binalyze-air-sdk 1.0.2__py3-none-any.whl → 1.0.3__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- binalyze_air/__init__.py +77 -77
- binalyze_air/apis/__init__.py +67 -27
- binalyze_air/apis/acquisitions.py +107 -0
- binalyze_air/apis/api_tokens.py +49 -0
- binalyze_air/apis/assets.py +161 -0
- binalyze_air/apis/audit_logs.py +26 -0
- binalyze_air/apis/{authentication.py → auth.py} +29 -27
- binalyze_air/apis/auto_asset_tags.py +79 -75
- binalyze_air/apis/backup.py +177 -0
- binalyze_air/apis/baseline.py +46 -0
- binalyze_air/apis/cases.py +225 -0
- binalyze_air/apis/cloud_forensics.py +116 -0
- binalyze_air/apis/event_subscription.py +96 -96
- binalyze_air/apis/evidence.py +249 -53
- binalyze_air/apis/interact.py +153 -36
- binalyze_air/apis/investigation_hub.py +234 -0
- binalyze_air/apis/license.py +104 -0
- binalyze_air/apis/logger.py +83 -0
- binalyze_air/apis/multipart_upload.py +201 -0
- binalyze_air/apis/notifications.py +115 -0
- binalyze_air/apis/organizations.py +267 -0
- binalyze_air/apis/params.py +44 -39
- binalyze_air/apis/policies.py +186 -0
- binalyze_air/apis/preset_filters.py +79 -0
- binalyze_air/apis/recent_activities.py +71 -0
- binalyze_air/apis/relay_server.py +104 -0
- binalyze_air/apis/settings.py +395 -27
- binalyze_air/apis/tasks.py +80 -0
- binalyze_air/apis/triage.py +197 -0
- binalyze_air/apis/user_management.py +183 -74
- binalyze_air/apis/webhook_executions.py +50 -0
- binalyze_air/apis/webhooks.py +322 -230
- binalyze_air/base.py +207 -133
- binalyze_air/client.py +217 -1337
- binalyze_air/commands/__init__.py +175 -145
- binalyze_air/commands/acquisitions.py +661 -387
- binalyze_air/commands/api_tokens.py +55 -0
- binalyze_air/commands/assets.py +324 -362
- binalyze_air/commands/{authentication.py → auth.py} +36 -36
- binalyze_air/commands/auto_asset_tags.py +230 -230
- binalyze_air/commands/backup.py +47 -0
- binalyze_air/commands/baseline.py +32 -396
- binalyze_air/commands/cases.py +609 -602
- binalyze_air/commands/cloud_forensics.py +88 -0
- binalyze_air/commands/event_subscription.py +101 -101
- binalyze_air/commands/evidences.py +918 -988
- binalyze_air/commands/interact.py +172 -58
- binalyze_air/commands/investigation_hub.py +315 -0
- binalyze_air/commands/license.py +183 -0
- binalyze_air/commands/logger.py +126 -0
- binalyze_air/commands/multipart_upload.py +363 -0
- binalyze_air/commands/notifications.py +45 -0
- binalyze_air/commands/organizations.py +200 -221
- binalyze_air/commands/policies.py +175 -203
- binalyze_air/commands/preset_filters.py +55 -0
- binalyze_air/commands/recent_activities.py +32 -0
- binalyze_air/commands/relay_server.py +144 -0
- binalyze_air/commands/settings.py +431 -29
- binalyze_air/commands/tasks.py +95 -56
- binalyze_air/commands/triage.py +224 -360
- binalyze_air/commands/user_management.py +351 -126
- binalyze_air/commands/webhook_executions.py +77 -0
- binalyze_air/config.py +244 -244
- binalyze_air/exceptions.py +49 -49
- binalyze_air/http_client.py +426 -305
- binalyze_air/models/__init__.py +287 -285
- binalyze_air/models/acquisitions.py +365 -250
- binalyze_air/models/api_tokens.py +73 -0
- binalyze_air/models/assets.py +438 -438
- binalyze_air/models/audit.py +247 -272
- binalyze_air/models/audit_logs.py +14 -0
- binalyze_air/models/{authentication.py → auth.py} +69 -69
- binalyze_air/models/auto_asset_tags.py +227 -116
- binalyze_air/models/backup.py +138 -0
- binalyze_air/models/baseline.py +231 -231
- binalyze_air/models/cases.py +275 -275
- binalyze_air/models/cloud_forensics.py +145 -0
- binalyze_air/models/event_subscription.py +170 -171
- binalyze_air/models/evidence.py +65 -65
- binalyze_air/models/evidences.py +367 -348
- binalyze_air/models/interact.py +266 -135
- binalyze_air/models/investigation_hub.py +265 -0
- binalyze_air/models/license.py +150 -0
- binalyze_air/models/logger.py +83 -0
- binalyze_air/models/multipart_upload.py +352 -0
- binalyze_air/models/notifications.py +138 -0
- binalyze_air/models/organizations.py +293 -293
- binalyze_air/models/params.py +153 -127
- binalyze_air/models/policies.py +260 -249
- binalyze_air/models/preset_filters.py +79 -0
- binalyze_air/models/recent_activities.py +70 -0
- binalyze_air/models/relay_server.py +121 -0
- binalyze_air/models/settings.py +538 -84
- binalyze_air/models/tasks.py +215 -149
- binalyze_air/models/triage.py +141 -142
- binalyze_air/models/user_management.py +200 -97
- binalyze_air/models/webhook_executions.py +33 -0
- binalyze_air/queries/__init__.py +121 -133
- binalyze_air/queries/acquisitions.py +155 -155
- binalyze_air/queries/api_tokens.py +46 -0
- binalyze_air/queries/assets.py +186 -105
- binalyze_air/queries/audit.py +400 -416
- binalyze_air/queries/{authentication.py → auth.py} +55 -55
- binalyze_air/queries/auto_asset_tags.py +59 -59
