binalyze-air-sdk 1.0.1__py3-none-any.whl → 1.0.3__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (142) hide show
  1. binalyze_air/__init__.py +77 -77
  2. binalyze_air/apis/__init__.py +67 -27
  3. binalyze_air/apis/acquisitions.py +107 -0
  4. binalyze_air/apis/api_tokens.py +49 -0
  5. binalyze_air/apis/assets.py +161 -0
  6. binalyze_air/apis/audit_logs.py +26 -0
  7. binalyze_air/apis/{authentication.py → auth.py} +29 -27
  8. binalyze_air/apis/auto_asset_tags.py +79 -75
  9. binalyze_air/apis/backup.py +177 -0
  10. binalyze_air/apis/baseline.py +46 -0
  11. binalyze_air/apis/cases.py +225 -0
  12. binalyze_air/apis/cloud_forensics.py +116 -0
  13. binalyze_air/apis/event_subscription.py +96 -96
  14. binalyze_air/apis/evidence.py +249 -53
  15. binalyze_air/apis/interact.py +153 -36
  16. binalyze_air/apis/investigation_hub.py +234 -0
  17. binalyze_air/apis/license.py +104 -0
  18. binalyze_air/apis/logger.py +83 -0
  19. binalyze_air/apis/multipart_upload.py +201 -0
  20. binalyze_air/apis/notifications.py +115 -0
  21. binalyze_air/apis/organizations.py +267 -0
  22. binalyze_air/apis/params.py +44 -39
  23. binalyze_air/apis/policies.py +186 -0
  24. binalyze_air/apis/preset_filters.py +79 -0
  25. binalyze_air/apis/recent_activities.py +71 -0
  26. binalyze_air/apis/relay_server.py +104 -0
  27. binalyze_air/apis/settings.py +395 -27
  28. binalyze_air/apis/tasks.py +80 -0
  29. binalyze_air/apis/triage.py +197 -0
  30. binalyze_air/apis/user_management.py +183 -74
  31. binalyze_air/apis/webhook_executions.py +50 -0
  32. binalyze_air/apis/webhooks.py +322 -230
  33. binalyze_air/base.py +207 -133
  34. binalyze_air/client.py +217 -1337
  35. binalyze_air/commands/__init__.py +175 -145
  36. binalyze_air/commands/acquisitions.py +661 -387
  37. binalyze_air/commands/api_tokens.py +55 -0
  38. binalyze_air/commands/assets.py +324 -362
  39. binalyze_air/commands/{authentication.py → auth.py} +36 -36
  40. binalyze_air/commands/auto_asset_tags.py +230 -230
  41. binalyze_air/commands/backup.py +47 -0
  42. binalyze_air/commands/baseline.py +32 -396
  43. binalyze_air/commands/cases.py +609 -602
  44. binalyze_air/commands/cloud_forensics.py +88 -0
  45. binalyze_air/commands/event_subscription.py +101 -101
  46. binalyze_air/commands/evidences.py +918 -988
  47. binalyze_air/commands/interact.py +172 -58
  48. binalyze_air/commands/investigation_hub.py +315 -0
  49. binalyze_air/commands/license.py +183 -0
  50. binalyze_air/commands/logger.py +126 -0
  51. binalyze_air/commands/multipart_upload.py +363 -0
  52. binalyze_air/commands/notifications.py +45 -0
  53. binalyze_air/commands/organizations.py +200 -221
  54. binalyze_air/commands/policies.py +175 -203
  55. binalyze_air/commands/preset_filters.py +55 -0
  56. binalyze_air/commands/recent_activities.py +32 -0
  57. binalyze_air/commands/relay_server.py +144 -0
  58. binalyze_air/commands/settings.py +431 -29
  59. binalyze_air/commands/tasks.py +95 -56
  60. binalyze_air/commands/triage.py +224 -360
  61. binalyze_air/commands/user_management.py +351 -126
  62. binalyze_air/commands/webhook_executions.py +77 -0
  63. binalyze_air/config.py +244 -244
  64. binalyze_air/exceptions.py +49 -49
  65. binalyze_air/http_client.py +426 -305
  66. binalyze_air/models/__init__.py +287 -285
  67. binalyze_air/models/acquisitions.py +365 -250
  68. binalyze_air/models/api_tokens.py +73 -0
  69. binalyze_air/models/assets.py +438 -438
  70. binalyze_air/models/audit.py +247 -272
  71. binalyze_air/models/audit_logs.py +14 -0
  72. binalyze_air/models/{authentication.py → auth.py} +69 -69
  73. binalyze_air/models/auto_asset_tags.py +227 -116
  74. binalyze_air/models/backup.py +138 -0
  75. binalyze_air/models/baseline.py +231 -231
  76. binalyze_air/models/cases.py +275 -275
  77. binalyze_air/models/cloud_forensics.py +145 -0
  78. binalyze_air/models/event_subscription.py +170 -171
  79. binalyze_air/models/evidence.py +65 -65
  80. binalyze_air/models/evidences.py +367 -348
  81. binalyze_air/models/interact.py +266 -135
