Version 1.5.5 - New service collections, operations and updates #1401
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…oud based; added it to test sensor; tested it in production and works since the endpoint does work and provides hourly usage billing that is used for Cloud (reserved hourly) usage
jshcodes
added
hosts
crowdstrikedcs
approved these changes
Dec 19, 2025
jshcodes
had a problem deploying
to
bleeding-edge
GitHub Actions
Failure
jshcodes
had a problem deploying
to
bleeding-edge
GitHub Actions
Failure
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
FalconPy v1.5.5
This update provides new service collections (Case Management, Data Protection Configuration, Cloud Security) and new operations within existing service collections. Multiple bugs are addressed, and multiple updates are implemented.
Unit test coverage
Bandit analysis
[main] INFO running on Python 3.13.3 Run started:2025-12-18 23:05:31.709760 Test results: No issues identified. Code scanned: Total lines of code: 116157 Total lines skipped (#nosec): 0 Run metrics: Total issues (by severity): Undefined: 0 Low: 0 Medium: 0 High: 0 Total issues (by confidence): Undefined: 0 Low: 0 Medium: 0 High: 0 Files skipped (0):Added features and functionality
Added: Added "SPL", "AI translated" and "all" as allowed values for the
languageargument in the GetArchiveExport operation within the CAO Hunting service collection._endpoint/_cao_hunting.pycao_hunting.pyAdded: Added
include_translated_contentargument to the GetIntelligenceQueries operation within the CAO Hunting service collection._endpoint/_cao_hunting.pycao_hunting.pyAdded: Added three new operations to the CAO Hunting service collection.
_endpoint/_cao_hunting.pycao_hunting.pytests/test_cao_hunting.pyAdded: Added the new Case Management service collection with 48 operations.
_endpoint/__init__.py_endpoint/_case_management.py_endpoint/deprecated/__init__.py_endpoint/deprecated/_case_management.py_payload/__init__.py_payload/_case_management.py__init__.pycase_management.pytests/test_case_management.pyAdded: Added two new operations to the Cloud AWS Registration service collection.
_endpoint/_cloud_aws_registration.py_endpoint/deprecated/_cloud_aws_registration.pycloud_aws_registration.pytests/test_cloud_aws_registration.pyAdded: Added new cloud_registration_azure_trigger_health_check operation to the Cloud Azure Registration service collection.
_endpoint/_cloud_azure_registration.py_endpoint/deprecated/_cloud_azure_registration.pycloud_azure_registration.pytests/test_cloud_azure_registration.pyAdded: Added two new operations to the Cloud Azure Registration service collection.
_endpoint/_cloud_azure_registration.py_endpoint/deprecated/_cloud_azure_registration.py_payload/__init__.py_payload/_cloud_azure_registration.pycloud_azure_registration.pytests/test_cloud_azure_registration.pyAdded: Added the new Cloud Google Cloud Registration service collection with 6 operations.
_endpoint/__init__.py_endpoint/_cloud_google_cloud_registration.py_endpoint/deprecated/__init__.py_endpoint/deprecated/_cloud_google_cloud_registration.py_payload/__init__.py_payload/_cloud_google_cloud_registration.py__init__.pycloud_google_cloud_registration.pytests/test_cloud_google_cloud_registration.pyAdded: Added the new Cloud Security Compliance service collection with 2 operations.
_endpoint/__init__.py_endpoint/_cloud_security_compliance.py_endpoint/deprecated/__init__.py_endpoint/deprecated/_cloud_security_compliance.py__init__.pycloud_security_compliance.pytests/test_cloud_security_compliance.pyAdded: Added the new Cloud Security Detections service collection with 2 operations.
_endpoint/__init__.py_endpoint/_cloud_security_detections.py_endpoint/deprecated/__init__.py_endpoint/deprecated/_cloud_security_detections.py__init__.pycloud_security_detections.pytests/test_cloud_security_detections.pyAdded: Added the new Cloud Policies service collection with 24 operations.
