Class: Falcon::SpotlightVulnerabilities

Inherits:
Object
  • Object
show all
Defined in:
lib/crimson-falcon/api/spotlight_vulnerabilities.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(api_client = ApiClient.default) ⇒ SpotlightVulnerabilities

Returns a new instance of SpotlightVulnerabilities.



36
37
38
 
# File 'lib/crimson-falcon/api/spotlight_vulnerabilities.rb', line 36

def initialize(api_client = ApiClient.default)
  @api_client = api_client
end

Instance Attribute Details

#api_client ⇒ Object

Returns the value of attribute api_client.



34
35
36
 
# File 'lib/crimson-falcon/api/spotlight_vulnerabilities.rb', line 34

def api_client
  @api_client
end

Instance Method Details

#combined_query_vulnerabilities(filter, opts = {}) ⇒ DomainSPAPICombinedVulnerabilitiesResponse

Search for Vulnerabilities in your environment by providing an FQL filter and paging details. Returns a set of Vulnerability entities which match the filter criteria

Parameters:

  • filter (String) —

    Filter items using a query in Falcon Query Language (FQL). Wildcards * and empty filter values are unsupported. Available filter fields that supports match (~): N/A Available filter fields that supports exact match: aid, cid, last_seen_within, status, cve.id, cve.is_cisa_kev, cve.remediation_level, cve.cps_rating, cve.exprt_rating, cve.exploit_status_to_include, cve.severity, cve.base_score, cve.types, host_info.asset_criticality, host_info.asset_roles, host_info.internet_exposure, host_info.tags, host_info.groups, host_info.product_type_desc, host_info.platform_name, suppression_info.is_suppressed, suppression_info.reason, host_info.instance_state Available filter fields that supports wildcard (*): N/A Available filter fields that supports range comparisons (>, <, >=, <=): created_timestamp, closed_timestamp, updated_timestamp, cve.base_score

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :after (String) —

    A pagination token used with the `limit` parameter to manage pagination of results. On your first request, don't provide an `after` token. On subsequent requests, provide the `after` token from the previous response to continue from that place in the results.

  • :limit (Integer) —

    The number of items to return in this response (default: 100, max: 5000). Use with the after parameter to manage pagination of results.

  • :sort (String) —

    Sort vulnerabilities by their properties. Common sort options include: <ul><li>updated_timestamp|asc</li><li>closed_timestamp|asc</li></ul>

  • :facet (Array<String>) —

    Select various details blocks to be returned for each vulnerability entity. Supported values: &lt;ul&gt;&lt;li&gt;host_info&lt;/li&gt;&lt;li&gt;remediation&lt;/li&gt;&lt;li&gt;cve&lt;/li&gt;&lt;li&gt;evaluation_logic&lt;/li&gt;&lt;/ul&gt;

Returns:



47
48
49
50
 
# File 'lib/crimson-falcon/api/spotlight_vulnerabilities.rb', line 47

def combined_query_vulnerabilities(filter, opts = {})
  data, _status_code, _headers = combined_query_vulnerabilities_with_http_info(filter, opts)
  data
end

#combined_query_vulnerabilities_with_http_info(filter, opts = {}) ⇒ Array<(DomainSPAPICombinedVulnerabilitiesResponse, Integer, Hash)>

Search for Vulnerabilities in your environment by providing an FQL filter and paging details. Returns a set of Vulnerability entities which match the filter criteria

Parameters:

  • filter (String) —

    Filter items using a query in Falcon Query Language (FQL). Wildcards * and empty filter values are unsupported. Available filter fields that supports match (~): N/A Available filter fields that supports exact match: aid, cid, last_seen_within, status, cve.id, cve.is_cisa_kev, cve.remediation_level, cve.cps_rating, cve.exprt_rating, cve.exploit_status_to_include, cve.severity, cve.base_score, cve.types, host_info.asset_criticality, host_info.asset_roles, host_info.internet_exposure, host_info.tags, host_info.groups, host_info.product_type_desc, host_info.platform_name, suppression_info.is_suppressed, suppression_info.reason, host_info.instance_state Available filter fields that supports wildcard (*): N/A Available filter fields that supports range comparisons (&gt;, &lt;, &gt;&#x3D;, &lt;&#x3D;): created_timestamp, closed_timestamp, updated_timestamp, cve.base_score

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :after (String) —

    A pagination token used with the &#x60;limit&#x60; parameter to manage pagination of results. On your first request, don&#39;t provide an &#x60;after&#x60; token. On subsequent requests, provide the &#x60;after&#x60; token from the previous response to continue from that place in the results.

