binalyze-air-sdk 1.0.2__py3-none-any.whl → 1.0.3__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (142) hide show
  1. binalyze_air/__init__.py +77 -77
  2. binalyze_air/apis/__init__.py +67 -27
  3. binalyze_air/apis/acquisitions.py +107 -0
  4. binalyze_air/apis/api_tokens.py +49 -0
  5. binalyze_air/apis/assets.py +161 -0
  6. binalyze_air/apis/audit_logs.py +26 -0
  7. binalyze_air/apis/{authentication.py → auth.py} +29 -27
  8. binalyze_air/apis/auto_asset_tags.py +79 -75
  9. binalyze_air/apis/backup.py +177 -0
  10. binalyze_air/apis/baseline.py +46 -0
  11. binalyze_air/apis/cases.py +225 -0
  12. binalyze_air/apis/cloud_forensics.py +116 -0
  13. binalyze_air/apis/event_subscription.py +96 -96
  14. binalyze_air/apis/evidence.py +249 -53
  15. binalyze_air/apis/interact.py +153 -36
  16. binalyze_air/apis/investigation_hub.py +234 -0
  17. binalyze_air/apis/license.py +104 -0
  18. binalyze_air/apis/logger.py +83 -0
  19. binalyze_air/apis/multipart_upload.py +201 -0
  20. binalyze_air/apis/notifications.py +115 -0
  21. binalyze_air/apis/organizations.py +267 -0
  22. binalyze_air/apis/params.py +44 -39
  23. binalyze_air/apis/policies.py +186 -0
  24. binalyze_air/apis/preset_filters.py +79 -0
  25. binalyze_air/apis/recent_activities.py +71 -0
  26. binalyze_air/apis/relay_server.py +104 -0
  27. binalyze_air/apis/settings.py +395 -27
  28. binalyze_air/apis/tasks.py +80 -0
  29. binalyze_air/apis/triage.py +197 -0
  30. binalyze_air/apis/user_management.py +183 -74
  31. binalyze_air/apis/webhook_executions.py +50 -0
  32. binalyze_air/apis/webhooks.py +322 -230
  33. binalyze_air/base.py +207 -133
  34. binalyze_air/client.py +217 -1337
  35. binalyze_air/commands/__init__.py +175 -145
  36. binalyze_air/commands/acquisitions.py +661 -387
  37. binalyze_air/commands/api_tokens.py +55 -0
  38. binalyze_air/commands/assets.py +324 -362
  39. binalyze_air/commands/{authentication.py → auth.py} +36 -36
  40. binalyze_air/commands/auto_asset_tags.py +230 -230
  41. binalyze_air/commands/backup.py +47 -0
  42. binalyze_air/commands/baseline.py +32 -396
  43. binalyze_air/commands/cases.py +609 -602
  44. binalyze_air/commands/cloud_forensics.py +88 -0
  45. binalyze_air/commands/event_subscription.py +101 -101
  46. binalyze_air/commands/evidences.py +918 -988
  47. binalyze_air/commands/interact.py +172 -58
  48. binalyze_air/commands/investigation_hub.py +315 -0
  49. binalyze_air/commands/license.py +183 -0
  50. binalyze_air/commands/logger.py +126 -0
  51. binalyze_air/commands/multipart_upload.py +363 -0
  52. binalyze_air/commands/notifications.py +45 -0
  53. binalyze_air/commands/organizations.py +200 -221
  54. binalyze_air/commands/policies.py +175 -203
  55. binalyze_air/commands/preset_filters.py +55 -0
  56. binalyze_air/commands/recent_activities.py +32 -0
  57. binalyze_air/commands/relay_server.py +144 -0
  58. binalyze_air/commands/settings.py +431 -29
  59. binalyze_air/commands/tasks.py +95 -56
  60. binalyze_air/commands/triage.py +224 -360
  61. binalyze_air/commands/user_management.py +351 -126
  62. binalyze_air/commands/webhook_executions.py +77 -0
  63. binalyze_air/config.py +244 -244
  64. binalyze_air/exceptions.py +49 -49
  65. binalyze_air/http_client.py +426 -305
  66. binalyze_air/models/__init__.py +287 -285
  67. binalyze_air/models/acquisitions.py +365 -250
  68. binalyze_air/models/api_tokens.py +73 -0
  69. binalyze_air/models/assets.py +438 -438
  70. binalyze_air/models/audit.py +247 -272
  71. binalyze_air/models/audit_logs.py +14 -0
  72. binalyze_air/models/{authentication.py → auth.py} +69 -69
  73. binalyze_air/models/auto_asset_tags.py +227 -116
  74. binalyze_air/models/backup.py +138 -0
  75. binalyze_air/models/baseline.py +231 -231
  76. binalyze_air/models/cases.py +275 -275
  77. binalyze_air/models/cloud_forensics.py +145 -0
  78. binalyze_air/models/event_subscription.py +170 -171
  79. binalyze_air/models/evidence.py +65 -65
  80. binalyze_air/models/evidences.py +367 -348
  81. binalyze_air/models/interact.py +266 -135
  82. binalyze_air/models/investigation_hub.py +265 -0
  83. binalyze_air/models/license.py +150 -0
  84. binalyze_air/models/logger.py +83 -0
  85. binalyze_air/models/multipart_upload.py +352 -0
  86. binalyze_air/models/notifications.py +138 -0
  87. binalyze_air/models/organizations.py +293 -293
