Skip to content
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
100 commits
Select commit Hold shift + click to select a range
02b9ba5
Fix: send action as dict in UserManagement.perform_action
Matth3wW Aug 1, 2025
adc3c67
Resolve search_id keyword path interpolation issue with GetSearchStat…
jshcodes Aug 6, 2025
102da16
Add Cloud Security Compliance service collection
jshcodes Aug 7, 2025
763d93d
Resolve body payload generation issue with the userActionV1 operation
jshcodes Aug 7, 2025
82fcadc
Adjust unit testing to temporarily allow 500 from userActionV1
jshcodes Aug 7, 2025
61f1767
Bump version -> 1.5.5
jshcodes Aug 7, 2025
269a758
Resolve issue with FDR service collection endpoints. Closes #1371.
jshcodes Aug 13, 2025
2e0a773
added `GetSensorUsageHourly` as this allows you to pull hourly for Cl…
Sep 5, 2025
8e58cfa
Add sane boundaries to the random_string generator
jshcodes Nov 6, 2025
5a8dee8
Add @Matth3ww, @dweissbacher, @atav928 and @subbu-cs
jshcodes Nov 6, 2025
1812469
Update parameter descriptions (Container Alerts)
jshcodes Nov 8, 2025
f983ac6
Update operation and parameter descriptions (Container Images)
jshcodes Nov 8, 2025
1624e9e
Update operation and parameter descriptions (Container Packages)
jshcodes Nov 8, 2025
7ee6639
Update operation and parameter descriptions (Container Vulnerabilities)
jshcodes Nov 8, 2025
10de298
Deprecate Detects service collection and all related endpoints. Close…
jshcodes Nov 8, 2025
9dda3b6
Add cloud_registration_azure_trigger_health_check operation
jshcodes Nov 16, 2025
644b35d
Cosmetic updates to parameter descriptions within the cloud_security_…
jshcodes Nov 16, 2025
05ef4d7
Add control.extension.status as an allowed filter option to the _clou…
jshcodes Nov 16, 2025
320ceee
Update filter options for the _clodu_security_assets_queries_ operation
jshcodes Nov 16, 2025
60b7f47
Add CombinedDetections operation
jshcodes Nov 16, 2025
27f2af6
Update filter argument description for several operations wtihin the …
jshcodes Nov 16, 2025
fba5f87
Update limit and offset descriptions for several operations within th…
jshcodes Nov 16, 2025
ffb7697
Add dspm_host_account_id, dspm_host_integration_role_name and dspm_ho…
jshcodes Nov 16, 2025
53081fe
Add facet argument to combined_applications operation within the Disc…
jshcodes Nov 16, 2025
1aac689
Add scan_details.scan_id, scan_details.schedule_id, scan_details.scan…
jshcodes Nov 16, 2025
c43045b
Add FetchFilesDownloadInfo operation to the Downloads service collection
jshcodes Nov 16, 2025
fbe9cb0
Cosmetic updates to the limit and offset argument descriptions in the…
jshcodes Nov 16, 2025
cb6d154
Cosmetic updates to the sort enum a filter argument description in th…
jshcodes Nov 16, 2025
69beb90
Remove unnecessary authorization headers from all operations within t…
jshcodes Nov 16, 2025
7941dc4
Add reports.slug as an allowed value for the filter argument in the Q…
jshcodes Nov 16, 2025
bb5e839
Add summary as an allowed value for the filter argument in the QueryI…
jshcodes Nov 16, 2025
0d8d46c
Update limit and offset argument descriptions in the SearchAndRReadUn…
jshcodes Nov 16, 2025
82b650d
Add uuid as an allowed filter value to queryUserV1 within the User Ma…
