Repository: CrowdStrike/falconpy (language: python)

Issue:
[ BUG ] Returning empty Body ("body": {"message": "No content returned", "resources": []})
I am using the below code to pull the information, it was working fine yesterday but it is not returning any content in json's body.

Can you please help ?

```python
import json
from argparse import ArgumentParser, RawTextHelpFormatter
from falconpy import ReportExecutions
import os

def consume_arguments():
    """Consume our required command line arguments."""
    parser = ArgumentParser(description=__doc__, formatter_class=RawTextHelpFormatter)
    required = parser.add_argument_group("required_arguments")
    required.add_argument("-k", "--falcon_client_id",
                        help="CrowdStrike API Client ID",
                        required=True
                        )
    required.add_argument("-s", "--falcon_client_secret",
                        help="CrowdStrike API Client Secret",
                        required=True
                        )
    required.add_argument("-r", "--report", help="ID of the report to retrieve", required=True)
    return parser.parse_args()


def retrieve_report_executions(sdk: ReportExecutions, rptid: str):
    """Retrieve the list of execution IDs that match this report ID."""
    print(f"🔍 Searching for executions of {rptid}")
    execution_id_lookup = sdk.reports_executions_query(filter=f"scheduled_report_id:'{rptid}'")
    if not execution_id_lookup["status_code"] == 200:
        raise SystemExit("⛔ Unable to retrieve report executions from "
                         "the CrowdStrike API, check API key permissions."
                         )

    # Give the SDK back so we can feed our results to the next method easily
    return sdk, execution_id_lookup["body"]["resources"]


def get_report_execution_runs(sdk: ReportExecutions, id_list: list):
    """Retrieve the list of execution runs for each execution ID."""
    print(f"✅ Found {len(id_list)} executions of this report available.")
    # Retrieve the status of these IDs
    exec_status_lookup = sdk.report_executions_get(id_list)
    if not exec_status_lookup["status_code"] == 200:
        raise SystemExit("⛔ Unable to retrieve execution statuses from the CrowdStrike API.")
    print(f"⚠️  This execution has run {len(exec_status_lookup['body']['resources'])} times.")

    # Give the SDK back as well so we can easily feed it to our next method call
    return sdk, exec_status_lookup["body"]["resources"]


def process_executions(sdk: ReportExecutions, run_list: list):
    """Process the results of the executions, this solution only handles completed runs."""
    saved = 0
    for exec_status in run_list:
        status = exec_status["status"]
        exec_id = exec_status["id"]
        rpt_id = exec_status["scheduled_report_id"]
        if status.upper() == "DONE":
            report_detail = sdk.get_download(exec_id)
            if report_detail:
                if isinstance(report_detail, dict):
                    try:
                        with open(f"{rpt_id}_{exec_id}.rpt", "w", encoding="utf-8") as json_output:
                            json.dump(report_detail, json_output)
                        saved += 1
                        print(f"📥 {exec_id} successfully saved to {rpt_id}_{exec_id}.rpt")
                    except json.JSONDecodeError:
                        print(f"❗ Unable to decode results of report run {exec_id} for ")
                else:
                    with open(f"{rpt_id}_{exec_id}.rpt", "wb") as csv_output:
                        csv_output.write(report_detail)
                    saved += 1
            else:
                print(f"⛔ Unable to retrieve report for execution {exec_id} of {rpt_id}.")
        else:
            print(f"⏩ Skipping {exec_id} as not yet finished.")
    # Return back the number of successful saves
    return saved


if __name__ == "__main__":
    # Consume any provided command line arguments
    cmdline = consume_arguments()
    # Create an instance of the ReportExecutions Service Class
    falcon = ReportExecutions(client_id=os.getenv("CLIENT_ID"),
                              client_secret=cmdline.falcon_client_secret
                              )
    # Retrieve our report executions, and process them, saving any that
    # have completed successfully to individual files (JSON format).
    # Let's be fancy and leverage list expansion to provide arguments from
    # one method to the subsequent one. It's like inception for Python. ♜
    SUCCESSFUL = process_executions(
        *get_report_execution_runs(*retrieve_report_executions(falcon, cmdline.report))
        )
    # Inform the user of the result
    print(f"🏁 Retrieval complete, {SUCCESSFUL} report results were downloaded.")
```


Discussion / hints:

Fix patch:
diff --git a/.github/wordlist.txt b/.github/wordlist.txt
index c22386a77..5e4c4216d 100644
--- a/.github/wordlist.txt
+++ b/.github/wordlist.txt
@@ -840,3 +840,40 @@ FalconInterface
 UberInterface
 APIRequest
 hostgroup
+Subreddit
+deleteCIDGroupMembersV
+GetSensorAggregates
+GetSensorDetails
+QuerySensorsByFilter
+CreateInventory
+GetCredentialsMixin
+RegisterCspmSnapshotAccount
+queryPolicies
+queryScheduledExclusions
+queryRuleGroups
+highVolumeQueryChanges
+updateRuleGroups
+deleteRuleGroups
+createRuleGroups
+getRuleGroups
+updateRules
+deleteRules
+createRules
+getRules
+updateRuleGroupPrecedence
+updateScheduledExclusions
+deleteScheduledExclusions
+createScheduledExclusions
+getScheduledExclusions
+updatePolicies
+deletePolicies
+createPolicies
+getPolicies
+updatePolicyRuleGroups
+updatePolicyPrecedence
+updatePolicyHostGroups
+GetCombinedImages
+AggregateAlerts
+QueryAlertIdsByFilter
+URLEncoded
+aboese
\ No newline at end of file
diff --git a/AUTHORS.md b/AUTHORS.md
index 1b1502881..28e2e534a 100644
--- a/AUTHORS.md
+++ b/AUTHORS.md
@@ -1,6 +1,7 @@
 ![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
 
-[![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)](https://twitter.com/CrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
+
 
 # FalconPy Project Authors
 The FalconPy project exists to enable developer interactions with the CrowdStrike Falcon API. Designed to be easy to integrate and use within your Python projects, the library is released under the [Unlicense](LICENSE) license. Developed and maintained by a diverse group of security architects, engineers and specialists, FalconPy has received multiple contributions from the community at large.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 024313916..9108c710f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,108 @@
+# Version 1.3.1
+## Added features and functionality
++ Added: 1 new operation added (`highVolumeQueryChanges`) from the _FileVantage_ service collection.
+    - `_endpoint/_filevantage.py`
+    - `filevantage.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_filevantage.py`
++ Added: Warn when providing API arguments that are unnecessarily URLEncoded. Closes #850.
+    - `_error/__init__.py`
+    - `_error/_warnings.py`
+    - `_util/_functions.py`
+    - `_util/_uber.py`
+    - `__init__.py`
+    - Thanks go out to @aboese for suggesting this enhancement. 🙇
++ Added: `add_comment` keyword added to the _PerformIncidentAction_ operation within the _**Incidents**_ Service Class. Closes #1003.
+    - `_payload/_incidents.py`
+    - `incidents.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_incidents.py`
+    - Thanks go out to @morcef for suggesting this enhancement. 🙇
++ Added: `add-rule-group` and `remove-rule-group` options added to _performFirewallPoliciesAction_ operation in the __Firewall Policies__ service collection.
+    - `_endpoint/_firewall_policies.py`
+    - `firewall_policies.py`
++ Added: Sort by `alert_ids` option added to _QueryBehaviors_ operation in the __Incidents_ service collection.
+    - `_endpoint/_incidents.py`
++ Added: _AggregateAlerts_ and _QueryAlertIdsByFilter_ operations added to the __Falcon Complete Dashboard__ service collection.
+    - `_endpoint/_falcon_complete_dashboard.py`
+    - `falcon_complete_dashboard.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_falcon_complete_dashboard.py`
++ Added: _GetCombinedImages_ operation added to the __Falcon Container__ service collection.
+    - `_endpoint/_falcon_container.py`
+    - `falcon_container.py`
+    > Unit testing expanded to complete code coverage.
+    - `test_falcon_container.py`
++ Added: `ids` keyword argument added to _GetIntelReportPDF_ and _QueryMitreAttacks_ operations. `if_none_match` and `if_modified_since` keyword arguments added to _GetLatestIntelRuleFile_ operation. __Intel__ service collection.
+    - `_endpoint/_intel.py`
+    - `intel.py`
+    > Unit testing expanded to complete code coverage.
+    - `test_intel.py`
++ Added: Override functionality - All service classes are now able to call manually specified operation endpoints via the `override` method. This method mirrors functionality provided by the `override` keyword within the Uber Class.
+    - `_service_class.py`
++ Added: 23 new operations added to the __FileVantage__ service collection.
+    * updatePolicyHostGroups
+    * updatePolicyPrecedence
+    * updatePolicyRuleGroups
+    * getPolicies
+    * createPolicies
+    * deletePolicies
+    * updatePolicies
+    * getScheduledExclusions
+    * createScheduledExclusions
+    * deleteScheduledExclusions
+    * updateScheduledExclusions
+    * updateRuleGroupPrecedence
+    * getRules
+    * createRules
+    * deleteRules
+    * updateRules
+    * getRuleGroups
+    * createRuleGroups
+    * deleteRuleGroups
+    * updateRuleGroups
+    * highVolumeQueryChanges
+    * queryRuleGroups
+    * queryScheduledExclusions
+    * queryPolicies
+    - `_endpoint/_filevantage.py`
+    - `filevantage.py`
+    > 4 new payload handlers were implemented.
+    - `_payload/__init__.py`
+    - `_payload/_filevantage.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_filevantage.py`
++ Added: A new service collection, __Cloud Snapshots__ was implemented with three new operations (_GetCredentialsMixin0_, _CreateInventory_, and _RegisterCspmSnapshotAccount_).
+    - `_endpoint/__init__.py`
+    - `_endpoint/_cloud_snapshots.py`
+    - `__init__.py`
+    - `cloud_snapshots.py`
+    > Two new payload handlers were implemented.
+    - `_payload/__init__.py`
+    - `_payload/_cloud_snapshots.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_cloud_snapshot.py`
++ Added: 3 new operations added to the __Identity Protection__ service collection (_GetSensorAggregates_, _GetSensorDetails_, and _QuerySensorsByFilter_).
+    - `_endpoint/_identity_protection.py`
+    - `identity_protection.py`
+    > Unit testing expanded to complete code coverage.
+    - `tests/test_identity_protection.py`
+
+## Issues resolved
++ Fixed: API errors generated by the Uber Class do not stop execution when in pythonic mode.
+    - `api_complete.py`
++ Fixed: Result object failure on JSON formatted list response from _report_executions_download_get_ operation within the __Report Executions__ service collection. Closes #1033.
+    - `_result/result.py`
+
+## Other
++ Deprecated: _deleteCIDGroupMembersV1_ is now deprecated. Calls to _deleteCIDGroupMembers_ are now redirected to _deleteCIDGroupMembersV2_. __MSSP__ service collection.
+    - `_endpoint/_mssp.py`
+    - `mssp.py`
+    > Unit testing expanded to complete code coverage.
+    - `test_mssp.py`
+
+---
+
 # Version 1.3.0
 > Developer Enhancements Release 🎉
 ## Added features and functionality
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
index d002a16df..b1f43fb78 100644
--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@@ -1,6 +1,6 @@
 ![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
 
-[![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)](https://twitter.com/CrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # FalconPy Community Code of Conduct
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 1b161bec1..3060b69d8 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,6 +1,6 @@
 ![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
 
-[![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)](https://twitter.com/CrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # Contributing to this repository <!-- omit in toc -->
 
diff --git a/README.md b/README.md
index f02ead4d5..521baa60b 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 ![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
 
-[![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)](https://twitter.com/CrowdStrike)<br/>
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)<br/>
 
 # FalconPy - The CrowdStrike Falcon SDK for Python
 
diff --git a/SECURITY.md b/SECURITY.md
index 140390430..4f679dfff 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,9 +1,8 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
 
-[![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)](https://twitter.com/CrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 ![GitHub top language](https://img.shields.io/github/languages/top/crowdstrike/falconpy?logo=python&logoColor=white)
-![Snyk Vulnerabilities for GitHub Repo](https://img.shields.io/snyk/vulnerabilities/github/crowdstrike/falconpy?logo=snyk)
 [![Snyk Advisor](https://snyk.io/advisor/python/crowdstrike-falconpy/badge.svg)](https://snyk.io/advisor/python/crowdstrike-falconpy)
 ![GitHub issues](https://img.shields.io/github/issues-raw/crowdstrike/falconpy?logo=github)
 ![GitHub closed issues](https://img.shields.io/github/issues-closed-raw/crowdstrike/falconpy?color=green&logo=github)
@@ -24,6 +23,7 @@ FalconPy functionality is unit tested to run under the following versions of Pyt
 
 | Version | Supported |
 | :------- | :--------: |
+| 3.11.x  | ![Yes](https://img.shields.io/badge/-YES-green) |
 | 3.10.x  | ![Yes](https://img.shields.io/badge/-YES-green) |
 | 3.9.x   | ![Yes](https://img.shields.io/badge/-YES-green) |
 | 3.8.x   | ![Yes](https://img.shields.io/badge/-YES-green) |
diff --git a/SUPPORT.md b/SUPPORT.md
index f1aa50965..486c53752 100644
--- a/SUPPORT.md
+++ b/SUPPORT.md
@@ -1,6 +1,6 @@
 ![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
 
-[![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)](https://twitter.com/CrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # FalconPy Support
 
diff --git a/docs/PACKAGING.md b/docs/PACKAGING.md
index 0dfdc1cd4..dc54128c6 100644
--- a/docs/PACKAGING.md
+++ b/docs/PACKAGING.md
@@ -1,6 +1,6 @@
 ![CrowdStrike FalconPy](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
 
-[![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)](https://twitter.com/CrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # FalconPy package release cycle
 
diff --git a/docs/README.md b/docs/README.md
index c36bb3944..b703ec981 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -1,6 +1,6 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
 
-[![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)](https://twitter.com/CrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # FalconPy Project Documentation
 Where can I find help?
diff --git a/samples/README.md b/samples/README.md
index 19f95f160..55b38087d 100644
--- a/samples/README.md
+++ b/samples/README.md
@@ -1,6 +1,6 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png) 
 
-[![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)](https://twitter.com/CrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # FalconPy Sample Library
 
diff --git a/samples/authentication/README.md b/samples/authentication/README.md
index f93a2fd3c..8f4dbb6f6 100644
--- a/samples/authentication/README.md
+++ b/samples/authentication/README.md
@@ -1,6 +1,6 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
 
-![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # Authentication examples
 The examples in this folder focus on authentication to CrowdStrike's APIs.
diff --git a/samples/custom_ioa/README.md b/samples/custom_ioa/README.md
index 383d591db..a1990c834 100644
--- a/samples/custom_ioa/README.md
+++ b/samples/custom_ioa/README.md
@@ -1,6 +1,6 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
 
-![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # Custom IOA examples
 The examples in this folder focus on leveraging CrowdStrike's Custom IOA API to manage Indicators of Attack within your Falcon Tenant.
diff --git a/samples/detects/README.md b/samples/detects/README.md
index 0ec347b7b..556fe1541 100644
--- a/samples/detects/README.md
+++ b/samples/detects/README.md
@@ -1,6 +1,6 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
 
-![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # Detects examples
 The examples in this folder focus on leveraging CrowdStrike's Detects API to interact with alerts generated by the CrowdStrike Falcon sensor.
diff --git a/samples/falconx_sandbox/README.md b/samples/falconx_sandbox/README.md
index 372d92f1b..5e3e7c99c 100644
--- a/samples/falconx_sandbox/README.md
+++ b/samples/falconx_sandbox/README.md
@@ -1,5 +1,5 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
-![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # Falcon Intelligence Sandbox examples
 The examples within this folder focus on leveraging CrowdStrike's Falcon Intelligence Sandbox and Sample Uploads APIs to analyze potential malware in different environments.
diff --git a/samples/flight_control/README.md b/samples/flight_control/README.md
index 7d2be9d41..b3a9ef0fd 100644
--- a/samples/flight_control/README.md
+++ b/samples/flight_control/README.md
@@ -1,5 +1,5 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
-![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # Falcon Flight Control (MSSP) examples
 The examples within this folder focus on leveraging CrowdStrike's Falcon Flight Control to interact with child hosts.
diff --git a/samples/hosts/README.md b/samples/hosts/README.md
index d0e08b39e..6a6779a89 100644
--- a/samples/hosts/README.md
+++ b/samples/hosts/README.md
@@ -1,6 +1,6 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
 
-![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # Hosts examples
 The examples in this folder focus on leveraging CrowdStrike's Hosts API to perform administrative operations.
diff --git a/samples/identity/README.md b/samples/identity/README.md
index 8f84a5d9d..946ccfb54 100644
--- a/samples/identity/README.md
+++ b/samples/identity/README.md
@@ -1,5 +1,5 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
-![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # Identity Protection examples
 The examples within this folder focus on leveraging CrowdStrike Falcon Identity Protection.
diff --git a/samples/incidents/README.md b/samples/incidents/README.md
index 63687b382..73be2ec4e 100644
--- a/samples/incidents/README.md
+++ b/samples/incidents/README.md
@@ -1,5 +1,5 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
-![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # Incidents examples
 The examples in this folder focus on leveraging CrowdStrike's Incidents API.
diff --git a/samples/intel/README.md b/samples/intel/README.md
index c20fa78cd..ab740eb87 100644
--- a/samples/intel/README.md
+++ b/samples/intel/README.md
@@ -1,5 +1,5 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
-![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # Intel examples
 The examples within this folder focus on leveraging CrowdStrike Falcon Intel service collection.
diff --git a/samples/malquery/README.md b/samples/malquery/README.md
index 4c4fe4024..787d33690 100644
--- a/samples/malquery/README.md
+++ b/samples/malquery/README.md
@@ -1,5 +1,5 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
-![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # MalQuery examples
 The examples in this folder focus on leveraging CrowdStrike's MalQuery API to perform threat hunting operations.
diff --git a/samples/prevention_policy/README.md b/samples/prevention_policy/README.md
index b7d6f6f7f..8fa4d71e9 100644
--- a/samples/prevention_policy/README.md
+++ b/samples/prevention_policy/README.md
@@ -1,5 +1,5 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
-![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # Prevention Policy examples
 The examples in this folder focus on leveraging CrowdStrike's Prevention Policy API.
diff --git a/samples/proxytool/README.md b/samples/proxytool/README.md
index 872b0b433..ae078082b 100644
--- a/samples/proxytool/README.md
+++ b/samples/proxytool/README.md
@@ -1,5 +1,5 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
-![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # ProxyTool v3.5
 This example focuses on leveraging CrowdStrike's Hosts, Host Groups, Sensor Download, and Real-Time Response API.
diff --git a/samples/quick_scan/README.md b/samples/quick_scan/README.md
index 18bfc8c6d..6221eb7a6 100644
--- a/samples/quick_scan/README.md
+++ b/samples/quick_scan/README.md
@@ -1,6 +1,6 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png) 
 
-[![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)](https://twitter.com/CrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # Quick Scan examples
 The examples within this folder focus on leveraging CrowdStrike's Falcon Quick Scan API.
diff --git a/samples/report_executions/README.md b/samples/report_executions/README.md
index 6fca3bc6e..fb0d8f223 100644
--- a/samples/report_executions/README.md
+++ b/samples/report_executions/README.md
@@ -1,5 +1,7 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
 
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
+
 # Falcon Report Executions samples
 The examples within this folder focus on leveraging CrowdStrike's Falcon Report Executions API.
 
diff --git a/samples/rtr/README.md b/samples/rtr/README.md
index 978c9e49c..fb790c45a 100644
--- a/samples/rtr/README.md
+++ b/samples/rtr/README.md
@@ -1,5 +1,5 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
-![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # Real Time Response examples
 The examples within this folder focus on leveraging CrowdStrike's Real Time Response API to respond to security events.
diff --git a/samples/rtr/pid-dump/README.md b/samples/rtr/pid-dump/README.md
index 607196ee5..5f8c25d2a 100644
--- a/samples/rtr/pid-dump/README.md
+++ b/samples/rtr/pid-dump/README.md
@@ -1,5 +1,5 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
-![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # Real Time Response - Dump memory for a running process
 This sample leverages CrowdStrike's Hosts and Real Time Response APIs to dump the memory for a process running in memory.
diff --git a/samples/rtr/pony/README.md b/samples/rtr/pony/README.md
index fdfc7eb0e..70083cad9 100644
--- a/samples/rtr/pony/README.md
+++ b/samples/rtr/pony/README.md
@@ -1,5 +1,5 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
-![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # My Little RTR
 ### Using Real Time Response to retrieve basic system information
diff --git a/samples/sample_uploads/README.md b/samples/sample_uploads/README.md
index 08b531500..a6f17da43 100644
--- a/samples/sample_uploads/README.md
+++ b/samples/sample_uploads/README.md
@@ -1,5 +1,7 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
 