  88. binalyze_air/models/params.py +153 -127
  89. binalyze_air/models/policies.py +260 -249
  90. binalyze_air/models/preset_filters.py +79 -0
  91. binalyze_air/models/recent_activities.py +70 -0
  92. binalyze_air/models/relay_server.py +121 -0
  93. binalyze_air/models/settings.py +538 -84
  94. binalyze_air/models/tasks.py +215 -149
  95. binalyze_air/models/triage.py +141 -142
  96. binalyze_air/models/user_management.py +200 -97
  97. binalyze_air/models/webhook_executions.py +33 -0
  98. binalyze_air/queries/__init__.py +121 -133
  99. binalyze_air/queries/acquisitions.py +155 -155
  100. binalyze_air/queries/api_tokens.py +46 -0
  101. binalyze_air/queries/assets.py +186 -105
  102. binalyze_air/queries/audit.py +400 -416
  103. binalyze_air/queries/{authentication.py → auth.py} +55 -55
  104. binalyze_air/queries/auto_asset_tags.py +59 -59
  105. binalyze_air/queries/backup.py +66 -0
  106. binalyze_air/queries/baseline.py +21 -185
  107. binalyze_air/queries/cases.py +292 -292
  108. binalyze_air/queries/cloud_forensics.py +137 -0
  109. binalyze_air/queries/event_subscription.py +54 -54
  110. binalyze_air/queries/evidence.py +139 -139
  111. binalyze_air/queries/evidences.py +279 -279
  112. binalyze_air/queries/interact.py +140 -28
  113. binalyze_air/queries/investigation_hub.py +329 -0
  114. binalyze_air/queries/license.py +85 -0
  115. binalyze_air/queries/logger.py +58 -0
  116. binalyze_air/queries/multipart_upload.py +180 -0
  117. binalyze_air/queries/notifications.py +71 -0
  118. binalyze_air/queries/organizations.py +222 -222
  119. binalyze_air/queries/params.py +154 -115
  120. binalyze_air/queries/policies.py +149 -149
  121. binalyze_air/queries/preset_filters.py +60 -0
  122. binalyze_air/queries/recent_activities.py +44 -0
  123. binalyze_air/queries/relay_server.py +42 -0
  124. binalyze_air/queries/settings.py +533 -20
  125. binalyze_air/queries/tasks.py +125 -81
  126. binalyze_air/queries/triage.py +230 -230
  127. binalyze_air/queries/user_management.py +193 -83
  128. binalyze_air/queries/webhook_executions.py +39 -0
  129. binalyze_air_sdk-1.0.3.dist-info/METADATA +752 -0
  130. binalyze_air_sdk-1.0.3.dist-info/RECORD +132 -0
  131. {binalyze_air_sdk-1.0.2.dist-info → binalyze_air_sdk-1.0.3.dist-info}/WHEEL +1 -1
  132. binalyze_air/apis/endpoints.py +0 -22
  133. binalyze_air/apis/evidences.py +0 -216
  134. binalyze_air/apis/users.py +0 -68
  135. binalyze_air/commands/users.py +0 -101
  136. binalyze_air/models/endpoints.py +0 -76
  137. binalyze_air/models/users.py +0 -82
  138. binalyze_air/queries/endpoints.py +0 -25
  139. binalyze_air/queries/users.py +0 -69
  140. binalyze_air_sdk-1.0.2.dist-info/METADATA +0 -706
  141. binalyze_air_sdk-1.0.2.dist-info/RECORD +0 -82
  142. {binalyze_air_sdk-1.0.2.dist-info → binalyze_air_sdk-1.0.3.dist-info}/top_level.txt +0 -0
@@ -1,706 +0,0 @@
1
- Metadata-Version: 2.4
2
- Name: binalyze-air-sdk
3
- Version: 1.0.2
4
- Summary: Complete Python SDK for Binalyze AIR API - 100% API Coverage
5
- Home-page: https://github.com/binalyze/air-python-sdk
6
- Author: Binalyze
7
- Author-email: support@binalyze.com
8
- Project-URL: Bug Reports, https://github.com/binalyze/air-python-sdk/issues
9
- Project-URL: Source, https://github.com/binalyze/air-python-sdk
10
- Project-URL: Documentation, https://github.com/binalyze/air-python-sdk/blob/main/README.md
11
- Keywords: binalyze air forensics security api sdk digital-forensics incident-response
12
- Classifier: Development Status :: 5 - Production/Stable
13
- Classifier: Intended Audience :: Developers
14
- Classifier: Intended Audience :: Information Technology
15
- Classifier: Intended Audience :: System Administrators
16
- Classifier: License :: OSI Approved :: MIT License
17
- Classifier: Operating System :: OS Independent
18
- Classifier: Programming Language :: Python :: 3
19
- Classifier: Programming Language :: Python :: 3.8
20
- Classifier: Programming Language :: Python :: 3.9
21
- Classifier: Programming Language :: Python :: 3.10
22
- Classifier: Programming Language :: Python :: 3.11
23
- Classifier: Programming Language :: Python :: 3.12
24
- Classifier: Topic :: Security
25
- Classifier: Topic :: System :: Systems Administration
26
- Classifier: Topic :: Software Development :: Libraries :: Python Modules
