binalyze-air-sdk 1.0.1__py3-none-any.whl → 1.0.3__py3-none-any.whl

binalyze_air/queries/acquisitions.py

@@ -1,156 +1,156 @@
-"""
-Acquisition-related queries for the Binalyze AIR SDK.
-"""
-
-from typing import List, Optional
-
-from ..base import Query
-from ..models.acquisitions import (
-    AcquisitionProfile, AcquisitionProfileDetails, AcquisitionFilter,
-    AcquisitionProfilePlatformDetails, NetworkCaptureConfig, EDiscoveryPattern
-)
-from ..http_client import HTTPClient
-
-
-class ListAcquisitionProfilesQuery(Query[List[AcquisitionProfile]]):
-    """Query to list acquisition profiles with optional filtering."""
-    
-    def __init__(
-        self, 
-        http_client: HTTPClient, 
-        filter_params: Optional[AcquisitionFilter] = None,
-        organization_ids: Optional[List[int]] = None,
-        all_organizations: bool = False
-    ):
-        self.http_client = http_client
-        # Initialize filter with default organization IDs if not provided
-        if filter_params is None:
-            filter_params = AcquisitionFilter()
-        
-        # Set organization parameters if not already set in filter
-        if filter_params.organization_ids is None and organization_ids is not None:
-            filter_params.organization_ids = organization_ids
-        elif filter_params.organization_ids is None:
-            filter_params.organization_ids = [0]  # Default to organization 0
-        
-        # Set all_organizations parameter if not already set in filter
-        if filter_params.all_organizations is None and all_organizations:
-            filter_params.all_organizations = all_organizations
-        
-        self.filter_params = filter_params
-    
-    def execute(self) -> List[AcquisitionProfile]:
-        """Execute the query to list acquisition profiles."""
-        # Use filter's parameter generation
-        params = self.filter_params.to_params()
-        
-        response = self.http_client.get("acquisitions/profiles", params=params)
-        
-        entities = response.get("result", {}).get("entities", [])
-        
-        # Convert to AcquisitionProfile objects
-        profiles = []
-        for entity_data in entities:
-            mapped_data = {
-                "id": entity_data.get("_id"),
-                "name": entity_data.get("name"),
-                "organization_ids": entity_data.get("organizationIds", []),  # Keep as integers
-                "created_at": entity_data.get("createdAt"),
-                "updated_at": entity_data.get("updatedAt"),
-                "created_by": entity_data.get("createdBy"),
-                "deletable": entity_data.get("deletable", True),
-                "average_time": entity_data.get("averageTime"),
-                "last_used_at": entity_data.get("lastUsedAt"),
-                "last_used_by": entity_data.get("lastUsedBy"),
-                "has_event_log_records_evidence": entity_data.get("hasEventLogRecordsEvidence"),
-            }
-            
-            # Remove None values
-            mapped_data = {k: v for k, v in mapped_data.items() if v is not None}
-            
-            profiles.append(AcquisitionProfile(**mapped_data))
-        
-        return profiles
-
-
-class GetAcquisitionProfileQuery(Query[AcquisitionProfileDetails]):
-    """Query to get a specific acquisition profile by ID."""
-    
-    def __init__(self, http_client: HTTPClient, profile_id: str):
-        self.http_client = http_client
-        self.profile_id = profile_id
-    
-    def execute(self) -> AcquisitionProfileDetails:
-        """Execute the query to get acquisition profile details."""
