usage/Environment-Configuration.html#cloud-region-autodiscovery) for the CrowdStrike `US-1`, `US-2` and `EU-1` regions.
 - Supports dynamic [configuration](https://www.falconpy.io/Usage/Environment-Configuration.html) based upon the needs of your environment.

{crowdstrike-falconpy-dev-1.4.0 → crowdstrike-falconpy-dev-1.4.2}/README.md

@@ -9,7 +9,7 @@
 [![Release date](https://img.shields.io/github/release-date/CrowdStrike/falconpy)](https://github.com/CrowdStrike/falconpy/releases)
 [![Repo status](https://img.shields.io/osslifecycle/crowdstrike/falconpy?label=repo%20status)](https://github.com/CrowdStrike/falconpy/graphs/code-frequency)
 [![Commit activity](https://img.shields.io/github/commits-since/CrowdStrike/falconpy/latest)](https://github.com/CrowdStrike/falconpy/commits/main)
-![GitHub forks](https://img.shields.io/github/forks/crowdstrike/falconpy)
+![GitHub forks](https://img.shields.io/github/forks/crowdstrike/falconpy?style=flat)
 
 The FalconPy SDK contains a collection of Python classes that abstract CrowdStrike Falcon OAuth2 API interaction, removing duplicative code and allowing developers to focus on just the logic of their solution requirements.
 
@@ -83,6 +83,7 @@ For each CrowdStrike Falcon API service collection, a matching Service Class is
 
 - Closely follows Python and OpenAPI best practice for code style and syntax. PEP-8 compliant.
 - Completely abstracts token management, automatically refreshing your token when it expires.
+- Interact with newly released API operations not yet available in the library via the `override` method.
 - Provides simple programmatic patterns for interacting with CrowdStrike Falcon APIs.
 - Supports [cloud region autodiscovery](https://www.falconpy.io/Usage/Environment-Configuration.html#cloud-region-autodiscovery) for the CrowdStrike `US-1`, `US-2` and `EU-1` regions.
 - Supports dynamic [configuration](https://www.falconpy.io/Usage/Environment-Configuration.html) based upon the needs of your environment.

{crowdstrike-falconpy-dev-1.4.0 → crowdstrike-falconpy-dev-1.4.2/src/crowdstrike_falconpy_dev.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: crowdstrike-falconpy-dev
-Version: 1.4.0
+Version: 1.4.2
 Summary: The CrowdStrike Falcon SDK for Python 3
 Home-page: https://github.com/CrowdStrike/falconpy
 Author: CrowdStrike
@@ -56,7 +56,7 @@ License-File: AUTHORS.md
 [![Release date](https://img.shields.io/github/release-date/CrowdStrike/falconpy)](https://github.com/CrowdStrike/falconpy/releases)
 [![Repo status](https://img.shields.io/osslifecycle/crowdstrike/falconpy?label=repo%20status)](https://github.com/CrowdStrike/falconpy/graphs/code-frequency)
 [![Commit activity](https://img.shields.io/github/commits-since/CrowdStrike/falconpy/latest)](https://github.com/CrowdStrike/falconpy/commits/main)
-![GitHub forks](https://img.shields.io/github/forks/crowdstrike/falconpy)
+![GitHub forks](https://img.shields.io/github/forks/crowdstrike/falconpy?style=flat)
 
 The FalconPy SDK contains a collection of Python classes that abstract CrowdStrike Falcon OAuth2 API interaction, removing duplicative code and allowing developers to focus on just the logic of their solution requirements.
 
@@ -130,6 +130,7 @@ For each CrowdStrike Falcon API service collection, a matching Service Class is
 
 - Closely follows Python and OpenAPI best practice for code style and syntax. PEP-8 compliant.
 - Completely abstracts token management, automatically refreshing your token when it expires.
+- Interact with newly released API operations not yet available in the library via the `override` method.
 - Provides simple programmatic patterns for interacting with CrowdStrike Falcon APIs.
 - Supports [cloud region autodiscovery](https://www.falconpy.io/Usage/Environment-Configuration.html#cloud-region-autodiscovery) for the CrowdStrike `US-1`, `US-2` and `EU-1` regions.
 - Supports dynamic [configuration](https://www.falconpy.io/Usage/Environment-Configuration.html) based upon the needs of your environment.

