psengine 2.4.0__tar.gz → 2.4.2__tar.gz

{psengine-2.4.0 → psengine-2.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: psengine
-Version: 2.4.0
+Version: 2.4.2
 Summary: psengine is a simple, yet elegant, library for rapid development of integrations with Recorded Future.
 Author-email: Moise Medici <moise.medici@recordedfuture.com>, Patrick Kinsella <patrick.kinsella@recordedfuture.com>, Ernest Bartosevic <ernest.bartosevic@recordedfuture.com>
 License-Expression: MIT
@@ -20,6 +20,7 @@ Classifier: Programming Language :: Python :: 3.13
 Requires-Python: <3.14,>=3.9
 Description-Content-Type: text/markdown
 License-File: LICENSE
+Requires-Dist: typing_extensions>=4.8.0
 Requires-Dist: requests>=2.27.1
 Requires-Dist: jsonpath_ng<=1.6.1,>=1.5.3
 Requires-Dist: stix2~=3.0.1

{psengine-2.4.0 → psengine-2.4.2}/psengine/_version.py

@@ -11,4 +11,4 @@
 # accessed from any third party API.                                                         #
 ##############################################################################################
 
-__version__ = '2.4.0'
+__version__ = '2.4.1'

{psengine-2.4.0 → psengine-2.4.2}/psengine/constants.py

@@ -23,7 +23,7 @@ DEFAULT_MAX_WORKERS = 10
 # Recorded Future API
 #####################
 RF_TOKEN_ENV_VAR = 'RF_TOKEN'  # noqa: S105
-RF_TOKEN_VALIDATION_REGEX = r'^[a-f0-9]{32}$'  # noqa: S105
+RF_TOKEN_VALIDATION_REGEX = r'^[a-z0-9]{32}$'  # noqa: S105
 
 #####################
 # Recorded Future Portal

{psengine-2.4.0 → psengine-2.4.2}/psengine/detection/detection_mgr.py

@@ -93,7 +93,7 @@ class DetectionMgr:
         data = {
             'filter': filters,
             'tagged_entities': tagged_entities,
-            'limit': SEARCH_LIMIT,
+            'limit': min(SEARCH_LIMIT, max_results) if max_results else SEARCH_LIMIT,
         }
 
         data = DetectionRuleSearchOut.model_validate(data)

{psengine-2.4.0 → psengine-2.4.2}/psengine/malware_intel/malware_intel.py

@@ -89,6 +89,8 @@ class SandboxReport(RFBaseModel):
 
 
 def _split_time(value: str):
+    if not value:
+        return value
     return value.split('T')[0]
 
 
@@ -96,12 +98,14 @@ class MalwareReportIn(RFBaseModel):
     """Validate data sent to the `/v1/reports` endpoint."""
 
     query: str
-    sha256: str
+    sha256: Optional[str] = None
     start_date: Annotated[
         str, BeforeValidator(Validators.convert_relative_time), AfterValidator(_split_time)
     ]
     end_date: Annotated[
-        str, BeforeValidator(Validators.convert_relative_time), AfterValidator(_split_time)
+        Optional[str],
+        BeforeValidator(Validators.convert_relative_time),
+        AfterValidator(_split_time),
     ]
     my_enterprise: bool
     limit: int = Field(ge=1, le=10)

{psengine-2.4.0 → psengine-2.4.2}/psengine/malware_intel/malware_intel_mgr.py

@@ -12,7 +12,7 @@
 ##############################################################################################
 
 import logging
-from typing import Annotated
+from typing import Annotated, Optional
 
 from pydantic import validate_call
 from typing_extensions import Doc
@@ -48,7 +48,9 @@ class MalwareIntelMgr:
         start_date: Annotated[
             str, Doc('The starting date, format YYYY-MM-DD or relative like -1d.')
         ],
-        end_date: Annotated[str, Doc('The ending date, format YYYY-MM-DD or relative like -1d.')],
+        end_date: Annotated[
+            Optional[str], Doc('The ending date, format YYYY-MM-DD or relative like -1d.')
+        ] = None,
         my_enterprise: Annotated[
             bool, Doc('If the report has been submitted by your enterprise.')
         ] = False,

{psengine-2.4.0 → psengine-2.4.2}/psengine/malware_intel/models.py

@@ -247,7 +247,8 @@ class SampleInfo(RFBaseModel):
 
 
 class StaticInfo(RFBaseModel):
-    exts: Optional[str] = None
+    extracted: Optional[list[ExtractedItem]] = []
+    exts: Optional[list[str]] = None
     sha1: Optional[str] = None
     md5: Optional[str] = None
     sha256: Optional[str] = None
@@ -256,6 +257,10 @@ class StaticInfo(RFBaseModel):
     ssdeep: Optional[str] = None
     tags: Optional[list[str]] = []
     target: Optional[str] = None
+    registry: RegistryInfo = Field(default_factory=RegistryInfo)
+    registry_count: Optional[int] = None
+    signatures: Optional[list[Signature]] = []
+    signatures_count: Optional[int] = None
 
 
 class DynamicInfo(RFBaseModel):