27
- Requires-Python: >=3.8
28
- Description-Content-Type: text/markdown
29
- Requires-Dist: requests>=2.25.1
30
- Requires-Dist: pydantic>=2.0.0
31
- Requires-Dist: typing-extensions>=4.0.0
32
- Requires-Dist: python-dateutil>=2.8.0
33
- Requires-Dist: urllib3>=1.26.0
34
- Provides-Extra: dev
35
- Requires-Dist: pytest>=6.0; extra == "dev"
36
- Requires-Dist: pytest-asyncio; extra == "dev"
37
- Requires-Dist: black; extra == "dev"
38
- Requires-Dist: isort; extra == "dev"
39
- Requires-Dist: mypy; extra == "dev"
40
- Requires-Dist: flake8; extra == "dev"
41
- Provides-Extra: testing
42
- Requires-Dist: pytest>=6.0; extra == "testing"
43
- Requires-Dist: pytest-cov; extra == "testing"
44
- Requires-Dist: pytest-mock; extra == "testing"
45
- Dynamic: author
46
- Dynamic: author-email
47
- Dynamic: classifier
48
- Dynamic: description
49
- Dynamic: description-content-type
50
- Dynamic: home-page
51
- Dynamic: keywords
52
- Dynamic: project-url
53
- Dynamic: provides-extra
54
- Dynamic: requires-dist
55
- Dynamic: requires-python
56
- Dynamic: summary
57
-
58
- # 🎉 Binalyze AIR Python SDK - Production Ready SDK
59
-
60
- **PRODUCTION READY!** A comprehensive Python SDK for the Binalyze AIR cybersecurity platform with **extensive API coverage** across **18 modules**.
61
-
62
- [![Production Ready](https://img.shields.io/badge/Status-Production%20Ready-brightgreen)](https://github.com/binalyze/air-python-sdk)
63
- [![API Coverage](https://img.shields.io/badge/API%20Coverage-Extensive-brightgreen)](https://github.com/binalyze/air-python-sdk)
64
- [![Test Coverage](https://img.shields.io/badge/Tests-Real%20Tests-brightgreen)](https://github.com/binalyze/air-python-sdk)
65
- [![Python Version](https://img.shields.io/badge/Python-3.8%2B-blue)](https://python.org)
66
- [![License](https://img.shields.io/badge/License-MIT-blue)](LICENSE)
67
-
68
- ## 🏆 Comprehensive SDK Coverage
69
-
70
- - ✅ **Core Operations**: Assets, Cases, Tasks, Acquisitions management
71
- - ✅ **Security & Intelligence**: Triage, Authentication, Policies
72
- - ✅ **Data Management**: Evidence, Audit logs, Baseline comparison
73
- - ✅ **Administration**: Organizations, Users, Settings
74
- - ✅ **Integration**: Webhooks, Event subscriptions, Interactions
75
- - ✅ **Enterprise Ready**: Full error handling & validation
76
- - ✅ **Performance Tested**: Response time validation
77
-
78
- ## 🚀 Complete Feature Set
79
-
80
- ### **Core Operations**
81
-
82
- - **🔧 Acquisitions** - Forensic data collection, imaging, and evidence acquisition
83
- - **📂 Cases** - Complete investigation workflow and collaboration
84
- - **📊 Tasks** - Task orchestration and monitoring
85
- - **🖥️ Assets** - Asset management, isolation, tagging, and control
86
-
87
- ### **Security & Intelligence**
88
-
89
- - **🔍 Triage** - Threat detection, YARA rule creation, and analysis
90
- - **🔐 Authentication** - Secure login, token management, and validation
91
- - **📋 Policies** - Policy management, assignment, and execution
92
- - **📈 Baseline** - System baseline comparison and monitoring
93
-
94
- ### **Data Management**
95
-
96
- - **📚 Evidence** - Evidence storage, retrieval, and management
97
- - **📊 Audit** - Comprehensive audit logging and analytics
98
- - **🏷️ Auto Asset Tags** - Automated asset classification and tagging
99
- - **📚 Evidences** - Repository management for evidence storage
100
-
101
- ### **Administration**
102
-
103
- - **🏢 Organizations** - Multi-tenant administration and settings
104
- - **👥 Users** - User administration and permissions
105
- - **⚙️ Settings** - System configuration and banner management
106
- - **🔗 Webhooks** - External system integration and triggers
107
-
108
- ### **Integration & Advanced**
109
-
110
- - **📡 Event Subscription** - Real-time event notifications
111
- - **💬 Interact** - Shell interaction and command execution
112
- - **⚙️ Params** - System parameters and configuration
113
- - **🏷️ Endpoints** - Endpoint tag management
114
-
115
- ## 📦 Installation
116
-
117
- ### **Standard Installation**
118
-
119
- ```bash
120
- pip install binalyze-air-sdk
121
- ```
122
-
123
- ### **Development Installation**
124
-
125
- ```bash
126
- git clone https://github.com/binalyze/air-python-sdk.git
127
- cd air-python-sdk
128
- pip install -r requirements.txt
129
- pip install -e .