  82. binalyze_air/models/investigation_hub.py +265 -0
  83. binalyze_air/models/license.py +150 -0
  84. binalyze_air/models/logger.py +83 -0
  85. binalyze_air/models/multipart_upload.py +352 -0
  86. binalyze_air/models/notifications.py +138 -0
  87. binalyze_air/models/organizations.py +293 -293
  88. binalyze_air/models/params.py +153 -127
  89. binalyze_air/models/policies.py +260 -249
  90. binalyze_air/models/preset_filters.py +79 -0
  91. binalyze_air/models/recent_activities.py +70 -0
  92. binalyze_air/models/relay_server.py +121 -0
  93. binalyze_air/models/settings.py +538 -84
  94. binalyze_air/models/tasks.py +215 -149
  95. binalyze_air/models/triage.py +141 -142
  96. binalyze_air/models/user_management.py +200 -97
  97. binalyze_air/models/webhook_executions.py +33 -0
  98. binalyze_air/queries/__init__.py +121 -133
  99. binalyze_air/queries/acquisitions.py +155 -155
  100. binalyze_air/queries/api_tokens.py +46 -0
  101. binalyze_air/queries/assets.py +186 -105
  102. binalyze_air/queries/audit.py +400 -416
  103. binalyze_air/queries/{authentication.py → auth.py} +55 -55
  104. binalyze_air/queries/auto_asset_tags.py +59 -59
  105. binalyze_air/queries/backup.py +66 -0
  106. binalyze_air/queries/baseline.py +21 -185
  107. binalyze_air/queries/cases.py +292 -292
  108. binalyze_air/queries/cloud_forensics.py +137 -0
  109. binalyze_air/queries/event_subscription.py +54 -54
  110. binalyze_air/queries/evidence.py +139 -139
  111. binalyze_air/queries/evidences.py +279 -279
  112. binalyze_air/queries/interact.py +140 -28
  113. binalyze_air/queries/investigation_hub.py +329 -0
  114. binalyze_air/queries/license.py +85 -0
  115. binalyze_air/queries/logger.py +58 -0
  116. binalyze_air/queries/multipart_upload.py +180 -0
  117. binalyze_air/queries/notifications.py +71 -0
  118. binalyze_air/queries/organizations.py +222 -222
  119. binalyze_air/queries/params.py +154 -115
  120. binalyze_air/queries/policies.py +149 -149
  121. binalyze_air/queries/preset_filters.py +60 -0
  122. binalyze_air/queries/recent_activities.py +44 -0
  123. binalyze_air/queries/relay_server.py +42 -0
  124. binalyze_air/queries/settings.py +533 -20
  125. binalyze_air/queries/tasks.py +125 -81
  126. binalyze_air/queries/triage.py +230 -230
  127. binalyze_air/queries/user_management.py +193 -83
  128. binalyze_air/queries/webhook_executions.py +39 -0
  129. binalyze_air_sdk-1.0.3.dist-info/METADATA +752 -0
  130. binalyze_air_sdk-1.0.3.dist-info/RECORD +132 -0
  131. {binalyze_air_sdk-1.0.1.dist-info → binalyze_air_sdk-1.0.3.dist-info}/WHEEL +1 -1
  132. binalyze_air/apis/endpoints.py +0 -22
  133. binalyze_air/apis/evidences.py +0 -216
  134. binalyze_air/apis/users.py +0 -68
  135. binalyze_air/commands/users.py +0 -101
  136. binalyze_air/models/endpoints.py +0 -76
  137. binalyze_air/models/users.py +0 -82
  138. binalyze_air/queries/endpoints.py +0 -25
  139. binalyze_air/queries/users.py +0 -69
  140. binalyze_air_sdk-1.0.1.dist-info/METADATA +0 -635
  141. binalyze_air_sdk-1.0.1.dist-info/RECORD +0 -82
  142. {binalyze_air_sdk-1.0.1.dist-info → binalyze_air_sdk-1.0.3.dist-info}/top_level.txt +0 -0
@@ -0,0 +1,116 @@
1
+ """
2
+ Cloud Forensics API for the Binalyze AIR SDK.
3
+ """
4
+
5
+ from typing import Optional, Dict, Any
6
+
7
+ from ..http_client import HTTPClient
8
+ from ..models.cloud_forensics import (
9
+ CloudAccount, CloudAccountsPaginatedResponse, CloudAccountFilter,
10
+ CreateCloudAccountRequest, UpdateCloudAccountRequest, CloudAccountSyncResult,
11
+ CloudVendorSyncResult, CloudVendor
12
+ )
13
+ from ..queries.cloud_forensics import (
14
+ ListCloudAccountsQuery, GetCloudAccountQuery, ExportCloudAccountsQuery,
15
+ SyncCloudAccountQuery, SyncCloudAccountsByVendorQuery
16
+ )
17
+ from ..commands.cloud_forensics import (
18
+ CreateCloudAccountCommand, UpdateCloudAccountCommand, DeleteCloudAccountCommand
19
+ )
20
+
21
+
22
+ class CloudForensicsAPI:
23
+ """Cloud Forensics API with CQRS pattern - separated queries and commands."""
