crowdstrike-falconpy-dev 1.5.0__tar.gz → 1.5.2__tar.gz

{crowdstrike_falconpy_dev-1.5.0 → crowdstrike_falconpy_dev-1.5.2}/CHANGELOG.md

@@ -1,3 +1,126 @@
+# Version 1.5.2
+## Added features and functionality
++ Updated: Updated `import_definition` (_WorkflowDefinitionsImport_ operation) method to allow for raw YAML file data to be passed to the `data_file` keyword within the __Workflows__ Service Class. Closes #1341.
+    - `workflows.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_workflows.py`
+    - Thanks go out to @jbfuzier for suggesting this update. 🙇
+
++ Updated: Expanded error handling for context manager usage scenarios.
+    - `_auth_object/_uber_interface.py`
+    - `_service_class/_service_class.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_service_class.py`
+    - `tests/test_uber.py`
+
++ Updated: Updated default `limit` for the _ReadCombinedVulnerabilitiesDetails_ operation from 100 to 5000 within the __Container Vulnerabilities__ service collection.
+    - `_endpoint/_container_vulnerabilities.py`
+
++ Added: Added `temporarily_assigned_cids` as an allowed value for the `filter` parameter in the _queryUserV1_ operation within the __User Management__ service collection.
+    - `_endpoint/_user_management.py`
+    - `user_management.py`
+
++ Added: Added new _GetIndicatorAggregates_ operation to the __Intelligence Indicator Graph__ service collection.
+    - `_endpoint/_intelligence_indicator_graph.py`
+    - `intelligence_indicator_graph.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_intelligence_indicator_graph.py`
+
+## Issues resolved
++ Fixed: Restored incorrectly removed values from the __PREFER_IDS_IN_BODY__ constant. Closes #1344.
+    - `_constant/__init__.py`
+    - Thanks go out to @agburch for identifying this issue! 🙇
+
+## Other
++ Updated: Updated `generate_error_result` method to handle context manager and pythonic scenarios.
+    - `_util/_functions.py`
+
++ Updated: Cosmetic updates to the `filter` parameter for the _cloud_security_registration_oci_get_account_ operation within the __Cloud OCI Registration__ service collection.
+    - `_endpoint/_cloud_oci_registration.py`
+    - `_endpoint/deprecated/_cloud_oci_registration.py`
+
+---
+
+# Version 1.5.1
+## Added features and functionality
++ Added: Added the _CreateFileV1_ and _UpdateFileV1_ operations to the __Foundry LogScale__ service collection.
+    - `_endpoint/_foundry_logscale.py`
+    - `_endpoint/_ngsiem.py`
+    - `foundry_logscale.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_foundry_logscale.py`
+
++ Added: Added new _CombinedUserRolesV2_ operation to the __User Management__ service collection. Deprecated the _combinedUserRolesV1_ operation.
+    - `_endpoint/_user_management.py`
+    - `user_management.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_user_management.py`
+
++ Added: Added new HTTP Event Collector module.
+    - `_enum/__init__py`
+    - `_enum/_ingest_base_url.py`
+    - `_enum/_ingest_format.py`
+    - `_enum/_timeunit.py`
+    - `_ngsiem/__init__.py`
+    - `_ngsiem/_hec.py`
+    - `_ngsiem/_ingest_config.py`
+    - `_ngsiem/_ingest_payload.py`
+    - `_ngsiem/_session_manager.py`
+    - `__init__.py`
