Class: Falcon::Intel

Inherits:
Object
  • Object
show all
Defined in:
lib/crimson-falcon/api/intel.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(api_client = ApiClient.default) ⇒ Intel

Returns a new instance of Intel.



36
37
38
 
# File 'lib/crimson-falcon/api/intel.rb', line 36

def initialize(api_client = ApiClient.default)
  @api_client = api_client
end

Instance Attribute Details

#api_client ⇒ Object

Returns the value of attribute api_client.



34
35
36
 
# File 'lib/crimson-falcon/api/intel.rb', line 34

def api_client
  @api_client
end

Instance Method Details

#get_intel_actor_entities(ids, opts = {}) ⇒ DomainActorsResponse

Retrieve specific actors using their actor IDs.

Parameters:

  • ids (Array<String>) —

    The IDs of the actors you want to retrieve.

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :fields (Array<String>) —

    The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like: __\&lt;collection\&gt;__. Ex: slug _full_. Defaults to _basic_.

Returns:



44
45
46
47
 
# File 'lib/crimson-falcon/api/intel.rb', line 44

def get_intel_actor_entities(ids, opts = {})
  data, _status_code, _headers = get_intel_actor_entities_with_http_info(ids, opts)
  data
end

#get_intel_actor_entities_with_http_info(ids, opts = {}) ⇒ Array<(DomainActorsResponse, Integer, Hash)>

Retrieve specific actors using their actor IDs.

Parameters:

  • ids (Array<String>) —

    The IDs of the actors you want to retrieve.

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :fields (Array<String>) —

    The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like: __\&lt;collection\&gt;__. Ex: slug _full_. Defaults to _basic_.

Returns:

  • (Array<(DomainActorsResponse, Integer, Hash)>) —

    DomainActorsResponse data, response status code and response headers



54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
 
# File 'lib/crimson-falcon/api/intel.rb', line 54

def get_intel_actor_entities_with_http_info(ids, opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Intel.get_intel_actor_entities ...'
  end
  # verify the required parameter 'ids' is set
  if @api_client.config.client_side_validation && ids.nil?
    fail ArgumentError, "Missing the required parameter 'ids' when calling Intel.get_intel_actor_entities"
  end
  # resource path
  local_var_path = '/intel/entities/actors/v1'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'ids'] = @api_client.build_collection_param(ids, :multi)
  query_params[:'fields'] = @api_client.build_collection_param(opts[:'fields'], :multi) if !opts[:'fields'].nil?

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type] || 'DomainActorsResponse'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Intel.get_intel_actor_entities",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Intel#get_intel_actor_entities\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#get_intel_indicator_entities(body, opts = {}) ⇒ DomainPublicIndicatorsV3Response

Retrieve specific indicators using their indicator IDs.

Parameters:

  • body (MsaIdsRequest)
  • opts (Hash) (defaults to: {}) —

    the optional parameters

Returns:



108
109
110
111
 
# File 'lib/crimson-falcon/api/intel.rb', line 108

def get_intel_indicator_entities(body, opts = {})
  data, _status_code, _headers = get_intel_indicator_entities_with_http_info(body, opts)
  data
end

#get_intel_indicator_entities_with_http_info(body, opts = {}) ⇒ Array<(DomainPublicIndicatorsV3Response, Integer, Hash)>

Retrieve specific indicators using their indicator IDs.

Parameters:

  • body (MsaIdsRequest)
  • opts (Hash) (defaults to: {}) —

    the optional parameters

Returns:



117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
 
# File 'lib/crimson-falcon/api/intel.rb', line 117

def get_intel_indicator_entities_with_http_info(body, opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Intel.get_intel_indicator_entities ...'
  end
  # verify the required parameter 'body' is set
  if @api_client.config.client_side_validation && body.nil?
    fail ArgumentError, "Missing the required parameter 'body' when calling Intel.get_intel_indicator_entities"
  end
  # resource path
  local_var_path = '/intel/entities/indicators/GET/v1'

  # query parameters
  query_params = opts[:query_params] || {}

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])
  # HTTP header 'Content-Type'
  content_type = @api_client.select_header_content_type(['application/json'])
  if !content_type.nil?
    header_params['Content-Type'] = content_type
  end

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body] || @api_client.object_to_http_body(body)

  # return_type
  return_type = opts[:debug_return_type] || 'DomainPublicIndicatorsV3Response'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Intel.get_intel_indicator_entities",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:POST, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Intel#get_intel_indicator_entities\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#get_intel_report_entities(ids, opts = {}) ⇒ DomainNewsResponse

Retrieve specific reports using their report IDs.

Parameters:

  • ids (Array<String>) —

    The IDs of the reports you want to retrieve.

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :fields (Array<String>) —

    The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like: __\&lt;collection\&gt;__. Ex: slug _full_. Defaults to _basic_.

Returns:



175
176
177
178
 
# File 'lib/crimson-falcon/api/intel.rb', line 175

def get_intel_report_entities(ids, opts = {})
  data, _status_code, _headers = get_intel_report_entities_with_http_info(ids, opts)
  data
end

#get_intel_report_entities_with_http_info(ids, opts = {}) ⇒ Array<(DomainNewsResponse, Integer, Hash)>

Retrieve specific reports using their report IDs.

Parameters:

  • ids (Array<String>) —

    The IDs of the reports you want to retrieve.

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :fields (Array<String>) —

    The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like: __\&lt;collection\&gt;__. Ex: slug _full_. Defaults to _basic_.

Returns:

  • (Array<(DomainNewsResponse, Integer, Hash)>) —

    DomainNewsResponse data, response status code and response headers



185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
 
# File 'lib/crimson-falcon/api/intel.rb', line 185

def get_intel_report_entities_with_http_info(ids, opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Intel.get_intel_report_entities ...'
  end
  # verify the required parameter 'ids' is set
  if @api_client.config.client_side_validation && ids.nil?
    fail ArgumentError, "Missing the required parameter 'ids' when calling Intel.get_intel_report_entities"
  end
  # resource path
  local_var_path = '/intel/entities/reports/v1'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'ids'] = @api_client.build_collection_param(ids, :multi)
  query_params[:'fields'] = @api_client.build_collection_param(opts[:'fields'], :multi) if !opts[:'fields'].nil?

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type] || 'DomainNewsResponse'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Intel.get_intel_report_entities",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Intel#get_intel_report_entities\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#get_intel_report_pdf(opts = {}) ⇒ File

Return a Report PDF attachment

Parameters:

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :id (String) —

    The ID of the report you want to download as a PDF.

  • :ids (String) —

    The ID of the report you want to download as a PDF. This parameter is used only if no id parameter given.

Returns:

  • (File) 


240
241
242
243
 
# File 'lib/crimson-falcon/api/intel.rb', line 240

def get_intel_report_pdf(opts = {})
  data, _status_code, _headers = get_intel_report_pdf_with_http_info(opts)
  data
end

#get_intel_report_pdf_with_http_info(opts = {}) ⇒ Array<(File, Integer, Hash)>

Return a Report PDF attachment

Parameters:

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :id (String) —

    The ID of the report you want to download as a PDF.

  • :ids (String) —

    The ID of the report you want to download as a PDF. This parameter is used only if no id parameter given.

Returns:

  • (Array<(File, Integer, Hash)>) —

    File data, response status code and response headers



250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
 
# File 'lib/crimson-falcon/api/intel.rb', line 250

def get_intel_report_pdf_with_http_info(opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Intel.get_intel_report_pdf ...'
  end
  # resource path
  local_var_path = '/intel/entities/report-files/v1'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'id'] = opts[:'id'] if !opts[:'id'].nil?
  query_params[:'ids'] = opts[:'ids'] if !opts[:'ids'].nil?