_endpoint/__init__.py_endpoint/_cloud_policies.py_payload/__init__.py_payload/_cloud_policies.py__init__.pycloud_policies.pytests/test_cloud_policies.pyAdded: Added the new Cloud Security service collection with 7 operations.
_endpoint/__init__.py_endpoint/_cloud_security.py_endpoint/deprecated/__init__.py_endpoint/deprecated/_cloud_security.py_payload/__init__.py_payload/_cloud_security__init__.pycloud_security.pytests/test_cloud_security.pyAdded: Added new filter option (
control.extension.status) as an allowed value to the cloud_security_assets_combined_compliance_by_account operation within the Cloud Security Assets service collection._endpoint/_cloud_security_assets.py_endpoint/deprecated/_cloud_security_assets.pycloud_security_assets.pyUpdated: Removed three options (
application_security.business_applications,application_security.business_criticalityandapplication_security.service_names) and added 7 options (control.benchmark.name,control.benchmark.version,control.framework,control.requirement,control.type,control.version, andnon_compliant.rule_name) as allowed filters in the cloud_security_assets_queries operation within the Cloud Security Assets service collection._endpoint/_cloud_security_assets.py_endpoint/deprecated/_cloud_security_assets.pycloud_security_assets.pyAdded: Added new filter and sort options as an allowed value to the cloud_security_assets_queries operation within the Cloud Security Assets service collection.
_endpoint/_cloud_security_assets.py_endpoint/deprecated/_cloud_security_assets.pycloud_security_assets.pyAdded: Added one new operation to the Cloud Security Assets service collection.
_endpoint/_cloud_security_assets.py_endpoint/deprecated/_cloud_security_assets.pycloud_security_assets.pytests/test_cloud_security_assets.pyAdded: Added new Cloud Security Compliance service collection with 2 new operations.
_endpoint/__init__.py_endpoint/_cloud_security_compliance.py_endpoint/deprecated/__init__.py_endpoint/deprecated/_cloud_security_compliance.py__init__.pycloud_security_compliance.pytests/test_cloud_security_compliance.pyAdded: Added new CombinedDetections operation to the Cloud Snapshots service collection.
_endpoint/_cloud_snapshots.pycloud_snapshots.pytests/test_cloud_snapshots.pyAdded: Added the new Correlation Rules Admin service collection with 1 operation.
_endpoint/__init__.py_endpoint/_correlation_rules_admin.py_endpoint/deprecated/__init__.py_endpoint/deprecated/_correlation_rules_admin.py_payload/__init__.py_payload/_correlation_rules_admin.py__init__.pycorrelation_rules_admin.pytests/test_correlation_rules_admin.pyAdded: Added
dspm_host_account_id,dspm_host_integration_role_name, anddspm_host_scanner_role_namearguments to the GetD4CAWSAccountScriptsAttachment operation within the D4C Registration service collection._endpoint/_d4c_registration.pyd4c_registration.pyUpdated: Adjusted the operation GetD4CAWSAccountScriptsAttachment within the D4C Registration service class to align with new endpoint parameters.
_endpoint/_d4c_registration.pyd4c_registration.pytests/test_d4c_registration.pyAdded: Added the new Data Protection Configuration service collection with 36 operations.
_endpoint/__init__.py_endpoint/_data_protection_configuration.py_endpoint/deprecated/__init__.py_endpoint/deprecated/_data_protection_configuration.py_payload/__init__.py_payload/_data_protection_configuration.py__init__.pydata_protection_configuration.pytests/test_data_protection_configuration.pyAdded: Added
facetargument to the combined_applications operation within the Discover service collection._endpoint/_discover.py_endpoint/deprecated/_discover.pydiscover.pyAdded: Added "scan_details.scan_id", "scan_details.schedule_id", "scan_details.scan_date", and "vulnerability_assessment_date" as allowed values for the
filterargument in the combined_hosts and query_hosts operations within the Discover service collection._endpoint/_discover.py_endpoint/deprecated/_discover.pydiscover.pyAdded: Added FetchFilesDownloadInfo operation to the Downloads service collection. Deprecated DownloadFile and EnumerateFile.
