psengine 2.8.4__tar.gz → 2.9.0__tar.gz

{psengine-2.8.4 → psengine-2.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: psengine
-Version: 2.8.4
+Version: 2.9.0
 Summary: psengine is a simple, yet elegant, library for rapid development of integrations with Recorded Future.
 Keywords: API,Recorded Future,Cyber Security Engineering,Threat Intelligence
 Author: Moise Medici, Patrick Kinsella, Ernest Bartosevic
@@ -23,7 +23,7 @@ Requires-Dist: idna>=3.15
 Requires-Dist: jsonpath-ng>=1.5.3,<=1.8.0
 Requires-Dist: stix2~=3.0.2
 Requires-Dist: python-dateutil>=2.7.0
-Requires-Dist: more-itertools>=9.0.0,<=11.0.2
+Requires-Dist: more-itertools>=9.0.0,<=11.1.0
 Requires-Dist: pydantic>=2.7,<3.0.0
 Requires-Dist: pydantic-settings[toml]>=2.14.2,<2.15.0
 Requires-Python: >=3.10, <3.15
@@ -76,6 +76,7 @@ It can easily interact with the following Recorded Future datasets:
 - On demand IOC enrichment
 - Risklists
 - Risk History
+- Sandbox Detonation of files and URLs
 - STIX conversion
 
 

{psengine-2.8.4 → psengine-2.9.0}/README.md

@@ -43,6 +43,7 @@ It can easily interact with the following Recorded Future datasets:
 - On demand IOC enrichment
 - Risklists
 - Risk History
+- Sandbox Detonation of files and URLs
 - STIX conversion
 
 

{psengine-2.8.4 → psengine-2.9.0}/psengine/analyst_notes/note_mgr.py

@@ -92,6 +92,11 @@ class AnalystNoteMgr:
 
         `max_results` is the maximum number of references, not notes.
 
+        Note:
+            Search returns a reduced `AnalystNote` projection. Fields such as
+            `diamond_model`, `events`, and `labels` are not populated and must be
+            retrieved per note via `lookup()`.
+
         Endpoint:
             `/analystnote/search`
 

{psengine-2.8.4 → psengine-2.9.0}/psengine/config/config.py

@@ -18,7 +18,7 @@ from copy import deepcopy
 from pathlib import Path
 from typing import Annotated
 
-from pydantic import Field, Secret, field_validator, validate_call
+from pydantic import Field, Secret, ValidationInfo, field_validator, validate_call
 from pydantic_settings import (
     BaseSettings,
     DotEnvSettingsSource,
@@ -32,6 +32,7 @@ from typing_extensions import Doc
 
 from ..constants import (
     ASI_TOKEN_ENV_VAR,
+    ASI_TOKEN_VALIDATION_REGEX,
     BACKOFF_FACTOR,
     POOL_MAX_SIZE,
     REQUEST_TIMEOUT,
@@ -39,6 +40,8 @@ from ..constants import (
     RF_TOKEN_ENV_VAR,
     RF_TOKEN_VALIDATION_REGEX,
     ROOT_DIR,
+    SANDBOX_TOKEN_ENV_VAR,
+    SANDBOX_TOKEN_VALIDATION_REGEX,
     SSL_VERIFY,
     STATUS_FORCELIST,
 )
@@ -48,6 +51,20 @@ from .errors import ConfigFileError
 PLAT_REGEX = r'^([A-Z]|[a-z])+(\/\d+)?((\.\d+)*?)$'
 APP_ID_REGEX = r'^\S+\/\d+((\.\d+)*?)$'
 
+TOKEN_CONFIG = {
+    'rf_token': (RF_TOKEN_ENV_VAR, RF_TOKEN_VALIDATION_REGEX, 'Recorded Future'),
+    'asi_token': (
+        ASI_TOKEN_ENV_VAR,
+        ASI_TOKEN_VALIDATION_REGEX,
+        'Recorded Future Attack Surface Intelligence',
+    ),
+    'sandbox_token': (
+        SANDBOX_TOKEN_ENV_VAR,
+        SANDBOX_TOKEN_VALIDATION_REGEX,
+        'Recorded Future Sandbox',
+    ),
+}
+
 
 class RFToken(Secret[str]):
     """Recorded Future token mask."""
@@ -93,6 +110,7 @@ class ConfigModel(BaseSettings):
     app_id: str | None = Field(default=None, pattern=APP_ID_REGEX, examples=['get-alerts/1.0.0'])
     rf_token: RFToken | None = Field(default=os.environ.get(RF_TOKEN_ENV_VAR, ''))
     asi_token: RFToken | None = Field(default=os.environ.get(ASI_TOKEN_ENV_VAR, ''))
+    sandbox_token: RFToken | None = Field(default=os.environ.get(SANDBOX_TOKEN_ENV_VAR, ''))
     http_proxy: str | None = None
     https_proxy: str | None = None
     client_ssl_verify: bool | None = SSL_VERIFY
@@ -159,28 +177,28 @@ class ConfigModel(BaseSettings):
                 raise ValueError('The config file extension must be .toml or .json or .env')
         return tuple(sources)
 