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/octet-stream', 'application/json', 'application/pdf'])

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type] || 'File'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Intel.get_intel_report_pdf",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Intel#get_intel_report_pdf\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#get_intel_rule_entities(ids, opts = {}) ⇒ DomainRulesResponse

Retrieve details for rule sets for the specified ids.

Parameters:

  • ids (Array<String>) —

    The ids of rules to return.

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Returns:



300
301
302
303
 
# File 'lib/crimson-falcon/api/intel.rb', line 300

def get_intel_rule_entities(ids, opts = {})
  data, _status_code, _headers = get_intel_rule_entities_with_http_info(ids, opts)
  data
end

#get_intel_rule_entities_with_http_info(ids, opts = {}) ⇒ Array<(DomainRulesResponse, Integer, Hash)>

Retrieve details for rule sets for the specified ids.

Parameters:

  • ids (Array<String>) —

    The ids of rules to return.

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Returns:

  • (Array<(DomainRulesResponse, Integer, Hash)>) —

    DomainRulesResponse data, response status code and response headers



309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
 
# File 'lib/crimson-falcon/api/intel.rb', line 309

def get_intel_rule_entities_with_http_info(ids, opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Intel.get_intel_rule_entities ...'
  end
  # verify the required parameter 'ids' is set
  if @api_client.config.client_side_validation && ids.nil?
    fail ArgumentError, "Missing the required parameter 'ids' when calling Intel.get_intel_rule_entities"
  end
  # resource path
  local_var_path = '/intel/entities/rules/v1'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'ids'] = @api_client.build_collection_param(ids, :multi)

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type] || 'DomainRulesResponse'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Intel.get_intel_rule_entities",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Intel#get_intel_rule_entities\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#get_intel_rule_file(id, opts = {}) ⇒ File

Download earlier rule sets.

Parameters:

  • id (Integer) —

    The ID of the rule set.

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :accept (String) —

    Choose the format you want the rule set in.

  • :format (String) —

    Choose the format you want the rule set in. Valid formats are zip and gzip. Defaults to zip.

Returns:

  • (File) 


364
365
366
367
 
# File 'lib/crimson-falcon/api/intel.rb', line 364

def get_intel_rule_file(id, opts = {})
  data, _status_code, _headers = get_intel_rule_file_with_http_info(id, opts)
  data
end

#get_intel_rule_file_with_http_info(id, opts = {}) ⇒ Array<(File, Integer, Hash)>

Download earlier rule sets.

Parameters:

  • id (Integer) —

    The ID of the rule set.

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :accept (String) —

    Choose the format you want the rule set in.

  • :format (String) —

    Choose the format you want the rule set in. Valid formats are zip and gzip. Defaults to zip.

Returns:

  • (Array<(File, Integer, Hash)>) —

    File data, response status code and response headers



375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
 
# File 'lib/crimson-falcon/api/intel.rb', line 375

def get_intel_rule_file_with_http_info(id, opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Intel.get_intel_rule_file ...'
  end
  # verify the required parameter 'id' is set
  if @api_client.config.client_side_validation && id.nil?
    fail ArgumentError, "Missing the required parameter 'id' when calling Intel.get_intel_rule_file"
  end
  # resource path
  local_var_path = '/intel/entities/rules-files/v1'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'id'] = id
  query_params[:'format'] = opts[:'format'] if !opts[:'format'].nil?

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/zip', 'application/gzip', 'application/octet-stream', 'application/json', '*/*'])
  header_params[:'Accept'] = opts[:'accept'] if !opts[:'accept'].nil?

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type] || 'File'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Intel.get_intel_rule_file",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Intel#get_intel_rule_file\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#get_latest_intel_rule_file(type, opts = {}) ⇒ File

Download the latest rule set.

Parameters:

  • type (String) —

    The rule news report type. Accepted values: snort-suricata-master snort-suricata-update snort-suricata-changelog yara-master yara-update yara-changelog common-event-format netwitness cql-master cql-update cql-changelog

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :accept (String) —

    Choose the format you want the rule set in.

  • :if_none_match (String) —

    Download the latest rule set only if it doesn&#39;t have an ETag matching the given ones.

  • :if_modified_since (String) —

    Download the latest rule set only if the rule was modified after this date. http, ANSIC and RFC850 formats accepted

  • :format (String) —

    Choose the format you want the rule set in. Valid formats are zip and gzip. Defaults to zip.

  • :if_modified_since2 (String) —

    Download Only if changed since

Returns:

  • (File) 


435
436
437
438
 
# File 'lib/crimson-falcon/api/intel.rb', line 435

def get_latest_intel_rule_file(type, opts = {})
  data, _status_code, _headers = get_latest_intel_rule_file_with_http_info(type, opts)
  data
end

#get_latest_intel_rule_file_with_http_info(type, opts = {}) ⇒ Array<(File, Integer, Hash)>

Download the latest rule set.

Parameters:

  • type (String) —

    The rule news report type. Accepted values: snort-suricata-master snort-suricata-update snort-suricata-changelog yara-master yara-update yara-changelog common-event-format netwitness cql-master cql-update cql-changelog

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :accept (String) —

    Choose the format you want the rule set in.

  • :if_none_match (String) —

    Download the latest rule set only if it doesn&#39;t have an ETag matching the given ones.

  • :if_modified_since (String) —

    Download the latest rule set only if the rule was modified after this date. http, ANSIC and RFC850 formats accepted

  • :format (String) —

    Choose the format you want the rule set in. Valid formats are zip and gzip. Defaults to zip.

  • :if_modified_since2 (String) —

    Download Only if changed since

Returns:

  • (Array<(File, Integer, Hash)>) —

    File data, response status code and response headers



449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
 
# File 'lib/crimson-falcon/api/intel.rb', line 449

def get_latest_intel_rule_file_with_http_info(type, opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Intel.get_latest_intel_rule_file ...'
  end
  # verify the required parameter 'type' is set
  if @api_client.config.client_side_validation && type.nil?
    fail ArgumentError, "Missing the required parameter 'type' when calling Intel.get_latest_intel_rule_file"
  end
  # resource path
  local_var_path = '/intel/entities/rules-latest-files/v1'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'type'] = type
  query_params[:'format'] = opts[:'format'] if !opts[:'format'].nil?

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/zip', 'application/gzip', 'application/octet-stream', 'application/json', '*/*'])
  header_params[:'Accept'] = opts[:'accept'] if !opts[:'accept'].nil?
  header_params[:'If-None-Match'] = opts[:'if_none_match'] if !opts[:'if_none_match'].nil?
  header_params[:'If-Modified-Since'] = opts[:'if_modified_since'] if !opts[:'if_modified_since'].nil?
  header_params[:'If-Modified-Since'] = opts[:'if_modified_since2'] if !opts[:'if_modified_since2'].nil?

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type] || 'File'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Intel.get_latest_intel_rule_file",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Intel#get_latest_intel_rule_file\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#get_malware_entities(ids, opts = {}) ⇒ DomainMalwareResponse

Get malware entities for specified ids.

Parameters:

  • ids (Array<String>) —

    Malware family name in lower case with spaces, dots and slashes replaced with dashes

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Returns:



507
508
509
510
 
# File 'lib/crimson-falcon/api/intel.rb', line 507

def get_malware_entities(ids, opts = {})
  data, _status_code, _headers = get_malware_entities_with_http_info(ids, opts)
  data
end

#get_malware_entities_with_http_info(ids, opts = {}) ⇒ Array<(DomainMalwareResponse, Integer, Hash)>

Get malware entities for specified ids.