jshcodes Nov 16, 2025
3382a47
Add entitiesRolesGETV2 and deprecate entitiesRolesV1 operations withi…
jshcodes Nov 16, 2025
6c28ec0
Add new operations to the ASPM service collection
jshcodes Nov 17, 2025
0567bf4
Add SPL, AI translated and __all__ language argument values to GetArc…
jshcodes Nov 17, 2025
cc16d34
Cosmetic updates to GetIntelligenceQueries and SearchIntelligenceQuer…
jshcodes Nov 17, 2025
5728f33
Add include_translated_content argument to the GetIntelligenceQueries…
jshcodes Nov 17, 2025
c2a970f
Add PolicyChecks, GetReportByReference and GetReportByScanID operations
jshcodes Nov 17, 2025
283d92e
Add "any" as an allowed feed_interval value to the QueryFeedArchives …
jshcodes Nov 17, 2025
a66e5b5
Add file_name argument to UploadFileQuickScanPro
jshcodes Nov 17, 2025
2060ca1
Convert offset datatype to integer from string within QueryActivityBy…
jshcodes Nov 17, 2025
aa5f78b
Add sort argument values to the CombinedHiddenDevicesByFilter and Com…
jshcodes Nov 17, 2025
f57141e
Add limit, from and to arguments to the QueryDeviceLoginHistoryV2 ope…
jshcodes Nov 17, 2025
7fa28ab
Add WorkflowDefinitionsAction endpoint and corresponding method in Wo…
dweissbacher Sep 4, 2025
9a3f84c
Argument and operation description updates to multiple Workflows oper…
jshcodes Nov 18, 2025
16288b6
Add cancel as an allowed value for action_name within WorkflowExecuti…
jshcodes Nov 18, 2025
968d845
Add ignore_activity_mock_references and skip_validation arguments to …
jshcodes Nov 18, 2025
b6625aa
Update ITAutomationStartExecutionResultsSearch and ITAutomationGetExe…
jshcodes Nov 18, 2025
71df988
Add new operations to the IT Automation service collection
jshcodes Nov 18, 2025
60611da
Add namespace and pod_name as an allowed filter value to 5 cluster op…
jshcodes Nov 18, 2025
ef75d14
Update limit and offset argument descriptions in 10 operations within…
jshcodes Nov 18, 2025
af94816
Update descriptions for the ReadClusterCombinedV2, SearchAndReadKuber…
jshcodes Nov 18, 2025
4a953d3
Add PostSearchKubernetesIOMEntities operation to the Kubernetes Prote…
jshcodes Nov 18, 2025
6bb4645
Add 22 new operations to the NGSIEM service collection
jshcodes Nov 19, 2025
b0b96e1
Add child_login and logout helper methods to the authentication objec…
jshcodes Nov 19, 2025
a94f4f5
Add Case Management service collection
alhumaw Nov 19, 2025
ea81e99
Add SaaS Security service collection
alhumaw Nov 19, 2025
07c02f7
Add Spotlight Vulnerability Metadata service collection
alhumaw Nov 19, 2025
46bffcc
Add Data Protection Configuration service collection
alhumaw Nov 19, 2025
173a09e
Add Correlation Rules Admin service collection
alhumaw Nov 19, 2025
4bbacd2
Add Cloud Security Detections service collection
alhumaw Nov 19, 2025
e3805e4
Add Cloud Policies service collection
alhumaw Nov 19, 2025
38d8c61
Allow for string and list values to be removed in IOC metadata
jshcodes Dec 10, 2025
55584f4
Update Threat Graph service collection. Typo in get_summary()
alhumaw Dec 15, 2025
21a1ef4
Update unit testing
jshcodes Nov 20, 2025
04a5639
Add add-rule-group and remove-rule-group as allowed actions in perfor…
jshcodes Dec 16, 2025
af7780f
Add 9 new operations to the Case Management service collection
