splunk-soar-sdk 2.3.6__py3-none-any.whl → 3.0.0__py3-none-any.whl

soar_sdk/decorators/view_handler.py

@@ -1,6 +1,7 @@
 import inspect
 from functools import wraps
-from typing import Callable, Optional, Any
+from typing import Any
+from collections.abc import Callable
 
 from soar_sdk.action_results import ActionResult
 from soar_sdk.views.component_registry import COMPONENT_REGISTRY
@@ -10,9 +11,7 @@ from soar_sdk.views.view_parser import ViewFunctionParser
 from soar_sdk.views.template_renderer import (
     get_template_renderer,
     get_templates_dir,
-    BASE_TEMPLATE_PATH,
 )
-from soar_sdk.compat import remove_when_soar_newer_than
 
 from typing import TYPE_CHECKING
 
@@ -23,15 +22,15 @@ if TYPE_CHECKING:
 class ViewHandlerDecorator:
     """Class-based decorator for view handler functionality."""
 
-    def __init__(self, app: "App", *, template: Optional[str] = None) -> None:
+    def __init__(self, app: "App", *, template: str | None = None) -> None:
         self.app = app
         self.template = template
 
     @staticmethod
     def _validate_view_function_signature(
         function: Callable,
-        template: Optional[str] = None,
-        component_type: Optional[str] = None,
+        template: str | None = None,
+        component_type: str | None = None,
     ) -> None:
         """Validate that the function signature is compatible with view handlers."""
         signature = inspect.signature(function)
@@ -92,14 +91,9 @@ class ViewHandlerDecorator:
             **kwargs: Any,  # noqa: ANN401
         ) -> str:
             def handle_html_output(html: str) -> str:
-                remove_when_soar_newer_than(
-                    "6.4.1", "SOAR now fully supports prerendering views"
-                )
-                if context.get("accepts_prerender"):
-                    context["prerender"] = True
-                    return html
-                context["html_content"] = html
-                return BASE_TEMPLATE_PATH
+                # SOAR 7.0+ fully supports prerendering
+                context["prerender"] = True
+                return html
 
             def render_with_error_handling(
                 render_func: Callable[[], str], error_type: str, target_name: str
@@ -121,12 +115,12 @@ class ViewHandlerDecorator:
                 parser: ViewFunctionParser = ViewFunctionParser(function)
 
                 # Parse context to ViewContext (coming from app_interface)
-                parsed_context = ViewContext.parse_obj(context)
+                parsed_context = ViewContext.model_validate(context)
 
                 # Parse all_app_runs to AllAppRuns (coming from app_interface)
                 parsed_all_app_runs: AllAppRuns = []
                 for app_run_data, action_results in all_app_runs:
-                    result_summary = ResultSummary.parse_obj(app_run_data)
+                    result_summary = ResultSummary.model_validate(app_run_data)
                     parsed_all_app_runs.append((result_summary, action_results))
 
                 result = parser.execute(
@@ -158,7 +152,7 @@ class ViewHandlerDecorator:
 
             # Reusable component
             if isinstance(result, BaseModel):
-                result_dict = result.dict()
+                result_dict = result.model_dump()
                 template_name = f"components/{component_type}.html"
                 err_msg = "Component Rendering Failed"
                 err_context = f"component '{component_type}'"

soar_sdk/decorators/webhook.py

@@ -1,6 +1,5 @@
 import inspect
 from functools import wraps
-from typing import Optional
 from pathlib import Path
 
 from soar_sdk.cli.path_utils import relative_to_cwd
@@ -19,7 +18,7 @@ class WebhookDecorator:
     """Class-based decorator for webhook functionality."""
 
     def __init__(
-        self, app: "App", url_pattern: str, allowed_methods: Optional[list[str]] = None
+        self, app: "App", url_pattern: str, allowed_methods: list[str] | None = None
     ) -> None:
         self.app = app
         self.url_pattern = url_pattern

soar_sdk/exceptions.py

@@ -1,10 +1,7 @@
-from typing import Optional
-
-
 class ActionFailure(Exception):
     """Exception raised when an action fails to execute successfully."""
 
