crowdstrike-falconpy-dev 1.5.1__tar.gz → 1.5.2__tar.gz

{crowdstrike_falconpy_dev-1.5.1 → crowdstrike_falconpy_dev-1.5.2}/CHANGELOG.md

@@ -1,3 +1,46 @@
+# Version 1.5.2
+## Added features and functionality
++ Updated: Updated `import_definition` (_WorkflowDefinitionsImport_ operation) method to allow for raw YAML file data to be passed to the `data_file` keyword within the __Workflows__ Service Class. Closes #1341.
+    - `workflows.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_workflows.py`
+    - Thanks go out to @jbfuzier for suggesting this update. 🙇
+
++ Updated: Expanded error handling for context manager usage scenarios.
+    - `_auth_object/_uber_interface.py`
+    - `_service_class/_service_class.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_service_class.py`
+    - `tests/test_uber.py`
+
++ Updated: Updated default `limit` for the _ReadCombinedVulnerabilitiesDetails_ operation from 100 to 5000 within the __Container Vulnerabilities__ service collection.
+    - `_endpoint/_container_vulnerabilities.py`
+
++ Added: Added `temporarily_assigned_cids` as an allowed value for the `filter` parameter in the _queryUserV1_ operation within the __User Management__ service collection.
+    - `_endpoint/_user_management.py`
+    - `user_management.py`
+
++ Added: Added new _GetIndicatorAggregates_ operation to the __Intelligence Indicator Graph__ service collection.
+    - `_endpoint/_intelligence_indicator_graph.py`
+    - `intelligence_indicator_graph.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_intelligence_indicator_graph.py`
+
+## Issues resolved
++ Fixed: Restored incorrectly removed values from the __PREFER_IDS_IN_BODY__ constant. Closes #1344.
+    - `_constant/__init__.py`
+    - Thanks go out to @agburch for identifying this issue! 🙇
+
+## Other
++ Updated: Updated `generate_error_result` method to handle context manager and pythonic scenarios.
+    - `_util/_functions.py`
+
++ Updated: Cosmetic updates to the `filter` parameter for the _cloud_security_registration_oci_get_account_ operation within the __Cloud OCI Registration__ service collection.
+    - `_endpoint/_cloud_oci_registration.py`
+    - `_endpoint/deprecated/_cloud_oci_registration.py`
+
+---
+
 # Version 1.5.1
 ## Added features and functionality
 + Added: Added the _CreateFileV1_ and _UpdateFileV1_ operations to the __Foundry LogScale__ service collection.
@@ -58,6 +101,13 @@
     - `_util/_uber.py`
     - Thanks go out to @Gage-BCCA for submitting this fix! 🙇
 
++ Updated: Expanded the operations covered by the PREFER_IDS_IN_BODY constant.
+    - `_constant/__init__.py`
+
++ Updated: Updated the `data_payload` payload handler for operations within __Real Time Response__ service collections to allow for blank parameter values. Closes #1339.
+    - `_payload/_real_time_response.py`
+    - Thanks go out to @jbfuzier for reporting this issue! 🙇
+
 ## Other
 + Updated: Cosmetic updates to enum and parameter descriptions in the _GetMigrationIDsV1_ and _GetHostMigrationIDsV1_ operations within the __Host Migration__ service collection.
     - `_endpoint/_host_migration.py`

{crowdstrike_falconpy_dev-1.5.1 → crowdstrike_falconpy_dev-1.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crowdstrike-falconpy-dev
-Version: 1.5.1
+Version: 1.5.2
 Summary: The CrowdStrike Falcon SDK for Python
 Project-URL: Documentation, https://www.falconpy.io
 Project-URL: Homepage, https://github.com/CrowdStrike/falconpy

{crowdstrike_falconpy_dev-1.5.1 → crowdstrike_falconpy_dev-1.5.2}/src/falconpydev/_auth_object/_uber_interface.py

@@ -35,6 +35,7 @@ OTHER DEALINGS IN THE SOFTWARE.
 