{crowdstrike-falconpy-dev-1.4.0 → crowdstrike-falconpy-dev-1.4.2}/src/crowdstrike_falconpy_dev.egg-info/SOURCES.txt

@@ -41,6 +41,7 @@ src/falconpydev/foundry_logscale.py
 src/falconpydev/host_group.py
 src/falconpydev/hosts.py
 src/falconpydev/identity_protection.py
+src/falconpydev/image_assessment_policies.py
 src/falconpydev/incidents.py
 src/falconpydev/installation_tokens.py
 src/falconpydev/intel.py
@@ -122,6 +123,7 @@ src/falconpydev/_endpoint/_foundry_logscale.py
 src/falconpydev/_endpoint/_host_group.py
 src/falconpydev/_endpoint/_hosts.py
 src/falconpydev/_endpoint/_identity_protection.py
+src/falconpydev/_endpoint/_image_assessment_policies.py
 src/falconpydev/_endpoint/_incidents.py
 src/falconpydev/_endpoint/_installation_tokens.py
 src/falconpydev/_endpoint/_intel.py
@@ -269,6 +271,7 @@ tests/test_foundry_logscale.py
 tests/test_host_group.py
 tests/test_hosts.py
 tests/test_identity_protection.py
+tests/test_image_assessment_policies.py
 tests/test_incidents.py
 tests/test_installation_tokens.py
 tests/test_intel.py

{crowdstrike-falconpy-dev-1.4.0 → crowdstrike-falconpy-dev-1.4.2}/src/falconpydev/__init__.py

@@ -118,6 +118,7 @@ from .foundry_logscale import FoundryLogScale
 from .host_group import HostGroup
 from .hosts import Hosts
 from .identity_protection import IdentityProtection
+from .image_assessment_policies import ImageAssessmentPolicies
 from .incidents import Incidents
 from .installation_tokens import InstallationTokens
 from .intel import Intel
@@ -193,7 +194,8 @@ __all__ = [
     "RealTimeResponseAudit", "Workflows", "DeprecatedClass", "DeprecatedOperation",
     "SDKDeprecationWarning", "ConfigurationAssessmentEvaluationLogic", "ConfigurationAssessment",
     "ContainerAlerts", "ContainerDetections", "ContainerImages", "ContainerPackages",
-    "ContainerVulnerabilities", "DriftIndicators", "UnidentifiedContainers"
+    "ContainerVulnerabilities", "DriftIndicators", "UnidentifiedContainers",
+    "ImageAssessmentPolicies"
     ]
 """
 This is free and unencumbered software released into the public domain.

{crowdstrike-falconpy-dev-1.4.0 → crowdstrike-falconpy-dev-1.4.2}/src/falconpydev/_auth_object/_falcon_interface.py

@@ -90,7 +90,8 @@ class FalconInterface(BaseFalconAuth):
                  debug: Optional[bool] = False,
                  debug_record_count: Optional[int] = None,
                  sanitize_log: Optional[bool] = None,
-                 pythonic: Optional[bool] = False
+                 pythonic: Optional[bool] = False,
+                 environment: Optional[Dict[str, str]] = None
                  ) -> "FalconInterface":
         """Construct an instance of the FalconInterface class."""
         # Set the pythonic behavior mode.
@@ -149,20 +150,24 @@ class FalconInterface(BaseFalconAuth):
                                      )
 
         # Environment Authentication
+        # User configuration environment keys
+        self._environment = environment if environment else {}
         # When credentials are not provided, attempt to retrieve them from the environment.
         if not self.cred_format_valid and not self.token_value:
             # Both variables must be present within the running environment.
-            if os.getenv("FALCON_CLIENT_ID") and os.getenv("FALCON_CLIENT_SECRET"):
-                api_id = os.getenv("FALCON_CLIENT_ID") if "client_id" not in self.creds else self.creds["client_id"]
-                if "client_secret" not in self.creds:
-                    api_sec = os.getenv("FALCON_CLIENT_SECRET")
-                else:
-                    api_sec = self.creds["client_secret"]
+            if os.getenv(f"{self.env_prefix}{self.env_key}") and os.getenv(f"{self.env_prefix}{self.env_secret}"):
+                api_id = os.getenv(f"{self.env_prefix}{self.env_key}") \
+                    if "client_id" not in self.creds else self.creds["client_id"]
+                api_sec = os.getenv(f"{self.env_prefix}{self.env_secret}") \
+                    if "client_secret" not in self.creds else self.creds["client_secret"]
                 # Environment Authentication will not override values that preexist in the creds dictionary.
                 self._creds = {
                     "client_id": api_id,
                     "client_secret": api_sec
                 }
+                # Provide member_cid for MSSP environment authentication scenarios. Issue #1105.
+                if member_cid:
+                    self._creds["member_cid"] = member_cid
 
