psengine 2.3.1__tar.gz → 2.4.1__tar.gz

{psengine-2.3.1 → psengine-2.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: psengine
-Version: 2.3.1
+Version: 2.4.1
 Summary: psengine is a simple, yet elegant, library for rapid development of integrations with Recorded Future.
 Author-email: Moise Medici <moise.medici@recordedfuture.com>, Patrick Kinsella <patrick.kinsella@recordedfuture.com>, Ernest Bartosevic <ernest.bartosevic@recordedfuture.com>
 License-Expression: MIT
@@ -20,6 +20,7 @@ Classifier: Programming Language :: Python :: 3.13
 Requires-Python: <3.14,>=3.9
 Description-Content-Type: text/markdown
 License-File: LICENSE
+Requires-Dist: typing_extensions>=4.8.0
 Requires-Dist: requests>=2.27.1
 Requires-Dist: jsonpath_ng<=1.6.1,>=1.5.3
 Requires-Dist: stix2~=3.0.1

{psengine-2.3.1 → psengine-2.4.1}/psengine/_version.py

@@ -11,4 +11,4 @@
 # accessed from any third party API.                                                         #
 ##############################################################################################
 
-__version__ = '2.3.0'
+__version__ = '2.4.1'

{psengine-2.3.1 → psengine-2.4.1}/psengine/analyst_notes/note_mgr.py

@@ -111,7 +111,7 @@ class AnalystNoteMgr:
             'label': label,
             'source': source,
             'serialization': serialization,
-            'taggedText': tagged_text,
+            'tagged_text': tagged_text,
             'limit': min(max_results, notes_per_page),
         }
         data = {key: val for key, val in data.items() if val is not None}

{psengine-2.3.1 → psengine-2.4.1}/psengine/enrich/lookup.py

@@ -33,6 +33,7 @@ from .models.lookup import (
     RawRisk,
     RiskMapping,
     RiskyCIDRPIP,
+    Scanner,
 )
 
 
@@ -47,6 +48,7 @@ class EnrichedIP(BaseEnrichedEntity):
     dns_port_cert: Optional[DnsPortCert] = Field(alias='dnsPortCert', default=None)
     location: Optional[IPLocation] = None
     risky_cidr_ips: Optional[list[RiskyCIDRPIP]] = Field(alias='riskyCIDRIPs', default=None)
+    scanner: Optional[Scanner] = None
 
 
 class EnrichedDomain(BaseEnrichedEntity):

{psengine-2.3.1 → psengine-2.4.1}/psengine/enrich/models/lookup.py

@@ -304,6 +304,45 @@ class DnsPortCert(RFBaseModel):
     ports: Optional[list[Port]] = None
 
 
+###########################################################
+# Scanner
+###########################################################
+class Tag(RFBaseModel):
+    verdict_details: Optional[list[str]] = Field(default=None, alias='verdictDetails')
+    entity: list[IdNameType]
+
+
+class Ports(RFBaseModel):
+    tcp: list[int]
+
+
+class Evidence(RFBaseModel):
+    name: str = Field(alias='Name')
+    mitigation_string: str = Field(default=None, alias='MitigationString')
+    evidence_string: str = Field(alias='EvidenceString', default=None)
+    rule: str = Field(alias='Rule')
+    criticality: float = Field(alias='Criticality')
+    timestamp: datetime = Field(alias='Timestamp')
+    criticality_label: str = Field(alias='CriticalityLabel')
+    sources_count: float = Field(alias='SourcesCount')
+    sightings_count: float = Field(alias='SightingsCount')
+    sources: list[str] = Field(alias='Sources')
+
+
+class Scanner(RFBaseModel):
+    last_seen: str = Field(alias='lastSeen')
+    tags: Tag
+    verdict: str
+    scanned_ip_countries: list[str] = Field(alias='scannedIpCountries')
+    rdns: list[str]
+    scanner_country: str = Field(alias='scannerCountry')
+    ports: Ports
+    global_scanner: bool = Field(alias='globalScanner')
+    user_agents: list[str] = Field(alias='userAgents', default=None)
+    web_requests: list[str] = Field(alias='webRequests', default=None)
+    evidence: Optional[list[Evidence]] = []
+
+
 ###########################################################
 # NVD
 ###########################################################

{psengine-2.3.1 → psengine-2.4.1}/psengine/entity_match/entity_match.py

@@ -68,6 +68,13 @@ class ResolvedEntity(RFBaseModel):
 
     This class supports string representation of `ResolvedEntity` instances.
 