- binalyze_air/queries/backup.py +66 -0
- binalyze_air/queries/baseline.py +21 -185
- binalyze_air/queries/cases.py +292 -292
- binalyze_air/queries/cloud_forensics.py +137 -0
- binalyze_air/queries/event_subscription.py +54 -54
- binalyze_air/queries/evidence.py +139 -139
- binalyze_air/queries/evidences.py +279 -279
- binalyze_air/queries/interact.py +140 -28
- binalyze_air/queries/investigation_hub.py +329 -0
- binalyze_air/queries/license.py +85 -0
- binalyze_air/queries/logger.py +58 -0
- binalyze_air/queries/multipart_upload.py +180 -0
- binalyze_air/queries/notifications.py +71 -0
- binalyze_air/queries/organizations.py +222 -222
- binalyze_air/queries/params.py +154 -115
- binalyze_air/queries/policies.py +149 -149
- binalyze_air/queries/preset_filters.py +60 -0
- binalyze_air/queries/recent_activities.py +44 -0
- binalyze_air/queries/relay_server.py +42 -0
- binalyze_air/queries/settings.py +533 -20
- binalyze_air/queries/tasks.py +125 -81
- binalyze_air/queries/triage.py +230 -230
- binalyze_air/queries/user_management.py +193 -83
- binalyze_air/queries/webhook_executions.py +39 -0
- binalyze_air_sdk-1.0.3.dist-info/METADATA +752 -0
- binalyze_air_sdk-1.0.3.dist-info/RECORD +132 -0
- {binalyze_air_sdk-1.0.2.dist-info → binalyze_air_sdk-1.0.3.dist-info}/WHEEL +1 -1
- binalyze_air/apis/endpoints.py +0 -22
- binalyze_air/apis/evidences.py +0 -216
- binalyze_air/apis/users.py +0 -68
- binalyze_air/commands/users.py +0 -101
- binalyze_air/models/endpoints.py +0 -76
- binalyze_air/models/users.py +0 -82
- binalyze_air/queries/endpoints.py +0 -25
- binalyze_air/queries/users.py +0 -69
- binalyze_air_sdk-1.0.2.dist-info/METADATA +0 -706
- binalyze_air_sdk-1.0.2.dist-info/RECORD +0 -82
- {binalyze_air_sdk-1.0.2.dist-info → binalyze_air_sdk-1.0.3.dist-info}/top_level.txt +0 -0
@@ -1,706 +0,0 @@
|
|
1
|
-
Metadata-Version: 2.4
|
2
|
-
Name: binalyze-air-sdk
|
3
|
-
Version: 1.0.2
|
4
|
-
Summary: Complete Python SDK for Binalyze AIR API - 100% API Coverage
|
5
|
-
Home-page: https://github.com/binalyze/air-python-sdk
|
6
|
-
Author: Binalyze
|
7
|
-
Author-email: support@binalyze.com
|
8
|
-
Project-URL: Bug Reports, https://github.com/binalyze/air-python-sdk/issues
|
9
|
-
Project-URL: Source, https://github.com/binalyze/air-python-sdk
|
10
|
-
Project-URL: Documentation, https://github.com/binalyze/air-python-sdk/blob/main/README.md
|
11
|
-
Keywords: binalyze air forensics security api sdk digital-forensics incident-response
|
12
|
-
Classifier: Development Status :: 5 - Production/Stable
|
13
|
-
Classifier: Intended Audience :: Developers
|
14
|
-
Classifier: Intended Audience :: Information Technology
|
15
|
-
Classifier: Intended Audience :: System Administrators
|
16
|
-
Classifier: License :: OSI Approved :: MIT License
|
17
|
-
Classifier: Operating System :: OS Independent
|
18
|
-
Classifier: Programming Language :: Python :: 3
|
19
|
-
Classifier: Programming Language :: Python :: 3.8
|
20
|
-
Classifier: Programming Language :: Python :: 3.9
|
21
|
-
Classifier: Programming Language :: Python :: 3.10
|
22
|
-
Classifier: Programming Language :: Python :: 3.11
|
23
|
-
Classifier: Programming Language :: Python :: 3.12
|
24
|
-
Classifier: Topic :: Security
|
25
|
-
Classifier: Topic :: System :: Systems Administration
|
26
|
-
Classifier: Topic :: Software Development :: Libraries :: Python Modules
|
27
|
-
Requires-Python: >=3.8
|
28
|
-
Description-Content-Type: text/markdown
|
29
|
-
Requires-Dist: requests>=2.25.1
|
30
|
-
Requires-Dist: pydantic>=2.0.0
|
31
|
-
Requires-Dist: typing-extensions>=4.0.0
|
32
|
-
Requires-Dist: python-dateutil>=2.8.0
|
33
|
-
Requires-Dist: urllib3>=1.26.0
|
34
|
-
Provides-Extra: dev
|
35
|
-
Requires-Dist: pytest>=6.0; extra == "dev"
|
36
|
-
Requires-Dist: pytest-asyncio; extra == "dev"
|
37
|
-
Requires-Dist: black; extra == "dev"
|
38
|
-
Requires-Dist: isort; extra == "dev"
|
39
|
-
Requires-Dist: mypy; extra == "dev"
|
40
|
-
Requires-Dist: flake8; extra == "dev"
|
41
|
-
Provides-Extra: testing
|
42
|
-
Requires-Dist: pytest>=6.0; extra == "testing"
|
43
|
-
Requires-Dist: pytest-cov; extra == "testing"
|
44
|
-
Requires-Dist: pytest-mock; extra == "testing"
|
45
|
-
Dynamic: author
|
46
|
-
Dynamic: author-email
|
47
|
-
Dynamic: classifier
|
48
|
-
Dynamic: description
|
49
|
-
Dynamic: description-content-type
|
50
|
-
Dynamic: home-page
|
51
|
-
Dynamic: keywords
|
52
|
-
Dynamic: project-url
|
53
|
-
Dynamic: provides-extra
|
54
|
-
Dynamic: requires-dist
|
55
|
-
Dynamic: requires-python
|
56
|
-
Dynamic: summary
|
57
|
-
|
58
|
-
# 🎉 Binalyze AIR Python SDK - Production Ready SDK
|
59
|
-
|
60
|
-
**PRODUCTION READY!** A comprehensive Python SDK for the Binalyze AIR cybersecurity platform with **extensive API coverage** across **18 modules**.
