Crowdstrike-falconpy

Added features and functionality
+ Added: Context Authentication (supports Foundry execution environments).
> FalconInterface object refactored to support new authentication mechanism, track mechanism used, add additional comments, and reduce overall complexity.
- `_auth_object/_falcon_interface.py`
> ServiceClass object updated to detect Object Authentication and track mechanism used.
- `_service_class/_service_class.py`
> New helper method defined to abstract Direct and Credential authentication creation of the _creds dictionary attribute.
- `_util/__init__.py`
- `_util/_auth.py`
> Class instantiation logging updated to detail authentication mechanism used. Linting and cleanup.
- `_util/_functions.py`
> Unit testing expanded to complete code coverage.
- `tests/test_authentications.py`
- `tests/test_result_object.py`
- `tests/test_zero_trust_assessment.py`

+ Added: Added _UpdateCSPMGCPServiceAccountsExt_ operation to the __CSPM Registration__ service collection.
- `_endpoint/_cspm_registration.py`
- `cspm_registration.py`
> Unit testing expanded to complete code coverage.
- `tests/test_cspm_registration.py`

+ Added: Added _UpdateD4CGCPServiceAccountsExt_ operation to the __D4C Registration__ service collection.
- `_endpoint/_d4c_registration.py`
- `d4c_registration.py`
> Unit testing expanded to complete code coverage.
- `tests/test_d4c_registration.py`

+ Added: Added `content_files`, `content_registry_values`, `enable_content_capture` and `enable_hash_capture` arguments to the _createRules_ and _updateRules_ operations within the __FileVantage__ service collection.
- `_endpoint/_filevantage.py`
- `_payload/_filevantage.py`
- `filevantage.py`

+ Added: Added `iar_coverage` as an allowed filter argument to the _ReadClustersByKubernetesVersionCount_, _ReadClustersByStatusCount_, _ReadClusterCount_, and _ReadClusterCombined_ operations within the __Kubernetes Protection__ service collection.
- `_endpoint/_kubernetes_protection.py`
- `kubernetes_protection.py`


Issues resolved
+ Fixed: 406 error when uploading Fusion workflows via the _WorkflowDefinitionsImport_ operation. Closes 1145.
- `workflows.py`
> Unit testing expanded to complete code coverage.
- `tests/test_workflows.py`
- `tests/test.yml`
> Thanks go out to RoemIko for identifying and reporting this issue! 🙇

+ Fixed: Added missing `force_default` decorator to the _GetCSPMAwsConsoleSetupURLs_ and _GetCSPMAwsAccountScriptsAttachment_ operations within the __CSPM Registration__ Service Class.
- `cspm_registration.py`


Other
+ Updated: Updated `sort` argument description for the _ReadCombinedImagesExport_ operation (__Container Images__ service collection) within the endpoint module.
- `_endpoint/_container_images.py`

+ Updated: Updated `filter` argument description for the _GetConfigurationDetectionIDsV2_ operation (__CSPM Registration__ service collection) within the endpoint module.
- `_endpoint/_cspm_registration.py`

+ Updated: Updated enum for the _QueryActivityByCaseID_ operation (__Message Center__ service collection) within the endpoint module.
- `_endpoint/_message_center.py`

+ Updated: Minor unit testing adjustments to handle updated API responses.
- `tests/test_container_detections.py`
- `tests/test_container_packages.py`
- `tests/test_container_vulnerabilities.py`
- `tests/test_drift_indicators.py`
- `tests/test_unidentified_containers.py`

---

Added features and functionality
+ Expanded: Environment Authentication functionality has been expanded to allow developers to customize the names of the environment keys used to store API credentials.
- `_auth_object/_falcon_interface.py`
- `_auth_object/_uber_interface.py`
- `oauth2.py`
> Unit testing expanded to complete code coverage.
- `tests/test_authentications.py`
python
from falconpy import Hosts
We can now define the prefix and the names of the
environment values used for API key lookups
environment_keys = {
"prefix": "CROWDSTRIKE_",
"id_name": "API_ID",
"secret_name": "API_SECRET"
}
These values are provided as a dictionary to the class
hosts = Hosts(environment=environment_keys)
Usage of the class is the same
results = hosts.query_devices_by_filter_scroll()