+    - `_version.py`
+    > Unit testing expanded to complete code coverage.
+    - `.github/workflows/unit_testing_ubuntu.yml`
+    - `tests/5records.raw`
+    - `tests/100thousand.raw.gz`
+    - `tests/test_hec.py`
+
++ Added: Added new helper module containing a text color helper class, progress / wait indicator, and a random string generator.
+    - `_helper/__init__.py`
+    - `_helper/_indicator.py`
+    - `_helper/_text_colors.py`
+    - `__init__.py`
+    > Unit testing expanded to complete coverage.
+
++ Added: Added the `sort` parameter to the _queryPinnableContentVersions_ operation within the __Content Update Policies__ service collection.
+    - `_endpoint/_content_update_policies.py`
+    - `content_update_policies.py`
+
++ Added: Added `actors.animal_classifier`, `malware`, `malware.community_identifiers`, `malware.family_name`, and `malware.slug` as an allowed filter parameter values in the _QueryIntelReportIds_ and _QueryIntelReportEntities_ operations within the __Intel__ service collection.
+    - `_endpoint/_intel.py`
+    - `intel.py`
+
++ Added: Added `animal_classifier` as an allowed filter parameter value in the _QueryIntelActorEntities_ and _QueryIntelActorIds_ operations within the __Intel__ service collection.
+    - `_endpoint/_intel.py`
+    - `intel.py`
+
+## Issues resolved
++ Updated: Changed form data files tuple name for `file_data` to match the keyword in the _IngestDataV1_ and _IngestDataAsyncV1_ operations within the __Foundry LogScale__ Service Class.
+    - `foundry_logscale.py`
+
++ Resolved: Updated `search_id` to `id` in the Uber Class _scrub_target_ method to properly handle path variables required for the _GetSearchStatusV1_ operation within the __NGSIEM__ service collection. Closes #1329.
+    - `_util/_uber.py`
+    - Thanks go out to @Gage-BCCA for submitting this fix! 🙇
+
++ Updated: Expanded the operations covered by the PREFER_IDS_IN_BODY constant.
+    - `_constant/__init__.py`
+
++ Updated: Updated the `data_payload` payload handler for operations within __Real Time Response__ service collections to allow for blank parameter values. Closes #1339.
+    - `_payload/_real_time_response.py`
+    - Thanks go out to @jbfuzier for reporting this issue! 🙇
+
+## Other
++ Updated: Cosmetic updates to enum and parameter descriptions in the _GetMigrationIDsV1_ and _GetHostMigrationIDsV1_ operations within the __Host Migration__ service collection.
+    - `_endpoint/_host_migration.py`
+
++ Removed: Removed the MacOS Sonoma ARM 64 option for the `environment_id` parameter within the __Submit__ operation in the __Falcon Intelligence Sandbox__ Service Class.
+    - `falconx_sandbox.py`
+
++ Updated: Cosmetic updates to the `filter` and `sort` parameter descriptions in the _cloud-security-registration-oci-get-account_ operation within the __Cloud OCI Registration__ service collection.
+    - `_endpoint/_cloud_oci_registration.py`
+    - `_endpoint/deprecated/_cloud_oci_registration.py`
+
+---
+
 # Version 1.5.0
 ## Added features and functionality
 + Added: Streaming download functionality. Closes #965.
@@ -80,6 +203,10 @@
     - `_payload/_certificate_based_exclusions.py`
     - `certificate_based_exclusions.py`
 
