crowdstrike-falconpy-dev 1.4.3__tar.gz → 1.4.4__tar.gz

{crowdstrike-falconpy-dev-1.4.3/src/crowdstrike_falconpy_dev.egg-info → crowdstrike-falconpy-dev-1.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: crowdstrike-falconpy-dev
-Version: 1.4.3
+Version: 1.4.4
 Summary: The CrowdStrike Falcon SDK for Python 3
 Home-page: https://github.com/CrowdStrike/falconpy
 Author: CrowdStrike

{crowdstrike-falconpy-dev-1.4.3 → crowdstrike-falconpy-dev-1.4.4/src/crowdstrike_falconpy_dev.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: crowdstrike-falconpy-dev
-Version: 1.4.3
+Version: 1.4.4
 Summary: The CrowdStrike Falcon SDK for Python 3
 Home-page: https://github.com/CrowdStrike/falconpy
 Author: CrowdStrike

{crowdstrike-falconpy-dev-1.4.3 → crowdstrike-falconpy-dev-1.4.4}/src/crowdstrike_falconpy_dev.egg-info/SOURCES.txt

@@ -11,6 +11,7 @@ src/crowdstrike_falconpy_dev.egg-info/top_level.txt
 src/falconpydev/__init__.py
 src/falconpydev/_version.py
 src/falconpydev/alerts.py
+src/falconpydev/api_integrations.py
 src/falconpydev/cloud_connect_aws.py
 src/falconpydev/cloud_snapshots.py
 src/falconpydev/configuration_assessment.py
@@ -30,6 +31,7 @@ src/falconpydev/device_control_policies.py
 src/falconpydev/discover.py
 src/falconpydev/drift_indicators.py
 src/falconpydev/event_streams.py
+src/falconpydev/exposure_management.py
 src/falconpydev/falcon_complete_dashboard.py
 src/falconpydev/falcon_container.py
 src/falconpydev/falconx_sandbox.py
@@ -74,6 +76,7 @@ src/falconpydev/sensor_visibility_exclusions.py
 src/falconpydev/spotlight_evaluation_logic.py
 src/falconpydev/spotlight_vulnerabilities.py
 src/falconpydev/tailored_intelligence.py
+src/falconpydev/threatgraph.py
 src/falconpydev/unidentified_containers.py
 src/falconpydev/user_management.py
 src/falconpydev/workflows.py
@@ -94,6 +97,7 @@ src/falconpydev/_auth_object/_uber_interface.py
 src/falconpydev/_constant/__init__.py
 src/falconpydev/_endpoint/__init__.py
 src/falconpydev/_endpoint/_alerts.py
+src/falconpydev/_endpoint/_api_integrations.py
 src/falconpydev/_endpoint/_cloud_connect_aws.py
 src/falconpydev/_endpoint/_cloud_snapshots.py
 src/falconpydev/_endpoint/_configuration_assessment.py
@@ -112,6 +116,7 @@ src/falconpydev/_endpoint/_device_control_policies.py
 src/falconpydev/_endpoint/_discover.py
 src/falconpydev/_endpoint/_drift_indicators.py
 src/falconpydev/_endpoint/_event_streams.py
+src/falconpydev/_endpoint/_exposure_management.py
 src/falconpydev/_endpoint/_falcon_complete_dashboard.py
 src/falconpydev/_endpoint/_falcon_container.py
 src/falconpydev/_endpoint/_falconx_sandbox.py
@@ -156,6 +161,7 @@ src/falconpydev/_endpoint/_sensor_visibility_exclusions.py
 src/falconpydev/_endpoint/_spotlight_evaluation_logic.py
