psengine 2.4.1__tar.gz → 2.4.3__tar.gz

{psengine-2.4.1 → psengine-2.4.3}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.4
 Name: psengine
-Version: 2.4.1
+Version: 2.4.3
 Summary: psengine is a simple, yet elegant, library for rapid development of integrations with Recorded Future.
 Author-email: Moise Medici <moise.medici@recordedfuture.com>, Patrick Kinsella <patrick.kinsella@recordedfuture.com>, Ernest Bartosevic <ernest.bartosevic@recordedfuture.com>
 License-Expression: MIT
-Project-URL: Homepage, https://github.com/RecordedFuture-ProfessionalServices/psengine
-Project-URL: Changelog, https://recordedfuture-professionalservices.github.io/psengine/CHANGELOG/
+Project-URL: Homepage, https://recordedfuture-professionalservices.github.io/psengine/latest/
+Project-URL: Changelog, https://recordedfuture-professionalservices.github.io/psengine/latest/CHANGELOG/
 Keywords: API,Recorded Future,Cyber Security Engineering,Threat Intelligence
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Programming Language :: Python

{psengine-2.4.1 → psengine-2.4.3}/psengine/__init__.py

@@ -13,7 +13,6 @@
 
 import logging
 
-from ._version import __version__ as version
 from .base_http_client import BaseHTTPClient
 from .errors import ReadFileError, RecordedFutureError, WriteFileError
 from .rf_client import RFClient

{psengine-2.4.1 → psengine-2.4.3}/psengine/_sdk_id.py

@@ -11,6 +11,6 @@
 # accessed from any third party API.                                                         #
 ##############################################################################################
 
-from ._version import __version__
+from importlib.metadata import version
 
-SDK_ID = f'psengine-py/{__version__}'
+SDK_ID = f'psengine-py/{version("psengine")}'

{psengine-2.4.1 → psengine-2.4.3}/psengine/constants.py

@@ -23,7 +23,7 @@ DEFAULT_MAX_WORKERS = 10
 # Recorded Future API
 #####################
 RF_TOKEN_ENV_VAR = 'RF_TOKEN'  # noqa: S105
-RF_TOKEN_VALIDATION_REGEX = r'^[a-f0-9]{32}$'  # noqa: S105
+RF_TOKEN_VALIDATION_REGEX = r'^[a-z0-9]{32}$'  # noqa: S105
 
 #####################
 # Recorded Future Portal

{psengine-2.4.1 → psengine-2.4.3}/psengine/detection/detection_mgr.py

@@ -93,7 +93,7 @@ class DetectionMgr:
         data = {
             'filter': filters,
             'tagged_entities': tagged_entities,
-            'limit': SEARCH_LIMIT,
+            'limit': min(SEARCH_LIMIT, max_results) if max_results else SEARCH_LIMIT,
         }
 
         data = DetectionRuleSearchOut.model_validate(data)

{psengine-2.4.1 → psengine-2.4.3}/psengine/malware_intel/malware_intel.py

@@ -89,6 +89,8 @@ class SandboxReport(RFBaseModel):
 
 
 def _split_time(value: str):
+    if not value:
+        return value
     return value.split('T')[0]
 
 
@@ -101,7 +103,9 @@ class MalwareReportIn(RFBaseModel):
         str, BeforeValidator(Validators.convert_relative_time), AfterValidator(_split_time)
     ]
     end_date: Annotated[
-        str, BeforeValidator(Validators.convert_relative_time), AfterValidator(_split_time)
+        Optional[str],
+        BeforeValidator(Validators.convert_relative_time),
+        AfterValidator(_split_time),
     ]
     my_enterprise: bool
     limit: int = Field(ge=1, le=10)

{psengine-2.4.1 → psengine-2.4.3}/psengine/malware_intel/malware_intel_mgr.py

@@ -12,7 +12,7 @@
 ##############################################################################################
 
 import logging
-from typing import Annotated
+from typing import Annotated, Optional
 
 from pydantic import validate_call
 from typing_extensions import Doc
@@ -48,7 +48,9 @@ class MalwareIntelMgr:
         start_date: Annotated[
             str, Doc('The starting date, format YYYY-MM-DD or relative like -1d.')
         ],
-        end_date: Annotated[str, Doc('The ending date, format YYYY-MM-DD or relative like -1d.')],
+        end_date: Annotated[
+            Optional[str], Doc('The ending date, format YYYY-MM-DD or relative like -1d.')
+        ] = None,
         my_enterprise: Annotated[
             bool, Doc('If the report has been submitted by your enterprise.')
         ] = False,