++ Fixed: Resolved payload handling issue with the `start` and `timezone` parameters in the _StartSearchV1_ operation within the __NGSIEM__ Service Class. Closes #1331.
+    - `_payload/_ngsiem.py`
+    - Thanks go out to @jimmyruann for reporting this issue and identifying the fix. 🙇
+
 ## Other
 + Removed: Removed decommissioned _cloud_registration_aws_validate_accounts_ from the __Cloud AWS Registration__ service collection.
     - `_endpoint/_cloud_aws_registration.py`

{crowdstrike_falconpy_dev-1.5.0 → crowdstrike_falconpy_dev-1.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crowdstrike-falconpy-dev
-Version: 1.5.0
+Version: 1.5.2
 Summary: The CrowdStrike Falcon SDK for Python
 Project-URL: Documentation, https://www.falconpy.io
 Project-URL: Homepage, https://github.com/CrowdStrike/falconpy

{crowdstrike_falconpy_dev-1.5.0 → crowdstrike_falconpy_dev-1.5.2}/src/falconpydev/__init__.py

@@ -40,7 +40,14 @@ from ._constant import (
     GLOBAL_API_MAX_RETURN,
     MOCK_OPERATIONS
     )
-from ._enum import BaseURL, ContainerBaseURL, TokenFailReason
+from ._enum import (
+    BaseURL,
+    ContainerBaseURL,
+    TokenFailReason,
+    IngestBaseURL,
+    IngestFormat,
+    TimeUnit
+    )
 from ._log import LogFacility
 from ._error import (
     APIError,
@@ -87,6 +94,14 @@ from ._api_request import (
     RequestPayloads,
     RequestValidator
     )
+from ._ngsiem import (
+    HTTPEventCollector,
+    HEC,
+    IngestPayload,
+    IngestConfig,
+    SessionManager
+)
+from ._helper import random_string, Indicator, Color
 from .alerts import Alerts
 from .api_integrations import APIIntegrations
 from .api_complete import APIHarness, APIHarnessV2
@@ -227,7 +242,9 @@ __all__ = [
     "NGSIEM", "CorrelationRules", "CloudAWSRegistration", "CloudAzureRegistration",
     "CloudOCIRegistration", "CloudSecurityAssets", "Deployments", "ServerlessVulnerabilities",
     "DeviceContent", "IntelligenceIndicatorGraph", "ContentUpdatePolicies", "CAOHunting",
-    "ContainerImageCompliance", "FaaSExecution"
+    "ContainerImageCompliance", "FaaSExecution", "HEC", "IngestBaseURL", "IngestFormat",
+    "IngestPayload", "HTTPEventCollector", "IngestConfig", "SessionManager", "TimeUnit",
+    "Color", "Indicator", "random_string"
     ]
 """
 This is free and unencumbered software released into the public domain.

{crowdstrike_falconpy_dev-1.5.0 → crowdstrike_falconpy_dev-1.5.2}/src/falconpydev/_auth_object/_uber_interface.py

@@ -35,6 +35,7 @@ OTHER DEALINGS IN THE SOFTWARE.
 
 For more information, please refer to <https://unlicense.org>
 """
+from traceback import extract_tb
 from typing import Dict, List, Optional, Union
 from ._falcon_interface import FalconInterface
 from .._constant import MAX_DEBUG_RECORDS
@@ -156,10 +157,19 @@ class UberInterface(FalconInterface):
         """Allow for entry as a context manager."""
         return self
 
-    def __exit__(self, *args):
-        """Discard our token when we exit the context."""
+    def __exit__(self, exc_type, exc_val, exc_tb):
+        """Discard our token when we exit the context and handle any errors."""
+        if exc_type is not None:
+            if self.log:
+                # Log the error and traceback detail
+                self.log.error("ERROR: [%s] %s", exc_type.__name__, exc_val)
+                frame_list = extract_tb(exc_tb)
+                frame = frame_list[len(frame_list)-1]
+                lineno = frame.lineno
+                func = frame.name
+                fname = frame.filename
+                self.log.error("LOCATION: %s, Line #%i in Function '%s'", fname, lineno, func)
         self.logout()
-        return args
 
     # Legacy property getters maintained for backwards functionality.
     def authenticated(self) -> bool:

{crowdstrike_falconpy_dev-1.5.0 → crowdstrike_falconpy_dev-1.5.2}/src/falconpydev/_constant/__init__.py

