Class: Falcon::Detects

Inherits:
Object
  • Object
show all
Defined in:
lib/crimson-falcon/api/detects.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(api_client = ApiClient.default) ⇒ Detects 



36
37
38
 
# File 'lib/crimson-falcon/api/detects.rb', line 36

def initialize(api_client = ApiClient.default)
  @api_client = api_client
end

Instance Attribute Details

#api_client ⇒ Object

Returns the value of attribute api_client.



34
35
36
 
# File 'lib/crimson-falcon/api/detects.rb', line 34

def api_client
  @api_client
end

Instance Method Details

#get_aggregate_detects(body, opts = {}) ⇒ MsaAggregatesResponse

Get detect aggregates as specified via json in request body.



43
44
45
46
 
# File 'lib/crimson-falcon/api/detects.rb', line 43

def get_aggregate_detects(body, opts = {})
  data, _status_code, _headers = get_aggregate_detects_with_http_info(body, opts)
  data
end

#get_aggregate_detects_with_http_info(body, opts = {}) ⇒ Array<(MsaAggregatesResponse, Integer, Hash)>

Get detect aggregates as specified via json in request body.



52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
 
# File 'lib/crimson-falcon/api/detects.rb', line 52

def get_aggregate_detects_with_http_info(body, opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Detects.get_aggregate_detects ...'
  end
  # verify the required parameter 'body' is set
  if @api_client.config.client_side_validation && body.nil?
    fail ArgumentError, "Missing the required parameter 'body' when calling Detects.get_aggregate_detects"
  end
  # resource path
  local_var_path = '/detects/aggregates/detects/GET/v1'

  # query parameters
  query_params = opts[:query_params] || {}

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])
  # HTTP header 'Content-Type'
  content_type = @api_client.select_header_content_type(['application/json'])
  if !content_type.nil?
    header_params['Content-Type'] = content_type
  end

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body] || @api_client.object_to_http_body(body)

  # return_type
  return_type = opts[:debug_return_type] || 'MsaAggregatesResponse'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Detects.get_aggregate_detects",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:POST, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Detects#get_aggregate_detects\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#get_detect_summaries(body, opts = {}) ⇒ DomainMsaDetectSummariesResponse

View information about detections



109
110
111
112
 
# File 'lib/crimson-falcon/api/detects.rb', line 109

def get_detect_summaries(body, opts = {})
  data, _status_code, _headers = get_detect_summaries_with_http_info(body, opts)
  data
end

#get_detect_summaries_with_http_info(body, opts = {}) ⇒ Array<(DomainMsaDetectSummariesResponse, Integer, Hash)>

View information about detections



118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
 
# File 'lib/crimson-falcon/api/detects.rb', line 118

def get_detect_summaries_with_http_info(body, opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Detects.get_detect_summaries ...'
  end
  # verify the required parameter 'body' is set
  if @api_client.config.client_side_validation && body.nil?
    fail ArgumentError, "Missing the required parameter 'body' when calling Detects.get_detect_summaries"
  end
  # resource path
  local_var_path = '/detects/entities/summaries/GET/v1'

  # query parameters
  query_params = opts[:query_params] || {}

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])
  # HTTP header 'Content-Type'
  content_type = @api_client.select_header_content_type(['application/json'])
  if !content_type.nil?
    header_params['Content-Type'] = content_type
  end

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body] || @api_client.object_to_http_body(body)

  # return_type
  return_type = opts[:debug_return_type] || 'DomainMsaDetectSummariesResponse'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Detects.get_detect_summaries",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:POST, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Detects#get_detect_summaries\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#query_detects(opts = {}) ⇒ MsaQueryResponse

Search for detection IDs that match a given query

Options Hash (opts):

  • :offset (Integer) —

    The first detection to return, where &#x60;0&#x60; is the latest detection. Use with the &#x60;limit&#x60; parameter to manage pagination of results.

  • :limit (Integer) —

    The maximum number of detections to return in this response (default: 9999; max: 9999). Use with the &#x60;offset&#x60; parameter to manage pagination of results.

  • :sort (String) —

    Sort detections using these options: - &#x60;first_behavior&#x60;: Timestamp of the first behavior associated with this detection - &#x60;last_behavior&#x60;: Timestamp of the last behavior associated with this detection - &#x60;max_severity&#x60;: Highest severity of the behaviors associated with this detection - &#x60;max_confidence&#x60;: Highest confidence of the behaviors associated with this detection - &#x60;adversary_id&#x60;: ID of the adversary associated with this detection, if any - &#x60;device.hostname&#x60;: Hostname of the host where this detection was detected Sort either &#x60;asc&#x60; (ascending) or &#x60;desc&#x60; (descending). For example: &#x60;last_behavior|asc&#x60;

  • :filter (String) —

    Filter detections using a query in Falcon Query Language (FQL) An asterisk wildcard &#x60;*&#x60; includes all results. Common filter options include: - &#x60;status&#x60; - &#x60;device.device_id&#x60; - &#x60;max_severity&#x60; The full list of valid filter options is extensive. Review it in our [documentation inside the Falcon console](falcon.crowdstrike.com/documentation/45/falcon-query-language-fql).

