crowdstrike-falconpy-dev 1.4.6__tar.gz → 1.4.7__tar.gz

{crowdstrike_falconpy_dev-1.4.6 → crowdstrike_falconpy_dev-1.4.7}/AUTHORS.md

@@ -1,4 +1,5 @@
-![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
+![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png#gh-light-mode-only)
+![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo-red.png#gh-dark-mode-only)
 
 [![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
@@ -101,6 +102,9 @@ This has been a critical element in the development of the FalconPy project.
 + Alexander Moomaw, `@alhumaw`
 + Esha Kumar, `@exk200006`
 + Griffin Ansel, `@gansel51`
++ `@am-cs-se`
++ Jesko, `@jhhcs`
++ Evan Stoner, `@evanstoner`
 
 
 ## Sponsors

{crowdstrike_falconpy_dev-1.4.6 → crowdstrike_falconpy_dev-1.4.7}/CHANGELOG.md

@@ -1,3 +1,69 @@
+# Version 1.4.7
+## Added features and functionality
++ Added: Added new __Intelligence Feeds__ service collection with 3 operations.
+    - _DownloadFeedArchive_
+    - _ListFeedTypes_
+    - _QueryFeedArchives_
+    - `_endpoint/__init__.py`
+    - `_endpoint/_intelligence_feeds.py`
+    - `__init__.py`
+    - `intelligence_feeds.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_intelligence_feeds.py`
+
++ Added: Added new __NGSIEM__ service collection with 9 operations.
+    - _UploadLookupV1_
+    - _GetLookupV1_
+    - _GetLookupFromPackageWithNamespaceV1_
+    - _GetLookupFromPackageV1_
+    - _StartSearchV1_
+    - _GetSearchStatusV1_
+    - _StopSearchV1_
+    - _CreateFileV1_
+    - _UpdateFileV1_
+    - `_endpoint/__init__.py`
+    - `_endpoint/_ngsiem.py`
+    - `_util/_functions.py`
+    - `__init__.py`
+    - `ngsiem.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_ngsiem.py`
+
++ Added: Added new __Correlation Rules__ service collection with 6 operations.
+    - _combined_rules_get_v1_
+    - _entities_rules_get_v1_
+    - _entities_rules_post_v1_
+    - _entities_rules_delete_v1_
+    - _entities_rules_patch_v1_
+    - _queries_rules_get_v1_
+    - `_endpoint/__init__.py`
+    - `_endpoint/_correlation_rules.py`
+    - `_endpoint/deprecated/__init__.py`
+    - `_endpoint/deprecated/_correlation_rules.py`
+    - `_payload/__init__.py`
+    - `_payload/_correlation_rules.py`
+    - `__init__.py`
+    - `correlation_rules.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_correlation_rules.py`
+
+## Issues resolved
++ Resolved: `timezone` argument is not available for the _createScheduledExclusions_ operation within the __FileVantage__ Service Class. Closes #1231.
+    - `_payload/_filevantage.py`
+    - `filevantage.py`
+    - Thanks go out to @security-roberts for identifying and reporting this issue! 🙇
+
++ Resolved: Fixed payload handler issue when providing certificate keys via keywords as opposed to providing the `certificate` keyword when using the _cb_exclusions_create_v1_ operation within the __CertificateBasedExclusions__ service class.
+    - `_payload/_certificate_based_exclusions.py`
+
++ Resolved: Added error handling for when invalid API responses are received from the GraphQL operation within the __Identity Protection__ service collection.
+    - `_util/_functions.py`
+
++ Resolved: Fixed invalid default body payload for _createMLExclusionsV1_ operation in __MLExclusions__ Service Class.
+    - `ml_exclusions.py`
+
+---
+
 # Version 1.4.6
 ## Added features and functionality
 + Added: Added _ExecuteCommandProxy_ operation to the __API Integrations__ service collection.