+ Added: `include_hidden` argument added to the _PostAggregatesAlertsV2_, _PatchEntitiesAlertsV3_, _PostEntitiesAlertsV2_ and _GetQueriesAlertsV2_ operations within the __Alerts__ Service Class.
- `alerts.py`

+ Added: Added 4 new operations to the __Cloud Snapshots__ service collection.
- _ReadDeploymentsCombined_
- _ReadDeploymentsEntities_
- _CreateDeploymentEntity_
- _GetScanReport_
- `_endpoint/_cloud_snapshots.py`
- `_payload/__init__.py`
- `_payload/_cloud_snapshots.py`
- `cloud_snapshots.py`
> Unit testing expanded to complete code coverage.
- `tests/test_cloud_snapshots.py`

+ Added: Added _GetRuntimeDetectionsCombinedV2_ to the __Container Detections__ service collection.
- `_endpoint/_container_detections.py`
- `container_detections.py`
> Unit testing expanded to complete code coverage.
- `tests/test_container_detections.py`

+ Added: Added 3 new operations to the __CSPM Registration__ service collection.
- _DeleteCSPMAzureManagementGroup_
- _GetCSPMGCPValidateAccountsExt_
- _ValidateCSPMGCPServiceAccountExt_
- `_endpoint/_cspm_registration.py`
- `_payload/__init__.py`
- `_payload/_cspm_registration.py`
- `cspm_registration.py`
> Unit testing expanded to complete code coverage.
- `tests/test_cspm_registration.py`

+ Added: Added _query_iot_hostsV2_ operation to the __Discover__ service collection.
- `_endpoint/_discover.py`
- `_endpoint/deprecated/_discover.py`
- `discover.py`
> Unit testing expanded to complete code coverage.
- `tests/test_discover.py`

+ Added: Added _AggregateSupportIssues_ operation to the __Falcon Complete Dashboard__ service collection.
- `_endpoint/_falcon_complete_dashboard.py`
- `falcon_complete_dashboard.py`
> Unit testing expanded to complete code coverage.
- `tests/test_falcon_complete_dashboard.py`

+ Added: Added _IngestDataAsyncV1_ operation to the __Foundry LogScale__ service collection.
- `_endpoint/_foundry_logscale.py`
- `foundry_logscale.py`
> Unit testing expanded to complete code coverage.
- `tests/test_foundry_logscale.py`

+ Added: Added `infer_json_types` and `match_response_schema` arguments to the _CreateSavedSearchesDynamicExecuteV1_, _GetSavedSearchesExecuteV1_ and _CreateSavedSearchesExecuteV1_ operations within the __Foundry LogScale__ service collection.
- `_endpoint/_foundry_logscale.py`
- `foundry_logscale.py`

+ Added: Added `infer_json_types` argument to the _GetSavedSearchesJobResultsDownloadV1_ operation within the __Foundry LogScale__ service collection.
- `_endpoint/_foundry_logscale.py`
- `foundry_logscale.py`

+ Added: Added 3 new operations to the __Intel__ service collection.
- _GetMalwareEntities_
- _QueryMalware_
- _QueryMitreAttacksForMalware_
- `_endpoint/_intel.py`
- `intel.py`
> Unit testing expanded to complete code coverage.
- `tests/test_intel.py`

+ Added: Added 4 new operations to the __Sensor Download__ service collection.
- _GetCombinedSensorInstallersByQueryV2_
- _DownloadSensorInstallerByIdV2_
- _GetSensorInstallersEntitiesV2_
- _GetSensorInstallersByQueryV2_
- `_endpoint/_sensor_download.py`
- `sensor_download.py`
> Unit testing expanded to complete code coverage.
- `tests/test_sensor_download.py`