 For more information, please refer to <https://unlicense.org>
 """
+from traceback import extract_tb
 from typing import Dict, List, Optional, Union
 from ._falcon_interface import FalconInterface
 from .._constant import MAX_DEBUG_RECORDS
@@ -156,10 +157,19 @@ class UberInterface(FalconInterface):
         """Allow for entry as a context manager."""
         return self
 
-    def __exit__(self, *args):
-        """Discard our token when we exit the context."""
+    def __exit__(self, exc_type, exc_val, exc_tb):
+        """Discard our token when we exit the context and handle any errors."""
+        if exc_type is not None:
+            if self.log:
+                # Log the error and traceback detail
+                self.log.error("ERROR: [%s] %s", exc_type.__name__, exc_val)
+                frame_list = extract_tb(exc_tb)
+                frame = frame_list[len(frame_list)-1]
+                lineno = frame.lineno
+                func = frame.name
+                fname = frame.filename
+                self.log.error("LOCATION: %s, Line #%i in Function '%s'", fname, lineno, func)
         self.logout()
-        return args
 
     # Legacy property getters maintained for backwards functionality.
     def authenticated(self) -> bool:

{crowdstrike_falconpy_dev-1.5.1 → crowdstrike_falconpy_dev-1.5.2}/src/falconpydev/_constant/__init__.py

@@ -43,10 +43,21 @@ PREFER_NONETYPE: List[str] = [
     "RTR_DeleteSession"
 ]
 PREFER_IDS_IN_BODY: List[str] = [
-    "GetDeviceDetails", "PostDeviceDetailsV2", "GetVulnerabilities", "GetIntelIndicatorEntities",
-    "getChildrenV2", "cancel-scans", "GetDetectSummaries", "UpdateQuarantinedDetectsByIds",
-    "GetQuarantineFiles", "PostEntitiesAlertsV1", "CreateSavedSearchesDeployV1",
-    "WorkflowExecutionsAction", "signalChangesExternal"
+    "GetBehaviors", "GetCaseActivityByIds", "GetCaseEntitiesByIDs", "GetDetectSummaries",
+    "GetEventsEntities", "GetHostMigrationsV1", "GetIncidents", "GetIntelIndicatorEntities",
+    "GetQuarantineFiles", "GetRulesEntities", "GetSensorDetails", "GetVulnerabilities",
+    "HostMigrationsActionsV1", "MigrationsActionsV1", "PatchEntitiesAlertsV2", "PerformActionV2",
+    "PerformIncidentAction", "PostDeviceDetailsV2", "PostEntitiesAlertsV1", "PostMitreAttacks",
+    "QueryDeviceLoginHistory", "QueryDeviceLoginHistoryV2", "QueryGetNetworkAddressHistoryV1",
+    "RTR_ListQueuedSessions", "RTR_ListSessions", "UpdateDetectsByIdsV2", "cancel_scans",
+    "UpdateQuarantinedDetectsByIds", "WorkflowExecutionsAction", "get_rules_get", "getChildrenV2",
+    "performContentUpdatePoliciesAction", "performDeviceControlPoliciesAction", "userActionV1",
+    "performFirewallPoliciesAction", "performGroupAction", "performPreventionPoliciesAction",
+    "performRTResponsePoliciesAction", "performSensorUpdatePoliciesAction", "retrieveUsersGETV1",
+    "setContentUpdatePoliciesPrecedence", "setDeviceControlPoliciesPrecedence",
+    "setFirewallPoliciesPrecedence", "setPreventionPoliciesPrecedence", "signalChangesExternal",
+    "setRTResponsePoliciesPrecedence", "setSensorUpdatePoliciesPrecedence", "GetDeviceDetails",
+    "CreateSavedSearchesDeployV1", "cancel-scans", "get-rules-get"
 ]
 MOCK_OPERATIONS: List[str] = [
     "GetImageAssessmentReport", "DeleteImageDetails", "ImageMatchesPolicy"

{crowdstrike_falconpy_dev-1.5.1 → crowdstrike_falconpy_dev-1.5.2}/src/falconpydev/_endpoint/_cloud_oci_registration.py

@@ -47,7 +47,7 @@ _cloud_oci_registration_endpoints = [
       {
         "type": "string",
         "description": "FQL (Falcon Query Language) string for filtering results. Allowed filters are "
-        "Set{updated_at, tenancy_ocid, tenancy_name, home_region, key_age, overall_status, created_at}",
+        "Set{overall_status, created_at, updated_at, tenancy_ocid, tenancy_name, home_region, key_age}",
         "name": "filter",
         "in": "query"
       },