-        response = self.http_client.get(f"acquisitions/profiles/{self.profile_id}")
-        
-        entity_data = response.get("result", {})
-        
-        # Parse platform configurations
-        def parse_platform_config(platform_data: dict) -> AcquisitionProfilePlatformDetails:
-            network_capture = None
-            if "networkCapture" in platform_data:
-                nc_data = platform_data["networkCapture"]
-                network_capture = NetworkCaptureConfig(
-                    enabled=nc_data.get("enabled", False),
-                    duration=nc_data.get("duration", 60),
-                    pcap=nc_data.get("pcap", {"enabled": False}),
-                    network_flow=nc_data.get("networkFlow", {"enabled": False})
-                )
-            
-            return AcquisitionProfilePlatformDetails(
-                evidence_list=platform_data.get("evidenceList", []),
-                artifact_list=platform_data.get("artifactList"),
-                custom_content_profiles=platform_data.get("customContentProfiles", []),
-                network_capture=network_capture
-            )
-        
-        # Parse platform configurations
-        windows_config = None
-        linux_config = None
-        macos_config = None
-        aix_config = None
-        
-        if "windows" in entity_data:
-            windows_config = parse_platform_config(entity_data["windows"])
-        
-        if "linux" in entity_data:
-            linux_config = parse_platform_config(entity_data["linux"])
-        
-        if "macos" in entity_data:
-            macos_config = parse_platform_config(entity_data["macos"])
-        
-        if "aix" in entity_data:
-            aix_config = parse_platform_config(entity_data["aix"])
-        
-        # Parse eDiscovery patterns
-        e_discovery = None
-        if "eDiscovery" in entity_data and "patterns" in entity_data["eDiscovery"]:
-            patterns = [
-                EDiscoveryPattern(
-                    pattern=pattern.get("pattern", ""),
-                    category=pattern.get("category", "")
-                )
-                for pattern in entity_data["eDiscovery"]["patterns"]
-            ]
-            e_discovery = {"patterns": patterns}
-        
-        mapped_data = {
-            "id": entity_data.get("_id"),
-            "name": entity_data.get("name"),
-            "organization_ids": [str(org_id) for org_id in entity_data.get("organizationIds", [])],
-            "created_at": entity_data.get("createdAt"),
-            "updated_at": entity_data.get("updatedAt"),
-            "created_by": entity_data.get("createdBy"),
-            "deletable": entity_data.get("deletable", True),
-            "windows": windows_config,
-            "linux": linux_config,
-            "macos": macos_config,
-            "aix": aix_config,
-            "e_discovery": e_discovery,
-        }
-        
-        # Remove None values
-        mapped_data = {k: v for k, v in mapped_data.items() if v is not None}
-        
+"""
+Acquisition-related queries for the Binalyze AIR SDK.
+"""
+
+from typing import List, Optional
+
+from ..base import Query
+from ..models.acquisitions import (
+    AcquisitionProfile, AcquisitionProfileDetails, AcquisitionFilter,
+    AcquisitionProfilePlatformDetails, NetworkCaptureConfig, EDiscoveryPattern
+)
+from ..http_client import HTTPClient
+
+
+class ListAcquisitionProfilesQuery(Query[List[AcquisitionProfile]]):
+    """Query to list acquisition profiles with optional filtering."""
+    
+    def __init__(
+        self, 
+        http_client: HTTPClient, 
+        filter_params: Optional[AcquisitionFilter] = None,
+        organization_ids: Optional[List[int]] = None,
+        all_organizations: bool = False
+    ):
+        self.http_client = http_client
+        # Initialize filter with default organization IDs if not provided
+        if filter_params is None:
+            filter_params = AcquisitionFilter()
+        
+        # Set organization parameters if not already set in filter
+        if filter_params.organization_ids is None and organization_ids is not None:
+            filter_params.organization_ids = organization_ids
+        elif filter_params.organization_ids is None:
+            filter_params.organization_ids = [0]  # Default to organization 0
+        
+        # Set all_organizations parameter if not already set in filter
+        if filter_params.all_organizations is None and all_organizations:
+            filter_params.all_organizations = all_organizations
+        
+        self.filter_params = filter_params
+    
+    def execute(self) -> List[AcquisitionProfile]:
+        """Execute the query to list acquisition profiles."""
