crowdstrike-falconpy-dev 1.5.2__tar.gz → 1.5.3__tar.gz

{crowdstrike_falconpy_dev-1.5.2 → crowdstrike_falconpy_dev-1.5.3}/CHANGELOG.md

@@ -1,3 +1,82 @@
+# Version 1.5.3
+## Added features and functionality
++ Added: Added new __Kubernetes Container Compliance__ service collection containing 11 new operations.
+    - _AggregateAssessmentsGroupedByClustersV2_
+    - _AggregateComplianceByAssetType_
+    - _AggregateComplianceByClusterType_
+    - _AggregateComplianceByFramework_
+    - _AggregateFailedRulesByClustersV3_
+    - _AggregateFailedRulesByClustersV3_
+    - _AggregateAssessmentsGroupedByRulesV2_
+    - _AggregateTopFailedImages_
+    - _CombinedImagesFindings_
+    - _CombinedNodesFindings_
+    - _getRulesMetadataByID_
+    - `_endpoint/__init__.py`
+    - `_endpoint/_kubernetes_container_compliance.py`
+    - `__init__.py`
+    - `kubernetes_container_compliance.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_kubernetes_container_compliance.py`
+
++ Added: New `filter` and `sort` parameter options added to the _cloud_security_assets_queries_ operation within the __Cloud Security Assets__ service collection.
+    - filter: `application_security.business_applications`
+    - filter: `application_security.business_criticality`
+    - filter: `application_security.service_names`
+    - filter: `tags`
+    - sort: `compartment_name`
+    - sort: `compartment_ocid`
+    - sort: `compartment_path`
+    - sort: `tenancy_name`
+    - sort: `tenancy_ocid`
+    - sort: `tenancy_type`
+    - `_endpoint/_cloud_security_assets.py`
+    - `_endpoint/deprecated/_cloud_security_assets.py`
+    - `cloud_security_assets.py`
+
++ Added: Added new `find_operation` helper.
+    - `_helper/__init__.py`
+    - `_helper/_find_operation.py`
+    - `__init__.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_helper.py`
+
++ Added: Added `filter` parameter to the _ReadContainerCountByRegistry_ operation within the __Kubernetes Protection__ service collection.
+    - `_endpoint/_kubernetes_protection.py`
+    - `kubernetes_protection.py`
+
+## Issues resolved
++ Fixed: Resolved issue with `file` parameter name in file tuples used for the _CreateFileV1_ and _UpdateFileV1_ operations within the __FoundryLogScale__ Service Class.
+    - `foundry_logscale.py`
+
++ Adjusted: Removed default values from HEC ingestion payload class that should be defined within the NGSIEM parser and not the event.
+    - `_ngsiem/_ingest_payload.py`
+
++ Fixed: Added `excluded_from` to the payload handler for exclusion payloads. Updated _createMLExclusionsV1_ docstring to reflect new functionality.
+    - `_payload/_generic.py`
+    - `ml_exclusions.py`
+
++ Fixed: Added `is_descendant_process` to the _updateMLExclusionsV1_ operation within the __ML Exclusions__ Service Class.
+    - `_payload/_generic.py`
+    - `ml_exclusions.py`
+
+## Other
++ Updated: Cosmetic updates to `filter` parameter descriptions in 11 operations within the __Container Image Compliance__ service collection.
+    - `_endpoint/_container_image_compliance.py`
+
++ Revised: Updated HTTP Event Collector (HEC) default ingestion payload handling to remove fields that should be handled by parsing.
+    - `_ngsiem/_ingest_payload.py`
+
++ Updated: Updated `filter` parameter description and docstring for the _QueryVulnerabilities_ operation within the __Intel__ service collection.
+    - `_endpoint/_intel.py`
+    - `intel.py`
+
++ Updated: Cosmetic updates to `filter` parameter description in the _cloud_security_registration_oci_get_account_ operation within the __Cloud OCI Registration__ service collection.
+    - `_endpoint/_cloud_oci_registration.py`
+    - `_endpoint/deprecated/_cloud_oci_registration.py`
+
+---
+
 # Version 1.5.2
 ## Added features and functionality
 + Updated: Updated `import_definition` (_WorkflowDefinitionsImport_ operation) method to allow for raw YAML file data to be passed to the `data_file` keyword within the __Workflows__ Service Class. Closes #1341.