{crowdstrike_falconpy_dev-1.5.1 → crowdstrike_falconpy_dev-1.5.2}/src/falconpydev/_endpoint/_container_vulnerabilities.py

@@ -279,7 +279,7 @@ _container_vulnerabilities_endpoints = [
       },
       {
         "type": "integer",
-        "default": 100,
+        "default": 5000,
         "description": "The upper-bound on the number of records to retrieve.",
         "name": "limit",
         "in": "query"

{crowdstrike_falconpy_dev-1.5.1 → crowdstrike_falconpy_dev-1.5.2}/src/falconpydev/_endpoint/_intelligence_indicator_graph.py

@@ -37,6 +37,20 @@ For more information, please refer to <https://unlicense.org>
 """
 
 _intelligence_indicator_graph_endpoints = [
+  [
+    "GetIndicatorAggregates",
+    "POST",
+    "/intelligence/aggregates/indicators/v1",
+    "Get aggregates for indicators based on requests",
+    "intelligence_indicator_graph",
+    [
+      {
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ],
   [
     "SearchIndicators",
     "POST",

{crowdstrike_falconpy_dev-1.5.1 → crowdstrike_falconpy_dev-1.5.2}/src/falconpydev/_endpoint/_user_management.py

@@ -377,7 +377,8 @@ _user_management_endpoints = [
       {
         "type": "string",
         "description": "Filter using a query in Falcon Query Language (FQL). Supported filters: assigned_cids, "
-        "cid, direct_assigned_cids, factors, first_name, has_temporary_roles, last_name, name, status, uid",
+        " cid, direct_assigned_cids, factors, first_name, has_temporary_roles, last_name, name, status, "
+        "temporarily_assigned_cids, uid",
         "name": "filter",
         "in": "query"
       },
@@ -416,6 +417,8 @@ _user_management_endpoints = [
           "name|desc",
           "status|asc",
           "status|desc",
+          "temporarily_assigned_cids|asc",
+          "temporarily_assigned_cids|desc",
           "uid|asc",
           "uid|desc"
         ],

{crowdstrike_falconpy_dev-1.5.1 → crowdstrike_falconpy_dev-1.5.2}/src/falconpydev/_endpoint/deprecated/_cloud_oci_registration.py

@@ -47,7 +47,7 @@ _cloud_oci_registration_endpoints = [
       {
         "type": "string",
         "description": "FQL (Falcon Query Language) string for filtering results. Allowed filters are "
-        "Set{updated_at, tenancy_ocid, tenancy_name, home_region, key_age, overall_status, created_at}",
+        "Set{overall_status, created_at, updated_at, tenancy_ocid, tenancy_name, home_region, key_age}",
         "name": "filter",
         "in": "query"
       },

{crowdstrike_falconpy_dev-1.5.1 → crowdstrike_falconpy_dev-1.5.2}/src/falconpydev/_payload/_real_time_response.py

@@ -114,7 +114,7 @@ def data_payload(passed_keywords: dict) -> dict:
         "content", "platform", "permission_type"
         ]
     for key in keys:
-        if passed_keywords.get(key, None):
+        if passed_keywords.get(key, None) is not None:
             returned_payload[key] = passed_keywords.get(key, None)
 
     return returned_payload

{crowdstrike_falconpy_dev-1.5.1 → crowdstrike_falconpy_dev-1.5.2}/src/falconpydev/_service_class/_service_class.py

@@ -35,6 +35,7 @@ OTHER DEALINGS IN THE SOFTWARE.
 