{crowdstrike_falconpy_dev-1.4.6 → crowdstrike_falconpy_dev-1.4.7}/CODE_OF_CONDUCT.md

@@ -1,4 +1,5 @@
-![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
+![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png#gh-light-mode-only)
+![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo-red.png#gh-dark-mode-only)
 
 [![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 

{crowdstrike_falconpy_dev-1.4.6 → crowdstrike_falconpy_dev-1.4.7}/CONTRIBUTING.md

@@ -1,4 +1,5 @@
-![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
+![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png#gh-light-mode-only)
+![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo-red.png#gh-dark-mode-only)
 
 [![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 

{crowdstrike_falconpy_dev-1.4.6 → crowdstrike_falconpy_dev-1.4.7}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.3
+Metadata-Version: 2.4
 Name: crowdstrike-falconpy-dev
-Version: 1.4.6
+Version: 1.4.7
 Summary: The CrowdStrike Falcon SDK for Python
 Project-URL: Documentation, https://www.falconpy.io
 Project-URL: Homepage, https://github.com/CrowdStrike/falconpy
@@ -72,7 +72,8 @@ Requires-Dist: pytest; extra == 'dev'
 Requires-Dist: pytest-cov; extra == 'dev'
 Description-Content-Type: text/markdown
 
-![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
+![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png#gh-light-mode-only)
+![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo-red.png#gh-dark-mode-only)
 
 [![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)<br/>
 
@@ -109,7 +110,7 @@ The CrowdStrike Falcon SDK for Python completely abstracts token management, whi
 [![Development Installs](https://static.pepy.tech/personalized-badge/crowdstrike-falconpy-dev?left_text=development%20package%20installs/month&left_color=grey&right_color=blue&period=month)](https://pepy.tech/project/crowdstrike-falconpy-dev)
 
 #### Supported versions of Python
-The CrowdStrike Falcon SDK for Python was developed for Python 3. Current versions of FalconPy provide support for Python versions `3.7` - `3.12`. Every commit to the FalconPy code base is unit tested for functionality using all versions of Python the library currently supports.
+The CrowdStrike Falcon SDK for Python was developed for Python 3. Current versions of FalconPy provide support for Python versions `3.7` - `3.13`. Every commit to the FalconPy code base is unit tested for functionality using all versions of Python the library currently supports.
 
 > [!NOTE]
 > Developers working with Python version `3.6` will need to leverage versions of FalconPy less than `1.4.0`.
@@ -213,13 +214,17 @@ from falconpydev import Hosts
 # CrowdStrike does not recommend you hardcode credentials within source code.
 # Instead, provide these values as variables that are retrieved from the environment,
 # read from an encrypted file or secrets store, provided at runtime, etc.
-# This example retrieves credentials from the environment as the variables
-# "FALCON_CLIENT_ID" and "FALCON_CLIENT_SECRET".
 
 hosts = Hosts(client_id=os.getenv("FALCON_CLIENT_ID"),
               client_secret=os.getenv("FALCON_CLIENT_SECRET")
               )
 
+# While this example retrieves credentials from the environment as the variables
+# "FALCON_CLIENT_ID" and "FALCON_CLIENT_SECRET". Developers leveraging environment
+# authentication do not need to specify the client_id or client_secret keywords.
+#
+# hosts = Hosts()
+
 SEARCH_FILTER = "hostname-search-string"
 
 # Retrieve a list of hosts that have a hostname that matches our search filter

{crowdstrike_falconpy_dev-1.4.6 → crowdstrike_falconpy_dev-1.4.7}/README.md

@@ -1,4 +1,5 @@
-![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
+![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png#gh-light-mode-only)
+![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo-red.png#gh-dark-mode-only)
 
 [![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)<br/>
 
@@ -35,7 +36,7 @@ The CrowdStrike Falcon SDK for Python completely abstracts token management, whi
 [![Development Installs](https://static.pepy.tech/personalized-badge/crowdstrike-falconpy-dev?left_text=development%20package%20installs/month&left_color=grey&right_color=blue&period=month)](https://pepy.tech/project/crowdstrike-falconpy-dev)
 
 #### Supported versions of Python
-The CrowdStrike Falcon SDK for Python was developed for Python 3. Current versions of FalconPy provide support for Python versions `3.7` - `3.12`. Every commit to the FalconPy code base is unit tested for functionality using all versions of Python the library currently supports.
+The CrowdStrike Falcon SDK for Python was developed for Python 3. Current versions of FalconPy provide support for Python versions `3.7` - `3.13`. Every commit to the FalconPy code base is unit tested for functionality using all versions of Python the library currently supports.
 