Parameters:

  • ids (Array<String>) —

    Malware family name in lower case with spaces, dots and slashes replaced with dashes

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Returns:

  • (Array<(DomainMalwareResponse, Integer, Hash)>) —

    DomainMalwareResponse data, response status code and response headers



516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
 
# File 'lib/crimson-falcon/api/intel.rb', line 516

def get_malware_entities_with_http_info(ids, opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Intel.get_malware_entities ...'
  end
  # verify the required parameter 'ids' is set
  if @api_client.config.client_side_validation && ids.nil?
    fail ArgumentError, "Missing the required parameter 'ids' when calling Intel.get_malware_entities"
  end
  # resource path
  local_var_path = '/intel/entities/malware/v1'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'ids'] = @api_client.build_collection_param(ids, :multi)

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type] || 'DomainMalwareResponse'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Intel.get_malware_entities",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Intel#get_malware_entities\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#get_malware_mitre_report(id, format, opts = {}) ⇒ nil

Export Mitre ATT&CK information for a given malware family.

Parameters:

  • id (String) —

    Malware family name in lower case with spaces replaced with dashes

  • format (String) —

    Supported report formats: CSV, JSON or JSON_NAVIGATOR

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :x_cs_useruuid (String) —

    User id

Returns:

  • (nil) 


571
572
573
574
 
# File 'lib/crimson-falcon/api/intel.rb', line 571

def get_malware_mitre_report(id, format, opts = {})
  get_malware_mitre_report_with_http_info(id, format, opts)
  nil
end

#get_malware_mitre_report_with_http_info(id, format, opts = {}) ⇒ Array<(nil, Integer, Hash)>

Export Mitre ATT&amp;CK information for a given malware family.

Parameters:

  • id (String) —

    Malware family name in lower case with spaces replaced with dashes

  • format (String) —

    Supported report formats: CSV, JSON or JSON_NAVIGATOR

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :x_cs_useruuid (String) —

    User id

Returns:

  • (Array<(nil, Integer, Hash)>) —

    nil, response status code and response headers



582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
 
# File 'lib/crimson-falcon/api/intel.rb', line 582

def get_malware_mitre_report_with_http_info(id, format, opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Intel.get_malware_mitre_report ...'
  end
  # verify the required parameter 'id' is set
  if @api_client.config.client_side_validation && id.nil?
    fail ArgumentError, "Missing the required parameter 'id' when calling Intel.get_malware_mitre_report"
  end
  # verify the required parameter 'format' is set
  if @api_client.config.client_side_validation && format.nil?
    fail ArgumentError, "Missing the required parameter 'format' when calling Intel.get_malware_mitre_report"
  end
  # resource path
  local_var_path = '/intel/entities/malware-mitre-reports/v1'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'id'] = id
  query_params[:'format'] = format

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json', 'text/csv'])
  header_params[:'X-CS-USERUUID'] = opts[:'x_cs_useruuid'] if !opts[:'x_cs_useruuid'].nil?

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type]

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Intel.get_malware_mitre_report",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Intel#get_malware_mitre_report\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#get_mitre_report(actor_id, format, opts = {}) ⇒ nil

Export Mitre ATT&CK information for a given actor.

Parameters:

  • actor_id (String) —

    Actor ID(derived from the actor&#39;s name)

  • format (String) —

    Supported report formats: CSV or JSON

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Returns:

  • (nil) 


642
643
644
645
 
# File 'lib/crimson-falcon/api/intel.rb', line 642

def get_mitre_report(actor_id, format, opts = {})
  get_mitre_report_with_http_info(actor_id, format, opts)
  nil
end

#get_mitre_report_with_http_info(actor_id, format, opts = {}) ⇒ Array<(nil, Integer, Hash)>

Export Mitre ATT&amp;CK information for a given actor.

Parameters:

  • actor_id (String) —

    Actor ID(derived from the actor&#39;s name)

  • format (String) —

    Supported report formats: CSV or JSON

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Returns:

  • (Array<(nil, Integer, Hash)>) —

    nil, response status code and response headers



652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
 
# File 'lib/crimson-falcon/api/intel.rb', line 652

def get_mitre_report_with_http_info(actor_id, format, opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Intel.get_mitre_report ...'
  end
  # verify the required parameter 'actor_id' is set
  if @api_client.config.client_side_validation && actor_id.nil?
    fail ArgumentError, "Missing the required parameter 'actor_id' when calling Intel.get_mitre_report"
  end
  # verify the required parameter 'format' is set
  if @api_client.config.client_side_validation && format.nil?
    fail ArgumentError, "Missing the required parameter 'format' when calling Intel.get_mitre_report"
  end
  # resource path
  local_var_path = '/intel/entities/mitre-reports/v1'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'actor_id'] = actor_id
  query_params[:'format'] = format

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/octet-stream', 'application/json', 'text/csv'])

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type]

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Intel.get_mitre_report",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Intel#get_mitre_report\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#get_vulnerabilities(body, opts = {}) ⇒ DomainVulnerabilityResponse

Get vulnerabilities

Parameters:

  • body (MsaIdsRequest)
  • opts (Hash) (defaults to: {}) —

    the optional parameters

Returns:



710
711
712
713
 
# File 'lib/crimson-falcon/api/intel.rb', line 710

def get_vulnerabilities(body, opts = {})
  data, _status_code, _headers = get_vulnerabilities_with_http_info(body, opts)
  data
end

#get_vulnerabilities_with_http_info(body, opts = {}) ⇒ Array<(DomainVulnerabilityResponse, Integer, Hash)>

Get vulnerabilities

Parameters:

  • body (MsaIdsRequest)
  • opts (Hash) (defaults to: {}) —

    the optional parameters

Returns:

  • (Array<(DomainVulnerabilityResponse, Integer, Hash)>) —

    DomainVulnerabilityResponse data, response status code and response headers



719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
 
# File 'lib/crimson-falcon/api/intel.rb', line 719

def get_vulnerabilities_with_http_info(body, opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Intel.get_vulnerabilities ...'
  end
  # verify the required parameter 'body' is set
  if @api_client.config.client_side_validation && body.nil?
    fail ArgumentError, "Missing the required parameter 'body' when calling Intel.get_vulnerabilities"
  end
  # resource path
  local_var_path = '/intel/entities/vulnerabilities/GET/v1'

  # query parameters
  query_params = opts[:query_params] || {}

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])
  # HTTP header 'Content-Type'
  content_type = @api_client.select_header_content_type(['application/json'])
  if !content_type.nil?
    header_params['Content-Type'] = content_type
  end

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body] || @api_client.object_to_http_body(body)

  # return_type
  return_type = opts[:debug_return_type] || 'DomainVulnerabilityResponse'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Intel.get_vulnerabilities",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:POST, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Intel#get_vulnerabilities\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#post_mitre_attacks(body, opts = {}) ⇒ nil

Retrieves report and observable IDs associated with the given actor and attacks

Parameters:

  • body (MsaIdsRequest)
  • opts (Hash) (defaults to: {}) —

    the optional parameters

Returns:

  • (nil) 


776
777
778
779
 
# File 'lib/crimson-falcon/api/intel.rb', line 776

def post_mitre_attacks(body, opts = {})
  post_mitre_attacks_with_http_info(body, opts)
  nil
end

#post_mitre_attacks_with_http_info(body, opts = {}) ⇒ Array<(nil, Integer, Hash)>

Retrieves report and observable IDs associated with the given actor and attacks

Parameters:

  • body (MsaIdsRequest)
  • opts (Hash) (defaults to: {}) —

    the optional parameters

Returns:

  • (Array<(nil, Integer, Hash)>) —

    nil, response status code and response headers



785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
 
# File 'lib/crimson-falcon/api/intel.rb', line 785

def post_mitre_attacks_with_http_info(body, opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Intel.post_mitre_attacks ...'
  end
  # verify the required parameter 'body' is set
  if @api_client.config.client_side_validation && body.nil?
    fail ArgumentError, "Missing the required parameter 'body' when calling Intel.post_mitre_attacks"
  end
  # resource path
  local_var_path = '/intel/entities/mitre/v1'

  # query parameters
  query_params = opts[:query_params] || {}

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])
  # HTTP header 'Content-Type'
  content_type = @api_client.select_header_content_type(['application/json'])
  if !content_type.nil?
    header_params['Content-Type'] = content_type
  end

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body] || @api_client.object_to_http_body(body)

  # return_type
  return_type = opts[:debug_return_type]

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Intel.post_mitre_attacks",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:POST, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Intel#post_mitre_attacks\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#query_intel_actor_entities(opts = {}) ⇒ DomainActorsResponse

Get info about actors that match provided FQL filters.

