crowdstrike-falconpy-dev 1.4.8__tar.gz → 1.4.9__tar.gz

{crowdstrike_falconpy_dev-1.4.8 → crowdstrike_falconpy_dev-1.4.9}/AUTHORS.md

@@ -105,6 +105,7 @@ This has been a critical element in the development of the FalconPy project.
 + `@am-cs-se`
 + Jesko, `@jhhcs`
 + Evan Stoner, `@evanstoner`
++ Gage Schaffer, `@Gage-BCCA`
 
 
 ## Sponsors

{crowdstrike_falconpy_dev-1.4.8 → crowdstrike_falconpy_dev-1.4.9}/CHANGELOG.md

@@ -1,3 +1,128 @@
+# Version 1.4.9
+## Added features and functionality
++ Added: Added new __CAO Hunting__ service collection with 4 new operations.
+    - `_endpoint/__init__.py`
+    - `_endpoint/_cao_hunting.py`
+    - `_payload/_generic.py`
+    - `__init__.py`
+    - `cao_hunting.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_cao_hunting.py`
+
++ Added: Added new _cloud_security_assets_combined_compliance_by_account_ operation to the __Cloud Security Assets__ service collection.
+    - `_endpoint/_cloud_security_assets.py`
+    - `_endpoint/deprecated/_cloud_security_assets.py`
+    - `cloud_security_assets.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_cloud_security_assets.py`
+
++ Added: Added 6 new operations to the __Custom Storage__ service collection.
+    - _ListCollections_
+    - _DescribeCollections_
+    - _DescribeCollection_
+    - _ListSchemas_
+    - _GetSchema_
+    - _GetSchemaMetadata_
+    - `_endpoint/_custom_storage.py`
+    - `_util/_functions.py`
+    - `custom_storage.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_custom_storage.py`
+
++ Added: Added new __FaaS Execution__ service collection with 1 new operation.
+    - _ReadRequestBody_
+    - `_endpoint/__init__.py`
+    - `_endpoint/_faas_execution.py`
+    - `__init__.py`
+    - `faas_execution.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_faas_execution.py`
+
++ Added: Added new _ReadClusterCombinedV2_ operation to the __Kubernetes Protection__ service collection.
+    - `_endpoint/_kubernetes_protection.py`
+    - `kubernetes_protection.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_kubernetes_protection.py`
+
++ Added: Added _aggregateUsersV1_ operation to the __User Management__ service collection.
+    - `_endpoint/_user_management.py`
+    - `user_management.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_user_management.py`
+
+## Other
++ Updated: Cosmetic update to `filter` and `sort` parameter descriptions in the _cloud_security_registration_oci_get_account_ operation of the __Cloud OCI Registration__ service collection.
+    - `_endpoint/_cloud_oci_registration.py`
+    - `_endpoint/deprecated/_cloud_oci_registration.py`
+
++ Removed: Removed the _cloud_security_assets_entities_artifacts_get_ operation from the __Cloud Security Assets__ service collection.
+    - `_endpoint/_cloud_security_assets.py`
+    - `_endpoint/deprecated/_cloud_security_assets.py`
+    - `cloud_security_assets.py`
+    > Unit testing updated to reflect currently available operations.
+    - `tests/test_cloud_security_assets.py`
+
++ Added: Added `service_category` as an allowed value for the `sort` parameter in the __cloud_security_assets_queries__ operation within the __Cloud Security Assets__ service collection.
+    - `_endpoint/_cloud_security_assets.py`
+    - `cloud_security_assets.py`
+
++ Renamed: Renamed to the __Compliance Assessments__ service collection to __Container Image Compliance__. Legacy service collection name maintained as an alias within the Service Class.