@@ -43,10 +43,21 @@ PREFER_NONETYPE: List[str] = [
     "RTR_DeleteSession"
 ]
 PREFER_IDS_IN_BODY: List[str] = [
-    "GetDeviceDetails", "PostDeviceDetailsV2", "GetVulnerabilities", "GetIntelIndicatorEntities",
-    "getChildrenV2", "cancel-scans", "GetDetectSummaries", "UpdateQuarantinedDetectsByIds",
-    "GetQuarantineFiles", "PostEntitiesAlertsV1", "CreateSavedSearchesDeployV1",
-    "WorkflowExecutionsAction", "signalChangesExternal"
+    "GetBehaviors", "GetCaseActivityByIds", "GetCaseEntitiesByIDs", "GetDetectSummaries",
+    "GetEventsEntities", "GetHostMigrationsV1", "GetIncidents", "GetIntelIndicatorEntities",
+    "GetQuarantineFiles", "GetRulesEntities", "GetSensorDetails", "GetVulnerabilities",
+    "HostMigrationsActionsV1", "MigrationsActionsV1", "PatchEntitiesAlertsV2", "PerformActionV2",
+    "PerformIncidentAction", "PostDeviceDetailsV2", "PostEntitiesAlertsV1", "PostMitreAttacks",
+    "QueryDeviceLoginHistory", "QueryDeviceLoginHistoryV2", "QueryGetNetworkAddressHistoryV1",
+    "RTR_ListQueuedSessions", "RTR_ListSessions", "UpdateDetectsByIdsV2", "cancel_scans",
+    "UpdateQuarantinedDetectsByIds", "WorkflowExecutionsAction", "get_rules_get", "getChildrenV2",
+    "performContentUpdatePoliciesAction", "performDeviceControlPoliciesAction", "userActionV1",
+    "performFirewallPoliciesAction", "performGroupAction", "performPreventionPoliciesAction",
+    "performRTResponsePoliciesAction", "performSensorUpdatePoliciesAction", "retrieveUsersGETV1",
+    "setContentUpdatePoliciesPrecedence", "setDeviceControlPoliciesPrecedence",
+    "setFirewallPoliciesPrecedence", "setPreventionPoliciesPrecedence", "signalChangesExternal",
+    "setRTResponsePoliciesPrecedence", "setSensorUpdatePoliciesPrecedence", "GetDeviceDetails",
+    "CreateSavedSearchesDeployV1", "cancel-scans", "get-rules-get"
 ]
 MOCK_OPERATIONS: List[str] = [
     "GetImageAssessmentReport", "DeleteImageDetails", "ImageMatchesPolicy"

{crowdstrike_falconpy_dev-1.5.0 → crowdstrike_falconpy_dev-1.5.2}/src/falconpydev/_endpoint/_cloud_oci_registration.py

@@ -47,14 +47,14 @@ _cloud_oci_registration_endpoints = [
       {
         "type": "string",
         "description": "FQL (Falcon Query Language) string for filtering results. Allowed filters are "
-        "Set{key_age, overall_status, created_at, updated_at, tenancy_ocid, tenancy_name, home_region}",
+        "Set{overall_status, created_at, updated_at, tenancy_ocid, tenancy_name, home_region, key_age}",
         "name": "filter",
         "in": "query"
       },
       {
         "type": "string",
-        "description": "Field and direction for sorting results - allowed sort fields are Set{home_region, "
-        "key_age, overall_status, created_at, updated_at, tenancy_ocid, tenancy_name}",
+        "description": "Field and direction for sorting results - allowed sort fields are Set{updated_at, "
+        "tenancy_ocid, tenancy_name, home_region, key_age, overall_status, created_at}",
         "name": "sort",
         "in": "query"
       },

{crowdstrike_falconpy_dev-1.5.0 → crowdstrike_falconpy_dev-1.5.2}/src/falconpydev/_endpoint/_container_vulnerabilities.py

@@ -279,7 +279,7 @@ _container_vulnerabilities_endpoints = [
       },
       {
         "type": "integer",
-        "default": 100,
+        "default": 5000,
         "description": "The upper-bound on the number of records to retrieve.",
         "name": "limit",
         "in": "query"

{crowdstrike_falconpy_dev-1.5.0 → crowdstrike_falconpy_dev-1.5.2}/src/falconpydev/_endpoint/_content_update_policies.py