-    def __init__(self, message: str, action_name: Optional[str] = None) -> None:
+    def __init__(self, message: str, action_name: str | None = None) -> None:
         self.message = message
         self.action_name = action_name
         super().__init__(self.message)

soar_sdk/field_utils.py

@@ -0,0 +1,8 @@
+from typing import Any
+
+
+def parse_json_schema_extra(json_schema_extra: Any) -> dict[str, Any]:  # noqa: ANN401
+    """Extract json_schema_extra as a dict, handling both dict and callable forms."""
+    if callable(json_schema_extra):
+        return {}
+    return json_schema_extra or {}

soar_sdk/input_spec.py

@@ -1,6 +1,6 @@
 from uuid import uuid4
-from pydantic import BaseModel, Field, validator
-from typing import Literal, Optional, Any
+from pydantic import BaseModel, Field, field_validator, ConfigDict
+from typing import Literal, Any
 import random
 
 
@@ -20,20 +20,18 @@ class AppConfig(BaseModel):
 
     app_version: str
     directory: str
-    ingest: Optional[IngestConfig] = None
+    ingest: IngestConfig | None = None
     main_module: str
     # TODO: The platform should deprecate this unused field
     appname: Literal["-"] = "-"
 
     # NOTE: Inputs will intermix the keys of the asset config with the keys here
-    class Config:
-        """Configuration for the AppConfig model."""
-
-        extra = "allow"
+    model_config = ConfigDict(extra="allow")
 
     def get_asset_config(self) -> dict[str, Any]:
         """Get the asset configuration from the app config."""
-        return {k: v for k, v in self.__dict__.items() if k not in self.__fields__}
+        # In Pydantic v2 extra fields are stored in __pydantic_extra__
+        return dict(self.__pydantic_extra__) if self.__pydantic_extra__ else {}
 
 
 class EnvironmentVariable(BaseModel):
@@ -65,10 +63,7 @@ class ActionParameter(BaseModel):
     # context: Optional[ParameterContext] = None # noqa: ERA001
 
     # Additional keys are action-specific and not predictable here.
-    class Config:
-        """Configuration for the ActionParameter model."""
-
-        extra = "allow"
+    model_config = ConfigDict(extra="allow")
 
 
 class SoarAuth(BaseModel):
@@ -78,7 +73,8 @@ class SoarAuth(BaseModel):
     username: str
     password: str
 
-    @validator("phantom_url")
+    @field_validator("phantom_url")
+    @classmethod
     def validate_phantom_url(cls, value: str) -> str:
         """Ensure the URL starts with http:// or https://."""
         return (
@@ -137,9 +133,9 @@ class InputSpecification(BaseModel):
     }
     """
 
-    action: Optional[str] = None
+    action: str | None = None
     action_run_id: int = Field(default_factory=id_factory)
-    app_config: Optional[Any] = None
+    app_config: Any | None = None
     asset_id: str = Field(default_factory=lambda: str(id_factory()))
     config: AppConfig
     connector_run_id: int = Field(default_factory=id_factory)
@@ -148,6 +144,6 @@ class InputSpecification(BaseModel):
     dec_key: str = Field(default_factory=lambda: str(id_factory()))
     environment_variables: dict[str, EnvironmentVariable] = Field(default_factory=dict)
     identifier: str
-    parameters: list[ActionParameter] = Field(default_factory=lambda: [{}])
+    parameters: list[ActionParameter] = Field(default_factory=list)
     user_session_token: str = ""
-    soar_auth: Optional[SoarAuth] = None
+    soar_auth: SoarAuth | None = None

soar_sdk/logging.py

@@ -4,7 +4,7 @@ from soar_sdk.colors import ANSIColor
 from soar_sdk.shims.phantom.install_info import is_soar_available, get_product_version
 from soar_sdk.shims.phantom.ph_ipc import ph_ipc
 from packaging.version import Version
-from typing import Any, Optional
+from typing import Any
 from soar_sdk.compat import remove_when_soar_newer_than
 
 PROGRESS_LEVEL = 25
@@ -38,7 +38,7 @@ class SOARHandler(logging.Handler):
         self,
     ) -> None:
         super().__init__()
-        self.__handle: Optional[int] = None
+        self.__handle: int | None = None
 
     def emit(self, record: logging.LogRecord) -> None:
         is_new_soar = Version(get_product_version()) >= Version("7.0.0")
@@ -79,7 +79,7 @@ class SOARHandler(logging.Handler):
         except Exception:
             self.handleError(record)
 
-    def set_handle(self, handle: Optional[int]) -> None:
+    def set_handle(self, handle: int | None) -> None:
         """Set the action handle for the SOAR client."""
         self.__handle = handle
 

soar_sdk/meta/actions.py

@@ -1,9 +1,8 @@
-from typing import Any, Type, Optional, Callable  # noqa: UP035
+from typing import Any, Type, Callable  # noqa: UP035
 
 from pydantic import BaseModel, Field
 
 from soar_sdk.cli.manifests.serializers import ParamsSerializer, OutputsSerializer
-from soar_sdk.compat import remove_when_soar_newer_than
 from soar_sdk.params import Params
 from soar_sdk.action_results import ActionOutput
 