 > [!NOTE]
 > Developers working with Python version `3.6` will need to leverage versions of FalconPy less than `1.4.0`.
@@ -139,13 +140,17 @@ from falconpydev import Hosts
 # CrowdStrike does not recommend you hardcode credentials within source code.
 # Instead, provide these values as variables that are retrieved from the environment,
 # read from an encrypted file or secrets store, provided at runtime, etc.
-# This example retrieves credentials from the environment as the variables
-# "FALCON_CLIENT_ID" and "FALCON_CLIENT_SECRET".
 
 hosts = Hosts(client_id=os.getenv("FALCON_CLIENT_ID"),
               client_secret=os.getenv("FALCON_CLIENT_SECRET")
               )
 
+# While this example retrieves credentials from the environment as the variables
+# "FALCON_CLIENT_ID" and "FALCON_CLIENT_SECRET". Developers leveraging environment
+# authentication do not need to specify the client_id or client_secret keywords.
+#
+# hosts = Hosts()
+
 SEARCH_FILTER = "hostname-search-string"
 
 # Retrieve a list of hosts that have a hostname that matches our search filter

{crowdstrike_falconpy_dev-1.4.6 → crowdstrike_falconpy_dev-1.4.7}/SECURITY.md

@@ -1,4 +1,5 @@
-![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
+![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png#gh-light-mode-only)
+![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo-red.png#gh-dark-mode-only)
 
 [![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 

{crowdstrike_falconpy_dev-1.4.6 → crowdstrike_falconpy_dev-1.4.7}/SUPPORT.md

@@ -1,4 +1,5 @@
-![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
+![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png#gh-light-mode-only)
+![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo-red.png#gh-dark-mode-only)
 
 [![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 

{crowdstrike_falconpy_dev-1.4.6 → crowdstrike_falconpy_dev-1.4.7}/src/falconpydev/README.md

@@ -1,6 +1,8 @@
-![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
-# FalconPy - The CrowdStrike Falcon SDK for Python 3
-This folder contains the FalconPy project, a Python 3 interface handler for the CrowdStrike Falcon OAuth2 API.
+![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png#gh-light-mode-only)
+![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo-red.png#gh-dark-mode-only)
+
+# FalconPy - The CrowdStrike Falcon SDK for Python
+This folder contains the FalconPy project, a Python interface handler for the CrowdStrike Falcon OAuth2 API.
 
 ## Service Classes
 ### Currently implemented

{crowdstrike_falconpy_dev-1.4.6 → crowdstrike_falconpy_dev-1.4.7}/src/falconpydev/__init__.py