         # Log the creation of this object if debugging is enabled.
         # Starting with v1.3.0 minimal Python native logging is available. In order to reduce
@@ -508,3 +513,18 @@ class FalconInterface(BaseFalconAuth):
     def pythonic(self, value: bool):
         """Enable or disable pythonic mode."""
         self._pythonic = value
+
+    @property
+    def env_prefix(self) -> str:
+        """Return the environment prefix."""
+        return self._environment.get("prefix", "FALCON_")
+
+    @property
+    def env_key(self) -> str:
+        """Return the environment API key name."""
+        return self._environment.get("id_name", "CLIENT_ID")
+
+    @property
+    def env_secret(self) -> str:
+        """Return the environment API key secret."""
+        return self._environment.get("secret_name", "CLIENT_SECRET")

{crowdstrike-falconpy-dev-1.4.0 → crowdstrike-falconpy-dev-1.4.2}/src/falconpydev/_auth_object/_uber_interface.py

@@ -77,7 +77,8 @@ class UberInterface(FalconInterface):
                  debug: Optional[bool] = False,
                  debug_record_count: Optional[int] = MAX_DEBUG_RECORDS,
                  sanitize_log: Optional[bool] = None,
-                 pythonic: Optional[bool] = None
+                 pythonic: Optional[bool] = None,
+                 environment: Optional[Dict[str, str]] = None
                  ):
         """Construct an instance of the UberInterface class.
 
@@ -126,7 +127,8 @@ class UberInterface(FalconInterface):
                          debug=debug,
                          debug_record_count=debug_record_count,
                          sanitize_log=sanitize_log,
-                         pythonic=pythonic
+                         pythonic=pythonic,
+                         environment=environment
                          )
 
         # Complete list of available API operations.

{crowdstrike-falconpy-dev-1.4.0 → crowdstrike-falconpy-dev-1.4.2}/src/falconpydev/_endpoint/__init__.py

@@ -68,6 +68,7 @@ from ._foundry_logscale import _foundry_logscale_endpoints
 from ._host_group import _host_group_endpoints
 from ._hosts import _hosts_endpoints
 from ._identity_protection import _identity_protection_endpoints
+from ._image_assessment_policies import _image_assessment_policies_endpoints
 from ._incidents import _incidents_endpoints
 from ._installation_tokens import _installation_tokens_endpoints
 from ._intel import _intel_endpoints
@@ -135,6 +136,7 @@ api_endpoints.extend(_foundry_logscale_endpoints)
 api_endpoints.extend(_host_group_endpoints)
 api_endpoints.extend(_hosts_endpoints)
 api_endpoints.extend(_identity_protection_endpoints)
+api_endpoints.extend(_image_assessment_policies_endpoints)
 api_endpoints.extend(_incidents_endpoints)
 api_endpoints.extend(_installation_tokens_endpoints)
 api_endpoints.extend(_intel_endpoints)

{crowdstrike-falconpy-dev-1.4.0 → crowdstrike-falconpy-dev-1.4.2}/src/falconpydev/_endpoint/_alerts.py