  • :limit (Integer) —

    The number of items to return in this response (default: 100, max: 5000). Use with the after parameter to manage pagination of results.

  • :sort (String) —

    Sort vulnerabilities by their properties. Common sort options include: &lt;ul&gt;&lt;li&gt;updated_timestamp|asc&lt;/li&gt;&lt;li&gt;closed_timestamp|asc&lt;/li&gt;&lt;/ul&gt;

  • :facet (Array<String>) —

    Select various details blocks to be returned for each vulnerability entity. Supported values: &lt;ul&gt;&lt;li&gt;host_info&lt;/li&gt;&lt;li&gt;remediation&lt;/li&gt;&lt;li&gt;cve&lt;/li&gt;&lt;li&gt;evaluation_logic&lt;/li&gt;&lt;/ul&gt;

Returns:



60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
 
# File 'lib/crimson-falcon/api/spotlight_vulnerabilities.rb', line 60

def combined_query_vulnerabilities_with_http_info(filter, opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: SpotlightVulnerabilities.combined_query_vulnerabilities ...'
  end
  # verify the required parameter 'filter' is set
  if @api_client.config.client_side_validation && filter.nil?
    fail ArgumentError, "Missing the required parameter 'filter' when calling SpotlightVulnerabilities.combined_query_vulnerabilities"
  end
  if @api_client.config.client_side_validation && !opts[:'limit'].nil? && opts[:'limit'] > 5000
    fail ArgumentError, 'invalid value for "opts[:"limit"]" when calling SpotlightVulnerabilities.combined_query_vulnerabilities, must be smaller than or equal to 5000.'
  end

  if @api_client.config.client_side_validation && !opts[:'limit'].nil? && opts[:'limit'] < 1
    fail ArgumentError, 'invalid value for "opts[:"limit"]" when calling SpotlightVulnerabilities.combined_query_vulnerabilities, must be greater than or equal to 1.'
  end

  # resource path
  local_var_path = '/spotlight/combined/vulnerabilities/v1'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'filter'] = filter
  query_params[:'after'] = opts[:'after'] if !opts[:'after'].nil?
  query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
  query_params[:'sort'] = opts[:'sort'] if !opts[:'sort'].nil?
  query_params[:'facet'] = @api_client.build_collection_param(opts[:'facet'], :multi) if !opts[:'facet'].nil?

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type] || 'DomainSPAPICombinedVulnerabilitiesResponse'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"SpotlightVulnerabilities.combined_query_vulnerabilities",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: SpotlightVulnerabilities#combined_query_vulnerabilities\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#get_remediations_v2(ids, opts = {}) ⇒ DomainSPAPIRemediationEntitiesResponseV2

Get details on remediation by providing one or more IDs

Parameters:

  • ids (Array<String>) —

    One or more remediation IDs

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Returns:



125
126
127
128
 
# File 'lib/crimson-falcon/api/spotlight_vulnerabilities.rb', line 125

def get_remediations_v2(ids, opts = {})
  data, _status_code, _headers = get_remediations_v2_with_http_info(ids, opts)
  data
end

#get_remediations_v2_with_http_info(ids, opts = {}) ⇒ Array<(DomainSPAPIRemediationEntitiesResponseV2, Integer, Hash)>

Get details on remediation by providing one or more IDs

Parameters:

  • ids (Array<String>) —

    One or more remediation IDs

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Returns:



134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
 
# File 'lib/crimson-falcon/api/spotlight_vulnerabilities.rb', line 134

def get_remediations_v2_with_http_info(ids, opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: SpotlightVulnerabilities.get_remediations_v2 ...'
  end
  # verify the required parameter 'ids' is set
  if @api_client.config.client_side_validation && ids.nil?
    fail ArgumentError, "Missing the required parameter 'ids' when calling SpotlightVulnerabilities.get_remediations_v2"
  end
  # resource path
  local_var_path = '/spotlight/entities/remediations/v2'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'ids'] = @api_client.build_collection_param(ids, :multi)

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type] || 'DomainSPAPIRemediationEntitiesResponseV2'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"SpotlightVulnerabilities.get_remediations_v2",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: SpotlightVulnerabilities#get_remediations_v2\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#get_vulnerabilities(ids, opts = {}) ⇒ DomainSPAPIVulnerabilitiesEntitiesResponseV2

Get details on vulnerabilities by providing one or more IDs

Parameters:

  • ids (Array<String>) —

    One or more vulnerability IDs (max: 400). Find vulnerability IDs with GET /spotlight/queries/vulnerabilities/v1

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Returns:



187
188
189
190
 
# File 'lib/crimson-falcon/api/spotlight_vulnerabilities.rb', line 187

def get_vulnerabilities(ids, opts = {})
  data, _status_code, _headers = get_vulnerabilities_with_http_info(ids, opts)
  data
end

#get_vulnerabilities_with_http_info(ids, opts = {}) ⇒ Array<(DomainSPAPIVulnerabilitiesEntitiesResponseV2, Integer, Hash)>

Get details on vulnerabilities by providing one or more IDs

Parameters:

  • ids (Array<String>) —

    One or more vulnerability IDs (max: 400). Find vulnerability IDs with GET /spotlight/queries/vulnerabilities/v1

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Returns:



196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
 
# File 'lib/crimson-falcon/api/spotlight_vulnerabilities.rb', line 196

def get_vulnerabilities_with_http_info(ids, opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: SpotlightVulnerabilities.get_vulnerabilities ...'
  end
  # verify the required parameter 'ids' is set
  if @api_client.config.client_side_validation && ids.nil?
    fail ArgumentError, "Missing the required parameter 'ids' when calling SpotlightVulnerabilities.get_vulnerabilities"
  end
  # resource path
  local_var_path = '/spotlight/entities/vulnerabilities/v2'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'ids'] = @api_client.build_collection_param(ids, :multi)

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type] || 'DomainSPAPIVulnerabilitiesEntitiesResponseV2'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"SpotlightVulnerabilities.get_vulnerabilities",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: SpotlightVulnerabilities#get_vulnerabilities\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end

#query_vulnerabilities(filter, opts = {}) ⇒ DomainSPAPIQueryResponse

Search for Vulnerabilities in your environment by providing an FQL filter and paging details. Returns a set of Vulnerability IDs which match the filter criteria

Parameters:

  • filter (String) —

    Filter items using a query in Falcon Query Language (FQL). Wildcards * and empty filter values are unsupported. Available filter fields that supports match (~): N/A Available filter fields that supports exact match: aid, cid, last_seen_within, status, cve.id, cve.is_cisa_kev, cve.remediation_level, cve.cps_rating, cve.exprt_rating, cve.exploit_status_to_include, cve.severity, cve.base_score, cve.types, host_info.asset_criticality, host_info.asset_roles, host_info.internet_exposure, host_info.tags, host_info.groups, host_info.product_type_desc, host_info.platform_name, suppression_info.is_suppressed, suppression_info.reason, host_info.instance_state Available filter fields that supports wildcard (*): N/A Available filter fields that supports range comparisons (&gt;, &lt;, &gt;&#x3D;, &lt;&#x3D;): created_timestamp, closed_timestamp, updated_timestamp, cve.base_score

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :after (String) —

    A pagination token used with the &#x60;limit&#x60; parameter to manage pagination of results. On your first request, don&#39;t provide an &#x60;after&#x60; token. On subsequent requests, provide the &#x60;after&#x60; token from the previous response to continue from that place in the results.

  • :limit (Integer) —

    The number of items to return in this response (default: 100, max: 400). Use with the after parameter to manage pagination of results.

  • :sort (String) —

    Sort vulnerabilities by their properties. Available sort options: &lt;ul&gt;&lt;li&gt;updated_timestamp|asc/desc&lt;/li&gt;&lt;li&gt;closed_timestamp|asc&lt;/li&gt;&lt;li&gt;updated_timestamp|asc/desc&lt;/li&gt;&lt;/ul&gt;. Can be used in a format &lt;field&gt;|asc for ascending order or &lt;field&gt;|desc for descending order.

Returns:



252
253
254
255
 
# File 'lib/crimson-falcon/api/spotlight_vulnerabilities.rb', line 252

def query_vulnerabilities(filter, opts = {})
  data, _status_code, _headers = query_vulnerabilities_with_http_info(filter, opts)
  data
end

#query_vulnerabilities_with_http_info(filter, opts = {}) ⇒ Array<(DomainSPAPIQueryResponse, Integer, Hash)>

Search for Vulnerabilities in your environment by providing an FQL filter and paging details. Returns a set of Vulnerability IDs which match the filter criteria

Parameters:

  • filter (String) —

    Filter items using a query in Falcon Query Language (FQL). Wildcards * and empty filter values are unsupported. Available filter fields that supports match (~): N/A Available filter fields that supports exact match: aid, cid, last_seen_within, status, cve.id, cve.is_cisa_kev, cve.remediation_level, cve.cps_rating, cve.exprt_rating, cve.exploit_status_to_include, cve.severity, cve.base_score, cve.types, host_info.asset_criticality, host_info.asset_roles, host_info.internet_exposure, host_info.tags, host_info.groups, host_info.product_type_desc, host_info.platform_name, suppression_info.is_suppressed, suppression_info.reason, host_info.instance_state Available filter fields that supports wildcard (*): N/A Available filter fields that supports range comparisons (&gt;, &lt;, &gt;&#x3D;, &lt;&#x3D;): created_timestamp, closed_timestamp, updated_timestamp, cve.base_score

  • opts (Hash) (defaults to: {}) —

    the optional parameters

Options Hash (opts):

  • :after (String) —

    A pagination token used with the &#x60;limit&#x60; parameter to manage pagination of results. On your first request, don&#39;t provide an &#x60;after&#x60; token. On subsequent requests, provide the &#x60;after&#x60; token from the previous response to continue from that place in the results.

  • :limit (Integer) —

    The number of items to return in this response (default: 100, max: 400). Use with the after parameter to manage pagination of results.

  • :sort (String) —

    Sort vulnerabilities by their properties. Available sort options: &lt;ul&gt;&lt;li&gt;updated_timestamp|asc/desc&lt;/li&gt;&lt;li&gt;closed_timestamp|asc&lt;/li&gt;&lt;li&gt;updated_timestamp|asc/desc&lt;/li&gt;&lt;/ul&gt;. Can be used in a format &lt;field&gt;|asc for ascending order or &lt;field&gt;|desc for descending order.

Returns:

  • (Array<(DomainSPAPIQueryResponse, Integer, Hash)>) —

    DomainSPAPIQueryResponse data, response status code and response headers



264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
 
# File 'lib/crimson-falcon/api/spotlight_vulnerabilities.rb', line 264

def query_vulnerabilities_with_http_info(filter, opts = {})
  if @api_client.config.debugging
    @api_client.config.logger.debug 'Calling API: SpotlightVulnerabilities.query_vulnerabilities ...'
  end
  # verify the required parameter 'filter' is set
  if @api_client.config.client_side_validation && filter.nil?
    fail ArgumentError, "Missing the required parameter 'filter' when calling SpotlightVulnerabilities.query_vulnerabilities"
  end
  if @api_client.config.client_side_validation && !opts[:'limit'].nil? && opts[:'limit'] > 400
    fail ArgumentError, 'invalid value for "opts[:"limit"]" when calling SpotlightVulnerabilities.query_vulnerabilities, must be smaller than or equal to 400.'
  end

  if @api_client.config.client_side_validation && !opts[:'limit'].nil? && opts[:'limit'] < 1
    fail ArgumentError, 'invalid value for "opts[:"limit"]" when calling SpotlightVulnerabilities.query_vulnerabilities, must be greater than or equal to 1.'
  end

  # resource path
  local_var_path = '/spotlight/queries/vulnerabilities/v1'

  # query parameters
  query_params = opts[:query_params] || {}
  query_params[:'filter'] = filter
  query_params[:'after'] = opts[:'after'] if !opts[:'after'].nil?
  query_params[:'limit'] = opts[:'limit'] if !opts[:'limit'].nil?
  query_params[:'sort'] = opts[:'sort'] if !opts[:'sort'].nil?

  # header parameters
  header_params = opts[:header_params] || {}
  # HTTP header 'Accept' (if needed)
  header_params['Accept'] = @api_client.select_header_accept(['application/json'])

  # form parameters
  form_params = opts[:form_params] || {}

  # http body (model)
  post_body = opts[:debug_body]

  # return_type
  return_type = opts[:debug_return_type] || 'DomainSPAPIQueryResponse'

  # auth_names
  auth_names = opts[:debug_auth_names] || ['oauth2']

  new_options = opts.merge(
    :operation => :"SpotlightVulnerabilities.query_vulnerabilities",
    :header_params => header_params,
    :query_params => query_params,
    :form_params => form_params,
    :body => post_body,
    :auth_names => auth_names,
    :return_type => return_type
  )

  data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
  if @api_client.config.debugging
    @api_client.config.logger.debug "API called: SpotlightVulnerabilities#query_vulnerabilities\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
  end
  return data, status_code, headers
end