+    - `_endpoint/__init__.py`
+    - `_endpoint/_compliance_assessments.py` (Removed)
+    - `_endpoint/_container_image_compliance.py`
+    - `__init__.py`
+    - `compliance_assessments.py` -> `container_image_compliance.py`
+    > Unit testing updated to reflect new code pattern.
+    - `tests/test_compliance_assessments.py` -> `tests/test_container_compliance.py`
+
++ Updated: Cosmetic update to the `offset` parameter description in the _CombinedImageByVulnerabilityCount_ operation within the __Container Images__ service collection.
+    - `_endpoint/_container_images.py`
+
++ Added: Added `ai_related` as an allowed value for the `filter` parameter in 10 operations within the __Kubernetes Protection__ service collection.
+    - _FindContainersByContainerRunTimeVersion_
+    - _GroupContainersByManaged_
+    - _ReadContainersByDateRangeCount_
+    - _ReadContainerImageDetectionsCountByDate_
+    - _ReadVulnerableContainerImageCount_
+    - _ReadContainerCount_
+    - _ReadContainersSensorCoverage_
+    - _ReadContainerVulnerabilitiesBySeverityCount_
+    - _ReadDistinctContainerImageCount_
+    - _ReadContainerImagesByMostUsed_
+    - _ReadContainerCombined_
+    - `_endpoint/_kubernetes_protection.py`
+    - `kubernetes_protection.py`
+
++ Added: Added multiple new allowed values for the `filter` parameter in the _ReadClusterCombined_ operation within the __Kubernetes Protection__ service collection.
+    - `kubernetes_protection.py`
+
++ Added: Added `containers_impacted_ai_related` as an allowed value for the `filter` parameter in 2 operations within the __Kubernetes Protection__ service collection.
+    - _SearchAndReadKubernetesIomEntities_
+    - _SearchKubernetesIoms_
+    - `_endpoint/_kubernetes_protection.py`
+    - `kubernetes_protection.py`
+
++ Updated: Added `host_info.instance_state` as an allowed value for the `filter` parameter in the _combinedQueryVulnerabilities_ and _queryVulnerabilities_ operations within the __Spotlight Vulnerabilities__ service collection.
+    - `_endpoint/_spotlight_vulnerabilities.py`
+
++ Updated: Added `accessed_by_process` as an allowed value to the `edge_type` parameter in the _combined_edges_get_ operation within the __ThreatGraph__ service collection.
+    - `_endpoint/_threatgraph.py`
+    - `threatgraph.py`
+
++ Updated: Added `expires_at` as an allowed value for the `filter` and `sort` parameters in the _combinedUserRolesV1_ operation within the __User Management__ service collection.
+    - `_endpoint/_user_management.py`
+    - `user_management.py`
+
++ Updated: Added `has_temporary_roles` as an allowed value for the `filter` and `sort` parameters in the _queryUserV1_ operation within the __User Management__ service collection.
+    - `_endpoint/_user_management.py`
+    - `user_management.py`
+
++ Updated: Added `direct_assigned_cids` and `status` as allowed values for the `filter` parameter in the _queryUserV1_ operation within the __User Management__ service collection.
+    - `_endpoint/_user_management.py`
+    - `user_management.py`
+
+---
+
 # Version 1.4.8
 ## Added features and functionality
 + Added: Added 1 new operation to the __Alerts__ service collection.
@@ -297,6 +422,12 @@
 + Fixed: Payload handler / docstring issue with _entities_rules_patch_v1_ operation within the __CorrelationRules__ Service Class.  Closes #1294.
     - `correlation_rules.py`
 