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
+
 # Falcon Sample Uploads samples
 The examples within this folder focus on leveraging CrowdStrike's Falcon Sample Uploads API.
 
diff --git a/samples/sensor_download/README.md b/samples/sensor_download/README.md
index b64caf04e..18846bb74 100644
--- a/samples/sensor_download/README.md
+++ b/samples/sensor_download/README.md
@@ -1,5 +1,5 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
-![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # Sensor Download examples
 The examples within this folder focus on leveraging CrowdStrike's Falcon Sensor Download API to list and retrieve versions of the CrowdStrike agent.
diff --git a/samples/sensor_update_policies/README.md b/samples/sensor_update_policies/README.md
index b527bebe8..e8c24148b 100644
--- a/samples/sensor_update_policies/README.md
+++ b/samples/sensor_update_policies/README.md
@@ -1,5 +1,5 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
-![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # Sensor Update Policies examples
 The examples in this folder focus on leveraging CrowdStrike's Sensor Update Policies API to adjust sensor update policy settings.
diff --git a/samples/spotlight/README.md b/samples/spotlight/README.md
index 862109bbb..4873e69d5 100644
--- a/samples/spotlight/README.md
+++ b/samples/spotlight/README.md
@@ -1,5 +1,5 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
-![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # Falcon Spotlight Vulnerabilities samples
 The examples within this folder focus on leveraging CrowdStrike's Falcon Spotlight Vulnerabilities API.
diff --git a/samples/user_management/README.md b/samples/user_management/README.md
index 767ec6133..82737f6e4 100644
--- a/samples/user_management/README.md
+++ b/samples/user_management/README.md
@@ -1,6 +1,6 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
 
-![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # User Management examples
 The examples in this folder focus on leveraging CrowdStrike's User Management API to perform administrative operations.
diff --git a/src/falconpy/__init__.py b/src/falconpy/__init__.py
index 4f803fc63..4172512c3 100644
--- a/src/falconpy/__init__.py
+++ b/src/falconpy/__init__.py
@@ -60,7 +60,8 @@
     PayloadValidationError,
     NoAuthenticationMechanism,
     InvalidIndex,
-    InvalidCredentialFormat
+    InvalidCredentialFormat,
+    UnnecessaryEncodingUsed
     )
 from ._result import (
     Result,
@@ -85,6 +86,7 @@
     )
 from .alerts import Alerts
 from .api_complete import APIHarness
+from .cloud_snapshots import CloudSnapshots
 from .cloud_connect_aws import CloudConnectAWS
 from .cspm_registration import CSPMRegistration
 from .custom_ioa import CustomIOA
@@ -169,8 +171,9 @@
     "FunctionalityNotImplemented", "BearerToken", "LogFacility", "InvalidBaseURL",
     "InterfaceConfiguration", "RequestBehavior", "RequestConnection", "RequestMeta",
     "RequestPayloads", "RequestValidator", "PayloadValidationError", "MIN_TOKEN_RENEW_WINDOW",
-    "MAX_TOKEN_RENEW_WINDOW", "GLOBAL_API_MAX_RETURN", "MOCK_OPERATIONS",
-    "NoAuthenticationMechanism", "InvalidIndex", "version", "InvalidCredentialFormat"
+    "MAX_TOKEN_RENEW_WINDOW", "GLOBAL_API_MAX_RETURN", "MOCK_OPERATIONS", "CloudSnapshots",
+    "NoAuthenticationMechanism", "InvalidIndex", "version", "InvalidCredentialFormat",
+    "UnnecessaryEncodingUsed"
     ]
 """
 This is free and unencumbered software released into the public domain.
diff --git a/src/falconpy/_endpoint/__init__.py b/src/falconpy/_endpoint/__init__.py
index 490435ac4..46d2c7619 100644
--- a/src/falconpy/_endpoint/__init__.py
+++ b/src/falconpy/_endpoint/__init__.py
@@ -39,6 +39,7 @@
 
 from ._alerts import _alerts_endpoints
 from ._cloud_connect_aws import _cloud_connect_aws_endpoints
+from ._cloud_snapshots import _cloud_snapshot_endpoints
 from ._cspm_registration import _cspm_registration_endpoints
 from ._custom_ioa import _custom_ioa_endpoints
 from ._d4c_registration import _d4c_registration_endpoints
@@ -92,6 +93,7 @@
 api_endpoints: List[Any] = []
 api_endpoints.extend(_alerts_endpoints)
 api_endpoints.extend(_cloud_connect_aws_endpoints)
+api_endpoints.extend(_cloud_snapshot_endpoints)
 api_endpoints.extend(_cspm_registration_endpoints)
 api_endpoints.extend(_custom_ioa_endpoints)
 api_endpoints.extend(_d4c_registration_endpoints)
diff --git a/src/falconpy/_endpoint/_cloud_snapshots.py b/src/falconpy/_endpoint/_cloud_snapshots.py
new file mode 100644
index 000000000..351de7352
--- /dev/null
+++ b/src/falconpy/_endpoint/_cloud_snapshots.py
@@ -0,0 +1,76 @@
+"""Internal API endpoint constant library.
+
+ _______                        __ _______ __        __ __
+|   _   .----.-----.--.--.--.--|  |   _   |  |_.----|__|  |--.-----.
+|.  1___|   _|  _  |  |  |  |  _  |   1___|   _|   _|  |    <|  -__|
+|.  |___|__| |_____|________|_____|____   |____|__| |__|__|__|_____|
+|:  1   |                         |:  1   |
+|::.. . |   CROWDSTRIKE FALCON    |::.. . |    FalconPy
+`-------'                         `-------'
+
+OAuth2 API - Customer SDK
+
+This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
+
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <https://unlicense.org>
+"""
+
+_cloud_snapshot_endpoints = [
+  [
+    "CreateInventory",
+    "POST",
+    "/snapshots/entities/inventories/v1",
+    "Create inventory from data received from snapshot",
+    "inventories",
+    [
+      {
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "GetCredentialsMixin0",
+    "GET",
+    "/snapshots/entities/image-registry-credentials/v1",
+    "Gets the registry credentials",
+    "provision",
+    []
+  ],
+  [
+    "RegisterCspmSnapshotAccount",
+    "POST",
+    "/snapshots/entities/accounts/v1",
+    "Register customer cloud account for snapshot scanning",
+    "registration",
+    [
+      {
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ]
+]
diff --git a/src/falconpy/_endpoint/_falcon_complete_dashboard.py b/src/falconpy/_endpoint/_falcon_complete_dashboard.py
index 6a1fa9fb5..c9f34e513 100644
--- a/src/falconpy/_endpoint/_falcon_complete_dashboard.py
+++ b/src/falconpy/_endpoint/_falcon_complete_dashboard.py
@@ -37,6 +37,20 @@
 """
 
