From 05f88e2074d9dd0bea803078a7b5b13c414a8094 Mon Sep 17 00:00:00 2001 From: jshcodes <74007258+jshcodes@users.noreply.github.com> Date: Wed, 8 Sep 2021 14:06:40 -0400 Subject: [PATCH] [DEPLOY] v0.6.5 - Service Class updates (#334) * Remove Hash Analyzer Service Class * Fixed quarantine endpoint references for Uber * Update CHANGELOG.md * Bump version -> 0.6.5 --- CHANGELOG.md | 9 +++ src/falconpy/_endpoint/__init__.py | 2 + src/falconpy/_endpoint/_hash_analyzer.py | 81 --------------------- src/falconpy/_version.py | 2 +- src/falconpy/hash_analyzer.py | 89 ------------------------ tests/test_hash_analyzer.py | 32 --------- 6 files changed, 12 insertions(+), 203 deletions(-) delete mode 100644 src/falconpy/_endpoint/_hash_analyzer.py delete mode 100644 src/falconpy/hash_analyzer.py delete mode 100644 tests/test_hash_analyzer.py diff --git a/CHANGELOG.md b/CHANGELOG.md index 6ad2c1d3e..1b81752c8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,12 @@ +# Version 0.6.5 +## Issues resolved ++ Removed: Hash Analyzer Service Class and all related unit tests. (Unavailable at this time) + - `hash_analyzer.py` + - `_endpoint/_hash_analyzer.py` + - `test_hash_analyzer.py` ++ Fixed: Missing reference to _quarantine_endpoints in endpoint module. `_endpoint/__init__.py` + - This issue only impacted users leveraging the Uber class for these endpoints. + # Version 0.6.4 ## Added features and functionality + Added: New Hash Analyzer Service Class `hash_analyzer.py` diff --git a/src/falconpy/_endpoint/__init__.py b/src/falconpy/_endpoint/__init__.py index 58b8560e1..6596eacb3 100644 --- a/src/falconpy/_endpoint/__init__.py +++ b/src/falconpy/_endpoint/__init__.py @@ -56,6 +56,7 @@ from ._oauth2 import _oauth2_endpoints from ._overwatch_dashboard import _overwatch_dashboard_endpoints from ._prevention_policies import _prevention_policies_endpoints +from ._quarantine import _quarantine_endpoints from ._quick_scan import _quick_scan_endpoints from ._real_time_response import _real_time_response_endpoints from ._real_time_response_admin import _real_time_response_admin_endpoints @@ -99,6 +100,7 @@ api_endpoints.extend(_oauth2_endpoints) api_endpoints.extend(_overwatch_dashboard_endpoints) api_endpoints.extend(_prevention_policies_endpoints) +api_endpoints.extend(_quarantine_endpoints) api_endpoints.extend(_quick_scan_endpoints) api_endpoints.extend(_real_time_response_endpoints) api_endpoints.extend(_real_time_response_admin_endpoints) diff --git a/src/falconpy/_endpoint/_hash_analyzer.py b/src/falconpy/_endpoint/_hash_analyzer.py deleted file mode 100644 index 380ca35ce..000000000 --- a/src/falconpy/_endpoint/_hash_analyzer.py +++ /dev/null @@ -1,81 +0,0 @@ -""" - _______ __ _______ __ __ __ -| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----. -|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__| -|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____| -|: 1 | |: 1 | -|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy -`-------' `-------' - -OAuth2 API - Customer SDK - -_endpoint._hash_analyzer - Internal API endpoint constant library - -This is free and unencumbered software released into the public domain. - -Anyone is free to copy, modify, publish, use, compile, sell, or -distribute this software, either in source code form or as a compiled -binary, for any purpose, commercial or non-commercial, and by any -means. - -In jurisdictions that recognize copyright laws, the author or authors -of this software dedicate any and all copyright interest in the -software to the public domain. We make this dedication for the benefit -of the public at large and to the detriment of our heirs and -successors. We intend this dedication to be an overt act of -relinquishment in perpetuity of all present and future rights to this -software under copyright law. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, -EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF -MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. -IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR -OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, -ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR -OTHER DEALINGS IN THE SOFTWARE. - -For more information, please refer to -""" - -_hash_analyzer_endpoints = [ - [ - "GetPublicAnalysisResults", - "GET", - "/publichashes/entities/analysis/v1?ids={}", - "Retrieve analysis of a given file hash", - "hash_analyzer", - [ - { - "type": "array", - "items": { - "type": "string" - }, - "collectionFormat": "csv", - "description": "SHA256 hash used to get details on", - "name": "ids", - "in": "query", - "required": True - } - ] - ], - [ - "GetPublicAnalysisResultsV2", - "GET", - "/publichashes/entities/analysis/v2?ids={}", - "Retrieve analysis of a given file hash", - "hash_analyzer", - [ - { - "type": "array", - "items": { - "type": "string" - }, - "collectionFormat": "csv", - "description": "SHA256 hash used to get details on", - "name": "ids", - "in": "query", - "required": True - } - ] - ] -] diff --git a/src/falconpy/_version.py b/src/falconpy/_version.py index f368d7e12..36813de33 100644 --- a/src/falconpy/_version.py +++ b/src/falconpy/_version.py @@ -36,7 +36,7 @@ For more information, please refer to """ -_VERSION = '0.6.4' +_VERSION = '0.6.5' _MAINTAINER = 'Joshua Hiller' _AUTHOR = 'CrowdStrike' _AUTHOR_EMAIL = 'falconpy@crowdstrike.com' diff --git a/src/falconpy/hash_analyzer.py b/src/falconpy/hash_analyzer.py deleted file mode 100644 index 07c7a32de..000000000 --- a/src/falconpy/hash_analyzer.py +++ /dev/null @@ -1,89 +0,0 @@ -""" - _______ __ _______ __ __ __ -| _ .