Version 1.6.5 - Minor docstring tweaks (36,000 lines), an entire agentic platform, bug fixes - #1495
Merged
Merged
Conversation
alhumaw
force-pushed
the
release/1.6.5
branch
2 times, most recently
from
August 5, 2026 17:34
0021641 to
df01df5
Compare
start_search documented body as an accepted keyword, but the guard only built search when body was falsy, then gated the request on search alone. Passing body= left search as None and returned a locally generated error without issuing a request. Closes CrowdStrike#1491
jshcodes
approved these changes
Aug 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
FalconPy v1.6.5
This update implements new operations and service collections. A docstring overhaul and multiple bug fixes are also included.
Unit test coverage
Bandit analysis
[main] INFO profile include tests: None [main] INFO profile exclude tests: None [main] INFO cli include tests: None [main] INFO cli exclude tests: None [main] INFO running on Python 3.14.6 Working... ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:01 Run started:2026-08-04 23:27:40.163112+00:00 Test results: No issues identified. Code scanned: Total lines of code: 155084 Total lines skipped (#nosec): 0 Run metrics: Total issues (by severity): Undefined: 0 Low: 0 Medium: 0 High: 0 Total issues (by confidence): Undefined: 0 Low: 0 Medium: 0 High: 0 Files skipped (0):Added features and functionality
Added: Optional
sessionkeyword argument (arequests.Sessioninstance) accepted byOAuth2,APIHarnessV2,the legacy
APIHarness, and every Service Class, allowing callers to reuse a single HTTP connection acrosslogin, every API call, token renewal, and logout. FalconPy never closes a session provided this way; the
caller retains ownership of its lifecycle. Behavior is unchanged when this keyword is omitted.
_util/_functions.py_api_request/_request.py_api_request/_request_connection.py_auth_object/_interface_config.py_auth_object/_falcon_interface.py_auth_object/_uber_interface.pyoauth2.py_util/_service.py_util/_uber.py_service_class/_base_service_class.pyapi_complete/_legacy.pytests/test_session_support.pytests/test_session_connection_reuse.pyAdded: New Agent Invocation service collection with three operations.
_endpoint/__init__.py_endpoint/_agent_invocation.py_payload/__init__.py_payload/_agent_invocation.py__init__.pyagent_invocation.pytests/test_agent_invocation.pyAdded: New Agent Templates service collection with two operations.
_endpoint/__init__.py_endpoint/_agent_templates.py_payload/__init__.py_payload/_agent_templates.py__init__.pyagent_templates.pytests/test_agent_templates.pyAdded: New Agent Versions service collection with two operations.
_endpoint/__init__.py_endpoint/_agent_versions.py_payload/__init__.py_payload/_agent_versions.py__init__.pyagent_versions.pytests/test_agent_versions.pyAdded: Added
entities_merge_post_v1operation to the Case Management service collection._endpoint/_case_management.pycase_management.pytests/test_case_management.pyUpdated: Added
enrichedas an allowed parameter in the GetRuleInputSchema operation within the Cloud Policies service collection._endpoint/_cloud_policies.pycloud_policies.pyUpdated: Added
sortas an allowed parameter in the cloud_security_assets_combined_application_findings operation, updated thefilterparameter description in the cloud_security_assets_combined_compliance_by_account operation, and updated thefilterparameter description in the cloud_security_assets_queries operation within the Cloud Security Assets service collection._endpoint/_cloud_security_assets.pycloud_security_assets.pyAdded: Added
cspm_evaluations_iom_entities_postoperation to the Cloud Security Detections service collection._endpoint/_cloud_security_detections.pycloud_security_detections.pytests/test_cloud_security_detections.pyAdded: Added
entities_rules_ownership_put_v2operation to the Correlation Rules Admin service collection._endpoint/_correlation_rules_admin.pycorrelation_rules_admin.pytests/test_correlation_rules_admin.pyAdded: Added five new operations to the Data Protection Configuration service collection.
_endpoint/_data_protection_configuration.pydata_protection_configuration.pytests/test_data_protection_configuration.pyUpdated: Added
Authorizationas an allowed parameter to the CombinedReleaseNotesV1, CombinedReleasesV1Mixin0, GetDeploymentsExternalV1, GetEntityIDsByQueryPOST, GetEntityIDsByQueryPOSTV2, and QueryReleaseNotesV1 operations within the Deployments service collection._endpoint/_deployments.pydeployments.pyUpdated: Added
cloud_service_compartment_idas an allowedsortvalue for the CombinedHiddenDevicesByFilter and CombinedDevicesByFilter operations within the Hosts service collection._endpoint/_hosts.pyhosts.pyDecommissioned: Decommissioned all six operations within the Incidents service collection (CrowdScore, GetBehaviors, GetIncidents, PerformIncidentAction, QueryBehaviors, and QueryIncidents). The Incidents API reached end of life and these operations were removed from the API specification. The
IncidentsService Class and its methods remain importable and are taggedDECOMMISSIONEDso existing code continues to load, but calls to these operations will no longer succeed. Use the Alerts service collection instead._endpoint/_incidents.py_endpoint/deprecated/_incidents.py_endpoint/deprecated/_mapping.pyincidents.pyDecommissioned: Decommissioned
AggregatesKnowledgeBaseAuditEventsV1operation in the Knowledge Base Audit Events service collection._endpoint/_knowledge_base_audit_events.py_endpoint/deprecated/_knowledge_base_audit_events.py_endpoint/deprecated/_mapping.pyknowledge_base_audit_events.pyDecommissioned: Decommissioned
AggregatesKnowledgeBasesV1operation in the Knowledge Bases service collection._endpoint/_knowledge_bases.py_endpoint/deprecated/_knowledge_bases.py_endpoint/deprecated/_mapping.pyknowledge_bases.pyAdded: Added
PostAggregatesPodsoperation to the Kubernetes Protection service collection._endpoint/_kubernetes_protection.pykubernetes_protection.pytests/test_kubernetes_protection.pyAdded: Added
exclusions_sdmf_query_v1operation to the Ml Exclusions service collection._endpoint/_ml_exclusions.pyml_exclusions.pytests/test_ml_exclusions.pyAdded: New Models service collection with two operations.