++ Fixed: Added missing keyword arguments for updated body payloads in the __CSPM Registration__ Service Class. Closes #1273.
+    - `_payload/_cspm_registration.py`
+    - `cspm_registration.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_cspm_registration.py`
+
 + Fixed: Pylance issue with type hints for Service Class methods when pythonic mode is being used. Closes #1274.
     - `alerts.py`
     - `api_integrations.py`

{crowdstrike_falconpy_dev-1.4.8 → crowdstrike_falconpy_dev-1.4.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crowdstrike-falconpy-dev
-Version: 1.4.8
+Version: 1.4.9
 Summary: The CrowdStrike Falcon SDK for Python
 Project-URL: Documentation, https://www.falconpy.io
 Project-URL: Homepage, https://github.com/CrowdStrike/falconpy

{crowdstrike_falconpy_dev-1.4.8 → crowdstrike_falconpy_dev-1.4.9}/src/falconpydev/__init__.py

@@ -91,13 +91,14 @@ from .alerts import Alerts
 from .api_integrations import APIIntegrations
 from .api_complete import APIHarness, APIHarnessV2
 from .aspm import ASPM
+from .cao_hunting import CAOHunting
 from .certificate_based_exclusions import CertificateBasedExclusions
 from .cloud_aws_registration import CloudAWSRegistration
 from .cloud_azure_registration import CloudAzureRegistration
 from .cloud_oci_registration import CloudOCIRegistration
 from .cloud_security_assets import CloudSecurityAssets
 from .cloud_snapshots import CloudSnapshots
-from .compliance_assessments import ComplianceAssessments
+from .container_image_compliance import ContainerImageCompliance, ComplianceAssessments
 from .configuration_assessment_evaluation_logic import ConfigurationAssessmentEvaluationLogic
 from .configuration_assessment import ConfigurationAssessment
 from .container_alerts import ContainerAlerts
@@ -123,6 +124,7 @@ from .downloads import Downloads
 from .drift_indicators import DriftIndicators
 from .event_streams import EventStreams
 from .exposure_management import ExposureManagement
+from .faas_execution import FaaSExecution
 from .falcon_complete_dashboard import CompleteDashboard
 from .falcon_container import FalconContainer
 from .falconx_sandbox import FalconXSandbox
@@ -224,7 +226,8 @@ __all__ = [
     "DataScanner", "SensorUsage", "Downloads", "DeliverySettings", "ASPM", "IntelligenceFeeds",
     "NGSIEM", "CorrelationRules", "CloudAWSRegistration", "CloudAzureRegistration",
     "CloudOCIRegistration", "CloudSecurityAssets", "Deployments", "ServerlessVulnerabilities",
-    "DeviceContent", "IntelligenceIndicatorGraph", "ContentUpdatePolicies"
+    "DeviceContent", "IntelligenceIndicatorGraph", "ContentUpdatePolicies", "CAOHunting",
+    "ContainerImageCompliance", "FaaSExecution"
     ]
 """
 This is free and unencumbered software released into the public domain.

{crowdstrike_falconpy_dev-1.4.8 → crowdstrike_falconpy_dev-1.4.9}/src/falconpydev/_endpoint/__init__.py

@@ -50,6 +50,7 @@ from .deprecated import _deprecated_class_mapping
 from ._alerts import _alerts_endpoints
 from ._api_integrations import _api_integrations_endpoints
 from ._aspm import _aspm_endpoints
+from ._cao_hunting import _cao_hunting_endpoints
 from ._certificate_based_exclusions import _certificate_based_exclusions_endpoints
 from ._cloud_aws_registration import _cloud_aws_registration_endpoints
 from ._cloud_azure_registration import _cloud_azure_registration_endpoints
@@ -57,7 +58,7 @@ from ._cloud_oci_registration import _cloud_oci_registration_endpoints
 from ._cloud_security_assets import _cloud_security_assets_endpoints
 from ._cloud_connect_aws import _cloud_connect_aws_endpoints
 from ._cloud_snapshots import _cloud_snapshots_endpoints
-from ._compliance_assessments import _compliance_assessments_endpoints
+from ._container_image_compliance import _container_image_compliance_endpoints
 from ._configuration_assessment_evaluation_logic import _configuration_assessment_evaluation_logic_endpoints
 from ._configuration_assessment import _configuration_assessment_endpoints
 from ._container_alerts import _container_alerts_endpoints
@@ -82,6 +83,7 @@ from ._downloads import _downloads_endpoints
 from ._drift_indicators import _drift_indicators_endpoints
 from ._event_streams import _event_streams_endpoints
 from ._exposure_management import _exposure_management_endpoints
+from ._faas_execution import _faas_execution_endpoints
 from ._falcon_complete_dashboard import _falcon_complete_dashboard_endpoints
 from ._falcon_container import _falcon_container_endpoints
 from ._falconx_sandbox import _falconx_sandbox_endpoints
@@ -142,6 +144,7 @@ api_endpoints: List[Any] = []
 api_endpoints.extend(_alerts_endpoints)
 api_endpoints.extend(_api_integrations_endpoints)
 api_endpoints.extend(_aspm_endpoints)
+api_endpoints.extend(_cao_hunting_endpoints)
 api_endpoints.extend(_certificate_based_exclusions_endpoints)
 api_endpoints.extend(_cloud_connect_aws_endpoints)
 api_endpoints.extend(_cloud_aws_registration_endpoints)
@@ -149,7 +152,7 @@ api_endpoints.extend(_cloud_azure_registration_endpoints)
 api_endpoints.extend(_cloud_oci_registration_endpoints)
 api_endpoints.extend(_cloud_security_assets_endpoints)
 api_endpoints.extend(_cloud_snapshots_endpoints)
-api_endpoints.extend(_compliance_assessments_endpoints)
+api_endpoints.extend(_container_image_compliance_endpoints)
 api_endpoints.extend(_configuration_assessment_evaluation_logic_endpoints)
 api_endpoints.extend(_configuration_assessment_endpoints)
 api_endpoints.extend(_container_alerts_endpoints)
@@ -174,6 +177,7 @@ api_endpoints.extend(_downloads_endpoints)
 api_endpoints.extend(_drift_indicators_endpoints)
 api_endpoints.extend(_event_streams_endpoints)
 api_endpoints.extend(_exposure_management_endpoints)
+api_endpoints.extend(_faas_execution_endpoints)
 api_endpoints.extend(_falcon_complete_dashboard_endpoints)
 api_endpoints.extend(_falcon_container_endpoints)
 api_endpoints.extend(_falconx_sandbox_endpoints)