24
+
25
+ def __init__(self, http_client: HTTPClient):
26
+ self.http_client = http_client
27
+
28
+ # QUERIES (Read operations)
29
+ def list_accounts(self, filter_params: Optional[CloudAccountFilter] = None) -> CloudAccountsPaginatedResponse:
30
+ """List cloud accounts with optional filtering."""
31
+ query = ListCloudAccountsQuery(self.http_client, filter_params)
32
+ return query.execute()
33
+
34
+ def get_account(self, account_id: str) -> CloudAccount:
35
+ """Get a specific cloud account by ID."""
36
+ query = GetCloudAccountQuery(self.http_client, account_id)
37
+ return query.execute()
38
+
39
+ def export_accounts(self, filter_params: Optional[CloudAccountFilter] = None) -> Dict[str, Any]:
40
+ """Export cloud accounts data."""
41
+ query = ExportCloudAccountsQuery(self.http_client, filter_params)
42
+ return query.execute()
43
+
44
+ def sync_account(self, account_id: str) -> CloudAccountSyncResult:
45
+ """Sync a specific cloud account by ID."""
46
+ query = SyncCloudAccountQuery(self.http_client, account_id)
47
+ return query.execute()
48
+
49
+ def sync_accounts_by_vendor(self, cloud_vendor: CloudVendor) -> CloudVendorSyncResult:
50
+ """Sync all cloud accounts by vendor."""
51
+ query = SyncCloudAccountsByVendorQuery(self.http_client, cloud_vendor)
52
+ return query.execute()
53
+
54
+ # COMMANDS (Write operations)
55
+ def create_account(self, request: CreateCloudAccountRequest) -> CloudAccount:
56
+ """Create a new cloud account."""
57
+ command = CreateCloudAccountCommand(self.http_client, request)
58
+ return command.execute()
59
+
60
+ def update_account(self, account_id: str, request: UpdateCloudAccountRequest) -> CloudAccount:
61
+ """Update an existing cloud account."""
62
+ command = UpdateCloudAccountCommand(self.http_client, account_id, request)
63
+ return command.execute()
64
+
65
+ def delete_account(self, account_id: str) -> Dict[str, Any]:
66
+ """Delete a cloud account."""
67
+ command = DeleteCloudAccountCommand(self.http_client, account_id)
68
+ return command.execute()
69
+
70
+ # Convenience methods
71
+ def list_aws_accounts(self, filter_params: Optional[CloudAccountFilter] = None) -> CloudAccountsPaginatedResponse:
72
+ """List AWS cloud accounts."""
73
+ if filter_params is None:
74
+ filter_params = CloudAccountFilter()
75
+ filter_params.cloud_vendor = CloudVendor.AWS
76
+ return self.list_accounts(filter_params)
77
+
78
+ def list_azure_accounts(self, filter_params: Optional[CloudAccountFilter] = None) -> CloudAccountsPaginatedResponse:
79
+ """List Azure cloud accounts."""
80
+ if filter_params is None:
81
+ filter_params = CloudAccountFilter()
82
+ filter_params.cloud_vendor = CloudVendor.AZURE
83
+ return self.list_accounts(filter_params)
84
+
85
+ def sync_all_aws_accounts(self) -> CloudVendorSyncResult:
86
+ """Sync all AWS accounts."""
87
+ return self.sync_accounts_by_vendor(CloudVendor.AWS)
88
+
89
+ def sync_all_azure_accounts(self) -> CloudVendorSyncResult:
90
+ """Sync all Azure accounts."""
91
+ return self.sync_accounts_by_vendor(CloudVendor.AZURE)
92
+
93
+ def get_account_summary(self, filter_params: Optional[CloudAccountFilter] = None) -> Dict[str, Any]:
94
+ """Get a summary of cloud accounts including counts by vendor and status."""
95
+ accounts = self.list_accounts(filter_params)
96
+
97
+ summary = {
98
+ "total_accounts": len(accounts.entities),
99
+ "by_vendor": {},
100
+ "by_status": {},
101
+ "total_assets": 0
102
+ }
103
+
104
+ for account in accounts.entities:
105
+ # Count by vendor (handle both enum and string cases)
106
+ vendor = account.cloud_vendor.value if hasattr(account.cloud_vendor, 'value') else str(account.cloud_vendor)
107
+ summary["by_vendor"][vendor] = summary["by_vendor"].get(vendor, 0) + 1
108
+
109
+ # Count by status (handle both enum and string cases)
110
+ status = account.status.value if hasattr(account.status, 'value') else str(account.status)
111
+ summary["by_status"][status] = summary["by_status"].get(status, 0) + 1
112
+
113
+ # Sum total assets
114
+ summary["total_assets"] += account.detected_assets_count
115
+
116
+ return summary
@@ -1,97 +1,97 @@
1
- """
2
- Event Subscription API for the Binalyze AIR SDK.
3
- """
4
-
5
- from typing import List, Optional, Dict, Any, Union
6
-
7
- from ..http_client import HTTPClient
8
- from ..models.event_subscription import (
9
- EventSubscription, EventSubscriptionFilter,
10
- CreateEventSubscriptionRequest, UpdateEventSubscriptionRequest
11
- )
12
- from ..queries.event_subscription import ListEventSubscriptionsQuery, GetEventSubscriptionQuery
13
- from ..commands.event_subscription import (
14
- CreateEventSubscriptionCommand, UpdateEventSubscriptionCommand, DeleteEventSubscriptionCommand
15
- )
16
-
17
-
18
- class EventSubscriptionAPI:
19
- """Event Subscription API with CQRS pattern - separated queries and commands."""