+        # Use filter's parameter generation
+        params = self.filter_params.to_params()
+        
+        response = self.http_client.get("acquisitions/profiles", params=params)
+        
+        entities = response.get("result", {}).get("entities", [])
+        
+        # Convert to AcquisitionProfile objects
+        profiles = []
+        for entity_data in entities:
+            mapped_data = {
+                "id": entity_data.get("_id"),
+                "name": entity_data.get("name"),
+                "organization_ids": entity_data.get("organizationIds", []),  # Keep as integers
+                "created_at": entity_data.get("createdAt"),
+                "updated_at": entity_data.get("updatedAt"),
+                "created_by": entity_data.get("createdBy"),
+                "deletable": entity_data.get("deletable", True),
+                "average_time": entity_data.get("averageTime"),
+                "last_used_at": entity_data.get("lastUsedAt"),
+                "last_used_by": entity_data.get("lastUsedBy"),
+                "has_event_log_records_evidence": entity_data.get("hasEventLogRecordsEvidence"),
+            }
+            
+            # Remove None values
+            mapped_data = {k: v for k, v in mapped_data.items() if v is not None}
+            
+            profiles.append(AcquisitionProfile(**mapped_data))
+        
+        return profiles
+
+
+class GetAcquisitionProfileQuery(Query[AcquisitionProfileDetails]):
+    """Query to get a specific acquisition profile by ID."""
+    
+    def __init__(self, http_client: HTTPClient, profile_id: str):
+        self.http_client = http_client
+        self.profile_id = profile_id
+    
+    def execute(self) -> AcquisitionProfileDetails:
+        """Execute the query to get acquisition profile details."""
+        response = self.http_client.get(f"acquisitions/profiles/{self.profile_id}")
+        
+        entity_data = response.get("result", {})
+        
+        # Parse platform configurations
+        def parse_platform_config(platform_data: dict) -> AcquisitionProfilePlatformDetails:
+            network_capture = None
+            if "networkCapture" in platform_data:
+                nc_data = platform_data["networkCapture"]
+                network_capture = NetworkCaptureConfig(
+                    enabled=nc_data.get("enabled", False),
+                    duration=nc_data.get("duration", 60),
+                    pcap=nc_data.get("pcap", {"enabled": False}),
+                    network_flow=nc_data.get("networkFlow", {"enabled": False})
+                )
+            
+            return AcquisitionProfilePlatformDetails(
+                evidence_list=platform_data.get("evidenceList", []),
+                artifact_list=platform_data.get("artifactList"),
+                custom_content_profiles=platform_data.get("customContentProfiles", []),
+                network_capture=network_capture
+            )
+        
+        # Parse platform configurations
+        windows_config = None
+        linux_config = None
+        macos_config = None
+        aix_config = None
+        
+        if "windows" in entity_data:
+            windows_config = parse_platform_config(entity_data["windows"])
+        
+        if "linux" in entity_data:
+            linux_config = parse_platform_config(entity_data["linux"])
+        
+        if "macos" in entity_data:
+            macos_config = parse_platform_config(entity_data["macos"])
+        
+        if "aix" in entity_data:
+            aix_config = parse_platform_config(entity_data["aix"])
+        
+        # Parse eDiscovery patterns
+        e_discovery = None
+        if "eDiscovery" in entity_data and "patterns" in entity_data["eDiscovery"]:
+            patterns = [
+                EDiscoveryPattern(
+                    pattern=pattern.get("pattern", ""),
+                    category=pattern.get("category", "")
+                )
+                for pattern in entity_data["eDiscovery"]["patterns"]
+            ]
+            e_discovery = {"patterns": patterns}
+        
+        mapped_data = {
+            "id": entity_data.get("_id"),
+            "name": entity_data.get("name"),
+            "organization_ids": [str(org_id) for org_id in entity_data.get("organizationIds", [])],
+            "created_at": entity_data.get("createdAt"),
+            "updated_at": entity_data.get("updatedAt"),
+            "created_by": entity_data.get("createdBy"),
+            "deletable": entity_data.get("deletable", True),
+            "windows": windows_config,
+            "linux": linux_config,
+            "macos": macos_config,
+            "aix": aix_config,
+            "e_discovery": e_discovery,
+        }
+        
+        # Remove None values
+        mapped_data = {k: v for k, v in mapped_data.items() if v is not None}
+        
         return AcquisitionProfileDetails(**mapped_data) 

binalyze_air/queries/api_tokens.py

@@ -0,0 +1,46 @@
+"""
+API Tokens queries for the Binalyze AIR SDK.
+"""
+
+from typing import Optional, Dict, Any
+
+from ..base import Query
+from ..models.api_tokens import APIToken, APITokensPaginatedResponse, APITokenFilter
+from ..http_client import HTTPClient
+
+
+class ListAPITokensQuery(Query[APITokensPaginatedResponse]):
+    """Query to list API tokens with optional filtering."""