 src/falconpydev/_endpoint/_spotlight_vulnerabilities.py
 src/falconpydev/_endpoint/_tailored_intelligence.py
+src/falconpydev/_endpoint/_threatgraph.py
 src/falconpydev/_endpoint/_unidentified_containers.py
 src/falconpydev/_endpoint/_user_management.py
 src/falconpydev/_endpoint/_workflows.py
@@ -164,6 +170,7 @@ src/falconpydev/_endpoint/deprecated/__init__.py
 src/falconpydev/_endpoint/deprecated/_custom_ioa.py
 src/falconpydev/_endpoint/deprecated/_d4c_registration.py
 src/falconpydev/_endpoint/deprecated/_discover.py
+src/falconpydev/_endpoint/deprecated/_exposure_management.py
 src/falconpydev/_endpoint/deprecated/_fdr.py
 src/falconpydev/_endpoint/deprecated/_firewall_management.py
 src/falconpydev/_endpoint/deprecated/_hosts.py
@@ -189,6 +196,7 @@ src/falconpydev/_log/__init__.py
 src/falconpydev/_log/_facility.py
 src/falconpydev/_payload/__init__.py
 src/falconpydev/_payload/_alerts.py
+src/falconpydev/_payload/_api_integrations.py
 src/falconpydev/_payload/_cloud_connect_aws.py
 src/falconpydev/_payload/_cloud_snapshots.py
 src/falconpydev/_payload/_container.py
@@ -196,6 +204,7 @@ src/falconpydev/_payload/_cspm_registration.py
 src/falconpydev/_payload/_d4c_registration.py
 src/falconpydev/_payload/_detects.py
 src/falconpydev/_payload/_device_control_policy.py
+src/falconpydev/_payload/_exposure_management.py
 src/falconpydev/_payload/_falconx.py
 src/falconpydev/_payload/_filevantage.py
 src/falconpydev/_payload/_firewall.py
@@ -207,6 +216,7 @@ src/falconpydev/_payload/_ioa.py
 src/falconpydev/_payload/_ioc.py
 src/falconpydev/_payload/_malquery.py
 src/falconpydev/_payload/_message_center.py
+src/falconpydev/_payload/_mobile_enrollment.py
 src/falconpydev/_payload/_mssp.py
 src/falconpydev/_payload/_ods.py
 src/falconpydev/_payload/_prevention_policy.py
@@ -239,6 +249,7 @@ src/falconpydev/api_complete/__init__.py
 src/falconpydev/api_complete/_advanced.py
 src/falconpydev/api_complete/_legacy.py
 tests/test_alerts.py
+tests/test_api_integrations.py
 tests/test_api_request.py
 tests/test_authentications.py
 tests/test_authorization.py
@@ -260,6 +271,7 @@ tests/test_device_control_policies.py
 tests/test_discover.py
 tests/test_drift_indicators.py
 tests/test_event_streams.py
+tests/test_exposure_management.py
 tests/test_falcon_complete_dashboard.py
 tests/test_falcon_container.py
 tests/test_falconx_sandbox.py
@@ -305,6 +317,7 @@ tests/test_service_class.py
 tests/test_spotlight_evaluation_logic.py
 tests/test_spotlight_vulnerabilities.py
 tests/test_tailored_intelligence.py
+tests/test_threatgraph.py
 tests/test_timeout.py
 tests/test_uber.py
 tests/test_uber_api_complete.py

{crowdstrike-falconpy-dev-1.4.3 → crowdstrike-falconpy-dev-1.4.4}/src/falconpydev/__init__.py