-    @field_validator('rf_token', mode='before')
+    @field_validator('rf_token', 'asi_token', 'sandbox_token', mode='before')
     @classmethod
     def validate_token(
         cls,
-        rf_token: Annotated[str, Doc('Recorded Future token.')],
+        token: Annotated[str, Doc('API token value.')],
+        info: ValidationInfo,
     ) -> Annotated[str, Doc('Validated token.')]:
-        """Validate a Recorded Future token.
+        """Validate a Recorded Future API token (`rf_token`, `asi_token`, or `sandbox_token`).
 
         Raises:
-            ValueError: When the token is not 32 alphanumeric characters in the `[a-f][0-9]` range.
+            ValueError: When the token does not match the expected format for its field.
         """
-        rf_token = rf_token or os.environ.get(RF_TOKEN_ENV_VAR)
-        if not rf_token:
+        env_var, regex, label = TOKEN_CONFIG[info.field_name]
+        token = token or os.environ.get(env_var)
+        if not token:
             # Edge case: when RF_RF_TOKEN env var is set, it is used and RF_TOKEN is ignored
             # So we check if RF_TOKEN is set and validate it
             return ''
-        if not re.match(RF_TOKEN_VALIDATION_REGEX, rf_token):
-            raise ValueError(
-                f'Invalid Recorded Future API token.must match regex {RF_TOKEN_VALIDATION_REGEX}'
-            )
+        if not re.fullmatch(regex, token):
+            raise ValueError(f'Invalid {label} API token. Must match regex {regex}')
 
-        return rf_token
+        return token
 
     @validate_call
     def save_config(
@@ -198,7 +216,7 @@ class ConfigModel(BaseSettings):
         """
         directory = Path(directory)
         log = logging.getLogger(__name__)
-        data = self.model_dump_json(exclude=['rf_token', 'asi_token'], indent=4)
+        data = self.model_dump_json(exclude=['rf_token', 'asi_token', 'sandbox_token'], indent=4)
         OSHelpers.mkdir(directory)
         config_path = directory / file
         log.info(f'Saving config in {config_path.as_posix()}')
@@ -245,6 +263,8 @@ class Config:
             platform_id (str): Name & version of the tool this integrates with, example: ES/8.0.0.
             app_id (str): Name & version of the integration itself, example: get-alerts/1.0.0.
             rf_token (str): Recorded Future API token.
+            asi_token (str): Recorded Future Attack Surface Intelligence API token.
+            sandbox_token (str): Recorded Future Sandbox API token.
             http_proxy (str): HTTP proxy.
             https_proxy (str): HTTPS proxy.
             client_ssl_verify (bool): SSL verification. Default is True.

{psengine-2.8.4 → psengine-2.9.0}/psengine/constants.py

@@ -26,6 +26,8 @@ RF_TOKEN_ENV_VAR = 'RF_TOKEN'  # noqa: S105
 RF_TOKEN_VALIDATION_REGEX = r'^[a-z0-9]{32}$'  # noqa: S105
 ASI_TOKEN_ENV_VAR = 'RF_ASI_TOKEN'  # noqa: S105
 ASI_TOKEN_VALIDATION_REGEX = r'^[a-zA-Z0-9-_]{32}$'  # noqa: S105
+SANDBOX_TOKEN_ENV_VAR = 'RF_SANDBOX_TOKEN'  # noqa: S105
+SANDBOX_TOKEN_VALIDATION_REGEX = r'^[a-f0-9]{40}$'  # noqa: S105
 
 
 #####################

{psengine-2.8.4 → psengine-2.9.0}/psengine/endpoints.py

@@ -158,6 +158,33 @@ EP_ASI_ASSETS_SEARCH = f'{EP_ASI_ASSETS}/_search'
 EP_ASI_EXPOSURES = f'{EP_ASI_PROJECTS}/{{}}/exposures'
 EP_ASI_EXPOSURES_BY_SIGNATURE = f'{EP_ASI_EXPOSURES}/{{}}'
 