@@ -59,6 +59,13 @@ _alerts_endpoints = [
     "retrieves aggregate values for Alerts across all CIDs",
     "alerts",
     [
+      {
+        "type": "boolean",
+        "default": True,
+        "description": "allows previously hidden alerts to be retrieved",
+        "name": "include_hidden",
+        "in": "query"
+      },
       {
         "description": "request body takes a list of aggregate-alert query requests",
         "name": "body",
@@ -114,6 +121,13 @@ _alerts_endpoints = [
     "retrieves all Alerts given their composite ids",
     "alerts",
     [
+      {
+        "type": "boolean",
+        "default": True,
+        "description": "allows previously hidden alerts to be retrieved",
+        "name": "include_hidden",
+        "in": "query"
+      },
       {
         "name": "body",
         "in": "body",
@@ -125,7 +139,7 @@ _alerts_endpoints = [
     "PatchEntitiesAlertsV2",
     "PATCH",
     "/alerts/entities/alerts/v2",
-    "Perform actions on detections identified by detection ID(s) in request.\nEach action has a name and a "
+    "Perform actions on Alerts identified by composite ID(s) in request.\nEach action has a name and a "
     "description which describes what the action does.\nIf a request adds and removes tag in a single request, the "
     "order of processing would be to remove tags before adding new ones in.\n\n",
     "alerts",
@@ -142,13 +156,21 @@ _alerts_endpoints = [
     "PatchEntitiesAlertsV3",
     "PATCH",
     "/alerts/entities/alerts/v3",
-    "Perform actions on detections identified by detection ID(s) in request.\nEach action has a name and a "
+    "Perform actions on Alerts identified by composite ID(s) in request.\nEach action has a name and a "
     "description which describes what the action does.\nIf a request adds and removes tag in a single request, the "
     "order of processing would be to remove tags before adding new ones in.\n\n",
     "alerts",
     [
       {
-        "description": "request body takes a list of action parameter request that is applied against all \"ids\" provided",
+        "type": "boolean",
+        "default": True,
+        "description": "allows previously hidden alerts to be retrieved",
+        "name": "include_hidden",
+        "in": "query"
+      },
+      {
+        "description": "request body takes a list of action parameter request that is applied against all "
+        "\"composite_ids\" provided",
         "name": "body",
         "in": "body",
         "required": True
@@ -219,6 +241,13 @@ _alerts_endpoints = [
     "retrieves all Alerts ids that match a given query",
     "alerts",
     [
+      {
+        "type": "boolean",
+        "default": True,
+        "description": "allows previously hidden alerts to be retrieved",
+        "name": "include_hidden",
+        "in": "query"
+      },
       {
         "type": "integer",
         "description": "The first detection to return, where `0` is the latest detection. Use with the "

crowdstrike-falconpy-dev-1.4.2/src/falconpydev/_endpoint/_cloud_snapshots.py

@@ -0,0 +1,164 @@
+"""Internal API endpoint constant library.
+
+ _______                        __ _______ __        __ __
+|   _   .----.-----.--.--.--.--|  |   _   |  |_.----|__|  |--.-----.
+|.  1___|   _|  _  |  |  |  |  _  |   1___|   _|   _|  |    <|  -__|
+|.  |___|__| |_____|________|_____|____   |____|__| |__|__|__|_____|
+|:  1   |                         |:  1   |
+|::.. . |   CROWDSTRIKE FALCON    |::.. . |    FalconPy
+`-------'                         `-------'
+
+OAuth2 API - Customer SDK
+
+This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
+
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <https://unlicense.org>
+"""
+
+_cloud_snapshots_endpoints = [
+  [
+    "ReadDeploymentsCombined",
+    "GET",
+    "/snapshots/combined/deployments/v1",
+    "Retrieve snapshot jobs identified by the provided IDs",
+    "cloud_snapshots",
+    [
+      {
+        "type": "string",
+        "description": "Search snapshot jobs using a query in Falcon Query Language (FQL). Supported filters: "
+        "account_id,asset_identifier,cloud_provider,region,status",
+        "name": "filter",
+        "in": "query"
+      },
+      {
+        "type": "integer",
+        "description": "The upper-bound on the number of records to retrieve.",
+        "name": "limit",
+        "in": "query"
+      },
+      {
+        "type": "integer",
+        "description": "The offset from where to begin.",
+        "name": "offset",
+        "in": "query"
+      },
+      {
+        "type": "string",
+        "description": "The fields to sort the records on. Supported columns:  [account_id asset_identifier "
+        "cloud_provider instance_type last_updated_timestamp region status]",
+        "name": "sort",
+        "in": "query"
+      }
+    ]
+  ],
+  [
+    "RegisterCspmSnapshotAccount",
+    "POST",
+    "/snapshots/entities/accounts/v1",
+    "Register customer cloud account for snapshot scanning",
+    "cloud_snapshots",
+    [
+      {
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "ReadDeploymentsEntities",
+    "GET",
+    "/snapshots/entities/deployments/v1",
+    "Retrieve snapshot jobs identified by the provided IDs",
+    "cloud_snapshots",
+    [
+      {
+        "type": "array",
+        "items": {
+          "type": "string"
+        },
+        "collectionFormat": "csv",
+        "description": "Search snapshot jobs by ids - The maximum amount is 100 IDs",
+        "name": "ids",
+        "in": "query"
+      }
+    ]
+  ],
+  [
+    "CreateDeploymentEntity",
+    "POST",
+    "/snapshots/entities/deployments/v1",
+    "Launch a snapshot scan for a given cloud asset",
+    "cloud_snapshots",
+    [
+      {
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "GetCredentialsMixin0",
+    "GET",
+    "/snapshots/entities/image-registry-credentials/v1",
+    "Gets the registry credentials",
+    "cloud_snapshots",
+    []
+  ],
+  [
+    "CreateInventory",
+    "POST",
+    "/snapshots/entities/inventories/v1",
+    "Create inventory from data received from snapshot",
+    "cloud_snapshots",
+    [
+      {
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "GetScanReport",
+    "GET",
+    "/snapshots/entities/scanreports/v1",
+    "retrieve the scan report for an instance",
+    "cloud_snapshots",
+    [
+      {
+        "type": "array",
+        "items": {
+          "type": "string"
+        },
+        "collectionFormat": "csv",
+        "description": "the instance identifiers to fetch the report for",
+        "name": "ids",
+        "in": "query",
+        "required": True
+      }
+    ]
+  ]
+]

