Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Version 1.1 - Expanded binary responses, action_parameter abstraction, docstrings #648

Merged
merged 35 commits into from
May 9, 2022

Conversation

jshcodes
Copy link
Member

@jshcodes jshcodes commented May 9, 2022

FalconPy v1.1.0

This update provides new functionality for advanced handling of binary API responses and the abstraction of action_parameters payload elements. Several minor developer utilities are added to the util folder. Multiple docstring issues are also resolved.

  • Enhancement
  • Major Feature update
  • Updated unit tests
  • Documentation

Unit test coverage

220 passed in 375.29s (0:06:15)

Name                                                             Stmts   Miss  Cover
------------------------------------------------------------------------------------
src/falconpy/__init__.py                                            66      0   100%
src/falconpy/_base_url.py                                            7      0   100%
src/falconpy/_endpoint/__init__.py                                 119      0   100%
src/falconpy/_endpoint/_cloud_connect_aws.py                         1      0   100%
src/falconpy/_endpoint/_cspm_registration.py                         1      0   100%
src/falconpy/_endpoint/_custom_ioa.py                                1      0   100%
src/falconpy/_endpoint/_d4c_registration.py                          1      0   100%
src/falconpy/_endpoint/_detects.py                                   1      0   100%
src/falconpy/_endpoint/_device_control_policies.py                   1      0   100%
src/falconpy/_endpoint/_discover.py                                  1      0   100%
src/falconpy/_endpoint/_event_streams.py                             1      0   100%
src/falconpy/_endpoint/_falcon_complete_dashboard.py                 1      0   100%
src/falconpy/_endpoint/_falcon_container.py                          1      0   100%
src/falconpy/_endpoint/_falconx_sandbox.py                           1      0   100%
src/falconpy/_endpoint/_filevantage.py                               1      0   100%
src/falconpy/_endpoint/_firewall_management.py                       1      0   100%
src/falconpy/_endpoint/_firewall_policies.py                         1      0   100%
src/falconpy/_endpoint/_host_group.py                                1      0   100%
src/falconpy/_endpoint/_hosts.py                                     1      0   100%
src/falconpy/_endpoint/_identity_protection.py                       1      0   100%
src/falconpy/_endpoint/_incidents.py                                 1      0   100%
src/falconpy/_endpoint/_installation_tokens.py                       1      0   100%
src/falconpy/_endpoint/_intel.py                                     1      0   100%
src/falconpy/_endpoint/_ioa_exclusions.py                            1      0   100%
src/falconpy/_endpoint/_ioc.py                                       1      0   100%
src/falconpy/_endpoint/_iocs.py                                      1      0   100%
src/falconpy/_endpoint/_kubernetes_protection.py                     1      0   100%
src/falconpy/_endpoint/_malquery.py                                  1      0   100%
src/falconpy/_endpoint/_message_center.py                            1      0   100%
src/falconpy/_endpoint/_ml_exclusions.py                             1      0   100%
src/falconpy/_endpoint/_mssp.py                                      1      0   100%
src/falconpy/_endpoint/_oauth2.py                                    1      0   100%
src/falconpy/_endpoint/_overwatch_dashboard.py                       1      0   100%
src/falconpy/_endpoint/_prevention_policies.py                       1      0   100%
src/falconpy/_endpoint/_quarantine.py                                1      0   100%
src/falconpy/_endpoint/_quick_scan.py                                1      0   100%
src/falconpy/_endpoint/_real_time_response.py                        1      0   100%
src/falconpy/_endpoint/_real_time_response_admin.py                  1      0   100%
src/falconpy/_endpoint/_recon.py                                     1      0   100%
src/falconpy/_endpoint/_report_executions.py                         1      0   100%
src/falconpy/_endpoint/_response_policies.py                         1      0   100%
src/falconpy/_endpoint/_sample_uploads.py                            1      0   100%
src/falconpy/_endpoint/_scheduled_reports.py                         1      0   100%
src/falconpy/_endpoint/_sensor_download.py                           1      0   100%
src/falconpy/_endpoint/_sensor_update_policies.py                    1      0   100%
src/falconpy/_endpoint/_sensor_visibility_exclusions.py              1      0   100%
src/falconpy/_endpoint/_spotlight_evaluation_logic.py                1      0   100%
src/falconpy/_endpoint/_spotlight_vulnerabilities.py                 1      0   100%
src/falconpy/_endpoint/_user_management.py                           1      0   100%
src/falconpy/_endpoint/_zero_trust_assessment.py                     1      0   100%
src/falconpy/_endpoint/deprecated/__init__.py                       22      0   100%
src/falconpy/_endpoint/deprecated/_custom_ioa.py                     1      0   100%
src/falconpy/_endpoint/deprecated/_discover.py                       1      0   100%
src/falconpy/_endpoint/deprecated/_firewall_management.py            1      0   100%
src/falconpy/_endpoint/deprecated/_identity_protection.py            1      0   100%
src/falconpy/_endpoint/deprecated/_installation_tokens.py            1      0   100%
src/falconpy/_endpoint/deprecated/_ioc.py                            1      0   100%
src/falconpy/_endpoint/deprecated/_iocs.py                           1      0   100%
src/falconpy/_endpoint/deprecated/_real_time_response.py             1      0   100%
src/falconpy/_endpoint/deprecated/_real_time_response_admin.py       1      0   100%
src/falconpy/_endpoint/deprecated/_report_executions.py              1      0   100%
src/falconpy/_endpoint/deprecated/_scheduled_reports.py              1      0   100%
src/falconpy/_payload/__init__.py                                   25      0   100%
src/falconpy/_payload/_cloud_connect_aws.py                         22      0   100%
src/falconpy/_payload/_cspm_registration.py                         40      0   100%