@@ -88,6 +88,7 @@ from ._api_request import (
     RequestValidator
     )
 from .alerts import Alerts
+from .api_integrations import APIIntegrations
 from .api_complete import APIHarness, APIHarnessV2
 from .cloud_snapshots import CloudSnapshots
 from .configuration_assessment_evaluation_logic import ConfigurationAssessmentEvaluationLogic
@@ -107,6 +108,7 @@ from .device_control_policies import DeviceControlPolicies
 from .discover import Discover
 from .drift_indicators import DriftIndicators
 from .event_streams import EventStreams
+from .exposure_management import ExposureManagement
 from .falcon_complete_dashboard import CompleteDashboard
 from .falcon_container import FalconContainer
 from .falconx_sandbox import FalconXSandbox
@@ -151,6 +153,7 @@ from .sensor_visibility_exclusions import SensorVisibilityExclusions
 from .spotlight_vulnerabilities import SpotlightVulnerabilities
 from .spotlight_evaluation_logic import SpotlightEvaluationLogic
 from .tailored_intelligence import TailoredIntelligence
+from .threatgraph import ThreatGraph
 from .unidentified_containers import UnidentifiedContainers
 from .user_management import UserManagement
 from .workflows import Workflows
@@ -195,7 +198,7 @@ __all__ = [
     "SDKDeprecationWarning", "ConfigurationAssessmentEvaluationLogic", "ConfigurationAssessment",
     "ContainerAlerts", "ContainerDetections", "ContainerImages", "ContainerPackages",
     "ContainerVulnerabilities", "DriftIndicators", "UnidentifiedContainers",
-    "ImageAssessmentPolicies"
+    "ImageAssessmentPolicies", "APIIntegrations", "ThreatGraph", "ExposureManagement"
     ]
 """
 This is free and unencumbered software released into the public domain.

{crowdstrike-falconpy-dev-1.4.3 → crowdstrike-falconpy-dev-1.4.4}/src/falconpydev/_constant/__init__.py

@@ -46,7 +46,7 @@ PREFER_IDS_IN_BODY: List[str] = [
     "GetDeviceDetails", "PostDeviceDetailsV2", "GetVulnerabilities", "GetIntelIndicatorEntities",
     "getChildrenV2", "cancel-scans", "GetDetectSummaries", "UpdateQuarantinedDetectsByIds",
     "GetQuarantineFiles", "PostEntitiesAlertsV1", "CreateSavedSearchesDeployV1",
-    "WorkflowExecutionsAction"
+    "WorkflowExecutionsAction", "signalChangesExternal"
 ]
 MOCK_OPERATIONS: List[str] = [
     "GetImageAssessmentReport", "DeleteImageDetails", "ImageMatchesPolicy"

{crowdstrike-falconpy-dev-1.4.3 → crowdstrike-falconpy-dev-1.4.4}/src/falconpydev/_endpoint/__init__.py

@@ -40,6 +40,7 @@ from .deprecated import _deprecated_operation_mapping
 from .deprecated import _deprecated_class_mapping
 
 from ._alerts import _alerts_endpoints
+from ._api_integrations import _api_integrations_endpoints
 from ._cloud_connect_aws import _cloud_connect_aws_endpoints
 from ._cloud_snapshots import _cloud_snapshots_endpoints
 from ._configuration_assessment_evaluation_logic import _configuration_assessment_evaluation_logic_endpoints
@@ -58,6 +59,7 @@ from ._device_control_policies import _device_control_policies_endpoints
 from ._discover import _discover_endpoints
 from ._drift_indicators import _drift_indicators_endpoints
 from ._event_streams import _event_streams_endpoints
+from ._exposure_management import _exposure_management_endpoints
 from ._falcon_complete_dashboard import _falcon_complete_dashboard_endpoints
 from ._falcon_container import _falcon_container_endpoints
 from ._falconx_sandbox import _falconx_sandbox_endpoints
@@ -101,6 +103,7 @@ from ._sensor_visibility_exclusions import _sensor_visibility_exclusions_endpoin
 from ._spotlight_evaluation_logic import _spotlight_evaluation_logic_endpoints
 from ._spotlight_vulnerabilities import _spotlight_vulnerabilities_endpoints
 from ._tailored_intelligence import _tailored_intelligence_endpoints
+from ._threatgraph import _threatgraph_endpoints
 from ._unidentified_containers import _unidentified_containers_endpoints
 from ._user_management import _user_management_endpoints
 from ._workflows import _workflows_endpoints
@@ -108,6 +111,7 @@ from ._zero_trust_assessment import _zero_trust_assessment_endpoints
 
