Conversation
… to route_url.format(uuid=str(passed_uuid)) to properly handle the {uuid} placeholder in Falcon Container routes.
… is not initialized. Fixed test_service_class.py: Added null check for _CLEAN before using it
alhumaw
added
CAO hunting
alhumaw
previously approved these changes
Mar 18, 2026
crowdstrikedcs
previously approved these changes
Mar 19, 2026
alhumaw
approved these changes
Mar 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
FalconPy v1.6.1
This update implements new operations and service collections. Multiple bug fixes are also included.
Unit test coverage
Bandit analysis
[main] INFO running on Python 3.13.3 Run started:2026-03-18 22:53:20.160367 Test results: No issues identified. Code scanned: Total lines of code: 125704 Total lines skipped (#nosec): 0 Run metrics: Total issues (by severity): Undefined: 0 Low: 0 Medium: 0 High: 0 Total issues (by confidence): Undefined: 0 Low: 0 Medium: 0 High: 0 Files skipped (0):Added features and functionality
Added: New Admission Control Policies service collection with 15 operations.
_endpoint/__init__.py_endpoint/_admission_control_policies.py_endpoint/deprecated/__init__.py_endpoint/deprecated/_admission_control_policies.py_payload/__init__.py_payload/_admission_control_policies.py__init__.pyadmission_control_policies.pytests/test_admission_control_policies.pyAdded: Added two new operations to the Workflows service collection.
_endpoint/__init__.py_endpoint/_workflows.py_endpoint/deprecated/__init__.py_endpoint/deprecated/_workflows.pyworkflows.pytests/test_workflows.pyAdded: Added
offsetandlimitparameters to the WorkflowTriggersCombined operation within the Workflows service collection._endpoint/_workflows.pyworkflows.pyAdded: Added
triggered_custom_ioaas an allowed value for theedge_typeargument in the combined_edges_get operation within the Threat Graph service collection._endpoint/_threatgraph.pythreatgraph.pyAdded: Added
custom_ioaandcustom_ioasas allowed values for thevertex_typeargument in the combined_summary_get, entities_vertices_get, and entities_vertices_getv2 operations within the Threat Graph service collection._endpoint/_threatgraph.pythreatgraph.pyAdded: Added four new operations to the Sensor Download service collection.
_endpoint/_sensor_download.pysensor_download.pytests/test_sensor_download.pyAdded: Added
passwordandX-File-Passwordparameters to the UploadFileQuickScanPro operation within the Quick Scan Pro service collection._endpoint/_quick_scan_pro.pyquick_scan_pro.pytests/test_quick_scan_pro.pyAdded: Added nine new operations to the ML Exclusions service collection.
_endpoint/__init__.py_endpoint/_ml_exclusions.py_endpoint/deprecated/__init__.py_endpoint/deprecated/_ml_exclusions.py_payload/__init__.py_payload/_ml_exclusions.pyml_exclusions.pytests/test_ml_exclusions.pyAdded: Added
group_idsandgroup_namesas allowed values for thefilterandsortarguments in the ITAutomationCombinedScheduledTasks and ITAutomationSearchScheduledTasks operations within the IT Automation service collection._endpoint/_it_automation.pyit_automation.pyAdded: Added nine new operations to the IOA Exclusions service collection.
_endpoint/__init__.py_endpoint/_ioa_exclusions.py_endpoint/deprecated/__init__.py_endpoint/deprecated/_ioa_exclusions.py_payload/__init__.py_payload/_ioa.pyioa_exclusions.pytests/test_ioa_exclusions.pyUpdated: Added deprecation notices to all operations within the Incidents service collection (API will be removed in March 2026).
_endpoint/_incidents.pyincidents.pyAdded: Added three new operations to the Correlation Rules service collection.