@@ -101,6 +101,7 @@ from .container_detections import ContainerDetections
 from .container_images import ContainerImages
 from .container_packages import ContainerPackages
 from .container_vulnerabilities import ContainerVulnerabilities
+from .correlation_rules import CorrelationRules
 from .cloud_connect_aws import CloudConnectAWS
 from .cspm_registration import CSPMRegistration
 from .custom_ioa import CustomIOA
@@ -131,6 +132,7 @@ from .image_assessment_policies import ImageAssessmentPolicies
 from .incidents import Incidents
 from .installation_tokens import InstallationTokens
 from .intel import Intel
+from .intelligence_feeds import IntelligenceFeeds
 from .ioa_exclusions import IOAExclusions
 from .ioc import IOC
 from .iocs import Iocs
@@ -140,6 +142,7 @@ from .message_center import MessageCenter
 from .ml_exclusions import MLExclusions
 from .mobile_enrollment import MobileEnrollment
 from .mssp import FlightControl
+from .ngsiem import NGSIEM
 from .oauth2 import OAuth2
 from .ods import ODS
 from .overwatch_dashboard import OverwatchDashboard
@@ -209,7 +212,8 @@ __all__ = [
     "ContainerVulnerabilities", "DriftIndicators", "UnidentifiedContainers",
     "ImageAssessmentPolicies", "APIIntegrations", "ThreatGraph", "ExposureManagement",
     "CertificateBasedExclusions", "ComplianceAssessments", "HostMigration", "QuickScanPro",
-    "DataScanner", "SensorUsage", "Downloads", "DeliverySettings", "ASPM"
+    "DataScanner", "SensorUsage", "Downloads", "DeliverySettings", "ASPM", "IntelligenceFeeds",
+    "NGSIEM", "CorrelationRules"
     ]
 """
 This is free and unencumbered software released into the public domain.

{crowdstrike_falconpy_dev-1.4.6 → crowdstrike_falconpy_dev-1.4.7}/src/falconpydev/_endpoint/__init__.py

@@ -20,6 +20,7 @@
                                                         `---' OAuth2 API SDK for Python 3 `---'
 """
 from typing import List, Any
+from .deprecated import _correlation_rules_deprecated
 from .deprecated import _custom_ioa_deprecated
 from .deprecated import _d4c_registration_deprecated
 from .deprecated import _datascanner_deprecated
@@ -55,6 +56,7 @@ from ._container_detections import _container_detections_endpoints
 from ._container_images import _container_images_endpoints
 from ._container_packages import _container_packages_endpoints
 from ._container_vulnerabilities import _container_vulnerabilities_endpoints
+from ._correlation_rules import _correlation_rules_endpoints
 from ._cspm_registration import _cspm_registration_endpoints
 from ._custom_ioa import _custom_ioa_endpoints
 from ._custom_storage import _custom_storage_endpoints
@@ -81,6 +83,7 @@ from ._host_migration import _host_migration_endpoints
 from ._identity_protection import _identity_protection_endpoints
 from ._image_assessment_policies import _image_assessment_policies_endpoints
 from ._incidents import _incidents_endpoints
+from ._intelligence_feeds import _intelligence_feeds_endpoints
 from ._installation_tokens import _installation_tokens_endpoints
 from ._intel import _intel_endpoints
 from ._ioa_exclusions import _ioa_exclusions_endpoints
@@ -92,6 +95,7 @@ from ._message_center import _message_center_endpoints
 from ._ml_exclusions import _ml_exclusions_endpoints
 from ._mobile_enrollment import _mobile_enrollment_endpoints
 from ._mssp import _mssp_endpoints
+from ._ngsiem import _ngsiem_endpoints
 from ._oauth2 import _oauth2_endpoints
 from ._ods import _ods_endpoints
 from ._overwatch_dashboard import _overwatch_dashboard_endpoints
@@ -135,6 +139,7 @@ api_endpoints.extend(_container_detections_endpoints)
 api_endpoints.extend(_container_images_endpoints)
 api_endpoints.extend(_container_packages_endpoints)
 api_endpoints.extend(_container_vulnerabilities_endpoints)
+api_endpoints.extend(_correlation_rules_endpoints)
 api_endpoints.extend(_cspm_registration_endpoints)
 api_endpoints.extend(_custom_ioa_endpoints)
 api_endpoints.extend(_custom_storage_endpoints)
@@ -162,6 +167,7 @@ api_endpoints.extend(_identity_protection_endpoints)
 api_endpoints.extend(_image_assessment_policies_endpoints)
 api_endpoints.extend(_incidents_endpoints)
 api_endpoints.extend(_installation_tokens_endpoints)
+api_endpoints.extend(_intelligence_feeds_endpoints)
 api_endpoints.extend(_intel_endpoints)
 api_endpoints.extend(_ioa_exclusions_endpoints)
 api_endpoints.extend(_ioc_endpoints)
@@ -172,6 +178,7 @@ api_endpoints.extend(_message_center_endpoints)
 api_endpoints.extend(_ml_exclusions_endpoints)
 api_endpoints.extend(_mobile_enrollment_endpoints)
 api_endpoints.extend(_mssp_endpoints)
+api_endpoints.extend(_ngsiem_endpoints)
 api_endpoints.extend(_oauth2_endpoints)
 api_endpoints.extend(_ods_endpoints)
 api_endpoints.extend(_overwatch_dashboard_endpoints)
@@ -202,6 +209,7 @@ api_endpoints.extend(_zero_trust_assessment_endpoints)
 