alhumaw Dec 16, 2025
79fae13
Add 2 new operations to the Cloud AWS Registration
alhumaw Dec 16, 2025
0521eba
Removed 2 operations from the ASPM service collection
alhumaw Dec 16, 2025
08e90b6
Add 2 new operations to the Cloud Azure Registration. Deprecated 2 op…
alhumaw Dec 16, 2025
4459fe5
Add Cloud Google Cloud Registration service collection
alhumaw Dec 17, 2025
efb7bd9
Add 1 new operation to the Cloud Security Assets service collection. …
alhumaw Dec 17, 2025
a76a4fb
Update Cloud AWS Registration service collection. Fix hyphen-to-under…
alhumaw Dec 17, 2025
8b3c8df
Update Cloud Security Assets service collection. Add new filter and s…
alhumaw Dec 17, 2025
6a8371c
Add new filter and sort options to the Cloud Security Detections serv…
alhumaw Dec 17, 2025
d833242
Update Correlation Rules Admin deprecated operation ID name
alhumaw Dec 17, 2025
265a65c
Update Data Protection configuration operations. Update filter options
alhumaw Dec 17, 2025
f9d45bf
Update On Demand Scan service collection. Add new filter and sort opt…
alhumaw Dec 17, 2025
90e7fcf
Add 3 new operations to the Real Time Response Admin service collection
alhumaw Dec 17, 2025
7efab45
Update Cloud OCI Registration service collection . Update filter and …
alhumaw Dec 17, 2025
6b7b86f
Add 3 new operations to the CAO Hunting service collection
alhumaw Dec 17, 2025
50314a6
Update generic payload handler to handle more options aligning with C…
alhumaw Dec 17, 2025
d6a8769
Add 2 new operations to the Cloud Policies service collection
alhumaw Dec 17, 2025
110c020
Update Container Image Compliance filter values
alhumaw Dec 17, 2025
5ae2b39
Update D4C Registration service collection. Updated 1 operation with …
alhumaw Dec 17, 2025
ed4f706
Add 1 new operation to the Downloads service collection
alhumaw Dec 17, 2025
a156e3a
Update Falcon Container service collection. Update resource options i…
alhumaw Dec 17, 2025
11d88f3
Update Host Migration service collection. Update endpoint filter, sor…
alhumaw Dec 17, 2025
0ddd8ce
Update Hosts service collection. Add new sort values in 2 operations
alhumaw Dec 17, 2025
151c3b9
Update Intelligence Indicator Graph. Adding available filter values t…
alhumaw Dec 17, 2025
d0f1f78
Update Recon service collection. Add new sort options to 1 operation
alhumaw Dec 17, 2025
dc65b83
Update SaaS Security service collection. Add new parameter to 1 opera…
alhumaw Dec 17, 2025
a593817
Removed Datascanner service collection
alhumaw Dec 17, 2025
9e3519f
Add Cloud Security service collection
alhumaw Dec 17, 2025
9a9bc96
Update wordlist.txt
jshcodes Dec 16, 2025
309d8ee
Update workflow templates
jshcodes Dec 16, 2025
3661044
Update unit testing
jshcodes Dec 17, 2025
4d93ba7
Add publishing workflows
jshcodes Dec 18, 2025
3bdd86f
Update CHANGELOG.md
jshcodes Sep 11, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Add Cloud Security Compliance service collection
  • Loading branch information
jshcodes committed Dec 12, 2025
commit 102da1601adb8ac1c2628d56aeb146f46bd50b9b
4 changes: 3 additions & 1 deletion src/falconpy/__init__.py
Original file line number Diff line number Diff line change
Expand Up @@ -115,6 +115,7 @@
from .cloud_azure_registration import CloudAzureRegistration