@@ -20,14 +19,14 @@ class ActionMeta(BaseModel):
     verbose: str = ""
     parameters: Type[Params] = Field(default=Params)  # noqa: UP006
     output: Type[ActionOutput] = Field(default=ActionOutput)  # noqa: UP006
-    render_as: Optional[str] = None
-    view_handler: Optional[Callable] = None
-    summary_type: Optional[Type[ActionOutput]] = Field(default=None, exclude=True)  # noqa: UP006
+    render_as: str | None = None
+    view_handler: Callable | None = None
+    summary_type: Type[ActionOutput] | None = Field(default=None, exclude=True)  # noqa: UP006
     enable_concurrency_lock: bool = False
 
-    def dict(self, *args: Any, **kwargs: Any) -> dict[str, Any]:  # noqa: ANN401
+    def model_dump(self, *args: Any, **kwargs: Any) -> dict[str, Any]:  # noqa: ANN401
         """Serializes the action metadata to a dictionary."""
-        data = super().dict(*args, **kwargs)
+        data = super().model_dump(*args, **kwargs)
         data["parameters"] = ParamsSerializer.serialize_fields_info(self.parameters)
         data["output"] = OutputsSerializer.serialize_datapaths(
             self.parameters, self.output, summary_class=self.summary_type
@@ -40,21 +39,6 @@ class ActionMeta(BaseModel):
                 "type": self.render_as,
             }
 
-        if self.view_handler:
-            remove_when_soar_newer_than("6.4.1")
-            # Get the module path and function name for the view
-            module = self.view_handler.__module__
-            # Convert module path from dot notation to the expected format
-            # e.g., "example_app.src.app" -> "src.app"
-            module_parts = module.split(".")
-            if len(module_parts) > 1:
-                # Remove the package name (first part) to get relative module path
-                relative_module = ".".join(module_parts[1:])
-            else:
-                relative_module = module
-
-            data["render"]["view"] = f"{relative_module}.{self.view_handler.__name__}"
-
         # Remove view_handler from the output since in render
         data.pop("view_handler", None)
         data.pop("render_as", None)

soar_sdk/meta/app.py

@@ -1,5 +1,4 @@
-from pydantic import BaseModel, Field, validator
-from typing import Optional, Union
+from pydantic import BaseModel, Field, field_validator
 
 from soar_sdk.asset import AssetFieldSpecification
 from soar_sdk.compat import PythonVersion
@@ -42,13 +41,14 @@ class AppMeta(BaseModel):
     configuration: dict[str, AssetFieldSpecification] = Field(default_factory=dict)
     actions: list[ActionMeta] = Field(default_factory=list)
 
-    pip39_dependencies: DependencyList = Field(default_factory=DependencyList)
     pip313_dependencies: DependencyList = Field(default_factory=DependencyList)
+    pip314_dependencies: DependencyList = Field(default_factory=DependencyList)
 
-    webhook: Optional[WebhookMeta]
+    webhook: WebhookMeta | None = None
 
-    @validator("python_version", pre=True)
-    def convert_python_version_to_csv(cls, v: Union[list, str]) -> str:
+    @field_validator("python_version", mode="before")
+    @classmethod
+    def convert_python_version_to_csv(cls, v: list | str) -> str:
         """Converts python_version to a comma-separated string if it's a list and validates versions."""
         if isinstance(v, list):
             # Validate each version in the list and convert to CSV
@@ -64,4 +64,7 @@ class AppMeta(BaseModel):
 
     def to_json_manifest(self) -> dict:
         """Converts the AppMeta instance to a JSON-compatible dictionary."""
-        return self.dict(exclude_none=True)
+        data = self.model_dump(exclude_none=True)
+        # In Pydantic v2 nested model_dump() overrides aren't automatically called
+        data["actions"] = [action.model_dump() for action in self.actions]
+        return data

soar_sdk/meta/dependencies.py

@@ -1,3 +1,4 @@
+import functools
 import io
 import os
 from pathlib import Path
@@ -6,7 +7,7 @@ import tarfile
 from tempfile import TemporaryDirectory
 import build
 
-from typing import Optional
+from typing import ClassVar
 from collections.abc import Mapping, Sequence, AsyncGenerator
 from pydantic import BaseModel, Field
 
@@ -61,22 +62,23 @@ DEPENDENCIES_TO_BUILD = {
 class UvWheel(BaseModel):
     """Represents a Python wheel file with metadata and methods to fetch and validate it."""
 