+ Added: Added `sanitize` argument to the _WorkflowDefinitionsExport_ operation within the __Workflows__ service collection.
- `_endpoint/_workflows.py`
- `workflows.py`

+ Added: Added 2 new operations to the __Workflows__ service collection.
- _WorkflowExecuteInternal_
- _WorkflowMockExecute_
- `_endpoint/workflows.py`
- `_payload/__init__.py`
- `_payload/_workflows.py`
- `workflows.py`
> Unit testing expanded to complete code coverage.
- `tests/test_workflows.py`

Issues resolved
+ Fixed: Resolved parsing issue with formData arguments provided to the _ArchiveUploadV2_ operation within the __SampleUploads__ Service Class. Closes 1122.
- `sample_uploads.py`

+ Fixed: Resolved conversion issue with query string boolean parameters not being properly converted to lowercase before API submission. Closes 1129.
- `_util/_functions.py`

Other
+ Updated: Updated `body` argument description for the _PatchEntitiesAlertsV3_ operation within the endpoint module.
- `_endpoint/_alerts.py`

+ Updated: Added `highest_cps_current_rating` as an allowed sort parameter to the _ReadCombinedImagesExport_ operation within the __Container Images__ service collection.
- `_endpoint/_container_images.py`

+ Updated: Added `watch_permissions_key_changes` option to the _createRules_ operation within the __FileVantage__ service collection.
- `_endpoint/_filevantage.py`

+ Updated: Updated operation and argument descriptions in the deprecated __IOCS__ service collection.
- `_endpoint/_iocs.py`

+ Updated: Added `prevented` as an allowed filter to the _ReadKubernetesIomByDateRange_, _ReadKubernetesIomCount_, _SearchAndReadKubernetesIomEntities_ and _SearchKubernetesIoms_ operations within the __Kubernetes Protection__ service collection.
- `_endpoint/_kubernetes_protection.py`

+ Updated: Updated the `body` argument description for the _BatchAdminCmd_ and _RTR_ExecuteAdminCommand_ operations within the __Real Time Response Admin__ service collection.
- `_endpoint/_real_time_response_admin.py`
- `_endpoint/deprecated/_real_time_response_admin.py`

+ Updated: Updated the `body` argument description for the _BatchActiveResponderCmd_, _BatchCmd_, _RTR_ExecuteActiveResponderCommand_, and _RTR_ExecuteCommand_ operations within the __Real Time Response__ service collection.
- `_endpoint/_real_time_response.py`
- `_endpoint/deprecated/_real_time_response.py`

+ Removed: The _CreateInventory_ operation is removed from the __Cloud Snapshots__ Service Class.
- `_payload/__init__.py`
- `_payload/_cloud_snapshots.py`
- `cloud_snapshots.py`
> Unit testing updated to reflect current functionality.
- `tests/test_cloud_snapshots.py`

+ Removed: The _WorkflowDefinitionsCreate_ operation is removed from the __Workflows__ service collection.
- `_endpoint/_workflows.py`
- `workflows.py`
> Unit testing updated to reflect current functionality.
- `tests/test_workflows.py`

---

Added features and functionality
+ Added: `include_hidden` argument added to the _PostAggregatesAlertsV2_, _PostEntitiesAlertsV2_, _PatchEntitiesAlertsV3_ and _GetQueriesAlertsV2_ operations.
- `_endpoint/_alerts.py`

+ Added: _ReadContainerAlertsCountBySeverity_ operation added to the __Container Alerts__ service collection.
- `_endpoint/_container_alerts.py`
- `container_alerts.py`
> Unit testing expanded to complete code coverage.
- `tests/test_container_alerts.py`

+ Added: `cspm_lite` argument added to the _GetCSPMAwsAccount_ and _GetCSPMAzureAccount_ operations within the __CSPM Registration__ service collection.
- `_endpoint/_cspm_registration.py`
- `cspm_registration.py`