|
61
|
-
|
62
|
-
[](https://github.com/binalyze/air-python-sdk)
|
63
|
-
[](https://github.com/binalyze/air-python-sdk)
|
64
|
-
[](https://github.com/binalyze/air-python-sdk)
|
65
|
-
[](https://python.org)
|
66
|
-
[](LICENSE)
|
67
|
-
|
68
|
-
## 🏆 Comprehensive SDK Coverage
|
69
|
-
|
70
|
-
- ✅ **Core Operations**: Assets, Cases, Tasks, Acquisitions management
|
71
|
-
- ✅ **Security & Intelligence**: Triage, Authentication, Policies
|
72
|
-
- ✅ **Data Management**: Evidence, Audit logs, Baseline comparison
|
73
|
-
- ✅ **Administration**: Organizations, Users, Settings
|
74
|
-
- ✅ **Integration**: Webhooks, Event subscriptions, Interactions
|
75
|
-
- ✅ **Enterprise Ready**: Full error handling & validation
|
76
|
-
- ✅ **Performance Tested**: Response time validation
|
77
|
-
|
78
|
-
## 🚀 Complete Feature Set
|
79
|
-
|
80
|
-
### **Core Operations**
|
81
|
-
|
82
|
-
- **🔧 Acquisitions** - Forensic data collection, imaging, and evidence acquisition
|
83
|
-
- **📂 Cases** - Complete investigation workflow and collaboration
|
84
|
-
- **📊 Tasks** - Task orchestration and monitoring
|
85
|
-
- **🖥️ Assets** - Asset management, isolation, tagging, and control
|
86
|
-
|
87
|
-
### **Security & Intelligence**
|
88
|
-
|
89
|
-
- **🔍 Triage** - Threat detection, YARA rule creation, and analysis
|
90
|
-
- **🔐 Authentication** - Secure login, token management, and validation
|
91
|
-
- **📋 Policies** - Policy management, assignment, and execution
|
92
|
-
- **📈 Baseline** - System baseline comparison and monitoring
|
93
|
-
|
94
|
-
### **Data Management**
|
95
|
-
|
96
|
-
- **📚 Evidence** - Evidence storage, retrieval, and management
|
97
|
-
- **📊 Audit** - Comprehensive audit logging and analytics
|
98
|
-
- **🏷️ Auto Asset Tags** - Automated asset classification and tagging
|
99
|
-
- **📚 Evidences** - Repository management for evidence storage
|
100
|
-
|
101
|
-
### **Administration**
|
102
|
-
|
103
|
-
- **🏢 Organizations** - Multi-tenant administration and settings
|
104
|
-
- **👥 Users** - User administration and permissions
|
105
|
-
- **⚙️ Settings** - System configuration and banner management
|
106
|
-
- **🔗 Webhooks** - External system integration and triggers
|
107
|
-
|
108
|
-
### **Integration & Advanced**
|
109
|
-
|
110
|
-
- **📡 Event Subscription** - Real-time event notifications
|
111
|
-
- **💬 Interact** - Shell interaction and command execution
|
112
|
-
- **⚙️ Params** - System parameters and configuration
|
113
|
-
- **🏷️ Endpoints** - Endpoint tag management
|
114
|
-
|
115
|
-
## 📦 Installation
|
116
|
-
|
117
|
-
### **Standard Installation**
|
118
|
-
|
119
|
-
```bash
|
120
|
-
pip install binalyze-air-sdk
|
121
|
-
```
|
122
|
-
|
123
|
-
### **Development Installation**
|
124
|
-
|
125
|
-
```bash
|
126
|
-
git clone https://github.com/binalyze/air-python-sdk.git
|
127
|
-
cd air-python-sdk
|
128
|
-
pip install -r requirements.txt
|
129
|
-
pip install -e .
|
130
|
-
```
|
131
|
-
|
132
|
-
### **Requirements**
|
133
|
-
|
134
|
-
- Python 3.8+
|
135
|
-
- requests>=2.25.1
|
136
|
-
- pydantic>=2.0.0
|
137
|
-
- python-dateutil>=2.8.0
|
138
|
-
- urllib3>=1.26.0
|
139
|
-
|
140
|
-
## 🔧 Quick Start
|
141
|
-
|
142
|
-
```python
|
143
|
-
from binalyze_air import AIRClient
|
144
|
-
|
145
|
-
# Initialize client
|
146
|
-
client = AIRClient(
|
147
|
-
host="https://your-air-instance.com",
|
148
|
-
api_token="your-api-token",
|
149
|
-
organization_id=0
|
150
|
-
)
|
151
|
-
|
152
|
-
# Test authentication
|
153
|
-
auth_status = client.authentication.check_status()
|
154
|
-
if auth_status.get('success'):
|
155
|
-
print("✅ Connected to Binalyze AIR!")