130
- ```
131
-
132
- ### **Requirements**
133
-
134
- - Python 3.8+
135
- - requests>=2.25.1
136
- - pydantic>=2.0.0
137
- - python-dateutil>=2.8.0
138
- - urllib3>=1.26.0
139
-
140
- ## 🔧 Quick Start
141
-
142
- ```python
143
- from binalyze_air import AIRClient
144
-
145
- # Initialize client
146
- client = AIRClient(
147
- host="https://your-air-instance.com",
148
- api_token="your-api-token",
149
- organization_id=0
150
- )
151
-
152
- # Test authentication
153
- auth_status = client.authentication.check_status()
154
- if auth_status.get('success'):
155
- print("✅ Connected to Binalyze AIR!")
156
-
157
- # Asset Management
158
- assets = client.assets.list()
159
- client.assets.isolate(["endpoint-id"])
160
- client.assets.add_tags(["endpoint-id"], ["investigation", "priority"])
161
-
162
- # Case Management
163
- from binalyze_air.models.cases import CreateCaseRequest
164
- case_request = CreateCaseRequest(
165
- name="Security Investigation",
166
- description="Investigating suspicious activity",
167
- visibility="public-to-organization"
168
- )
169
- case = client.cases.create(case_request)
170
-
171
- # Evidence Acquisition
172
- profiles = client.acquisitions.list_profiles()
173
- acquisition_request = {
174
- "case_id": case.id,
175
- "acquisition_profile_id": profiles[0].id,
176
- "filter": {
177
- "included_endpoint_ids": ["endpoint-id"],
178
- "organization_ids": [0]
179
- }
180
- }
181
- acquisition = client.acquisitions.acquire(acquisition_request)
182
-
183
- # Triage Operations
184
- rules = client.triage.list_rules()
185
- validation = client.triage.validate_rule("rule content", "yara")
186
-
187
- # Task Management
188
- tasks = client.tasks.list()
189
- task_assignments = client.tasks.get_assignments("task-id")
190
-
191
- # User Management
192
- users = client.user_management.list_users()
193
- user_details = client.user_management.get_user("user-id")
194
- ```
195
-
196
- ## 📚 Complete API Reference
197
-
198
- ### **🔧 Acquisitions**
199
-
200
- ```python
201
- # Profiles
202
- client.acquisitions.list_profiles(filter_params, organization_ids, all_organizations)
203
- client.acquisitions.get_profile(profile_id)
204
- client.acquisitions.create_profile(request)
205
-
206
- # Tasks
207
- client.acquisitions.acquire(request) # Assign evidence task
208
- client.acquisitions.acquire_image(request) # Assign image task
209
-
210
- # Legacy aliases
211
- client.acquisitions.assign_task(request) # Legacy alias for acquire
212
- client.acquisitions.assign_image_task(request) # Legacy alias for acquire_image
213
- ```
214
-
215
- ### **📂 Cases**
216
-
217
- ```python
218
- # Case Management
219
- client.cases.list(filter_params, organization_ids) # List cases
220
- client.cases.create(case_data) # Create case
221
- client.cases.get(case_id) # Get case details
222
- client.cases.update(case_id, update_data) # Update case
223
- client.cases.close(case_id) # Close case
224
- client.cases.open(case_id) # Open case
225
- client.cases.archive(case_id) # Archive case
226
- client.cases.change_owner(case_id, user_id) # Change owner
227
- client.cases.check_name(name) # Check name availability
228
-
229
- # Case Data
230
- client.cases.get_activities(case_id, filter_params) # Get activities
231
- client.cases.get_endpoints(case_id, filter_params) # Get case endpoints
232
- client.cases.get_tasks(case_id, filter_params) # Get case tasks
233
- client.cases.get_users(case_id, filter_params) # Get case users
234
-
235
- # Case Operations
236
- client.cases.remove_endpoints(case_id, filter_params) # Remove endpoints
237
- client.cases.remove_task_assignment(case_id, task_assignment_id) # Remove task
238
- client.cases.import_task_assignments(case_id, task_assignment_ids) # Import tasks
239
-
240
- # Notes
241
- client.cases.add_note(case_id, note) # Add note
242
- client.cases.update_note(case_id, note_id, note) # Update note
243
- client.cases.delete_note(case_id, note_id) # Delete note
244
-
245
- # Export
246
- client.cases.export_notes(case_id) # Export notes
247
- client.cases.export_cases(filter_params) # Export cases
248
- client.cases.export_endpoints(case_id, filter_params) # Export endpoints
249
- client.cases.export_activities(case_id, filter_params) # Export activities
250
- ```
251
-
252
- ### **🖥️ Assets**
253
-
254
- ```python
255