20
-
21
- def __init__(self, http_client: HTTPClient):
22
- self.http_client = http_client
23
-
24
- # QUERIES (Read operations)
25
- def list(self, filter_params: Optional[EventSubscriptionFilter] = None) -> List[EventSubscription]:
26
- """List event subscriptions with optional filtering."""
27
- query = ListEventSubscriptionsQuery(self.http_client, filter_params)
28
- return query.execute()
29
-
30
- def get(self, subscription_id: str) -> EventSubscription:
31
- """Get a specific event subscription by ID."""
32
- query = GetEventSubscriptionQuery(self.http_client, subscription_id)
33
- return query.execute()
34
-
35
- # Webhook-specific aliases for queries
36
- def list_webhooks(self, filter_params: Optional[EventSubscriptionFilter] = None) -> List[EventSubscription]:
37
- """List webhooks - alias for list."""
38
- return self.list(filter_params)
39
-
40
- def get_webhook(self, webhook_id: str) -> EventSubscription:
41
- """Get a specific webhook by ID - alias for get."""
42
- return self.get(webhook_id)
43
-
44
- def get_webhook_events(self, webhook_id: str) -> List[Dict[str, Any]]:
45
- """Get webhook events."""
46
- try:
47
- # This would typically get events for a specific webhook
48
- response = self.http_client.get(f"event-subscriptions/{webhook_id}/events")
49
- return response.get("result", [])
50
- except Exception as e:
51
- # Return a simulated response for testing
52
- return [
53
- {"event": "asset.created", "timestamp": "2024-01-01T00:00:00Z"},
54
- {"event": "case.updated", "timestamp": "2024-01-01T00:01:00Z"}
55
- ]
56
-
57
- # COMMANDS (Write operations)
58
- def create(self, request: Union[CreateEventSubscriptionRequest, Dict[str, Any]]) -> EventSubscription:
59
- """Create a new event subscription."""
60
- command = CreateEventSubscriptionCommand(self.http_client, request)
61
- return command.execute()
62
-
63
- def update(self, subscription_id: str, request: Union[UpdateEventSubscriptionRequest, Dict[str, Any]]) -> EventSubscription:
64
- """Update an existing event subscription."""
65
- command = UpdateEventSubscriptionCommand(self.http_client, subscription_id, request)
66
- return command.execute()
67
-
68
- def delete(self, subscription_id: str) -> Dict[str, Any]:
69
- """Delete an event subscription."""
70
- command = DeleteEventSubscriptionCommand(self.http_client, subscription_id)
71
- return command.execute()
72
-
73
- # Webhook-specific aliases for commands
74
- def create_webhook(self, webhook_data: Union[CreateEventSubscriptionRequest, Dict[str, Any]]) -> EventSubscription:
75
- """Create a new webhook - alias for create."""
76
- return self.create(webhook_data)
77
-
78
- def update_webhook(self, webhook_id: str, update_data: Union[UpdateEventSubscriptionRequest, Dict[str, Any]]) -> EventSubscription:
79
- """Update an existing webhook - alias for update."""
80
- return self.update(webhook_id, update_data)
81
-
82
- def delete_webhook(self, webhook_id: str) -> Dict[str, Any]:
83
- """Delete a webhook - alias for delete."""
84
- return self.delete(webhook_id)
85
-
86
- def test_webhook(self, webhook_id: str) -> Dict[str, Any]:
87
- """Test webhook connectivity."""
88
- try:
89
- response = self.http_client.post(f"event-subscriptions/{webhook_id}/test", json_data={})
90
- return response
91
- except Exception as e:
92
- # Return a simulated response for testing
93
- return {
94
- "success": False,
95
- "error": str(e),
96
- "test_result": "failed"
1
+ """
2
+ Event Subscription API for the Binalyze AIR SDK.
3
+ """
4
+
5
+ from typing import List, Optional, Dict, Any, Union
6
+
7
+ from ..http_client import HTTPClient
8
+ from ..models.event_subscription import (
9
+ EventSubscription, EventSubscriptionFilter,
10
+ CreateEventSubscriptionRequest, UpdateEventSubscriptionRequest
11
+ )
12
+ from ..queries.event_subscription import ListEventSubscriptionsQuery, GetEventSubscriptionQuery
13
+ from ..commands.event_subscription import (
14
+ CreateEventSubscriptionCommand, UpdateEventSubscriptionCommand, DeleteEventSubscriptionCommand
15
+ )
16
+
17
+
18
+ class EventSubscriptionAPI:
19
+ """Event Subscription API with CQRS pattern - separated queries and commands."""
20
+
21
+ def __init__(self, http_client: HTTPClient):
22
+ self.http_client = http_client
23
+
24
+ # QUERIES (Read operations)
25
+ def list(self, filter_params: Optional[EventSubscriptionFilter] = None) -> List[EventSubscription]:
26
+ """List event subscriptions with optional filtering."""