_endpoint/__init__.py_endpoint/_models.py_payload/__init__.py_payload/_models.py__init__.pymodels.pytests/test_models.pyAdded: Added 18 new operations to the Ngsiem service collection.
_endpoint/_ngsiem.pyngsiem.pytests/test_ngsiem.pyAdded: New Scanning Orchestrator service collection with eight operations.
_endpoint/__init__.py_endpoint/_scanning_orchestrator.py_payload/__init__.py_payload/_scanning_orchestrator.py__init__.pyscanning_orchestrator.pytests/test_scanning_orchestrator.pyAdded: New Spans service collection with two operations.
_endpoint/__init__.py_endpoint/_spans.py_payload/__init__.py_payload/_spans.py__init__.pyspans.pytests/test_spans.pyAdded: New Stream service collection with one operation.
_endpoint/__init__.py_endpoint/_stream.py_payload/__init__.py_payload/_stream.py__init__.pystream.pytests/test_stream.pyUpdated: Added
Authorizationas an allowed parameter to the GetEventsBody, GetEventsEntities, QueryEvents, GetRulesEntities, and QueryRules operations within the Tailored Intelligence service collection._endpoint/_tailored_intelligence.pytailored_intelligence.pyAdded: New Tools service collection with two operations.
_endpoint/__init__.py_endpoint/_tools.py_payload/__init__.py_payload/_tools.py__init__.pytools.pytests/test_tools.pyDecommissioned: Decommissioned
WorkflowExecuteInternaloperation in the Workflows service collection._endpoint/_workflows.py_endpoint/deprecated/_workflows.py_endpoint/deprecated/_mapping.pyworkflows.pyUpdated: Added
include_mocksandversionas allowed parameters in the WorkflowDefinitionsExport operation within the Workflows service collection._endpoint/_workflows.pyworkflows.pyUpdated: Converted method docstrings within every service collection to the "format friendly" style. Keyword arguments and return values are now typed entries beneath underlined section headers, which is valid numpydoc and reStructuredText and renders as structured documentation in editors and IDEs. Method behavior is unchanged.
*.py(every service collection).pylintrcutil/convert_docstrings.pyutil/fix_docstring_underlines.pyIssues resolved
Fixed: Fixed the documented
bodykeyword argument being ignored by the start_search method within the NGSIEM service collection. The search payload was only built whenbodywas absent, and the request was then gated on that payload, so passingbodyreturned a local error result without calling the API. Thesearchkeyword is unaffected. Closes [ BUG ] NGSIEM.start_search() ignores the documented body keyword #1491.ngsiem.pytests/test_ngsiem.pyFixed: Documented the timestamp format required by the
filterkeyword for the query_malware and query_malware_entities operations within the Intel service collection. These operations returnlast_updatedandcreated_timestampas ISO 8601 strings, so filter values for those fields must be quoted (last_updated:>='2026-01-28T10:22:34Z'). An unquoted value is parsed as an integer, so a Unix epoch timestamp is accepted but matches no records, making the filter appear to be ignored. FalconPy passes thefiltervalue to the API unmodified, so this is a documentation change only. Closes [ BUG ] query_malware_entities ignores last_updated FQL filter #1422.intel.pyFixed: Fixed path parameters being interpolated into operation routes without per-segment encoding. A value containing a forward slash or a dot-segment sequence altered the generated path, and since the
requestslibrary normalizes a path before transmission, the request could be issued against a different route than the calling method selected. The newencode_path_segmenthandler is applied at all three route construction sites:handle_path_variables(Service Classes),handle_fieldandscrub_target(the Uber Class), and the path variable handlers within the legacyAPIHarness. Integers, UUIDs and hyphenated keys are unaffected. Closes [ ENH ] Harden path-variable interpolation in handle_path_variables and scrub_target #1488._util/__init__.py_util/_functions.py_util/_uber.pyapi_complete/_legacy.pytests/test_path_encoding.pyFixed: Fixed Context Authentication discarding an explicitly provided
base_url. The cloud region advertised by the discovered context object was applied unconditionally, replacing the base URL specified by the caller, which retargeted requests to the contextcs_cloudvalue within Foundry FaaS functions. A caller-provided base URL now takes precedence, and the context is only consulted when one was not supplied._auth_object/_falcon_interface.pytests/test_zero_trust_assessment.pyFixed: Added
US-3to the list of dashed region names recognized when a base URL is specified by name. Passingbase_url="us-3"producedhttps://us-3instead of the US-3 API URL, since the dash was only stripped for regions present in that list. All regions now resolve the same way with or without the dash._util/_functions.pytests/test_authentications.pyFixed: Added the missing
US-3andUSGOV-2ingest base URLs. Retrieving an ingest base URL for a US-3 or USGOV-2 tenant raised aKeyError, making the NGSIEM HTTP Event Collector unusable in those regions._enum/_ingest_base_url.py