+ Added: `azure_management_group` argument added to the _GetCSPMAzureUserScriptsAttachment_ operation within the __CSPM Registration__ service collection.
- `_endpoint/_cspm_registration.py`
- `cspm_registration.py`

+ Added: 9 new operations added to the __CSPM Registration__ service collection.
* _GetCSPMAzureManagementGroup_
* _CreateCSPMAzureManagementGroup_
* _GetCSPMCGPAccount_
* _CreateCSPMGCPAccount_
* _DeleteCSPMGCPAccount_
* _UpdateCSPMGCPAccount_
* _ConnectCSPMGCPAccount_
* _GetCSPMGCPServiceAccountsExt_
* _GetCSPMGCPUserScriptsAttachment_
- `_endpoint/_cspm_registration.py`
- `_payload/_cspm_registration.py`
- `cspm_registration.py`
> Unit testing expanded to complete code coverage.
- `tests/test_cspm_registration.py`

+ Added: `azure_management_group` argument added to the _GetDiscoverCloudAzureUserScriptsAttachment_ operation within the __D4C Registration__ service collection.
- `_endpoint/_d4c_registration.py`
- `d4c_registration.py`

+ Added: 4 new operations added to the __D4C Registration__ service collection.
* _DeleteD4CGCPAccount_
* _ConnectD4CGCPAccount_
* _GetD4CGCPServiceAccountsExt_
* _GetD4CGCPUserScriptsAttachment_
- `_endpoint/_d4c_registration.py`
- `_payload/_d4c_registration.py`
- `d4c_registration.py`
> Unit testing expanded to complete code coverage.
- `tests/test_d4c_registration.py`

+ Added: `execution_cid` argument added to the _WorkflowExecute_ operation within the __Workflows__ service collection.
- `_endpoint/_workflows.py`
- `workflows.py`

+ Added: New service collection __Image Assessment Policies__ containing 11 new operations.
* _ReadPolicies_
* _CreatePolicies_
* _UpdatePolicies_
* _DeletePolicy_
* _ReadPolicyExclusions_
* _UpdatePolicyExclusions_
* _ReadPolicyGroups_
* _CreatePolicyGroups_
* _UpdatePolicyGroups_
* _DeletePolicyGroup_
* _UpdatePolicyPrecedence_
- `_endpoint/__init__.py`
- `_endpoint/_image_assessment_policies.py`
> 3 new payload handlers are added.
- `_payload/__init__.py`
- `_payload/_container.py`
- `__init__.py`
- `image_assessment_policies.py`
> Unit testing expanded to complete code coverage.
- `tests/test_image_assessment_policies.py`

+ Added: 8 new operations added to the __Workflows__ service collection.
* _WorkflowDefinitionsCombined_
* _WorkflowExecutionsCombined_
* _WorkflowDefinitionsExport_
* _WorkflowDefinitionsImport_
* _WorkflowDefinitionsUpdate_
* _WorkflowDefinitionsCreate_
* _WorkflowGetHumanInputV1_
* _WorkflowUpdateHumanInputV1_
- `_endpoint/_workflows.py`
- `workflows.py`
> 2 new payload handlers are added.
- `_payload/__init__.py`
- `_payload/_workflows.py`
> Unit testing expanded to complete code coverage.
- `tests/test_workflows.py`

Issues resolved
+ Fixed: `member_cid` argument is not being passed to the authentication event when leveraging Environment Authentication. Closes 1105.
- `_auth_object/_falcon_interface.py`

+ Fixed: `rule_ids` is not included in body payloads when the list is empty for the _update_rule_groups_ operation within the __Firewall Management__ Service Class. Closes 1107.
- `_payload/_firewall.py`

+ Fixed: Added missing actions to _allowed_actions validator within `PerformActionV2` method of the __Hosts__ service collection. Closes 1108.
- `hosts.py`
- Thanks go out to i-shubham01 for identifying and resolving this issue! 🙇