from .cloud_oci_registration import CloudOCIRegistration
from .cloud_security_assets import CloudSecurityAssets
from .cloud_security_compliance import CloudSecurityCompliance
from .cloud_snapshots import CloudSnapshots
from .container_image_compliance import ContainerImageCompliance, ComplianceAssessments
from .configuration_assessment_evaluation_logic import ConfigurationAssessmentEvaluationLogic
Expand Down Expand Up @@ -249,7 +250,8 @@
"ContainerImageCompliance", "FaaSExecution", "HEC", "IngestBaseURL", "IngestFormat",
"IngestPayload", "HTTPEventCollector", "IngestConfig", "SessionManager", "TimeUnit",
"Color", "Indicator", "random_string", "KubernetesContainerCompliance", "find_operation",
"InvalidRoute", "InvalidServiceCollection", "InvalidOperationSearch", "ITAutomation", "F4IT"
"InvalidRoute", "InvalidServiceCollection", "InvalidOperationSearch", "ITAutomation", "F4IT",
"CloudSecurityCompliance"
]
"""
This is free and unencumbered software released into the public domain.
Expand Down
4 changes: 4 additions & 0 deletions src/falconpy/_endpoint/__init__.py
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@
from .deprecated import _cloud_azure_registration_deprecated
from .deprecated import _cloud_oci_registration_deprecated
from .deprecated import _cloud_security_assets_deprecated
from .deprecated import _cloud_security_compliance_deprecated
from .deprecated import _correlation_rules_deprecated
from .deprecated import _custom_ioa_deprecated
from .deprecated import _d4c_registration_deprecated
Expand Down Expand Up @@ -56,6 +57,7 @@
from ._cloud_azure_registration import _cloud_azure_registration_endpoints
from ._cloud_oci_registration import _cloud_oci_registration_endpoints
from ._cloud_security_assets import _cloud_security_assets_endpoints
from ._cloud_security_compliance import _cloud_security_compliance_endpoints
from ._cloud_connect_aws import _cloud_connect_aws_endpoints
from ._cloud_snapshots import _cloud_snapshots_endpoints
from ._container_image_compliance import _container_image_compliance_endpoints
Expand Down Expand Up @@ -152,6 +154,7 @@
api_endpoints.extend(_cloud_azure_registration_endpoints)
api_endpoints.extend(_cloud_oci_registration_endpoints)
api_endpoints.extend(_cloud_security_assets_endpoints)
api_endpoints.extend(_cloud_security_compliance_endpoints)
api_endpoints.extend(_cloud_snapshots_endpoints)
api_endpoints.extend(_container_image_compliance_endpoints)
api_endpoints.extend(_configuration_assessment_evaluation_logic_endpoints)
Expand Down Expand Up @@ -242,6 +245,7 @@
deprecated_endpoints.extend(_cloud_azure_registration_deprecated)
deprecated_endpoints.extend(_cloud_oci_registration_deprecated)
deprecated_endpoints.extend(_cloud_security_assets_deprecated)
deprecated_endpoints.extend(_cloud_security_compliance_deprecated)
deprecated_endpoints.extend(_correlation_rules_deprecated)
deprecated_endpoints.extend(_certificate_based_exclusions_deprecated)
deprecated_endpoints.extend(_custom_ioa_deprecated)
Expand Down
98 changes: 98 additions & 0 deletions src/falconpy/_endpoint/_cloud_security_compliance.py
Original file line number Diff line number Diff line change
@@ -0,0 +1,98 @@
"""Internal API endpoint constant library.