{crowdstrike_falconpy_dev-1.5.2 → crowdstrike_falconpy_dev-1.5.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crowdstrike-falconpy-dev
-Version: 1.5.2
+Version: 1.5.3
 Summary: The CrowdStrike Falcon SDK for Python
 Project-URL: Documentation, https://www.falconpy.io
 Project-URL: Homepage, https://github.com/CrowdStrike/falconpy

{crowdstrike_falconpy_dev-1.5.2 → crowdstrike_falconpy_dev-1.5.3}/src/falconpydev/__init__.py

@@ -71,7 +71,10 @@ from ._error import (
     UnnecessaryEncodingUsed,
     DeprecatedClass,
     DeprecatedOperation,
-    SDKDeprecationWarning
+    SDKDeprecationWarning,
+    InvalidRoute,
+    InvalidServiceCollection,
+    InvalidOperationSearch
     )
 from ._result import (
     Result,
@@ -101,7 +104,7 @@ from ._ngsiem import (
     IngestConfig,
     SessionManager
 )
-from ._helper import random_string, Indicator, Color
+from ._helper import random_string, Indicator, Color, find_operation
 from .alerts import Alerts
 from .api_integrations import APIIntegrations
 from .api_complete import APIHarness, APIHarnessV2
@@ -161,6 +164,7 @@ from .intelligence_feeds import IntelligenceFeeds
 from .ioa_exclusions import IOAExclusions
 from .ioc import IOC
 from .iocs import Iocs
+from .kubernetes_container_compliance import KubernetesContainerCompliance
 from .kubernetes_protection import KubernetesProtection
 from .malquery import MalQuery
 from .message_center import MessageCenter
@@ -244,7 +248,8 @@ __all__ = [
     "DeviceContent", "IntelligenceIndicatorGraph", "ContentUpdatePolicies", "CAOHunting",
     "ContainerImageCompliance", "FaaSExecution", "HEC", "IngestBaseURL", "IngestFormat",
     "IngestPayload", "HTTPEventCollector", "IngestConfig", "SessionManager", "TimeUnit",
-    "Color", "Indicator", "random_string"
+    "Color", "Indicator", "random_string", "KubernetesContainerCompliance", "find_operation",
+    "InvalidRoute", "InvalidServiceCollection", "InvalidOperationSearch"
     ]
 """
 This is free and unencumbered software released into the public domain.

{crowdstrike_falconpy_dev-1.5.2 → crowdstrike_falconpy_dev-1.5.3}/src/falconpydev/_endpoint/__init__.py

@@ -104,6 +104,7 @@ from ._intel import _intel_endpoints
 from ._ioa_exclusions import _ioa_exclusions_endpoints
 from ._ioc import _ioc_endpoints
 from ._iocs import _iocs_endpoints
+from ._kubernetes_container_compliance import _kubernetes_container_compliance_endpoints
 from ._kubernetes_protection import _kubernetes_protection_endpoints
 from ._malquery import _malquery_endpoints
 from ._message_center import _message_center_endpoints
@@ -198,6 +199,7 @@ api_endpoints.extend(_intel_endpoints)
 api_endpoints.extend(_ioa_exclusions_endpoints)
 api_endpoints.extend(_ioc_endpoints)
 api_endpoints.extend(_iocs_endpoints)
+api_endpoints.extend(_kubernetes_container_compliance_endpoints)
 api_endpoints.extend(_kubernetes_protection_endpoints)
 api_endpoints.extend(_malquery_endpoints)
 api_endpoints.extend(_message_center_endpoints)

{crowdstrike_falconpy_dev-1.5.2 → crowdstrike_falconpy_dev-1.5.3}/src/falconpydev/_endpoint/_cloud_oci_registration.py

@@ -47,7 +47,7 @@ _cloud_oci_registration_endpoints = [
       {
         "type": "string",
         "description": "FQL (Falcon Query Language) string for filtering results. Allowed filters are "
-        "Set{overall_status, created_at, updated_at, tenancy_ocid, tenancy_name, home_region, key_age}",
+        "Set{home_region, key_age, overall_status, created_at, updated_at, tenancy_ocid, tenancy_name}",
         "name": "filter",
         "in": "query"
       },