 _falcon_complete_dashboard_endpoints = [
+  [
+    "AggregateAlerts",
+    "POST",
+    "/falcon-complete-dashboards/aggregates/alerts/GET/v1",
+    "Retrieve aggregate alerts values based on the matched filter",
+    "falcon_complete_dashboard",
+    [
+      {
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ],
   [
     "AggregateAllowList",
     "POST",
@@ -135,6 +149,42 @@
       }
     ]
   ],
+  [
+    "QueryAlertIdsByFilter",
+    "GET",
+    "/falcon-complete-dashboards/queries/alerts/v1",
+    "Retrieve Alerts Ids that match the provided FQL filter criteria with scrolling enabled",
+    "falcon_complete_dashboard",
+    [
+      {
+        "type": "integer",
+        "description": "The maximum records to return. [1-500]",
+        "name": "limit",
+        "in": "query"
+      },
+      {
+        "type": "string",
+        "description": "The property to sort on, followed by a dot (.), "
+        "followed by the sort direction, either \"asc\" or \"desc\".",
+        "name": "sort",
+        "in": "query"
+      },
+      {
+        "type": "string",
+        "description": "Optional filter and sort criteria in the form of an FQL query. "
+        "For more information about FQL queries, see "
+        "[our FQL documentation](https://falconpy.io/Usage/Falcon-Query-Language).",
+        "name": "filter",
+        "in": "query"
+      },
+      {
+        "type": "string",
+        "description": "Starting index of overall result set from which to return ids.",
+        "name": "offset",
+        "in": "query"
+      }
+    ]
+  ],
   [
     "QueryAllowListFilter",
     "GET",
diff --git a/src/falconpy/_endpoint/_falcon_container.py b/src/falconpy/_endpoint/_falcon_container.py
index 0a6a324c8..3d5be3cd4 100644
--- a/src/falconpy/_endpoint/_falcon_container.py
+++ b/src/falconpy/_endpoint/_falcon_container.py
@@ -45,6 +45,41 @@
     "falcon_container",
     []
   ],
+  [
+    "GetCombinedImages",
+    "GET",
+    "/container-security/combined/image-assessment/images/v1",
+    "Get image assessment results by providing an FQL filter and paging details",
+    "falcon_container_image",
+    [
+      {
+        "type": "string",
+        "description": "Filter images using a query in Falcon Query Language (FQL). Supported filters:  "
+        "container_running_status, cve_id, first_seen, registry, repository, tag, vulnerability_severity",
+        "name": "filter",
+        "in": "query"
+      },
+      {
+        "type": "integer",
+        "description": "The upper-bound on the number of records to retrieve [1-100]",
+        "name": "limit",
+        "in": "query"
+      },
+      {
+        "type": "integer",
+        "description": "The offset from where to begin.",
+        "name": "offset",
+        "in": "query"
+      },
+      {
+        "type": "string",
+        "description": "The fields to sort the records on. Supported columns:  "
+        "[first_seen registry repository tag vulnerability_severity]",
+        "name": "sort",
+        "in": "query"
+      }
+    ]
+  ],
   [
     "ReadImageVulnerabilities",
     "POST",
diff --git a/src/falconpy/_endpoint/_filevantage.py b/src/falconpy/_endpoint/_filevantage.py
index 86161f7e9..0743ce570 100644
--- a/src/falconpy/_endpoint/_filevantage.py
+++ b/src/falconpy/_endpoint/_filevantage.py
@@ -45,12 +45,542 @@
     "filevantage",
     [
       {
+        "maxItems": 500,
+        "minItems": 1,
         "type": "array",
         "items": {
           "type": "string"
         },
         "collectionFormat": "multi",
-        "description": "Comma separated values of change ids",
+        "description": "One or more change ids in the form of `ids=ID1&ids=ID2`. "
+        "The maximum number of ids that can be requested at once is `500`.",
+        "name": "ids",
+        "in": "query",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "updatePolicyHostGroups",
+    "PATCH",
+    "/filevantage/entities/policies-host-groups/v1",
+    "Manage host groups assigned to a policy.",
+    "filevantage",
+    [
+      {
+        "type": "string",
+        "description": "The id of the policy for which to perform the action.",
+        "name": "policy_id",
+        "in": "query",
+        "required": True
+      },
+      {
+        "type": "string",
+        "description": "The action to perform with the provided ids, must be one of: `assign` or `unassign`.",
+        "name": "action",
+        "in": "query",
+        "required": True
+      },
+      {
+        "type": "array",
+        "items": {
+          "type": "string"
+        },
+        "collectionFormat": "multi",
+        "description": "One or more host group ids in the form of `ids=ID1&ids=ID2`",
+        "name": "ids",
+        "in": "query",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "updatePolicyPrecedence",
+    "PATCH",
+    "/filevantage/entities/policies-precedence/v1",
+    "Updates the policy precedence for all policies of a specific type.",
+    "filevantage",
+    [
+      {
+        "type": "array",
+        "items": {
+          "type": "string"
+        },
+        "collectionFormat": "multi",
+        "description": "Precedence of the policies for the provided type in the form of `ids=ID1&ids=ID2`",
+        "name": "ids",
+        "in": "query",
+        "required": True
+      },
+      {
+        "type": "string",
+        "description": "The policy type for which to set the precedence order, must be one of `Windows`, `Linux` or `Mac`.",
+        "name": "type",
+        "in": "query",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "updatePolicyRuleGroups",
+    "PATCH",
+    "/filevantage/entities/policies-rule-groups/v1",
+    "Manage the rule groups assigned to the policy or set the rule group precedence for all rule groups within the policy.",
+    "filevantage",
+    [
+      {
+        "type": "string",
+        "description": "The id of the policy for which to perform the action.",
+        "name": "policy_id",
+        "in": "query",
+        "required": True
+      },
+      {
+        "type": "string",
+        "description": "The action to perform with the provided ids, must be one of: `assign`, `unassign`, or `precedence`.",
+        "name": "action",
+        "in": "query",
+        "required": True
+      },
+      {
+        "type": "array",
+        "items": {
+          "type": "string"
+        },
+        "collectionFormat": "multi",
+        "description": "One or more rule group ids in the form of ids=ID1&ids=ID2. Note, for the precedence action, "
+        "precedence is controlled by the order of the ids as they are specified in the request.",
+        "name": "ids",
+        "in": "query",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "getPolicies",
+    "GET",
+    "/filevantage/entities/policies/v1",
+    "Retrieves the configuration for 1 or more policies.",
+    "filevantage",
+    [
+      {
+        "type": "array",
+        "items": {
+          "type": "string"
+        },
+        "collectionFormat": "multi",
+        "description": "One or more (up to 500) policy ids in the form of `ids=ID1&ids=ID2`",
+        "name": "ids",
+        "in": "query",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "createPolicies",
+    "POST",
+    "/filevantage/entities/policies/v1",
+    "Creates a new policy of the specified type. New policies are always added at the end of the precedence "
+    "list for the provided policy type.",
+    "filevantage",
+    [
+      {
+        "description": "Create a new policy.\n\n * `name` must be between 1 and 100 characters.\n\n * `description` "
+        "can be between 0 and 500 characters.\n\n * `platform` must be one of `Windows`, `Linux`, or `Mac`\n\n "
+        "Rule and host group assignment and policy precedence setting is performed via their respective patch end-points.",
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "updatePolicies",
+    "PATCH",
+    "/filevantage/entities/policies/v1",
+    "Updates the general information of the provided policy.",
+    "filevantage",
+    [
+      {
+        "description": "Enables updates to the following fields for an existing policy. \n\n * `id` of the policy "
+        "to update.\n\n * `name` must be between 1 and 100 characters.\n\n * `description` can be between 0 and 500 "
+        "characters.\n\n * `platform` may not be modified after the policy is created.\n\n * `enabled` must be one "
+        "of `true` or `false`.\n\n Rule and host group assignment and policy precedence setting is performed via "
+        "their respective patch end-points.",
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "deletePolicies",
+    "DELETE",
+    "/filevantage/entities/policies/v1",
+    "Deletes 1 or more policies.",
+    "filevantage",
+    [
+      {
+        "type": "array",
+        "items": {
+          "type": "string"
+        },
+        "collectionFormat": "multi",
+        "description": "One or more (up to 500) policy ids in the form of `ids=ID1&ids=ID2`",
+        "name": "ids",
+        "in": "query",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "getScheduledExclusions",
+    "GET",
+    "/filevantage/entities/policy-scheduled-exclusions/v1",
+    "Retrieves the configuration of 1 or more scheduled exclusions from the provided policy id.",
+    "filevantage",
+    [
+      {
+        "type": "string",
+        "description": "The id of the policy to retrieve the scheduled exclusion configurations.",
+        "name": "policy_id",
+        "in": "query",
+        "required": True
+      },
+      {
+        "type": "array",
+        "items": {
+          "type": "string"
+        },
+        "collectionFormat": "multi",
+        "description": "One or more (up to 500) scheduled exclusion ids in the form of `ids=ID1&ids=ID2`.",
+        "name": "ids",
+        "in": "query",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "createScheduledExclusions",
+    "POST",
+    "/filevantage/entities/policy-scheduled-exclusions/v1",
+    "Creates a new scheduled exclusion configuration for the provided policy id.",
+    "filevantage",
+    [
+      {
+        "description": "Create a new scheduled exclusion configuration for the specified policy.\n\n \n\n * `policy_id` "
+        "to add the scheduled exclusion to.\n\n * `name` must be between 1 and 100 characters.\n\n * `description` "
+        "can be between 0 and 500 characters.\n\n * `users` can be between 0 and 500 characters representing a comma "
+        "separated list of user to exclude their changes.\n\n    *  admin* excludes changes made by all usernames that "
+        "begin with admin. Falon GLOB syntax is supported.\n\n * `processes` can be between 0 and 500 characters "
+        "representing a comma separated list of processes to exclude their changes.\n\n    * **\\RunMe.exe or **/RunMe.sh "
+        "excludes changes made by RunMe.exe or RunMe.sh in any location.\n\n * `schedule_start` must be provided to "
+        "indicate the start of the schedule. This date/time must be an rfc3339 formatted string "
+        "https://datatracker.ietf.org/doc/html/rfc3339.\n\n * `schedule_end` optionally provided to indicate "
+        "the end of the schedule. This date/time must be an rfc3339 formatted string "
+        "https://datatracker.ietf.org/doc/html/rfc3339.",
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "updateScheduledExclusions",
+    "PATCH",
+    "/filevantage/entities/policy-scheduled-exclusions/v1",
+    "Updates the provided scheduled exclusion configuration within the provided policy.",
+    "filevantage",
+    [
+      {
+        "description": "Update an existing scheduled exclusion for the specified policy.\n\n \n\n * `id` "
+        "representing the scheduled exclusion to update.\n\n * `policy_id` which the scheduled exclusion "
+        "is assigned.\n\n * `name` must be between 1 and 100 characters.\n\n * `description` can be between "
+        "0 and 500 characters.\n\n * `users` can be between 0 and 500 characters representing a comma "
+        "separated list of user to exclude their changes.\n\n    *  admin* excludes changes made by all "
+        "usernames that begin with admin. Falon GLOB syntax is supported.\n\n * `processes` can be between "
+        "0 and 500 characters representing a comma separated list of processes to exclude their changes.\n\n"
+        "    * **\\RunMe.exe or **/RunMe.sh excludes changes made by RunMe.exe or RunMe.sh in any location."
+        "\n\n * `schedule_start` must be provided to indicate the start of the schedule. This date/time must "
+        "be an rfc3339 formatted string  https://datatracker.ietf.org/doc/html/rfc3339.\n\n * `schedule_end` "
+        "optionally provided to indicate the end of the schedule. This date/time must be an rfc3339 formatted "
+        "string  https://datatracker.ietf.org/doc/html/rfc3339.",
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "deleteScheduledExclusions",
+    "DELETE",
+    "/filevantage/entities/policy-scheduled-exclusions/v1",
+    "Deletes 1 or more scheduled exclusions from the provided policy id.",
+    "filevantage",
+    [
+      {
+        "type": "string",
+        "description": "ID of the policy to delete the scheduled exclusions from.",
+        "name": "policy_id",
+        "in": "query",
+        "required": True
+      },
+      {
+        "type": "array",
+        "items": {
+          "type": "string"
+        },
+        "collectionFormat": "multi",
+        "description": "One or more (up to 500) scheduled exclusion ids in the form of `ids=ID1&ids=ID2`.",
+        "name": "ids",
+        "in": "query",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "updateRuleGroupPrecedence",
+    "PATCH",
+    "/filevantage/entities/rule-groups-rule-precedence/v1",
+    "Updates the rule precedence for all rules in the identified rule group.",
+    "filevantage",
+    [
+      {
+        "type": "string",
+        "description": "Rule group from which to set the precedence.",
+        "name": "rule_group_id",
+        "in": "query",
+        "required": True
+      },
+      {
+        "type": "array",
+        "items": {
+          "type": "string"
+        },
+        "collectionFormat": "multi",
+        "description": "One or more (up to 500) rule group ids in the form of `ids=ID1&ids=ID2`.",
+        "name": "ids",
+        "in": "query",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "getRules",
+    "GET",
+    "/filevantage/entities/rule-groups-rules/v1",
+    "Retrieves the configuration for 1 or more rules.",
+    "filevantage",
+    [
+      {
+        "type": "string",
+        "description": "Rule group from which to retrieve the rule configuration.",
+        "name": "rule_group_id",
+        "in": "query",
+        "required": True
+      },
+      {
+        "type": "array",
+        "items": {
+          "type": "string"
+        },
+        "collectionFormat": "multi",
+        "description": "One or more (up to 500) rule ids in the form of `ids=ID1&ids=ID2`.",
+        "name": "ids",
+        "in": "query",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "createRules",
+    "POST",
+    "/filevantage/entities/rule-groups-rules/v1",
+    "Creates a new rule configuration within the specified rule group.",
+    "filevantage",
+    [
+      {
+        "description": "Create a new rule configuration for the specified rule group.\n\n * `id` is not "
+        "supported for creation of a rule, the new id of the created rule will be included in the response."
+        "\n\n * `rule_group_id` to add the new rule configuration.\n\n * `description` can be between 0 and "
+        "500 characters.\n\n * `path` representing the file system or registry path to monitor.\n\n   * must "
+        "be between 1 and 250 characters. \n\n   * All paths must end with the path separator, e.g. "
+        "c:\\windows\\ /usr/bin/ \n\n * `severity` to categorize change events produced by this rule; "
+        "must be one of: `Low`, `Medium`, `High` or `Critical`\n\n * `depth` below the base path to monitor; "
+        "must be one of: `1`, `2`, `3`, `4`, `5` or `ANY`\n\n * `precedence` - is not supported for creation "
+        "of a rule, new rules will be added last in precedence order.will result this rule being placed before "
+        "that existing rule.\n\nFalcon GLOB syntax is supported for the following 6 properties. Allowed rule "
+        "group configuration is based on the type of rule group the rule group is added to.\n\n * `include` "
+        "represents the files, directories, registry keys, or registry values that will be monitored. \n\n "
+        "* `exclude` represents the files, directories, registry keys, or registry values that will `NOT` "
+        "be monitored. \n\n * `include_users` represents the changes performed by specific users that will "
+        "be monitored (`macOS` is not supported at this time).\n\n * `exclude_users` represents the changes "
+        "performed by specific users that will `NOT` be monitored (`macOS` is not supported at this time)."
+        "\n\n * `include_processes` represents the changes performed by specific processes that will be monitored "
+        "(`macOS` is not supported at this time).\n\n * `exclude_users` represents the changes performed by "
+        "specific processes that will be `NOT` monitored (`macOS` is not supported at this time).\n\nFile "
+        "system directory monitoring:\n\n * `watch_delete_directory_changes`\n\n * "
+        "`watch_create_directory_changes`\n\n * `watch_rename_directory_changes`\n\n * "
+        "`watch_attributes_directory_changes` (`macOS` is not supported at this time)\n\n * "
+        "`watch_permissions_directory_changes` (`macOS` is not supported at this time)\n\n"
+        "File system file monitoring:\n\n * `watch_rename_file_changes`\n\n * "
+        "`watch_write_file_changes`\n\n * `watch_create_file_changes`\n\n * "
+        "`watch_delete_file_changes`\n\n * `watch_attributes_file_changes` "
+        "(`macOS` is not supported at this time)\n\n * `watch_permissions_file_changes` "
+        "(`macOS` is not supported at this time)\n\nWindows registry key and value monitoring: "
+        "\n\n * `watch_create_key_changes`\n\n * `watch_delete_key_changes`\n\n * "
+        "`watch_rename_key_changes`\n\n * `watch_set_value_changes`\n\n * "
+        "`watch_delete_value_changes`\n\n * `watch_create_file_changes`",
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "updateRules",
+    "PATCH",
+    "/filevantage/entities/rule-groups-rules/v1",
+    "Updates the provided rule configuration within the specified rule group.",
+    "filevantage",
+    [
+      {
+        "description": "Update the rule configuration for the specified rule ID and group."
+        "\n\n * `id` of the rule to update.\n\n * `rule_group_id` that contains the rule "
+        "configuration.\n\n * `description` can be between 0 and 500 characters.\n\n * "
+        "`path` representing the file system or registry path to monitor.\n\n   * must be "
+        "between 1 and 250 characters. \n\n   * All paths must end with the path separator, "
+        "e.g. c:\\windows\\ /usr/bin/ \n\n * `severity` to categorize change events produced "
+        "by this rule; must be one of: `Low`, `Medium`, `High` or `Critical`\n\n * `depth` "
+        "below the base path to monitor; must be one of: `1`, `2`, `3`, `4`, `5` or `ANY`"
+        "\n\n * `precedence` is the order in which rules will be evaluated starting with 1. "
+        "Specifying a precedence value that is already set for another rule in the group will "
+        "result this rule being placed before that existing rule.\n\nFalcon GLOB syntax is "
+        "supported for the following 6 properties. Allowed rule group configuration is based "
+        "on the type of rule group the rule group is added to.\n\n * `include` represents the "
+        "files, directories, registry keys, or registry values that will be monitored. \n\n "
+        "* `exclude` represents the files, directories, registry keys, or registry values "
+        "that will `NOT` be monitored. \n\n * `include_users` represents the changes performed "
+        "by specific users that will be monitored (`macOS` is not supported at this time).\n\n "
+        "* `exclude_users` represents the changes performed by specific users that will `NOT` "
+        "be monitored (`macOS` is not supported at this time).\n\n * `include_processes` "
+        "represents the changes performed by specific processes that will be monitored "
+        "(`macOS` is not supported at this time).\n\n * `exclude_users` represents the changes "
+        "performed by specific processes that will be `NOT` monitored (`macOS` is not supported "
+        "at this time).\n\nFile system directory monitoring:\n\n * `watch_delete_directory_changes`"
+        "\n\n * `watch_create_directory_changes`\n\n * `watch_rename_directory_changes`\n\n * "
+        "`watch_attributes_directory_changes` (`macOS` is not supported at this time)\n\n * "
+        "`watch_permissions_directory_changes` (`macOS` is not supported at this time)\n\n"
+        "File system file monitoring:\n\n * `watch_rename_file_changes`\n\n * `watch_write_file_changes`"
+        "\n\n * `watch_create_file_changes`\n\n * `watch_delete_file_changes`\n\n * "
+        "`watch_attributes_file_changes` (`macOS` is not supported at this time)\n\n * "
+        "`watch_permissions_file_changes` (`macOS` is not supported at this time)\n\n"
+        "Windows registry key and value monitoring: \n\n * `watch_create_key_changes`\n\n * "
+        "`watch_delete_key_changes`\n\n * `watch_rename_key_changes`\n\n * "
+        "`watch_set_value_changes`\n\n * `watch_delete_value_changes`\n\n * `watch_create_file_changes`",
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "deleteRules",
+    "DELETE",
+    "/filevantage/entities/rule-groups-rules/v1",
+    "Deletes 1 or more rules from the specified rule group.",
+    "filevantage",
+    [
+      {
+        "type": "string",
+        "description": "The id of the rule group from which the rules will be deleted.",
+        "name": "rule_group_id",
+        "in": "query",
+        "required": True
+      },
+      {
+        "type": "array",
+        "items": {
+          "type": "string"
+        },
+        "collectionFormat": "multi",
+        "description": "One or more (up to 500) rule ids in the form of `ids=ID1&ids=ID2`",
+        "name": "ids",
+        "in": "query",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "getRuleGroups",
+    "GET",
+    "/filevantage/entities/rule-groups/v1",
+    "Retrieves the rule group details for 1 or more rule groups.",
+    "filevantage",
+    [
+      {
+        "type": "array",
+        "items": {
+          "type": "string"
+        },
+        "collectionFormat": "multi",
+        "description": "One or more (up to 500) rule group ids in the form of `ids=ID1&ids=ID2`",
+        "name": "ids",
+        "in": "query",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "createRuleGroups",
+    "POST",
+    "/filevantage/entities/rule-groups/v1",
+    "Creates a new rule group of the specified type.",
+    "filevantage",
+    [
+      {
+        "description": "Create a new rule group of a specific type.\n\n * `name` must be between 1 and "
+        "100 characters.\n\n * `type` must be one of `WindowsFiles`, `WindowsRegistry`, `LinuxFiles` or "
+        "`MacFiles`.\n\n * `description` can be between 0 and 500 characters.\n\n Note: rules are "
+        "added/removed from rule groups using their dedicated end-points.",
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "updateRuleGroups",
+    "PATCH",
+    "/filevantage/entities/rule-groups/v1",
+    "Updates the provided rule group.",
+    "filevantage",
+    [
+      {
+        "description": "Enables updates to the following fields for an existing rule group. \n\n * `id` "
+        "of the rule group to update.\n\n * `name` must be between 1 and 100 characters.\n\n * "
+        "`description` can be between 0 and 500 characters.\n\n * `type` may not be modified after "
+        "the rule group is created.\n\n Note: rules are added/removed from rule groups using their dedicated end-points.",
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "deleteRuleGroups",
+    "DELETE",
+    "/filevantage/entities/rule-groups/v1",
+    "Deletes 1 or more rule groups ",
+    "filevantage",
+    [
+      {
+        "type": "array",
+        "items": {
+          "type": "string"
+        },
+        "collectionFormat": "multi",
+        "description": "One or more (up to 500) rule group ids in the form of `ids=ID1&ids=ID2`",
         "name": "ids",
         "in": "query",
         "required": True
@@ -74,6 +604,7 @@
         "in": "query"
       },
       {
+        "maximum": 500,
         "type": "integer",
         "description": "The maximum number of changes to return in the response "
         "(default: 100; max: 500). "
@@ -100,5 +631,143 @@
         "in": "query"
       }
     ]
+  ],
+  [
+    "highVolumeQueryChanges",
+    "GET",
+    "/filevantage/queries/changes/v3",
+    "Returns 1 or more change ids",
+    "filevantage",
+    [
+      {
+        "type": "string",
+        "description": "A pagination token used with the `limit` parameter to manage pagination of results. "
+        "On your first request don't provide a value for the `after` token. On subsequent requests provide "
+        "the `after` token value from the previous response to continue pagination from where you left. "
+        "If the response returns an empty `after` token it means there are no more results to return.",
+        "name": "after",
+        "in": "query"
+      },
+      {
+        "maximum": 5000,
+        "type": "integer",
+        "default": 100,
+        "description": "The maximum number of ids to return. Defaults to `100` if not specified. "
+        "The maximum number of results that can be returned in a single call is `5000`.",
+        "name": "limit",
+        "in": "query"
+      },
+      {
+        "type": "string",
+        "default": "action_timestamp|desc",
+        "description": "Sort results using options like:\n\n- `action_timestamp` (timestamp of the change "
+        "occurrence) \n\nSort either `asc` (ascending) or `desc` (descending). For example: "
+        "`action_timestamp|asc`. Defaults to `action_timestamp|desc` no value is specified.\nThe full list "
+        "of allowed sorting options can be reviewed in our API documentation.",
+        "name": "sort",
+        "in": "query"
+      },
+      {
+        "type": "string",
+        "description": "Filter changes using a query in Falcon Query Language (FQL). \n\nCommon filter "
+        "options include:\n\n - `host.name`\n - `action_timestamp`\n\n The full list of allowed filter "
+        "parameters can be reviewed in our API documentation.",
+        "name": "filter",
+        "in": "query"
+      }
+    ]
+  ],
+  [
+    "queryPolicies",
+    "GET",
+    "/filevantage/queries/policies/v1",
+    "Retrieve the ids of all policies that are assigned the provided policy type.",
+    "filevantage",
+    [
+      {
+        "minimum": 0,
+        "type": "integer",
+        "description": "The offset to start retrieving records from. Defaults to 0 if not specified.",
+        "name": "offset",
+        "in": "query"
+      },
+      {
+        "type": "integer",
+        "description": "The maximum number of ids to return. Defaults to 100 if not specified. "
+        "The maximum number of results that can be returned in a single call is 500.",
+        "name": "limit",
+        "in": "query"
+      },
+      {
+        "type": "string",
+        "description": "Sort the returned ids based on one of the following properties:\n\n`precedence`, "
+        "`created_timestamp` or `modified_timestamp`\n\n Sort either `asc` (ascending) or `desc` "
+        "(descending);  for example: `precedence|asc`.",
+        "name": "sort",
+        "in": "query"
+      },
+      {
+        "type": "string",
+        "description": "The types of policies to retrieve.\n\n Allowed values are: `Windows`, `Linux` or `Mac`.",
+        "name": "type",
+        "in": "query",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "queryScheduledExclusions",
+    "GET",
+    "/filevantage/queries/policy-scheduled-exclusions/v1",
+    "Retrieve the ids of all scheduled exclusions contained within the provided policy id.",
+    "filevantage",
+    [
+      {
+        "type": "string",
+        "description": "The id of the policy from which to retrieve the scheduled exclusion ids.",
+        "name": "policy_id",
+        "in": "query",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "queryRuleGroups",
+    "GET",
+    "/filevantage/queries/rule-groups/v1",
+    "Retrieve the ids of all rule groups that are of the provided rule group type.",
+    "filevantage",
+    [
+      {
+        "minimum": 0,
+        "type": "integer",
+        "description": "The offset to start retrieving records from. Defaults to 0 if not specified.",
+        "name": "offset",
+        "in": "query"
+      },
+      {
+        "type": "integer",
+        "description": "The maximum number of ids to return. Defaults to 100 if not specified. "
+        "The maximum number of results that can be returned in a single call is 500.",
+        "name": "limit",
+        "in": "query"
+      },
+      {
+        "type": "string",
+        "description": "Sort the returned ids based on one of the following properties:\n\n `created_timestamp` "
+        "or `modified_timestamp`\n\n Sort either `asc` (ascending) or `desc` (descending);  "
+        "for example: `created_timestamp|asc`.",
+        "name": "sort",
+        "in": "query"
+      },
+      {
+        "type": "string",
+        "description": "The rule group type to retrieve the ids of.\n\n Allowed values are: "
+        "`WindowsFiles`, `WindowsRegistry`, `LinuxFiles` or `MacFiles`.",
+        "name": "type",
+        "in": "query",
+        "required": True
+      }
+    ]
   ]
 ]
diff --git a/src/falconpy/_endpoint/_firewall_policies.py b/src/falconpy/_endpoint/_firewall_policies.py
index 82dcce12a..aaceec986 100644
--- a/src/falconpy/_endpoint/_firewall_policies.py
+++ b/src/falconpy/_endpoint/_firewall_policies.py
@@ -145,9 +145,11 @@
       {
         "enum": [
           "add-host-group",
+          "add-rule-group",
           "disable",
           "enable",
-          "remove-host-group"
+          "remove-host-group",
+          "remove-rule-group"
         ],
         "type": "string",
         "description": "The action to perform",
diff --git a/src/falconpy/_endpoint/_identity_protection.py b/src/falconpy/_endpoint/_identity_protection.py
index bdbd95349..cf433aa4a 100644
--- a/src/falconpy/_endpoint/_identity_protection.py
+++ b/src/falconpy/_endpoint/_identity_protection.py
@@ -54,5 +54,66 @@
         "required": True
       }
     ]
+  ],
+  [
+    "GetSensorAggregates",
+    "POST",
+    "/identity-protection/aggregates/devices/GET/v1",
+    "Get sensor aggregates as specified via json in request body.",
+    "identity_entities",
+    [
+      {
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "GetSensorDetails",
+    "POST",
+    "/identity-protection/entities/devices/GET/v1",
+    "Get details on one or more sensors by providing device IDs in a POST body. Supports up to a maximum of 5000 IDs.",
+    "identity_entities",
+    [
+      {
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "QuerySensorsByFilter",
+    "GET",
+    "/identity-protection/queries/devices/v1",
+    "Search for sensors in your environment by hostname, IP, and other criteria.",
+    "identity_entities",
+    [
+      {
+        "type": "integer",
+        "description": "The offset to start retrieving records from",
+        "name": "offset",
+        "in": "query"
+      },
+      {
+        "type": "integer",
+        "description": "The maximum records to return. [1-200]",
+        "name": "limit",
+        "in": "query"
+      },
+      {
+        "type": "string",
+        "description": "The property to sort by (e.g. status.desc or hostname.asc)",
+        "name": "sort",
+        "in": "query"
+      },
+      {
+        "type": "string",
+        "description": "The filter expression that should be used to limit the results",
+        "name": "filter",
+        "in": "query"
+      }
+    ]
   ]
 ]
diff --git a/src/falconpy/_endpoint/_incidents.py b/src/falconpy/_endpoint/_incidents.py
index b86063aa0..c6a3a69e3 100644
--- a/src/falconpy/_endpoint/_incidents.py
+++ b/src/falconpy/_endpoint/_incidents.py
@@ -173,6 +173,8 @@
       },
       {
         "enum": [
+          "alert_ids.asc",
+          "alert_ids.desc",
           "cmdline.asc",
           "cmdline.desc",
           "detection_ids.asc",
diff --git a/src/falconpy/_endpoint/_intel.py b/src/falconpy/_endpoint/_intel.py
index bb9435d97..8aeb0ece3 100644
--- a/src/falconpy/_endpoint/_intel.py
+++ b/src/falconpy/_endpoint/_intel.py
@@ -301,8 +301,14 @@
         "type": "string",
         "description": "The ID of the report you want to download as a PDF.",
         "name": "id",
-        "in": "query",
-        "required": True
+        "in": "query"
+      },
+      {
+        "type": "string",
+        "description": "The ID of the report you want to download as a PDF. "
+        "This parameter is used only if no id parameter given.",
+        "name": "ids",
+        "in": "query"
       }
     ]
   ],
@@ -379,6 +385,19 @@
         "name": "Accept",
         "in": "header"
       },
+      {
+        "type": "string",
+        "description": "Download the latest rule set only if it doesn't have an ETag matching the given ones.",
+        "name": "If-None-Match",
+        "in": "header"
+      },
+      {
+        "type": "string",
+        "description": "Download the latest rule set only if the rule was modified after this date. "
+        "http, ANSIC and RFC850 formats accepted",
+        "name": "If-Modified-Since",
+        "in": "header"
+      },
       {
         "type": "string",
         "description": "The rule news report type. Accepted values:\n\nsnort-suricata-master\n\n"
@@ -538,10 +557,21 @@
     [
       {
         "type": "string",
-        "description": "The actor ID(derived from the actor's name) for which to retrieve a list of attacks.",
+        "description": "The actor ID(derived from the actor's name) for which to retrieve a list of attacks, "
+        "for example: fancy-bear. Only one value is allowed",
         "name": "id",
-        "in": "query",
-        "required": True
+        "in": "query"
+      },
+      {
+        "type": "array",
+        "items": {
+          "type": "string"
+        },
+        "collectionFormat": "multi",
+        "description": "The actor ID(derived from the actor's name) for which to retrieve a list of attacks, "
+        "for example: fancy-bear. Multiple values are allowed",
+        "name": "ids",
+        "in": "query"
       }
     ]
   ],
diff --git a/src/falconpy/_endpoint/_mssp.py b/src/falconpy/_endpoint/_mssp.py
index 93dc27c42..7e955e82c 100644
--- a/src/falconpy/_endpoint/_mssp.py
+++ b/src/falconpy/_endpoint/_mssp.py
@@ -107,10 +107,10 @@
     ]
   ],
   [
-    "deleteCIDGroupMembers",
+    "deleteCIDGroupMembersV1",
     "DELETE",
     "/mssp/entities/cid-group-members/v1",
-    "Delete CID group members.",
+    "Deprecated: Please use deleteCIDGroupMembersV2.",
     "mssp",
     [
       {
@@ -161,6 +161,36 @@
       }
     ]
   ],
+  [
+    "deleteCIDGroupMembers",
+    "DELETE",
+    "/mssp/entities/cid-group-members/v2",
+    "Delete CID group members. Prevents removal of a cid group a cid group if it is only part of one cid group.",
+    "mssp",
+    [
+      {
+        "description": "Both 'cid_group_id' and 'cids' fields are required.",
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ],
+  [
+    "deleteCIDGroupMembersV2",
+    "DELETE",
+    "/mssp/entities/cid-group-members/v2",
+    "Delete CID group members. Prevents removal of a cid group a cid group if it is only part of one cid group.",
+    "mssp",
+    [
+      {
+        "description": "Both 'cid_group_id' and 'cids' fields are required.",
+        "name": "body",
+        "in": "body",
+        "required": True
+      }
+    ]
+  ],
   [
     "getCIDGroupByIdV1",
     "GET",
diff --git a/src/falconpy/_error/__init__.py b/src/falconpy/_error/__init__.py
index 2db166ca6..bcbf1fc8e 100644
--- a/src/falconpy/_error/__init__.py
+++ b/src/falconpy/_error/__init__.py
@@ -56,7 +56,8 @@
     SDKWarning,
     SSLDisabledWarning,
     NoContentWarning,
-    NoAuthenticationMechanism
+    NoAuthenticationMechanism,
+    UnnecessaryEncodingUsed
 )
 
