Crowdstrike-falconpy

Added features and functionality
+ Updated: Updated operation payload parameter datatype details.
- `_endpoint/_ioc.py`
- `_endpoint/_recon.py`
- `_endpoint/_sample_uploads.py`

+ Updated: Updated operation payload parameter data location details.
- `_endpoint/_falconx_sandbox.py`
- `_endpoint/_sample_uploads.py`

+ Added: New `host_timeout_duration` parameter to `BatchActiveResponderCmd`, `BatchCmd`, `BatchGetCmd` and `BatchInitSessions` operations within the Real Time Response Service Collection.
- `_endpoint/_real_time_response.py`

+ Added: New `GetDeviceDetailsV2` and `PostDeviceDetailsV2` operations to Hosts Service Collection.
> The operation `GetDeviceDetails` is now deprecated, and will eventually be removed from the CrowdStrike API. Due to backwards compatibility considerations, and the added functionality provided by the new endpoint, FalconPy will continue to support this operation ID by redirecting requests to `PostDeviceDetailsV2`. IDs that are provided in incorrect payload destinations due to the differences between a GET and POST operation are migrated to the appropriate dictionary before the request is made. This solution is implemented within the Hosts Service Class (`GetDeviceDetails`, `get_device_details`) and within the Uber Class. Developers __must__ upgrade installations to FalconPy v1.2.0 to benefit from this new functionality. __Administrators and end users are strongly urged to consider upgrading to v1.2.0 before this endpoint is removed.__
- `_endpoint/_hosts.py`
- `_uber_default_preference.py`
- `api_complete.py`
- `hosts.py`
- `tests/test_get_device_details.py`

+ Added: Falcon Container registry functionality to Falcon Container Service Class.
> This solution implements three "mock" operation IDs; `GetImageAssessmentReport` (`get_assessment`), `DeleteImageDetails` (`delete_image_details`), and `ImageMatchesPolicy` (`image_matches_policy`). All mocked operations are available from both the Service and Uber classes. The Falcon Container Registry base URL is calculated based upon the base URL used for authentication.
- `_endpoint/_falcon_container.py`
- `__init__.py`
- `_container_base_url.py`
- `_uber_default_preference.py`
- `_util.py`
- `api_complete.py`
- `falcon_container.py`
- `tests/test_falcon_container.py`

Issues resolved
+ Fixed: Default NoneType preference for body payloads sent to the `RTR_ListFiles` and `RTR_ListFilesV2` operations. Closes 750.
- `_uber_default_preference.py`

+ Removed: Unused header payload parameters from operation payloads.
- `_endpoint/_falconx_sandbox.py`
- `_endpoint/_firewall_management.py`
- `_endpoint/_recon.py`
- `_endpoint/_report_executions.py`
- `_endpoint/_sample_uploads.py`

+ Removed: Duplicate parameter definition (`after`) from `indicator_combined_v1` operation.
- `_endpoint/_ioc.py`

Other
+ Updated: Comment updates.
- `_endpoint/_d4c_registration.py`
+ Updated: Fixed docstring typo within `userActionV1` operation. Closes 763.
- `user_management.py`

---

Added features and functionality
+ Added: New Alerts service collection operation - `PatchEntitiesAlertsV2` (`update_alerts_v2`).
- `_endpoint/_alerts.py`
- `_payload/_alerts.py`
- `alerts.py`
- `tests/test_alerts.py`
+ Added: New Service Collection - Mobile Enrollment. Matching Service Class / Uber Class functionality. Unit testing expanded to cover new methods.
- `_endpoint/_mobile_enrollment.py`
- `mobile_enrollment.py`
- `tests/test_mobile_enrollment.py`
+ Added: New User Management service collection operations
* combinedUserRolesV1 - `get_user_grants`
* get_user_roles - `get_user_grants`
* get_user_roles_combined - `get_user_grants`
* entitiesRolesV1 - `get_roles_mssp`
* userActionV1 - `user_action`
* userRolesActionV1 - `user_roles_action`
* retrieveUsersGETV1 - `retrieve_users`
* createUserV1 - `create_user_mssp`
* deleteUserV1 - `delete_user_mssp`
* updateUserV1 - `update_user_mssp`
* queryRolesV1 - `query_roles`
* queriesRolesV1 - `query_roles`
* queryUserV1 - `query_users`
- `user_management.py`
- `tests/test_user_management.py`