+###############################################################################
+# Recorded Future Sandbox API Base URLs and Endpoints
+###############################################################################
+SANDBOX_API_VERSION = 'v0'
+
+# Sandbox base URLs by region
+SANDBOX_BASE_URLS = {
+    'eu': 'https://sandbox.recordedfuture.com/api/' + SANDBOX_API_VERSION,
+    'usa': 'https://us-sandbox.recordedfuture.com/api/' + SANDBOX_API_VERSION,
+    'apj': 'https://apj-sandbox.recordedfuture.com/api/' + SANDBOX_API_VERSION,
+    'public': 'https://tria.ge/api/' + SANDBOX_API_VERSION,
+    'private': 'https://private.tria.ge/api/' + SANDBOX_API_VERSION,
+}
+
+# Sandbox Sample Endpoints (using {base_url} as placeholder)
+EP_SANDBOX_SAMPLES = '{base_url}/samples'
+EP_SANDBOX_SAMPLES_ID = '{base_url}/samples/{sample_id}'
+EP_SANDBOX_SAMPLES_DOWNLOAD = '{base_url}/samples/{sample_id}/sample'
+EP_SANDBOX_SAMPLES_SUMMARY = '{base_url}/samples/{sample_id}/summary'
+EP_SANDBOX_SAMPLES_STATIC_REPORT = '{base_url}/samples/{sample_id}/reports/static'
+EP_SANDBOX_SAMPLES_OVERVIEW = '{base_url}/samples/{sample_id}/overview.json'
+EP_SANDBOX_SAMPLES_BEHAVIORAL = '{base_url}/samples/{sample_id}/{task_id}/report_triage.json'
+EP_SANDBOX_SAMPLES_PROFILE = '{base_url}/samples/{sample_id}/profile'
+EP_SANDBOX_SEARCH = '{base_url}/search'
+EP_SANDBOX_PROFILES = '{base_url}/profiles'
+EP_SANDBOX_PROFILES_ID = '{base_url}/profiles/{profile_id}'
+
 ################################################################################
 # Threat Map API Endpoints
 ################################################################################

{psengine-2.8.4 → psengine-2.9.0}/psengine/enrich/models/soar.py

@@ -38,7 +38,6 @@ class Evidence(RFBaseModel):
     timestamp: datetime
     description: str
     rule: str
-    # TODO - temp fix until API team fixes/confirms behaviour of sightings
     sightings: int = 0
     mitigation: str
     level: int

{psengine-2.8.4 → psengine-2.9.0}/psengine/helpers/helpers.py

@@ -486,13 +486,46 @@ class Validators:
     @staticmethod
     def convert_str_to_list(
         value: Annotated[str | list | None, Doc('String or list to convert.')],
-    ) -> Annotated[list | None, Doc('Converted list with None values removed.')]:
-        """Convert value from str to list and remove None values."""
-        if value:
-            value = value if isinstance(value, list) else [value]
-            return [v for v in value if v is not None]
+    ) -> Annotated[list | None, Doc('Converted list, stripped and cleaned.')]:
+        """Convert value from str to list, strip strings, drop None/empty strings.
+
+        Non-string items in a list are passed through unchanged so enum-typed
+        fields (e.g. `list[DomainTypes]`) keep their values.
+        """
+        if value is None:
+            return None
+        if isinstance(value, str):
+            value = value.strip()
+            return [value] if value else []
+        if isinstance(value, list):
+            result = []
+            for v in value:
+                if v is None:
+                    continue
+                if isinstance(v, str):
+                    stripped = v.strip()
+                    if not stripped:
+                        continue
+                    result.append(stripped)
+                else:
+                    result.append(v)
+            return result
         return value
 
+    @staticmethod
+    def none_to_empty_list(
+        value: Annotated[list | None, Doc('A list or `null`/empty value from the API.')],
+    ) -> Annotated[list, Doc('The value, or [] when it is None/empty.')]:
+        """Coerce a `null`/empty API value to a list so the field is always iterable."""
+        return value or []
+
+    @staticmethod
+    def empty_str_to_none(
+        value: Annotated[str | None, Doc('A value that may be an empty string.')],
+    ) -> Annotated[str | None, Doc('None if the value is an empty string, else the value.')]:
+        """Normalise an empty string (`''`) to None; pass everything else through."""
+        return None if value == '' else value
+
     @staticmethod
     def convert_relative_time(
         input_time: Annotated[str, Doc("Relative time string, e.g., '7d', '3h'.")],