{psengine-2.4.1 → psengine-2.4.3}/psengine/playbook_alerts/constants.py

@@ -58,5 +58,3 @@ PBA_WITH_IMAGES_VALIDATOR = Union[
 PBA_WITH_IMAGES_INST = (PBA_DomainAbuse, PBA_GeopoliticsFacility)
 
 ALERTS_PER_PAGE = 50
-
-BULK_LOOKUP_BATCH_SIZE = 200

{psengine-2.4.1 → psengine-2.4.3}/psengine/playbook_alerts/markdown/markdown.py

@@ -42,7 +42,7 @@ MARKDOWN_BY_PBA_TYPE = {
 
 
 def _generic_pba_summary(pba, md_maker: MarkdownMaker):
-    md_maker.add_title(pba.panel_status.case_rule_label)
+    md_maker.add_title(pba.panel_status.alert_rule.name or pba.panel_status.alert_rule.label)
     id_ = pba.playbook_alert_id
     general_info = [
         f'{bold("ID:")} {id_}  ',

{psengine-2.4.1 → psengine-2.4.3}/psengine/playbook_alerts/models/common_models.py

@@ -29,3 +29,9 @@ class PBAInsiktNote(RFBaseModel):
     published: Optional[datetime] = None
     topic: Optional[str] = None
     fragment: Optional[str] = None
+
+
+class AlertRule(RFBaseModel):
+    id_: str = Field(alias='id')
+    label: str
+    name: Optional[str] = None

{psengine-2.4.1 → psengine-2.4.3}/psengine/playbook_alerts/models/panel_status.py

@@ -19,6 +19,7 @@ from pydantic import model_validator
 
 from ...common_models import RFBaseModel
 from ..models.common_models import ResolvedEntity
+from .common_models import AlertRule
 
 
 class Organisation(RFBaseModel):
@@ -42,6 +43,7 @@ class PanelStatus(RFBaseModel):
     updated: datetime
     case_rule_id: Optional[str] = None
     case_rule_label: Optional[str] = None
+    alert_rule: AlertRule
     creator_name: Optional[str] = None
     creator_id: Optional[str] = None
     owner_organisation_details: Optional[OwnerOrganisationDetails] = None

{psengine-2.4.1 → psengine-2.4.3}/psengine/playbook_alerts/models/pba_geopolitics_facility.py

@@ -14,7 +14,7 @@
 from datetime import datetime
 from typing import Optional
 
-from pydantic import Field, HttpUrl
+from pydantic import Field
 
 from ...common_models import RFBaseModel
 from ..models.panel_status import PanelStatus
@@ -28,7 +28,7 @@ class Assessment(RFBaseModel):
 class Event(RFBaseModel):
     text: str = None
     source: str = None
-    url: HttpUrl = None
+    url: str = None
     assessments: list[Assessment] = []
     document_id: str = None
     time: datetime = None

{psengine-2.4.1 → psengine-2.4.3}/psengine/playbook_alerts/models/search_endpoint.py

@@ -19,6 +19,7 @@ from pydantic import Field, model_validator
 
 from ...common_models import RFBaseModel
 from ..models.panel_status import OwnerOrganisationDetails
+from .common_models import AlertRule
 
 
 class DatetimeRange(RFBaseModel):
@@ -33,6 +34,7 @@ class SearchStatus(RFBaseModel):
 
 class SearchData(RFBaseModel):
     playbook_alert_id: str
+    alert_rule: AlertRule
     status: str
     priority: str
     reopen: Optional[str] = None