|
156
|
-
|
157
|
-
# Asset Management
|
158
|
-
assets = client.assets.list()
|
159
|
-
client.assets.isolate(["endpoint-id"])
|
160
|
-
client.assets.add_tags(["endpoint-id"], ["investigation", "priority"])
|
161
|
-
|
162
|
-
# Case Management
|
163
|
-
from binalyze_air.models.cases import CreateCaseRequest
|
164
|
-
case_request = CreateCaseRequest(
|
165
|
-
name="Security Investigation",
|
166
|
-
description="Investigating suspicious activity",
|
167
|
-
visibility="public-to-organization"
|
168
|
-
)
|
169
|
-
case = client.cases.create(case_request)
|
170
|
-
|
171
|
-
# Evidence Acquisition
|
172
|
-
profiles = client.acquisitions.list_profiles()
|
173
|
-
acquisition_request = {
|
174
|
-
"case_id": case.id,
|
175
|
-
"acquisition_profile_id": profiles[0].id,
|
176
|
-
"filter": {
|
177
|
-
"included_endpoint_ids": ["endpoint-id"],
|
178
|
-
"organization_ids": [0]
|
179
|
-
}
|
180
|
-
}
|
181
|
-
acquisition = client.acquisitions.acquire(acquisition_request)
|
182
|
-
|
183
|
-
# Triage Operations
|
184
|
-
rules = client.triage.list_rules()
|
185
|
-
validation = client.triage.validate_rule("rule content", "yara")
|
186
|
-
|
187
|
-
# Task Management
|
188
|
-
tasks = client.tasks.list()
|
189
|
-
task_assignments = client.tasks.get_assignments("task-id")
|
190
|
-
|
191
|
-
# User Management
|
192
|
-
users = client.user_management.list_users()
|
193
|
-
user_details = client.user_management.get_user("user-id")
|
194
|
-
```
|
195
|
-
|
196
|
-
## 📚 Complete API Reference
|
197
|
-
|
198
|
-
### **🔧 Acquisitions**
|
199
|
-
|
200
|
-
```python
|
201
|
-
# Profiles
|
202
|
-
client.acquisitions.list_profiles(filter_params, organization_ids, all_organizations)
|
203
|
-
client.acquisitions.get_profile(profile_id)
|
204
|
-
client.acquisitions.create_profile(request)
|
205
|
-
|
206
|
-
# Tasks
|
207
|
-
client.acquisitions.acquire(request) # Assign evidence task
|
208
|
-
client.acquisitions.acquire_image(request) # Assign image task
|
209
|
-
|
210
|
-
# Legacy aliases
|
211
|
-
client.acquisitions.assign_task(request) # Legacy alias for acquire
|
212
|
-
client.acquisitions.assign_image_task(request) # Legacy alias for acquire_image
|
213
|
-
```
|
214
|
-
|
215
|
-
### **📂 Cases**
|
216
|
-
|
217
|
-
```python
|
218
|
-
# Case Management
|
219
|
-
client.cases.list(filter_params, organization_ids) # List cases
|
220
|
-
client.cases.create(case_data) # Create case
|
221
|
-
client.cases.get(case_id) # Get case details
|
222
|
-
client.cases.update(case_id, update_data) # Update case
|
223
|
-
client.cases.close(case_id) # Close case
|
224
|
-
client.cases.open(case_id) # Open case
|
225
|
-
client.cases.archive(case_id) # Archive case
|
226
|
-
client.cases.change_owner(case_id, user_id) # Change owner
|
227
|
-
client.cases.check_name(name) # Check name availability
|
228
|
-
|
229
|
-
# Case Data
|
230
|
-
client.cases.get_activities(case_id, filter_params) # Get activities
|
231
|
-
client.cases.get_endpoints(case_id, filter_params) # Get case endpoints
|
232
|
-
client.cases.get_tasks(case_id, filter_params) # Get case tasks
|
233
|
-
client.cases.get_users(case_id, filter_params) # Get case users
|
234
|
-
|
235
|
-
# Case Operations
|
236
|
-
client.cases.remove_endpoints(case_id, filter_params) # Remove endpoints
|
237
|
-
client.cases.remove_task_assignment(case_id, task_assignment_id) # Remove task
|
238
|
-
client.cases.import_task_assignments(case_id, task_assignment_ids) # Import tasks
|
239
|
-
|
240
|
-
# Notes
|
241
|
-
client.cases.add_note(case_id, note) # Add note
|
242
|
-
client.cases.update_note(case_id, note_id, note) # Update note
|
243
|
-
client.cases.delete_note(case_id, note_id) # Delete note
|
244
|
-
|
245
|
-
# Export
|
246
|
-
client.cases.export_notes(case_id) # Export notes
|
247
|
-
client.cases.export_cases(filter_params) # Export cases
|
248
|
-
client.cases.export_endpoints(case_id, filter_params) # Export endpoints
|
249
|
-
client.cases.export_activities(case_id, filter_params) # Export activities
|
250
|
-
```
|
251
|
-
|
252
|
-
### **🖥️ Assets**
|
253
|
-
|
254
|
-
```python
|
255
|
-
# Asset Information
|
256
|
-
client.assets.list(filter_params) # List assets
|
257
|
-
client.assets.get(asset_id) # Get asset details
|
258
|
-
client.assets.get_tasks(asset_id, filter_params) # Get asset tasks
|
259
|
-
|
260
|
-
# Asset Control
|
261
|
-
client.assets.isolate(endpoint_ids, organization_ids) # Isolate assets
|
262
|
-
client.assets.unisolate(endpoint_ids, organization_ids) # Remove isolation
|
263
|
-
client.assets.reboot(endpoint_ids, organization_ids) # Reboot assets
|
264
|
-