{psengine-2.8.4 → psengine-2.9.0}/psengine/malware_intel/malware_intel.py

@@ -138,7 +138,7 @@ class AutoSigmaJobOut(RFBaseModel):
     end_date: str | None = None
     n_matched_hashes: int | None = None
     family_counts: dict[str, int] = {}
-    patterns: list[SigmaPatternItem] = Field(default_factory=list)
+    patterns: list[SigmaPatternItem] = []
 
     def __str__(self):
         created = self.created.strftime(TIMESTAMP_STR) if self.created else 'N/A'

{psengine-2.8.4 → psengine-2.9.0}/psengine/malware_intel/models.py

@@ -319,13 +319,13 @@ class YaraJob(RFBaseModel):
 class SigmaPatternStats(RFBaseModel):
     n_hashes: int | float | None = None
     overlap: int | float | None = None
-    family_counts: dict[str, int | float] = Field(default_factory=dict)
+    family_counts: dict[str, int | float] = {}
 
 
 class SigmaPatternItem(RFBaseModel):
     image: str | None = None
     cmd_pattern: str | None = None
-    matched_cmds: list[str] = Field(default_factory=list)
+    matched_cmds: list[str] = []
     stats: SigmaPatternStats | None = None
 
 

psengine-2.9.0/psengine/sandbox/__init__.py

@@ -0,0 +1,29 @@
+##################################### TERMS OF USE ###########################################
+# The following code is provided for demonstration purpose only, and should not be used      #
+# without independent verification. Recorded Future makes no representations or warranties,  #
+# express, implied, statutory, or otherwise, regarding any aspect of this code or of the     #
+# information it may retrieve, and provides it both strictly “as-is” and without assuming    #
+# responsibility for any information it may retrieve. Recorded Future shall not be liable    #
+# for, and you assume all risk of using, the foregoing. By using this code, Customer         #
+# represents that it is solely responsible for having all necessary licenses, permissions,   #
+# rights, and/or consents to connect to third party APIs, and that it is solely responsible  #
+# for having all necessary licenses, permissions, rights, and/or consents to any data        #
+# accessed from any third party API.                                                         #
+##############################################################################################
+
+from .sandbox import (
+    BehavioralReport,
+    BehavioralReportFailure,
+    BehavioralReportsResult,
+    OverviewReport,
+    Profile,
+    ProfileDeleteOut,
+    ProfileOptions,
+    ProfileUpdateOut,
+    Sample,
+    SampleDeleteOut,
+    SampleProfileOut,
+    SampleTasks,
+    StaticAnalysisReport,
+)
+from .sandbox_mgr import SandboxChoice, SandboxMgr, SandboxSubset