 
@@ -65,5 +66,5 @@
            "InvalidCredentials", "APIError", "NoContentWarning", "CannotRevokeToken",
            "FunctionalityNotImplemented", "InvalidBaseURL", "PayloadValidationError",
            "NoAuthenticationMechanism", "FeatureNotSupportedByPythonVersion",
-           "InvalidIndex", "InvalidCredentialFormat"
+           "InvalidIndex", "InvalidCredentialFormat", "UnnecessaryEncodingUsed"
            ]
diff --git a/src/falconpy/_error/_warnings.py b/src/falconpy/_error/_warnings.py
index 6a62129b1..e8cdac492 100644
--- a/src/falconpy/_error/_warnings.py
+++ b/src/falconpy/_error/_warnings.py
@@ -95,3 +95,10 @@ class NoAuthenticationMechanism(SDKWarning):
 
     _code = 400
     _message = "No authentication mechanism has been specified for this class."
+
+
+class UnnecessaryEncodingUsed(SDKWarning):
+    """An argument was urlencoded when it should not be."""
+
+    _code = 400
+    _message = "A provided argument utilizes unnecessary encoding."
diff --git a/src/falconpy/_payload/__init__.py b/src/falconpy/_payload/__init__.py
index a75b7c945..eb9814fdd 100644
--- a/src/falconpy/_payload/__init__.py
+++ b/src/falconpy/_payload/__init__.py
@@ -55,6 +55,12 @@
 from ._cspm_registration import cspm_registration_payload, cspm_policy_payload, cspm_scan_payload
 from ._device_control_policy import device_policy_payload, default_device_policy_config_payload
 from ._falconx import falconx_payload
+from ._filevantage import (
+    filevantage_rule_group_payload,
+    filevantage_rule_payload,
+    filevantage_policy_payload,
+    filevantage_scheduled_exclusion_payload
+    )
 from ._mssp import mssp_payload
 from ._firewall import (
     firewall_policy_payload,
@@ -71,6 +77,7 @@
 from ._alerts import update_alerts_payload
 from ._sample_uploads import extraction_payload
 from ._ods import scheduled_scan_payload
+from ._cloud_snapshots import snapshot_inventory_payload, snapshot_registration_payload
 
 
 __all__ = [
@@ -91,5 +98,7 @@
     "extraction_payload", "simple_action_parameter", "network_locations_metadata_payload",
     "network_locations_create_payload", "scheduled_scan_payload", "token_settings_payload",
     "recon_export_job_payload", "default_device_policy_config_payload", "registry_payload",
-    "gcp_registration_payload"
+    "gcp_registration_payload", "filevantage_rule_group_payload", "filevantage_rule_payload",
+    "filevantage_policy_payload", "filevantage_scheduled_exclusion_payload",
+    "snapshot_inventory_payload", "snapshot_registration_payload"
 ]
diff --git a/src/falconpy/_payload/_cloud_snapshots.py b/src/falconpy/_payload/_cloud_snapshots.py
new file mode 100644
index 000000000..697fcc07c
--- /dev/null
+++ b/src/falconpy/_payload/_cloud_snapshots.py
@@ -0,0 +1,145 @@
+"""Internal payload handling library - Cloud Snapshots Payloads.
+
+ _______                        __ _______ __        __ __
+|   _   .----.-----.--.--.--.--|  |   _   |  |_.----|__|  |--.-----.
+|.  1___|   _|  _  |  |  |  |  _  |   1___|   _|   _|  |    <|  -__|
+|.  |___|__| |_____|________|_____|____   |____|__| |__|__|__|_____|
+|:  1   |                         |:  1   |
+|::.. . |   CROWDSTRIKE FALCON    |::.. . |    FalconPy
+`-------'                         `-------'
+
+OAuth2 API - Customer SDK
+
+This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
+
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <https://unlicense.org>
+"""
+
+
+def snapshot_registration_payload(passed_keywords: dict) -> dict:
+    """Craft a properly formatted Cloud Snapshot registration payload.
+
+    {
+        "aws_accounts": [
+            {
+                "account_number": "string",
+                "batch_regions": [
+                    {
+                        "job_definition_name": "string",
+                        "job_queue": "string",
+                        "region": "string"
+                    }
+                ],
+                "iam_external_id": "string",
+                "iam_role_arn": "string",
+                "kms_alias": "string",
+                "processing_account": "string"
+            }
+        ]
+    }
+    """
+    returned_payload = {}
+    if passed_keywords.get("aws_accounts", None):
+        returned_payload["aws_accounts"] = passed_keywords.get("aws_accounts", None)
+    else:
+        returned_payload["aws_accounts"] = []
+        returned = {}
+        keys = ["account_number", "batch_regions", "iam_external_id",
+                "iam_role_arn", "kms_alias", "processing_account"
+                ]
+        for key in keys:
+            if passed_keywords.get(key, None):
+                returned[key] = passed_keywords.get(key)
+        returned_payload["aws_accounts"].append(returned)
+
+    return returned_payload
+
+
+def snapshot_inventory_payload(passed_keywords: dict) -> dict:
+    """Craft a properly formatted Cloud Snapshot inventory payload.
+
+    {
+        "job_metadata": {
+            "cloud_provider": "string",
+            "instance_id": "string",
+            "job_end_time": "2023-08-31T02:45:34.131Z",
+            "job_id": "string",
+            "job_start_time": "2023-08-31T02:45:34.131Z",
+            "message": "string",
+            "scanner_version": "string",
+            "status": "string"
+        },
+        "results": {
+            "applications": [
+                {
+                    "major_version": "string",
+                    "package_hash": "string",
+                    "package_provider": "string",
+                    "package_source": "string",
+                    "path": "string",
+                    "product": "string",
+                    "software_architecture": "string",
+                    "type": "string",
+                    "vendor": "string"
+                }
+            ],
+            "os_version": "string"
+        }
+    }
+    """
+    returned_payload = {}
+    returned_payload["results"] = {}
+    # Job metadata
+    if passed_keywords.get("job_metadata", None):
+        returned_payload["job_metadata"] = passed_keywords.get("job_metadata", None)
+    else:
+        returned_payload["job_metadata"] = {}
+        # This will only support specifying one job at a time
+        keys = ["cloud_provider", "instance_id", "job_end_time", "job_id",
+                "job_start_time", "message", "scanner_version", "status"
+                ]
+        for key in keys:
+            if passed_keywords.get(key, None):
+                returned_payload["job_metadata"][key] = passed_keywords.get("key", None)
+    # Job results
+    if passed_keywords.get("results", None):
+        returned_payload["results"] = passed_keywords.get("results", None)
+    else:
+        if passed_keywords.get("applications", None):
+            returned_payload["results"]["applications"] = passed_keywords.get("applications", None)
+        else:
+            # This will only support specifying one application at a time
+            returned_payload["results"]["applications"] = []
+            keys = ["major_version", "package_hash", "package_provider", "package_source",
+                    "path", "product", "software_architecture", "type", "vendor"
+                    ]
+            for key in keys:
+                returned = {}
+                if passed_keywords.get(key, None):
+                    returned[key] = passed_keywords.get(key, None)
+            returned_payload["results"]["applications"].append(returned)
+        if passed_keywords.get("os_version", None):
+            returned_payload["results"]["os_version"] = passed_keywords.get("os_version", None)
+
+    return returned_payload
diff --git a/src/falconpy/_payload/_filevantage.py b/src/falconpy/_payload/_filevantage.py
new file mode 100644
index 000000000..d1cbe2c9c
--- /dev/null
+++ b/src/falconpy/_payload/_filevantage.py
@@ -0,0 +1,166 @@
+"""Internal payload handling library - Falcon X Sandbox.
+
+ _______                        __ _______ __        __ __
+|   _   .----.-----.--.--.--.--|  |   _   |  |_.----|__|  |--.-----.
+|.  1___|   _|  _  |  |  |  |  _  |   1___|   _|   _|  |    <|  -__|
+|.  |___|__| |_____|________|_____|____   |____|__| |__|__|__|_____|
+|:  1   |                         |:  1   |
+|::.. . |   CROWDSTRIKE FALCON    |::.. . |    FalconPy
+`-------'                         `-------'
+
+OAuth2 API - Customer SDK
+
+This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
+
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <https://unlicense.org>
+"""
+
+
+def filevantage_rule_group_payload(passed_keywords: dict) -> dict:
+    """Craft a properly formatted FileVantage rule group body payload.
+
+    {
+        "description": "string",
+        "id": "string",
+        "name": "string",
+        "type": "string"
+    }
+    """
+    returned = {}
+    keys = ["description", "id", "name", "type"]
+    for key in keys:
+        if passed_keywords.get(key, None):
+            returned[key] = passed_keywords.get(key, None)
+
+    return returned
+
+
+def filevantage_policy_payload(passed_keywords: dict) -> dict:
+    """Craft a properly formatted FileVantage policy body payload.
+
+    {
+        "description": "string",
+        "id": "string",
+        "name": "string",
+        "platform": "string",
+        "enabled": boolean
+    }
+    """
+    returned = {}
+    keys = ["description", "id", "name", "platform"]
+    for key in keys:
+        if passed_keywords.get(key, None):
+            returned[key] = passed_keywords.get(key, None)
+
+    if passed_keywords.get("enabled", None) is not None:
+        returned[key] = passed_keywords.get("enabled", None)
+
+    return returned
+
+
+def filevantage_scheduled_exclusion_payload(passed_keywords: dict) -> dict:
+    """Craft a properly formatted FileVantage scheduled exclusion body payload.
+
+    {
+        "description": "string",
+        "id": "string",
+        "name": "string",
+        "policy_id": "string",
+        "processes": "string",
+        "schedule_end": "string",
+        "schedule_start": "string",
+        "users": "string"
+    }
+    """
+    returned = {}
+    keys = ["description", "id", "name", "policy_id", "processes",
+            "schedule_end", "schedule_start", "users"
+            ]
+    for key in keys:
+        if passed_keywords.get(key, None):
+            returned[key] = passed_keywords.get(key, None)
+
+    return returned
+
+
+def filevantage_rule_payload(passed_keywords: dict) -> dict:
+    """Craft a properly formatted FileVantage rule body payload.
+
+    {
+        "created_timestamp": "string",
+        "depth": "string",
+        "description": "string",
+        "exclude": "string",
+        "exclude_processes": "string",
+        "exclude_users": "string",
+        "id": "string",
+        "include": "string",
+        "include_processes": "string",
+        "include_users": "string",
+        "modified_timestamp": "string",
+        "path": "string",
+        "precedence": integer,
+        "rule_group_id": "string",
+        "severity": "string",
+        "type": "string",
+        "watch_attributes_directory_changes": boolean,
+        "watch_attributes_file_changes": boolean,
+        "watch_create_directory_changes": boolean,
+        "watch_create_file_changes": boolean,
+        "watch_create_key_changes": boolean,
+        "watch_delete_directory_changes": boolean,
+        "watch_delete_file_changes": boolean,
+        "watch_delete_key_changes": boolean,
+        "watch_delete_value_changes": boolean,
+        "watch_permissions_directory_changes": boolean,
+        "watch_permissions_file_changes": boolean,
+        "watch_rename_directory_changes": boolean,
+        "watch_rename_file_changes": boolean,
+        "watch_rename_key_changes": boolean,
+        "watch_set_value_changes": boolean,
+        "watch_write_file_changes": boolean
+    }
+    """
+    returned = {}
+    keys = ["created_timestamp", "depth", "description", "exclude", "exclude_processes",
+            "exclude_users", "id", "include", "include_processes", "include_users",
+            "modified_timestamp", "path", "rule_group_id", "severity", "type",
+            ]
+    bool_int_keys = ["watch_attributes_directory_changes", "watch_attributes_file_changes",
+                     "watch_create_directory_changes", "watch_create_file_changes",
+                     "watch_create_key_changes", "watch_delete_directory_changes",
+                     "watch_delete_file_changes", "watch_delete_key_changes",
+                     "watch_delete_value_changes", "watch_permissions_directory_changes",
+                     "watch_permissions_file_changes", "watch_rename_directory_changes",
+                     "watch_rename_file_changes", "watch_rename_key_changes",
+                     "watch_set_value_changes", "watch_write_file_changes", "precedence"
+                     ]
+    for key in keys:
+        if passed_keywords.get(key, None):
+            returned[key] = passed_keywords.get(key, None)
+    for key in bool_int_keys:
+        if passed_keywords.get(key, None) is not None:
+            returned[key] = passed_keywords.get(key, None)
+
+    return returned
diff --git a/src/falconpy/_payload/_incidents.py b/src/falconpy/_payload/_incidents.py
index feaa6a7b9..bd13e9d38 100644
--- a/src/falconpy/_payload/_incidents.py
+++ b/src/falconpy/_payload/_incidents.py
@@ -41,6 +41,7 @@ def incident_action_parameters(passed_keywords: dict) -> list:
     """Create a properly formatted action_parameters branch for incident action payload operations.
 
     Available keywords
+    add_comment - Adds the associated value as a new comment on all the incidents in the ids list.
     add_tag - Adds the associated value as a new tag on all the incidents of the ids list.
               Multiple tags may be provided as a list or comma delimited string.
     delete_tag - Deletes tags matching the value from all the incidents in the ids list.
@@ -79,7 +80,7 @@ def incident_action_parameters(passed_keywords: dict) -> list:
     returned_payload = []
     valid_keywords = [
         "add_tag", "delete_tag", "unassign", "update_name", "update_assigned_to_v2",
-        "update_description", "update_status"
+        "update_description", "update_status", "add_comment"
         ]
     for key, val in passed_keywords.items():
         if key in valid_keywords and key != "unassign":
diff --git a/src/falconpy/_result/_result.py b/src/falconpy/_result/_result.py
index 6cd85ed74..5cbc72bdb 100644
--- a/src/falconpy/_result/_result.py
+++ b/src/falconpy/_result/_result.py
@@ -73,7 +73,12 @@ def __init__(self,
             if isinstance(_headers, CaseInsensitiveDict):
                 _headers = dict(headers)
             self.headers = Headers(_headers)
-            if isinstance(body, bytes):
+            if isinstance(body, list):
+                # Specific to report_executions_download_get returning raw
+                # JSON payloads as a list. There will be no Meta or Errors
+                # branch in this response.
+                self.resources = Resources(body)  # pragma: no cover
+            elif isinstance(body, bytes):
                 # Binary response
                 self.resources = BinaryFile(body)
                 self.meta = Meta()
diff --git a/src/falconpy/_service_class/_service_class.py b/src/falconpy/_service_class/_service_class.py
index 54003449a..03b85f2fd 100644
--- a/src/falconpy/_service_class/_service_class.py
+++ b/src/falconpy/_service_class/_service_class.py
@@ -35,11 +35,12 @@
 
 For more information, please refer to <https://unlicense.org>
 """
-from typing import Dict, Type, Optional
+from typing import Dict, Type, Optional, Union
 from ._base_service_class import BaseServiceClass
 from .._auth_object import FalconInterface
-from .._util import log_class_startup
+from .._util import log_class_startup, perform_request, service_override_payload
 from ..oauth2 import OAuth2
+from .._result import Result
 
 
 class ServiceClass(BaseServiceClass):
@@ -191,6 +192,35 @@ def token_expired(self) -> bool:
         """Return a boolean reflecting token expiration status."""
         return self.auth_object.token_expired
 
+    # Manual operation override
+    def override(self,
+                 method: str,
+                 route: str,
+                 parameters: dict = None,
+                 body: dict = None,
+                 data: Union[dict, bytes] = None,
+                 files: list = None,
+                 expand_result: bool = False
+                 ) -> Union[dict, Result]:
+        """Allow any Service Class to make requests to manually specified routes.
+
+        This helper is primarily intended for testing. The override method
+        does not support body payload abstraction or parameter abstraction.
+        """
+        if self.log:
+            # Log the operation we're performing if enabled.
+            self.log.debug("OPERATION: %s", "Manual")
+        # Process the API request.
+        return perform_request(**service_override_payload(caller=self,
+                                                          meth=method,
+                                                          rte=route,
+                                                          body_p=body,
+                                                          param_p=parameters,
+                                                          file_p=files,
+                                                          data_p=data,
+                                                          exp=expand_result
+                                                          ))
+
     # ___  ____ ____ ___  ____ ____ ___ _ ____ ____
     # |__] |__/ |  | |__] |___ |__/  |  | |___ [__
     # |    |  \ |__| |    |___ |  \  |  | |___ ___]
diff --git a/src/falconpy/_util/__init__.py b/src/falconpy/_util/__init__.py
index 06fdcc53a..c1c2688ae 100644
--- a/src/falconpy/_util/__init__.py
+++ b/src/falconpy/_util/__init__.py
@@ -58,6 +58,7 @@
     log_class_startup,
     _ALLOWED_METHODS
 )
+from ._service import service_override_payload
 from ._uber import (
     create_uber_header_payload,
     handle_body_payload_ids,
@@ -73,5 +74,5 @@
            "get_default", "args_to_params", "process_service_request", "confirm_base_url",
            "confirm_base_region", "return_preferred_default", "base_url_regions",
            "_ALLOWED_METHODS", "login_payloads", "logout_payloads", "sanitize_dictionary",
-           "calc_content_return", "log_class_startup"
+           "calc_content_return", "log_class_startup", "service_override_payload"
            ]
diff --git a/src/falconpy/_util/_functions.py b/src/falconpy/_util/_functions.py
index 6dd1d62af..977314b97 100644
--- a/src/falconpy/_util/_functions.py
+++ b/src/falconpy/_util/_functions.py
@@ -68,7 +68,8 @@
     NoContentWarning,
     PayloadValidationError,
     InvalidBaseURL,
-    SSLDisabledWarning
+    SSLDisabledWarning,
+    UnnecessaryEncodingUsed
     )
 from .._result import Result
 urllib3.disable_warnings(InsecureRequestWarning)
@@ -524,7 +525,13 @@ def get_default(types: list, position: int) -> Union[list, str, int, dict, bool]
     return retval
 
 
-def args_to_params(payload: dict, passed_arguments: dict, endpoints: list, epname: str) -> dict:
+def args_to_params(payload: dict,
+                   passed_arguments: dict,
+                   endpoints: list,
+                   epname: str,
+                   log_utl: Logger = None,
+                   pyth: bool = None
+                   ) -> dict:
     """Query String parameter abstraction handler.
 
     This function reviews arguments passed to the function against arguments accepted by the
@@ -544,6 +551,8 @@ def args_to_params(payload: dict, passed_arguments: dict, endpoints: list, epnam
     passed_arguments -- Keywords provided to the calling method.
     endpoints -- List of API endpoints available to the calling method.
     epname -- Operation ID to be retrieved from the endpoints list.
+    log_utl -- Logger used when warnings are issued.
+    pyth -- Boolean indicating if pythonic responses are enabled.
 