{psengine-2.4.1 → psengine-2.4.3}/psengine/playbook_alerts/playbook_alert_mgr.py

@@ -30,7 +30,6 @@ from ..helpers import TimeHelpers, connection_exceptions, debug_call
 from ..rf_client import RFClient
 from .constants import (
     ALERTS_PER_PAGE,
-    BULK_LOOKUP_BATCH_SIZE,
     PBA_WITH_IMAGES_INST,
     PBA_WITH_IMAGES_TYPE,
     PBA_WITH_IMAGES_VALIDATOR,
@@ -141,9 +140,9 @@ class PlaybookAlertMgr:
         alerts_per_page: Annotated[
             Optional[int], Doc('Number of alerts per page (pagination).')
         ] = Field(ge=1, le=10000, default=ALERTS_PER_PAGE),
-        max_results: Annotated[
-            Optional[int], Doc('Maximum number of alerts to fetch.')
-        ] = DEFAULT_LIMIT,
+        max_results: Annotated[Optional[int], Doc('Maximum number of alerts to fetch.')] = Field(
+            ge=1, le=10_000, default=DEFAULT_LIMIT
+        ),
         order_by: Annotated[
             Optional[str], Doc('Field to order alerts by, e.g. `created` or `updated`.')
         ] = None,
@@ -208,7 +207,9 @@ class PlaybookAlertMgr:
             in_cat_alerts = filter(lambda x: x['category'] == cat, alerts)
             in_cat_ids = [x['id'] for x in in_cat_alerts]
             try:
-                fetched_alerts.extend(self._do_bulk(in_cat_ids, cat, fetch_images, panels or []))
+                fetched_alerts.extend(
+                    self._do_bulk(in_cat_ids, cat, fetch_images, panels or [], alerts_per_page)
+                )
             except (PlaybookAlertBulkFetchError, PlaybookAlertRetrieveImageError) as err:  # noqa: PERF203
                 errors += 1
                 self.log.error(err)
@@ -229,7 +230,7 @@ class PlaybookAlertMgr:
         ),
         max_results: Annotated[
             Optional[int], Doc('Maximum total number of alerts to fetch.')
-        ] = DEFAULT_LIMIT,
+        ] = Field(ge=1, le=10_000, default=DEFAULT_LIMIT),
         order_by: Annotated[
             Optional[str], Doc('Field to order alerts by, e.g. `created` or `updated`.')
         ] = None,
@@ -286,7 +287,7 @@ class PlaybookAlertMgr:
             data=request_body,
             max_results=max_results,
             results_path='data',
-            offset_key='from',
+            offset_key='offset',
         )
 
         # To avoid a breaking change have to reconstruct the SearchResponse model manually
@@ -547,7 +548,7 @@ class PlaybookAlertMgr:
     @validate_call
     @connection_exceptions(ignore_status_code=[], exception_to_raise=PlaybookAlertBulkFetchError)
     def _do_bulk(
-        self, alert_ids: list, category: str, fetch_image: bool, panels: list
+        self, alert_ids: list, category: str, fetch_image: bool, panels: list, alerts_per_page: int
     ) -> list[PLAYBOOK_ALERT_TYPE]:
         """Does bulk fetch (used by bulk() after alert IDs have been sorted by category).
 
@@ -556,6 +557,7 @@ class PlaybookAlertMgr:
             category (str): Category of alert to fetch
             fetch_image (bool): Whether to fetch images for Domain Abuse alerts
             panels (list): List of panels to fetch
+            alerts_per_page (int): Number of alerts to fetch per page for bulk search results
 
         Raises:
             ValidationError: if any supplied parameter is of incorrect type
@@ -576,7 +578,7 @@ class PlaybookAlertMgr:
         self.log.info(f'Fetching {len(alert_ids)} {category} alerts')
 
         results = []
-        for batch in batched(alert_ids, BULK_LOOKUP_BATCH_SIZE):
+        for batch in batched(alert_ids, alerts_per_page):
             data['playbook_alert_ids'] = batch
             response = self.rf_client.request('post', url=CATEGORY_ENDPOINTS[category], data=data)
             results += response.json()['data']

{psengine-2.4.1 → psengine-2.4.3}/psengine/playbook_alerts/playbook_alerts.py

@@ -127,7 +127,7 @@ class PBA_Generic(RFBaseModel):
         return (
             f'Playbook Alert ID: {self.playbook_alert_id}, '
             f'Updated: {self.panel_status.updated.strftime(TIMESTAMP_STR)}, '
-            f'Category: {self.panel_status.case_rule_label}, '
+            f'Category: {self.panel_status.alert_rule.name or self.panel_status.alert_rule.label}, '
             f'Lookup Status: {self.panel_status.status}'
         )
 

{psengine-2.4.1 → psengine-2.4.3}/psengine/rf_client.py

@@ -184,8 +184,13 @@ class RFClient(BaseHTTPClient):
         **kwargs,
     ):
         if 'next_offset' in json_response:
+            current_len = 0
             while 'next_offset' in json_response:
                 data[offset_key] = json_response['next_offset']
+                data['limit'] = min(data['limit'], max_results - current_len)
+                if data['limit'] <= 0:
+                    break
+
                 json_response = self.request(
                     method=method,
                     url=url,
@@ -202,11 +207,15 @@ class RFClient(BaseHTTPClient):
                     if any(len(v) >= max_results for v in dict_results.values()):
                         dict_results = {k: v[:max_results] for k, v in dict_results.items()}
                         break
+                    current_len = max(len(v) for v in dict_results.values())
+
                 else:
                     all_results += self._get_matches(results_expr, json_response)
-                    if len(all_results) >= max_results:
+                    current_len = len(all_results)
+                    if current_len >= max_results:
                         all_results = all_results[:max_results]
                         break
+
         else:
             seen = json_response['counts']['returned']
             if json_response['counts']['total'] > max_results:
@@ -324,6 +333,9 @@ class RFClient(BaseHTTPClient):
                 with suppress(KeyError):
                     dict_results[str(expr)].extend(self._get_matches(expr, json_response))
 