_endpoint/_downloads.pydownloads.pytests/test_downloads.pyAdded: Added one new operation to the Downloads service collection.
_endpoint/_downloads.pydownloads.pytests/test_downloads.pyAdded: Added PolicyChecks, GetReportByReference and GetReportByScanID operations to the Falcon Container service collection.
_endpoint/_falcon_container.py_util/_functions.py_util/_uber.pyfalcon_container.pytests/test_falcon_container.pyUpdated: Removed one resource option (
network.events) from the resource parameter to the LaunchExportJob operation in the Falcon Container service collection._endpoint/_falcon_container.pyfalcon_container.pyAdded: Added "add-rule-group" and "remove-rule-group" as allowed values for the
action_nameargument in the performFirewallPoliciesAction operation within the FirewallPolicies Service Class.firewall_policies.pyUpdated: Added 9 possible values for the
sortargument in the CombinedHiddenDevicesByFilter and CombinedDevicesByFilter operations within the Hosts service collection._endpoint/_hosts.pyhosts.pyAdded: Added
limit,fromandtoarguments to the QueryDeviceLoginHistoryV2 operation within the Hosts service collection._endpoint/_hosts.pyhosts.pyAdded: Added new filter and sort options to the CombinedDevicesByFilter and CombinedHiddenDevicesByFilter operations within the Hosts service collection.
_endpoint/_hosts.pyhosts.pyAdded: Added "reports.slug" as an allowed
filtervalue to the QueryIntelIndicatorEntities and QueryIntelIndicatorIds operations within the Intel service collection._endpoint/_intel.pyintel.pyAdded: Added "summary" as an allowed
filtervalue to the QueryIntelReportEntities and QueryIntelReportIds operations within the Intel service collection._endpoint/_intel.pyintel.pyAdded: Added "any" as an allowed
feed_intervalvalue to the QueryFeedArchives operation within the Intelligence Feeds service collection._endpoint/_intelligence_feeds.pyintelligence_feeds.pyAdded: Added 21 new filter options to the SearchIndicators operation within the Intelligence Indicator Graph service collection.
_endpoint/_intelligence_indicator_graph.pyintelligence_indicator_graph.pyAdded: Added 5 new operations to the IT Automation service collection.
_endpoint/_it_automation.py_payload/__init__.py_payload/_it_automation.pyit_automation.pytests/test_it_automation.pyAdded: Added "namespace" and "pod_name" as allowed
filtervalues in the ReadClustersByKubernetesVersionCount, ReadClustersByStatusCount, ReadClusterCount, ReadClusterCombined, and ReadClusterCombinedV2 operations within the Kubernetes Protection service collection._endpoint/_kubernetes_protection.pykubernetes_protection.pyAdded: Added the operation PostSearchKubernetesIOMEntities to the Kubernetes Protection service collection.
_endpoint/_kubernetes_protection.pykubernetes_protection.pytests/test_kubernetes_protection.pyAdded: Added 22 new operations to the NGSIEM service collection.
_endpoint/_ngsiem.py_payload/__init__.py_payload/_ngsiem.pyngsiem.pytests/test_dashboard.ymltests/test_ngsiem.pyAdded: Added new filter and sort options (
description,aspm.description.keyword) as an allowed value to the query_scheduled_scans and query_scans operations within the On Demand Scan service collection._endpoint/_ods.py_endpoint/deprecated/_ods.pyods.pyAdded: Added the
file_nameargument to the UploadFileQuickScanPro operation within the Quick Scan Pro service collection._endpoint/_quick_scan_pro.pyAdded: Added three new operations to the Real Time Response Admin service collection.