     Returns: dictionary representing QueryString parameters.
     """
@@ -559,6 +568,19 @@ def args_to_params(payload: dict, passed_arguments: dict, endpoints: list, epnam
                         if argument["type"] == "array":
                             if isinstance(passed_arguments[arg_name], (str)):
                                 passed_arguments[arg_name] = passed_arguments[arg_name].split(",")
+                        # Check for unnecessarily URLEncoded strings by finding an encoded ":", Issue #850
+                        if isinstance(passed_arguments[arg_name], str):
+                            if "%3A" in passed_arguments[arg_name]:
+                                msg = " ".join([arg_name,
+                                                "argument contains potentially urlencoded string of",
+                                                f"'{passed_arguments[arg_name]}'."
+                                                ])
+                                if pyth:
+                                    warn(msg, UnnecessaryEncodingUsed, stacklevel=5)
+                                else:
+                                    if log_utl:
+                                        log_utl.warning(msg)
+
                         # More data type validation can go here
                         payload[arg_name] = passed_arguments[arg_name]
             except IndexError:
@@ -638,7 +660,13 @@ def process_service_request(calling_object,  # pylint: disable=R0914 # (19/15)
     passed_params = kwargs.get("params", None)
     parameter_payload = None
     if passed_keywords or passed_params:
-        parameter_payload = args_to_params(passed_params, passed_keywords, endpoints, operation_id)
+        parameter_payload = args_to_params(passed_params,
+                                           passed_keywords,
+                                           endpoints,
+                                           operation_id,
+                                           calling_object.log,
+                                           calling_object.pythonic
+                                           )
     expand_result = passed_keywords.get("expand_result", False) if passed_keywords else kwargs.get("expand_result", False)
     new_keywords = {
         "caller": calling_object,
@@ -654,7 +682,7 @@ def process_service_request(calling_object,  # pylint: disable=R0914 # (19/15)
         "body_required": kwargs.get("body_required", None),
         "expand_result": expand_result,
         "container": container,
-        "pythonic": kwargs.get("pythonic", None),
+        "pythonic": calling_object.pythonic,
         "perform": True
     }
 
diff --git a/src/falconpy/_util/_service.py b/src/falconpy/_util/_service.py
new file mode 100644
index 000000000..0be0cefce
--- /dev/null
+++ b/src/falconpy/_util/_service.py
@@ -0,0 +1,69 @@
+"""FalconPy Service Class helper methods.
+
+ _______                        __ _______ __        __ __
+|   _   .----.-----.--.--.--.--|  |   _   |  |_.----|__|  |--.-----.
+|.  1___|   _|  _  |  |  |  |  _  |   1___|   _|   _|  |    <|  -__|
+|.  |___|__| |_____|________|_____|____   |____|__| |__|__|__|_____|
+|:  1   |                         |:  1   |
+|::.. . |   CROWDSTRIKE FALCON    |::.. . |    FalconPy
+`-------'                         `-------'
+
+OAuth2 API - Customer SDK
+
+This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
+
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <https://unlicense.org>
+"""
+from typing import Union
+
+
+def service_override_payload(caller: object,
+                             meth: str,
+                             rte: str,
+                             body_p: dict,
+                             param_p: dict,
+                             file_p: list,
+                             data_p: Union[dict, bytes],
+                             exp: bool
+                             ) -> dict:
+    """Create the necessary arguments for a direct call to process_request."""
+    return {
+        "method": meth,
+        "endpoint": f"{caller.base_url}{rte}",
+        "body": body_p,
+        "data": data_p,
+        "params": param_p,
+        "headers": caller.headers,
+        "files": file_p,
+        "verify": caller.ssl_verify,
+        "proxy": caller.proxy,
+        "timeout": caller.timeout,
+        "user_agent": caller.user_agent,
+        "expand_result": exp,
+        "container": False,     # Does not currently support container operations
+        "log_util": caller.log,
+        "debug_record_count": caller.debug_record_count,
+        "sanitize": caller.sanitize_log,
+        "pythonic": caller.pythonic
+    }
diff --git a/src/falconpy/_util/_uber.py b/src/falconpy/_util/_uber.py
index fa4d862a9..0a2c0fbbb 100644
--- a/src/falconpy/_util/_uber.py
+++ b/src/falconpy/_util/_uber.py
@@ -121,7 +121,13 @@ def uber_request_keywords(caller,
         "endpoint": tgt,
         "body": kwa.get("body", return_preferred_default(oper)),
         "data": kwa.get("data", return_preferred_default(oper)),
-        "params": args_to_params(kwa.get("parameters", {}), kwa, caller.commands, oper),
+        "params": args_to_params(kwa.get("parameters", {}),
+                                 kwa,
+                                 caller.commands,
+                                 oper,
+                                 caller.log,
+                                 caller.pythonic
+                                 ),
         "headers": create_uber_header_payload(caller.auth_headers, kwa),
         "files": kwa.get("files", return_preferred_default(oper, "list")),
         "verify": caller.ssl_verify,
diff --git a/src/falconpy/_version.py b/src/falconpy/_version.py
index 5218c6cec..236c4f6f8 100644
--- a/src/falconpy/_version.py
+++ b/src/falconpy/_version.py
@@ -35,7 +35,7 @@
 
 For more information, please refer to <https://unlicense.org>
 """
-_VERSION = '1.3.0'
+_VERSION = '1.3.1'
 _MAINTAINER = 'Joshua Hiller'
 _AUTHOR = 'CrowdStrike'
 _AUTHOR_EMAIL = 'falconpy@crowdstrike.com'
diff --git a/src/falconpy/api_complete.py b/src/falconpy/api_complete.py
index 8f5235e0b..24866b60f 100644
--- a/src/falconpy/api_complete.py
+++ b/src/falconpy/api_complete.py
@@ -52,7 +52,8 @@
     InvalidOperation,
     InvalidMethod,
     TokenNotSpecified,
-    SDKError
+    SDKError,
+    APIError
     )
 
 
@@ -78,6 +79,9 @@ def log_failure(msg, code: int, res: dict = None):
                 caller.log.debug("RESULT: %s", res)
         try:
             result = func(caller, *args, **kwargs)
+        except APIError as api_error:
+            # Should only receive this in pythonic mode
+            raise api_error
         except (SDKError, InvalidMethod, InvalidOperation) as bad_sdk:
             result = bad_sdk.result
             log_failure(bad_sdk.message, bad_sdk.code, result)
diff --git a/src/falconpy/cloud_snapshots.py b/src/falconpy/cloud_snapshots.py
new file mode 100644
index 000000000..9dd5ef896
--- /dev/null
+++ b/src/falconpy/cloud_snapshots.py
@@ -0,0 +1,219 @@
+"""CrowdStrike Cloud Snapshots API Interface Class.
+
+ _______                        __ _______ __        __ __
+|   _   .----.-----.--.--.--.--|  |   _   |  |_.----|__|  |--.-----.
+|.  1___|   _|  _  |  |  |  |  _  |   1___|   _|   _|  |    <|  -__|
+|.  |___|__| |_____|________|_____|____   |____|__| |__|__|__|_____|
+|:  1   |                         |:  1   |
+|::.. . |   CROWDSTRIKE FALCON    |::.. . |    FalconPy
+`-------'                         `-------'
+
+OAuth2 API - Customer SDK
+
+This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
+
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <https://unlicense.org>
+"""
+from typing import Dict, Union
+from ._util import process_service_request, force_default
+from ._payload import snapshot_registration_payload, snapshot_inventory_payload
+from ._service_class import ServiceClass
+from ._endpoint._cloud_snapshots import _cloud_snapshot_endpoints as Endpoints
+
+
+class CloudSnapshots(ServiceClass):
+    """The only requirement to instantiate an instance of this class is one of the following.
+
+    - a valid client_id and client_secret provided as keywords.
+    - a credential dictionary with client_id and client_secret containing valid API credentials
+      {
+          "client_id": "CLIENT_ID_HERE",
+          "client_secret": "CLIENT_SECRET_HERE"
+      }
+    - a previously-authenticated instance of the authentication service class (oauth2.py)
+    - a valid token provided by the authentication service class (oauth2.py)
+    """
+
+    def get_credentials(self: object) -> Dict[str, Union[int, dict]]:
+        """Retrieve the registry credentials.
+
+        HTTP Method: GET
+
+        Swagger URL
+        ----
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-snapshots/GetCredentialsMixin0
+
+        Keyword arguments
+        ----
+        This method does not accept keyword arguments.
+
+        Arguments
+        ----
+        This method does not accept arguments.
+
+        Returns
+        ----
+        dict
+            Dictionary object containing API response.
+        """
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="GetCredentialsMixin0"
+            )
+
+    @force_default(defaults=["body"], default_types=["dict"])
+    def create_inventory(self: object, body: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        """Create inventory from data received from a snapshot.
+
+        Keyword arguments:
+        body - full body payload in JSON format, not required if using other keywords.
+               {
+                   "job_metadata": {
+                       "cloud_provider": "string",
+                       "instance_id": "string",
+                       "job_end_time": "2023-08-31T02:45:34.131Z",
+                       "job_id": "string",
+                       "job_start_time": "2023-08-31T02:45:34.131Z",
+                       "message": "string",
+                       "scanner_version": "string",
+                       "status": "string"
+                   },
+                   "results": {
+                       "applications": [
+                           {
+                               "major_version": "string",
+                               "package_hash": "string",
+                               "package_provider": "string",
+                               "package_source": "string",
+                               "path": "string",
+                               "product": "string",
+                               "software_architecture": "string",
+                               "type": "string",
+                               "vendor": "string"
+                           }
+                       ],
+                       "os_version": "string"
+                   }
+               }
+        cloud_provider -- Name of the cloud provider. String.
+        instance_id -- ID of the instance. String.
+        job_end_time -- Completion time for the job. UTC date string.
+        job_id -- ID of the job. String.
+        job_start_time -- Start time for the job. UTC date string.
+        message -- Message received upon job completion. String.
+        scanner_version -- Version identifier for the scanner used. String.
+        status -- Job completion status. String.
+        results -- Full results payload. Dictionary. Overrides values below.
+        os_version -- Operating system version. String.
+        applications -- Complete application list. List of dictionaries. Overrides values below.
+        major_version -- Application major version. String.
+        package_hash -- Hash for the package. String.
+        package_provider -- Package provider. String.
+        path -- File path for the application. String.
+        product - Product name for the application. String.
+        software_architecture -- Running architecture for the application. String.
+        type -- Type of application. String.
+        vendor -- Application vendor. String.
+        job_metadata -- Complete job metadata. Dictionary.
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: POST
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-snapshots/CreateInventory
+        """
+        if not body:
+            body = snapshot_inventory_payload(passed_keywords=kwargs)
+
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="CreateInventory",
+            keywords=kwargs,
+            body=body
+            )
+
+    @force_default(defaults=["body"], default_types=["dict"])
+    def register_account(self: object, body: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        """Create inventory from data received from a snapshot.
+
+        Keyword arguments:
+        body - full body payload in JSON format, not required if using other keywords.
+               {
+                   "aws_accounts": [
+                       {
+                           "account_number": "string",
+                           "batch_regions": [
+                               {
+                                   "job_definition_name": "string",
+                                   "job_queue": "string",
+                                   "region": "string"
+                               }
+                           ],
+                           "iam_external_id": "string",
+                           "iam_role_arn": "string",
+                           "kms_alias": "string",
+                           "processing_account": "string"
+                       }
+                   ]
+               }
+        aws_accounts -- Complete list of AWS accounts to register. List of dictionaries.
+                        Overrides any values specified below.
+        account_number -- AWS account number. String
+        batch_regions -- Region the batch is executed. List of dictionaries.
+        iam_external_id -- The external ID of the IAM account used. String.
+        iam_role_arn -- The AWS ARN for the IAM account used. String.
+        kms_alias -- The KMS alias for the IAM account used. String.
+        processing_account -- The name of the processing account. String.
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: POST
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/cloud-snapshots/RegisterCspmSnapshotAccount
+        """
+        if not body:
+            body = snapshot_registration_payload(passed_keywords=kwargs)
+
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="RegisterCspmSnapshotAccount",
+            keywords=kwargs,
+            body=body
+            )
+
+    # This method name aligns to the operation ID in the API but
+    # does not conform to snake_case / PEP8 and is defined here
+    # for backwards compatibility / ease of use purposes
+    GetCredentialsMixin0 = get_credentials
+    CreateInventory = create_inventory
+    RegisterCspmSnapshotAccount = register_account
diff --git a/src/falconpy/falcon_complete_dashboard.py b/src/falconpy/falcon_complete_dashboard.py
index 6fea29388..d2f2939c8 100644
--- a/src/falconpy/falcon_complete_dashboard.py
+++ b/src/falconpy/falcon_complete_dashboard.py
@@ -55,6 +55,82 @@ class CompleteDashboard(ServiceClass):
     - a valid token provided by the authentication service class (OAuth2.token())
     """
 
+    @force_default(defaults=["body"], default_types=["list"])
+    def aggregate_alerts(self: object, body: list = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        """Retrieve aggregate allowlist ticket values based on the matched filter.
+
+        Keyword arguments:
+        body -- full body payload, not required when using other keywords.
+                List of dictionaries.
+                [{
+                    "date_ranges": [
+                        {
+                            "from": "string",
+                            "to": "string"
+                        }
+                    ],
+                    "field": "string",
+                    "filter": "string",
+                    "interval": "string",
+                    "min_doc_count": 0,
+                    "missing": "string",
+                    "name": "string",
+                    "q": "string",
+                    "ranges": [
+                        {
+                            "From": 0,
+                            "To": 0
+                        }
+                    ],
+                    "size": 0,
+                    "sort": "string",
+                    "sub_aggregates": [
+                        null
+                    ],
+                    "time_zone": "string",
+                    "type": "string"
+                }]
+        date_ranges -- If peforming a date range query specify the from and to date ranges.
+                       These can be in common date formats like 2019-07-18 or now.
+                       List of dictionaries.
+        field -- Term you want to aggregate on. If doing a date_range query,
+                 this is the date field you want to apply the date ranges to. String.
+        filter -- Optional filter criteria in the form of an FQL query.
+                  For more information about FQL queries, see our FQL documentation in Falcon.
+                  String.
+        interval -- String.
+        min_doc_count -- Minimum number of documents required to match. Integer.
+        missing -- String.
+        name -- Name of the aggregation. String.
+        q -- FQL syntax. String.
+        ranges -- List of dictionaries.
+        size -- Size limit to apply to the queries. Integer.
+        sort -- FQL syntax. String.
+        sub_aggregates -- List of strings.
+        time_zone -- String.
+        type -- String.
+
+        This method only supports keywords for providing arguments.
+
+        This method does not support body payload validation.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: POST
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Falcon%20Complete%20Dashboard/AggregateAlerts
+        """
+        if not body:
+            body = [aggregate_payload(submitted_keywords=kwargs)]
+
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="AggregateAlerts",
+            body=body
+            )
+
     @force_default(defaults=["body"], default_types=["list"])
     def aggregate_allow_list(self: object, body: list = None, **kwargs) -> Dict[str, Union[int, dict]]:
         """Retrieve aggregate allowlist ticket values based on the matched filter.
@@ -649,6 +725,36 @@ def aggregate_remediations(self: object, body: list = None, **kwargs) -> Dict[st
             body=body
             )
 
+    @force_default(defaults=["parameters"], default_types=["dict"])
+    def query_alert_ids_by_filter(self: object, parameters: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        """Retrieve allowlist tickets that match the provided filter criteria with scrolling enabled.
+
+        Keyword arguments:
+        filter -- Optional filter and sort criteria in the form of an FQL query. String.
+        limit -- The maximum number of records to return in this response. [Integer, 1-500]
+                 Use with the offset parameter to manage pagination of results.
+        offset -- The offset to start retrieving records from. String.
+                  Use with the limit parameter to manage pagination of results.
+        parameters - full parameters payload, not required if using other keywords.
+        sort -- The property to sort on, followed by a dot `.`, followed by the sort direction.
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: GET
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/Falcon%20Complete%20Dashboard/QueryAlertIdsByFilter
+        """
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="QueryAlertIdsByFilter",
+            keywords=kwargs,
+            params=parameters
+            )
+
     @force_default(defaults=["parameters"], default_types=["dict"])
     def query_allow_list_filter(self: object, parameters: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
         """Retrieve allowlist tickets that match the provided filter criteria with scrolling enabled.
@@ -870,6 +976,7 @@ def query_remediations_filter(self: object, parameters: dict = None, **kwargs) -
     # These method names align to the operation IDs in the API but
     # do not conform to snake_case / PEP8 and are defined here for
     # backwards compatibility / ease of use purposes
+    AggregateAlerts = aggregate_alerts
     AggregateAllowList = aggregate_allow_list
     AggregateBlockList = aggregate_block_list
     AggregateDetections = aggregate_detections
@@ -877,6 +984,7 @@ def query_remediations_filter(self: object, parameters: dict = None, **kwargs) -
     AggregateEscalations = aggregate_escalations
     AggregateFCIncidents = aggregate_fc_incidents
     AggregateRemediations = aggregate_remediations
+    QueryAlertIdsByFilter = query_alert_ids_by_filter
     QueryAllowListFilter = query_allow_list_filter
     QueryBlockListFilter = query_block_list_filter
     QueryDetectionIdsByFilter = query_detection_ids_by_filter
diff --git a/src/falconpy/falcon_container.py b/src/falconpy/falcon_container.py
index 26dc19134..c3745cf99 100644
--- a/src/falconpy/falcon_container.py
+++ b/src/falconpy/falcon_container.py
@@ -83,6 +83,49 @@ def get_credentials(self: object) -> Dict[str, Union[int, dict]]:
             operation_id="GetCredentials"
             )
 
+    @force_default(defaults=["parameters"], default_types=["dict"])
+    def get_combined_images(self: object, parameters: dict = None, **kwargs) -> dict:
+        """Retrieve registry entities identified by the customer ID.
+
+        HTTP Method: GET
+
+        Swagger URL
+        ----
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/falcon-container-image/GetCombinedImages
+
+        Keyword arguments
+        ----
+        filter : string
+            Filter images using a query in Falcon Query Language (FQL).
+            Supported filters: container_running_status, cve_id, first_seen,
+                               registry, repository, tag, vulnerability_severity
+        limit : int
+            The maximum number of records to return in this response. [1-100]
+            Use with the offset parameter to manage pagination of results.
+        offset : int
+            The offset to start retrieving records from.
+            Use with the limit parameter to manage pagination of results.
+        parameters : dict
+            Full parameters payload. Not required if using other keywords.
+        sort : str
+            The property to sort by. FQL syntax.
+            Supports: first_seen, registry, repository, tag, vulnerability_severity
+
+        This method only supports keywords for providing arguments.
+
+        Returns
+        ----
+        dict
+            Dictionary object containing API response.
+        """
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="GetCombinedImages",
+            keywords=kwargs,
+            params=parameters
+            )
+
     @force_default(defaults=["body"], default_types=["dict"])
     def read_image_vulnerabilities(self: object, body: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
         """Retrieve an assessment report for an image by specifying repository and tag.
@@ -457,6 +500,7 @@ def update_registry_entities(self: object, body: dict = None, **kwargs) -> dict:
     # do not conform to snake_case / PEP8 and are defined here for
     # backwards compatibility / ease of use purposes
     GetCredentials = get_credentials
+    GetCombinedImages = get_combined_images
     GetImageAssessmentReport = get_assessment
     DeleteImageDetails = delete_image_details
     ImageMatchesPolicy = image_matches_policy
diff --git a/src/falconpy/filevantage.py b/src/falconpy/filevantage.py
index 8dc7e021d..cc9f37c57 100644
--- a/src/falconpy/filevantage.py
+++ b/src/falconpy/filevantage.py
@@ -35,7 +35,14 @@
 
 For more information, please refer to <https://unlicense.org>
 """
+# pylint: disable=C0302
 from typing import Dict, Union
+from ._payload import (
+    filevantage_rule_group_payload,
+    filevantage_rule_payload,
+    filevantage_policy_payload,
+    filevantage_scheduled_exclusion_payload
+    )
 from ._util import process_service_request, force_default, handle_single_argument
 from ._service_class import ServiceClass
 from ._endpoint._filevantage import _filevantage_endpoints as Endpoints
@@ -80,6 +87,861 @@ def get_changes(self: object, *args, parameters: dict = None, **kwargs) -> Dict[
             params=handle_single_argument(args, parameters, "ids")
             )
 