_endpoint/_correlation_rules.py_endpoint/deprecated/_correlation_rules.py_payload/__init__.py_payload/_correlation_rules.pycorrelation_rules.pytests/test_correlation_rules.pyAdded: Added
categoryas an allowed filter field in the query_applications operation within the Discover service collection._endpoint/_discover.py_endpoint/deprecated/_discover.pyAdded: Added
tags_stringas an allowed filter field in the cloud_compliance_framework_posture_summaries and cloud_compliance_rule_posture_summaries operations within the Cloud Security Compliance service collection._endpoint/_cloud_security_compliance.py_endpoint/deprecated/_cloud_security_compliance.pycloud_security_compliance.pyAdded: Added
gcrnparameter to the combined_application_findings operation within the Cloud Security Assets service collection (deprecating thecrnparameter)._endpoint/_cloud_security_assets.py_endpoint/deprecated/_cloud_security_assets.pyAdded: Added
cloud_risks.rule,cloud_risks.severity, andcloud_risks.statusas allowed filter fields in the cloud_security_assets_queries operation within the Cloud Security Assets service collection._endpoint/_cloud_security_assets.py_endpoint/deprecated/_cloud_security_assets.pycloud_security_assets.pytests/test_cloud_security_assets.pyAdded: Added
cloud_risks.open_risk_count,publiclyExposedToTheInternet,publiclyExposedAccessRange, andpubliclyExposedExposureMethodas allowed sort fields in the cloud_security_assets_queries operation within the Cloud Security Assets service collection._endpoint/_cloud_security_assets.py_endpoint/deprecated/_cloud_security_assets.pyAdded: Added
organization_idsparameter to the cloud_registration_aws_get_accounts operation within the Cloud AWS Registration service collection._endpoint/_cloud_aws_registration.py_endpoint/deprecated/_cloud_aws_registration.pycloud_aws_registration.pytests/test_cloud_aws_registration.pyAdded: Added five new operations to the Cloud Policies service collection.
_endpoint/_cloud_policies.py_payload/__init__.py_payload/_cloud_policies.pycloud_policies.pytests/test_cloud_policies.pyAdded: Added
rule_category,rule_cloneable,rule_compliance_benchmark_uuid,rule_resource_type_name, andrule_risk_factoras allowed filter and sort fields in the QueryRules operation within the Cloud Policies service collection._endpoint/_cloud_policies.pycloud_policies.pyUpdated: Updated the CreateRule operation description within the Cloud Policies service collection to document rule severity mapping and Runtime IOM Custom Rule requirements.
_endpoint/_cloud_policies.pycloud_policies.pyAdded: Added eight new operations to the ASPM service collection.
_endpoint/_aspm.py_payload/__init__.py_payload/_aspm.pyaspm.pytests/test_aspm.pyDeprecated: Overwatch Dashboard service collection.
__init__.py_endpoint/__init__.py_endpoint/_overwatch_dashboard.py_endpoint/deprecated/__init__.py_endpoint/deprecated/_overwatch_dashboard.pyoverwatch_dashboard.pytests/test_overwatch_dashboard.pyAdded: Added 6 new operations to the Case Management service collection.
_endpoint/_case_management.py_endpoint/deprecated/_case_management.py_payload/__init__.py_payload/_case_management.pycase_management.pytests/test_case_management.pyAdded: Added new cloud_registration_gcp_get_entities operation to the Cloud Google Cloud Registration service collection.
_endpoint/_cloud_google_cloud_registration.py_endpoint/deprecated/_cloud_google_cloud_registration.pycloud_google_cloud_registration.pytests/test_cloud_google_cloud_registration.pyAdded: Added new cspm_evaluations_combined_iom_by_rule operation to the Cloud Security Detections service collection.
_endpoint/_cloud_security_detections.py_endpoint/deprecated/_cloud_security_detections.pycloud_security_detections.pytests/test_cloud_security_detections.pyAdded: Added 11 new operations for the Data Protection Configuration service collection.
_endpoint/_data_protection_configuration.py_endpoint/deprecated/_data_protection_configuration.py_payload/__init__.py_payload/_data_protection_configuration.pydata_protection_configuration.pytests/test_data_protection_configuration.pyAdded: Added
properties.content_patterns_operatoras a supported filter field in the queries_classification_get_v2 operation within the Data Protection Configuration service collection._endpoint/_data_protection_configuration.pydata_protection_configuration.pyRemoved: Removed deprecated AggregateDetections and QueryDetectionIdsByFilter operations from the Falcon Complete Dashboard service collection.
_endpoint/_falcon_complete_dashboard.py_endpoint/deprecated/_falcon_complete_dashboard.pyfalcon_complete_dashboard.pyUpdated: Renamed GetAWSAccounts to GetAWSAccountsMixin0 and DeleteAWSAccounts to DeleteAWSAccountsMixin0 in the Kubernetes Protection service collection. Old names are retained for backward compatibility.