 # Deprecated endpoints
 deprecated_endpoints = []
+deprecated_endpoints.extend(_correlation_rules_deprecated)
 deprecated_endpoints.extend(_certificate_based_exclusions_deprecated)
 deprecated_endpoints.extend(_custom_ioa_deprecated)
 deprecated_endpoints.extend(_d4c_registration_deprecated)

crowdstrike_falconpy_dev-1.4.7/src/falconpydev/_endpoint/_correlation_rules.py

@@ -0,0 +1,208 @@
+"""Internal API endpoint constant library.
+
+ _______                        __ _______ __        __ __
+|   _   .----.-----.--.--.--.--|  |   _   |  |_.----|__|  |--.-----.
+|.  1___|   _|  _  |  |  |  |  _  |   1___|   _|   _|  |    <|  -__|
+|.  |___|__| |_____|________|_____|____   |____|__| |__|__|__|_____|
+|:  1   |                         |:  1   |
+|::.. . |   CROWDSTRIKE FALCON    |::.. . |    FalconPy
+`-------'                         `-------'
+
+OAuth2 API - Customer SDK
+
+This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
+
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <https://unlicense.org>
+"""
+
+_correlation_rules_endpoints = [
+  [
+    "combined_rules_get_v1",
+    "GET",
+    "/correlation-rules/combined/rules/v1",
+    "Find all rules matching the query and filter.\nSupported filters: "
+    "customer_id,user_id,user_uuid,status,name,created_on,last_updated_on\nSupported range filters: "
+    "created_on,last_updated_on",
+    "correlation_rules",
+    [
+      {
+        "type": "string",
+        "description": "FQL query specifying the filter parameters",
+        "name": "filter",
+        "in": "query"
+      },
+      {
+        "type": "string",
+        "description": "Match query criteria, which includes all the filter string fields",
+        "name": "q",
+        "in": "query"
+      },
+      {
+        "enum": [
+          "created_on",
+          "created_on|desc",
+          "last_updated_on",
+          "last_updated_on|desc"
+        ],
+        "type": "string",
+        "default": "created_on",
+        "description": "Rule property to sort on",
+        "name": "sort",
+        "in": "query"
+      },
+      {
+        "type": "integer",
+        "default": 0,
+        "description": "Starting index of overall result set from which to return IDs",
+        "name": "offset",
+        "in": "query"
+      },
+      {
+        "type": "integer",
+        "default": 100,
+        "description": "Number of IDs to return",
+        "name": "limit",
+        "in": "query"
+      }
+    ]
+  ],
+  [
+    "entities_rules_get_v1",
+    "GET",
+    "/correlation-rules/entities/rules/v1",
+    "Retrieve rules by IDs",
+    "correlation_rules",
+    [
+      {
+        "type": "array",
+        "items": {
+          "type": "string"
+        },
+        "collectionFormat": "multi",
+        "description": "The IDs",
+        "name": "ids",
+        "in": "query",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "entities_rules_post_v1",
+    "POST",
+    "/correlation-rules/entities/rules/v1",
+    "Create rule",
+    "correlation_rules",
+    [
+      {
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "entities_rules_patch_v1",
+    "PATCH",
+    "/correlation-rules/entities/rules/v1",
+    "Update rules",
+    "correlation_rules",
+    [
+      {
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "entities_rules_delete_v1",
+    "DELETE",
+    "/correlation-rules/entities/rules/v1",
+    "Delete rules by IDs",
+    "correlation_rules",
+    [
+      {
+        "type": "array",
+        "items": {
+          "type": "string"
+        },
+        "collectionFormat": "multi",
+        "description": "The IDs",
+        "name": "ids",
+        "in": "query",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "queries_rules_get_v1",
+    "GET",
+    "/correlation-rules/queries/rules/v1",
+    "Find all rule IDs matching the query and filter.\nSupported filters: "
+    "customer_id,user_id,user_uuid,status,name,created_on,last_updated_on\nSupported range filters: "
+    "created_on,last_updated_on",
+    "correlation_rules",
+    [
+      {
+        "type": "string",
+        "description": "FQL query specifying the filter parameters",
+        "name": "filter",
+        "in": "query"
+      },
+      {
+        "type": "string",
+        "description": "Match query criteria, which includes all the filter string fields",
+        "name": "q",
+        "in": "query"
+      },
+      {
+        "enum": [
+          "created_on",
+          "created_on|desc",
+          "last_updated_on",
+          "last_updated_on|desc"
+        ],
+        "type": "string",
+        "default": "created_on",
+        "description": "Rule property to sort on",
+        "name": "sort",
+        "in": "query"
+      },
+      {
+        "type": "integer",
+        "default": 0,
+        "description": "Starting index of overall result set from which to return IDs",
+        "name": "offset",
+        "in": "query"
+      },
+      {
+        "type": "integer",
+        "default": 100,
+        "description": "Number of IDs to return",
+        "name": "limit",
+        "in": "query"
+      }
+    ]
+  ]
+]