psengine-2.9.0/psengine/sandbox/client.py

@@ -0,0 +1,225 @@
+##################################### TERMS OF USE ###########################################
+# The following code is provided for demonstration purpose only, and should not be used      #
+# without independent verification. Recorded Future makes no representations or warranties,  #
+# express, implied, statutory, or otherwise, regarding any aspect of this code or of the     #
+# information it may retrieve, and provides it both strictly “as-is” and without assuming    #
+# responsibility for any information it may retrieve. Recorded Future shall not be liable    #
+# for, and you assume all risk of using, the foregoing. By using this code, Customer         #
+# represents that it is solely responsible for having all necessary licenses, permissions,   #
+# rights, and/or consents to connect to third party APIs, and that it is solely responsible  #
+# for having all necessary licenses, permissions, rights, and/or consents to any data        #
+# accessed from any third party API.                                                         #
+##############################################################################################
+
+import re
+from typing import Annotated
+
+from pydantic import Field, validate_call
+from requests.exceptions import JSONDecodeError
+from requests.models import Response
+from typing_extensions import Doc
+
+from ..base_http_client import BaseHTTPClient
+from ..constants import SANDBOX_TOKEN_VALIDATION_REGEX
+from ..helpers import debug_call
+from .constants import DEFAULT_PAGE_LIMIT, MAXIMUM_SAMPLES, SAMPLES_PER_PAGE
+
+
+@validate_call
+def is_api_token_format_valid(
+    token: Annotated[str, Doc('A Recorded Future API token.')],
+) -> Annotated[bool, Doc('True if the token format is valid, False otherwise.')]:
+    """Check if the token format is valid.
+
+    The function performs a simple regex check but does not validate the token against the API.
+    """
+    return re.fullmatch(SANDBOX_TOKEN_VALIDATION_REGEX, token) is not None
+
+
+class SandboxClient(BaseHTTPClient):
+    """Recorded Future Sandbox API client."""
+
+    def __init__(
+        self,
+        api_token: Annotated[
+            str | None,
+            Doc('The Sandbox API token. Defaults to RF_SANDBOX_TOKEN environment variable.'),
+        ] = None,
+        http_proxy: Annotated[str, Doc('An HTTP proxy URL.')] = None,
+        https_proxy: Annotated[str, Doc('An HTTPS proxy URL.')] = None,
+        verify: Annotated[
+            str | bool,
+            Doc('An SSL verification flag or path to CA bundle.'),
+        ] = None,
+        auth: Annotated[tuple[str, str], Doc('Basic Auth credentials.')] = None,
+        cert: Annotated[str | tuple[str, str] | None, Doc('Client certificates.')] = None,
+        timeout: Annotated[int, Doc('A request timeout. Defaults to 120.')] = None,
+        retries: Annotated[int, Doc('A number of retries. Defaults to 5.')] = None,
+        backoff_factor: Annotated[int, Doc('A backoff factor. Defaults to 1.')] = None,
+        status_forcelist: Annotated[
+            list, Doc('A list of status codes to force a retry. Defaults to [502, 503, 504].')
+        ] = None,
+        pool_max_size: Annotated[
+            int, Doc('The maximum number of connections in the pool. Defaults to 120.')
+        ] = None,
+    ):
+        """Recorded Future HTTP API client."""
+        super().__init__(
+            http_proxy=http_proxy,
+            https_proxy=https_proxy,
+            verify=verify,
+            auth=auth,
+            cert=cert,
+            timeout=timeout,
+            retries=retries,
+            backoff_factor=backoff_factor,
+            status_forcelist=status_forcelist,
+            pool_max_size=pool_max_size,
+        )
+
+        self._api_token = api_token or self.config.sandbox_token.get_secret_value()
+        if not self._api_token:
+            raise ValueError('Missing Recorded Future Sandbox API token.')
+        if not is_api_token_format_valid(self._api_token):
+            raise ValueError(
+                f'Invalid Sandbox API token: must match regex {SANDBOX_TOKEN_VALIDATION_REGEX}'
+            )
+
+    @debug_call
+    @validate_call
+    def request(
+        self,
+        method: Annotated[
+            str, Doc('An HTTP method, one of GET, PUT, POST, DELETE, HEAD, OPTIONS, PATCH.')
+        ],
+        url: Annotated[str, Doc('A URL to make the request to.')],
+        data: Annotated[dict | list[dict] | bytes | None, Doc('A request body.')] = None,
+        *,
+        params: Annotated[dict | None, Doc('HTTP query parameters.')] = None,
+        headers: Annotated[
+            dict | None,
+            Doc('If specified, it overrides default headers and does not set the token.'),
+        ] = None,
+        content_type_header: Annotated[
+            str | None, Doc('Content-Type header value.')
+        ] = 'application/json',
+        **kwargs,
+    ) -> Annotated[Response, Doc('A requests.Response object.')]:
+        """Perform an HTTP request.
+
+        Raises:
+            ValidationError: If method is not one of GET, PUT, POST, DELETE, HEAD, OPTIONS, PATCH.
+        """
+        headers = headers or self._prepare_headers(content_type_header)
+
+        return self.call(
+            method=method,
+            url=url,
+            headers=headers,
+            data=data,
+            params=params,
+            **kwargs,
+        )
+
+    @debug_call
+    @validate_call
+    def request_paged(
+        self,
+        method: Annotated[
+            str, Doc('An HTTP method, one of GET, PUT, POST, DELETE, HEAD, OPTIONS, PATCH.')
+        ],
+        url: Annotated[str, Doc('A URL to make the request to.')],
+        data: Annotated[dict | list[dict] | bytes | None, Doc('A request body.')] = None,
+        *,
+        params: Annotated[dict | None, Doc('HTTP query parameters.')] = None,
+        headers: Annotated[
+            dict | None,
+            Doc('If specified, it overrides default headers and does not set the token.'),
+        ] = None,
+        content_type_header: Annotated[
+            str | None, Doc('Content-Type header value.')
+        ] = 'application/json',
+        max_results: int = DEFAULT_PAGE_LIMIT,
+        results_per_page: Annotated[
+            int | None, Doc('The number of samples per page for pagination.')
+        ] = Field(ge=1, le=MAXIMUM_SAMPLES, default=SAMPLES_PER_PAGE),
+        **kwargs,
+    ) -> Annotated[list, Doc('Result rows accumulated across all fetched pages.')]:
+        """Perform a paged HTTP request, following `next` offsets until `max_results` is reached.
+
+        Raises:
+            ValidationError: If method is not one of GET, PUT, POST, DELETE, HEAD, OPTIONS, PATCH.
+        """
+        headers = headers or self._prepare_headers(content_type_header)
+        # Copy so our `limit`/`offset` bookkeeping never mutates the caller's dict.
+        params = dict(params or {})
+        all_results: list = []
+
+        # Trim `limit` to remaining headroom so the last page doesn't overfetch.
+        params['limit'] = min(results_per_page, max_results - len(all_results))
+        response = self.request(
+            method=method,
+            url=url,
+            headers=headers,
+            data=data,
+            params=params,
+            **kwargs,
+        )
+
+        try:
+            json_response = response.json()
+        except JSONDecodeError:
+            self.log.debug(f'Paged request does not contain valid JSON:\n{response.text}')
+            raise
+
+        try:
+            page = json_response['data'] or []
+        except KeyError:
+            self.log.debug(f'Paged request does not contain `data` JSON key:\n{response.text}')
+            raise
+
+        all_results.extend(page)
+        offset = json_response.get('next')
+        prev_offset = None
+
+        while offset and offset != prev_offset and len(all_results) < max_results:
+            params['offset'] = offset
+            params['limit'] = min(results_per_page, max_results - len(all_results))
+            response = self.request(
+                method=method,
+                url=url,
+                headers=headers,
+                data=data,
+                params=params,
+                **kwargs,
+            )
+            json_response = response.json()
+            page = json_response.get('data', [])
+
+            if not page:
+                # The last page is always empty
+                self.log.debug('Paged request returned an empty `data` page; stopping.')
+                break
+
+            all_results.extend(page)
+            prev_offset = offset
+            offset = json_response.get('next')
+
+        return all_results[:max_results]
+
+    def _prepare_headers(self, content_type_header: str | None = 'application/json'):
+        user_agent = self._get_user_agent_header()
+        headers = {
+            'User-Agent': user_agent,
+            'accept': 'application/json',
+        }
+        # `content_type_header=None` omits Content-Type so `requests` can set the
+        # multipart/form-data boundary itself (used by multipart file uploads).
+        if content_type_header is not None:
+            headers['Content-Type'] = content_type_header
+        if self._api_token:
+            headers['Authorization'] = f'Bearer {self._api_token}'
+        else:
+            # In theory should never happen, but just in case
+            self.log.warning('Request being made with no Sandbox API key set')
+        return headers