Other
+ Updated: Enums added to _GetCSPMAwsAccount_ and _GetCSPMAwsConsoleSetupURLs_ operations within the __CSPM Registration__ endpoint module.
- `_endpoint/_cspm_registration.py`

+ Updated: Several parameter descriptions within the __Custom IOA__ endpoint module updated.
- `_endpoint/_custom_ioa.py`
- `_endpoint/deprecated/_custom_ioa.py`

+ Updated: Enum updated within the _GetD4CAwsAccount_ operation of the __D4C Registration__ endpoint module.
- `_endpoint/_d4c_registration.py`

+ Updated: Parameter description for the _Submit_ operation within the __Falcon Intelligence Sandbox__ endpoint module updated.
- `_endpoint/_falconx_sandbox.py`

+ Updated: Multiple parameter descriptions within the __Kubernetes Protection__ endpoint module updated.
- `_endpoint/_kubernetes_protection_.py`

+ Updated: Enum updated within the _QueryActivityByCaseID_ operation of the __Message Center__ endpoint module.
- `_endpoint/_message_center.py`

---

Other
+ Dropped: Python 3.6 support.
> Unit testing adjusted to reflect supported versions.
- `README.md`
- `SECURITY.md`
- `setup.py`

+ Refactored: Simple private child objects within the [__APIRequest__](https://www.falconpy.io/Usage/Extensibility.html#apirequest) object updated to leverage data classes.
- `_api_request/_request_connection.py`
- `_api_request/_request_payloads.py`
- `_api_request/_request_validator.py`