_endpoint/_real_time_response_admin.py_endpoint/deprecated/_real_time_response_admin.pyreal_time_response_admin.pytests/test_real_time_response_admin.pyAdded: Added 4 new filter and sort options to the QueryRulesV1 operation within the Recon service collection.
_endpoint/_recon.pyrecon.pyAdded: Added the new SaaS Security service collection with 24 operations.
_endpoint/__init__.py_endpoint/_saas_security.py__init__.pysaas_security.pytests/test_saas_security.pyAdded: Added new GetSensorUsageHourly operation to the Sensor Usage service collection.
_endpoint/_sensor_usage.pysensor_usage.pytests/test_sensor_usage.pyAdded: Added the new Spotlight Vulnerability Metadata service collection with 1 operation.
_endpoint/__init__.py_endpoint/_spotlight_vulnerability_metadata.py__init__.pyspotlight_vulnerability_metadata.pytests/test_spotlight_vulnerability_metadata.pyAdded: Added "uuid" as an allowed
filtervalue in the queryUserV1 operation within the User Management service collection._endpoint/_user_management.pyuser_management.pyUpdated: Added the entitiesRolesGETV2 operation and deprecated the entitiesRolesV1 operation within the User Management service collection.
_endpoint/_user_management.pyuser_management.pytests/test_user_management.pyAdded: Added new WorkflowDefinitionsStatus operation to the Workflows service class.
_constant/__init__.py_endpoint/_workflows.pyworkflows.pytests/test_workflows.pyAdded: Added "cancel" as an allowed value for
action_namein the WorkflowExecutionsAction operation within the Workflows service collection._endpoint/_workflows.pyAdded: Added
skip_validationandignore_activity_mock_referencesarguments to the WorkflowMockExecute operation within the Workflows service collection._endpoint/_workflows.pyworkflows.pyAdded: Added the child_login and child_logout helper methods to the authentication object and implemented aliases for Service Classes. This method allows login using existing parent credentials to a child tenant by providing the
member_cidargument only._auth_object/_falcon_interface.py_service_class/_service_class.pytests/test_authentications.pyIssues resolved
Fixed: Resolved path interpolation issue for the
search_idkeyword when using the Uber Class to call the GetSearchStatusV1 operation. Closes [ BUG ] StartSearchV1 in Uber class returns 404 'No content was received for this request' #1365._util/_uber.pyFixed: Resolved body payload generation issue with the userActionV1 operation within the UserManagement service class.
user_management.pyFixed: Resolved availability issue with FDR service collection endpoints within the endpoint module. Closes [ BUG ] Endpoint module is not exporting FDR endpoints properly. #1371.
_endpoint/__init__.pyFixed: Body payload issue with the userActionV1 operation within the User Management service class.
user_management.pyOther
Removed: Removed two operations from the ASPM service collection.
_endpoint/_aspm.pyaspm.pytests/test_aspm.pyUpdated: Cosmetic updates to operation descriptions for the GetIntelligenceQueries and SearchIntelligenceQueries operations within the CAO Hunting service collection.
_endpoint/_cao_hunting.pyUpdated: Converted
offsetargument data type from String to Integer in the QueryActivityByCaseID and QueryCasesIdsByFilter operations within the Message Center service collection._endpoint/_message_center.pymessage_center.pyUpdated: Cosmetic updates to parameter descriptions in the cloud_security_registration_oci_get_account operation within the Cloud OCI Registration service collection.
_endpoint/_cloud_oci_registration.py_endpoint/deprecated/_cloud_oci_registration.pyUpdated: Cosmetic update to parameter descriptions in the SearchAndReadContainerAlerts operation within the Container Alerts service collection.