src/falconpy/_payload/_d4c_registration.py                          10      0   100%
src/falconpy/_payload/_detects.py                                   13      0   100%
src/falconpy/_payload/_device_control_policy.py                     13      0   100%
src/falconpy/_payload/_falconx.py                                   25      0   100%
src/falconpy/_payload/_firewall.py                                  65      0   100%
src/falconpy/_payload/_generic.py                                   65      0   100%
src/falconpy/_payload/_host_group.py                                30      0   100%
src/falconpy/_payload/_incidents.py                                 15      0   100%
src/falconpy/_payload/_ioa.py                                       29      0   100%
src/falconpy/_payload/_ioc.py                                       36      0   100%
src/falconpy/_payload/_malquery.py                                  56      0   100%
src/falconpy/_payload/_message_center.py                            22      0   100%
src/falconpy/_payload/_mssp.py                                      15      0   100%
src/falconpy/_payload/_prevention_policy.py                         19      0   100%
src/falconpy/_payload/_real_time_response.py                        27      0   100%
src/falconpy/_payload/_recon.py                                     72      0   100%
src/falconpy/_payload/_reports.py                                   18      0   100%
src/falconpy/_payload/_response_policy.py                           19      0   100%
src/falconpy/_payload/_sensor_update_policy.py                      24      0   100%
src/falconpy/_result.py                                             17      0   100%
src/falconpy/_service_class.py                                      74      0   100%
src/falconpy/_token_fail_reason.py                                   4      0   100%
src/falconpy/_uber_default_preference.py                             1      0   100%
src/falconpy/_util.py                                              203      0   100%
src/falconpy/_version.py                                            10      0   100%
src/falconpy/api_complete.py                                       117      0   100%
src/falconpy/cloud_connect_aws.py                                   47      0   100%
src/falconpy/cspm_registration.py                                  118      0   100%
src/falconpy/custom_ioa.py                                          85      0   100%
src/falconpy/d4c_registration.py                                    47      0   100%
src/falconpy/detects.py                                             31      0   100%
src/falconpy/device_control_policies.py                             68      0   100%
src/falconpy/discover.py                                            22      0   100%
src/falconpy/event_streams.py                                       19      0   100%
src/falconpy/falcon_complete_dashboard.py                           76      0   100%
src/falconpy/falcon_container.py                                     7      0   100%
src/falconpy/falconx_sandbox.py                                     67      0   100%
src/falconpy/filevantage.py                                         13      0   100%
src/falconpy/firewall_management.py                                 81      0   100%
src/falconpy/firewall_policies.py                                   70      0   100%
src/falconpy/host_group.py                                          60      0   100%
src/falconpy/hosts.py                                               65      0   100%
src/falconpy/identity_protection.py                                 13      0   100%
src/falconpy/incidents.py                                           40      0   100%
src/falconpy/installation_tokens.py                                 37      0   100%
src/falconpy/intel.py                                               63      0   100%
src/falconpy/ioa_exclusions.py                                      32      0   100%
src/falconpy/ioc.py                                                 49      0   100%
src/falconpy/iocs.py                                                39      0   100%
src/falconpy/kubernetes_protection.py                               49      0   100%
src/falconpy/malquery.py                                            49      0   100%
src/falconpy/message_center.py                                      74      0   100%
src/falconpy/ml_exclusions.py                                       34      0   100%
src/falconpy/mssp.py                                               130      0   100%
src/falconpy/oauth2.py                                              75      0   100%
src/falconpy/overwatch_dashboard.py                                 30      0   100%
src/falconpy/prevention_policy.py                                   61      0   100%
src/falconpy/quarantine.py                                          45      0   100%
src/falconpy/quick_scan.py                                          26      0   100%
src/falconpy/real_time_response.py                                 126      0   100%
src/falconpy/real_time_response_admin.py                            66      0   100%
src/falconpy/recon.py                                               97      0   100%
src/falconpy/report_executions.py                                   23      0   100%
src/falconpy/response_policies.py                                   60      0   100%
src/falconpy/sample_uploads.py                                      24      0   100%
src/falconpy/scheduled_reports.py                                   19      0   100%
src/falconpy/sensor_download.py                                     32      0   100%
src/falconpy/sensor_update_policy.py                               109      0   100%
src/falconpy/sensor_visibility_exclusions.py                        32      0   100%
src/falconpy/spotlight_evaluation_logic.py                          22      0   100%
src/falconpy/spotlight_vulnerabilities.py                           30      0   100%
src/falconpy/user_management.py                                     69      0   100%
src/falconpy/zero_trust_assessment.py                               12      0   100%
------------------------------------------------------------------------------------
TOTAL                                                             3801      0   100%