+    @force_default(defaults=["parameters", "body"], default_types=["dict", "dict"])
+    def update_policy_host_groups(self: object,
+                                  parameters: dict = None,
+                                  body: dict = None,
+                                  **kwargs
+                                  ) -> Dict[str, Union[int, dict]]:
+        """Manage host groups assigned to a policy.
+
+        Keyword arguments:
+        action -- The action to perform on the provided IDs. (String)
+                  Allowed values: assign or unassign.
+        policy_id -- The ID of the policy to perform the action on. (String)
+        ids -- One or more host groups IDs. (String or List of strings)
+        parameters - full parameters payload, not required if using other keywords.
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: PATCH
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/updatePolicyHostGroups
+        """
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="updatePolicyHostGroups",
+            keywords=kwargs,
+            params=parameters,
+            body=body
+            )
+
+    @force_default(defaults=["parameters", "body"], default_types=["dict", "dict"])
+    def update_policy_precedence(self: object,
+                                 parameters: dict = None,
+                                 body: dict = None,
+                                 **kwargs
+                                 ) -> Dict[str, Union[int, dict]]:
+        """Update the policy precedence for all policies of a specific type.
+
+        Requests that do no represent all IDs of the provided policy type will not be processed.
+
+        Keyword arguments:
+        type -- The policy type to set the precedence order for. (String)
+                Allowed values: Windows, Linux, or Mac
+        ids -- Procedence of the policies for the provided type. (String or List of strings)
+        parameters - full parameters payload, not required if using other keywords.
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: PATCH
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/updatePolicyPrecedence
+        """
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="updatePolicyPrecedence",
+            keywords=kwargs,
+            params=parameters,
+            body=body
+            )
+
+    @force_default(defaults=["parameters", "body"], default_types=["dict", "dict"])
+    def update_policy_rule_groups(self: object,
+                                  parameters: dict = None,
+                                  body: dict = None,
+                                  **kwargs
+                                  ) -> Dict[str, Union[int, dict]]:
+        """Manage the rule groups assigned to the policy or set the rule group precedence.
+
+        Rule groups must be of the same type as the policy they are being added to:
+        WindowsRegistry and WindowsFiles groups can be added to a Windows policy.
+        LinuxFiles groups can be added to a Linux policy.
+        MacFiles groups can be added to a Max policy.
+        When setting rule group precedence, the prcedence for ALL rule group IDs within the
+        policy must be provided.
+
+        Keyword arguments:
+        action -- The action to perform with the provided IDs. (String)
+                  Allowed values: assign, unassign, precedence
+        policy_id -- The ID of teh policy for which to perform the action. (String)
+        ids -- One or more rule group IDs. (String or List of strings)
+               For the precedence action, precedence is controlled by the order of the IDs
+               in the list provided.
+        parameters - full parameters payload, not required if using other keywords.
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: PATCH
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/updatePolicyRuleGroups
+        """
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="updatePolicyRuleGroups",
+            keywords=kwargs,
+            params=parameters,
+            body=body
+            )
+
+    @force_default(defaults=["parameters"], default_types=["dict"])
+    def get_policies(self: object, *args, parameters: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        """Retrieve the configuration for one or more policies.
+
+        Keyword arguments:
+        ids -- List of policy IDs to retrieve. String or list of strings. (Max: 500)
+        parameters -- full parameters payload, not required if ids keyword is provided.
+
+        Arguments: When not specified, the first argument to this method is assumed to be 'ids'.
+                   All others are ignored.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: GET
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/getPolicies
+        """
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="getPolicies",
+            keywords=kwargs,
+            params=handle_single_argument(args, parameters, "ids")
+            )
+
+    @force_default(defaults=["body"], default_types=["dict"])
+    def create_policy(self: object, body: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        """Create a new policy of the specified type.
+
+        New policies are always added at the end of the precedence list for the provided policy type.
+
+        Keyword arguments:
+        body - full body payload in JSON format, not required if using other keywords.
+               {
+                   "description": "string",
+                   "name": "string",
+                   "platform": "string",
+               }
+        description -- The policy description. (String, 0-500 characters.)
+        platform -- Policy platform. (String)
+                    Allowed values: Windows, Linux or Mac
+        name -- Name of the policy. (String, 1-100 characters.)
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: POST
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/createPolicies
+        """
+        if not body:
+            body = filevantage_policy_payload(passed_keywords=kwargs)
+
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="createPolicies",
+            keywords=kwargs,
+            body=body
+            )
+
+    @force_default(defaults=["parameters"], default_types=["dict"])
+    def delete_policies(self: object, *args, parameters: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        """Delete one or more policies. Only disabled policies can be deleted.
+
+        Keyword arguments:
+        ids -- List of policy IDs to delete. String or list of strings. (Max: 500)
+        parameters -- full parameters payload, not required if other keywords are provided.
+
+        Arguments: When not specified, the first argument to this method is assumed to be 'ids'.
+                   All others are ignored.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: DELETE
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/deletePolicies
+        """
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="deletePolicies",
+            keywords=kwargs,
+            params=handle_single_argument(args, parameters, "ids")
+            )
+
+    @force_default(defaults=["body"], default_types=["dict"])
+    def update_policies(self: object, body: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        """Update the general information of the provided policy.
+
+        Only name, description, and enabled status of the policy is allowed to be update.
+        Rule and host group assignment is performed via their respective update end points.
+
+        Keyword arguments:
+        body - full body payload in JSON format, not required if using other keywords.
+               {
+                   "description": "string",
+                   "id": "string",
+                   "name": "string",
+                   "enabled": boolean,
+               }
+        description -- The policy description. (String, 0-500 characters.)
+        id -- ID of the policy to be updated. (String)
+        name -- Name of the policy. (String, 1-100 characters.)
+        enabled -- Enablement status of the policy. Boolean.
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: PATCH
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/updatePolicies
+        """
+        if not body:
+            body = filevantage_policy_payload(passed_keywords=kwargs)
+
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="updatePolicies",
+            keywords=kwargs,
+            body=body
+            )
+
+    @force_default(defaults=["parameters"], default_types=["dict"])
+    def get_scheduled_exclusions(self: object, parameters: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        """Retrieve the configuration for one or more scheduled exclusions within the provided policy.
+
+        Scheduled exclusions within the provided policy that match a provided ID will be returned.
+
+        Keyword arguments:
+        ids -- List of rule IDs to retrieve. String or list of strings. (Max: 500)
+        parameters -- full parameters payload, not required if ids keyword is provided.
+        policy_id -- Rule group from which to retrieve the rule configuration. (String)
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: GET
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/getScheduledExclusions
+        """
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="getScheduledExclusions",
+            keywords=kwargs,
+            params=parameters
+            )
+
+    @force_default(defaults=["body"], default_types=["dict"])
+    def create_scheduled_exclusions(self: object, body: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        r"""Create a new scheduled exclusion within the provided policy.
+
+        Keyword arguments:
+        body - full body payload in JSON format, not required if using other keywords.
+               {
+                   "description": "string",
+                   "name": "string",
+                   "policy_id": "string",
+                   "processes": "string",
+                   "schedule_end": "string",
+                   "schedule_start": "string",
+                   "users": "string"
+               }
+        description -- The scheduled exclusion description. (String, 0-500 characters.)
+        name -- Name of the scheduled exclusion. (String, 1-100 characters.)
+        policy_id -- ID of the policy the scheduled exclusion is assigned. (String)
+        users -- Comma delimited list of users to NOT monitor changes. (String, 1-500 characters)
+                 `admin*` excludes changes made by all usernames that begin with admin.
+                 Falcon GLOB syntax is supported.
+        processes - Comma delimited list of processes to NOT monitor changes. (String, 1-500 characters)
+                    `**\RunMe.exe` or `**/RunMe.sh` excludes changes made by RunMe.exe
+                    or RunMe.sh in any location.
+        schedule_start - Indicates the start of the schedule. (String, RFC3339 format, Required)
+        schedule_end - Indicates the end of the schedule. (String, RFC3339 format)
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: POST
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/createScheduledExclusions
+        """
+        if not body:
+            body = filevantage_scheduled_exclusion_payload(passed_keywords=kwargs)
+
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="createScheduledExclusions",
+            keywords=kwargs,
+            body=body
+            )
+
+    @force_default(defaults=["parameters"], default_types=["dict"])
+    def delete_scheduled_exclusions(self: object, parameters: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        """Delete one or more scheduled exclusions from the specified policy.
+
+        Scheduled exclusions that match the provided ID will be deleted form the provided policy.
+
+        Keyword arguments:
+        ids -- List of rule group IDs to delete. String or list of strings. (Max: 500 characters)
+        parameters -- full parameters payload, not required if other keywords are provided.
+        policy_id -- The ID of the rule group from which the scheduled exclusions will be deleted.
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: DELETE
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/deleteScheduledExclusions
+        """
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="deleteScheduledExclusions",
+            keywords=kwargs,
+            params=parameters
+            )
+
+    @force_default(defaults=["body"], default_types=["dict"])
+    def update_scheduled_exclusions(self: object, body: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        r"""Update the provided scheduled exclusion configuration within the provided policy.
+
+        Keyword arguments:
+        body - full body payload in JSON format, not required if using other keywords.
+               {
+                   "description": "string",
+                   "id": "string",
+                   "name": "string",
+                   "policy_id": "string",
+                   "processes": "string",
+                   "schedule_end": "string",
+                   "schedule_start": "string",
+                   "users": "string"
+               }
+        description -- The scheduled exclusion description. (String, 0-500 characters.)
+        id -- ID of the scheduled exclusion to be updated. (String)
+        name -- Name of the scheduled exclusion. (String, 1-100 characters.)
+        policy_id -- ID of the policy the scheduled exclusion is assigned. (String)
+        users -- Comma delimited list of users to NOT monitor changes. (String, 1-500 characters)
+                 `admin*` excludes changes made by all usernames that begin with admin.
+                 Falcon GLOB syntax is supported.
+        processes - Comma delimited list of processes to NOT monitor changes. (String, 1-500 characters)
+                    `**\RunMe.exe` or `**/RunMe.sh` excludes changes made by RunMe.exe
+                    or RunMe.sh in any location.
+        schedule_start - Indicates the start of the schedule. (String, RFC3339 format, Required)
+        schedule_end - Indicates the end of the schedule. (String, RFC3339 format)
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: PATCH
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/updateScheduledExclusions
+        """
+        if not body:
+            body = filevantage_scheduled_exclusion_payload(passed_keywords=kwargs)
+
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="updateScheduledExclusions",
+            keywords=kwargs,
+            body=body
+            )
+
+    @force_default(defaults=["parameters", "body"], default_types=["dict", "dict"])
+    def update_rule_group_precedence(self: object,
+                                     parameters: dict = None,
+                                     body: dict = None,
+                                     **kwargs
+                                     ) -> Dict[str, Union[int, dict]]:
+        """Update the rule precedence for all rules in the identified rule group.
+
+        The IDs for ALL rules contained within the rule group msut be specified in the desired
+        precedence order. Requests that do not represent all IDs will not be processed.
+
+        Keyword arguments:
+        ids -- List of rule IDs to retrieve. String or list of strings. (Max: 500)
+        parameters -- full parameters payload, not required if ids keyword is provided.
+        rule_group_id -- Rule group from which to retrieve the rule configuration. (String)
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: PATCH
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/updateRuleGroupPrecedence
+        """
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="updateRuleGroupPrecedence",
+            keywords=kwargs,
+            params=parameters,
+            body=body
+            )
+
+    @force_default(defaults=["parameters"], default_types=["dict"])
+    def get_rules(self: object, parameters: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        """Retrieve the configuration for one or more rules.
+
+        Rules within the provided rule group ID that match a provided ID will be returned.
+
+        Keyword arguments:
+        ids -- List of rule IDs to retrieve. String or list of strings. (Max: 500)
+        parameters -- full parameters payload, not required if ids keyword is provided.
+        rule_group_id -- Rule group from which to retrieve the rule configuration. (String)
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: GET
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/getRules
+        """
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="getRules",
+            keywords=kwargs,
+            params=parameters
+            )
+
+    @force_default(defaults=["body"], default_types=["dict"])
+    def create_rule(self: object, body: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        r"""Create a new rule configuration within the specified group.
+
+        Keyword arguments:
+        body - full body payload in JSON format, not required if using other keywords.
+               {
+                   "created_timestamp": "string",
+                   "depth": "string",
+                   "description": "string",
+                   "exclude": "string",
+                   "exclude_processes": "string",
+                   "exclude_users": "string",
+                   "id": "string",
+                   "include": "string",
+                   "include_processes": "string",
+                   "include_users": "string",
+                   "modified_timestamp": "string",
+                   "path": "string",
+                   "precedence": 0,
+                   "rule_group_id": "string",
+                   "severity": "string",
+                   "type": "string",
+                   "watch_attributes_directory_changes": true,
+                   "watch_attributes_file_changes": true,
+                   "watch_create_directory_changes": true,
+                   "watch_create_file_changes": true,
+                   "watch_create_key_changes": true,
+                   "watch_delete_directory_changes": true,
+                   "watch_delete_file_changes": true,
+                   "watch_delete_key_changes": true,
+                   "watch_delete_value_changes": true,
+                   "watch_permissions_directory_changes": true,
+                   "watch_permissions_file_changes": true,
+                   "watch_rename_directory_changes": true,
+                   "watch_rename_file_changes": true,
+                   "watch_rename_key_changes": true,
+                   "watch_set_value_changes": true,
+                   "watch_write_file_changes": true
+               }
+        description -- The rule description. (String, 0-500 characters.)
+        rule_group_id -- Group ID containing the group configuration. (String)
+        path -- the file system or registry path to monitor. (String, 1-250 characters)
+                All paths must end with the path separator, e.g. c:\windows\ /usr/bin/
+        severity -- to categorize change events produced by this rule. (String)
+                    Allowed values: Low, Medium, High or Critical
+        depth -- recursion levels below the base path to monitor. (String)
+                 Allowed values: 1, 2, 3, 4, 5 or ANY
+        precedence -- the order in which rules will be evaluated starting with 1.
+                      Specifying a precedence value that is already set for another rule
+                      in the group will result this rule being placed before that existing rule.
+        include -- the files, directories, registry keys, or registry values that will be monitored. (String).
+                   Falcon GLOB syntax is supported.
+                   Allowed rule group configuration is based on the type of rule
+                   the rule group is added to.
+        exclude -- the files, directories, registry keys, or registry values that will NOT be monitored. (String).
+                   Falcon GLOB syntax is supported.
+                   Allowed rule group configuration is based on the type of rule
+                   the rule group is added to.
+        include_users -- the changes performed by specific users that will be monitored. (String).
+                   Falcon GLOB syntax is supported.
+                   macOS is not supported at this time.
+                   Allowed rule group configuration is based on the type of rule
+                   the rule group is added to.
+        exclude_users -- the changes performed by specific users that will NOT be monitored. (String).
+                   Falcon GLOB syntax is supported.
+                   macOS is not supported at this time.
+                   Allowed rule group configuration is based on the type of rule
+                   the rule group is added to.
+        include_processes -- the changes performed by specific processes that will be monitored. (String).
+                   Falcon GLOB syntax is supported.
+                   macOS is not supported at this time.
+                   Allowed rule group configuration is based on the type of rule
+                   the rule group is added to.
+        exclude_users -- the changes performed by specific processes that will be NOT monitored. (String).
+                         Falcon GLOB syntax is supported.
+                         macOS is not supported at this time.
+                         Allowed rule group configuration is based on the type of rule
+                         the rule group is added to.
+        watch_delete_directory_changes -- File system directory monitoring. Boolean.
+        watch_create_directory_changes -- File system directory monitoring. Boolean.
+        watch_rename_directory_changes -- File system directory monitoring. Boolean.
+        watch_attributes_directory_changes -- File system directory monitoring. Boolean.
+                                              macOS is not supported at this time.
+        watch_permissions_directory_changes -- File system directory monitoring. Boolean.
+                                               macOS is not supported at this time.
+        watch_rename_file_changes -- File system file monitoring. Boolean.
+        watch_write_file_changes -- File system file monitoring. Boolean.
+        watch_create_file_changes -- File system file monitoring. Boolean.
+        watch_delete_file_changes -- File system file monitoring. Boolean.
+        watch_attributes_file_changes -- File system file monitoring. Boolean.
+                                         macOS is not supported at this time.
+        watch_permissions_file_changes -- File system file monitoring. Boolean.
+                                          macOS is not supported at this time.
+        watch_create_key_changes -- Windows registry key and value monitoring. Boolean.
+        watch_delete_key_changes -- Windows registry key and value monitoring. Boolean.
+        watch_rename_key_changes -- Windows registry key and value monitoring. Boolean.
+        watch_set_value_changes -- Windows registry key and value monitoring. Boolean.
+        watch_delete_value_changes -- Windows registry key and value monitoring. Boolean.
+        watch_create_file_changes -- Windows registry key and value monitoring. Boolean.
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: POST
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/createRules
+        """
+        if not body:
+            body = filevantage_rule_payload(passed_keywords=kwargs)
+
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="createRules",
+            keywords=kwargs,
+            body=body
+            )
+
+    @force_default(defaults=["parameters"], default_types=["dict"])
+    def delete_rules(self: object, parameters: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        """Delete one or more rules from the specified rule group.
+
+        Rules that match a provided ID will be deleted form the provided rule group ID.
+
+        Keyword arguments:
+        ids -- List of rule group IDs to delete. String or list of strings.
+        parameters -- full parameters payload, not required if other keywords are provided.
+        rule_group_id -- The ID of the rule group from which the rules will be deleted.
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: DELETE
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/deleteRules
+        """
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="deleteRules",
+            keywords=kwargs,
+            params=parameters
+            )
+
+    @force_default(defaults=["body"], default_types=["dict", "dict"])
+    def update_rule(self: object, body: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        r"""Update the provided rule configuration within the specified rule group.
+
+        The rule must exist within the specified rule group.
+
+        Keyword arguments:
+        body - full body payload in JSON format, not required if using other keywords.
+               {
+                   "created_timestamp": "string",
+                   "depth": "string",
+                   "description": "string",
+                   "exclude": "string",
+                   "exclude_processes": "string",
+                   "exclude_users": "string",
+                   "id": "string",
+                   "include": "string",
+                   "include_processes": "string",
+                   "include_users": "string",
+                   "modified_timestamp": "string",
+                   "path": "string",
+                   "precedence": 0,
+                   "rule_group_id": "string",
+                   "severity": "string",
+                   "type": "string",
+                   "watch_attributes_directory_changes": true,
+                   "watch_attributes_file_changes": true,
+                   "watch_create_directory_changes": true,
+                   "watch_create_file_changes": true,
+                   "watch_create_key_changes": true,
+                   "watch_delete_directory_changes": true,
+                   "watch_delete_file_changes": true,
+                   "watch_delete_key_changes": true,
+                   "watch_delete_value_changes": true,
+                   "watch_permissions_directory_changes": true,
+                   "watch_permissions_file_changes": true,
+                   "watch_rename_directory_changes": true,
+                   "watch_rename_file_changes": true,
+                   "watch_rename_key_changes": true,
+                   "watch_set_value_changes": true,
+                   "watch_write_file_changes": true
+               }
+        description -- The rule description. (String, 0-500 characters.)
+        id -- ID of the rule to be updated. (String)
+        rule_group_id -- Group ID containing the group configuration. (String)
+        path -- the file system or registry path to monitor. (String, 1-250 characters)
+                All paths must end with the path separator, e.g. c:\windows\ /usr/bin/
+        severity -- to categorize change events produced by this rule. (String)
+                    Allowed values: Low, Medium, High or Critical
+        depth -- recursion levels below the base path to monitor. (String)
+                 Allowed values: 1, 2, 3, 4, 5 or ANY
+        precedence -- the order in which rules will be evaluated starting with 1.
+                      Specifying a precedence value that is already set for another rule
+                      in the group will result this rule being placed before that existing rule.
+        include -- the files, directories, registry keys, or registry values that will be monitored. (String).
+                   Falcon GLOB syntax is supported.
+                   Allowed rule group configuration is based on the type of rule
+                   the rule group is added to.
+        exclude -- the files, directories, registry keys, or registry values that will NOT be monitored. (String).
+                   Falcon GLOB syntax is supported.
+                   Allowed rule group configuration is based on the type of rule
+                   the rule group is added to.
+        include_users -- the changes performed by specific users that will be monitored. (String).
+                   Falcon GLOB syntax is supported.
+                   macOS is not supported at this time.
+                   Allowed rule group configuration is based on the type of rule
+                   the rule group is added to.
+        exclude_users -- the changes performed by specific users that will NOT be monitored. (String).
+                   Falcon GLOB syntax is supported.
+                   macOS is not supported at this time.
+                   Allowed rule group configuration is based on the type of rule
+                   the rule group is added to.
+        include_processes -- the changes performed by specific processes that will be monitored. (String).
+                   Falcon GLOB syntax is supported.
+                   macOS is not supported at this time.
+                   Allowed rule group configuration is based on the type of rule
+                   the rule group is added to.
+        exclude_users -- the changes performed by specific processes that will be NOT monitored. (String).
+                         Falcon GLOB syntax is supported.
+                         macOS is not supported at this time.
+                         Allowed rule group configuration is based on the type of rule
+                         the rule group is added to.
+        watch_delete_directory_changes -- File system directory monitoring. Boolean.
+        watch_create_directory_changes -- File system directory monitoring. Boolean.
+        watch_rename_directory_changes -- File system directory monitoring. Boolean.
+        watch_attributes_directory_changes -- File system directory monitoring. Boolean.
+                                              macOS is not supported at this time.
+        watch_permissions_directory_changes -- File system directory monitoring. Boolean.
+                                               macOS is not supported at this time.
+        watch_rename_file_changes -- File system file monitoring. Boolean.
+        watch_write_file_changes -- File system file monitoring. Boolean.
+        watch_create_file_changes -- File system file monitoring. Boolean.
+        watch_delete_file_changes -- File system file monitoring. Boolean.
+        watch_attributes_file_changes -- File system file monitoring. Boolean.
+                                         macOS is not supported at this time.
+        watch_permissions_file_changes -- File system file monitoring. Boolean.
+                                          macOS is not supported at this time.
+        watch_create_key_changes -- Windows registry key and value monitoring. Boolean.
+        watch_delete_key_changes -- Windows registry key and value monitoring. Boolean.
+        watch_rename_key_changes -- Windows registry key and value monitoring. Boolean.
+        watch_set_value_changes -- Windows registry key and value monitoring. Boolean.
+        watch_delete_value_changes -- Windows registry key and value monitoring. Boolean.
+        watch_create_file_changes -- Windows registry key and value monitoring. Boolean.
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: PATCH
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/updateRules
+        """
+        if not body:
+            body = filevantage_rule_payload(passed_keywords=kwargs)
+
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="updateRules",
+            keywords=kwargs,
+            body=body
+            )
+
+    @force_default(defaults=["parameters"], default_types=["dict"])
+    def get_rule_groups(self: object, *args, parameters: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        """Retrieve the rule group details for one or more rule groups.
+
+        Full details of each rule group that matches a provided ID will be returned.
+
+        Keyword arguments:
+        ids -- List of rule group IDs to retrieve. String or list of strings.
+        parameters -- full parameters payload, not required if ids keyword is provided.
+
+        Arguments: When not specified, the first argument to this method is assumed to be 'ids'.
+                   All others are ignored.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: GET
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/getRuleGroups
+        """
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="getRuleGroups",
+            keywords=kwargs,
+            params=handle_single_argument(args, parameters, "ids")
+            )
+
+    @force_default(defaults=["body"], default_types=["dict", "dict"])
+    def create_rule_group(self: object, body: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        """Create a new rule group of the specified type.
+
+        Individual rules can be assigned to a rule group after it has been created.
+
+        Keyword arguments:
+        body - full body payload in JSON format, not required if using other keywords.
+               {
+                   "description": "string",
+                   "type": "string",
+                   "name": "string"
+               }
+        description -- The rule group description. (String, 0-500 characters.)
+        type -- The type of rule group. (String)
+                Allowed values: WindowsFiles, WindowsRegistry, LinuxFiles or MacFiles.
+        name -- Name of the rule group. (String, 1-100 characters.)
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: POST
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/createRuleGroups
+        """
+        if not body:
+            body = filevantage_rule_group_payload(passed_keywords=kwargs)
+
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="createRuleGroups",
+            keywords=kwargs,
+            body=body
+            )
+
+    @force_default(defaults=["parameters"], default_types=["dict"])
+    def delete_rule_groups(self: object, *args, parameters: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        """Delete a set of rule groups by specifying their IDs.
+
+        Keyword arguments:
+        ids -- List of rule group IDs to delete. String or list of strings.
+        parameters -- full parameters payload, not required if ids keyword is provided.
+
+        Arguments: When not specified, the first argument to this method is assumed to be 'ids'.
+                   All others are ignored.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: DELETE
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/deleteRuleGroups
+        """
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="deleteRuleGroups",
+            keywords=kwargs,
+            params=handle_single_argument(args, parameters, "ids")
+            )
+
+    @force_default(defaults=["body"], default_types=["dict"])
+    def update_rule_group(self: object, body: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        """Update the provided rule group.
+
+        Provides the ability to update the name and description of a rule group.
+
+        Keyword arguments:
+        body - full body payload in JSON format, not required if using other keywords.
+               {
+                   "description": "string",
+                   "id": "string",
+                   "name": "string"
+               }
+        description -- The rule group description. (String, 0-500 characters.)
+        id -- ID of the rule group to be updated. (String)
+        name -- Name of the rule group. (String, 1-100 characters.)
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: PATCH
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/updateRuleGroups
+        """
+        if not body:
+            body = filevantage_rule_group_payload(passed_keywords=kwargs)
+
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="updateRuleGroups",
+            keywords=kwargs,
+            body=body
+            )
+
     @force_default(defaults=["parameters"], default_types=["dict"])
     def query_changes(self: object, parameters: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
         """Search for changes within your environment. Returns one or more change IDs.
@@ -114,11 +976,175 @@ def query_changes(self: object, parameters: dict = None, **kwargs) -> Dict[str,
             params=parameters
             )
 