{crowdstrike-falconpy-dev-1.4.0 → crowdstrike-falconpy-dev-1.4.2}/src/falconpydev/_endpoint/_container_alerts.py

@@ -37,6 +37,22 @@ For more information, please refer to <https://unlicense.org>
 """
 
 _container_alerts_endpoints = [
+  [
+    "ReadContainerAlertsCountBySeverity",
+    "GET",
+    "/container-security/aggregates/container-alerts/count-by-severity/v1",
+    "Get Container Alerts counts by severity",
+    "container_alerts",
+    [
+      {
+        "type": "string",
+        "description": "Search Container Alerts using a query in Falcon Query Language (FQL). Supported "
+        "filters: cid,container_id,last_seen",
+        "name": "filter",
+        "in": "query"
+      }
+    ]
+  ],
   [
     "ReadContainerAlertsCount",
     "GET",
@@ -47,7 +63,7 @@ _container_alerts_endpoints = [
       {
         "type": "string",
         "description": "Search Container Alerts using a query in Falcon Query Language (FQL). Supported "
-        "filters:  cid,last_seen",
+        "filters:  cid,container_id,last_seen",
         "name": "filter",
         "in": "query"
       }

{crowdstrike-falconpy-dev-1.4.0 → crowdstrike-falconpy-dev-1.4.2}/src/falconpydev/_endpoint/_container_detections.py

@@ -120,6 +120,42 @@ _container_detections_endpoints = [
       }
     ]
   ],
+  [
+    "GetRuntimeDetectionsCombinedV2",
+    "GET",
+    "/container-security/combined/runtime-detections/v2",
+    "Retrieve container runtime detections by the provided search criteria",
+    "container_detections",
+    [
+      {
+        "type": "string",
+        "description": "Filter Container Runtime Detections using a query in Falcon Query Language (FQL). "
+        "Supported filters:  action_taken,aid,cid,cloud,cluster_name,command_line,computer_name,container_id,detect_tim"
+        "estamp,detection_description,detection_id,file_name,file_path,host_id,host_type,image_id,name,namespace,pod_na"
+        "me,severity,tactic",
+        "name": "filter",
+        "in": "query"
+      },
+      {
+        "type": "integer",
+        "description": "The upper-bound on the number of records to retrieve.",
+        "name": "limit",
+        "in": "query"
+      },
+      {
+        "type": "integer",
+        "description": "The offset from where to begin.",
+        "name": "offset",
+        "in": "query"
+      },
+      {
+        "type": "string",
+        "description": "The field to sort the records on.",
+        "name": "sort",
+        "in": "query"
+      }
+    ]
+  ],
   [
     "ReadDetections",
     "GET",

{crowdstrike-falconpy-dev-1.4.0 → crowdstrike-falconpy-dev-1.4.2}/src/falconpydev/_endpoint/_container_images.py

@@ -250,8 +250,9 @@ _container_images_endpoints = [
       {
         "type": "string",
         "description": "The fields to sort the records on. Supported columns:  [base_os cid containers "
-        "detections firstScanned first_seen highest_detection_severity highest_vulnerability_severity image_digest "
-        "image_id last_seen layers_with_vulnerabilities packages registry repository tag vulnerabilities]",
+        "detections firstScanned first_seen highest_cps_current_rating highest_detection_severity "
+        "highest_vulnerability_severity image_digest image_id last_seen layers_with_vulnerabilities packages registry "
+        "repository tag vulnerabilities]",
         "name": "sort",
         "in": "query"
       }