---

Added features and functionality
+ Added: 4 new operations added to the __*Alerts*__ service collection.
- *PostAggregateAlertsV2*
- *PostEntitiesAlertsV2*
- *PatchEntitiesAlertsV3*
- *GetQueriesAlertsV2*
- `_endpoint/_alerts.py`
- `alerts.py`
> Unit testing expanded to complete code coverage.
- `tests/test_alerts.py`
+ Added: `source_event_url` argument added to the _WorkflowExecute_ operation definition within the endpoint module.
- `_endpoint/_workflows.py`
+ Added: New Configuration Assessment service collection providing 2 new operations.
- *getCombinedAssessmentsQuery*
- *getRuleDetails*
- `_endpoint/__init__.py`
- `_endpoint/_configuration_assessment.py`
- `__init__.py`
- `configuration_assessment.py`
> Unit testing expanded to complete code coverage.
- `tests/test_configuration_assessment.py`
+ Added: New Configuration Assessment Evaluation Logic service collection providing 1 new operation.
- *getEvaluationLogicMixin0*
- `_endpoint/__init__.py`
- `_endpoint/_configuration_assessment_evaluation_logic.py`
- `__init__.py`
- `configuration_assessment_evaluation_logic.py`
> Unit testing expanded to complete code coverage.
- `tests/test_configuration_assessment_evaluation_logic.py`
+ Added: New Container Alerts service collection providing 2 new operations.
- *ReadContainerAlertsCount*
- *SearchAndReadContainerAlerts*
- `_endpoint/__init__.py`
- `_endpoint/_container_alerts.py`
- `__init__.py`
- `container_alerts.py`
> Unit testing expanded to complete code coverage.
- `tests/test_container_alerts.py`
+ Added: New Container Detections service collection providing 6 new operations.
- *ReadDetectionsCountBySeverity*
- *ReadDetectionsCountByType*
- *ReadDetectionsCount*
- *ReadCombinedDetections*
- *ReadDetections*
- *SearchDetections*
- `_endpoint/__init__.py`
- `_endpoint/_container_detections.py`
- `__init__.py`
- `container_detections.py`
> Unit testing expanded to complete code coverage.
- `tests/test_container_detections.py`
+ Added: New Container Images service collection providing 10 new operations.
- *AggregateImageAssessmentHistory*
- *AggregateImageCountByBaseOS*
- *AggregateImageCountByState*
- *AggregateImageCount*
- *GetCombinedImages*
- *CombinedImageByVulnerabilityCount*
- *CombinedImageDetail*
- *ReadCombinedImagesExport*
- *CombinedImageIssuesSummary*
- *CombinedImageVulnerabilitySummary*
- `_endpoint/__init__.py`
- `_endpoint/_container_images.py`
- `__init__.py`
- `container_images.py`
> Unit testing expanded to complete code coverage.
- `tests/test_container_images.py`
+ Added: New Container Packages service collection providing 5 new operations.
- *ReadPackagesCountByZeroDay*
- *ReadPackagesByFixableVulnCount*
- *ReadPackagesByVulnCount*
- *ReadPackagesCombinedExport*
- *ReadPackagesCombined*
- `_endpoint/__init__.py`
- `_endpoint/_container_packages.py`
- `__init__.py`
- `container_packages.py`
> Unit testing expanded to complete code coverage.
- `tests/test_container_packages.py`
+ Added: New Container Vulnerabilities service collection providing 10 new operations.
- *ReadCombinedVulnerabilities*
- *ReadCombinedVulnerabilitiesInfo*
- *ReadCombinedVulnerabilitiesDetails*
- *ReadVulnerabilitiesPublicationDate*
- *ReadVulnerabilitiesByImageCount*
- *ReadVulnerabilityCount*
- *ReadVulnerabilityCountBySeverity*
- *ReadVulnerabilityCountByCPSRating*
- *ReadVulnerabilityCountByCVSSScore*
- *ReadVulnerabilityCountByActivelyExploited*
- `_endpoint/__init__.py`
- `_endpoint/_container_vulnerabilities.py`
- `__init__.py`
- `container_vulnerabilities.py`
> Unit testing expanded to complete code coverage.
- `tests/test_container_vulnerabilities.py`
+ Added: `next_token` argument added to the _GetConfigurationDetectionIDsV2_ operation within the __*CSPM Registration*__ service collection.
- `_endpoint/_cspm_registration.py`
- `cspm_registration.py`
+ Added: New Drift Indicators service collection providing 5 new operations.
- *GetDriftIndicatorsValuesByDate*
- *ReadDriftIndicatorsCount*
- *SearchAndReadDriftIndicatorEntities*
- *ReadDriftIndicatorEntities*
- *SearchDriftIndicators*
- `_endpoint/__init__.py`
- `_endpoint/_drift_indicators.py`
- `__init__.py`
- `drift_indicators.py`
> Unit testing expanded to complete code coverage.
- `tests/test_drift_indicators.py`
+ Added: 3 new operations added to the __*Falcon Complete Dashboard*__ service collection.
- *AggregatePreventionPolicy*