_endpoint/_kubernetes_protection.py_endpoint/deprecated/_kubernetes_protection.pykubernetes_protection.pyAdded: Added
cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name, andnamespaceas supported filter fields in the ReadClusterEnrichment, ReadContainerEnrichment, ReadDeploymentEnrichment, ReadNodeEnrichment, and ReadPodEnrichment operations within the Kubernetes Protection service collection._endpoint/_kubernetes_protection.pykubernetes_protection.pyAdded: Added
include_countsas a query parameter to the ReadClusterCombinedV2 operation within the Kubernetes Protection service collection._endpoint/_kubernetes_protection.pykubernetes_protection.pyAdded: Added
cloud_account_id,cloud_name,cloud_region,cluster_id,cluster_name,image_name, andnamespaceas supported filter fields in the ReadRunningContainerImages operation within the Kubernetes Protection service collection._endpoint/_kubernetes_protection.pykubernetes_protection.pyUpdated: Updated
limitrange from 1-500 to 0-1000, correctedoffsettype from String to Integer, and documented supported values forstatusin the GetAWSAccountsMixin0 operation within the Kubernetes Protection service collection.kubernetes_protection.pyAdded: Added eighteen new operations to the NGSIEM service collection.
_endpoint/_ngsiem.py_endpoint/deprecated/_ngsiem.py_payload/__init__.py_payload/_ngsiem.pyngsiem.pytests/test_ngsiem.pyAdded: Added
update_availableandparser_typeas fields to the ListParsers operation within the NGSIEM service collection._endpoint/_ngsiem.pyngsiem.pyAdded: New Serverless Exports service collection with 4 operations.
_endpoint/_serverless_exports.py_payload/_serverless_exports.pyserverless_exports.pytests/test_serverless_exports.pyAdded: Added one new operation to the Spotlight Evaluation Logic service collection.
_endpoint/_spotlight_evaluation_logic.pyspotlight_evaluation_logic.pytests/test_spotlight_evaluation_logic.pyAdded: Added
cve_reachableas an allowed filter field in the get_vulnerabilities operation within the Serverless Vulnerabilities service collection._endpoint/_serverless_vulnerabilities.py_endpoint/deprecated/_serverless_vulnerabilities.pyserverless_vulnerabilities.pyAdded: Added
cloud_account_id,cloud_name,cloud_region, andcluster_idas allowed filter fields in the read_count_by_date_range, read_count, and search_and_read operations within the Unidentified Containers service collection._endpoint/_unidentified_containers.py_endpoint/deprecated/_unidentified_containers.pyunidentified_containers.pyAdded: Added
cid_name,created_at,last_login_at,status, andtemporarily_assigned_cidsas allowed sort values for the query_users operation within the User Management service collection._endpoint/_user_management.py_endpoint/deprecated/_user_management.pyuser_management.pyAdded: Added 11 new sort fields including
device_policies.application-abuse-prevention,device_policies.data-protection-cloud,device_policies.identity-endpoint,pointer_size, andsafe_modeto the combined_hidden_devices_by_filter and query_devices_by_filter_combined operations within the Hosts service collection._endpoint/_hosts.py_endpoint/deprecated/_hosts.pyhosts.pyAdded: Added
index_digestas an allowed filter field in the AggregateImageCountByBaseOS, AggregateImageCountByState, AggregateImageCount, CombinedImageIssuesSummary, GetCombinedImages, CombinedImageDetail, and ReadCombinedImagesExport operations within the Container Images service collection._endpoint/_container_images.pycontainer_images.pyAdded: Added
ai_related,ai_vulnerability_count, andai_vulnerabilitiesas allowed filter and sort fields in the AggregateImageCount, CombinedImageIssuesSummary, and ReadCombinedImagesExport operations within the Container Images service collection.container_images.pyAdded: Added
ai_relatedandindex_digestas allowed filter fields in the ReadVulnerabilityCountByActivelyExploited, ReadVulnerabilityCountByCPSRating, ReadVulnerabilityCountByCVSSScore, ReadVulnerabilityCountBySeverity, ReadVulnerabilityCount, and ReadCombinedVulnerabilities operations within the Container Vulnerabilities service collection._endpoint/_container_vulnerabilities.pycontainer_vulnerabilities.pyAdded: Added
notification_group_id,credentials_url,credentials_domain,credentials_ip,domain,credential_status,bot.operating_system.hardware_id, andbot.bot_idas allowed filter fields in the QueryNotificationsExposedDataRecordsV1 operation within the Recon service collection.recon.pyAdded: Added new incrementUninstallToken operation to the Sensor Update Policy service collection.