_______ __ _______ __ __ __
| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----.
|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__|
|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____|
|: 1 | |: 1 |
|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy
`-------' `-------'

OAuth2 API - Customer SDK

This is free and unencumbered software released into the public domain.

Anyone is free to copy, modify, publish, use, compile, sell, or
distribute this software, either in source code form or as a compiled
binary, for any purpose, commercial or non-commercial, and by any
means.

In jurisdictions that recognize copyright laws, the author or authors
of this software dedicate any and all copyright interest in the
software to the public domain. We make this dedication for the benefit
of the public at large and to the detriment of our heirs and
successors. We intend this dedication to be an overt act of
relinquishment in perpetuity of all present and future rights to this
software under copyright law.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
OTHER DEALINGS IN THE SOFTWARE.

For more information, please refer to <https://unlicense.org>
"""

_cloud_security_compliance_endpoints = [
[
"cloud_compliance_framework_posture_summaries",
"GET",
"/cloud-security-compliance/entities/framework-posture-summaries/v1",
"Get sections and requirements with scores for benchmarks.",
"cloud_security_compliance",
[
{
"maxItems": 20,
"type": "array",
"items": {
"type": "string"
},
"collectionFormat": "csv",
"description": "The uuids of compliance frameworks to retrieve (maximum 20 IDs allowed).",
"name": "ids",
"in": "query",
"required": True
},
{
"type": "string",
"description": "FQL filter, supported properties:\n - account_id account_name business_impact "
"cloud_label cloud_label_id cloud_provider environment groups region resource_type resource_type_name "
"tag_key tag_value",
"name": "filter",
"in": "query"
}
]
],
[
"cloud_compliance_rule_posture_summaries",
"GET",
"/cloud-security-compliance/entities/rule-posture-summaries/v1",
"Get compliance score and counts for rules.",
"cloud_security_compliance",
[
{
"maxItems": 350,
"type": "array",
"items": {
"type": "string"
},
"collectionFormat": "csv",
"description": "The uuids of compliance rules to retrieve (maximum 350 IDs allowed).",
"name": "ids",
"in": "query",
"required": True
},
{
"type": "string",
"description": "FQL filter, supported properties:\n - account_id account_name business_impact "
"cloud_label cloud_label_id cloud_provider environment groups region resource_type resource_type_name "
"tag_key tag_value",
"name": "filter",
"in": "query"
}
]
]
]
2 changes: 2 additions & 0 deletions src/falconpy/_endpoint/deprecated/__init__.py
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@
from ._cloud_azure_registration import _cloud_azure_registration_endpoints
from ._cloud_oci_registration import _cloud_oci_registration_endpoints
from ._cloud_security_assets import _cloud_security_assets_endpoints
from ._cloud_security_compliance import _cloud_security_compliance_endpoints
from ._custom_ioa import _custom_ioa_endpoints
from ._correlation_rules import _correlation_rules_endpoints
from ._d4c_registration import _d4c_registration_endpoints
Expand Down Expand Up @@ -62,6 +63,7 @@
_cloud_azure_registration_deprecated = _cloud_azure_registration_endpoints
_cloud_oci_registration_deprecated = _cloud_oci_registration_endpoints
_cloud_security_assets_deprecated = _cloud_security_assets_endpoints
_cloud_security_compliance_deprecated = _cloud_security_compliance_endpoints
_correlation_rules_deprecated = _correlation_rules_endpoints
_custom_ioa_deprecated = _custom_ioa_endpoints
_d4c_registration_deprecated = _d4c_registration_endpoints
Expand Down
98 changes: 98 additions & 0 deletions src/falconpy/_endpoint/deprecated/_cloud_security_compliance.py
Original file line number Diff line number Diff line change
@@ -0,0 +1,98 @@
"""Internal API endpoint constant library (deprecated operations).

_______ __ _______ __ __ __
| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----.
|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__|
|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____|
|: 1 | |: 1 |
|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy
`-------' `-------'

OAuth2 API - Customer SDK

This is free and unencumbered software released into the public domain.

Anyone is free to copy, modify, publish, use, compile, sell, or
distribute this software, either in source code form or as a compiled
binary, for any purpose, commercial or non-commercial, and by any
means.

In jurisdictions that recognize copyright laws, the author or authors
of this software dedicate any and all copyright interest in the
software to the public domain. We make this dedication for the benefit
of the public at large and to the detriment of our heirs and
successors. We intend this dedication to be an overt act of
relinquishment in perpetuity of all present and future rights to this
software under copyright law.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
OTHER DEALINGS IN THE SOFTWARE.

For more information, please refer to <https://unlicense.org>
"""

_cloud_security_compliance_endpoints = [
[
"cloud-compliance-framework-posture-summaries",
"GET",
"/cloud-security-compliance/entities/framework-posture-summaries/v1",
"Get sections and requirements with scores for benchmarks.",
"cloud_security_compliance",
[
{
"maxItems": 20,
"type": "array",
"items": {
"type": "string"
},
"collectionFormat": "csv",
"description": "The uuids of compliance frameworks to retrieve (maximum 20 IDs allowed).",
"name": "ids",
"in": "query",
"required": True
},
{
"type": "string",
"description": "FQL filter, supported properties:\n - account_id account_name business_impact "
"cloud_label cloud_label_id cloud_provider environment groups region resource_type resource_type_name "
"tag_key tag_value",
"name": "filter",
"in": "query"
}
]
],
[
"cloud-compliance-rule-posture-summaries",
"GET",
"/cloud-security-compliance/entities/rule-posture-summaries/v1",
"Get compliance score and counts for rules.",
"cloud_security_compliance",
[
{
"maxItems": 350,
"type": "array",
"items": {
"type": "string"
},
"collectionFormat": "csv",
"description": "The uuids of compliance rules to retrieve (maximum 350 IDs allowed).",
"name": "ids",
"in": "query",
"required": True
},
{
"type": "string",
"description": "FQL filter, supported properties:\n - account_id account_name business_impact "
"cloud_label cloud_label_id cloud_provider environment groups region resource_type resource_type_name "
"tag_key tag_value",
"name": "filter",
"in": "query"
}
]
]
]
Loading