client.assets.shutdown(endpoint_ids, organization_ids) # Shutdown assets
|
265
|
-
|
266
|
-
# Asset Management
|
267
|
-
client.assets.add_tags(endpoint_ids, tags, organization_ids) # Add tags
|
268
|
-
client.assets.remove_tags(endpoint_ids, tags, organization_ids) # Remove tags
|
269
|
-
client.assets.uninstall(endpoint_ids, purge_data, organization_ids) # Uninstall
|
270
|
-
client.assets.retrieve_logs(endpoint_ids, organization_ids) # Retrieve logs
|
271
|
-
client.assets.version_update(endpoint_ids, organization_ids) # Update version
|
272
|
-
```
|
273
|
-
|
274
|
-
### **📊 Tasks**
|
275
|
-
|
276
|
-
```python
|
277
|
-
client.tasks.list(filter_params, organization_ids) # List tasks
|
278
|
-
client.tasks.get(task_id) # Get task details
|
279
|
-
client.tasks.get_assignments(task_id) # Get task assignments
|
280
|
-
client.tasks.cancel(task_id) # Cancel task
|
281
|
-
client.tasks.delete(task_id) # Delete task
|
282
|
-
client.tasks.cancel_assignment(assignment_id) # Cancel assignment
|
283
|
-
client.tasks.delete_assignment(assignment_id) # Delete assignment
|
284
|
-
```
|
285
|
-
|
286
|
-
### **🔍 Triage**
|
287
|
-
|
288
|
-
```python
|
289
|
-
# Rules
|
290
|
-
client.triage.list_rules(filter_params, organization_ids) # List rules
|
291
|
-
client.triage.create_rule(rule_data) # Create rule
|
292
|
-
client.triage.get_rule(rule_id) # Get rule
|
293
|
-
client.triage.get_rule_by_id(rule_id) # Get rule (alias)
|
294
|
-
client.triage.update_rule(rule_id, data) # Update rule
|
295
|
-
client.triage.delete_rule(rule_id) # Delete rule
|
296
|
-
client.triage.validate_rule(rule_content, engine) # Validate rule
|
297
|
-
|
298
|
-
# Tags & Tasks
|
299
|
-
client.triage.list_tags(organization_id) # List tags
|
300
|
-
client.triage.create_tag(tag_data) # Create tag
|
301
|
-
client.triage.delete_tag(tag_id) # Delete tag
|
302
|
-
client.triage.assign_task(task_data) # Assign task
|
303
|
-
```
|
304
|
-
|
305
|
-
### **📋 Policies**
|
306
|
-
|
307
|
-
```python
|
308
|
-
# Policy Management
|
309
|
-
client.policies.list(filter_params, organization_ids) # List policies
|
310
|
-
client.policies.get(policy_id) # Get policy
|
311
|
-
client.policies.create(policy_data) # Create policy
|
312
|
-
client.policies.update(policy_id, update_data) # Update policy
|
313
|
-
client.policies.delete(policy_id) # Delete policy
|
314
|
-
client.policies.activate(policy_id) # Activate policy
|
315
|
-
client.policies.deactivate(policy_id) # Deactivate policy
|
316
|
-
|
317
|
-
# Policy Operations
|
318
|
-
client.policies.get_assignments(policy_id) # Get assignments
|
319
|
-
client.policies.get_executions(policy_id) # Get executions
|
320
|
-
client.policies.assign(assignment_data) # Assign policy
|
321
|
-
client.policies.unassign(policy_id, endpoint_ids) # Unassign policy
|
322
|
-
client.policies.execute(policy_id, endpoint_ids) # Execute policy
|
323
|
-
client.policies.get_match_stats(filter_params, organization_ids) # Get stats
|
324
|
-
client.policies.update_priorities(policy_ids, organization_ids) # Update priorities
|
325
|
-
```
|
326
|
-
|
327
|
-
### **🔐 Authentication**
|
328
|
-
|
329
|
-
```python
|
330
|
-
client.authentication.login(credentials) # Login with credentials
|
331
|
-
client.authentication.check_status() # Check auth status
|
332
|
-
```
|
333
|
-
|
334
|
-
### **🏢 Organizations**
|
335
|
-
|
336
|
-
```python
|
337
|
-
# Organization Management
|
338
|
-
client.organizations.list(page, page_size, sort_by, order) # List organizations
|
339
|
-
client.organizations.create(org_data) # Create organization
|
340
|
-
client.organizations.get(org_id) # Get organization
|
341
|
-
client.organizations.update(org_id, data) # Update organization
|
342
|
-
client.organizations.delete(org_id) # Delete organization
|
343
|
-
client.organizations.check_name(name) # Check name availability
|
344
|
-
|
345
|
-
# User Management
|
346
|
-
client.organizations.get_users(org_id, page, page_size) # Get org users
|
347
|
-
client.organizations.add_user(org_id, user_data) # Add user
|
348
|
-
client.organizations.assign_users(org_id, user_ids) # Assign users
|
349
|
-
client.organizations.remove_user(org_id, user_id) # Remove user
|
350
|
-
|
351
|
-
# Settings & Configuration
|
352
|
-
client.organizations.update_settings(org_id, settings) # Update settings
|
353
|
-
client.organizations.get_shareable_deployment_info(token) # Get deployment info
|
354
|
-
client.organizations.update_shareable_deployment_settings(org_id, status) # Update deployment
|
355
|
-
client.organizations.update_deployment_token(org_id, token) # Update token
|
356
|
-
|
357
|
-
# Tags
|
358
|
-