- # Asset Information
256
- client.assets.list(filter_params) # List assets
257
- client.assets.get(asset_id) # Get asset details
258
- client.assets.get_tasks(asset_id, filter_params) # Get asset tasks
259
-
260
- # Asset Control
261
- client.assets.isolate(endpoint_ids, organization_ids) # Isolate assets
262
- client.assets.unisolate(endpoint_ids, organization_ids) # Remove isolation
263
- client.assets.reboot(endpoint_ids, organization_ids) # Reboot assets
264
- client.assets.shutdown(endpoint_ids, organization_ids) # Shutdown assets
265
-
266
- # Asset Management
267
- client.assets.add_tags(endpoint_ids, tags, organization_ids) # Add tags
268
- client.assets.remove_tags(endpoint_ids, tags, organization_ids) # Remove tags
269
- client.assets.uninstall(endpoint_ids, purge_data, organization_ids) # Uninstall
270
- client.assets.retrieve_logs(endpoint_ids, organization_ids) # Retrieve logs
271
- client.assets.version_update(endpoint_ids, organization_ids) # Update version
272
- ```
273
-
274
- ### **📊 Tasks**
275
-
276
- ```python
277
- client.tasks.list(filter_params, organization_ids) # List tasks
278
- client.tasks.get(task_id) # Get task details
279
- client.tasks.get_assignments(task_id) # Get task assignments
280
- client.tasks.cancel(task_id) # Cancel task
281
- client.tasks.delete(task_id) # Delete task
282
- client.tasks.cancel_assignment(assignment_id) # Cancel assignment
283
- client.tasks.delete_assignment(assignment_id) # Delete assignment
284
- ```
285
-
286
- ### **🔍 Triage**
287
-
288
- ```python
289
- # Rules
290
- client.triage.list_rules(filter_params, organization_ids) # List rules
291
- client.triage.create_rule(rule_data) # Create rule
292
- client.triage.get_rule(rule_id) # Get rule
293
- client.triage.get_rule_by_id(rule_id) # Get rule (alias)
294
- client.triage.update_rule(rule_id, data) # Update rule
295
- client.triage.delete_rule(rule_id) # Delete rule
296
- client.triage.validate_rule(rule_content, engine) # Validate rule
297
-
298
- # Tags & Tasks
299
- client.triage.list_tags(organization_id) # List tags
300
- client.triage.create_tag(tag_data) # Create tag
301
- client.triage.delete_tag(tag_id) # Delete tag
302
- client.triage.assign_task(task_data) # Assign task
303
- ```
304
-
305
- ### **📋 Policies**
306
-
307
- ```python
308
- # Policy Management
309
- client.policies.list(filter_params, organization_ids) # List policies
310
- client.policies.get(policy_id) # Get policy
311
- client.policies.create(policy_data) # Create policy
312
- client.policies.update(policy_id, update_data) # Update policy
313
- client.policies.delete(policy_id) # Delete policy
314
- client.policies.activate(policy_id) # Activate policy
315
- client.policies.deactivate(policy_id) # Deactivate policy
316
-
317
- # Policy Operations
318
- client.policies.get_assignments(policy_id) # Get assignments
319
- client.policies.get_executions(policy_id) # Get executions
320
- client.policies.assign(assignment_data) # Assign policy
321
- client.policies.unassign(policy_id, endpoint_ids) # Unassign policy
322
- client.policies.execute(policy_id, endpoint_ids) # Execute policy
323
- client.policies.get_match_stats(filter_params, organization_ids) # Get stats
324
- client.policies.update_priorities(policy_ids, organization_ids) # Update priorities
325
- ```
326
-
327
- ### **🔐 Authentication**
328
-
329
- ```python
330
- client.authentication.login(credentials) # Login with credentials
331
- client.authentication.check_status() # Check auth status
332
- ```
333
-
334
- ### **🏢 Organizations**
335
-
336
- ```python
337
- # Organization Management
338
- client.organizations.list(page, page_size, sort_by, order) # List organizations
339
- client.organizations.create(org_data) # Create organization
340
- client.organizations.get(org_id) # Get organization
341
- client.organizations.update(org_id, data) # Update organization
342
- client.organizations.delete(org_id) # Delete organization
343
- client.organizations.check_name(name) # Check name availability
344
-
345
- # User Management
346
- client.organizations.get_users(org_id, page, page_size) # Get org users
347
- client.organizations.add_user(org_id, user_data) # Add user
348
- client.organizations.assign_users(org_id, user_ids) # Assign users
349
- client.organizations.remove_user(org_id, user_id) # Remove user