_endpoint/_sensor_update_policy.py_payload/__init__.py_payload/_sensor_update_policy.pysensor_update_policy.pyAdded: Added
add-rule-groupandremove-rule-groupas allowed action values in the performSensorUpdatePoliciesAction operation within the Sensor Update Policy service collection.sensor_update_policy.pyAdded: Added
risk_providerparameter to the getCombinedVulnerabilitiesMetadata operation within the Spotlight Vulnerability Metadata service collection._endpoint/_spotlight_vulnerability_metadata.py_endpoint/deprecated/_spotlight_vulnerability_metadata.pyspotlight_vulnerability_metadata.pyDeprecated: Deprecated four operations within the Alerts service collection: PostAggregatesAlertsV1, PostEntitiesAlertsV1, PatchEntitiesAlertsV2, and GetQueriesAlertsV1.
_endpoint/__init__.py_endpoint/deprecated/__init__.py_endpoint/deprecated/_alerts.pyDeprecated: Deprecated one operation within the CSPM Registration service collection: GetConfigurationDetections.
_endpoint/__init__.py_endpoint/deprecated/__init__.py_endpoint/deprecated/_cspm_registration.pyDeprecated: Deprecated four operations within the Detects service collection: GetAggregateDetects, UpdateDetectsByIdsV2, GetDetectSummaries, and QueryDetects.
_endpoint/__init__.py_endpoint/deprecated/__init__.py_endpoint/deprecated/_detects.pyDeprecated: Deprecated five operations within the Device Control Policies service collection: getDefaultDeviceControlPolicies, updateDefaultDeviceControlPolicies, getDeviceControlPolicies, updateDeviceControlPolicies, and createDeviceControlPolicies.
_endpoint/__init__.py_endpoint/deprecated/__init__.py_endpoint/deprecated/_device_control_policies.pyDeprecated: Deprecated three operations within the Downloads service collection: FetchFilesDownloadInfo, DownloadFile, and EnumerateFile.
_endpoint/__init__.py_endpoint/deprecated/__init__.py_endpoint/deprecated/_downloads.pyDeprecated: Deprecated five operations within the MSSP service collection: getCIDGroupMembersBy, deleteCIDGroupMembers, getCIDGroupById, getUserGroupMembersByID, and getUserGroupsByID.
_endpoint/__init__.py_endpoint/deprecated/__init__.py_endpoint/deprecated/_mssp.pyDeprecated: Deprecated one operation within the Sample Uploads service collection: ArchiveUploadV1.
_endpoint/__init__.py_endpoint/deprecated/__init__.py_endpoint/deprecated/_sample_uploads.pyIssues resolved
Fixed: Corrected HTTP Method from PATCH to POST for the CreateActionsV1 operation docstring within the Recon service collection.
recon.pyFixed: Swagger URLs within the Cloud Azure Registration service collection.
cloud_azure_registration.pyFixed: Swagger URLs within the Cloud OCI Registration service collection.
cloud_oci_registration.pyFixed: Added missing
idparameter to entities_policy_patch_v2 and entities_classification_patch_v2 operations within the Data Protection Configuration service collection._endpoint/_data_protection_configuration.pydata_protection_configuration.pyFixed: Fixed
expires_timestamptruthiness check in the Installation Tokens payload builder that preventedNonefrom being serialized as JSONnull. Closes [ BUG ] tokens_create cannot set expires_timestamp to null for never-expiring installation tokens #1431._payload/_generic.pyFixed: Fixed route URL formatting for Falcon Container operations that use named
{uuid}path placeholders. Positional.format()was replaced with keyword.format(uuid=...)to correctly substitute the UUID in routes like/image-assessment/entities/reports/v2/{uuid}._util/_functions.pyFixed: Added validation to the
base_urlsetter inInterfaceConfigurationto preventNone, empty strings, or non-string values from overwriting the base URL._auth_object/_interface_config.pyFixed: Fixed three incorrect aliases in the Case Management service collection. The
aggregates_notification_groups_post_v1andaggregates_notification_groups_post_v2aliases were incorrectly pointing to the entities GET methods instead of the aggregation POST methods, andentities_notification_groups_get_v2was pointing to the v1 method instead of v2.case_management.pyFixed: Resolves GetSearchStatusV1 pagination support. Closes [ BUG ] NGSIEM GetSearchStatusV1 doesn't support pagination #1383.
Fixed: Parameter mismatch / alias support in the StopSearchV1 parameter handling. Closes [ BUG ] NGSIEM stop_search giving 'No content was received for this request.' #1398.