@@ -313,6 +313,18 @@ _content_update_policies_endpoints = [
         "name": "category",
         "in": "query",
         "required": True
+      },
+      {
+        "enum": [
+          "deployed_timestamp.asc",
+          "deployed_timestamp.desc"
+        ],
+        "type": "string",
+        "default": "deployed_timestamp.desc",
+        "description": "value to sort returned content versions by. Allowed sort values are "
+        "deployed_timestamp.(asc|desc) defaulting to deployed_timestamp.desc",
+        "name": "sort",
+        "in": "query"
       }
     ]
   ],

{crowdstrike_falconpy_dev-1.5.0 → crowdstrike_falconpy_dev-1.5.2}/src/falconpydev/_endpoint/_foundry_logscale.py

@@ -145,6 +145,102 @@ _foundry_logscale_endpoints = [
       }
     ]
   ],
+  [
+    "CreateFileV1",
+    "POST",
+    "/loggingapi/entities/lookup-files/v1",
+    "Creates a lookup file",
+    "foundry_logscale",
+    [
+      {
+        "maxLength": 36,
+        "minLength": 36,
+        "type": "string",
+        "description": "Requester UUID.",
+        "name": "X-CS-USERUUID",
+        "in": "header"
+      },
+      {
+        "type": "file",
+        "description": "File to be uploaded",
+        "name": "file",
+        "in": "formData",
+        "required": True
+      },
+      {
+        "maxLength": 50,
+        "minLength": 5,
+        "type": "string",
+        "description": "Name used to identify the file",
+        "name": "name",
+        "in": "formData",
+        "required": True
+      },
+      {
+        "maxLength": 255,
+        "minLength": 5,
+        "type": "string",
+        "description": "File description",
+        "name": "description",
+        "in": "formData"
+      },
+      {
+        "maxLength": 32,
+        "minLength": 32,
+        "type": "string",
+        "description": "Unique identifier of the file being updated.",
+        "name": "id",
+        "in": "formData"
+      },
+      {
+        "maxLength": 255,
+        "minLength": 5,
+        "type": "string",
+        "description": "Name of repository or view to save the file",
+        "name": "repo",
+        "in": "formData"
+      }
+    ]
+  ],
+  [
+    "UpdateFileV1",
+    "PATCH",
+    "/loggingapi/entities/lookup-files/v1",
+    "Updates a lookup file",
+    "foundry_logscale",
+    [
+      {
+        "maxLength": 36,
+        "minLength": 36,
+        "type": "string",
+        "description": "Requester UUID.",
+        "name": "X-CS-USERUUID",
+        "in": "header"
+      },
+      {
+        "minLength": 32,
+        "type": "string",
+        "description": "Unique identifier of the file being updated.",
+        "name": "id",
+        "in": "formData",
+        "required": True
+      },
+      {
+        "maxLength": 255,
+        "minLength": 5,
+        "type": "string",
+        "description": "File description",
+        "name": "description",
+        "in": "formData"
+      },
+      {
+        "type": "file",
+        "description": "File to be uploaded",
+        "name": "file",
+        "in": "formData"
+      }
+    ]
+  ],
   [
     "CreateSavedSearchesDynamicExecuteV1",
     "POST",

{crowdstrike_falconpy_dev-1.5.0 → crowdstrike_falconpy_dev-1.5.2}/src/falconpydev/_endpoint/_host_migration.py