{crowdstrike_falconpy_dev-1.5.2 → crowdstrike_falconpy_dev-1.5.3}/src/falconpydev/_endpoint/_cloud_security_assets.py

@@ -138,18 +138,19 @@ _cloud_security_assets_endpoints = [
       {
         "type": "string",
         "description": "FQL string to filter on asset contents. Filterable fields include:  account_id  "
-        "account_name  active  azure.vm_id  business_impact  cloud_group  cloud_label  cloud_label_id  cloud_provider  "
-        "cloud_scope  cluster_id  cluster_name  compartment_ocid  compliant.benchmark_name  compliant.benchmark_version "
-        "  compliant.framework  compliant.policy_id  compliant.requirement  compliant.rule  compliant.section  "
-        "configuration.id  creation_time  cve_ids  data_classifications.found  data_classifications.label  "
-        "data_classifications.label_id  data_classifications.scanned  data_classifications.tag  "
-        "data_classifications.tag_id  environment  exprt_ratings  first_seen  highest_severity  id  "
-        "insights.boolean_value  insights.id  instance_id  instance_state  ioa_count  iom_count  legacy_resource_id  "
-        "legacy_uuid  managed_by  non_compliant.benchmark_name  non_compliant.benchmark_version  "
+        "account_name  active  application_security.business_applications  application_security.business_criticality  "
+        "application_security.service_names  azure.vm_id  business_impact  cloud_group  cloud_label  cloud_label_id  "
+        "cloud_provider  cloud_scope  cluster_id  cluster_name  compartment_ocid  compliant.benchmark_name  "
+        "compliant.benchmark_version  compliant.framework  compliant.policy_id  compliant.requirement  compliant.rule  "
+        "compliant.section  configuration.id  creation_time  cve_ids  data_classifications.found  "
+        "data_classifications.label  data_classifications.label_id  data_classifications.scanned  "
+        "data_classifications.tag  data_classifications.tag_id  environment  exprt_ratings  first_seen  "
+        "highest_severity  id  insights.boolean_value  insights.id  instance_id  instance_state  ioa_count  iom_count  "
+        "legacy_resource_id  legacy_uuid  managed_by  non_compliant.benchmark_name  non_compliant.benchmark_version  "
         "non_compliant.framework  non_compliant.policy_id  non_compliant.requirement  non_compliant.rule  "
         "non_compliant.section  non_compliant.severity  organization_Id  os_version  platform_name  publicly_exposed  "
         "region  resource_id  resource_name  resource_type  resource_type_name  sensor_priority  service  "
-        "service_category  severity  snapshot_detections  ssm_managed  status  tag_key  tag_value  tenant_id  "
+        "service_category  severity  snapshot_detections  ssm_managed  status  tag_key  tag_value  tags  tenant_id  "
         "updated_at  vmware.guest_os_id  vmware.guest_os_version  vmware.host_system_name  vmware.host_type  "
         "vmware.instance_uuid  vmware.vm_host_name  vmware.vm_tools_status  zone",
         "name": "filter",
@@ -158,12 +159,13 @@ _cloud_security_assets_endpoints = [
       {
         "type": "string",
         "description": "The field to sort on.  Sortable fields include:  account_id  account_name  active  "
-        "cloud_provider  cluster_id  cluster_name  creation_time  data_classifications.found  "
-        "data_classifications.scanned  first_seen  id  instance_id  instance_state  ioa_count  iom_count  managed_by  "
-        "organization_Id  os_version  platform_name  publicly_exposed  region  resource_id  resource_name  "
-        "resource_type  resource_type_name  service  service_category  ssm_managed  status  tenant_id  updated_at  "
-        "vmware.guest_os_id  vmware.guest_os_version  vmware.host_system_name  vmware.host_type  vmware.instance_uuid  "
-        "vmware.vm_host_name  vmware.vm_tools_status  zone\n\nUse |asc or |desc suffix to specify sort direction.",
+        "cloud_provider  cluster_id  cluster_name  compartment_name  compartment_ocid  compartment_path  creation_time "
+        "  data_classifications.found  data_classifications.scanned  first_seen  id  instance_id  instance_state  "
+        "ioa_count  iom_count  managed_by  organization_Id  os_version  platform_name  publicly_exposed  region  "
+        "resource_id  resource_name  resource_type  resource_type_name  service  service_category  ssm_managed  status "
+        "  tenancy_name  tenancy_ocid  tenancy_type  tenant_id  updated_at  vmware.guest_os_id  vmware.guest_os_version "
+        "  vmware.host_system_name  vmware.host_type  vmware.instance_uuid  vmware.vm_host_name  vmware.vm_tools_status "
+        "zone\n\nUse |asc or |desc suffix to specify sort direction.",
         "name": "sort",
         "in": "query"
       },