27
+ query = ListEventSubscriptionsQuery(self.http_client, filter_params)
28
+ return query.execute()
29
+
30
+ def get(self, subscription_id: str) -> EventSubscription:
31
+ """Get a specific event subscription by ID."""
32
+ query = GetEventSubscriptionQuery(self.http_client, subscription_id)
33
+ return query.execute()
34
+
35
+ # Webhook-specific aliases for queries
36
+ def list_webhooks(self, filter_params: Optional[EventSubscriptionFilter] = None) -> List[EventSubscription]:
37
+ """List webhooks - alias for list."""
38
+ return self.list(filter_params)
39
+
40
+ def get_webhook(self, webhook_id: str) -> EventSubscription:
41
+ """Get a specific webhook by ID - alias for get."""
42
+ return self.get(webhook_id)
43
+
44
+ def get_webhook_events(self, webhook_id: str) -> List[Dict[str, Any]]:
45
+ """Get webhook events."""
46
+ try:
47
+ # This would typically get events for a specific webhook
48
+ response = self.http_client.get(f"event-subscriptions/{webhook_id}/events")
49
+ return response.get("result", [])
50
+ except Exception as e:
51
+ # Return a simulated response for testing
52
+ return [
53
+ {"event": "asset.created", "timestamp": "2024-01-01T00:00:00Z"},
54
+ {"event": "case.updated", "timestamp": "2024-01-01T00:01:00Z"}
55
+ ]
56
+
57
+ # COMMANDS (Write operations)
58
+ def create(self, request: Union[CreateEventSubscriptionRequest, Dict[str, Any]]) -> EventSubscription:
59
+ """Create a new event subscription."""
60
+ command = CreateEventSubscriptionCommand(self.http_client, request)
61
+ return command.execute()
62
+
63
+ def update(self, subscription_id: str, request: Union[UpdateEventSubscriptionRequest, Dict[str, Any]]) -> EventSubscription:
64
+ """Update an existing event subscription."""
65
+ command = UpdateEventSubscriptionCommand(self.http_client, subscription_id, request)
66
+ return command.execute()
67
+
68
+ def delete(self, subscription_id: str) -> Dict[str, Any]:
69
+ """Delete an event subscription."""
70
+ command = DeleteEventSubscriptionCommand(self.http_client, subscription_id)
71
+ return command.execute()
72
+
73
+ # Webhook-specific aliases for commands
74
+ def create_webhook(self, webhook_data: Union[CreateEventSubscriptionRequest, Dict[str, Any]]) -> EventSubscription:
75
+ """Create a new webhook - alias for create."""
76
+ return self.create(webhook_data)
77
+
78
+ def update_webhook(self, webhook_id: str, update_data: Union[UpdateEventSubscriptionRequest, Dict[str, Any]]) -> EventSubscription:
79
+ """Update an existing webhook - alias for update."""
80
+ return self.update(webhook_id, update_data)
81
+
82
+ def delete_webhook(self, webhook_id: str) -> Dict[str, Any]:
83
+ """Delete a webhook - alias for delete."""
84
+ return self.delete(webhook_id)
85
+
86
+ def test_webhook(self, webhook_id: str) -> Dict[str, Any]:
87
+ """Test webhook connectivity."""
88
+ try:
89
+ response = self.http_client.post(f"event-subscriptions/{webhook_id}/test", json_data={})
90
+ return response
91
+ except Exception as e:
92
+ # Return a simulated response for testing
93
+ return {
94
+ "success": False,
95
+ "error": str(e),
96
+ "test_result": "failed"
97
97
  }
@@ -1,53 +1,249 @@
1
- """
2
- Evidence API for the Binalyze AIR SDK.
3
- """
4
-
5
- from typing import List, Dict, Any
6
-
7
- from ..http_client import HTTPClient
8
- from ..models.evidence import EvidencePPC, EvidenceReportFileInfo, EvidenceReport
9
- from ..queries.evidence import (
10
- GetEvidencePPCQuery, GetEvidenceReportFileInfoQuery, GetEvidenceReportQuery
11
- )
12
-
13
-
14
- class EvidenceAPI:
15
- """Evidence API with CQRS pattern - read-only operations for case evidence."""
16
-
17
- def __init__(self, http_client: HTTPClient):
18
- self.http_client = http_client
19
-
20
- # QUERIES (Read operations only - evidence is read-only)
21
- def get_case_evidence_ppc(self, endpoint_id: str, task_id: str) -> EvidencePPC:
22
- """Get case evidence PPC by endpoint ID and task ID."""
23
- query = GetEvidencePPCQuery(self.http_client, endpoint_id, task_id)
24
- return query.execute()
25
-
26
- def get_case_evidence_report_file_info(self, endpoint_id: str, task_id: str) -> EvidenceReportFileInfo:
27
- """Get case evidence report file info by endpoint ID and task ID."""
28
- query = GetEvidenceReportFileInfoQuery(self.http_client, endpoint_id, task_id)
29
- return query.execute()
30
-
31
- def get_case_evidence_report(self, endpoint_id: str, task_id: str) -> EvidenceReport:
32
- """Get case evidence report by endpoint ID and task ID."""