client.organizations.add_tags(org_id, tags) # Add tags
|
359
|
-
client.organizations.delete_tags(org_id, tags) # Delete tags
|
360
|
-
client.organizations.remove_tags(org_id, tags) # Remove tags (alias)
|
361
|
-
```
|
362
|
-
|
363
|
-
### **👥 Users**
|
364
|
-
|
365
|
-
```python
|
366
|
-
client.user_management.list_users() # List users
|
367
|
-
client.user_management.get_user(user_id) # Get user details
|
368
|
-
client.user_management.create_api_user(user_data) # Create API user
|
369
|
-
```
|
370
|
-
|
371
|
-
### **📊 Audit**
|
372
|
-
|
373
|
-
```python
|
374
|
-
client.audit.list_logs(filter_params, organization_ids) # List audit logs
|
375
|
-
client.audit.get_log(log_id) # Get audit log
|
376
|
-
client.audit.export_logs(filter_params, format, organization_ids) # Export logs
|
377
|
-
client.audit.get_summary(org_id, start_date, end_date) # Get summary
|
378
|
-
client.audit.get_user_activity(org_id, start_date, end_date, user_id) # Get activity
|
379
|
-
client.audit.get_system_events(org_id, start_date, end_date, severity) # Get events
|
380
|
-
client.audit.get_retention_policy(org_id) # Get retention policy
|
381
|
-
```
|
382
|
-
|
383
|
-
### **📈 Baseline**
|
384
|
-
|
385
|
-
```python
|
386
|
-
# Baseline Management
|
387
|
-
client.baseline.list(filter_params, organization_ids) # List baselines
|
388
|
-
client.baseline.create(request) # Create baseline
|
389
|
-
client.baseline.get(baseline_id) # Get baseline
|
390
|
-
client.baseline.update(baseline_id, request) # Update baseline
|
391
|
-
client.baseline.delete(baseline_id) # Delete baseline
|
392
|
-
client.baseline.refresh(baseline_id) # Refresh baseline
|
393
|
-
|
394
|
-
# Comparisons
|
395
|
-
client.baseline.get_comparisons(baseline_id) # Get comparisons
|
396
|
-
client.baseline.get_comparison(comparison_id) # Get comparison
|
397
|
-
client.baseline.compare(request) # Run comparison
|
398
|
-
client.baseline.get_comparison_report(baseline_id, task_id) # Get report
|
399
|
-
|
400
|
-
# Profiles & Schedules
|
401
|
-
client.baseline.list_profiles(organization_ids) # List profiles
|
402
|
-
client.baseline.get_profile(profile_id) # Get profile
|
403
|
-
client.baseline.create_profile(request) # Create profile
|
404
|
-
client.baseline.update_profile(profile_id, request) # Update profile
|
405
|
-
client.baseline.delete_profile(profile_id) # Delete profile
|
406
|
-
client.baseline.get_schedules(baseline_id, organization_ids) # Get schedules
|
407
|
-
client.baseline.create_schedule(baseline_id, schedule_data) # Create schedule
|
408
|
-
client.baseline.delete_schedule(schedule_id) # Delete schedule
|
409
|
-
|
410
|
-
# Advanced Operations
|
411
|
-
client.baseline.acquire(baseline_data) # Acquire baseline
|
412
|
-
client.baseline.acquire_by_filter(filter_data, case_id) # Acquire by filter
|
413
|
-
client.baseline.compare_by_endpoint(endpoint_id, task_ids) # Compare by endpoint
|
414
|
-
```
|
415
|
-
|
416
|
-
### **📚 Evidence**
|
417
|
-
|
418
|
-
```python
|
419
|
-
# Case Evidence (Read-only)
|
420
|
-
client.evidence.get_case_evidence_ppc(endpoint_id, task_id) # Get PPC
|
421
|
-
client.evidence.get_case_evidence_report_file_info(endpoint_id, task_id) # Get file info
|
422
|
-
client.evidence.get_case_evidence_report(endpoint_id, task_id) # Get report
|
423
|
-
|
424
|
-
# Repository Operations (delegates to evidences API)
|
425
|
-
client.evidence.list_repositories() # List repositories
|
426
|
-
```
|
427
|
-
|
428
|
-
### **📚 Evidences (Repository Management)**
|
429
|
-
|
430
|
-
```python
|
431
|
-
# Repository Management
|
432
|
-
client.evidences.list_repositories() # List all repositories
|
433
|
-
|
434
|
-
# SMB Repositories
|
435
|
-
client.evidences.create_smb_repository(request) # Create SMB
|
436
|
-
client.evidences.update_smb_repository(repo_id, request) # Update SMB
|
437
|
-
|
438
|
-
# SFTP Repositories
|
439
|
-
client.evidences.create_sftp_repository(request) # Create SFTP
|
440
|
-
client.evidences.update_sftp_repository(repo_id, request) # Update SFTP
|
441
|
-
|
442
|
-
# FTPS Repositories
|
443
|
-
client.evidences.create_ftps_repository(request) # Create FTPS
|
444
|
-
client.evidences.update_ftps_repository(repo_id, request) # Update FTPS
|
445
|
-
client.evidences.validate_ftps_repository(request) # Validate FTPS
|
446
|
-
|
447
|
-
# Azure Storage Repositories
|
448
|
-
client.evidences.create_azure_repository(request) # Create Azure
|
449
|
-
client.evidences.update_azure_repository(repo_id, request) # Update Azure
|
450
|
-
client.evidences.validate_azure_repository(request) # Validate Azure
|
451
|
-
|
452
|
-
# Amazon S3 Repositories
|