Bandit analysis

[main]	INFO	running on Python 3.9.9
Run started:2022-05-09 18:54:22.263100

Test results:
	No issues identified.

Code scanned:
	Total lines of code: 35059
	Total lines skipped (#nosec): 0

Run metrics:
	Total issues (by severity):
		Undefined: 0
		Low: 0
		Medium: 0
		High: 0
	Total issues (by confidence):
		Undefined: 0
		Low: 0
		Medium: 0
		High: 0
Files skipped (0):

Added features and functionality

  • Added: Results object expansion - expanded results are returned as a tuple, Ex: (status_code, headers, content). This allows for headers and status to be checked on binary API returns. Expanded results are supported for all calls to the API and can be requested from any Service Class method or the Uber Class command method using the keyword expand_result.

    • _result.py
    • _util.py
    • api_complete.py
    • test_sample_uploads.py

    Example

    # Pass a boolean True to the `expand_result` keyword to request expanded results.
    download_result = samples.get_sample(ids=file_sha, expand_result=True)
    
    # We're returned a tuple (status, headers, content)
    # Status will be in 0
    print(f"Status returned: {download_result[0]}")
    # Headers will be in 1
    print(f"Headers returned: {download_result[1]}")
    # File content will be in 2
    with open(example_file, "wb") as download_file:
        download_file.write(download_result[2])
  • Added: Specify action_parameters keys for perform operations using keywords instead of a list of dictionaries. Closes [ ENH ] Update all performXYZAction operations to allow for specifying the action parameter payload by name (as a keyword). #647.

    • Keyword: group_id
      • device_control_policies.py (perform_action method)
      • firewall_policies.py (perform_action method)
      • prevention_policy.py (perform_policies_action method)
      • response_policies.py (perform_policies_action method)
      • sensor_update_policy.py (perform_policies_action method)
    • Keyword: filter
      • host_group.py (perform_group_action method)
    • Keywords: add_tag, delete_tag, unassign, update_name, update_assigned_to_v2, update_description, update_status
      • _payload/__init__.py
      • _payload/_incidents.py
      • incidents.py (perform_incident_action method)

Other

@jshcodes jshcodes requested a review from crowdstrikedcs as a code owner May 9, 2022 19:02
@jshcodes jshcodes self-assigned this May 9, 2022
@github-actions github-actions bot added documentation 📖 Improvements or additions to documentation package Pull requests that update the core package pipeline CI/CD related unit testing Pull requests that include unit testing updates labels May 9, 2022
@jshcodes jshcodes added enhancement 🌟 New feature or request sensor update Sensor Update Policy issues and questions RTR Real Time Response issues and questions hosts Hosts or Host Groups issues and questions firewall Firewall Policies and Management issues and questions device control Device Control Policies issues and questions incidents Incidents issues and questions SDK usage General SDK usage issues and questions prevention policies Prevention Policies issues and questions labels May 9, 2022
@jshcodes jshcodes requested a review from jlangdev May 9, 2022 19:26
@jlangdev jlangdev merged commit 28852fe into main May 9, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
device control Device Control Policies issues and questions documentation 📖 Improvements or additions to documentation enhancement 🌟 New feature or request firewall Firewall Policies and Management issues and questions hosts Hosts or Host Groups issues and questions incidents Incidents issues and questions package Pull requests that update the core package pipeline CI/CD related prevention policies Prevention Policies issues and questions RTR Real Time Response issues and questions SDK usage General SDK usage issues and questions sensor update Sensor Update Policy issues and questions unit testing Pull requests that include unit testing updates
Projects
None yet
2 participants