- *AggregateSensorUpdatePolicy*
- *AggregateTotalDeviceCounts*
- `_endpoint/_falcon_complete_dashboard.py`
- `falcon_complete_dashboard.py`
> Unit testing expanded to complete code coverage.
- `tests/test_falcon_complete_dashboard.py`
+ Added: New arguments added to 5 operations within the __*Foundry LogScale*__ service collection. 2 arguments are removed from 1 operation.
- `check_test_data` is added to _ListReposV1_.
- `app_id` is added to _CreateSavedSearchesDynamicExecuteV1_.
- `app_id` is added to _GetSavedSearchesExecuteV1_.
- `app_id` is added to _CreateSavedSearchesExecuteV1_.
- `check_test_data` is added to _ListViewV1_.
- The duplicative query string parameter arguments `mode` and `version` have been removed from _CreateSavedSearchesExecuteV1_.
- `_endpoint/_foundry_logscale.py`
- `foundry_logscale.py`
> Unit testing expanded to complete code coverage.
- `tests/test_foundry_logscale.py`
+ Added: 1 new operation added to the __*Hosts*__ service collection.
- *QueryDeviceLoginHistoryV2*
- `_endpoint/_hosts.py`
- `hosts.py`
> Unit testing expanded to complete code coverage.
- `tests/test_hosts.py`
+ Added: 3 new operations added to the __*IOC*__ service collection. These operations replace legacy operations from the deprecated __*IOCS*__ service collection.
- *indicator_get_device_count_v1* replaces _DevicesCount_.
- *indicator_get_devices_ran_on_v1* replaces _DevicesRanOn_.
- *indicator_get_processes_ran_on_v1* replaces _ProcessRanOn_.
- `_endpoint/_ioc.py`
- `_endpoint/deprecated/_ioc.py`
- `ioc.py`
> Unit testing expanded to complete code coverage.
- `tests/test_ioc.py`
+ Added: 41 new operations added to the __*Kubernetes Protection*__ service collection.
- *ReadClustersByDateRangeCount*
- *ReadClustersByKubernetesVersionCount*
- *ReadClustersByStatusCount*
- *ReadClusterCount*
- *ReadContainersByDateRangeCount*
- *ReadContainerCountByRegistry*
- *FindContainersCountAffectedByZeroDayVulnerabilities*
- *ReadVulnerableContainerImageCount*
- *ReadContainerCount*
- *FindContainersByContainerRunTimeVersion*
- *GroupContainersByManaged*
- *ReadContainerImageDetectionsCountByDate*
- *ReadContainerImagesByState*
- *ReadContainersSensorCoverage*
- *ReadContainerVulnerabilitiesBySeverityCount*
- *ReadDeploymentsByDateRangeCount*
- *ReadDeploymentCount*
- *ReadClusterEnrichment*
- *ReadContainerEnrichment*
- *ReadDeploymentEnrichment*
- *ReadNodeEnrichment*
- *ReadPodEnrichment*
- *ReadDistinctContainerImageCount*
- *ReadContainerImagesByMostUsed*
- *ReadKubernetesIomByDateRange*
- *ReadKubernetesIomCount*
- *ReadNodesByCloudCount*
- *ReadNodesByContainerEngineVersionCount*
- *ReadNodesByDateRangeCount*
- *ReadNodeCount*
- *ReadPodsByDateRangeCount*
- *ReadPodCount*
- *ReadClusterCombined*
- *ReadRunningContainerImages*
- *ReadContainerCombined*
- *ReadDeploymentCombined*
- *SearchAndReadKubernetesIomEntities*
- *ReadNodeCombined*
- *ReadPodCombined*
- *ReadKubernetesIomEntities*
- *SearchKubernetesIoms*
- `_endpoint/_kubernetes_protection.py`
- `kubernetes_protection.py`
> Unit testing expanded to complete code coverage.
- `tests/test_kubernetes_protection.py`
+ Added: 1 new operation added to the __*ODS*__ service collection.
- *get_scans_by_scan_ids_v2*
> *get_scans_by_scan_ids_v1* has been deprecated. The PEP8 method `get_scans` has been redirected to the new operation. Developers wanting to leverage the legacy operation should call `get_scans_v1` or `get_scans_by_scan_ids_v1`.
- `_endpoint/_ods.py`
- `_endpoint/deprecated/_ods.py`
- `ods.py`
> Unit testing expanded to complete code coverage.
- `tests/test_ods.py`
+ Added: 2 new operations added to the __*Real Time Response Admin*__ service collection.
- *RTR_GetFalconScripts*
- *RTR_ListFalconScripts*
- `_endpoint/_real_time_response_admin.py`
- `_endpoint/deprecated/_real_time_response_admin.py`
- `real_time_response_admin.py`
> Unit testing expanded to complete code coverage.
- `tests/test_real_time_response_admin.py`
+ Added: New Unidentified Containers service collection providing 3 new operations.
- *ReadUnidentifiedContainersByDateRangeCount*
- *ReadUnidentifiedContainersCount*
- *SearchAndReadUnidentifiedContainers*
- `_endpoint/__init__.py`
- `_endpoint/_unidentified_containers.py`
- `__init__.py`
- `unidentified_containers.py`
> Unit testing expanded to complete code coverage.
- `tests/test_unidentified_containers.py`