453
|
-
client.evidences.create_s3_repository(request) # Create S3
|
454
|
-
client.evidences.update_s3_repository(repo_id, request) # Update S3
|
455
|
-
client.evidences.validate_s3_repository(request) # Validate S3
|
456
|
-
|
457
|
-
# Repository Operations
|
458
|
-
client.evidences.delete_repository(repo_id) # Delete repository
|
459
|
-
client.evidences.validate_repository(request) # Validate repository
|
460
|
-
client.evidences.get_repository_volumes(repo_id) # Get volumes
|
461
|
-
```
|
462
|
-
|
463
|
-
### **🏷️ Auto Asset Tags**
|
464
|
-
|
465
|
-
```python
|
466
|
-
client.auto_asset_tags.list(filter_params) # List auto tags
|
467
|
-
client.auto_asset_tags.create(request) # Create auto tag
|
468
|
-
client.auto_asset_tags.get(tag_id) # Get auto tag
|
469
|
-
client.auto_asset_tags.update(tag_id, request) # Update auto tag
|
470
|
-
client.auto_asset_tags.delete(tag_id) # Delete auto tag
|
471
|
-
client.auto_asset_tags.start_tagging(request) # Start tagging
|
472
|
-
```
|
473
|
-
|
474
|
-
### **📡 Event Subscription**
|
475
|
-
|
476
|
-
```python
|
477
|
-
client.event_subscription.list(filter_params) # List subscriptions
|
478
|
-
client.event_subscription.create(request) # Create subscription
|
479
|
-
client.event_subscription.get(subscription_id) # Get subscription
|
480
|
-
client.event_subscription.update(subscription_id, request) # Update subscription
|
481
|
-
client.event_subscription.delete(subscription_id) # Delete subscription
|
482
|
-
```
|
483
|
-
|
484
|
-
### **💬 Interact**
|
485
|
-
|
486
|
-
```python
|
487
|
-
client.interact.assign_shell_task(request) # Assign shell task
|
488
|
-
client.interact.get_shell_task_response(task_id) # Get shell response
|
489
|
-
```
|
490
|
-
|
491
|
-
### **⚙️ Params**
|
492
|
-
|
493
|
-
```python
|
494
|
-
client.params.get_drone_analyzers() # Get drone analyzers
|
495
|
-
client.params.get_acquisition_artifacts() # Get acquisition artifacts
|
496
|
-
client.params.get_acquisition_evidences() # Get acquisition evidences
|
497
|
-
client.params.get_e_discovery_patterns() # Get e-discovery patterns
|
498
|
-
```
|
499
|
-
|
500
|
-
### **⚙️ Settings**
|
501
|
-
|
502
|
-
```python
|
503
|
-
client.settings.get_banner_settings() # Get banner settings
|
504
|
-
client.settings.update_banner_settings(request) # Update banner settings
|
505
|
-
```
|
506
|
-
|
507
|
-
### **🏷️ Endpoints**
|
508
|
-
|
509
|
-
```python
|
510
|
-
client.endpoints.get_tags(filter_params) # Get endpoint tags
|
511
|
-
```
|
512
|
-
|
513
|
-
### **🔗 Webhooks**
|
514
|
-
|
515
|
-
```python
|
516
|
-
client.webhooks.trigger_get(slug, token) # Trigger GET webhook
|
517
|
-
client.webhooks.trigger_post(slug, token, payload) # Trigger POST webhook
|
518
|
-
client.webhooks.get_task_details(slug, token, task_id) # Get task details
|
519
|
-
```
|
520
|
-
|
521
|
-
## 🔧 Configuration Options
|
522
|
-
|
523
|
-
### **Environment Variables**
|
524
|
-
|
525
|
-
```bash
|
526
|
-
export AIR_HOST="https://your-air-instance.com"
|
527
|
-
export AIR_API_TOKEN="your-api-token"
|
528
|
-
export AIR_ORGANIZATION_ID="0"
|
529
|
-
export AIR_VERIFY_SSL="true"
|
530
|
-
export AIR_TIMEOUT="30"
|
531
|
-
```
|
532
|
-
|
533
|
-
### **Configuration File (config.json)**
|
534
|
-
|
535
|
-
```json
|
536
|
-
{
|
537
|
-
"host": "https://your-air-instance.com",
|
538
|
-
"api_token": "your-api-token",
|
539
|
-
"organization_id": 0,
|
540
|
-
"verify_ssl": true,
|
541
|
-
"timeout": 30
|
542
|
-
}
|
543
|
-
```
|
544
|
-
|
545
|
-
### **Programmatic Configuration**
|
546
|
-
|
547
|
-
```python
|
548
|
-
from binalyze_air import AIRClient, AIRConfig
|
549
|
-
|
550
|
-
# Using config object
|
551
|
-
config = AIRConfig(
|
552
|
-
host="https://your-air-instance.com",
|
553
|
-
api_token="your-api-token",
|
554
|
-
organization_id=0,
|
555
|
-
verify_ssl=False,
|
556
|
-
timeout=60
|
557
|
-
)
|
558
|
-
client = AIRClient(config=config)
|
559
|
-
|
560
|
-
# Direct initialization
|
561
|
-
client = AIRClient(
|
562
|
-
host="https://your-air-instance.com",
|
563
|
-
api_token="your-api-token",
|
564
|
-
organization_id=0
|
565
|
-
)
|
566
|
-
|
567
|
-
# From environment
|
568
|
-
client = AIRClient.from_environment()
|
569
|
-
|
570
|
-
# From config file
|
571
|
-
client = AIRClient.from_config_file("config.json")
|
572
|
-
```
|
573
|
-
|
574
|
-
## 🏗️ Architecture & Design
|
575
|
-
|
576
|
-
### **CQRS Pattern**
|
577
|
-
|
578
|
-
Clean separation of read and write operations:
|
579
|
-
|
580
|
-
```python
|
581
|
-
# Queries (Read operations)
|
582
|
-
assets = client.assets.list()
|
583
|
-
asset = client.assets.get("asset-id")