+    @force_default(defaults=["parameters"], default_types=["dict"])
+    def query_changes_scroll(self: object, parameters: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        """Search for changes within your environment. Returns one or more change IDs.
+
+        Returns a list of Falcon FileVantage change IDs filtered, sorted and limited by the query
+        parameters provided. An unlimited number of results can be retrieved using multiple requests.
+
+        Keyword arguments:
+        filter -- The filter expression that should be used to limit the results. FQL syntax.
+                  Available filters
+                  action_timestamp      ingestion_timestamp
+                  host.name
+        limit -- The maximum number of records to return. [Integer, 1-5000, Default: 100]
+        after -- A pagination token used with the `limit` parameter to manage pagination of results.
+                 On your first request don't provide a value for the `after` token. On subsequent
+                 requests provide the `after` token value from the previous response to continue
+                 pagination from where you left. If the response returns an empty `after` token
+                 it means there are no more results to return.
+        parameters - full parameters payload, not required if using other keywords.
+        sort -- The property to sort by. FQL syntax (e.g. status.desc or hostname.asc).
+                Available sort fields
+                action_timestamp        ingestion_timestamp
+
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: GET
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/highVolumeQueryChanges
+        """
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="highVolumeQueryChanges",
+            keywords=kwargs,
+            params=parameters
+            )
+
+    @force_default(defaults=["parameters"], default_types=["dict"])
+    def query_policies(self: object, parameters: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        """Retrieve the IDs of all rule groups that are of the provided rule group type.
+
+        Rule group ids will be returned sorted by created_timestamp order if a sort parameter
+        is not provided.
+
+        Keyword arguments:
+        limit -- The maximum number of ids to return. Defaults to 100 if not specified.
+                 (Integer, 1-500)
+        offset -- The first item to return, where 0 is the latest item. (Integer)
+                  Use with the limit parameter to manage pagination of results.
+        parameters - full parameters payload, not required if using other keywords.
+        sort -- The property to sort by. FQL syntax. (String)
+                Supported options: precedence, created_timestamp or modified_timestamp.
+                (e.g. created_timestamp|asc, modified_timestamp|desc, etc.)
+        type -- The type of policies to retrieve. (String)
+                Allowed values: Windows, Linux, or Mac.
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: GET
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/queryPolicies
+        """
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="queryPolicies",
+            keywords=kwargs,
+            params=parameters
+            )
+
+    @force_default(defaults=["parameters"], default_types=["dict"])
+    def query_scheduled_exclusions(self: object, *args, parameters: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        """Retrieve the IDs of all scheduled exclusions contained within the provided policy ID.
+
+        Use the IDs from this response to fetch the rules with get_rules.
+
+        Keyword arguments:
+        policy_id -- The ID of the policy to retrieve the scheduled exclusion IDs for. (String)
+
+        Arguments: When not specified, the first argument to this method is assumed to be
+                   'policy_ids'. All others are ignored.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: GET
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/queryScheduledExclusions
+        """
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="queryScheduledExclusions",
+            keywords=kwargs,
+            params=handle_single_argument(args, parameters, "policy_ids")
+            )
+
+    @force_default(defaults=["parameters"], default_types=["dict"])
+    def query_rule_groups(self: object, parameters: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        """Retrieve the IDs of all rule groups that are of the provided rule group type.
+
+        Rule group ids will be returned sorted by created_timestamp order if a sort parameter
+        is not provided.
+
+        Keyword arguments:
+        limit -- The maximum number of ids to return. Defaults to 100 if not specified.
+                 (Integer, 1-500)
+        offset -- The first item to return, where 0 is the latest item. (Integer)
+                  Use with the limit parameter to manage pagination of results.
+        parameters - full parameters payload, not required if using other keywords.
+        sort -- The property to sort by. FQL syntax. (String)
+                Supported options: created_timestamp or modified_timestamp.
+                (e.g. created_timestamp|asc, modified_timestamp|desc, etc.)
+        type -- The rule group type to retrieve the IDs for. (String)
+                Allowed values: WindowsFiles, WindowsRegistry, LinuxFiles, or MacFiles.
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: GET
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/filevantage/queryRuleGroups
+        """
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="queryRuleGroups",
+            keywords=kwargs,
+            params=parameters
+            )
+
     # This method name aligns to the operation ID in the API but
     # does not conform to snake_case / PEP8 and is defined here
     # for backwards compatibility / ease of use purposes
+    updatePolicyHostGroups = update_policy_host_groups
+    updatePolicyPrecedence = update_policy_precedence
+    updatePolicyRuleGroups = update_policy_rule_groups
+    getPolicies = get_policies
+    createPolicies = create_policy
+    deletePolicies = delete_policies
+    updatePolicies = update_policies
+    getScheduledExclusions = get_scheduled_exclusions
+    createScheduledExclusions = create_scheduled_exclusions
+    deleteScheduledExclusions = delete_scheduled_exclusions
+    updateScheduledExclusions = update_scheduled_exclusions
+    updateRuleGroupPrecedence = update_rule_group_precedence
+    getRules = get_rules
+    createRules = create_rule
+    deleteRules = delete_rules
+    updateRules = update_rule
+    getRuleGroups = get_rule_groups
+    createRuleGroups = create_rule_group
+    deleteRuleGroups = delete_rule_groups
+    updateRuleGroups = update_rule_group
     getChanges = get_changes
     queryChanges = query_changes
+    highVolumeQueryChanges = query_changes_scroll
+    queryRuleGroups = query_rule_groups
+    queryScheduledExclusions = query_scheduled_exclusions
+    queryPolicies = query_policies
 
 
 # The legacy name for this class does not conform to PascalCase / PEP8
diff --git a/src/falconpy/firewall_policies.py b/src/falconpy/firewall_policies.py
index 274eeb53b..4047609e8 100644
--- a/src/falconpy/firewall_policies.py
+++ b/src/falconpy/firewall_policies.py
@@ -131,8 +131,8 @@ def perform_action(self: object, body: dict = None, parameters: dict = None, **k
         """Perform the specified action on the Firewall Policies specified in the request.
 
         Keyword arguments:
-        action_name -- action to perform: 'add-host-group', 'disable', 'enable',
-                       or 'remove-host-group'.
+        action_name -- action to perform: 'add-host-group', 'add-rule-group', 'disable', 'enable',
+                       'remove-rule-group' or 'remove-host-group'.
         action_parameters -- Action specific parameter options. List of dictionaries.
                              {
                                  "name": "string",
diff --git a/src/falconpy/identity_protection.py b/src/falconpy/identity_protection.py
index 39e3c3691..c6a716497 100644
--- a/src/falconpy/identity_protection.py
+++ b/src/falconpy/identity_protection.py
@@ -37,6 +37,7 @@
 """
 from typing import Dict, Union
 from ._util import process_service_request, force_default
+from ._payload import aggregate_payload, generic_payload_list
 from ._service_class import ServiceClass
 from ._endpoint._identity_protection import _identity_protection_endpoints as Endpoints
 
@@ -97,11 +98,161 @@ def graphql(self: object, body: dict = None, **kwargs) -> Dict[str, Union[int, d
             body=body
             )
 
+    @force_default(defaults=["body"], default_types=["list"])
+    def get_sensor_aggregates(self: object, body: list = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        """Get sensor aggregates as specified via json in request body.
+
+        Keyword arguments:
+        body -- full body payload, not required when using other keywords.
+                [
+                    {
+                        "date_ranges": [
+                        {
+                            "from": "string",
+                            "to": "string"
+                        }
+                        ],
+                        "exclude": "string",
+                        "field": "string",
+                        "filter": "string",
+                        "from": 0,
+                        "include": "string",
+                        "interval": "string",
+                        "max_doc_count": 0,
+                        "min_doc_count": 0,
+                        "missing": "string",
+                        "name": "string",
+                        "q": "string",
+                        "ranges": [
+                        {
+                            "From": 0,
+                            "To": 0
+                        }
+                        ],
+                        "size": 0,
+                        "sort": "string",
+                        "sub_aggregates": [
+                            null
+                        ],
+                        "time_zone": "string",
+                        "type": "string"
+                    }
+                ]
+        date_ranges -- If peforming a date range query specify the from and to date ranges.
+                       These can be in common date formats like 2019-07-18 or now.
+                       List of dictionaries.
+        exclude -- Fields to exclude. String.
+        field -- Term you want to aggregate on. If doing a date_range query,
+                 this is the date field you want to apply the date ranges to. String.
+        filter -- Optional filter criteria in the form of an FQL query.
+                  For more information about FQL queries, see our FQL documentation in Falcon.
+                  String.
+        from -- Integer.
+        include -- Fields to include. String.
+        interval -- String.
+        max_doc_count -- Maximum number of documents. Integer.
+        min_doc_count -- Minimum number of documents. Integer.
+        missing -- String.
+        name -- Scan name. String.
+        q -- FQL syntax. String.
+        ranges -- List of dictionaries.
+        size -- Integer.
+        sort -- FQL syntax. String.
+        sub_aggregates -- List of strings.
+        time_zone -- String.
+        type -- String.
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: POST
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/identity-protection/GetSensorAggregates
+        """
+        if not body:
+            # Similar to 664: Detects aggregates expects a list
+            body = [aggregate_payload(submitted_keywords=kwargs)]
+
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="GetSensorAggregates",
+            body=body
+            )
+
+    @force_default(defaults=["body"], default_types=["dict"])
+    def get_sensor_details(self: object, body: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        """Get details on one or more sensors by providing device IDs.
+
+        Keyword arguments:
+        body -- full body payload, not required if ids are provided as keyword.
+                {
+                    "ids": [
+                        "string"
+                    ]
+                }
+        ids -- Sensor ID(s) to retrieve. String or list of strings.  (Max: 5,000)
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: POST
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/identity-protection/GetSensorDetails
+        """
+        if not body:
+            body = generic_payload_list(submitted_keywords=kwargs, payload_value="ids")
+
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="GetSensorDetails",
+            body=body
+            )
+
+    @force_default(defaults=["parameters"], default_types=["dict"])
+    def query_sensors(self: object, parameters: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        """Search for sensors in your environment by providing hostname, IP, and other criteria.
+
+        Keyword arguments:
+        filter -- The filter expression that should be used to limit the results. FQL syntax.
+        limit -- The maximum number of records to return in this response. [Integer, 1-200]
+                 Use with the offset parameter to manage pagination of results.
+        offset -- The offset to start retrieving records from. Integer.
+                  Use with the limit parameter to manage pagination of results.
+        parameters - full parameters payload, not required if using other keywords.
+        sort -- The property to sort by. FQL syntax. Ex: hostanme.desc or status.asc
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: GET
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/identity-protections/QuerySensorsByFilter
+        """
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="QuerySensorsByFilter",
+            keywords=kwargs,
+            params=parameters
+            )
+
     # This method name aligns to the operation ID in the API but
     # does not conform to snake_case / PEP8 and is defined here
     # for backwards compatibility / ease of use purposes
     GraphQL = graphql
     api_preempt_proxy_post_graphql = graphql
+    GetSensorAggregates = get_sensor_aggregates
+    GetSensorDetails = get_sensor_details
+    QuerySensorsByFilter = query_sensors
+    query_sensors_by_filter = query_sensors
 
 
 # The legacy name for this class does not conform to PascalCase / PEP8
diff --git a/src/falconpy/incidents.py b/src/falconpy/incidents.py
index bd42f8453..02559b2ec 100644
--- a/src/falconpy/incidents.py
+++ b/src/falconpy/incidents.py
@@ -131,6 +131,7 @@ def perform_incident_action(self: object,
 
         Keyword arguments:
         action_parameters -- Action specific parameters. List of dictionaries.
+        add_comment -- Adds the provided value as a new comment on all the incidents in the ids list. String.
         add_tag -- Adds the associated value as a new tag on all the incidents of the ids list.
                    Overridden if action_parameters is specified. Multiple values may be provided.
                    String, comma delimited string, or list.
diff --git a/src/falconpy/intel.py b/src/falconpy/intel.py
index 239beb5be..3d9141516 100644
--- a/src/falconpy/intel.py
+++ b/src/falconpy/intel.py
@@ -343,9 +343,11 @@ def get_report_pdf(self: object, *args, parameters: dict = None, **kwargs) -> ob
 
         Keyword arguments:
         id -- One or more actor IDs. String or list of strings.
+        ids -- The ID of the report you want to download as a PDF.
+               This parameter is used only if no id parameter given. String.
         parameters - full parameters payload, not required if id is provided as a keyword.
 
-        Arguments: When not specified, the first argument to this method is assumed to be 'id'.
+        Arguments: When not specified, the first argument to this method is assumed to be 'ids'.
                    All others are ignored.
 
         Returns: binary object on SUCCESS, dict object containing API response on FAILURE.
@@ -360,7 +362,7 @@ def get_report_pdf(self: object, *args, parameters: dict = None, **kwargs) -> ob
             endpoints=Endpoints,
             operation_id="GetIntelReportPDF",
             keywords=kwargs,
-            params=handle_single_argument(args, parameters, "id")
+            params=handle_single_argument(args, parameters, "ids")
             )
 
     @force_default(defaults=["parameters"], default_types=["dict"])
@@ -424,6 +426,10 @@ def get_latest_rule_file(self: object, *args, parameters: dict = None, **kwargs)
         """Download the latest rule set.
 
         Keyword arguments:
+        if_none_match -- Download the latest rule set only if it doesn't have an ETag
+                             matching the given ones. String.
+        if_modified_since -- Download the latest rule set only if the rule was modified after this date.
+                             http, ANSIC and RFC850 formats accepted. String.
         format -- Choose the format you want the rule set in. Either zip or gzip. Defaults to zip.
         parameters - full parameters payload, not required if other keywords are used.
         type -- The rule news report type. The following values are accepted:
@@ -442,11 +448,18 @@ def get_latest_rule_file(self: object, *args, parameters: dict = None, **kwargs)
         Swagger URL
         https://assets.falcon.crowdstrike.com/support/api/swagger.html#/intel/GetLatestIntelRuleFile
         """
+        headers = {}
+        if kwargs.get("if_none_match", None):
+            headers["If-None-Match"] = kwargs.get("if_none_match")
+        if kwargs.get("if_modified_since", None):
+            headers["If-Modified-Since"] = kwargs.get("if_modified_since")
+
         return process_service_request(
             calling_object=self,
             endpoints=Endpoints,
             operation_id="GetLatestIntelRuleFile",
             keywords=kwargs,
+            headers=headers,
             params=handle_single_argument(args, parameters, "type")
             )
 
@@ -575,9 +588,11 @@ def query_mitre_attacks(self: object, *args, parameters: dict = None, **kwargs)
 
         Keyword arguments:
         id -- Actor ID, derived from the actor name. (Example: fancy-bear) String.
+        ids -- The actor ID(derived from the actor's name) for which to retrieve a list of attacks.
+               Example: fancy-bear. Multiple values are allowed. List of strings.
         parameters - full parameters payload, not required if using `id` keyword.
 
-        Arguments: When not specified, the first argument to this method is assumed to be 'id'.
+        Arguments: When not specified, the first argument to this method is assumed to be 'ids'.
                    All others are ignored.
 
         Returns: dict object containing API response.
@@ -592,7 +607,7 @@ def query_mitre_attacks(self: object, *args, parameters: dict = None, **kwargs)
             endpoints=Endpoints,
             operation_id="QueryMitreAttacks",
             keywords=kwargs,
-            params=handle_single_argument(args, parameters, "id")
+            params=handle_single_argument(args, parameters, "ids")
             )
 
     @force_default(defaults=["parameters"], default_types=["dict"])
diff --git a/src/falconpy/mssp.py b/src/falconpy/mssp.py
index d93157875..7aa736cda 100644
--- a/src/falconpy/mssp.py
+++ b/src/falconpy/mssp.py
@@ -220,9 +220,12 @@ def add_cid_group_members(self: object, body: dict = None, **kwargs) -> Dict[str
             )
 
     @force_default(defaults=["body"], default_types=["dict"])
-    def delete_cid_group_members(self: object, body: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+    def delete_cid_group_members_v1(self: object, body: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
         """Delete CID Group members entry.
 