 api_endpoints: List[Any] = []
 api_endpoints.extend(_alerts_endpoints)
+api_endpoints.extend(_api_integrations_endpoints)
 api_endpoints.extend(_cloud_connect_aws_endpoints)
 api_endpoints.extend(_cloud_snapshots_endpoints)
 api_endpoints.extend(_configuration_assessment_evaluation_logic_endpoints)
@@ -126,6 +130,7 @@ api_endpoints.extend(_device_control_policies_endpoints)
 api_endpoints.extend(_discover_endpoints)
 api_endpoints.extend(_drift_indicators_endpoints)
 api_endpoints.extend(_event_streams_endpoints)
+api_endpoints.extend(_exposure_management_endpoints)
 api_endpoints.extend(_falcon_complete_dashboard_endpoints)
 api_endpoints.extend(_falcon_container_endpoints)
 api_endpoints.extend(_falconx_sandbox_endpoints)
@@ -169,6 +174,7 @@ api_endpoints.extend(_sensor_visibility_exclusions_endpoints)
 api_endpoints.extend(_spotlight_evaluation_logic_endpoints)
 api_endpoints.extend(_spotlight_vulnerabilities_endpoints)
 api_endpoints.extend(_tailored_intelligence_endpoints)
+api_endpoints.extend(_threatgraph_endpoints)
 api_endpoints.extend(_unidentified_containers_endpoints)
 api_endpoints.extend(_user_management_endpoints)
 api_endpoints.extend(_workflows_endpoints)

crowdstrike-falconpy-dev-1.4.4/src/falconpydev/_endpoint/_api_integrations.py

@@ -0,0 +1,90 @@
+"""Internal API endpoint constant library.
+
+ _______                        __ _______ __        __ __
+|   _   .----.-----.--.--.--.--|  |   _   |  |_.----|__|  |--.-----.
+|.  1___|   _|  _  |  |  |  |  _  |   1___|   _|   _|  |    <|  -__|
+|.  |___|__| |_____|________|_____|____   |____|__| |__|__|__|_____|
+|:  1   |                         |:  1   |
+|::.. . |   CROWDSTRIKE FALCON    |::.. . |    FalconPy
+`-------'                         `-------'
+
+OAuth2 API - Customer SDK
+
+This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
+
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <https://unlicense.org>
+"""
+
+_api_integrations_endpoints = [
+  [
+    "GetCombinedPluginConfigs",
+    "GET",
+    "/plugins/combined/configs/v1",
+    "Queries for config resources and returns details",
+    "api_integrations",
+    [
+      {
+        "type": "string",
+        "description": "Filter items using a query in Falcon Query Language (FQL).",
+        "name": "filter",
+        "in": "query"
+      },
+      {
+        "type": "integer",
+        "default": 100,
+        "description": "The number of items to return in this response (default: 100, max: 500). Use with the "
+        "offset parameter to manage pagination of results.",
+        "name": "limit",
+        "in": "query"
+      },
+      {
+        "type": "integer",
+        "description": "The first item to return, where 0 is the latest item. Use with the limit parameter to "
+        "manage pagination of results.",
+        "name": "offset",
+        "in": "query"
+      },
+      {
+        "type": "string",
+        "description": "Sort items using their properties.",
+        "name": "sort",
+        "in": "query"
+      }
+    ]
+  ],
+  [
+    "ExecuteCommand",
+    "POST",
+    "/plugins/entities/execute/v1",
+    "Execute a command.",
+    "api_integrations",
+    [
+      {
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ]
+]

{crowdstrike-falconpy-dev-1.4.3 → crowdstrike-falconpy-dev-1.4.4}/src/falconpydev/_endpoint/_cspm_registration.py