{crowdstrike_falconpy_dev-1.5.2 → crowdstrike_falconpy_dev-1.5.3}/src/falconpydev/_endpoint/_container_image_compliance.py

@@ -47,10 +47,10 @@ _container_image_compliance_endpoints = [
       {
         "type": "string",
         "description": "Filter results using a query in Falcon Query Language (FQL). Supported "
-        "Filters:\ncloud_info.namespace: Kubernetes namespace\ncid: Customer ID\ncloud_info.cluster_name: Kubernetes "
-        "cluster name\ncloud_info.cloud_provider: Cloud provider\ncompliance_finding.framework: Compliance finding "
-        "framework (available values: CIS)\ncloud_info.cloud_region: Cloud region\ncloud_info.cloud_account_id: Cloud "
-        "account ID\n",
+        "Filters:\ncompliance_finding.framework: Compliance finding framework (available values: CIS)\ncid: Customer "
+        "ID\ncloud_info.cloud_account_id: Cloud account ID\ncloud_info.cloud_provider: Cloud "
+        "provider\ncloud_info.cloud_region: Cloud region\ncloud_info.cluster_name: Kubernetes cluster "
+        "name\ncloud_info.namespace: Kubernetes namespace\n",
         "name": "filter",
         "in": "query"
       }
@@ -66,14 +66,14 @@ _container_image_compliance_endpoints = [
       {
         "type": "string",
         "description": "Filter results using a query in Falcon Query Language (FQL). Supported "
-        "Filters:\nimage_repository: Image repository\ncloud_info.cloud_region: Cloud region\ncompliance_finding.id: "
-        "Compliance finding ID\ncompliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 "
-        "(4: critical, 3: high, 2: medium, 1:low)\ncompliance_finding.name: Compliance finding Name\ncid: Customer "
-        "ID\nimage_digest: Image digest (sha256 digest)\nasset_type: asset type (container, "
-        "image)\ncloud_info.namespace: Kubernetes namespace\ncompliance_finding.framework: Compliance finding framework "
-        " (available values: CIS)\ncloud_info.cloud_provider: Cloud provider\ncloud_info.cluster_name: Kubernetes "
-        "cluster name\nimage_id: Image ID\ncloud_info.cloud_account_id: Cloud account ID\nimage_tag: Image "
-        "tag\nimage_registry: Image registry\n",
+        "Filters:\nimage_digest: Image digest (sha256 digest)\nimage_id: Image ID\ncloud_info.cloud_region: Cloud "
+        "region\ncompliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, "
+        "3: high, 2: medium, 1:low)\ncompliance_finding.id: Compliance finding ID\ncloud_info.cluster_name: Kubernetes "
+        "cluster name\ncloud_info.namespace: Kubernetes namespace\nasset_type: asset type (container, "
+        "image)\nimage_registry: Image registry\ncloud_info.cloud_provider: Cloud provider\nimage_tag: Image "
+        "tag\ncloud_info.cloud_account_id: Cloud account ID\ncompliance_finding.framework: Compliance finding framework "
+        " (available values: CIS)\ncompliance_finding.name: Compliance finding Name\ncid: Customer "
+        "ID\nimage_repository: Image repository\n",
         "name": "filter",
         "in": "query"
       },
@@ -102,13 +102,13 @@ _container_image_compliance_endpoints = [
       {
         "type": "string",
         "description": "Filter results using a query in Falcon Query Language (FQL). Supported "
-        "Filters:\ncompliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, "
-        " 3: high, 2: medium, 1:low)\ncompliance_finding.id: Compliance finding ID\nimage_registry: Image "
-        "registry\ncloud_info.cluster_name: Kubernetes cluster name\nimage_id: Image ID\nimage_tag: Image "
-        "tag\ncompliance_finding.name: Compliance finding Name\ncloud_info.cloud_provider: Cloud "
-        "provider\ncloud_info.cloud_region: Cloud region\nimage_digest: Image digest (sha256 "
-        "digest)\ncompliance_finding.framework: Compliance finding framework (available values: CIS)\nimage_repository: "
-        "Image repository\ncid: Customer ID\ncloud_info.cloud_account_id: Cloud account ID\n",
+        "Filters:\ncloud_info.cloud_account_id: Cloud account ID\ncompliance_finding.severity: Compliance finding "