  • :q (String) —

    Search all detection metadata for the provided string



179
180
181
182
 
# File 'lib/crimson-falcon/api/detects.rb', line 179

def query_detects(opts = {})
  data, _status_code, _headers = query_detects_with_http_info(opts)
  data
end

#query_detects_with_http_info(opts = {}) ⇒ Array<(MsaQueryResponse, Integer, Hash)>

Search for detection IDs that match a given query

Options Hash (opts):

  • :offset (Integer) —

    The first detection to return, where &#x60;0&#x60; is the latest detection. Use with the &#x60;limit&#x60; parameter to manage pagination of results.

  • :limit (Integer) —

    The maximum number of detections to return in this response (default: 9999; max: 9999). Use with the &#x60;offset&#x60; parameter to manage pagination of results.

  • :sort (String) —

    Sort detections using these options: - &#x60;first_behavior&#x60;: Timestamp of the first behavior associated with this detection - &#x60;last_behavior&#x60;: Timestamp of the last behavior associated with this detection - &#x60;max_severity&#x60;: Highest severity of the behaviors associated with this detection - &#x60;max_confidence&#x60;: Highest confidence of the behaviors associated with this detection - &#x60;adversary_id&#x60;: ID of the adversary associated with this detection, if any - &#x60;device.hostname&#x60;: Hostname of the host where this detection was detected Sort either &#x60;asc&#x60; (ascending) or &#x60;desc&#x60; (descending). For example: &#x60;last_behavior|asc&#x60;

  • :filter (String) —

    Filter detections using a query in Falcon Query Language (FQL) An asterisk wildcard &#x60;*&#x60; includes all results. Common filter options include: - &#x60;status&#x60; - &#x60;device.device_id&#x60; - &#x60;max_severity&#x60; The full list of valid filter options is extensive. Review it in our [documentation inside the Falcon console](falcon.crowdstrike.com/documentation/45/falcon-query-language-fql).

  • :q (String) —

    Search all detection metadata for the provided string



192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
 
# File 'lib/crimson-falcon/api/detects.rb', line 192

def query_detects_with_http_info(opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Detects.query_detects ...'
  end
  if @api_client.config.client_side_validation && !opts[:'limit'].nil? && opts[:'limit'] > 9999
    fail ArgumentError, 'invalid value for "opts[:"limit"]" when calling Detects.query_detects, must be smaller than or equal to 9999.'
  end

  if @api_client.config.client_side_validation && !opts[:'limit'].nil? && opts[:'limit'] < 0
    fail ArgumentError, 'invalid value for "opts[:"limit"]" when calling Detects.query_detects, must be greater than or equal to 0.'
  end

  # resource path
  local_var_path = '/detects/queries/detects/v1'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'offset'] = opts[:'offset'] if !opts[:'offset'].nil?
  query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
  query_params[:'sort'] = opts[:'sort'] if !opts[:'sort'].nil?
  query_params[:'filter'] = opts[:'filter'] if !opts[:'filter'].nil?
  query_params[:'q'] = opts[:'q'] if !opts[:'q'].nil?

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type] || 'MsaQueryResponse'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Detects.query_detects",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Detects#query_detects\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#update_detects_by_ids_v2(body, opts = {}) ⇒ MsaReplyMetaOnly

Modify the state, assignee, and visibility of detections



253
254
255
256
 
# File 'lib/crimson-falcon/api/detects.rb', line 253

def update_detects_by_ids_v2(body, opts = {})
  data, _status_code, _headers = update_detects_by_ids_v2_with_http_info(body, opts)
  data
end

#update_detects_by_ids_v2_with_http_info(body, opts = {}) ⇒ Array<(MsaReplyMetaOnly, Integer, Hash)>

Modify the state, assignee, and visibility of detections



262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
 
# File 'lib/crimson-falcon/api/detects.rb', line 262

def update_detects_by_ids_v2_with_http_info(body, opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Detects.update_detects_by_ids_v2 ...'
  end
  # verify the required parameter 'body' is set
  if @api_client.config.client_side_validation && body.nil?
    fail ArgumentError, "Missing the required parameter 'body' when calling Detects.update_detects_by_ids_v2"
  end
  # resource path
  local_var_path = '/detects/entities/detects/v2'

  # query parameters
  query_params = opts[:query_params] || {}

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])
  # HTTP header 'Content-Type'
  content_type = @api_client.select_header_content_type(['application/json'])
  if !content_type.nil?
    header_params['Content-Type'] = content_type
  end

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body] || @api_client.object_to_http_body(body)

  # return_type
  return_type = opts[:debug_return_type] || 'MsaReplyMetaOnly'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Detects.update_detects_by_ids_v2",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:PATCH, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Detects#update_detects_by_ids_v2\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end