350
-
351
- # Settings & Configuration
352
- client.organizations.update_settings(org_id, settings) # Update settings
353
- client.organizations.get_shareable_deployment_info(token) # Get deployment info
354
- client.organizations.update_shareable_deployment_settings(org_id, status) # Update deployment
355
- client.organizations.update_deployment_token(org_id, token) # Update token
356
-
357
- # Tags
358
- client.organizations.add_tags(org_id, tags) # Add tags
359
- client.organizations.delete_tags(org_id, tags) # Delete tags
360
- client.organizations.remove_tags(org_id, tags) # Remove tags (alias)
361
- ```
362
-
363
- ### **👥 Users**
364
-
365
- ```python
366
- client.user_management.list_users() # List users
367
- client.user_management.get_user(user_id) # Get user details
368
- client.user_management.create_api_user(user_data) # Create API user
369
- ```
370
-
371
- ### **📊 Audit**
372
-
373
- ```python
374
- client.audit.list_logs(filter_params, organization_ids) # List audit logs
375
- client.audit.get_log(log_id) # Get audit log
376
- client.audit.export_logs(filter_params, format, organization_ids) # Export logs
377
- client.audit.get_summary(org_id, start_date, end_date) # Get summary
378
- client.audit.get_user_activity(org_id, start_date, end_date, user_id) # Get activity
379
- client.audit.get_system_events(org_id, start_date, end_date, severity) # Get events
380
- client.audit.get_retention_policy(org_id) # Get retention policy
381
- ```
382
-
383
- ### **📈 Baseline**
384
-
385
- ```python
386
- # Baseline Management
387
- client.baseline.list(filter_params, organization_ids) # List baselines
388
- client.baseline.create(request) # Create baseline
389
- client.baseline.get(baseline_id) # Get baseline
390
- client.baseline.update(baseline_id, request) # Update baseline
391
- client.baseline.delete(baseline_id) # Delete baseline
392
- client.baseline.refresh(baseline_id) # Refresh baseline
393
-
394
- # Comparisons
395
- client.baseline.get_comparisons(baseline_id) # Get comparisons
396
- client.baseline.get_comparison(comparison_id) # Get comparison
397
- client.baseline.compare(request) # Run comparison
398
- client.baseline.get_comparison_report(baseline_id, task_id) # Get report
399
-
400
- # Profiles & Schedules
401
- client.baseline.list_profiles(organization_ids) # List profiles
402
- client.baseline.get_profile(profile_id) # Get profile
403
- client.baseline.create_profile(request) # Create profile
404
- client.baseline.update_profile(profile_id, request) # Update profile
405
- client.baseline.delete_profile(profile_id) # Delete profile
406
- client.baseline.get_schedules(baseline_id, organization_ids) # Get schedules
407
- client.baseline.create_schedule(baseline_id, schedule_data) # Create schedule
408
- client.baseline.delete_schedule(schedule_id) # Delete schedule
409
-
410
- # Advanced Operations
411
- client.baseline.acquire(baseline_data) # Acquire baseline
412
- client.baseline.acquire_by_filter(filter_data, case_id) # Acquire by filter
413
- client.baseline.compare_by_endpoint(endpoint_id, task_ids) # Compare by endpoint
414
- ```
415
-
416
- ### **📚 Evidence**
417
-
418
- ```python
419
- # Case Evidence (Read-only)
420
- client.evidence.get_case_evidence_ppc(endpoint_id, task_id) # Get PPC
421
- client.evidence.get_case_evidence_report_file_info(endpoint_id, task_id) # Get file info
422
- client.evidence.get_case_evidence_report(endpoint_id, task_id) # Get report
423
-
424
- # Repository Operations (delegates to evidences API)
425
- client.evidence.list_repositories() # List repositories
426
- ```
427
-
428
- ### **📚 Evidences (Repository Management)**
429
-
430
- ```python
431
- # Repository Management
432
- client.evidences.list_repositories() # List all repositories
433
-
434
- # SMB Repositories
435
- client.evidences.create_smb_repository(request) # Create SMB
436
- client.evidences.update_smb_repository(repo_id, request) # Update SMB
437
-
438
- # SFTP Repositories
439
- client.evidences.create_sftp_repository(request) # Create SFTP
440
- client.evidences.update_sftp_repository(repo_id, request) # Update SFTP
441
-
442
- # FTPS Repositories
443
- client.evidences.create_ftps_repository(request) # Create FTPS
444
- client.evidences.update_ftps_repository(repo_id, request) # Update FTPS
445