33
- query = GetEvidenceReportQuery(self.http_client, endpoint_id, task_id)
34
- return query.execute()
35
-
36
- # REPOSITORY OPERATIONS (Delegate to evidences API for backward compatibility)
37
- def list_repositories(self) -> List[Any]:
38
- """List evidence repositories - delegates to evidences API."""
39
- from .evidences import EvidencesAPI
40
- evidences_api = EvidencesAPI(self.http_client)
41
- return evidences_api.list_repositories()
42
-
43
- def get_repository(self, repository_id: str) -> Any:
44
- """Get repository details - delegates to evidences API."""
45
- from .evidences import EvidencesAPI
46
- evidences_api = EvidencesAPI(self.http_client)
47
- return evidences_api.get_repository(repository_id)
48
-
49
- def get_repository_statistics(self, repository_id: str) -> Dict[str, Any]:
50
- """Get repository statistics - delegates to evidences API."""
51
- from .evidences import EvidencesAPI
52
- evidences_api = EvidencesAPI(self.http_client)
53
- return evidences_api.get_repository_statistics(repository_id)
1
+ """
2
+ Evidence API for the Binalyze AIR SDK.
3
+ Comprehensive API covering all evidence operations including case evidence and evidence repositories.
4
+ """
5
+
6
+ from typing import List, Optional, Dict, Any
7
+
8
+ from ..http_client import HTTPClient
9
+ from ..models.evidence import EvidencePPC, EvidenceReportFileInfo, EvidenceReport
10
+ from ..models.evidences import (
11
+ EvidenceRepository, AmazonS3Repository, AzureStorageRepository,
12
+ FTPSRepository, SFTPRepository, SMBRepository, RepositoryFilter,
13
+ CreateAmazonS3RepositoryRequest, UpdateAmazonS3RepositoryRequest,
14
+ CreateAzureStorageRepositoryRequest, UpdateAzureStorageRepositoryRequest,
15
+ CreateFTPSRepositoryRequest, UpdateFTPSRepositoryRequest,
16
+ CreateSFTPRepositoryRequest, UpdateSFTPRepositoryRequest,
17
+ CreateSMBRepositoryRequest, UpdateSMBRepositoryRequest,
18
+ ValidateRepositoryRequest, ValidationResult
19
+ )
20
+ from ..queries.evidence import (
21
+ GetEvidencePPCQuery, GetEvidenceReportFileInfoQuery, GetEvidenceReportQuery
22
+ )
23
+ from ..queries.evidences import (
24
+ ListRepositoriesQuery, GetRepositoryQuery,
25
+ ListAmazonS3RepositoriesQuery, GetAmazonS3RepositoryQuery,
26
+ ListAzureStorageRepositoriesQuery, GetAzureStorageRepositoryQuery,
27
+ ListFTPSRepositoriesQuery, GetFTPSRepositoryQuery,
28
+ ListSFTPRepositoriesQuery, GetSFTPRepositoryQuery,
29
+ ListSMBRepositoriesQuery, GetSMBRepositoryQuery
30
+ )
31
+ from ..commands.evidences import (
32
+ UpdateRepositoryCommand, DeleteRepositoryCommand,
33
+ CreateAmazonS3RepositoryCommand, UpdateAmazonS3RepositoryCommand,
34
+ ValidateAmazonS3RepositoryCommand,
35
+ CreateAzureStorageRepositoryCommand, UpdateAzureStorageRepositoryCommand,
36
+ ValidateAzureStorageRepositoryCommand,
37
+ CreateFTPSRepositoryCommand, UpdateFTPSRepositoryCommand,
38
+ ValidateFTPSRepositoryCommand,
39
+ CreateSFTPRepositoryCommand, UpdateSFTPRepositoryCommand,
40
+ CreateSMBRepositoryCommand, UpdateSMBRepositoryCommand
41
+ )
42
+
43
+
44
+ class EvidenceAPI:
45
+ """
46
+ Comprehensive Evidence API covering all evidence operations.
47
+
48
+ Handles both:
49
+ 1. Case Evidence Operations (/evidence/case/*)
50
+ 2. Evidence Repository Management (/evidences/repositories/*)
51
+ """
52
+
53
+ def __init__(self, http_client: HTTPClient):
54
+ self.http_client = http_client
55
+
56
+ # ========================================
57
+ # CASE EVIDENCE OPERATIONS
58
+ # ========================================
59
+
60
+ def get_case_evidence_ppc(self, endpoint_id: str, task_id: str) -> EvidencePPC:
61
+ """Get case evidence PPC by endpoint ID and task ID."""
62
+ query = GetEvidencePPCQuery(self.http_client, endpoint_id, task_id)
63
+ return query.execute()
64
+
65
+ def get_case_evidence_report_file_info(self, endpoint_id: str, task_id: str) -> EvidenceReportFileInfo:
66
+ """Get case evidence report file info by endpoint ID and task ID."""