+        "severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1:low)\ncompliance_finding.name: "
+        "Compliance finding Name\nimage_tag: Image tag\ncloud_info.cloud_region: Cloud region\ncid: Customer "
+        "ID\nimage_registry: Image registry\nimage_digest: Image digest (sha256 digest)\ncompliance_finding.id: "
+        "Compliance finding ID\nimage_repository: Image repository\ncompliance_finding.framework: Compliance finding "
+        "framework (available values: CIS)\ncloud_info.cluster_name: Kubernetes cluster "
+        "name\ncloud_info.cloud_provider: Cloud provider\nimage_id: Image ID\n",
         "name": "filter",
         "in": "query"
       }
@@ -124,14 +124,13 @@ _container_image_compliance_endpoints = [
       {
         "type": "string",
         "description": "Filter results using a query in Falcon Query Language (FQL). Supported "
-        "Filters:\ncloud_info.cluster_name: Kubernetes cluster name\ncompliance_finding.name: Compliance finding "
-        "Name\ncloud_info.cloud_provider: Cloud provider\nimage_digest: Image digest (sha256 "
-        "digest)\ncloud_info.namespace: Kubernetes namespace\nimage_registry: Image registry\ncloud_info.cloud_region: "
-        "Cloud region\ncloud_info.cloud_account_id: Cloud account ID\nimage_tag: Image "
-        "tag\ncompliance_finding.framework: Compliance finding framework (available values: CIS)\nimage_repository: "
-        "Image repository\ncompliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: "
-        "critical, 3: high, 2: medium, 1:low)\ncompliance_finding.id: Compliance finding ID\ncid: Customer "
-        "ID\nimage_id: Image ID\n",
+        "Filters:\ncompliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, "
+        " 3: high, 2: medium, 1:low)\nimage_digest: Image digest (sha256 digest)\nimage_id: Image ID\nimage_tag: Image "
+        "tag\ncloud_info.cloud_region: Cloud region\nimage_registry: Image registry\nimage_repository: Image "
+        "repository\ncloud_info.cloud_account_id: Cloud account ID\ncloud_info.cloud_provider: Cloud "
+        "provider\ncompliance_finding.id: Compliance finding ID\ncloud_info.cluster_name: Kubernetes cluster "
+        "name\ncloud_info.namespace: Kubernetes namespace\ncid: Customer ID\ncompliance_finding.name: Compliance "
+        "finding Name\ncompliance_finding.framework: Compliance finding framework (available values: CIS)\n",
         "name": "filter",
         "in": "query"
       }
@@ -147,14 +146,13 @@ _container_image_compliance_endpoints = [
       {
         "type": "string",
         "description": "Filter results using a query in Falcon Query Language (FQL). Supported "
-        "Filters:\ncompliance_finding.framework: Compliance finding framework (available values: "
-        "CIS)\ncompliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: "
-        "high, 2: medium, 1:low)\ncompliance_finding.name: Compliance finding Name\ncloud_info.cloud_region: Cloud "
-        "region\ncloud_info.cluster_name: Kubernetes cluster name\ncompliance_finding.id: Compliance finding ID\ncid: "
-        "Customer ID\nimage_registry: Image registry\nimage_id: Image ID\nimage_digest: Image digest (sha256 "
-        "digest)\ncloud_info.cloud_account_id: Cloud account ID\ncloud_info.cloud_provider: Cloud "
-        "provider\nimage_repository: Image repository\ncloud_info.namespace: Kubernetes namespace\nimage_tag: Image "
-        "tag\n",
+        "Filters:\ncloud_info.cloud_provider: Cloud provider\ncompliance_finding.id: Compliance finding "
+        "ID\ncloud_info.cloud_region: Cloud region\nimage_registry: Image registry\nimage_digest: Image digest (sha256 "
+        "digest)\ncloud_info.cluster_name: Kubernetes cluster name\ncompliance_finding.severity: Compliance finding "
+        "severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1:low)\ncompliance_finding.name: "
+        "Compliance finding Name\ncloud_info.cloud_account_id: Cloud account ID\nimage_id: Image ID\nimage_repository: "