crowdstrike_falconpy_dev-1.4.7/src/falconpydev/_endpoint/_intelligence_feeds.py

@@ -0,0 +1,93 @@
+"""Internal API endpoint constant library.
+
+ _______                        __ _______ __        __ __
+|   _   .----.-----.--.--.--.--|  |   _   |  |_.----|__|  |--.-----.
+|.  1___|   _|  _  |  |  |  |  _  |   1___|   _|   _|  |    <|  -__|
+|.  |___|__| |_____|________|_____|____   |____|__| |__|__|__|_____|
+|:  1   |                         |:  1   |
+|::.. . |   CROWDSTRIKE FALCON    |::.. . |    FalconPy
+`-------'                         `-------'
+
+OAuth2 API - Customer SDK
+
+This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
+
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <https://unlicense.org>
+"""
+
+_intelligence_feeds_endpoints = [
+  [
+    "DownloadFeedArchive",
+    "GET",
+    "/indicator-feed/entities/feed-download/v1",
+    "Downloads feed file contents as a zip archive",
+    "intelligence_feeds",
+    [
+      {
+        "type": "string",
+        "description": "Feed ID",
+        "name": "feed_item_id",
+        "in": "query",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "ListFeedTypes",
+    "GET",
+    "/indicator-feed/entities/feed/v1",
+    "Lists the accessible feeds for a given customer",
+    "intelligence_feeds",
+    []
+  ],
+  [
+    "QueryFeedArchives",
+    "GET",
+    "/indicator-feed/queries/feed/v1",
+    "Queries the accessible feeds for a customer. Returns a list of feed IDs which can be later downloaded",
+    "intelligence_feeds",
+    [
+      {
+        "type": "string",
+        "description": "Feed Name",
+        "name": "feed_name",
+        "in": "query"
+      },
+      {
+        "type": "string",
+        "description": "Feed interval must be one of: dump|daily|hourly|minutely",
+        "name": "feed_interval",
+        "in": "query",
+        "required": True
+      },
+      {
+        "type": "string",
+        "description": "Since is a valid timestamp in RFC3399 format. Restrictions: minutely: now()-2h, "
+        "hourly: now()-2d, daily: now()-5d; dump: now()-7d",
+        "name": "since",
+        "in": "query"
+      }
+    ]
+  ]
+]