|
584
|
-
cases = client.cases.list(filter_params)
|
585
|
-
|
586
|
-
# Commands (Write operations)
|
587
|
-
client.assets.isolate(["endpoint-id"])
|
588
|
-
client.cases.create(case_data)
|
589
|
-
client.policies.execute("policy-id", ["endpoint-id"])
|
590
|
-
```
|
591
|
-
|
592
|
-
### **Type Safety with Pydantic V2**
|
593
|
-
|
594
|
-
```python
|
595
|
-
from binalyze_air.models.cases import CreateCaseRequest
|
596
|
-
from binalyze_air.models.assets import AssetFilter
|
597
|
-
|
598
|
-
# Type-safe request objects
|
599
|
-
case_request = CreateCaseRequest(
|
600
|
-
name="Investigation",
|
601
|
-
description="Security incident",
|
602
|
-
visibility="public-to-organization"
|
603
|
-
)
|
604
|
-
case = client.cases.create(case_request)
|
605
|
-
|
606
|
-
# Type-safe filtering
|
607
|
-
asset_filter = AssetFilter(
|
608
|
-
organization_ids=[0],
|
609
|
-
online_status=["online"],
|
610
|
-
tags=["production"]
|
611
|
-
)
|
612
|
-
assets = client.assets.list(asset_filter)
|
613
|
-
```
|
614
|
-
|
615
|
-
### **Comprehensive Error Handling**
|
616
|
-
|
617
|
-
```python
|
618
|
-
from binalyze_air.exceptions import (
|
619
|
-
AIRAPIError,
|
620
|
-
AuthenticationError,
|
621
|
-
AuthorizationError,
|
622
|
-
ValidationError
|
623
|
-
)
|
624
|
-
|
625
|
-
try:
|
626
|
-
case = client.cases.create(case_data)
|
627
|
-
except AuthenticationError:
|
628
|
-
print("Invalid API token")
|
629
|
-
except AuthorizationError:
|
630
|
-
print("Insufficient permissions")
|
631
|
-
except ValidationError as e:
|
632
|
-
print(f"Validation failed: {e}")
|
633
|
-
except AIRAPIError as e:
|
634
|
-
print(f"API error: {e}")
|
635
|
-
```
|
636
|
-
|
637
|
-
## 🧪 Testing & Quality
|
638
|
-
|
639
|
-
### **Comprehensive Test Suite**
|
640
|
-
|
641
|
-
- **Real system validation** with actual AIR instance
|
642
|
-
- **100% field mapping accuracy** verification
|
643
|
-
- **Error scenario testing** for robust error handling
|
644
|
-
- **Cross-platform compatibility** testing
|
645
|
-
|
646
|
-
### **Running Tests**
|
647
|
-
|
648
|
-
```bash
|
649
|
-
# Run individual SDK tests
|
650
|
-
python tests_sdk/001_acquisitions_01_get_acquisition_profiles_REAL_test.py
|
651
|
-
python tests_sdk/007_cases_08_get_cases_REAL_test.py
|
652
|
-
python tests_sdk/013_policies_03_get_policies_REAL_test.py
|
653
|
-
|
654
|
-
# Run API tests
|
655
|
-
python tests_api/001_acquisitions_01_get_acquisition_profiles_test.py
|
656
|
-
python tests_api/007_cases_08_get_cases_test.py
|
657
|
-
|
658
|
-
# Run test suites
|
659
|
-
python run_sdk_tests.ps1 # PowerShell
|
660
|
-
python run_all_tests.ps1 # PowerShell
|
661
|
-
```
|
662
|
-
|
663
|
-
### **Quality Metrics**
|
664
|
-
|
665
|
-
- ✅ **Production Ready**: All core endpoints tested
|
666
|
-
- ✅ **Cross-Platform**: Windows, Linux, macOS compatible
|
667
|
-
- ✅ **ASCII Output**: Universal compatibility
|
668
|
-
- ✅ **Real Data Testing**: Validated with live system
|
669
|
-
- ✅ **Dynamic Discovery**: No hardcoded test values
|
670
|
-
|
671
|
-
## 📖 Documentation
|
672
|
-
|
673
|
-
- **[Quick Start Guide](QUICKSTART.md)** - Get started in minutes
|
674
|
-
- **[SDK Documentation](SDK_DOCUMENTATION.md)** - Complete API reference
|
675
|
-
- **[Test Results](tests_sdk/)** - SDK test suite
|
676
|
-
- **[API Tests](tests_api/)** - API validation tests
|
677
|
-
|
678
|
-
## 🤝 Contributing
|
679
|
-
|
680
|
-
1. Fork the repository
|
681
|
-
2. Create a feature branch (`git checkout -b feature/amazing-feature`)
|
682
|
-
3. Commit your changes (`git commit -m 'Add amazing feature'`)
|
683
|
-
4. Push to the branch (`git push origin feature/amazing-feature`)
|
684
|
-
5. Open a Pull Request
|
685
|
-
|
686
|
-
## 📄 License
|
687
|
-
|
688
|
-
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
|
689
|
-
|
690
|
-
## 🆘 Support
|
691
|
-
|
692
|
-
- **Issues**: [GitHub Issues](https://github.com/binalyze/air-python-sdk/issues)
|
693
|
-
- **Documentation**: [GitHub Wiki](https://github.com/binalyze/air-python-sdk/wiki)
|
694
|
-
- **Email**: support@binalyze.com
|
695
|
-
|
696
|
-
## 🎉 Acknowledgments
|
697
|
-
|
698
|
-
- **Binalyze Team** for the incredible AIR platform
|
699
|
-
- **Python Community** for excellent libraries and tools
|
700
|
-
- **Contributors** who helped build this comprehensive SDK
|
701
|
-
|
702
|
-
---
|
703
|
-
|
704
|
-
**🏆 PRODUCTION READY SDK**
|
705
|
-
|
706
|
-
_A comprehensive, production-ready Python SDK for the Binalyze AIR cybersecurity platform. From asset management to evidence acquisition, from policy enforcement to triage automation - everything is at your fingertips._
|