@@ -215,15 +215,18 @@ _host_migration_endpoints = [
       },
       {
         "enum": [
+          "target_cid|asc",
+          "target_cid|desc",
+          "target_cid",
           "source_cid|asc",
           "source_cid|desc",
           "source_cid",
-          "id|asc",
-          "id|desc",
-          "id",
-          "created_time|asc",
-          "created_time|desc",
-          "created_time",
+          "host_migration_id|asc",
+          "host_migration_id|desc",
+          "host_migration_id",
+          "groups|asc",
+          "groups|desc",
+          "groups",
           "static_host_groups|asc",
           "static_host_groups|desc",
           "static_host_groups",
@@ -233,21 +236,18 @@ _host_migration_endpoints = [
           "status|asc",
           "status|desc",
           "status",
-          "target_cid|asc",
-          "target_cid|desc",
-          "target_cid",
-          "groups|asc",
-          "groups|desc",
-          "groups",
-          "hostgroups|asc",
-          "hostgroups|desc",
-          "hostgroups",
           "migration_id|asc",
           "migration_id|desc",
           "migration_id",
-          "host_migration_id|asc",
-          "host_migration_id|desc",
-          "host_migration_id"
+          "id|asc",
+          "id|desc",
+          "id",
+          "created_time|asc",
+          "created_time|desc",
+          "created_time",
+          "hostgroups|asc",
+          "hostgroups|desc",
+          "hostgroups"
         ],
         "type": "string",
         "description": "The property to sort by.",
@@ -256,9 +256,9 @@ _host_migration_endpoints = [
       },
       {
         "type": "string",
-        "description": "The filter expression that should be used to limit the results. Valid fields: groups, "
-        "hostgroups, migration_id, host_migration_id, source_cid, id, created_time, static_host_groups, hostname, "
-        "status, target_cid",
+        "description": "The filter expression that should be used to limit the results. Valid fields: "
+        "migration_id, id, created_time, hostgroups, static_host_groups, hostname, status, groups, target_cid, "
+        "source_cid, host_migration_id",
         "name": "filter",
         "in": "query"
       }
@@ -285,6 +285,12 @@ _host_migration_endpoints = [
       },
       {
         "enum": [
+          "status|asc",
+          "status|desc",
+          "status",
+          "migration_status|asc",
+          "migration_status|desc",
+          "migration_status",
           "created_by|asc",
           "created_by|desc",
           "created_by",
@@ -302,13 +308,7 @@ _host_migration_endpoints = [
           "migration_id",
           "target_cid|asc",
           "target_cid|desc",
-          "target_cid",
-          "status|asc",
-          "status|desc",
-          "status",
-          "migration_status|asc",
-          "migration_status|desc",
-          "migration_status"
+          "target_cid"
         ],
         "type": "string",
         "description": "The property to sort by.",
@@ -318,7 +318,7 @@ _host_migration_endpoints = [
       {
         "type": "string",
         "description": "The filter expression that should be used to limit the results. Valid fields: "
-        "migration_id, target_cid, status, migration_status, created_by, created_time, name, id",
+        "migration_status, created_by, created_time, name, id, migration_id, target_cid, status",
         "name": "filter",
         "in": "query"
       }

{crowdstrike_falconpy_dev-1.5.0 → crowdstrike_falconpy_dev-1.5.2}/src/falconpydev/_endpoint/_intel.py