+ Added: Extended custom headers (`ext_headers`) functionality for Service Classes.
- `_service_class.py`

Issues resolved
+ Added: Alias for `get_online_state_v1`. Closes 739.
- `hosts.py`

---

Added features and functionality
+ Added: New Service Collection - Alerts. Matching Service Class / Uber class functionality. Unit testing expanded to cover new methods.
- `_endpoint/__init__.py`
- `_endpoint/_alerts.py`
- `_payload/__init__.py`
- `_payload/_alerts.py`
- `alerts.py`
- `__init__.py`
- `tests/test_alerts.py`
+ Added: Expanded IdentityProtection unit testing to cover `US-2`.
- `tests/test_identity_protection.py`

Issues resolved
+ Fixed: Uber Class override keyword requires a null action parameter. Closes 706.
- `api_complete.py`
+ Fixed: Responses containing charset are not parsed as JSON. This impacted responses from the Identity Protection service collection. Closes 708.
- `_util.py`
- `tests/test_identity_protection.py`
- Thanks to hod-alpert for identifying and resolving this issue!

Other
+ Moved: Abstracted Cloud Region autodiscovery functionality into a standalone method to reduce code segment size.
- `_util.py`

---

Added features and functionality
+ Added: New operation - AzureDownloadCertificate (CSPMRegistration)
- `_endpoint/_cspm_registration.py`
- `cspm_registration.py`
- `tests/test_cspm_registration.py`
+ Added: New operation - DiscoverCloudAzureDownloadCertificate (D4CRegistration)
- `_endpoint/_d4c_registration.py`
- `d4c_registation.py`
- `tests/test_d4c_registration.py`
+ Added: New parameter - `disable_hostname_check` (QueryString) in performGroupAction (HostGroup)
- `_endpoint/_host_group.py`
- `host_group.py`
+ Added: New operation - GetOnlineState_V1 (Hosts)
- `_endpoint/_hosts.py`
- `hosts.py`
- `tests/test_hosts.py`
+ Added: New parameter - `include_relations` in QueryIntelIndicatorEntities and QueryIntelIndicatorIds (Intel)
- `_endpoint/_intel.py`
- `intel.py`
+ Added: New operations - RTR_GetPut_FilesV2 and RTR_GetScriptsV2 (RTR Administration)
- `_endpoint/_real_time_response_admin.py`
- `real_time_response_admin.py`
- `tests/test_real_time_response_admin.py`
+ Updated: DataType - `csv` -> `multi` for the `facet` parameter in combinedQueryVulnerabilities (SpotlightVulnerabilities)
- `_endpoint/_spotlight_vulnerabilities.py`

Issues resolved
+ Fixed: Docstring typo in `create_rule_group` method (FirewallManagement)
- `firewall_management.py`
+ Fixed: Typo in supported values definition for combinedQueryVulnerabilities endpoint definition.
_ `_endpoint/_spotlight_vulnerabilities.py`

---

Added features and functionality
+ Added: Firewall rules payload abstraction for the `create_rule_group` method. Firewall diff_operations payload abstraction for the `update_rule_group` method.
- `_payload/_firewall.py`
- `firewall_management.py`
- `tests/test_firewall_management.py`

---

Issues resolved
+ Fixed: Resolved issue with aggregate payload generation within the Detects, MessageCenter and Recon Service Classes. Closes 664.
- `detects.py`
- `message_center.py`
- `recon.py`

Other
+ Updated: Added macOS environment detail to docstring in `submit` method of the Falcon X Sandbox Service Class. Closes 651.
- `falconx_sandbox.py`


---