+    
+    def __init__(self, http_client: HTTPClient, filter_params: Optional[APITokenFilter] = None):
+        self.http_client = http_client
+        self.filter_params = filter_params or APITokenFilter()
+    
+    def execute(self) -> APITokensPaginatedResponse:
+        """Execute the query."""
+        params = {}
+        
+        if self.filter_params.page_size is not None:
+            params["pageSize"] = self.filter_params.page_size
+        if self.filter_params.page_number is not None:
+            params["pageNumber"] = self.filter_params.page_number
+        if self.filter_params.sort_type is not None:
+            params["sortType"] = self.filter_params.sort_type
+        if self.filter_params.sort_by is not None:
+            params["sortBy"] = self.filter_params.sort_by
+        
+        response = self.http_client.get("api-tokens", params=params)
+        return APITokensPaginatedResponse(**response["result"])
+
+
+class GetAPITokenQuery(Query[APIToken]):
+    """Query to get a specific API token by ID."""
+    
+    def __init__(self, http_client: HTTPClient, token_id: str):
+        self.http_client = http_client
+        self.token_id = token_id
+    
+    def execute(self) -> APIToken:
+        """Execute the query."""
+        response = self.http_client.get(f"api-tokens/{self.token_id}")
+        return APIToken(**response["result"]) 

binalyze_air/queries/assets.py

@@ -1,105 +1,186 @@
-"""
-Asset-related queries for the Binalyze AIR SDK.
-"""
-
-from typing import List, Dict, Any, Optional
-
-from ..base import Query, PaginatedResponse, APIResponse, PaginatedList
-from ..models.assets import Asset, AssetDetail, AssetTask, AssetFilter, AssetTaskFilter
-from ..http_client import HTTPClient
-
-
-class ListAssetsQuery(Query[List[Asset]]):
-    """Query to list assets with optional filtering."""
-    
-    def __init__(self, http_client: HTTPClient, filter_params: Optional[AssetFilter] = None):
-        self.http_client = http_client
-        self.filter_params = filter_params or AssetFilter()
-    
-    def execute(self) -> List[Asset]:
-        """Execute the query to list assets."""
-        params = self.filter_params.to_params()
-        
-        # Set default organization_ids if not provided
-        if not self.filter_params.organization_ids:
-            params["filter[organizationIds]"] = "0"
-        
-        # Ensure consistent sorting to match API defaults
-        if "sortBy" not in params:
-            params["sortBy"] = "createdAt"
-        if "sortType" not in params:
-            params["sortType"] = "ASC"
-        
-        response = self.http_client.get("assets", params=params)
-        
-        # Parse the paginated response
-        entities = response.get("result", {}).get("entities", [])
-        
-        # Convert to Asset objects using Pydantic parsing with aliases
-        assets = []
-        for entity_data in entities:
-            # Let Pydantic handle the field mapping via aliases
-            asset = Asset.model_validate(entity_data)
-            assets.append(asset)
-        
-        return assets
-
-
-class GetAssetQuery(Query[AssetDetail]):
-    """Query to get a specific asset by ID."""
-    
-    def __init__(self, http_client: HTTPClient, asset_id: str):
-        self.http_client = http_client
-        self.asset_id = asset_id
-    
-    def execute(self) -> AssetDetail:
-        """Execute the query to get asset details."""
-        response = self.http_client.get(f"assets/{self.asset_id}")
-        
-        entity_data = response.get("result", {})
-        
-        # Let Pydantic handle the field mapping via aliases
-        return AssetDetail.model_validate(entity_data)
-
-
-class GetAssetTasksQuery(Query[List[AssetTask]]):
-    """Query to get tasks for a specific asset with optional filtering."""
-    
-    def __init__(self, http_client: HTTPClient, asset_id: str, filter_params: Optional[AssetTaskFilter] = None):
-        self.http_client = http_client
-        self.asset_id = asset_id
-        self.filter_params = filter_params or AssetTaskFilter()
-    
-    def execute(self) -> List[AssetTask]:
-        """Execute the query to get asset tasks."""