 For more information, please refer to <https://unlicense.org>
 """
+from traceback import extract_tb
 from typing import Dict, Type, Optional, Union
 from ._base_service_class import BaseServiceClass
 from .._auth_object import FalconInterface
@@ -239,10 +240,19 @@ class ServiceClass(BaseServiceClass):
         """Allow for entry as a context manager."""
         return self
 
-    def __exit__(self, *args):
-        """Discard our token when we exit the context."""
+    def __exit__(self, exc_type, exc_val, exc_tb):
+        """Discard our token when we exit the context and handle any errors."""
+        if exc_type is not None:
+            if self.log:
+                # Log the error and traceback detail
+                self.log.error("ERROR: [%s] %s", exc_type.__name__, exc_val)
+                frame_list = extract_tb(exc_tb)
+                frame = frame_list[len(frame_list)-1]
+                lineno = frame.lineno
+                func = frame.name
+                fname = frame.filename
+                self.log.error("LOCATION: %s, Line #%i in Function '%s'", fname, lineno, func)
         self.logout()
-        return args
 
     # ___  ____ ____ ___  ____ ____ ___ _ ____ ____
     # |__] |__/ |  | |__] |___ |__/  |  | |___ [__

{crowdstrike_falconpy_dev-1.5.1 → crowdstrike_falconpy_dev-1.5.2}/src/falconpydev/_util/_functions.py

@@ -534,6 +534,15 @@ def generate_error_result(
         ) -> dict:
     """Normalize error messages."""
     return_headers = kwargs.get("headers", {})
+    caller: ServiceClass = kwargs.get("caller", None)
+    if caller:
+        pythonic_handling = caller.pythonic
+        log_handler: Logger = caller.log
+        if log_handler:
+            log_handler.error("ERROR: [%i] %s", code, message)
+        if pythonic_handling:
+            raise SDKError(code=code, message=message, headers=return_headers)
+
     return Result()(status_code=code, headers=return_headers, body={"errors": [{"message": f"{message}"}], "resources": []})
 
 

{crowdstrike_falconpy_dev-1.5.1 → crowdstrike_falconpy_dev-1.5.2}/src/falconpydev/_version.py

@@ -35,7 +35,7 @@ OTHER DEALINGS IN THE SOFTWARE.
 
 For more information, please refer to <https://unlicense.org>
 """
-_VERSION = '1.5.1'
+_VERSION = '1.5.2'
 _HEC_VERSION = '1.0.0'
 _MAINTAINER = 'Joshua Hiller'
 _AUTHOR = 'CrowdStrike'

{crowdstrike_falconpy_dev-1.5.1 → crowdstrike_falconpy_dev-1.5.2}/src/falconpydev/intelligence_indicator_graph.py

@@ -37,7 +37,7 @@ For more information, please refer to <https://unlicense.org>
 """
 from typing import Dict, Union
 from ._util import force_default, process_service_request
-from ._payload import indicator_graph_payload
+from ._payload import indicator_graph_payload, aggregate_payload
 from ._result import Result
 from ._service_class import ServiceClass
 from ._endpoint._intelligence_indicator_graph import _intelligence_indicator_graph_endpoints as Endpoints
@@ -56,6 +56,99 @@ class IntelligenceIndicatorGraph(ServiceClass):
     - a valid token provided by the authentication service class (oauth2.py)
     """
 
+    @force_default(defaults=["body"], default_types=["dict"])
+    def aggregate_indicators(self: object,
+                             body: dict = None,
+                             **kwargs
+                             ) -> Union[Dict[str, Union[int, dict]], Result]:
+        """Get indicator aggregates.
+
+        Keyword arguments:
+        body -- full body payload, not required when using other keywords.
+                {
+                    "requests": [
+                        {
+                            "date_ranges": [
+                            {
+                                "from": "string",
+                                "to": "string"
+                            }
+                            ],
+                            "exclude": "string",
+                            "extended_bounds": {
+                                "max": "string",
+                                "min": "string"
+                            }
+                            "field": "string",
+                            "filter": "string",
+                            "from": integer,
+                            "include": "string",
+                            "interval": "string",
+                            "max_doc_count": integer,
+                            "min_doc_count": integer,
+                            "missing": "string",
+                            "name": "string",
+                            "q": "string",
+                            "ranges": [
+                            {
+                                "From": integer,
+                                "To": integer
+                            }
+                            ],
+                            "size": integer,
+                            "sort": "string",
+                            "sub_aggregates": [
+                                null
+                            ],
+                            "time_zone": "string",
+                            "type": "string"
+                        }
+                    ]
+                }
+        date_ranges -- If peforming a date range query specify the from and to date ranges.
+                       These can be in common date formats like 2019-07-18 or now.
+                       List of dictionaries.
+        exclude -- Fields to exclude. String.
+        extended_bounds -- Extended bounds. Dictionary containing "min" and "max" as strings.
+        field -- Term you want to aggregate on. If doing a date_range query,
+                 this is the date field you want to apply the date ranges to. String.
+        filter -- Optional filter criteria in the form of an FQL query.
+                  For more information about FQL queries, see our FQL documentation in Falcon.
+                  String.
+        from -- Integer.
+        include -- Fields to include. String.
+        interval -- String.
+        max_doc_count -- Maximum number of documents. Integer.
+        min_doc_count -- Minimum number of documents. Integer.
+        missing -- String.
+        name -- Scan name. String.
+        q -- FQL syntax. String.
+        ranges -- List of dictionaries.
+        size -- Integer.
+        sort -- FQL syntax. String.
+        sub_aggregates -- List of strings.
+        time_zone -- String.
+        type -- String.
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: POST
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/user-management/aggregateUsersV1
+        """
+        if not body:
+            body = {"requests": [aggregate_payload(submitted_keywords=kwargs)]}
+
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="GetIndicatorAggregates",
+            body=body
+            )
+
     @force_default(defaults=["parameters", "body"], default_types=["dict", "dict"])
     def search(self: object,
                body: dict = None,
@@ -103,4 +196,5 @@ class IntelligenceIndicatorGraph(ServiceClass):
             body=body
             )
 