Parameters:

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :offset (Integer) —

    Set the starting row number to return actors from. Defaults to 0.

  • :limit (Integer) —

    Set the number of actors to return. The value must be between 1 and 5000.

  • :sort (String) —

    Order fields in ascending or descending order. Ex: created_date|asc.

  • :filter (String) —

    Filter your query by specifying FQL filter parameters. Filter parameters include: actor_type, animal_classifier, capabilities, capability, capability.id, capability.slug, capability.value, created_date, description, ecrime_kill_chain.attribution, ecrime_kill_chain.crimes, ecrime_kill_chain.customers, ecrime_kill_chain.marketing, ecrime_kill_chain.monetization, ecrime_kill_chain.services_offered, ecrime_kill_chain.services_used, ecrime_kill_chain.technical_tradecraft, ecrime_kill_chain.victims, first_activity_date, group, group.id, group.slug, group.value, id, kill_chain.actions_and_objectives, kill_chain.actions_on_objectives, kill_chain.command_and_control, kill_chain.delivery, kill_chain.exploitation, kill_chain.installation, kill_chain.objectives, kill_chain.reconnaissance, kill_chain.weaponization, known_as, last_activity_date, last_modified_date, motivations, motivations.id, motivations.slug, motivations.value, name, objectives, origins, origins.id, origins.slug, origins.value, region, region.id, region.slug, region.value, short_description, slug, status, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, target_regions, target_regions.id, target_regions.slug, target_regions.value.

  • :q (String) —

    Perform a generic substring search across all fields.

  • :fields (Array<String>) —

    The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like: __\&lt;collection\&gt;__. Ex: slug _full_. Defaults to _basic_.

Returns:



847
848
849
850
 
# File 'lib/crimson-falcon/api/intel.rb', line 847

def query_intel_actor_entities(opts = {})
  data, _status_code, _headers = query_intel_actor_entities_with_http_info(opts)
  data
end

#query_intel_actor_entities_with_http_info(opts = {}) ⇒ Array<(DomainActorsResponse, Integer, Hash)>

Get info about actors that match provided FQL filters.

Parameters:

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :offset (Integer) —

    Set the starting row number to return actors from. Defaults to 0.

  • :limit (Integer) —

    Set the number of actors to return. The value must be between 1 and 5000.

  • :sort (String) —

    Order fields in ascending or descending order. Ex: created_date|asc.

  • :filter (String) —

    Filter your query by specifying FQL filter parameters. Filter parameters include: actor_type, animal_classifier, capabilities, capability, capability.id, capability.slug, capability.value, created_date, description, ecrime_kill_chain.attribution, ecrime_kill_chain.crimes, ecrime_kill_chain.customers, ecrime_kill_chain.marketing, ecrime_kill_chain.monetization, ecrime_kill_chain.services_offered, ecrime_kill_chain.services_used, ecrime_kill_chain.technical_tradecraft, ecrime_kill_chain.victims, first_activity_date, group, group.id, group.slug, group.value, id, kill_chain.actions_and_objectives, kill_chain.actions_on_objectives, kill_chain.command_and_control, kill_chain.delivery, kill_chain.exploitation, kill_chain.installation, kill_chain.objectives, kill_chain.reconnaissance, kill_chain.weaponization, known_as, last_activity_date, last_modified_date, motivations, motivations.id, motivations.slug, motivations.value, name, objectives, origins, origins.id, origins.slug, origins.value, region, region.id, region.slug, region.value, short_description, slug, status, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, target_regions, target_regions.id, target_regions.slug, target_regions.value.

  • :q (String) —

    Perform a generic substring search across all fields.

  • :fields (Array<String>) —

    The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like: __\&lt;collection\&gt;__. Ex: slug _full_. Defaults to _basic_.

Returns:

  • (Array<(DomainActorsResponse, Integer, Hash)>) —

    DomainActorsResponse data, response status code and response headers



861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
 
# File 'lib/crimson-falcon/api/intel.rb', line 861

def query_intel_actor_entities_with_http_info(opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Intel.query_intel_actor_entities ...'
  end
  # resource path
  local_var_path = '/intel/combined/actors/v1'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'offset'] = opts[:'offset'] if !opts[:'offset'].nil?
  query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
  query_params[:'sort'] = opts[:'sort'] if !opts[:'sort'].nil?
  query_params[:'filter'] = opts[:'filter'] if !opts[:'filter'].nil?
  query_params[:'q'] = opts[:'q'] if !opts[:'q'].nil?
  query_params[:'fields'] = @api_client.build_collection_param(opts[:'fields'], :multi) if !opts[:'fields'].nil?

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type] || 'DomainActorsResponse'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Intel.query_intel_actor_entities",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Intel#query_intel_actor_entities\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#query_intel_actor_ids(opts = {}) ⇒ MsaQueryResponse

Get actor IDs that match provided FQL filters.

Parameters:

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :offset (Integer) —

    Set the starting row number to return actors IDs from. Defaults to 0.

  • :limit (Integer) —

    Set the number of actor IDs to return. The value must be between 1 and 5000.

  • :sort (String) —

    Order fields in ascending or descending order. Ex: created_date|asc.

  • :filter (String) —

    Filter your query by specifying FQL filter parameters. Filter parameters include: actor_type, animal_classifier, capabilities, capability, capability.id, capability.slug, capability.value, created_date, description, ecrime_kill_chain.attribution, ecrime_kill_chain.crimes, ecrime_kill_chain.customers, ecrime_kill_chain.marketing, ecrime_kill_chain.monetization, ecrime_kill_chain.services_offered, ecrime_kill_chain.services_used, ecrime_kill_chain.technical_tradecraft, ecrime_kill_chain.victims, first_activity_date, group, group.id, group.slug, group.value, id, kill_chain.actions_and_objectives, kill_chain.actions_on_objectives, kill_chain.command_and_control, kill_chain.delivery, kill_chain.exploitation, kill_chain.installation, kill_chain.objectives, kill_chain.reconnaissance, kill_chain.weaponization, known_as, last_activity_date, last_modified_date, motivations, motivations.id, motivations.slug, motivations.value, name, objectives, origins, origins.id, origins.slug, origins.value, region, region.id, region.slug, region.value, short_description, slug, status, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, target_regions, target_regions.id, target_regions.slug, target_regions.value.

  • :q (String) —

    Perform a generic substring search across all fields.

Returns:



919
920
921
922
 
# File 'lib/crimson-falcon/api/intel.rb', line 919

def query_intel_actor_ids(opts = {})
  data, _status_code, _headers = query_intel_actor_ids_with_http_info(opts)
  data
end

#query_intel_actor_ids_with_http_info(opts = {}) ⇒ Array<(MsaQueryResponse, Integer, Hash)>

Get actor IDs that match provided FQL filters.