-        # Get filter parameters
-        params = self.filter_params.to_params()
-        
-        # Provide sensible defaults that mirror the HTTP test defaults if not supplied
-        # Default pagination
-        if "pageNumber" not in params:
-            params["pageNumber"] = 1
-        if "pageSize" not in params:
-            params["pageSize"] = 10
-        # Default sorting
-        if "sortBy" not in params:
-            params["sortBy"] = "createdAt"
-        if "sortType" not in params:
-            params["sortType"] = "ASC"
-        
-        # Make request with parameters
-        response = self.http_client.get(f"assets/{self.asset_id}/tasks", params=params)
-        
-        result_meta = response.get("result", {})
-        entities_data = result_meta.get("entities", [])
-        
-        # Convert to AssetTask objects using Pydantic parsing with aliases
-        paginated_tasks = PaginatedList(
-            [AssetTask.model_validate(entity) for entity in entities_data],
-            total_entity_count=result_meta.get("totalEntityCount"),
-            current_page=result_meta.get("currentPage", params.get("pageNumber", 1)),
-            page_size=result_meta.get("pageSize", params.get("pageSize", len(entities_data))),
-            total_page_count=result_meta.get("totalPageCount"),
-        )
-
-        return paginated_tasks 
+"""
+Asset-related queries for the Binalyze AIR SDK.
+"""
+
+from typing import List, Dict, Any, Optional
+
+from ..base import Query, PaginatedResponse, APIResponse, PaginatedList
+from ..models.assets import Asset, AssetDetail, AssetTask, AssetFilter, AssetTaskFilter
+from ..http_client import HTTPClient
+
+
+class ListAssetsQuery(Query[List[Asset]]):
+    """Query to list assets with optional filtering."""
+    
+    def __init__(self, http_client: HTTPClient, filter_params: Optional[AssetFilter] = None):
+        self.http_client = http_client
+        self.filter_params = filter_params or AssetFilter()
+    
+    def execute(self) -> List[Asset]:
+        """Execute the query to list assets."""
+        params = self.filter_params.to_params()
+        
+        # Set default organization_ids if not provided
+        if not self.filter_params.organization_ids:
+            params["filter[organizationIds]"] = "0"
+        
+        # Ensure consistent sorting to match API defaults
+        if "sortBy" not in params:
+            params["sortBy"] = "createdAt"
+        if "sortType" not in params:
+            params["sortType"] = "ASC"
+        
+        response = self.http_client.get("assets", params=params)
+        
+        # Parse the paginated response
+        entities = response.get("result", {}).get("entities", [])
+        
+        # Convert to Asset objects using Pydantic parsing with aliases
+        assets = []
+        for entity_data in entities:
+            # Let Pydantic handle the field mapping via aliases
+            asset = Asset.model_validate(entity_data)
+            assets.append(asset)
+        
+        return assets
+
+
+class GetAssetQuery(Query[AssetDetail]):
+    """Query to get a specific asset by ID."""
+    
+    def __init__(self, http_client: HTTPClient, asset_id: str):
+        self.http_client = http_client
+        self.asset_id = asset_id
+    
+    def execute(self) -> AssetDetail:
+        """Execute the query to get asset details."""
+        response = self.http_client.get(f"assets/{self.asset_id}")
+        
+        entity_data = response.get("result", {})
+        
+        # Let Pydantic handle the field mapping via aliases
+        return AssetDetail.model_validate(entity_data)
+
+
+class GetAssetTasksQuery(Query[List[AssetTask]]):
+    """Query to get tasks for a specific asset with optional filtering."""
+    
+    def __init__(self, http_client: HTTPClient, asset_id: str, filter_params: Optional[AssetTaskFilter] = None):
+        self.http_client = http_client
+        self.asset_id = asset_id
+        self.filter_params = filter_params or AssetTaskFilter()
+    
+    def execute(self) -> List[AssetTask]:
+        """Execute the query to get asset tasks."""
