This is a bugfix release with minor changes:

* Cb Response

* Add ``partition_operations.py`` script to demonstrate the use of the StoragePartition model object.

* Fix errors when accessing the ``.start`` attribute of child processes.

* Fix errors generated by the ``walk_children.py`` example script. The output has been changed as well to indicate

``create_process`` method will now wait for the target process to complete before returning.

* Cb Defense

* Add ``wait_for_completion`` flag to ``create_process`` Live Response method, and default to ``True``. The

``create_process`` method will now wait for the target process to complete before returning.

Other changes:

* Cb Protection

* You can now create new ``FileRule`` and ``Policy`` model objects in cbapi.

* Cb Response

* Added ``watchlist_exporter.py`` and ``watchlist_importer.py`` scripts to the Cb Response examples directory.

These scripts allow you to export Watchlist data in a human- and machine-readable JSON format and then re-import them into another Cb Response server.

* The ``Sensor`` Model Object now uses the non-paginated (v1) API by default. This fixes any issues encountered when

``Process`` Model Object.

* Retrieve all events for a process when using ``segment`` ID of zero on a Cb Response 6.1 server.

* Behavior of ``Process.children`` attribute has changed:

* Only one entry is present per child (before there were up to two; one for the spawn event, one for the

terminate event)

* The timestamp is derived from the start time of the process, not the timestamp from the spawn event.

the two timestamps will be off by a few microseconds.

* The old behavior is still available by using the ``Process.childprocs`` attribute instead. This incurs a

performance penalty as another API call will have to be made to collect the childproc information.

* ``Binary`` Model Object now returns False for ``.is_signed`` attribute if it is set to ``(Unknown)``.

* Moved the ``six`` Python module into cbapi and removed the external dependency.

Other changes:

* Cb Response

* New method ``synchronize()`` added to the ``Feed`` Model Object

* Bug fixes and documentation improvements

* Add ``.all_events`` property to the ``Process`` Model Object to expose a list of all events across all segments.

* Add example script to perform auto-banning based on watchlist hits from Cb Event Forwarder S3 output files.

* Add bulk operations to the ``ThreatReport`` and ``Alert`` Query objects:

* You can now call ``.set_ignored()``, ``.assign()``, and ``.change_status()`` on an ``Alert`` Query object to change

the respective fields for every Alert that matches the query.

* You can now call ``.set_ignored()`` on a ``ThreatReport`` Query object to set or clear the ignored flag for every

CbAPI and Live Response

Black's REST APIs, cbapi provides Pythonic APIs to make working with the Live Response API much easier.

In addition to easy-to-use APIs to call into Live Response, cbapi also provides a "job-based" interface that allows

concurrent Live Response session slots (by default, only ten). By wrapping the ``.lr_session()``

A full listing of methods in the cbapi Live Response API is available in the documentation for

Live Response Errors

Live Response

File Operations

Registry Operations

Process Operations