@@ -251,6 +251,74 @@ _cspm_registration_endpoints = [
         "description": "AWS account IDs",
         "name": "ids",
         "in": "query"
+      },
+      {
+        "enum": [
+          "aws-bash",
+          "aws-terraform"
+        ],
+        "type": "string",
+        "description": "Template to be rendered",
+        "name": "template",
+        "in": "query"
+      },
+      {
+        "type": "array",
+        "items": {
+          "type": "string"
+        },
+        "collectionFormat": "multi",
+        "description": "The list of accounts to register",
+        "name": "accounts",
+        "in": "query"
+      },
+      {
+        "enum": [
+          "true",
+          "false"
+        ],
+        "type": "string",
+        "name": "behavior_assessment_enabled",
+        "in": "query"
+      },
+      {
+        "enum": [
+          "true",
+          "false"
+        ],
+        "type": "string",
+        "name": "sensor_management_enabled",
+        "in": "query"
+      },
+      {
+        "enum": [
+          "true",
+          "false"
+        ],
+        "type": "string",
+        "name": "use_existing_cloudtrail",
+        "in": "query"
+      },
+      {
+        "pattern": ".*",
+        "type": "string",
+        "description": "The AWS organization ID to be registered",
+        "name": "organization_id",
+        "in": "query"
+      },
+      {
+        "pattern": ".*",
+        "type": "string",
+        "description": "The AWS profile to be used during registration",
+        "name": "aws_profile",
+        "in": "query"
+      },
+      {
+        "pattern": ".*",
+        "type": "string",
+        "description": "The custom IAM role to be used during registration",
+        "name": "custom_role_name",
+        "in": "query"
       }
     ]
   ],

{crowdstrike-falconpy-dev-1.4.3 → crowdstrike-falconpy-dev-1.4.4}/src/falconpydev/_endpoint/_custom_ioa.py

@@ -268,6 +268,23 @@ _custom_ioa_endpoints = [
       }
     ]
   ],
+  [
+    "update_rules_v2",
+    "PATCH",
+    "/ioarules/entities/rules/v2",
+    "Update name, description, enabled or field_values for individual rules within a rule group. The v1 flavor "
+    " of this call requires the caller to specify the complete state for all the rules in the rule group, instead "
+    "the v2 flavor will accept the subset of rules in the rule group and apply the attribute updates to the subset "
+    "of rules in the rule group.Return the updated rules.",
+    "custom_ioa",
+    [
+      {
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ],
   [
     "validate",
     "POST",
@@ -466,10 +483,10 @@ _custom_ioa_endpoints = [
           "rules.ruletype_name"
         ],
         "type": "string",
-        "description": "Possible order by fields: {rules.current_version.description, "
-        "rules.current_version.action_label, rules.current_version.modified_on, rules.created_on, "
-        "rules.current_version.name, rules.created_by, rules.current_version.pattern_severity, "
-        "rules.current_version.modified_by, rules.ruletype_name, rules.enabled}",
+        "description": "Possible order by fields: {rules.current_version.name, "
+        "rules.current_version.description, rules.current_version.pattern_severity, rules.current_version.modified_by, "
+        "rules.current_version.modified_on, rules.ruletype_name, rules.enabled, rules.current_version.action_label, "
+        "rules.created_by, rules.created_on}",
         "name": "sort",
         "in": "query"
       },

{crowdstrike-falconpy-dev-1.4.3 → crowdstrike-falconpy-dev-1.4.4}/src/falconpydev/_endpoint/_d4c_registration.py