+        # Get filter parameters
+        params = self.filter_params.to_params()
+        
+        # Provide sensible defaults that mirror the HTTP test defaults if not supplied
+        # Default pagination
+        if "pageNumber" not in params:
+            params["pageNumber"] = 1
+        if "pageSize" not in params:
+            params["pageSize"] = 10
+        # Default sorting
+        if "sortBy" not in params:
+            params["sortBy"] = "createdAt"
+        if "sortType" not in params:
+            params["sortType"] = "ASC"
+        
+        # Make request with parameters
+        response = self.http_client.get(f"assets/{self.asset_id}/tasks", params=params)
+        
+        result_meta = response.get("result", {})
+        entities_data = result_meta.get("entities", [])
+        
+        # Convert to AssetTask objects using Pydantic parsing with aliases
+        paginated_tasks = PaginatedList(
+            [AssetTask.model_validate(entity) for entity in entities_data],
+            total_entity_count=result_meta.get("totalEntityCount"),
+            current_page=result_meta.get("currentPage", params.get("pageNumber", 1)),
+            page_size=result_meta.get("pageSize", params.get("pageSize", len(entities_data))),
+            total_page_count=result_meta.get("totalPageCount"),
+        )
+
+        return paginated_tasks
+
+
+class GetAssetGroupsByOrganizationIdQuery(Query[List[Dict[str, Any]]]):
+    """Query to get root asset groups by organization ID."""
+    
+    def __init__(self, http_client: HTTPClient, organization_id: int):
+        self.http_client = http_client
+        self.organization_id = organization_id
+    
+    def execute(self) -> List[Dict[str, Any]]:
+        """Execute the query to get asset groups by organization ID."""
+        response = self.http_client.get(f"asset-groups/root/{self.organization_id}")
+        return response.get("result", [])
+
+
+class GetAssetGroupsByParentIdQuery(Query[List[Dict[str, Any]]]):
+    """Query to get asset groups by parent ID."""
+    
+    def __init__(self, http_client: HTTPClient, group_id: str):
+        self.http_client = http_client
+        self.group_id = group_id
+    
+    def execute(self) -> List[Dict[str, Any]]:
+        """Execute the query to get asset groups by parent ID."""
+        response = self.http_client.get(f"asset-groups/{self.group_id}")
+        return response.get("result", [])
+
+
+class GetAssetTagsQuery(Query[Dict[str, Any]]):
+    """Query to get asset tags with filtering."""
+    
+    def __init__(self, http_client: HTTPClient, organization_ids: List[int], 
+                 page_number: int = 1, page_size: int = 10, sort_by: str = "createdAt",
+                 search_term: Optional[str] = None):
+        self.http_client = http_client
+        self.organization_ids = organization_ids
+        self.page_number = page_number
+        self.page_size = page_size
+        self.sort_by = sort_by
+        self.search_term = search_term
+    
+    def execute(self) -> Dict[str, Any]:
+        """Execute the query to get asset tags."""
+        params = {
+            "filter[organizationIds]": ",".join(map(str, self.organization_ids)),
+            "pageNumber": self.page_number,
+            "pageSize": self.page_size,
+            "sortBy": self.sort_by
+        }
+        
+        if self.search_term:
+            params["filter[searchTerm]"] = self.search_term
+        
+        response = self.http_client.get("asset-tags", params=params)
+        return response.get("result", {})
+
+
+class GetProcessorsByAssetTypeIdQuery(Query[List[Dict[str, Any]]]):
+    """Query to get processors by asset type ID."""
+    
+    def __init__(self, http_client: HTTPClient, asset_type_id: int):
+        self.http_client = http_client
+        self.asset_type_id = asset_type_id
+    
+    def execute(self) -> List[Dict[str, Any]]:
+        """Execute the query to get processors by asset type ID."""
+        response = self.http_client.get(f"processors/asset-type/{self.asset_type_id}")
+        return response.get("result", [])
+
+
+class GetProcessorTypesByAssetTypeQuery(Query[Dict[str, Any]]):
+    """Query to get processor types by asset type ID."""
+    
+    def __init__(self, http_client: HTTPClient, asset_type_id: int):
+        self.http_client = http_client
+        self.asset_type_id = asset_type_id
+    
+    def execute(self) -> Dict[str, Any]:
+        """Execute the query to get processor types by asset type ID."""
+        response = self.http_client.get(f"processors/type/{self.asset_type_id}")
+        return response.get("result", {})