Issues resolved
+ Fixed: `batch_id` and `batch_get_cmd_req_id` not available on pythonic Result object.
- `_result/_result.py`
+ Fixed: Pythonic responses not properly populating Result object resources attribute when a dictionary is returned for the resources branch.
- `_result/_result.py`
+ Fixed: `trace_id` property is not available on Result objects that do not contain a Meta attribute.
- `_result/_headers.py`
- `_result/_result.py`
+ Fixed: Changes the datatype for the `ids` argument within the _GetCSPMPolicy_ operation from __`string`__ to __`integer`__.
- `_endpoint/_cspm_registration.py`

Other
+ Fixed: A typo that incorrectly listed the default value for the `limit` keyword was resolved in the QueryDetects operation docstring. Closes 1089.
- `detects.py`
+ Refactored: Reduced complexity within the Result object constructor method by abstracting construction logic to a new method.
- `_result/_result.py`
+ Regenerated: Updated endpoint module to align to new library automation, resulting in cosmetic changes to description fields.
- `_endpoint/*`
+ Renamed: _RetrieveUser_ operation has been renamed to _retrieveUser_ within the __*User Management*__ service collection.
- `_endpoint/_user_management.py`
+ Deprecated: Adds additional deprecated operation IDs to the __*Firewall Management*__ service collection.
- `_endpoint/_firewall_management.py`
+ Fixed: Resolves a constant naming typo within the endpoint module for the __*Cloud Snapshots*__ service collection.
- `_endpoint/__init__.py`
- `_endpoint/_cloud_snapshots.py`
- `cloud_snapshots.py`
+ Fixed: Endpoint definition mismatch in _UploadSampleV3_ operation within the __*Sample Uploads*__ service collection.
- `_endpoint/_sample_uploads.py`
+ Fixed: Endpoint definition mismatch in _UploadSampleV2_ operation within the __*Falcon Intelligence Sandbox*__ service collection.
- `_endpoint/_falconx_sandbox.py`
> Unit testing expanded to complete code coverage.
- `tests/test_falconx_sandbox.py`

---

Added features and functionality
+ Added: Use a Service Class or the Uber Class as a context manager.
> Leveraging this functionality will automatically revoke your bearer token on context manager exit.
python
from falconpy import Hosts
with Hosts(pythonic=True) as hosts:
for device in hosts.query_devices().data:
print(device)

- `_auth_object/_uber_interface.py`
- `_service_class/_service_class.py`
+ Added: `app_id` keyword added to _CreateSavedSearchesIngestV1_ operation.
- `foundry_logscale.py`
> Unit testing expanded to complete code coverage.
- `tests/test_foundry_logscale.py`

Issues resolved
+ Fixed: _update_policy_container_ operation payload handler is missing the `policy_id` key. Closes 1068.
- `_payload/_firewall.py`
> Expanded unit testing to complete code coverage.
- `tests/test_firewall_management.py`
+ Fixed: `after` property is missing from the __Meta__ object. Closes 1069.
- `_result/_meta.py`
- `_result/_result.py`
+ Fixed: Payload handler for _tokens_update_ operation is not properly passing the `revoked` key. Closes 1074.
- `installation_tokens.py`
+ Fixed: API operations generating leveraging the raw attribute are not properly displaying results when leveraging result object expansion. Closes 1076.
- `_result/_result.py`
+ Fixed: Per-operation pythonic override is not working as expected. Closes 1078.
- `_util/_functions.py`

Other
+ Changed: Updated field mapping for Uber Class path variables to a cleaner solution.
- `_util/_uber.py`
+ Removed: The unsupported actions `add-rule-group` and `remove-rule-group` are removed from the _performFirewallPoliciesAction_ operation. Relates to 1059.
- `firewall_policies.py`

---