+        "Image repository\nimage_tag: Image tag\ncompliance_finding.framework: Compliance finding framework (available "
+        "values: CIS)\ncloud_info.namespace: Kubernetes namespace\ncid: Customer ID\n",
         "name": "filter",
         "in": "query"
       }
@@ -170,13 +168,14 @@ _container_image_compliance_endpoints = [
       {
         "type": "string",
         "description": "Filter results using a query in Falcon Query Language (FQL). Supported "
-        "Filters:\ncloud_info.namespace: Kubernetes namespace\ncompliance_finding.name: Compliance finding "
-        "Name\nimage_id: Image ID\ncloud_info.cluster_name: Kubernetes cluster name\nimage_digest: Image digest (sha256 "
-        " digest)\nimage_repository: Image repository\ncompliance_finding.framework: Compliance finding framework "
-        "(available values: CIS)\ncompliance_finding.id: Compliance finding ID\ncompliance_finding.severity: Compliance "
-        " finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, "
-        "1:low)\ncloud_info.cloud_region: Cloud region\ncloud_info.cloud_provider: Cloud provider\nimage_tag: Image "
-        "tag\nimage_registry: Image registry\ncloud_info.cloud_account_id: Cloud account ID\ncid: Customer ID\n",
+        "Filters:\ncloud_info.cloud_account_id: Cloud account ID\nimage_digest: Image digest (sha256 "
+        "digest)\ncompliance_finding.name: Compliance finding Name\ncompliance_finding.id: Compliance finding "
+        "ID\nimage_repository: Image repository\ncloud_info.cloud_region: Cloud region\ncompliance_finding.framework: "
+        "Compliance finding framework (available values: CIS)\ncloud_info.namespace: Kubernetes "
+        "namespace\ncloud_info.cloud_provider: Cloud provider\nimage_id: Image ID\nimage_registry: Image "
+        "registry\nimage_tag: Image tag\ncloud_info.cluster_name: Kubernetes cluster name\ncompliance_finding.severity: "
+        " Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1:low)\ncid: "
+        "Customer ID\n",
         "name": "filter",
         "in": "query"
       }
@@ -192,14 +191,14 @@ _container_image_compliance_endpoints = [
       {
         "type": "string",
         "description": "Filter results using a query in Falcon Query Language (FQL). Supported "
-        "Filters:\nimage_digest: Image digest (sha256 digest)\nimage_repository: Image repository\nimage_tag: Image "
-        "tag\ncloud_info.cloud_region: Cloud region\ncompliance_finding.severity: Compliance finding severity; "
+        "Filters:\ncloud_info.cluster_name: Kubernetes cluster name\ncloud_info.cloud_region: Cloud "
+        "region\ncompliance_finding.name: Compliance finding Name\nimage_tag: Image tag\ncloud_info.cloud_account_id: "
+        "Cloud account ID\ncompliance_finding.id: Compliance finding ID\nimage_repository: Image "
+        "repository\nimage_digest: Image digest (sha256 digest)\ncloud_info.namespace: Kubernetes namespace\ncid: "
+        "Customer ID\nimage_registry: Image registry\ncompliance_finding.severity: Compliance finding severity; "
         "available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1:low)\ncloud_info.cloud_provider: Cloud "
-        "provider\ncompliance_finding.framework: Compliance finding framework (available values: "
-        "CIS)\ncompliance_finding.id: Compliance finding ID\ncloud_info.cluster_name: Kubernetes cluster "
-        "name\ncloud_info.namespace: Kubernetes namespace\ncid: Customer ID\nimage_id: Image "
-        "ID\ncloud_info.cloud_account_id: Cloud account ID\nimage_registry: Image registry\ncompliance_finding.name: "
-        "Compliance finding Name\n",
+        "provider\nimage_id: Image ID\ncompliance_finding.framework: Compliance finding framework (available values: "
+        "CIS)\n",
         "name": "filter",
         "in": "query"
       }
@@ -215,14 +214,13 @@ _container_image_compliance_endpoints = [
       {
         "type": "string",
         "description": "Filter results using a query in Falcon Query Language (FQL). Supported "