Parameters:

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :offset (Integer) —

    Set the starting row number to return actors IDs from. Defaults to 0.

  • :limit (Integer) —

    Set the number of actor IDs to return. The value must be between 1 and 5000.

  • :sort (String) —

    Order fields in ascending or descending order. Ex: created_date|asc.

  • :filter (String) —

    Filter your query by specifying FQL filter parameters. Filter parameters include: actor_type, animal_classifier, capabilities, capability, capability.id, capability.slug, capability.value, created_date, description, ecrime_kill_chain.attribution, ecrime_kill_chain.crimes, ecrime_kill_chain.customers, ecrime_kill_chain.marketing, ecrime_kill_chain.monetization, ecrime_kill_chain.services_offered, ecrime_kill_chain.services_used, ecrime_kill_chain.technical_tradecraft, ecrime_kill_chain.victims, first_activity_date, group, group.id, group.slug, group.value, id, kill_chain.actions_and_objectives, kill_chain.actions_on_objectives, kill_chain.command_and_control, kill_chain.delivery, kill_chain.exploitation, kill_chain.installation, kill_chain.objectives, kill_chain.reconnaissance, kill_chain.weaponization, known_as, last_activity_date, last_modified_date, motivations, motivations.id, motivations.slug, motivations.value, name, objectives, origins, origins.id, origins.slug, origins.value, region, region.id, region.slug, region.value, short_description, slug, status, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, target_regions, target_regions.id, target_regions.slug, target_regions.value.

  • :q (String) —

    Perform a generic substring search across all fields.

Returns:

  • (Array<(MsaQueryResponse, Integer, Hash)>) —

    MsaQueryResponse data, response status code and response headers



932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
 
# File 'lib/crimson-falcon/api/intel.rb', line 932

def query_intel_actor_ids_with_http_info(opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Intel.query_intel_actor_ids ...'
  end
  # resource path
  local_var_path = '/intel/queries/actors/v1'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'offset'] = opts[:'offset'] if !opts[:'offset'].nil?
  query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
  query_params[:'sort'] = opts[:'sort'] if !opts[:'sort'].nil?
  query_params[:'filter'] = opts[:'filter'] if !opts[:'filter'].nil?
  query_params[:'q'] = opts[:'q'] if !opts[:'q'].nil?

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type] || 'MsaQueryResponse'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Intel.query_intel_actor_ids",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Intel#query_intel_actor_ids\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#query_intel_indicator_entities(opts = {}) ⇒ DomainPublicIndicatorsV3Response

Get info about indicators that match provided FQL filters.

Parameters:

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :offset (Integer) —

    Set the starting row number to return indicators from. Defaults to 0.

  • :limit (Integer) —

    Set the number of indicators to return. The number must be between 1 and 10000

  • :sort (String) —

    Order fields in ascending or descending order. Ex: published_date|asc.

  • :filter (String) —

    Filter your query by specifying FQL filter parameters. Filter parameters include: _marker, actors, deleted, domain_types, id, indicator, ip_address_types, kill_chains, labels, labels.created_on, labels.last_valid_on, labels.name, last_updated, malicious_confidence, malware_families, published_date, reports, scope, targets, threat_types, type, vulnerabilities.

  • :q (String) —

    Perform a generic substring search across all fields.

  • :include_deleted (Boolean) —

    If true, include both published and deleted indicators in the response. Defaults to false.

  • :include_relations (Boolean) —

    If true, include related indicators in the response. Defaults to true.

Returns:



991
992
993
994
 
# File 'lib/crimson-falcon/api/intel.rb', line 991

def query_intel_indicator_entities(opts = {})
  data, _status_code, _headers = query_intel_indicator_entities_with_http_info(opts)
  data
end

#query_intel_indicator_entities_with_http_info(opts = {}) ⇒ Array<(DomainPublicIndicatorsV3Response, Integer, Hash)>

Get info about indicators that match provided FQL filters.

Parameters:

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :offset (Integer) —

    Set the starting row number to return indicators from. Defaults to 0.

  • :limit (Integer) —

    Set the number of indicators to return. The number must be between 1 and 10000

  • :sort (String) —

    Order fields in ascending or descending order. Ex: published_date|asc.

  • :filter (String) —

    Filter your query by specifying FQL filter parameters. Filter parameters include: _marker, actors, deleted, domain_types, id, indicator, ip_address_types, kill_chains, labels, labels.created_on, labels.last_valid_on, labels.name, last_updated, malicious_confidence, malware_families, published_date, reports, scope, targets, threat_types, type, vulnerabilities.

  • :q (String) —

    Perform a generic substring search across all fields.

  • :include_deleted (Boolean) —

    If true, include both published and deleted indicators in the response. Defaults to false.

  • :include_relations (Boolean) —

    If true, include related indicators in the response. Defaults to true.

Returns:



1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
 
# File 'lib/crimson-falcon/api/intel.rb', line 1006

def query_intel_indicator_entities_with_http_info(opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Intel.query_intel_indicator_entities ...'
  end
  # resource path
  local_var_path = '/intel/combined/indicators/v1'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'offset'] = opts[:'offset'] if !opts[:'offset'].nil?
  query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
  query_params[:'sort'] = opts[:'sort'] if !opts[:'sort'].nil?
  query_params[:'filter'] = opts[:'filter'] if !opts[:'filter'].nil?
  query_params[:'q'] = opts[:'q'] if !opts[:'q'].nil?
  query_params[:'include_deleted'] = opts[:'include_deleted'] if !opts[:'include_deleted'].nil?
  query_params[:'include_relations'] = opts[:'include_relations'] if !opts[:'include_relations'].nil?

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type] || 'DomainPublicIndicatorsV3Response'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Intel.query_intel_indicator_entities",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Intel#query_intel_indicator_entities\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#query_intel_indicator_ids(opts = {}) ⇒ MsaQueryResponse

Get indicators IDs that match provided FQL filters.

Parameters:

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :offset (Integer) —

    Set the starting row number to return indicator IDs from. Defaults to 0.

  • :limit (Integer) —

    Set the number of indicator IDs to return. The number must be between 1 and 10000

  • :sort (String) —

    Order fields in ascending or descending order. Ex: published_date|asc.

  • :filter (String) —

    Filter your query by specifying FQL filter parameters. Filter parameters include: _marker, actors, deleted, domain_types, id, indicator, ip_address_types, kill_chains, labels, labels.created_on, labels.last_valid_on, labels.name, last_updated, malicious_confidence, malware_families, published_date, reports, scope, targets, threat_types, type, vulnerabilities.

  • :q (String) —

    Perform a generic substring search across all fields.

  • :include_deleted (Boolean) —

    If true, include both published and deleted indicators in the response. Defaults to false.

  • :include_relations (Boolean) —

    If true, include related indicators in the response. Defaults to true.

Returns:



1067
1068
1069
1070
 
# File 'lib/crimson-falcon/api/intel.rb', line 1067

def query_intel_indicator_ids(opts = {})
  data, _status_code, _headers = query_intel_indicator_ids_with_http_info(opts)
  data
end

#query_intel_indicator_ids_with_http_info(opts = {}) ⇒ Array<(MsaQueryResponse, Integer, Hash)>

Get indicators IDs that match provided FQL filters.

Parameters:

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :offset (Integer) —

    Set the starting row number to return indicator IDs from. Defaults to 0.

  • :limit (Integer) —

    Set the number of indicator IDs to return. The number must be between 1 and 10000

  • :sort (String) —

    Order fields in ascending or descending order. Ex: published_date|asc.