crowdstrike_falconpy_dev-1.4.9/src/falconpydev/_endpoint/_cao_hunting.py

@@ -0,0 +1,141 @@
+"""Internal API endpoint constant library.
+
+ _______                        __ _______ __        __ __
+|   _   .----.-----.--.--.--.--|  |   _   |  |_.----|__|  |--.-----.
+|.  1___|   _|  _  |  |  |  |  _  |   1___|   _|   _|  |    <|  -__|
+|.  |___|__| |_____|________|_____|____   |____|__| |__|__|__|_____|
+|:  1   |                         |:  1   |
+|::.. . |   CROWDSTRIKE FALCON    |::.. . |    FalconPy
+`-------'                         `-------'
+
+OAuth2 API - Customer SDK
+
+This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
+
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <https://unlicense.org>
+"""
+
+_cao_hunting_endpoints = [
+  [
+    "AggregateIntelligenceQueries",
+    "POST",
+    "/hunting/aggregates/intelligence-queries/v1",
+    "Aggregate intelligence queries",
+    "cao_hunting",
+    [
+      {
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "GetArchiveExport",
+    "GET",
+    "/hunting/entities/archive-exports/v1",
+    "Creates an Archive Export",
+    "cao_hunting",
+    [
+      {
+        "type": "string",
+        "description": "The Query Language. Accepted Values:\n\n<li>cql</li><li>snort</li><li>suricata</li><li>yara</li>",
+        "name": "language",
+        "in": "query",
+        "required": True
+      },
+      {
+        "type": "string",
+        "description": "The FQL Filter",
+        "name": "filter",
+        "in": "query"
+      },
+      {
+        "type": "string",
+        "description": "The Archive Type can be one of 'zip' and 'gzip'. Defaults to 'zip'.",
+        "name": "archive_type",
+        "in": "query"
+      }
+    ]
+  ],
+  [
+    "GetIntelligenceQueries",
+    "GET",
+    "/hunting/entities/intelligence-queries/v1",
+    "Retrieves a list of Intelligence queries",
+    "cao_hunting",
+    [
+      {
+        "type": "array",
+        "items": {
+          "type": "string"
+        },
+        "collectionFormat": "multi",
+        "description": "Intelligence queries IDs",
+        "name": "ids",
+        "in": "query",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "SearchIntelligenceQueries",
+    "GET",
+    "/hunting/queries/intelligence-queries/v1",
+    "Search intelligence queries that match the provided conditions",
+    "cao_hunting",
+    [
+      {
+        "type": "string",
+        "description": "Starting index of result set from which to return IDs.",
+        "name": "offset",
+        "in": "query"
+      },
+      {
+        "type": "integer",
+        "description": "Number of IDs to return.",
+        "name": "limit",
+        "in": "query"
+      },
+      {
+        "type": "string",
+        "description": "Order by fields.",
+        "name": "sort",
+        "in": "query"
+      },
+      {
+        "type": "string",
+        "description": "FQL query specifying the filter parameters.",
+        "name": "filter",
+        "in": "query"
+      },
+      {
+        "type": "string",
+        "description": "Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed).",
+        "name": "q",
+        "in": "query"
+      }
+    ]
+  ]
+]

{crowdstrike_falconpy_dev-1.4.8 → crowdstrike_falconpy_dev-1.4.9}/src/falconpydev/_endpoint/_cloud_oci_registration.py

@@ -47,14 +47,14 @@ _cloud_oci_registration_endpoints = [
       {
         "type": "string",
         "description": "FQL (Falcon Query Language) string for filtering results. Allowed filters are "
-        "Set{tenancy_name, home_region, key_age, overall_status, created_at, updated_at, tenancy_ocid}",
+        "Set{home_region, key_age, overall_status, created_at, updated_at, tenancy_ocid, tenancy_name}",
         "name": "filter",
         "in": "query"
       },
       {
         "type": "string",
-        "description": "Field and direction for sorting results - allowed sort fields are Set{tenancy_name, "
-        "home_region, key_age, overall_status, created_at, updated_at, tenancy_ocid}",
+        "description": "Field and direction for sorting results - allowed sort fields are Set{home_region, "
+        "key_age, overall_status, created_at, updated_at, tenancy_ocid, tenancy_name}",
         "name": "sort",
         "in": "query"
       },