@@ -184,6 +184,74 @@ _d4c_registration_endpoints = [
         "description": "AWS account IDs",
         "name": "ids",
         "in": "query"
+      },
+      {
+        "enum": [
+          "aws-bash",
+          "aws-terraform"
+        ],
+        "type": "string",
+        "description": "Template to be rendered",
+        "name": "template",
+        "in": "query"
+      },
+      {
+        "type": "array",
+        "items": {
+          "type": "string"
+        },
+        "collectionFormat": "multi",
+        "description": "The list of accounts to register",
+        "name": "accounts",
+        "in": "query"
+      },
+      {
+        "enum": [
+          "true",
+          "false"
+        ],
+        "type": "string",
+        "name": "behavior_assessment_enabled",
+        "in": "query"
+      },
+      {
+        "enum": [
+          "true",
+          "false"
+        ],
+        "type": "string",
+        "name": "sensor_management_enabled",
+        "in": "query"
+      },
+      {
+        "enum": [
+          "true",
+          "false"
+        ],
+        "type": "string",
+        "name": "use_existing_cloudtrail",
+        "in": "query"
+      },
+      {
+        "pattern": ".*",
+        "type": "string",
+        "description": "The AWS organization ID to be registered",
+        "name": "organization_id",
+        "in": "query"
+      },
+      {
+        "pattern": ".*",
+        "type": "string",
+        "description": "The AWS profile to be used during registration",
+        "name": "aws_profile",
+        "in": "query"
+      },
+      {
+        "pattern": ".*",
+        "type": "string",
+        "description": "The custom IAM role to be used during registration",
+        "name": "custom_role_name",
+        "in": "query"
       }
     ]
   ],

{crowdstrike-falconpy-dev-1.4.3 → crowdstrike-falconpy-dev-1.4.4}/src/falconpydev/_endpoint/_discover.py

@@ -374,11 +374,12 @@ _discover_endpoints = [
         "anaged'</li><li>product_type_desc:'Workstation'</li><li>platform_name:'Windows'</li><li>last_seen_timestamp:>' "
         "now-7d'</li></ul>\n\t\t\tAvailable filter fields that support exact match: device_family, device_class, "
         "device_type, device_mode, business_criticality, line_of_business, virtual_zone, subnet, purdue_level, vlan, "
-        "local_ip_addresses, mac_addresses, physical_connections_count, data_providers\n\t\t\tAvailable filter fields "
-        "that supports wildcard (*): device_family, device_class, device_type, device_mode, business_criticality, "
-        "line_of_business, virtual_zone, subnet, purdue_level, vlan, local_ip_addresses, mac_addresses, "
-        "data_providers\n\t\t\tAvailable filter fields that supports range comparisons (>, <, >=, <=): "
-        "physical_connections_count\n\t\t\tAll filter fields and operations supports negation (!).",
+        "local_ip_addresses, mac_addresses, physical_connections_count, data_providers, local_ips_count, "
+        "network_interfaces.local_ip, classification\n\t\t\tAvailable filter fields that supports wildcard (*): "
+        "device_family, device_class, device_type, device_mode, business_criticality, line_of_business, virtual_zone, "
+        "subnet, purdue_level, vlan, local_ip_addresses, mac_addresses, data_providers\n\t\t\tAvailable filter fields "
+        "that supports range comparisons (>, <, >=, <=): physical_connections_count, local_ips_count\n\t\t\tAll filter "
+        "fields and operations supports negation (!).",
         "name": "filter",
         "in": "query"
       }

{crowdstrike-falconpy-dev-1.4.3 → crowdstrike-falconpy-dev-1.4.4}/src/falconpydev/_endpoint/_drift_indicators.py

@@ -112,25 +112,6 @@ _drift_indicators_endpoints = [
       }
     ]
   ],
-  [
-    "ReadDriftIndicatorEntities",
-    "GET",
-    "/container-security/entities/drift-indicators/v1",
-    "Retrieve Drift Indicator entities identified by the provided IDs",
-    "drift_indicators",
-    [
-      {
-        "type": "array",
-        "items": {
-          "type": "string"
-        },
-        "collectionFormat": "csv",
-        "description": "Search Drift Indicators by ids - The maximum amount is 100 IDs",
-        "name": "ids",
-        "in": "query"
-      }
-    ]
-  ],
   [
     "SearchDriftIndicators",
     "GET",