@@ -65,8 +65,8 @@ _intel_endpoints = [
       {
         "type": "string",
         "description": "Filter your query by specifying FQL filter parameters. Filter parameters "
-        "include:\n\nactor_type, capabilities, capability, capability.id, capability.slug, capability.value, "
-        "created_date, description, ecrime_kill_chain.attribution, ecrime_kill_chain.crimes, "
+        "include:\n\nactor_type, animal_classifier, capabilities, capability, capability.id, capability.slug, "
+        "capability.value, created_date, description, ecrime_kill_chain.attribution, ecrime_kill_chain.crimes, "
         "ecrime_kill_chain.customers, ecrime_kill_chain.marketing, ecrime_kill_chain.monetization, "
         "ecrime_kill_chain.services_offered, ecrime_kill_chain.services_used, ecrime_kill_chain.technical_tradecraft, "
         "ecrime_kill_chain.victims, first_activity_date, group, group.id, group.slug, group.value, id, "
@@ -183,12 +183,13 @@ _intel_endpoints = [
       {
         "type": "string",
         "description": "Filter your query by specifying FQL filter parameters. Filter parameters "
-        "include:\n\nactors, actors.id, actors.name, actors.slug, actors.url, created_date, description, id, "
-        "last_modified_date, malware, malware.community_identifiers, malware.family_name, malware.slug, motivations, "
-        "motivations.id, motivations.slug, motivations.value, name, name.raw, short_description, slug, sub_type, "
-        "sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, tags.value, target_countries, "
-        "target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, "
-        "target_industries.slug, target_industries.value, type, type.id, type.name, type.slug, url.",
+        "include:\n\nactors, actors.animal_classifier, actors.id, actors.name, actors.slug, actors.url, created_date, "
+        "description, id, last_modified_date, malware, malware.community_identifiers, malware.family_name, "
+        "malware.slug, motivations, motivations.id, motivations.slug, motivations.value, name, name.raw, "
+        "short_description, slug, sub_type, sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, "
+        "tags.value, target_countries, target_countries.id, target_countries.slug, target_countries.value, "
+        "target_industries, target_industries.id, target_industries.slug, target_industries.value, type, type.id, "
+        "type.name, type.slug, url.",
         "name": "filter",
         "in": "query"
       },
@@ -525,8 +526,8 @@ _intel_endpoints = [
       {
         "type": "string",
         "description": "Filter your query by specifying FQL filter parameters. Filter parameters "
-        "include:\n\nactor_type, capabilities, capability, capability.id, capability.slug, capability.value, "
-        "created_date, description, ecrime_kill_chain.attribution, ecrime_kill_chain.crimes, "
+        "include:\n\nactor_type, animal_classifier, capabilities, capability, capability.id, capability.slug, "
+        "capability.value, created_date, description, ecrime_kill_chain.attribution, ecrime_kill_chain.crimes, "
         "ecrime_kill_chain.customers, ecrime_kill_chain.marketing, ecrime_kill_chain.monetization, "
         "ecrime_kill_chain.services_offered, ecrime_kill_chain.services_used, ecrime_kill_chain.technical_tradecraft, "
         "ecrime_kill_chain.victims, first_activity_date, group, group.id, group.slug, group.value, id, "
@@ -718,12 +719,13 @@ _intel_endpoints = [
       {
         "type": "string",
         "description": "Filter your query by specifying FQL filter parameters. Filter parameters "
-        "include:\n\nactors, actors.id, actors.name, actors.slug, actors.url, created_date, description, id, "
-        "last_modified_date, malware, malware.community_identifiers, malware.family_name, malware.slug, motivations, "
-        "motivations.id, motivations.slug, motivations.value, name, name.raw, short_description, slug, sub_type, "
-        "sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, tags.value, target_countries, "
-        "target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, "
-        "target_industries.slug, target_industries.value, type, type.id, type.name, type.slug, url.",
+        "include:\n\nactors, actors.animal_classifier, actors.id, actors.name, actors.slug, actors.url, created_date, "
+        "description, id, last_modified_date, malware, malware.community_identifiers, malware.family_name, "
+        "malware.slug, motivations, motivations.id, motivations.slug, motivations.value, name, name.raw, "
+        "short_description, slug, sub_type, sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, "
+        "tags.value, target_countries, target_countries.id, target_countries.slug, target_countries.value, "
+        "target_industries, target_industries.id, target_industries.slug, target_industries.value, type, type.id, "
+        "type.name, type.slug, url.",
         "name": "filter",
         "in": "query"
       },

{crowdstrike_falconpy_dev-1.5.0 → crowdstrike_falconpy_dev-1.5.2}/src/falconpydev/_endpoint/_intelligence_indicator_graph.py

@@ -37,6 +37,20 @@ For more information, please refer to <https://unlicense.org>
 """
 
 _intelligence_indicator_graph_endpoints = [
+  [
+    "GetIndicatorAggregates",
+    "POST",
+    "/intelligence/aggregates/indicators/v1",
+    "Get aggregates for indicators based on requests",
+    "intelligence_indicator_graph",
+    [
+      {
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ],
   [
     "SearchIndicators",
     "POST",