- client.evidences.validate_ftps_repository(request) # Validate FTPS
446
-
447
- # Azure Storage Repositories
448
- client.evidences.create_azure_repository(request) # Create Azure
449
- client.evidences.update_azure_repository(repo_id, request) # Update Azure
450
- client.evidences.validate_azure_repository(request) # Validate Azure
451
-
452
- # Amazon S3 Repositories
453
- client.evidences.create_s3_repository(request) # Create S3
454
- client.evidences.update_s3_repository(repo_id, request) # Update S3
455
- client.evidences.validate_s3_repository(request) # Validate S3
456
-
457
- # Repository Operations
458
- client.evidences.delete_repository(repo_id) # Delete repository
459
- client.evidences.validate_repository(request) # Validate repository
460
- client.evidences.get_repository_volumes(repo_id) # Get volumes
461
- ```
462
-
463
- ### **🏷️ Auto Asset Tags**
464
-
465
- ```python
466
- client.auto_asset_tags.list(filter_params) # List auto tags
467
- client.auto_asset_tags.create(request) # Create auto tag
468
- client.auto_asset_tags.get(tag_id) # Get auto tag
469
- client.auto_asset_tags.update(tag_id, request) # Update auto tag
470
- client.auto_asset_tags.delete(tag_id) # Delete auto tag
471
- client.auto_asset_tags.start_tagging(request) # Start tagging
472
- ```
473
-
474
- ### **📡 Event Subscription**
475
-
476
- ```python
477
- client.event_subscription.list(filter_params) # List subscriptions
478
- client.event_subscription.create(request) # Create subscription
479
- client.event_subscription.get(subscription_id) # Get subscription
480
- client.event_subscription.update(subscription_id, request) # Update subscription
481
- client.event_subscription.delete(subscription_id) # Delete subscription
482
- ```
483
-
484
- ### **💬 Interact**
485
-
486
- ```python
487
- client.interact.assign_shell_task(request) # Assign shell task
488
- client.interact.get_shell_task_response(task_id) # Get shell response
489
- ```
490
-
491
- ### **⚙️ Params**
492
-
493
- ```python
494
- client.params.get_drone_analyzers() # Get drone analyzers
495
- client.params.get_acquisition_artifacts() # Get acquisition artifacts
496
- client.params.get_acquisition_evidences() # Get acquisition evidences
497
- client.params.get_e_discovery_patterns() # Get e-discovery patterns
498
- ```
499
-
500
- ### **⚙️ Settings**
501
-
502
- ```python
503
- client.settings.get_banner_settings() # Get banner settings
504
- client.settings.update_banner_settings(request) # Update banner settings
505
- ```
506
-
507
- ### **🏷️ Endpoints**
508
-
509
- ```python
510
- client.endpoints.get_tags(filter_params) # Get endpoint tags
511
- ```
512
-
513
- ### **🔗 Webhooks**
514
-
515
- ```python
516
- client.webhooks.trigger_get(slug, token) # Trigger GET webhook
517
- client.webhooks.trigger_post(slug, token, payload) # Trigger POST webhook
518
- client.webhooks.get_task_details(slug, token, task_id) # Get task details
519
- ```
520
-
521
- ## 🔧 Configuration Options
522
-
523
- ### **Environment Variables**
524
-
525
- ```bash
526
- export AIR_HOST="https://your-air-instance.com"
527
- export AIR_API_TOKEN="your-api-token"
528
- export AIR_ORGANIZATION_ID="0"
529
- export AIR_VERIFY_SSL="true"
530
- export AIR_TIMEOUT="30"
531
- ```
532
-
533
- ### **Configuration File (config.json)**
534
-
535
- ```json
536
- {
537
- "host": "https://your-air-instance.com",
538
- "api_token": "your-api-token",
539
- "organization_id": 0,
540
- "verify_ssl": true,
541
- "timeout": 30
542
- }
543
- ```
544
-
545
- ### **Programmatic Configuration**
546
-
547
- ```python
548
- from binalyze_air import AIRClient, AIRConfig
549
-
550
- # Using config object
551
- config = AIRConfig(
552
- host="https://your-air-instance.com",
553
- api_token="your-api-token",
554
- organization_id=0,
555
- verify_ssl=False,
556
- timeout=60
557
- )
558
- client = AIRClient(config=config)
559
-
560
- # Direct initialization
561
- client = AIRClient(
562
- host="https://your-air-instance.com",
563
- api_token="your-api-token",
564
- organization_id=0
565
- )
566
-
567
- # From environment
568
- client = AIRClient.from_environment()
569
-
570
- # From config file
571
- client = AIRClient.from_config_file("config.json")
572
- ```
573
-
574
- ## 🏗️ Architecture & Design
575
-
576
- ### **CQRS Pattern**
577
-
578
