Update payload handler to support new values. Closes #1231.

CrowdStrike · Dec 11, 2024 · 35070e0 · 35070e0
1 parent cfde05a
commit 35070e0
Show file tree

Hide file tree

Showing 2 changed files with 45 additions and 12 deletions.
diff --git a/src/falconpy/_payload/_filevantage.py b/src/falconpy/_payload/_filevantage.py
@@ -110,18 +110,31 @@ def filevantage_scheduled_exclusion_payload(passed_keywords: dict) -> dict:
 
     {
         "description": "string",
-        "id": "string",
         "name": "string",
         "policy_id": "string",
         "processes": "string",
+        "repeated": {
+            "all_day": boolean,
+            "end_time": "string",
+            "frequency": "string",
+            "monthly_days": [
+                integer
+            ],
+            "occurrence": "string",
+            "start_time": "string",
+            "weekly_days": [
+                "string"
+            ]
+        },
         "schedule_end": "string",
         "schedule_start": "string",
+        "timezone": "string",
         "users": "string"
     }
     """
     returned = {}
     keys = ["description", "id", "name", "policy_id", "processes",
-            "schedule_end", "schedule_start", "users"
+            "schedule_end", "schedule_start", "users", "timezone", "repeated"
             ]
     for key in keys:
         if passed_keywords.get(key, None):

diff --git a/src/falconpy/filevantage.py b/src/falconpy/filevantage.py
@@ -461,25 +461,45 @@ def create_scheduled_exclusions(self: object, body: dict = None, **kwargs) -> Di
         Keyword arguments:
         body - full body payload in JSON format, not required if using other keywords.
                {
-                   "description": "string",
-                   "name": "string",
-                   "policy_id": "string",
-                   "processes": "string",
-                   "schedule_end": "string",
-                   "schedule_start": "string",
-                   "users": "string"
+                    "description": "string",
+                    "name": "string",
+                    "policy_id": "string",
+                    "processes": "string",
+                    "repeated": {
+                        "all_day": boolean,
+                        "end_time": "string",
+                        "frequency": "string",
+                        "monthly_days": [
+                            integer
+                        ],
+                        "occurrence": "string",
+                        "start_time": "string",
+                        "weekly_days": [
+                            "string"
+                        ]
+                    },
+                    "schedule_end": "string",
+                    "schedule_start": "string",
+                    "timezone": "string",
+                    "users": "string"
                }
         description -- The scheduled exclusion description. (String, 0-500 characters.)
         name -- Name of the scheduled exclusion. (String, 1-100 characters.)
         policy_id -- ID of the policy the scheduled exclusion is assigned. (String)
         users -- Comma delimited list of users to NOT monitor changes. (String, 1-500 characters)
                  `admin*` excludes changes made by all usernames that begin with admin.
                  Falcon GLOB syntax is supported.
-        processes - Comma delimited list of processes to NOT monitor changes. (String, 1-500 characters)
+        processes -- Comma delimited list of processes to NOT monitor changes. (String, 1-500 characters)
                     `**\RunMe.exe` or `**/RunMe.sh` excludes changes made by RunMe.exe
                     or RunMe.sh in any location.
-        schedule_start - Indicates the start of the schedule. (String, RFC3339 format, Required)
-        schedule_end - Indicates the end of the schedule. (String, RFC3339 format)
+        repeated -- Optionally provide to indicate the exclusion is applied repeatedly within the
+                    scheduled_start and scheduled_end time. (Dictionary)
+        schedule_start -- Indicates the start of the schedule. (String, RFC3339 format, Required)
+        schedule_end -- Indicates the end of the schedule. (String, RFC3339 format)
+        timezone -- Must be provided to indicate the TimeZone name set for the provided scheduled_start and
+                    scheduled_end values. (String)
+                    See https://en.wikipedia.org/wiki/List_of_tz_database_time_zones for values.
+                    
 
         This method only supports keywords for providing arguments.