psengine-2.9.0/psengine/sandbox/constants.py

@@ -0,0 +1,25 @@
+##################################### TERMS OF USE ###########################################
+# The following code is provided for demonstration purpose only, and should not be used      #
+# without independent verification. Recorded Future makes no representations or warranties,  #
+# express, implied, statutory, or otherwise, regarding any aspect of this code or of the     #
+# information it may retrieve, and provides it both strictly “as-is” and without assuming    #
+# responsibility for any information it may retrieve. Recorded Future shall not be liable    #
+# for, and you assume all risk of using, the foregoing. By using this code, Customer         #
+# represents that it is solely responsible for having all necessary licenses, permissions,   #
+# rights, and/or consents to connect to third party APIs, and that it is solely responsible  #
+# for having all necessary licenses, permissions, rights, and/or consents to any data        #
+# accessed from any third party API.                                                         #
+##############################################################################################
+
+DEFAULT_PAGE_LIMIT = 10
+SAMPLES_PER_PAGE = 50
+MAXIMUM_SAMPLES = 200
+
+STATIC_REPORT_WAIT_INTERVAL_SECONDS = 20
+STATIC_REPORT_WAIT_DEFAULT_TIMEOUT_SECONDS = 600
+
+BEHAVIORAL_REPORT_WAIT_INTERVAL_SECONDS = 20
+BEHAVIORAL_REPORT_WAIT_DEFAULT_TIMEOUT_SECONDS = 1800
+
+OVERVIEW_REPORT_WAIT_INTERVAL_SECONDS = 20
+OVERVIEW_REPORT_WAIT_DEFAULT_TIMEOUT_SECONDS = 1800