-        "Filters:\nasset_type: asset type (container, image)\ncompliance_finding.framework: Compliance finding "
-        "framework (available values: CIS)\ncompliance_finding.id: Compliance finding ID\ncompliance_finding.severity: "
-        "Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, "
-        "1:low)\ncloud_info.cloud_region: Cloud region\nimage_id: Image ID\ncloud_info.cluster_name: Kubernetes cluster "
-        " name\ncid: Customer ID\nimage_registry: Image registry\nimage_digest: Image digest (sha256 "
-        "digest)\ncloud_info.cloud_account_id: Cloud account ID\ncloud_info.cloud_provider: Cloud "
-        "provider\nimage_repository: Image repository\nimage_tag: Image tag\ncompliance_finding.name: Compliance "
-        "finding Name\n",
+        "Filters:\ncloud_info.cloud_region: Cloud region\nimage_digest: Image digest (sha256 digest)\ncid: Customer "
+        "ID\nimage_id: Image ID\ncompliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 "
+        " (4: critical, 3: high, 2: medium, 1:low)\ncloud_info.cloud_account_id: Cloud account "
+        "ID\ncompliance_finding.id: Compliance finding ID\ncloud_info.cloud_provider: Cloud provider\nimage_registry: "
+        "Image registry\ncloud_info.cluster_name: Kubernetes cluster name\nimage_tag: Image tag\nasset_type: asset type "
+        " (container, image)\nimage_repository: Image repository\ncompliance_finding.framework: Compliance finding "
+        "framework (available values: CIS)\ncompliance_finding.name: Compliance finding Name\n",
         "name": "filter",
         "in": "query"
       }
@@ -238,14 +236,14 @@ _container_image_compliance_endpoints = [
       {
         "type": "string",
         "description": "Filter results using a query in Falcon Query Language (FQL). Supported "
-        "Filters:\nimage_tag: Image tag\ncompliance_finding.name: Compliance finding Name\nimage_registry: Image "
-        "registry\ncloud_info.cloud_region: Cloud region\ncloud_info.namespace: Kubernetes namespace\nimage_digest: "
-        "Image digest (sha256 digest)\ncloud_info.cloud_provider: Cloud provider\ncid: Customer "
-        "ID\ncloud_info.cloud_account_id: Cloud account ID\ncompliance_finding.framework: Compliance finding framework "
-        "(available values: CIS)\ncompliance_finding.id: Compliance finding ID\ncompliance_finding.severity: Compliance "
-        " finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, "
-        "1:low)\ncloud_info.cluster_name: Kubernetes cluster name\nimage_id: Image ID\nasset_type: asset type "
-        "(container, image)\nimage_repository: Image repository\n",
+        "Filters:\nimage_registry: Image registry\ncloud_info.cloud_region: Cloud region\ncompliance_finding.framework: "
+        " Compliance finding framework (available values: CIS)\ncompliance_finding.severity: Compliance finding "
+        "severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1:low)\ncompliance_finding.name: "
+        "Compliance finding Name\nimage_id: Image ID\ncloud_info.cloud_provider: Cloud "
+        "provider\ncloud_info.cluster_name: Kubernetes cluster name\ncid: Customer ID\nasset_type: asset type "
+        "(container, image)\ncompliance_finding.id: Compliance finding ID\ncloud_info.cloud_account_id: Cloud account "
+        "ID\nimage_digest: Image digest (sha256 digest)\ncloud_info.namespace: Kubernetes namespace\nimage_repository: "
+        "Image repository\nimage_tag: Image tag\n",
         "name": "filter",
         "in": "query"
       }
@@ -261,14 +259,13 @@ _container_image_compliance_endpoints = [
       {
         "type": "string",
         "description": "Filter results using a query in Falcon Query Language (FQL). Supported "
-        "Filters:\ncloud_info.cloud_account_id: Cloud account ID\ncloud_info.cloud_provider: Cloud "
-        "provider\nasset_type: asset type (container, image)\nimage_repository: Image "
-        "repository\ncloud_info.cloud_region: Cloud region\ncompliance_finding.name: Compliance finding Name\nimage_id: "
-        " Image ID\ncompliance_finding.id: Compliance finding ID\nimage_registry: Image registry\nimage_digest: Image "