  • :filter (String) —

    Filter your query by specifying FQL filter parameters. Filter parameters include: _marker, actors, deleted, domain_types, id, indicator, ip_address_types, kill_chains, labels, labels.created_on, labels.last_valid_on, labels.name, last_updated, malicious_confidence, malware_families, published_date, reports, scope, targets, threat_types, type, vulnerabilities.

  • :q (String) —

    Perform a generic substring search across all fields.

  • :include_deleted (Boolean) —

    If true, include both published and deleted indicators in the response. Defaults to false.

  • :include_relations (Boolean) —

    If true, include related indicators in the response. Defaults to true.

Returns:

  • (Array<(MsaQueryResponse, Integer, Hash)>) —

    MsaQueryResponse data, response status code and response headers



1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
 
# File 'lib/crimson-falcon/api/intel.rb', line 1082

def query_intel_indicator_ids_with_http_info(opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Intel.query_intel_indicator_ids ...'
  end
  # resource path
  local_var_path = '/intel/queries/indicators/v1'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'offset'] = opts[:'offset'] if !opts[:'offset'].nil?
  query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
  query_params[:'sort'] = opts[:'sort'] if !opts[:'sort'].nil?
  query_params[:'filter'] = opts[:'filter'] if !opts[:'filter'].nil?
  query_params[:'q'] = opts[:'q'] if !opts[:'q'].nil?
  query_params[:'include_deleted'] = opts[:'include_deleted'] if !opts[:'include_deleted'].nil?
  query_params[:'include_relations'] = opts[:'include_relations'] if !opts[:'include_relations'].nil?

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type] || 'MsaQueryResponse'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Intel.query_intel_indicator_ids",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Intel#query_intel_indicator_ids\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#query_intel_report_entities(opts = {}) ⇒ DomainNewsResponse

Get info about reports that match provided FQL filters.

Parameters:

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :offset (Integer) —

    Set the starting row number to return reports from. Defaults to 0.

  • :limit (Integer) —

    Set the number of reports to return. The value must be between 1 and 5000.

  • :sort (String) —

    Order fields in ascending or descending order. Ex: created_date|asc.

  • :filter (String) —

    Filter your query by specifying FQL filter parameters. Filter parameters include: actors, actors.animal_classifier, actors.id, actors.name, actors.slug, actors.url, created_date, description, id, last_modified_date, malware, malware.community_identifiers, malware.family_name, malware.slug, motivations, motivations.id, motivations.slug, motivations.value, name, name.raw, short_description, slug, sub_type, sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, tags.value, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, type, type.id, type.name, type.slug, url.

  • :q (String) —

    Perform a generic substring search across all fields.

  • :fields (Array<String>) —

    The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like: __\&lt;collection\&gt;__. Ex: slug _full_. Defaults to _basic_.

Returns:



1142
1143
1144
1145
 
# File 'lib/crimson-falcon/api/intel.rb', line 1142

def query_intel_report_entities(opts = {})
  data, _status_code, _headers = query_intel_report_entities_with_http_info(opts)
  data
end

#query_intel_report_entities_with_http_info(opts = {}) ⇒ Array<(DomainNewsResponse, Integer, Hash)>

Get info about reports that match provided FQL filters.

Parameters:

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :offset (Integer) —

    Set the starting row number to return reports from. Defaults to 0.

  • :limit (Integer) —

    Set the number of reports to return. The value must be between 1 and 5000.

  • :sort (String) —

    Order fields in ascending or descending order. Ex: created_date|asc.

  • :filter (String) —

    Filter your query by specifying FQL filter parameters. Filter parameters include: actors, actors.animal_classifier, actors.id, actors.name, actors.slug, actors.url, created_date, description, id, last_modified_date, malware, malware.community_identifiers, malware.family_name, malware.slug, motivations, motivations.id, motivations.slug, motivations.value, name, name.raw, short_description, slug, sub_type, sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, tags.value, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, type, type.id, type.name, type.slug, url.

  • :q (String) —

    Perform a generic substring search across all fields.

  • :fields (Array<String>) —

    The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like: __\&lt;collection\&gt;__. Ex: slug _full_. Defaults to _basic_.

Returns:

  • (Array<(DomainNewsResponse, Integer, Hash)>) —

    DomainNewsResponse data, response status code and response headers



1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
 
# File 'lib/crimson-falcon/api/intel.rb', line 1156

def query_intel_report_entities_with_http_info(opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Intel.query_intel_report_entities ...'
  end
  # resource path
  local_var_path = '/intel/combined/reports/v1'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'offset'] = opts[:'offset'] if !opts[:'offset'].nil?
  query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
  query_params[:'sort'] = opts[:'sort'] if !opts[:'sort'].nil?
  query_params[:'filter'] = opts[:'filter'] if !opts[:'filter'].nil?
  query_params[:'q'] = opts[:'q'] if !opts[:'q'].nil?
  query_params[:'fields'] = @api_client.build_collection_param(opts[:'fields'], :multi) if !opts[:'fields'].nil?

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type] || 'DomainNewsResponse'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Intel.query_intel_report_entities",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Intel#query_intel_report_entities\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#query_intel_report_ids(opts = {}) ⇒ MsaQueryResponse

Get report IDs that match provided FQL filters.

Parameters:

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :offset (Integer) —

    Set the starting row number to return report IDs from. Defaults to 0.

  • :limit (Integer) —

    Set the number of report IDs to return. The value must be between 1 and 5000.

  • :sort (String) —

    Order fields in ascending or descending order. Ex: created_date|asc.

  • :filter (String) —

    Filter your query by specifying FQL filter parameters. Filter parameters include: actors, actors.animal_classifier, actors.id, actors.name, actors.slug, actors.url, created_date, description, id, last_modified_date, malware, malware.community_identifiers, malware.family_name, malware.slug, motivations, motivations.id, motivations.slug, motivations.value, name, name.raw, short_description, slug, sub_type, sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, tags.value, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, type, type.id, type.name, type.slug, url.

  • :q (String) —

    Perform a generic substring search across all fields.

Returns:



1214
1215
1216
1217
 
# File 'lib/crimson-falcon/api/intel.rb', line 1214

def query_intel_report_ids(opts = {})
  data, _status_code, _headers = query_intel_report_ids_with_http_info(opts)
  data
end

#query_intel_report_ids_with_http_info(opts = {}) ⇒ Array<(MsaQueryResponse, Integer, Hash)>

Get report IDs that match provided FQL filters.

Parameters:

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :offset (Integer) —

    Set the starting row number to return report IDs from. Defaults to 0.

  • :limit (Integer) —

    Set the number of report IDs to return. The value must be between 1 and 5000.

  • :sort (String) —

    Order fields in ascending or descending order. Ex: created_date|asc.

  • :filter (String) —

    Filter your query by specifying FQL filter parameters. Filter parameters include: actors, actors.animal_classifier, actors.id, actors.name, actors.slug, actors.url, created_date, description, id, last_modified_date, malware, malware.community_identifiers, malware.family_name, malware.slug, motivations, motivations.id, motivations.slug, motivations.value, name, name.raw, short_description, slug, sub_type, sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, tags.value, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, type, type.id, type.name, type.slug, url.

  • :q (String) —

    Perform a generic substring search across all fields.

Returns:

  • (Array<(MsaQueryResponse, Integer, Hash)>) —

    MsaQueryResponse data, response status code and response headers



1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
 
# File 'lib/crimson-falcon/api/intel.rb', line 1227

def query_intel_report_ids_with_http_info(opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Intel.query_intel_report_ids ...'
  end
  # resource path
  local_var_path = '/intel/queries/reports/v1'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'offset'] = opts[:'offset'] if !opts[:'offset'].nil?
  query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
  query_params[:'sort'] = opts[:'sort'] if !opts[:'sort'].nil?
  query_params[:'filter'] = opts[:'filter'] if !opts[:'filter'].nil?
  query_params[:'q'] = opts[:'q'] if !opts[:'q'].nil?