{psengine-2.4.0 → psengine-2.4.2}/psengine/playbook_alerts/playbook_alert_mgr.py

@@ -141,9 +141,9 @@ class PlaybookAlertMgr:
         alerts_per_page: Annotated[
             Optional[int], Doc('Number of alerts per page (pagination).')
         ] = Field(ge=1, le=10000, default=ALERTS_PER_PAGE),
-        max_results: Annotated[
-            Optional[int], Doc('Maximum number of alerts to fetch.')
-        ] = DEFAULT_LIMIT,
+        max_results: Annotated[Optional[int], Doc('Maximum number of alerts to fetch.')] = Field(
+            ge=1, le=10_000, default=DEFAULT_LIMIT
+        ),
         order_by: Annotated[
             Optional[str], Doc('Field to order alerts by, e.g. `created` or `updated`.')
         ] = None,
@@ -229,7 +229,7 @@ class PlaybookAlertMgr:
         ),
         max_results: Annotated[
             Optional[int], Doc('Maximum total number of alerts to fetch.')
-        ] = DEFAULT_LIMIT,
+        ] = Field(ge=1, le=10_000, default=DEFAULT_LIMIT),
         order_by: Annotated[
             Optional[str], Doc('Field to order alerts by, e.g. `created` or `updated`.')
         ] = None,
@@ -286,7 +286,7 @@ class PlaybookAlertMgr:
             data=request_body,
             max_results=max_results,
             results_path='data',
-            offset_key='from',
+            offset_key='offset',
         )
 
         # To avoid a breaking change have to reconstruct the SearchResponse model manually

{psengine-2.4.0 → psengine-2.4.2}/psengine/rf_client.py

@@ -184,8 +184,13 @@ class RFClient(BaseHTTPClient):
         **kwargs,
     ):
         if 'next_offset' in json_response:
+            current_len = 0
             while 'next_offset' in json_response:
                 data[offset_key] = json_response['next_offset']
+                data['limit'] = min(data['limit'], max_results - current_len)
+                if data['limit'] <= 0:
+                    break
+
                 json_response = self.request(
                     method=method,
                     url=url,
@@ -202,11 +207,15 @@ class RFClient(BaseHTTPClient):
                     if any(len(v) >= max_results for v in dict_results.values()):
                         dict_results = {k: v[:max_results] for k, v in dict_results.items()}
                         break
+                    current_len = max(len(v) for v in dict_results.values())
+
                 else:
                     all_results += self._get_matches(results_expr, json_response)
-                    if len(all_results) >= max_results:
+                    current_len = len(all_results)
+                    if current_len >= max_results:
                         all_results = all_results[:max_results]
                         break
+
         else:
             seen = json_response['counts']['returned']
             if json_response['counts']['total'] > max_results:
@@ -324,6 +333,9 @@ class RFClient(BaseHTTPClient):
                 with suppress(KeyError):
                     dict_results[str(expr)].extend(self._get_matches(expr, json_response))
 
+        if len(all_results) >= max_results:
+            return all_results[:max_results]
+
         if method.lower() == 'get':
             return self._request_paged_get(
                 url=url,
@@ -340,6 +352,8 @@ class RFClient(BaseHTTPClient):
             )
 
         if method.lower() == 'post':
+            data['limit'] = min(data['limit'], max_results - len(all_results))
+
             return self._request_paged_post(
                 url=url,
                 method=method,

{psengine-2.4.0 → psengine-2.4.2}/psengine.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: psengine
-Version: 2.4.0
+Version: 2.4.2
 Summary: psengine is a simple, yet elegant, library for rapid development of integrations with Recorded Future.
 Author-email: Moise Medici <moise.medici@recordedfuture.com>, Patrick Kinsella <patrick.kinsella@recordedfuture.com>, Ernest Bartosevic <ernest.bartosevic@recordedfuture.com>
 License-Expression: MIT
@@ -20,6 +20,7 @@ Classifier: Programming Language :: Python :: 3.13
 Requires-Python: <3.14,>=3.9
 Description-Content-Type: text/markdown
 License-File: LICENSE
+Requires-Dist: typing_extensions>=4.8.0
 Requires-Dist: requests>=2.27.1
 Requires-Dist: jsonpath_ng<=1.6.1,>=1.5.3
 Requires-Dist: stix2~=3.0.1

{psengine-2.4.0 → psengine-2.4.2}/psengine.egg-info/requires.txt

@@ -1,3 +1,4 @@
+typing_extensions>=4.8.0
 requests>=2.27.1
 jsonpath_ng<=1.6.1,>=1.5.3
 stix2~=3.0.1

{psengine-2.4.0 → psengine-2.4.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "psengine"
-version = "2.4.0"
+version = "2.4.2"
 readme = "README.md"
 license = "MIT"
 requires-python = ">=3.9, <3.14"
@@ -27,6 +27,7 @@ classifiers=[
 
 
 dependencies = [
+    "typing_extensions >= 4.8.0",
     "requests>=2.27.1",
     "jsonpath_ng>=1.5.3, <=1.6.1",
     "stix2~=3.0.1",