+    GetIndicatorAggregates = aggregate_indicators
     SearchIndicators = search

{crowdstrike_falconpy_dev-1.5.1 → crowdstrike_falconpy_dev-1.5.2}/src/falconpydev/user_management.py

@@ -687,7 +687,7 @@ class UserManagement(ServiceClass):
                 cid                     name
                 direct_assigned_cids    status
                 first_name              uid
-                has_temporary_roles
+                has_temporary_roles     temporarily_assigned_cids
         limit : int (range 1-500, default 0)
             The maximum number of records to return.
         offset : int (default 0)

{crowdstrike_falconpy_dev-1.5.1 → crowdstrike_falconpy_dev-1.5.2}/src/falconpydev/workflows.py

@@ -35,6 +35,8 @@ OTHER DEALINGS IN THE SOFTWARE.
 
 For more information, please refer to <https://unlicense.org>
 """
+import re
+from os.path import exists
 from typing import Dict, Union
 from ._util import (
     force_default,
@@ -249,7 +251,8 @@ class Workflows(ServiceClass):
         """Import a workflow definition based on the provided model.
 
         Keyword arguments:
-        data_file -- A workflow definition in YAML format to import. Binary data.
+        data_file -- A workflow definition in YAML format to import. Can be the file location or file contents.
+                     Supports string or binary data.
         name -- Workflow name to override. String.
         validate_only -- When enabled, prevents saving workflow after validating. Boolean.
         parameters -- Full parameters payload dictionary. Not required if using other keywords.
@@ -265,16 +268,29 @@ class Workflows(ServiceClass):
         """
         data_file = kwargs.get("data_file", None)
         content_type = "application/x-yaml"
-        # Create a multipart form payload for our upload file
-        try:
+        # Retrieve data file contents from the specified location
+        valid_format = False
+        if exists(data_file):
             with open(data_file, "r", encoding="utf-8") as yaml_file:
                 file_data = yaml_file.read()
-                file_extended = [("data_file", ("yaml_upload", file_data, content_type))]
-        except FileNotFoundError:
-            data_file = None
-        # Remove the data file from the keywords dictionary before args_to_params
-        kwargs.pop("data_file")
-        if data_file and file_data:
+        else:
+            # Assume file contents are provided instead, can handle string or binary data
+            file_data = data_file
+            if isinstance(data_file, bytes):
+                file_data = data_file.decode()
+        if file_data:
+            # Check yaml formatting
+            # Look for key: value pairs
+            if re.search(r'\s*:\s*[^:\n]+', file_data):
+                valid_format = True
+            # Look for list items
+            if re.search(r'-\s+.*', file_data):
+                valid_format = True
+        if valid_format:
+            # Create a multipart form payload for our upload file
+            file_extended = [("data_file", ("yaml_upload", file_data, content_type))]
+            # Remove the data file from the keywords dictionary before args_to_params processing
+            kwargs.pop("data_file")
             returned = process_service_request(
                         calling_object=self,
                         endpoints=Endpoints,
@@ -284,7 +300,10 @@ class Workflows(ServiceClass):
                         files=file_extended
                         )
         else:
-            returned = generate_error_result("You must provide a workflow file in YAML format to import.")
+            returned = generate_error_result(
+                "You must provide a workflow file in YAML format or a workfile location to import.",
+                caller=self
+                )
 