+        if len(all_results) >= max_results:
+            return all_results[:max_results]
+
         if method.lower() == 'get':
             return self._request_paged_get(
                 url=url,
@@ -340,6 +352,8 @@ class RFClient(BaseHTTPClient):
             )
 
         if method.lower() == 'post':
+            data['limit'] = min(data['limit'], max_results - len(all_results))
+
             return self._request_paged_post(
                 url=url,
                 method=method,

{psengine-2.4.1 → psengine-2.4.3}/psengine.egg-info/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.4
 Name: psengine
-Version: 2.4.1
+Version: 2.4.3
 Summary: psengine is a simple, yet elegant, library for rapid development of integrations with Recorded Future.
 Author-email: Moise Medici <moise.medici@recordedfuture.com>, Patrick Kinsella <patrick.kinsella@recordedfuture.com>, Ernest Bartosevic <ernest.bartosevic@recordedfuture.com>
 License-Expression: MIT
-Project-URL: Homepage, https://github.com/RecordedFuture-ProfessionalServices/psengine
-Project-URL: Changelog, https://recordedfuture-professionalservices.github.io/psengine/CHANGELOG/
+Project-URL: Homepage, https://recordedfuture-professionalservices.github.io/psengine/latest/
+Project-URL: Changelog, https://recordedfuture-professionalservices.github.io/psengine/latest/CHANGELOG/
 Keywords: API,Recorded Future,Cyber Security Engineering,Threat Intelligence
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Programming Language :: Python

{psengine-2.4.1 → psengine-2.4.3}/psengine.egg-info/SOURCES.txt

@@ -3,7 +3,6 @@ README.md
 pyproject.toml
 psengine/__init__.py
 psengine/_sdk_id.py
-psengine/_version.py
 psengine/base_http_client.py
 psengine/common_models.py
 psengine/constants.py

{psengine-2.4.1 → psengine-2.4.3}/pyproject.toml

@@ -1,10 +1,11 @@
 [project]
 name = "psengine"
-version = "2.4.1"
+version = "2.4.3"
 readme = "README.md"
 license = "MIT"
 requires-python = ">=3.9, <3.14"
 description = "psengine is a simple, yet elegant, library for rapid development of integrations with Recorded Future."
+
 authors = [
     {name = "Moise Medici", email = "moise.medici@recordedfuture.com"},
     {name = "Patrick Kinsella", email = "patrick.kinsella@recordedfuture.com"},
@@ -77,8 +78,8 @@ requires = [
 build-backend = "setuptools.build_meta"
 
 [project.urls]
-Homepage = "https://github.com/RecordedFuture-ProfessionalServices/psengine"
-Changelog = "https://recordedfuture-professionalservices.github.io/psengine/CHANGELOG/"
+Homepage = "https://recordedfuture-professionalservices.github.io/psengine/latest/"
+Changelog = "https://recordedfuture-professionalservices.github.io/psengine/latest/CHANGELOG/"
 
 [tool.setuptools]
 packages = [

psengine-2.4.1/psengine/_version.py

@@ -1,14 +0,0 @@
-##################################### TERMS OF USE ###########################################
-# The following code is provided for demonstration purpose only, and should not be used      #
-# without independent verification. Recorded Future makes no representations or warranties,  #
-# express, implied, statutory, or otherwise, regarding any aspect of this code or of the     #
-# information it may retrieve, and provides it both strictly “as-is” and without assuming    #
-# responsibility for any information it may retrieve. Recorded Future shall not be liable    #
-# for, and you assume all risk of using, the foregoing. By using this code, Customer         #
-# represents that it is solely responsible for having all necessary licenses, permissions,   #
-# rights, and/or consents to connect to third party APIs, and that it is solely responsible  #
-# for having all necessary licenses, permissions, rights, and/or consents to any data        #
-# accessed from any third party API.                                                         #
-##############################################################################################
-
-__version__ = '2.4.1'