----.-----.--.--.--.--| | _ | |_.----|__| |--.-----. -|. 1___| _| _ | | | | _ | 1___| _| _| | <| -__| -|. |___|__| |_____|________|_____|____ |____|__| |__|__|__|_____| -|: 1 | |: 1 | -|::.. . | CROWDSTRIKE FALCON |::.. . | FalconPy -`-------' `-------' - -OAuth2 API - Customer SDK - -hash_analyzer - CrowdStrike Hash Analyzer API Interface Class - -This is free and unencumbered software released into the public domain. - -Anyone is free to copy, modify, publish, use, compile, sell, or -distribute this software, either in source code form or as a compiled -binary, for any purpose, commercial or non-commercial, and by any -means. - -In jurisdictions that recognize copyright laws, the author or authors -of this software dedicate any and all copyright interest in the -software to the public domain. We make this dedication for the benefit -of the public at large and to the detriment of our heirs and -successors. We intend this dedication to be an overt act of -relinquishment in perpetuity of all present and future rights to this -software under copyright law. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, -EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF -MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. -IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR -OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, -ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR -OTHER DEALINGS IN THE SOFTWARE. - -For more information, please refer to -""" -from ._util import process_service_request, force_default, handle_single_argument -from ._service_class import ServiceClass -from ._endpoint._hash_analyzer import _hash_analyzer_endpoints as Endpoints - - -class HashAnalyzer(ServiceClass): - """ - The only requirement to instantiate an instance of this class - is a valid token provided by the Falcon API SDK OAuth2 class, a - existing instance of the authentication class as an object or a - valid set of credentials. - """ - - @force_default(defaults=["parameters"], default_types=["dict"]) - def get_analysis_results(self: object, *args, parameters: dict = None, **kwargs) -> dict: - """ - Retrieve analysis of a given file hash - """ - # [POST] https://assets.falcon.crowdstrike.com/support/api/swagger.html#/hash-analyzer/GetPublicAnalysisResults - return process_service_request( - calling_object=self, - endpoints=Endpoints, - operation_id="GetPublicAnalysisResults", - keywords=kwargs, - params=handle_single_argument(args, parameters, "ids") - ) - - @force_default(defaults=["parameters"], default_types=["dict"]) - def get_analysis_results_v2(self: object, *args, parameters: dict = None, **kwargs) -> dict: - """ - Retrieve analysis of a given file hash - """ - # [POST] https://assets.falcon.crowdstrike.com/support/api/swagger.html#/hash-analyzer/GetPublicAnalysisResults - return process_service_request( - calling_object=self, - endpoints=Endpoints, - operation_id="GetPublicAnalysisResultsV2", - keywords=kwargs, - params=handle_single_argument(args, parameters, "ids") - ) - - # This method name aligns to the operation ID in the API but - # does not conform to snake_case / PEP8 and is defined here - # for backwards compatibility / ease of use purposes - GetPublicAnalysisResults = get_analysis_results - GetPublicAnalysisResultsV2 = get_analysis_results_v2 - - -# The legacy name for this class does not conform to PascalCase / PEP8 -# It is defined here for backwards compatibility purposes only. -Hash_Analyzer = HashAnalyzer # pylint: disable=C0103 diff --git a/tests/test_hash_analyzer.py b/tests/test_hash_analyzer.py deleted file mode 100644 index 7b5a61b61..000000000 --- a/tests/test_hash_analyzer.py +++ /dev/null @@ -1,32 +0,0 @@ -""" -test_hash_analyzer.py - This class tests the hash_analyzer service class -""" -import os -import sys -# Authentication via the test_authorization.py -from tests import test_authorization as Authorization -# Import our sibling src folder into the path -sys.path.append(os.path.abspath('src')) -# Classes to test - manually imported from sibling folder -from falconpy.hash_analyzer import HashAnalyzer - -auth = Authorization.TestAuthorization() -token = auth.getConfigExtended() -falcon = HashAnalyzer(access_token=token) -AllowedResponses = [200, 201, 404, 429] -test_sha = "b169fe25e455f173fa59ca922acbd779c0f3d04d458855ddcff0c8a5ea80e451" # "CrowdStrike" - - -class TestHashAnayzer: - - def test_get_analysis(self): - """Pytest harness hook""" - # Commented out for now - # assert bool(falcon.get_analysis_results(ids=test_sha)["status_code"] in AllowedResponses) is True - assert True is True - - def test_get_analysis_v2(self): - """Pytest harness hook""" - # Commented out for now - # assert bool(falcon.get_analysis_results_v2(ids=test_sha)["status_code"] in AllowedResponses) is True - assert True is True