+    Hashing:
+        Returns a hash value based on the entity `id_` if found, else the hash of the name.
+
+    Equality:
+        Checks equality between two `ResolvedEntity` instances based on the `id_` if the entity was
+        found else the name.
+
     String Representation:
         Returns a string representation of the `ResolvedEntity` instance including the
         entity match name, type, and ID.
@@ -91,3 +98,13 @@ class ResolvedEntity(RFBaseModel):
         if isinstance(self.content, IdNameType):
             return f'Entity: {self.entity}, Type: {self.content.type_}, ID: {self.content.id_}'
         return f'Entity: {self.entity}, {self.content}'
+
+    def __hash__(self):
+        if hasattr(self.content, 'id_'):
+            return hash(self.content.id_)
+        return hash(self.entity)
+
+    def __eq__(self, other: 'ResolvedEntity'):
+        if hasattr(self.content, 'id_') and hasattr(other.content, 'id_'):
+            return self.content.id_ == other.content.id_
+        return self.entity == other.entity

{psengine-2.3.1 → psengine-2.4.1}/psengine/entity_match/entity_match_mgr.py

@@ -48,7 +48,7 @@ class EntityMatchMgr:
             Optional[Union[list, str]], Doc('Type or list of types of the entity, if known.')
         ] = None,
         limit: Annotated[int, Doc('Maximum number of matches to return.')] = DEFAULT_LIMIT,
-    ) -> Annotated[list[ResolvedEntity], Doc('List of resolved entity matches.')]:
+    ) -> Annotated[list[ResolvedEntity], Doc('List of deduplicated resolved entity matches.')]:
         """Match a text string using the entity match API.
 
         Endpoint:
@@ -65,7 +65,7 @@ class EntityMatchMgr:
         response = self.rf_client.request('post', EP_ENTITY_MATCH, data=request_body.json())
         response = [IdNameType.model_validate(d) for d in response.json()]
         return (
-            [ResolvedEntity(entity=d.name, is_found=bool(d.id_), content=d) for d in response]
+            list({ResolvedEntity(entity=d.name, is_found=bool(d.id_), content=d) for d in response})
             if response
             else [ResolvedEntity(entity=entity_name, is_found=False, content='Entity ID not found')]
         )

{psengine-2.3.1 → psengine-2.4.1}/psengine/malware_intel/malware_intel.py

@@ -96,7 +96,7 @@ class MalwareReportIn(RFBaseModel):
     """Validate data sent to the `/v1/reports` endpoint."""
 
     query: str
-    sha256: str
+    sha256: Optional[str] = None
     start_date: Annotated[
         str, BeforeValidator(Validators.convert_relative_time), AfterValidator(_split_time)
     ]

{psengine-2.3.1 → psengine-2.4.1}/psengine/malware_intel/models.py

@@ -247,7 +247,8 @@ class SampleInfo(RFBaseModel):
 
 
 class StaticInfo(RFBaseModel):
-    exts: Optional[str] = None
+    extracted: Optional[list[ExtractedItem]] = []
+    exts: Optional[list[str]] = None
     sha1: Optional[str] = None
     md5: Optional[str] = None
     sha256: Optional[str] = None
@@ -256,6 +257,10 @@ class StaticInfo(RFBaseModel):
     ssdeep: Optional[str] = None
     tags: Optional[list[str]] = []
     target: Optional[str] = None
+    registry: RegistryInfo = Field(default_factory=RegistryInfo)
+    registry_count: Optional[int] = None
+    signatures: Optional[list[Signature]] = []
+    signatures_count: Optional[int] = None
 
 
 class DynamicInfo(RFBaseModel):

{psengine-2.3.1 → psengine-2.4.1}/psengine.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: psengine
-Version: 2.3.1
+Version: 2.4.1
 Summary: psengine is a simple, yet elegant, library for rapid development of integrations with Recorded Future.
 Author-email: Moise Medici <moise.medici@recordedfuture.com>, Patrick Kinsella <patrick.kinsella@recordedfuture.com>, Ernest Bartosevic <ernest.bartosevic@recordedfuture.com>
 License-Expression: MIT
@@ -20,6 +20,7 @@ Classifier: Programming Language :: Python :: 3.13
 Requires-Python: <3.14,>=3.9
 Description-Content-Type: text/markdown
 License-File: LICENSE
+Requires-Dist: typing_extensions>=4.8.0
 Requires-Dist: requests>=2.27.1
 Requires-Dist: jsonpath_ng<=1.6.1,>=1.5.3
 Requires-Dist: stix2~=3.0.1

{psengine-2.3.1 → psengine-2.4.1}/psengine.egg-info/requires.txt

@@ -1,3 +1,4 @@
+typing_extensions>=4.8.0
 requests>=2.27.1
 jsonpath_ng<=1.6.1,>=1.5.3
 stix2~=3.0.1

{psengine-2.3.1 → psengine-2.4.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "psengine"
-version = "2.3.1"
+version = "2.4.1"
 readme = "README.md"
 license = "MIT"
 requires-python = ">=3.9, <3.14"
@@ -27,6 +27,7 @@ classifiers=[
 
 
 dependencies = [
+    "typing_extensions >= 4.8.0",
     "requests>=2.27.1",
     "jsonpath_ng>=1.5.3, <=1.6.1",
     "stix2~=3.0.1",