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type] || 'MsaQueryResponse'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Intel.query_intel_report_ids",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Intel#query_intel_report_ids\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#query_intel_rule_ids(type, opts = {}) ⇒ MsaQueryResponse

Search for rule IDs that match provided filter criteria.

Parameters:

  • type (String) —

    The rule news report type. Accepted values: snort-suricata-master snort-suricata-update snort-suricata-changelog yara-master yara-update yara-changelog common-event-format netwitness cql-master cql-update cql-changelog

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :offset (Integer) —

    Set the starting row number to return reports from. Defaults to 0.

  • :limit (Integer) —

    The number of rule IDs to return. Defaults to 10.

  • :sort (String) —

    Order fields in ascending or descending order. Ex: created_date|asc.

  • :name (Array<String>) —

    Search by rule title.

  • :description (Array<String>) —

    Substring match on description field.

  • :tags (Array<String>) —

    Search for rule tags.

  • :min_created_date (Integer) —

    Filter results to those created on or after a certain date.

  • :max_created_date (String) —

    Filter results to those created on or before a certain date.

  • :q (String) —

    Perform a generic substring search across all fields.

Returns:



1289
1290
1291
1292
 
# File 'lib/crimson-falcon/api/intel.rb', line 1289

def query_intel_rule_ids(type, opts = {})
  data, _status_code, _headers = query_intel_rule_ids_with_http_info(type, opts)
  data
end

#query_intel_rule_ids_with_http_info(type, opts = {}) ⇒ Array<(MsaQueryResponse, Integer, Hash)>

Search for rule IDs that match provided filter criteria.

Parameters:

  • type (String) —

    The rule news report type. Accepted values: snort-suricata-master snort-suricata-update snort-suricata-changelog yara-master yara-update yara-changelog common-event-format netwitness cql-master cql-update cql-changelog

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :offset (Integer) —

    Set the starting row number to return reports from. Defaults to 0.

  • :limit (Integer) —

    The number of rule IDs to return. Defaults to 10.

  • :sort (String) —

    Order fields in ascending or descending order. Ex: created_date|asc.

  • :name (Array<String>) —

    Search by rule title.

  • :description (Array<String>) —

    Substring match on description field.

  • :tags (Array<String>) —

    Search for rule tags.

  • :min_created_date (Integer) —

    Filter results to those created on or after a certain date.

  • :max_created_date (String) —

    Filter results to those created on or before a certain date.

  • :q (String) —

    Perform a generic substring search across all fields.

Returns:

  • (Array<(MsaQueryResponse, Integer, Hash)>) —

    MsaQueryResponse data, response status code and response headers



1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
 
# File 'lib/crimson-falcon/api/intel.rb', line 1307

def query_intel_rule_ids_with_http_info(type, opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Intel.query_intel_rule_ids ...'
  end
  # verify the required parameter 'type' is set
  if @api_client.config.client_side_validation && type.nil?
    fail ArgumentError, "Missing the required parameter 'type' when calling Intel.query_intel_rule_ids"
  end
  # resource path
  local_var_path = '/intel/queries/rules/v1'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'type'] = type
  query_params[:'offset'] = opts[:'offset'] if !opts[:'offset'].nil?
  query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
  query_params[:'sort'] = opts[:'sort'] if !opts[:'sort'].nil?
  query_params[:'name'] = @api_client.build_collection_param(opts[:'name'], :csv) if !opts[:'name'].nil?
  query_params[:'description'] = @api_client.build_collection_param(opts[:'description'], :csv) if !opts[:'description'].nil?
  query_params[:'tags'] = @api_client.build_collection_param(opts[:'tags'], :csv) if !opts[:'tags'].nil?
  query_params[:'min_created_date'] = opts[:'min_created_date'] if !opts[:'min_created_date'].nil?
  query_params[:'max_created_date'] = opts[:'max_created_date'] if !opts[:'max_created_date'].nil?
  query_params[:'q'] = opts[:'q'] if !opts[:'q'].nil?

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type] || 'MsaQueryResponse'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Intel.query_intel_rule_ids",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Intel#query_intel_rule_ids\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#query_malware(opts = {}) ⇒ DomainQueryResponse

Get malware family names that match provided FQL filters.

Parameters:

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :offset (Integer) —

    Set the starting row number to return malware IDs from. Defaults to 0.

  • :limit (Integer) —

    Set the number of malware IDs to return. The value must be between 1 and 5000.

  • :sort (String) —

    Order fields in ascending or descending order. Ex: created_date|asc.

  • :filter (String) —

    Filter your query by specifying FQL filter parameters.

  • :q (String) —

    Perform a generic substring search across all fields.

Returns:



1373
1374
1375
1376
 
# File 'lib/crimson-falcon/api/intel.rb', line 1373

def query_malware(opts = {})
  data, _status_code, _headers = query_malware_with_http_info(opts)
  data
end

#query_malware_entities(opts = {}) ⇒ DomainMalwareResponse

Get malware entities that match provided FQL filters.

Parameters:

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :offset (Integer) —

    Set the starting row number to return malware IDs from. Defaults to 0.

  • :limit (Integer) —

    Set the number of malware IDs to return. The value must be between 1 and 5000.

  • :sort (String) —

    Order fields in ascending or descending order. Ex: created_date|asc.

  • :filter (String) —

    Filter your query by specifying FQL filter parameters.

  • :q (String) —

    Perform a generic substring search across all fields.

  • :fields (Array<String>) —

    The fields to return

Returns:



1444
1445
1446
1447
 
# File 'lib/crimson-falcon/api/intel.rb', line 1444

def query_malware_entities(opts = {})
  data, _status_code, _headers = query_malware_entities_with_http_info(opts)
  data
end

#query_malware_entities_with_http_info(opts = {}) ⇒ Array<(DomainMalwareResponse, Integer, Hash)>

Get malware entities that match provided FQL filters.

Parameters:

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :offset (Integer) —

    Set the starting row number to return malware IDs from. Defaults to 0.

  • :limit (Integer) —

    Set the number of malware IDs to return. The value must be between 1 and 5000.

  • :sort (String) —

    Order fields in ascending or descending order. Ex: created_date|asc.

  • :filter (String) —

    Filter your query by specifying FQL filter parameters.

  • :q (String) —

    Perform a generic substring search across all fields.

  • :fields (Array<String>) —

    The fields to return

Returns:

  • (Array<(DomainMalwareResponse, Integer, Hash)>) —

    DomainMalwareResponse data, response status code and response headers



1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
 
# File 'lib/crimson-falcon/api/intel.rb', line 1458

def query_malware_entities_with_http_info(opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Intel.query_malware_entities ...'
  end
  # resource path
  local_var_path = '/intel/combined/malware/v1'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'offset'] = opts[:'offset'] if !opts[:'offset'].nil?
  query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
  query_params[:'sort'] = opts[:'sort'] if !opts[:'sort'].nil?
  query_params[:'filter'] = opts[:'filter'] if !opts[:'filter'].nil?
  query_params[:'q'] = opts[:'q'] if !opts[:'q'].nil?
  query_params[:'fields'] = @api_client.build_collection_param(opts[:'fields'], :multi) if !opts[:'fields'].nil?

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type] || 'DomainMalwareResponse'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Intel.query_malware_entities",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Intel#query_malware_entities\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#query_malware_with_http_info(opts = {}) ⇒ Array<(DomainQueryResponse, Integer, Hash)>

Get malware family names that match provided FQL filters.