-        "digest (sha256 digest)\nimage_tag: Image tag\ncompliance_finding.severity: Compliance finding severity; "
-        "available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1:low)\ncloud_info.cluster_name: Kubernetes "
-        "cluster name\ncid: Customer ID\ncompliance_finding.framework: Compliance finding framework (available values: "
-        "CIS)\n",
+        "Filters:\ncloud_info.cloud_region: Cloud region\ncompliance_finding.name: Compliance finding "
+        "Name\nimage_repository: Image repository\nimage_digest: Image digest (sha256 digest)\ncloud_info.cluster_name: "
+        " Kubernetes cluster name\ncompliance_finding.framework: Compliance finding framework (available values: "
+        "CIS)\nasset_type: asset type (container, image)\nimage_id: Image ID\ncloud_info.cloud_account_id: Cloud "
+        "account ID\ncompliance_finding.id: Compliance finding ID\ncompliance_finding.severity: Compliance finding "
+        "severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1:low)\ncid: Customer "
+        "ID\nimage_registry: Image registry\nimage_tag: Image tag\ncloud_info.cloud_provider: Cloud provider\n",
         "name": "filter",
         "in": "query"
       }
@@ -284,14 +281,14 @@ _container_image_compliance_endpoints = [
       {
         "type": "string",
         "description": "Filter results using a query in Falcon Query Language (FQL). Supported "
-        "Filters:\nasset_type: asset type (container, image)\nimage_repository: Image "
-        "repository\ncloud_info.cluster_name: Kubernetes cluster name\ncompliance_finding.name: Compliance finding "
-        "Name\ncid: Customer ID\ncompliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 "
-        " (4: critical, 3: high, 2: medium, 1:low)\ncloud_info.cloud_account_id: Cloud account ID\nimage_tag: Image "
-        "tag\ncompliance_finding.id: Compliance finding ID\nimage_registry: Image registry\ncontainer_id: Container "
-        "ID\nimage_digest: Image digest (sha256 digest)\ncontainer_name: Container name\ncloud_info.cloud_region: Cloud "
-        " region\nimage_id: Image ID\ncloud_info.cloud_provider: Cloud provider\ncompliance_finding.framework: "
-        "Compliance finding framework (available values: CIS)\n",
+        "Filters:\nimage_registry: Image registry\nimage_repository: Image repository\nimage_tag: Image "
+        "tag\ncloud_info.cloud_provider: Cloud provider\ncompliance_finding.id: Compliance finding ID\nimage_id: Image "
+        "ID\ncid: Customer ID\ncompliance_finding.framework: Compliance finding framework (available values: "
+        "CIS)\ncompliance_finding.severity: Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: "
+        "high, 2: medium, 1:low)\ncontainer_id: Container ID\ncloud_info.cloud_account_id: Cloud account "
+        "ID\ncompliance_finding.name: Compliance finding Name\ncloud_info.cloud_region: Cloud "
+        "region\ncloud_info.cluster_name: Kubernetes cluster name\nimage_digest: Image digest (sha256 "
+        "digest)\ncontainer_name: Container name\nasset_type: asset type (container, image)\n",
         "name": "filter",
         "in": "query"
       }

{crowdstrike_falconpy_dev-1.5.2 → crowdstrike_falconpy_dev-1.5.3}/src/falconpydev/_endpoint/_intel.py

@@ -848,7 +848,11 @@ _intel_endpoints = [
       },
       {
         "type": "string",
-        "description": "FQL query specifying the filter parameters.",
+        "description": "FQL query specifying the filter parameters. Filter parameters include:\n\n_all, "
+        "affected_products.product, affected_products.vendor, community_identifiers, cve, cvss_v3_base, "
+        "cvss_v3_base.score, cvss_v3_base.severity, exploit_status, publish_date, related_actors, "
+        "related_actors.animal_classifier, related_actors.name, related_reports.serial_id, related_reports.title, "
+        "related_threats, related_threats.name, severity, updated_timestamp.",
         "name": "filter",
         "in": "query"
       },