_endpoint/_container_alerts.pyUpdated: Cosmetic update adding "image_digest" as an allowed value to the
filterargument description in the ReadDetectsCountBySeverity, ReadDetectionsCountByType, ReadDetectionsCount, ReadCombinedDetections, ReadDetections, and SearchDetections operations within the Container Detections service collection._endpoint/_container_detections.pyUpdated: Cosmetic update to the
limitandoffsetdescriptions in the ReadCombinedDetections, GetRuntimeDetectionsCombinedV2, ReadDetections, and SearchDetections operations within the Container Detections service collection._endpoint/_container_detections.pyUpdated: Cosmetic update to operation and parameter descriptions in the GetCombinedImages, CombinedImageDetail, and ReadCombinedImagesExport operations within the Container Images service collection.
_endpoint/_container_images.pyUpdated: Cosmetic update to operation and parameter descriptions in the ReadPackagesByFixableVulnCount, ReadPackagesByVulnCount, ReadPackagesCombinedExport, ReadPackagesCombined, and ReadPackagesCombinedV2 operations within the Container Packages service collection.
_endpoint/_container_packages.pyUpdated: Cosmetic update to operation and parameter descriptions in the ReadVulnerabilityCountByActivelyExploited, ReadVulnerabilityCountByCPSRating, ReadVulnerabilityCountByCVSSScore, ReadVulnerabilityCountBySeverity, ReadVulnerabilityCount, ReadVulnerabilitiesByImageCount, ReadVulnerabilitiesPublicationDate, ReadCombinedVulnerabilitiesDetails, ReadCombinedVulnerabilitiesInfo, and ReadCombinedVulnerabilities operations within the Container Vulnerabilities service collection.
_endpoint/_container_vulnerabilities.pyDeprecated: Deprecated the Detects service collection and all included endpoints. Closes [ BUG ] [ DEPRECATION ] The Detects API endpoints are deprecated #1378.
_endpoint/_detects.py_endpoint/deprecated/_mapping.pydetects.pyUpdated: Cosmetic update to the
limitandoffsetdescriptions in the SearchAndReadDriftIndicatorEntities and SearchDriftIndicators operations within the Drift Indicators service collection._endpoint/_container_detections.pyUpdated: Cosmetic update to the
sortenum andfilterargument description in the GetHostMigrationIDsV1 and GetMigrationIDsV1 operations within the Host Migration service collection._endpoint/_host_migration.pyUpdated: Cosmetic update to remove unnecessary Authorization headers from the post_graphql, GetSensorDetails, get_policy_rules, delete_policy_rules, and get_policy_rules_query operations within the Identity Protection service collection.
_endpoint/_identity_protection.pyUpdated: Cosmetic updates to operation descriptions for the ITAutomationStartExecutionResultsSearch and ITAutomationGetExecutionResults operations within the IT Automation service collection.
_endpoint/_it_automation.pyUpdated: Cosmetic update to the
limitandoffsetargument descriptions for the FindContainersByContainerRunTimeVersion, ReadClusterCombined, ReadClusterCombinedV2, ReadRunningContainerImages, ReadContainerCombined, ReadDeploymentCombined, SearchAndReadKubernetesIomEntities, ReadNodeCombined, ReadPodCombined and SearchKubernetesIoms operations within the Kubernetes Protection service collection._endpoint/_it_automation.pyUpdated: Cosmetic update to operation descriptions for the ReadClusterCombinedV2, ReadContainerCombined and SearchAndReadKubernetesIomEntities operations within the Kubernetes Protection service collection.
_endpoint/_it_automation.pyUpdated: Cosmetic update to the
limitandoffsetargument descriptions in the SearchAndRReadUnidentifiedContainers operation within the Unidentified Containers service collection._endpoint/_unidentified_containers.pyUpdated: Cosmetic updates to argument and operation descriptions in the WorkflowDefinitionsCombined, WorkflowDefinitionsStatus, WorkflowExecutionsAction and WorkflowMockExecute operations within the Workflows service collection.
_endpoint/_workflows.py