         return returned
 

{crowdstrike_falconpy_dev-1.5.1 → crowdstrike_falconpy_dev-1.5.2}/tests/test.yml

@@ -2,3 +2,6 @@
 
 name: Test-Workflow
 description: Generic test workflow
+stuff:
+  - Thing1
+  - Thing2

{crowdstrike_falconpy_dev-1.5.1 → crowdstrike_falconpy_dev-1.5.2}/tests/test_identity_protection.py

@@ -18,34 +18,57 @@ config = auth.getConfigObject()
 falcon = IdentityProtection(auth_object=config)
 AllowedResponses = [200, 400, 429]
 
+# TEST_QUERY = r"""query ($after: Cursor) {
+#   entities(types: [USER], archived: false, learned: false, first: 5, after: $after) {
+#     nodes {
+#       primaryDisplayName
+#       secondaryDisplayName
+#       accounts {
+#         ... on ActiveDirectoryAccountDescriptor {
+#           domain
+#         }
+#       }
+#     }
+#     pageInfo {
+#       hasNextPage
+#       endCursor
+#     }
+#   }
+# }"""
+
 TEST_QUERY = """
-query ($after: Cursor) {
-  entities(types: [USER], archived: false, learned: false, first: 5, after: $after) {
-    nodes {
-      primaryDisplayName
-      secondaryDisplayName
-      accounts {
-        ... on ActiveDirectoryAccountDescriptor {
-          domain
-        }
-      }
-    }
+{
+  entities (   
+    roles: [BuiltinAdministratorRole]
+    sortKey: PRIMARY_DISPLAY_NAME
+    sortOrder: ASCENDING
+    # Limit the response to two records:
+    first: 2
+  )
+  {
+    # Include pageInfo properties for pagination:  
     pageInfo {
+      # Are there more results to obtain?  
       hasNextPage
+      # Identify the last records in the results:
       endCursor
     }
+    nodes {
+      primaryDisplayName
+      secondaryDisplayName
+    }
   }
 }
 """
-
 class TestIdentityProtection:
     def idp_graphql(self):
         payload = {"query":"{\n  entities(first: 1)\n  {\n    nodes {\n      entityId    \n    }\n  }\n}"}
-        result = falcon.GraphQL(query=TEST_QUERY, variables={"after", ""})
+        result = falcon.GraphQL(query=TEST_QUERY, variables={"after": "$after"})
         if not isinstance(result, dict):
             result = json.loads(result.decode())
         else:
             result = result["body"]
+
         if result.get("data", {}).get("entities", {}).get("pageInfo", {}).get("hasNextPage", None):
             next_page = result["data"].get("entities", {}).get("pageInfo", {}).get("endCursor", None)
             result = falcon.graphql(query=TEST_QUERY, variables={"after": next_page})["body"]

{crowdstrike_falconpy_dev-1.5.1 → crowdstrike_falconpy_dev-1.5.2}/tests/test_intelligence_indicator_graph.py

@@ -5,6 +5,7 @@
 import os
 import sys
 import pytest
+from urllib.parse import urlparse
 # Authentication via the test_authorization.py
 from tests import test_authorization as Authorization
 
@@ -16,7 +17,7 @@ from falconpy import IntelligenceIndicatorGraph
 auth = Authorization.TestAuthorization()
 config = auth.getConfigObject()
 falcon = IntelligenceIndicatorGraph(auth_object=config)
-AllowedResponses = [200, 201, 207, 400, 403, 429]
+AllowedResponses = [200, 201, 207, 400, 401, 403, 429]
 
 
 class TestIntelligenceIndicatorGraph:
@@ -28,6 +29,11 @@ class TestIntelligenceIndicatorGraph:
         tests = {
             "SearchIndicators": falcon.search(filter="indicator:'malware.ru'", limit=1, sort={"order": "desc"})
         }
+        if urlparse(config.base_url).hostname == "api.crowdstrike.com":
+            tests["GetIndicatorAggregates"] = falcon.aggregate_indicators(field="string",
+                                                                          filter="string",
+                                                                          interval="string"
+                                                                          )
         for key in tests:
             if tests[key]["status_code"] not in AllowedResponses:
                 error_checks = False

