Add payload handler for incident action_parameters

Relates to #647.

src/falconpy/_payload/__init__.py

@@ -26,6 +26,7 @@
 from ._recon import recon_notifications_payload, recon_rule_preview_payload
 from ._malquery import malquery_exact_search_payload, malquery_hunt_payload, malquery_fuzzy_payload
 from ._detects import update_detects_payload
+from ._incidents import incident_action_parameters
 from ._ioa import ioa_exclusion_payload, ioa_custom_payload
 from ._prevention_policy import prevention_policy_payload
 from ._sensor_update_policy import sensor_policy_payload
@@ -56,5 +57,5 @@
     "cspm_policy_payload", "cspm_scan_payload", "device_policy_payload", "falconx_payload",
     "mssp_payload", "ioa_custom_payload", "firewall_policy_payload", "firewall_container_payload",
     "firewall_rule_group_payload", "firewall_rule_group_update_payload", "reports_payload",
-    "activity_payload", "case_payload"
+    "activity_payload", "case_payload", "incident_action_parameters"
 ]

src/falconpy/_payload/_incidents.py

@@ -0,0 +1,89 @@
+"""Internal payload handling library - Incident Payloads.
+
+ _______                        __ _______ __        __ __
+|   _   .----.-----.--.--.--.--|  |   _   |  |_.----|__|  |--.-----.
+|.  1___|   _|  _  |  |  |  |  _  |   1___|   _|   _|  |    <|  -__|
+|.  |___|__| |_____|________|_____|____   |____|__| |__|__|__|_____|
+|:  1   |                         |:  1   |
+|::.. . |   CROWDSTRIKE FALCON    |::.. . |    FalconPy
+`-------'                         `-------'
+
+OAuth2 API - Customer SDK
+
+This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
+
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <https://unlicense.org>
+"""
+
+
+def incident_action_parameters(passed_keywords: dict) -> dict:
+    """Create a properly formatted action_parameters branch for incident action payload operations.
+
+    Available keywords
+    add_tag - Adds the associated value as a new tag on all the incidents of the ids list.
+    delete_tag - Deletes tags matching the value from all the incidents in the ids list
+    unassign - Unassigns all users from all of the incidents in the ids list.
+               This action does not require a value parameter. For example:
+               "action_parameters": [
+                    {
+                        "name": "unassign"
+                    }
+                ]
+    update_name - Updates the name to the parameter value of all the incidents in the ids list.
+    update_assigned_to_v2 - Assigns the user matching the UUID in the parameter value to all of
+                            the incidents in the ids list.
+                            For information on getting the UUID of a user, see Find existing users.
+    update_description - Updates the description to the parameter value of all the incidents listed in the ids list.
+    update_status - Updates the status to the parameter value of all the incidents in the ids list.
+                    Valid status values are 20, 25, 30, or 40:
+                        20: New
+                        25: Reopened
+                        30: In Progress
+                        40: Closed
+    [
+        {
+            "name": "string",
+            "value": "string"
+        },
+        {
+            "name": "string",
+            "value": "string"
+        },
+        etc.
+    ]
+    """
+    returned_payload = []
+    valid_keywords = [
+        "add_tag", "delete_tag", "unassign", "update_name", "update_assigned_to_v2"
+        "update_description", "update_status"
+        ]
+    for key, val in passed_keywords.items():
+        if key in valid_keywords:
+            act_param = {
+                "name": key,
+                "value": val
+            }
+            returned_payload.append(act_param)
+
+    return returned_payload