67
+ query = GetEvidenceReportFileInfoQuery(self.http_client, endpoint_id, task_id)
68
+ return query.execute()
69
+
70
+ def get_case_evidence_report(self, endpoint_id: str, task_id: str) -> EvidenceReport:
71
+ """Get case evidence report by endpoint ID and task ID."""
72
+ query = GetEvidenceReportQuery(self.http_client, endpoint_id, task_id)
73
+ return query.execute()
74
+
75
+ # ========================================
76
+ # EVIDENCE REPOSITORY OPERATIONS
77
+ # ========================================
78
+
79
+ # GENERAL REPOSITORY QUERIES
80
+ def list_repositories(self, filter_params: Optional[RepositoryFilter] = None, organization_ids: Optional[List[int]] = None) -> List[EvidenceRepository]:
81
+ """List evidence repositories with optional filtering."""
82
+ query = ListRepositoriesQuery(self.http_client, filter_params, organization_ids)
83
+ return query.execute()
84
+
85
+ def get_repository(self, repository_id: str) -> EvidenceRepository:
86
+ """Get a specific evidence repository by ID."""
87
+ query = GetRepositoryQuery(self.http_client, repository_id)
88
+ return query.execute()
89
+
90
+ def get_repository_statistics(self, repository_id: str) -> Dict[str, Any]:
91
+ """Get statistics for a specific evidence repository."""
92
+ response = self.http_client.get(f"repositories/{repository_id}/statistics")
93
+ return response.get("result", {})
94
+
95
+ # GENERAL REPOSITORY COMMANDS
96
+ def update_repository(self, repository_id: str, update_data: Dict[str, Any]) -> EvidenceRepository:
97
+ """Update an evidence repository."""
98
+ command = UpdateRepositoryCommand(self.http_client, repository_id, update_data)
99
+ return command.execute()
100
+
101
+ def delete_repository(self, repository_id: str) -> Dict[str, Any]:
102
+ """Delete an evidence repository."""
103
+ command = DeleteRepositoryCommand(self.http_client, repository_id)
104
+ return command.execute()
105
+
106
+ # AMAZON S3 REPOSITORY OPERATIONS
107
+ def list_amazon_s3_repositories(self, filter_params: Optional[RepositoryFilter] = None) -> List[AmazonS3Repository]:
108
+ """List Amazon S3 repositories with optional filtering."""
109
+ query = ListAmazonS3RepositoriesQuery(self.http_client, filter_params)
110
+ return query.execute()
111
+
112
+ def get_amazon_s3_repository(self, repository_id: str) -> AmazonS3Repository:
113
+ """Get a specific Amazon S3 repository by ID."""
114
+ query = GetAmazonS3RepositoryQuery(self.http_client, repository_id)
115
+ return query.execute()
116
+
117
+ def create_amazon_s3_repository(self, request: CreateAmazonS3RepositoryRequest) -> AmazonS3Repository:
118
+ """Create a new Amazon S3 repository."""
119
+ command = CreateAmazonS3RepositoryCommand(self.http_client, request)
120
+ return command.execute()
121
+
122
+ def update_amazon_s3_repository(self, repository_id: str, request: UpdateAmazonS3RepositoryRequest) -> AmazonS3Repository:
123
+ """Update an existing Amazon S3 repository."""
124
+ command = UpdateAmazonS3RepositoryCommand(self.http_client, repository_id, request)
125
+ return command.execute()
126
+
127
+ def delete_amazon_s3_repository(self, repository_id: str) -> Dict[str, Any]:
128
+ """Delete an Amazon S3 repository."""
129
+ command = DeleteRepositoryCommand(self.http_client, repository_id)
130
+ return command.execute()
131
+
132
+ def validate_amazon_s3_repository(self, request: ValidateRepositoryRequest) -> ValidationResult:
133
+ """Validate Amazon S3 repository configuration."""
134
+ command = ValidateAmazonS3RepositoryCommand(self.http_client, request)
135
+ return command.execute()
136
+
137
+ # AZURE STORAGE REPOSITORY OPERATIONS
138
+ def list_azure_storage_repositories(self, filter_params: Optional[RepositoryFilter] = None) -> List[AzureStorageRepository]:
139
+ """List Azure Storage repositories with optional filtering."""
140
+ query = ListAzureStorageRepositoriesQuery(self.http_client, filter_params)
141
+ return query.execute()
142
+
143
+ def get_azure_storage_repository(self, repository_id: str) -> AzureStorageRepository:
144
+ """Get a specific Azure Storage repository by ID."""
145
+ query = GetAzureStorageRepositoryQuery(self.http_client, repository_id)
146
+ return query.execute()
147
+
148
+ def create_azure_storage_repository(self, request: CreateAzureStorageRepositoryRequest) -> AzureStorageRepository:
149
+ """Create a new Azure Storage repository."""
150
+ command = CreateAzureStorageRepositoryCommand(self.http_client, request)
151
+ return command.execute()
152
+
153
+ def update_azure_storage_repository(self, repository_id: str, request: UpdateAzureStorageRepositoryRequest) -> AzureStorageRepository:
154
+ """Update an existing Azure Storage repository."""
155
+ command = UpdateAzureStorageRepositoryCommand(self.http_client, repository_id, request)
156
+ return command.execute()
157
+
158
+ def delete_azure_storage_repository(self, repository_id: str) -> Dict[str, Any]:
159
+ """Delete an Azure Storage repository."""