{crowdstrike_falconpy_dev-1.4.8 → crowdstrike_falconpy_dev-1.4.9}/src/falconpydev/_endpoint/_cloud_security_assets.py

@@ -38,22 +38,64 @@ For more information, please refer to <https://unlicense.org>
 
 _cloud_security_assets_endpoints = [
   [
-    "cloud_security_assets_entities_artifacts_get",
+    "cloud_security_assets_combined_compliance_by_account",
     "GET",
-    "/cloud-security-assets/entities/resource-artifacts/v1",
-    "TODO",
+    "/cloud-security-assets/combined/compliance-controls/by-account-region-and-resource-type/v1",
+    "Gets combined compliance data aggregated by account and region. Results can be filtered and sorted.",
     "cloud_security_assets",
     [
       {
         "type": "string",
-        "description": "ID",
-        "name": "id",
+        "description": "FQL string to filter on asset contents. Filterable fields include:  account_id  "
+        "account_name  assessment_id  business_impact  cloud_group  cloud_label  cloud_label_id  cloud_provider  "
+        "cloud_scope  compliant  control.benchmark.name  control.benchmark.version  control.framework  control.name  "
+        "control.type  control.version  environment  last_evaluated  region  resource_provider  resource_type  "
+        "resource_type_name  service  service_category  severities",
+        "name": "filter",
         "in": "query"
       },
       {
         "type": "string",
-        "description": "CRN",
-        "name": "crn",
+        "description": "Sort expression in format: field|direction (e.g., last_evaluated|desc). Allowed sort "
+        "fields:   account_id  account_name  assessment_id  cloud_provider  control.benchmark.name  "
+        "control.benchmark.version  control.framework  control.name  control.type  control.version  last_evaluated  "
+        "region  resource_counts.compliant  resource_counts.non_compliant  resource_counts.total  resource_provider  "
+        "resource_type  resource_type_name  service  service_category",
+        "name": "sort",
+        "in": "query"
+      },
+      {
+        "maximum": 10000,
+        "minimum": 0,
+        "type": "integer",
+        "default": 20,
+        "description": "The maximum number of items to return. When not specified or 0, 20 is used. When "
+        "larger than 10000, 10000 is used.",
+        "name": "limit",
+        "in": "query"
+      },
+      {
+        "maximum": 9999,
+        "minimum": 0,
+        "type": "integer",
+        "description": "Offset returned controls. Use only one of 'offset' and 'after' parameter for "
+        "paginating. 'offset' can only be used on offsets < 10,000. For paginating through the entire result set, use "
+        "'after' parameter",
+        "name": "offset",
+        "in": "query"
+      },
+      {
+        "type": "string",
+        "description": "token-based pagination. use for paginating through an entire result set. Use only one "
+        "of 'offset' and 'after' parameters for paginating",
+        "name": "after",
+        "in": "query"
+      },
+      {
+        "type": "boolean",
+        "default": False,
+        "description": "Include counts of failing IOMs by severity level",
+        "name": "include_failing_iom_severity_counts",
         "in": "query"
       }
     ]
@@ -119,9 +161,9 @@ _cloud_security_assets_endpoints = [
         "cloud_provider  cluster_id  cluster_name  creation_time  data_classifications.found  "
         "data_classifications.scanned  first_seen  id  instance_id  instance_state  ioa_count  iom_count  managed_by  "
         "organization_Id  os_version  platform_name  publicly_exposed  region  resource_id  resource_name  "
-        "resource_type  resource_type_name  service  ssm_managed  status  tenant_id  updated_at  vmware.guest_os_id  "
-        "vmware.guest_os_version  vmware.host_system_name  vmware.host_type  vmware.instance_uuid  vmware.vm_host_name "
-        "vmware.vm_tools_status  zone\n\nUse |asc or |desc suffix to specify sort direction.",
+        "resource_type  resource_type_name  service  service_category  ssm_managed  status  tenant_id  updated_at  "
+        "vmware.guest_os_id  vmware.guest_os_version  vmware.host_system_name  vmware.host_type  vmware.instance_uuid  "
+        "vmware.vm_host_name  vmware.vm_tools_status  zone\n\nUse |asc or |desc suffix to specify sort direction.",
         "name": "sort",
         "in": "query"
       },