- Clean separation of read and write operations:
579
-
580
- ```python
581
- # Queries (Read operations)
582
- assets = client.assets.list()
583
- asset = client.assets.get("asset-id")
584
- cases = client.cases.list(filter_params)
585
-
586
- # Commands (Write operations)
587
- client.assets.isolate(["endpoint-id"])
588
- client.cases.create(case_data)
589
- client.policies.execute("policy-id", ["endpoint-id"])
590
- ```
591
-
592
- ### **Type Safety with Pydantic V2**
593
-
594
- ```python
595
- from binalyze_air.models.cases import CreateCaseRequest
596
- from binalyze_air.models.assets import AssetFilter
597
-
598
- # Type-safe request objects
599
- case_request = CreateCaseRequest(
600
- name="Investigation",
601
- description="Security incident",
602
- visibility="public-to-organization"
603
- )
604
- case = client.cases.create(case_request)
605
-
606
- # Type-safe filtering
607
- asset_filter = AssetFilter(
608
- organization_ids=[0],
609
- online_status=["online"],
610
- tags=["production"]
611
- )
612
- assets = client.assets.list(asset_filter)
613
- ```
614
-
615
- ### **Comprehensive Error Handling**
616
-
617
- ```python
618
- from binalyze_air.exceptions import (
619
- AIRAPIError,
620
- AuthenticationError,
621
- AuthorizationError,
622
- ValidationError
623
- )
624
-
625
- try:
626
- case = client.cases.create(case_data)
627
- except AuthenticationError:
628
- print("Invalid API token")
629
- except AuthorizationError:
630
- print("Insufficient permissions")
631
- except ValidationError as e:
632
- print(f"Validation failed: {e}")
633
- except AIRAPIError as e:
634
- print(f"API error: {e}")
635
- ```
636
-
637
- ## 🧪 Testing & Quality
638
-
639
- ### **Comprehensive Test Suite**
640
-
641
- - **Real system validation** with actual AIR instance
642
- - **100% field mapping accuracy** verification
643
- - **Error scenario testing** for robust error handling
644
- - **Cross-platform compatibility** testing
645
-
646
- ### **Running Tests**
647
-
648
- ```bash
649
- # Run individual SDK tests
650
- python tests_sdk/001_acquisitions_01_get_acquisition_profiles_REAL_test.py
651
- python tests_sdk/007_cases_08_get_cases_REAL_test.py
652
- python tests_sdk/013_policies_03_get_policies_REAL_test.py
653
-
654
- # Run API tests
655
- python tests_api/001_acquisitions_01_get_acquisition_profiles_test.py
656
- python tests_api/007_cases_08_get_cases_test.py
657
-
658
- # Run test suites
659
- python run_sdk_tests.ps1 # PowerShell
660
- python run_all_tests.ps1 # PowerShell
661
- ```
662
-
663
- ### **Quality Metrics**
664
-
665
- - ✅ **Production Ready**: All core endpoints tested
666
- - ✅ **Cross-Platform**: Windows, Linux, macOS compatible
667
- - ✅ **ASCII Output**: Universal compatibility
668
- - ✅ **Real Data Testing**: Validated with live system
669
- - ✅ **Dynamic Discovery**: No hardcoded test values
670
-
671
- ## 📖 Documentation
672
-
673
- - **[Quick Start Guide](QUICKSTART.md)** - Get started in minutes
674
- - **[SDK Documentation](SDK_DOCUMENTATION.md)** - Complete API reference
675
- - **[Test Results](tests_sdk/)** - SDK test suite
676
- - **[API Tests](tests_api/)** - API validation tests
677
-
678
- ## 🤝 Contributing
679
-
680
- 1. Fork the repository
681
- 2. Create a feature branch (`git checkout -b feature/amazing-feature`)
682
- 3. Commit your changes (`git commit -m 'Add amazing feature'`)
683
- 4. Push to the branch (`git push origin feature/amazing-feature`)
684
- 5. Open a Pull Request
685
-
686
- ## 📄 License
687
-
688
- This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
689
-
690
- ## 🆘 Support
691
-
692
- - **Issues**: [GitHub Issues](https://github.com/binalyze/air-python-sdk/issues)
693
- - **Documentation**: [GitHub Wiki](https://github.com/binalyze/air-python-sdk/wiki)
694
- - **Email**: support@binalyze.com
695
-
696
- ## 🎉 Acknowledgments
697
-
698
- - **Binalyze Team** for the incredible AIR platform
699
- - **Python Community** for excellent libraries and tools
700
- - **Contributors** who helped build this comprehensive SDK
701
-
702
- ---
703
-
704
- **🏆 PRODUCTION READY SDK**
705
-
706
- _A comprehensive, production-ready Python SDK for the Binalyze AIR cybersecurity platform. From asset management to evidence acquisition, from policy enforcement to triage automation - everything is at your fingertips._