160
+ command = DeleteRepositoryCommand(self.http_client, repository_id)
161
+ return command.execute()
162
+
163
+ def validate_azure_storage_repository(self, request: ValidateRepositoryRequest) -> ValidationResult:
164
+ """Validate Azure Storage repository configuration."""
165
+ command = ValidateAzureStorageRepositoryCommand(self.http_client, request)
166
+ return command.execute()
167
+
168
+ # FTPS REPOSITORY OPERATIONS
169
+ def list_ftps_repositories(self, filter_params: Optional[RepositoryFilter] = None) -> List[FTPSRepository]:
170
+ """List FTPS repositories with optional filtering."""
171
+ query = ListFTPSRepositoriesQuery(self.http_client, filter_params)
172
+ return query.execute()
173
+
174
+ def get_ftps_repository(self, repository_id: str) -> FTPSRepository:
175
+ """Get a specific FTPS repository by ID."""
176
+ query = GetFTPSRepositoryQuery(self.http_client, repository_id)
177
+ return query.execute()
178
+
179
+ def create_ftps_repository(self, request: CreateFTPSRepositoryRequest) -> FTPSRepository:
180
+ """Create a new FTPS repository."""
181
+ command = CreateFTPSRepositoryCommand(self.http_client, request)
182
+ return command.execute()
183
+
184
+ def update_ftps_repository(self, repository_id: str, request: UpdateFTPSRepositoryRequest) -> FTPSRepository:
185
+ """Update an existing FTPS repository."""
186
+ command = UpdateFTPSRepositoryCommand(self.http_client, repository_id, request)
187
+ return command.execute()
188
+
189
+ def delete_ftps_repository(self, repository_id: str) -> Dict[str, Any]:
190
+ """Delete an FTPS repository."""
191
+ command = DeleteRepositoryCommand(self.http_client, repository_id)
192
+ return command.execute()
193
+
194
+ def validate_ftps_repository(self, request: ValidateRepositoryRequest) -> ValidationResult:
195
+ """Validate FTPS repository configuration."""
196
+ command = ValidateFTPSRepositoryCommand(self.http_client, request)
197
+ return command.execute()
198
+
199
+ # SFTP REPOSITORY OPERATIONS
200
+ def list_sftp_repositories(self, filter_params: Optional[RepositoryFilter] = None) -> List[SFTPRepository]:
201
+ """List SFTP repositories with optional filtering."""
202
+ query = ListSFTPRepositoriesQuery(self.http_client, filter_params)
203
+ return query.execute()
204
+
205
+ def get_sftp_repository(self, repository_id: str) -> SFTPRepository:
206
+ """Get a specific SFTP repository by ID."""
207
+ query = GetSFTPRepositoryQuery(self.http_client, repository_id)
208
+ return query.execute()
209
+
210
+ def create_sftp_repository(self, request: CreateSFTPRepositoryRequest) -> SFTPRepository:
211
+ """Create a new SFTP repository."""
212
+ command = CreateSFTPRepositoryCommand(self.http_client, request)
213
+ return command.execute()
214
+
215
+ def update_sftp_repository(self, repository_id: str, request: UpdateSFTPRepositoryRequest) -> SFTPRepository:
216
+ """Update an existing SFTP repository."""
217
+ command = UpdateSFTPRepositoryCommand(self.http_client, repository_id, request)
218
+ return command.execute()
219
+
220
+ def delete_sftp_repository(self, repository_id: str) -> Dict[str, Any]:
221
+ """Delete an SFTP repository."""
222
+ command = DeleteRepositoryCommand(self.http_client, repository_id)
223
+ return command.execute()
224
+
225
+ # SMB REPOSITORY OPERATIONS
226
+ def list_smb_repositories(self, filter_params: Optional[RepositoryFilter] = None) -> List[SMBRepository]:
227
+ """List SMB repositories with optional filtering."""
228
+ query = ListSMBRepositoriesQuery(self.http_client, filter_params)
229
+ return query.execute()
230
+
231
+ def get_smb_repository(self, repository_id: str) -> SMBRepository:
232
+ """Get a specific SMB repository by ID."""
233
+ query = GetSMBRepositoryQuery(self.http_client, repository_id)
234
+ return query.execute()
235
+
236
+ def create_smb_repository(self, request: CreateSMBRepositoryRequest) -> SMBRepository:
237
+ """Create a new SMB repository."""
238
+ command = CreateSMBRepositoryCommand(self.http_client, request)
239
+ return command.execute()
240
+
241
+ def update_smb_repository(self, repository_id: str, request: UpdateSMBRepositoryRequest) -> SMBRepository:
242
+ """Update an existing SMB repository."""
243
+ command = UpdateSMBRepositoryCommand(self.http_client, repository_id, request)
244
+ return command.execute()
245
+
246
+ def delete_smb_repository(self, repository_id: str) -> Dict[str, Any]:
247
+ """Delete an SMB repository."""
248
+ command = DeleteRepositoryCommand(self.http_client, repository_id)
249
+ return command.execute()