+        *DEPRECATED*
+        Please use delete_cid_group_members.
+
         Keyword arguments:
         body -- full body payload, not required if sha256 is provided as a keyword.
                 {
@@ -260,6 +263,47 @@ def delete_cid_group_members(self: object, body: dict = None, **kwargs) -> Dict[
             body=body
             )
 
+    @force_default(defaults=["body"], default_types=["dict"])
+    def delete_cid_group_members(self: object, body: dict = None, **kwargs) -> Dict[str, Union[int, dict]]:
+        """Delete CID Group members entry.
+
+        Keyword arguments:
+        body -- full body payload, not required if sha256 is provided as a keyword.
+                {
+                    "resources": [
+                        {
+                            "cid_group_id": "string",
+                            "cids": [
+                                "string"
+                            ]
+                        }
+                    ]
+                }
+        cid_group_id -- ID of the CID group to update. String.
+        cids -- CIDs to remove from the group. String or list of strings.
+
+        This method only supports keywords for providing arguments.
+
+        Returns: dict object containing API response.
+
+        HTTP Method: DELETE
+
+        Swagger URL
+        https://assets.falcon.crowdstrike.com/support/api/swagger.html#/mssp/deleteCIDGroupMembers
+        """
+        if not body:
+            item = generic_payload_list(submitted_keywords=kwargs, payload_value="cids")
+            if kwargs.get("cid_group_id", None):
+                item["cid_group_id"] = kwargs.get("cid_group_id", None)
+            body["resources"] = [item]
+
+        return process_service_request(
+            calling_object=self,
+            endpoints=Endpoints,
+            operation_id="deleteCIDGroupMembersV2",
+            body=body
+            )
+
     @force_default(defaults=["parameters"], default_types=["dict"])
     def get_cid_group_by_id_v1(self: object, *args, parameters: dict = None, **kwargs) -> dict:
         """Get CID Group(s) by ID(s).
@@ -1060,6 +1104,8 @@ def query_user_groups(self: object, parameters: dict = None, **kwargs) -> Dict[s
     getCIDGroupMembersByV2 = get_cid_group_members_by
     addCIDGroupMembers = add_cid_group_members
     deleteCIDGroupMembers = delete_cid_group_members
+    deleteCIDGroupMembersV1 = delete_cid_group_members_v1
+    deleteCIDGroupMembersV2 = delete_cid_group_members
     getCIDGroupById = get_cid_group_by_id
     getCIDGroupByIdV1 = get_cid_group_by_id_v1
     getCIDGroupByIdV2 = get_cid_group_by_id
diff --git a/util/README.md b/util/README.md
index 769a4fdd9..9bc46f879 100644
--- a/util/README.md
+++ b/util/README.md
@@ -1,4 +1,6 @@
-![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)<br/>[![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)](https://twitter.com/CrowdStrike)<br/>
+![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
+
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # Utilities
 These scripts are meant to assist developers working on FalconPy, the CrowdStrike Falcon SDK for Python, and are mostly focused on automating tasks that have to be performed consistently.


Test patch:
diff --git a/tests/README.md b/tests/README.md
index eaa8344b5..a9ffd1752 100644
--- a/tests/README.md
+++ b/tests/README.md
@@ -1,6 +1,6 @@
 ![CrowdStrike Falcon](https://raw.githubusercontent.com/CrowdStrike/falconpy/main/docs/asset/cs-logo.png)
 
-[![Twitter URL](https://img.shields.io/twitter/url?label=Follow%20%40CrowdStrike&style=social&url=https%3A%2F%2Ftwitter.com%2FCrowdStrike)](https://twitter.com/CrowdStrike)
+[![CrowdStrike Subreddit](https://img.shields.io/badge/-r%2Fcrowdstrike-white?logo=reddit&labelColor=gray&link=https%3A%2F%2Freddit.com%2Fr%2Fcrowdstrike)](https://reddit.com/r/crowdstrike)
 
 # FalconPy Unit Testing
 The contents of this folder are used to unit test the FalconPy code base.
diff --git a/tests/test_cloud_snapshots.py b/tests/test_cloud_snapshots.py
new file mode 100644
index 000000000..ee474f39e
--- /dev/null
+++ b/tests/test_cloud_snapshots.py
@@ -0,0 +1,47 @@
+"""
+test_cloud_snapshots.py - This class tests the CloudSnapshots service class
+"""
+import os
+import sys
+import pytest
+# Authentication via the test_authorization.py
+from tests import test_authorization as Authorization
+# Import our sibling src folder into the path
+sys.path.append(os.path.abspath('src'))
+# Classes to test - manually imported from sibling folder
+from falconpy import CloudSnapshots, APIHarness
+
+auth = Authorization.TestAuthorization()
+config = auth.getConfigObject()
+falcon = CloudSnapshots(auth_object=config)
+
+AllowedResponses = [200, 201, 204, 400, 404, 429]  # Allowing no content returned as code paths are confirmed
+
+
+class TestCloudSnapshots:
+    def run_tests(self):
+        error_checks = True
+
+        tests = {
+            "RegisterAccount": falcon.register_account(aws_accounts=[{"account_number": "1"}]),
+            "RegisterAccountToo": falcon.register_account(account_number="12345678"),
+            "CreateInventory": falcon.create_inventory(job_metadata={"cloud_provider": "aws"}, result=[{"major_version": "1"}]),
+            "CreateInventoryAlso": falcon.create_inventory(cloud_provider="aws", major_version="1", os_version="12"),
+            "CreateInventoryAsWell": falcon.create_inventory(results={"applications":[]}),
+            "CreateInventoryTheFourth": falcon.create_inventory(applications=[{"major_version": "42"}])
+        }
+        for key in tests:
+            if tests[key]["status_code"] not in AllowedResponses:
+                error_checks = False
+                # print(tests[key])
+                # print(f"{key} operation returned a {tests[key]['status_code']} status code")
+
+        return error_checks
+
+    def test_get_credentials(self):
+        """Pytest harness hook"""
+        assert bool(falcon.get_credentials()["status_code"] in AllowedResponses) is True
+
+    def test_remaining_code_paths(self):
+        """Pytest harness hook"""
+        assert self.run_tests() is True
diff --git a/tests/test_falcon_complete_dashboard.py b/tests/test_falcon_complete_dashboard.py
index 62d23a603..6ecba0fc5 100644
--- a/tests/test_falcon_complete_dashboard.py
+++ b/tests/test_falcon_complete_dashboard.py
@@ -17,6 +17,13 @@
 
 
 class TestFalconCompleteDashboard:
+    def ServiceFCD_QueryAlertIdsByFilter(self):
+        returned = False
+        if falcon.QueryAlertIdsByFilter()["status_code"] in AllowedResponses:
+            returned = True
+
+        return returned
+
     def ServiceFCD_QueryAllowListFilter(self):
         returned = False
         if falcon.QueryAllowListFilter()["status_code"] in AllowedResponses:
@@ -70,6 +77,7 @@ def ServiceFCD_GenerateErrors(self):
         falcon.base_url = "nowhere"
         error_checks = True
         tests = {
+            "AggregateAlerts": falcon.aggregate_alerts(),
             "AggregateAllowList": falcon.aggregate_allow_list(),
             "AggregateBlockList": falcon.aggregate_block_list(),
             "AggregateDetections": falcon.aggregate_detections(),
@@ -85,6 +93,9 @@ def ServiceFCD_GenerateErrors(self):
 
         return error_checks
 
+    def test_QueryAlertIdsByFilter(self):
+        assert self.ServiceFCD_QueryAlertIdsByFilter() is True
+
     def test_QueryAllowListFilter(self):
         assert self.ServiceFCD_QueryAllowListFilter() is True
 
diff --git a/tests/test_falcon_container.py b/tests/test_falcon_container.py
index 402a22fcb..c255f08a9 100644
--- a/tests/test_falcon_container.py
+++ b/tests/test_falcon_container.py
@@ -27,6 +27,7 @@ def run_tests(self):
 
         tests = {
             "GetAssessment": falcon.get_assessment(repository="misp", tag="latest"),
+            "GetCombinedImages": falcon.get_combined_images(),
             "DeleteImageDetails": falcon.delete_image_details("whatever"),
             "ImageMatchesPolicy": falcon.image_matches_policy(repository="whatever", tag="whatever", body={}),
             "GetAssessmentUber": uber.command("GetImageAssessmentReport", repository="misp", tag="latest"),
diff --git a/tests/test_filevantage.py b/tests/test_filevantage.py
index 345432025..0c1779777 100644
--- a/tests/test_filevantage.py
+++ b/tests/test_filevantage.py
@@ -15,7 +15,7 @@
 auth = Authorization.TestAuthorization()
 config = auth.getConfigObject()
 falcon = FileVantage(auth_object=config)
-AllowedResponses = [200, 202, 429]  # Adding rate-limiting as an allowed response for now
+AllowedResponses = [200, 202, 400, 404, 429]  # Adding rate-limiting as an allowed response for now
 
 
 class TestFileVantage:
@@ -29,6 +29,13 @@ def test_query_changes(self):
         """Pytest harness hook"""
         assert bool(falcon.query_changes(limit=1)["status_code"] in AllowedResponses) is True
 
+    @pytest.mark.skipif(config.base_url == "https://api.laggar.gcw.crowdstrike.com",
+                        reason="Unit testing unavailable on US-GOV-1"
+                        )
+    def test_query_changes_scroll(self):
+        """Pytest harness hook"""
+        assert bool(falcon.query_changes_scroll(limit=1)["status_code"] in AllowedResponses) is True
+
     @pytest.mark.skipif(config.base_url == "https://api.laggar.gcw.crowdstrike.com",
                         reason="Unit testing unavailable on US-GOV-1"
                         )
@@ -38,3 +45,46 @@ def test_get_changes(self):
         assert bool(
             falcon.get_changes("12345678")["status_code"] in AllowedResponses
         ) is True
+
+    def service_filevantage_remaining_tests(self):
+
+        error_checks = True
+        tests = {
+            "update_policy_host_groups": falcon.update_policy_host_groups(policy_id="12345678", ids="1", action="unassign"),
+            "update_policy_precedence": falcon.update_policy_precedence(ids="12345678", type="Windows"),
+            "update_policy_rule_groups": falcon.update_policy_rule_groups(ids="12345678", policy_id="9876543"),
+            "get_policies": falcon.get_policies(ids="12345678"),
+            "create_policy": falcon.create_policy(name="whatevers", enabled=False),
+            "delete_policies": falcon.delete_policies("12345678"),
+            "update_policies": falcon.update_policies(id="12345678", description="whatevs", name="whatevs"),
+            "get_scheduled_exclusions": falcon.get_scheduled_exclusions(ids="12345678", policy_id="12345678"),
+            "create_scheduled_exclusions": falcon.create_scheduled_exclusions(name="whatevers"),
+            "delete_scheduled_exclusions": falcon.delete_scheduled_exclusions(ids="12345678", policy_id="12345678"),
+            "update_scheduled_exclusions": falcon.update_scheduled_exclusions(),
+            "update_rule_group_precedence": falcon.update_rule_group_precedence(ids="1,2,3,4", rule_group_id="12345678"),
+            "get_rules": falcon.get_rules(ids="12345678", rule_group_id="12345678"),
+            "create_rule": falcon.create_rule(watch_attributes_directory_changes=True, description="whatevers"),
+            "delete_rule": falcon.delete_rules(ids="12345678", rule_group_id="12345678"),
+            "update_rule": falcon.update_rule(),
+            "get_rule_groups": falcon.get_rule_groups("12345678"),
+            "create_rule_group": falcon.create_rule_group(name="Whatevers"),
+            "delete_rule_groups": falcon.delete_rule_groups("12345678"),
+            "update_rule_group" : falcon.update_rule_group(),
+            "query_policies": falcon.query_policies(),
+            "query_scheduled_exclusions": falcon.query_scheduled_exclusions(),
+            "query_rule_groups": falcon.query_rule_groups(type="WindowsFiles")
+        }
+        for key in tests:
+            if tests[key]["status_code"] not in AllowedResponses:
+                # print(f"{key}: {tests[key]}")
+                error_checks = False
+
+        return error_checks
+
+    @pytest.mark.skipif(falcon.base_url.lower() == "https://api.laggar.gcw.crowdstrike.com", reason="Unit test not supported in GovCloud")
+    def test_remaining_functionality(self):
+        assert self.service_filevantage_remaining_tests() is True
+
+    @pytest.mark.skipif(falcon.base_url.lower() == "https://api.laggar.gcw.crowdstrike.com", reason="Unit test not supported in GovCloud")
+    def test_override_style(self):
+        assert bool(falcon.override(method="PATCH", route="/filevantage/entities/policies-host-groups/v1",body={}, parameters={"policy_id":"12345678","action": "unassign","ids":["12345678"]})["status_code"] in AllowedResponses)
\ No newline at end of file
diff --git a/tests/test_identity_protection.py b/tests/test_identity_protection.py
index 2ad11d5c4..9f15e1dc9 100644
--- a/tests/test_identity_protection.py
+++ b/tests/test_identity_protection.py
@@ -16,7 +16,7 @@
 config = auth.getConfigObject()
 
 falcon = IdentityProtection(auth_object=config)
-AllowedResponses = [200, 429]
+AllowedResponses = [200, 400, 429]
 
 TEST_QUERY = """
 query ($after: Cursor) {
@@ -68,3 +68,22 @@ def idp_graphql(self):
     def test_graphql(self):
         assert self.idp_graphql() is True
 
+
+    def service_idp_remaining_tests(self):
+        if falcon.base_url.lower() != "https://api.crowdstrike.com":
+            pytest.skip("Identity protection testing is not supported in this region")
+        error_checks = True
+        tests = {
+            "GetSensorAggregates": falcon.get_sensor_aggregates(date_ranges=[{}]),
+            "GetSensorDetails": falcon.get_sensor_details(ids="12345678"),
+            "QuerySensorsByFilter": falcon.query_sensors(limit=1)
+        }
+        for key in tests:
+            if tests[key]["status_code"] not in AllowedResponses:
+                # print(f"{key}: {tests[key]}")
+                error_checks = False
+
+        return error_checks
+
+    def test_remaining_functionality(self):
+        assert self.service_idp_remaining_tests() is True
\ No newline at end of file
diff --git a/tests/test_incidents.py b/tests/test_incidents.py
index 6511f4ae4..d9f6f4b91 100644
--- a/tests/test_incidents.py
+++ b/tests/test_incidents.py
@@ -73,6 +73,7 @@ def serviceIncidents_GenerateErrors(self):
             ["PerformIncidentAction", falcon.perform_incident_action(action_parameters=[
                 {"name": "whatever", "value": "something"}
                 ],
+                add_comment="Something",
                 add_tag="Something",
                 delete_tag="something",
                 update_name="something",
diff --git a/tests/test_intel.py b/tests/test_intel.py
index 78ed8bb97..29e377723 100644
--- a/tests/test_intel.py
+++ b/tests/test_intel.py
@@ -29,7 +29,7 @@ def intel_test_all_code_paths(self):
             "get_intel_report_pdf": falcon.GetIntelReportPDF(parameters={}),
             "get_intel_report_entities": falcon.GetIntelReportEntities(ids='12345678'),
             "get_intel_rule_file": falcon.GetIntelRuleFile(parameters={}),
-            "get_latest_intel_rule_file": falcon.GetLatestIntelRuleFile(parameters={}),
+            "get_latest_intel_rule_file": falcon.GetLatestIntelRuleFile(parameters={}, if_none_match="whatevs", if_modified_since="01/01/2020"),
             "get_intel_rule_entities": falcon.GetIntelRuleEntities(ids='12345678'),
             "query_intel_actor_ids": falcon.QueryIntelActorIds(),
             "query_intel_indicator_ids": falcon.QueryIntelIndicatorIds(limit=5),
diff --git a/tests/test_mssp.py b/tests/test_mssp.py
index 5ce252e00..5623a3ac9 100644
--- a/tests/test_mssp.py
+++ b/tests/test_mssp.py
@@ -26,7 +26,8 @@ def serviceFlight_GenerateErrors(self):
             "getCIDGroupMembersByV1": falcon.get_cid_group_members_by_v1(cid_group_ids='12345678'),
             "getCIDGroupMembersByV2": falcon.get_cid_group_members_by(cid_group_ids='12345678'),
             "addCIDGroupMembers": falcon.add_cid_group_members(cid_group_id="12345678"),
-            "deleteCIDGroupMembers": falcon.delete_cid_group_members(cid_group_id="12345678"),
+            "deleteCIDGroupMembersV1": falcon.delete_cid_group_members_v1(cid_group_id="12345678"),
+            "deleteCIDGroupMembersV2": falcon.delete_cid_group_members(cid_group_id="12345678"),
             "getCIDGroupByIdV1": falcon.get_cid_group_by_id_v1(cid_group_ids='12345678'),
             "getCIDGroupByIdV2": falcon.get_cid_group_by_id(cid_group_ids='12345678'),
             "createCIDGroups": falcon.create_cid_groups(body={}),
diff --git a/tests/test_result_object.py b/tests/test_result_object.py
index 6647243f4..3cf2cbd9a 100644
--- a/tests/test_result_object.py
+++ b/tests/test_result_object.py
@@ -5,6 +5,7 @@
 import sys
 import pytest
 import hashlib
+import warnings
 # Authentication via the test_authorization.py
 from tests import test_authorization as Authorization
 
@@ -24,7 +25,8 @@
     BaseResource,
     Errors,
     SampleUploads,
-    CSPMRegistration
+    CSPMRegistration,
+    UnnecessaryEncodingUsed
     )
 from falconpy._result._base_dictionary import UnsupportedPythonVersion
 
@@ -728,3 +730,17 @@ def test_unusual_response_formatting(self):
         if isinstance(result, dict):
             _returned = True
         assert _returned
+
+    @not_supported
+    def test_unnecessary_encoding_used_warning(self):
+        with pytest.warns(UnnecessaryEncodingUsed):
+            # warnings.warn("Debug", UnnecessaryEncodingUsed)
+            _success = True
+            try:
+                hosts = Hosts(auth_object=config, pythonic=True)
+                hosts.query_devices_by_filter_scroll(filter="hostname%3A%27falconpy%27")
+            except APIError:
+                _success = True
+            hosts = Hosts(auth_object=hosts, pythonic=False)
+            hosts.query_devices_by_filter_scroll(filter="hostname%3A%27falconpy%27")
+            assert _success
\ No newline at end of file
diff --git a/tests/test_uber_api_complete.py b/tests/test_uber_api_complete.py
index 420c6dc64..16bb2e5d9 100644
--- a/tests/test_uber_api_complete.py
+++ b/tests/test_uber_api_complete.py
@@ -12,7 +12,7 @@
 # flake8: noqa=E402
 # pylint: disable=C0103
 # Classes to test - manually imported from our sibling folder
-from falconpy import APIHarness
+from falconpy import APIHarness, APIError
 # Import perform_request from _util so we can test generating 405's directly
 from falconpy._util import perform_request, force_default
 
@@ -354,8 +354,7 @@ def test_uber_deprecated_attributes(self):
 
     def test_uber_properties(self):
         # Force a new object so we can flip the debug flag
-        temp_falcon = APIHarness(client_id=config["falcon_client_id"],
-                                 client_secret=config["falcon_client_secret"],
+        temp_falcon = APIHarness(access_token=falcon.token_value,
                                  base_url=config["falcon_base_url"],
                                  debug=True
                                  )
@@ -369,3 +368,16 @@ def test_uber_revoke_success(self):
         assert(bool(
             falcon.command("oauth2RevokeToken", token_value=falcon.token_value)["status_code"]==200
             ))
+
+    def test_pythonic_failure(self):
+        _success = False
+        new_falcon = APIHarness(access_token=falcon.token_value,
+                            base_url=config["falcon_base_url"],
+                            debug=_DEBUG,
+                            pythonic=True
+                            )
+        try:
+            new_falcon.command("GetDeviceDetails", ids="12345678")
+        except APIError:
+            _success = True
+        assert _success