{crowdstrike_falconpy_dev-1.5.1 → crowdstrike_falconpy_dev-1.5.2}/tests/test_service_class.py

@@ -21,10 +21,12 @@ from falconpy import (
     FunctionalityNotImplemented,
     SSLDisabledWarning,
     APIError,
+    SDKError,
     NoAuthenticationMechanism,
     Result,
     ExpandedResult,
-    InvalidBaseURL
+    InvalidBaseURL,
+    Workflows
     )
 
 auth = Authorization.TestAuthorization()
@@ -130,6 +132,19 @@ class TestServiceClass:
                 _success = True
         assert _success
 
+    @rate_limited
+    @not_supported
+    def test_service_class_context_manager_with_pythonic_error(self):
+        _success = False
+        new_sdk = Workflows(creds=config.creds, base_url=config.base_url, pythonic=True, debug=True)
+        try:
+            with new_sdk as sdk:
+                result = sdk.import_definition(data_file="InvalidDataFile")
+                raise SDKError(code=500, message="Unit testing")
+        except SDKError:
+            _success = True
+        assert _success
+
     @rate_limited
     @not_supported
     def test_property_refreshable(self):

{crowdstrike_falconpy_dev-1.5.1 → crowdstrike_falconpy_dev-1.5.2}/tests/test_uber.py

@@ -12,7 +12,7 @@ sys.path.append(os.path.abspath('src'))
 # flake8: noqa=E402
 # pylint: disable=C0103
 # Classes to test - manually imported from our sibling folder
-from falconpy import APIHarnessV2, APIError
+from falconpy import APIHarnessV2, APIError, SDKError
 # Import perform_request from _util so we can test generating 405's directly
 from falconpy._util import perform_request, force_default
 
@@ -52,6 +52,22 @@ class TestUber:
                 _success = True
         assert _success
 
+    def test_uber_context_with_pythonic_error(self):
+        _success = False
+        test_uber = APIHarnessV2(client_id=config["falcon_client_id"],
+                                 client_secret=config["falcon_client_secret"],
+                                 base_url=config["falcon_base_url"],
+                                 pythonic=True,
+                                 debug=True
+                                 )
+        try:
+            with test_uber as sdk:
+                raise SDKError(code=500, message="Unit testing")
+        except (SDKError, APIError):
+            _success = True
+
+        assert _success
+
     def uberCCAWS_GetAWSSettings(self):
         returned = False
         authenticated = falcon.authenticated()

{crowdstrike_falconpy_dev-1.5.1 → crowdstrike_falconpy_dev-1.5.2}/tests/test_workflows.py

@@ -17,6 +17,8 @@ config = auth.getConfigObject()
 falcon = Workflows(auth_object=config)
 AllowedResponses = [200, 201, 400, 403, 404, 415, 500, 502]  # Allowing 415 due to workflow import
 
+with open("tests/test.yml", "rb") as file_data:
+    binary_example = file_data.read()
 
 class TestWorkflows:
     def run_all_tests(self):
@@ -39,6 +41,7 @@ class TestWorkflows:
             "WorkflowDefinitionsImport2": falcon.import_definition(validate_only=True, file_data="this_will_500"),
             "WorkflowDefinitionsImport3": falcon.import_definition(validate_only=True, data_file="not_here.yml"),
             "WorkflowDefinitionsImport4": falcon.import_definition(validate_only=True, data_file="tests/test.yml", name="workflow_name"),
+            "WorkflowDefinitionsImport4": falcon.import_definition(validate_only=True, data_file=binary_example, name="workflow_name"),
             "WorkflowDefinitionsUpdate": falcon.update_definition(change_log="testing"),
             "WorkflowGetHumanInputV1": falcon.get_human_input(ids="1234567"),
             "WorkflowUpdateHumanInputV1": falcon.update_human_input(input="whatever", note="whatever"),