Parameters:

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :offset (Integer) —

    Set the starting row number to return malware IDs from. Defaults to 0.

  • :limit (Integer) —

    Set the number of malware IDs to return. The value must be between 1 and 5000.

  • :sort (String) —

    Order fields in ascending or descending order. Ex: created_date|asc.

  • :filter (String) —

    Filter your query by specifying FQL filter parameters.

  • :q (String) —

    Perform a generic substring search across all fields.

Returns:

  • (Array<(DomainQueryResponse, Integer, Hash)>) —

    DomainQueryResponse data, response status code and response headers



1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
 
# File 'lib/crimson-falcon/api/intel.rb', line 1386

def query_malware_with_http_info(opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Intel.query_malware ...'
  end
  # resource path
  local_var_path = '/intel/queries/malware/v1'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'offset'] = opts[:'offset'] if !opts[:'offset'].nil?
  query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
  query_params[:'sort'] = opts[:'sort'] if !opts[:'sort'].nil?
  query_params[:'filter'] = opts[:'filter'] if !opts[:'filter'].nil?
  query_params[:'q'] = opts[:'q'] if !opts[:'q'].nil?

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type] || 'DomainQueryResponse'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Intel.query_malware",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Intel#query_malware\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#query_mitre_attacks(opts = {}) ⇒ DomainQueryMitreAttacksResponse

Gets MITRE tactics and techniques for the given actor, returning concatenation of id and tactic and technique ids, example: fancy-bear_TA0011_T1071

Parameters:

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :id (String) —

    The actor ID(derived from the actor&#39;s name) for which to retrieve a list of attacks, for example: fancy-bear. Only one value is allowed

  • :ids (Array<String>) —

    The actor ID(derived from the actor&#39;s name) for which to retrieve a list of attacks, for example: fancy-bear. Multiple values are allowed

Returns:



1513
1514
1515
1516
 
# File 'lib/crimson-falcon/api/intel.rb', line 1513

def query_mitre_attacks(opts = {})
  data, _status_code, _headers = query_mitre_attacks_with_http_info(opts)
  data
end

#query_mitre_attacks_for_malware(ids, opts = {}) ⇒ DomainQueryResponse

Gets MITRE tactics and techniques for the given malware

Parameters:

  • ids (Array<String>) —

    Malware family name in lower case with spaces replaced with dashes

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Returns:



1573
1574
1575
1576
 
# File 'lib/crimson-falcon/api/intel.rb', line 1573

def query_mitre_attacks_for_malware(ids, opts = {})
  data, _status_code, _headers = query_mitre_attacks_for_malware_with_http_info(ids, opts)
  data
end

#query_mitre_attacks_for_malware_with_http_info(ids, opts = {}) ⇒ Array<(DomainQueryResponse, Integer, Hash)>

Gets MITRE tactics and techniques for the given malware

Parameters:

  • ids (Array<String>) —

    Malware family name in lower case with spaces replaced with dashes

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Returns:

  • (Array<(DomainQueryResponse, Integer, Hash)>) —

    DomainQueryResponse data, response status code and response headers



1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
 
# File 'lib/crimson-falcon/api/intel.rb', line 1582

def query_mitre_attacks_for_malware_with_http_info(ids, opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Intel.query_mitre_attacks_for_malware ...'
  end
  # verify the required parameter 'ids' is set
  if @api_client.config.client_side_validation && ids.nil?
    fail ArgumentError, "Missing the required parameter 'ids' when calling Intel.query_mitre_attacks_for_malware"
  end
  # resource path
  local_var_path = '/intel/queries/mitre-malware/v1'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'ids'] = @api_client.build_collection_param(ids, :multi)

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type] || 'DomainQueryResponse'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Intel.query_mitre_attacks_for_malware",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Intel#query_mitre_attacks_for_malware\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#query_mitre_attacks_with_http_info(opts = {}) ⇒ Array<(DomainQueryMitreAttacksResponse, Integer, Hash)>

Gets MITRE tactics and techniques for the given actor, returning concatenation of id and tactic and technique ids, example: fancy-bear_TA0011_T1071

Parameters:

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :id (String) —

    The actor ID(derived from the actor&#39;s name) for which to retrieve a list of attacks, for example: fancy-bear. Only one value is allowed

  • :ids (Array<String>) —

    The actor ID(derived from the actor&#39;s name) for which to retrieve a list of attacks, for example: fancy-bear. Multiple values are allowed

Returns:



1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
 
# File 'lib/crimson-falcon/api/intel.rb', line 1523

def query_mitre_attacks_with_http_info(opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Intel.query_mitre_attacks ...'
  end
  # resource path
  local_var_path = '/intel/queries/mitre/v1'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'id'] = opts[:'id'] if !opts[:'id'].nil?
  query_params[:'ids'] = @api_client.build_collection_param(opts[:'ids'], :multi) if !opts[:'ids'].nil?

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type] || 'DomainQueryMitreAttacksResponse'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Intel.query_mitre_attacks",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Intel#query_mitre_attacks\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#query_vulnerabilities(opts = {}) ⇒ MsaQueryResponse

Get vulnerabilities IDs

Parameters:

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :offset (String) —

    Starting index of result set from which to return IDs.

  • :limit (Integer) —

    Number of IDs to return.

  • :sort (String) —

    Order by fields.

  • :filter (String) —

    FQL query specifying the filter parameters. Filter parameters include: _all, affected_products.product, affected_products.vendor, community_identifiers, cve, cvss_v3_base, cvss_v3_base.score, cvss_v3_base.severity, exploit_status, publish_date, related_actors, related_actors.animal_classifier, related_actors.name, related_reports.serial_id, related_reports.title, related_threats, related_threats.name, severity, updated_timestamp.

  • :q (String) —

    Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed).

Returns:



1639
1640
1641
1642
 
# File 'lib/crimson-falcon/api/intel.rb', line 1639

def query_vulnerabilities(opts = {})
  data, _status_code, _headers = query_vulnerabilities_with_http_info(opts)
  data
end

#query_vulnerabilities_with_http_info(opts = {}) ⇒ Array<(MsaQueryResponse, Integer, Hash)>

Get vulnerabilities IDs

Parameters:

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :offset (String) —

    Starting index of result set from which to return IDs.

  • :limit (Integer) —

    Number of IDs to return.

  • :sort (String) —

    Order by fields.

  • :filter (String) —

    FQL query specifying the filter parameters. Filter parameters include: _all, affected_products.product, affected_products.vendor, community_identifiers, cve, cvss_v3_base, cvss_v3_base.score, cvss_v3_base.severity, exploit_status, publish_date, related_actors, related_actors.animal_classifier, related_actors.name, related_reports.serial_id, related_reports.title, related_threats, related_threats.name, severity, updated_timestamp.

  • :q (String) —

    Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed).

Returns:

  • (Array<(MsaQueryResponse, Integer, Hash)>) —

    MsaQueryResponse data, response status code and response headers



1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
 
# File 'lib/crimson-falcon/api/intel.rb', line 1652

def query_vulnerabilities_with_http_info(opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: Intel.query_vulnerabilities ...'
  end
  # resource path
  local_var_path = '/intel/queries/vulnerabilities/v1'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'offset'] = opts[:'offset'] if !opts[:'offset'].nil?
  query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
  query_params[:'sort'] = opts[:'sort'] if !opts[:'sort'].nil?
  query_params[:'filter'] = opts[:'filter'] if !opts[:'filter'].nil?
  query_params[:'q'] = opts[:'q'] if !opts[:'q'].nil?

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type] || 'MsaQueryResponse'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"Intel.query_vulnerabilities",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: Intel#query_vulnerabilities\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end