-    url: str
+    url: str | None = None
+    filename: str | None = None
     hash: str
-    size: Optional[int] = None
+    size: int | None = None
 
     # The wheel file name is specified by PEP427. It's either a 5- or 6-tuple:
     # {distribution}-{version}(-{build tag})?-{python tag}-{abi tag}-{platform tag}.whl
     # We can parse this to determine which configurations it supports.
-    @property
+    @functools.cached_property
     def basename(self) -> str:
         """The base name of the wheel file."""
-        remove_when_soar_newer_than(
-            "6.4.0",
-            "We should be able to adopt pydantic 2 now, and turn this into a cached property.",
-        )
-        filename = self.url.split("/")[-1]
-        return filename.removesuffix(".whl")
+        if self.filename:
+            return self.filename.removesuffix(".whl")
+        if self.url:
+            filename = self.url.split("/")[-1]
+            return filename.removesuffix(".whl")
+        raise ValueError("UvWheel must have either url or filename")
 
     @property
     def distribution(self) -> str:
@@ -89,7 +91,7 @@ class UvWheel(BaseModel):
         return self.basename.split("-")[1]
 
     @property
-    def build_tag(self) -> Optional[str]:
+    def build_tag(self) -> str | None:
         """An optional build tag for the wheel."""
         split = self.basename.split("-")
         if len(split) == 6:
@@ -122,6 +124,10 @@ class UvWheel(BaseModel):
 
     async def fetch(self) -> bytes:
         """Download the wheel file from the specified URL."""
+        if self.url is None:
+            raise ValueError(
+                f"Cannot fetch wheel {self.filename or 'unknown'}: no URL provided (local file reference?)"
+            )
         async with httpx.AsyncClient() as client:
             response = await client.get(self.url, timeout=10)
             response.raise_for_status()
@@ -135,7 +141,7 @@ class UvSourceDistribution(BaseModel):
 
     url: str
     hash: str
-    size: Optional[int] = None
+    size: int | None = None
 
     def validate_hash(self, sdist: bytes) -> None:
         """Validate the hash of the downloaded sdist against the expected hash."""
@@ -158,8 +164,8 @@ class UvSourceDistribution(BaseModel):
     @staticmethod
     def _builder_runner(
         cmd: Sequence[str],
-        cwd: Optional[str] = None,
-        extra_environ: Optional[Mapping[str, str]] = None,
+        cwd: str | None = None,
+        extra_environ: Mapping[str, str] | None = None,
     ) -> None:
         """Run a command in a subprocess and return its exit code, stdout, and stderr."""
         proc = subprocess.run(  # noqa: S603
@@ -191,13 +197,13 @@ class DependencyWheel(BaseModel):
 
     module: str
     input_file: str = ""
-    input_file_aarch64: Optional[str] = None
+    input_file_aarch64: str | None = None
 
-    wheel: Optional[UvWheel] = Field(exclude=True, default=None)
-    wheel_aarch64: Optional[UvWheel] = Field(exclude=True, default=None)
-    sdist: Optional[UvSourceDistribution] = Field(exclude=True, default=None)
+    wheel: UvWheel | None = Field(exclude=True, default=None)
+    wheel_aarch64: UvWheel | None = Field(exclude=True, default=None)
+    sdist: UvSourceDistribution | None = Field(exclude=True, default=None)
 
-    async def collect_wheels(self) -> AsyncGenerator[tuple[str, bytes], None]:
+    async def collect_wheels(self) -> AsyncGenerator[tuple[str, bytes]]:
         """Collect a list of wheel files to fetch for this dependency across all platforms."""
         if self.wheel is None and self.sdist is not None:
             logger.info(f"Building sdist for {self.input_file}")
@@ -229,7 +235,7 @@ class DependencyWheel(BaseModel):
 
     def __hash__(self) -> int:
         """Compute a hash for the dependency wheel so we can dedupe wheel files in a later step."""
-        return hash((type(self), *tuple(self.dict().items())))
+        return hash((type(self), *tuple(self.model_dump().items())))
 
 
 class DependencyList(BaseModel):
@@ -254,7 +260,7 @@ class UvPackage(BaseModel):
         default_factory=dict, alias="optional-dependencies"
     )
     wheels: list[UvWheel] = []
-    sdist: Optional[UvSourceDistribution] = None
+    sdist: UvSourceDistribution | None = None
 
     def _find_wheel(
         self,
@@ -287,21 +293,21 @@ class UvPackage(BaseModel):
             f"Could not find a suitable wheel for {self.name=}, {self.version=}, {abi_precedence=}, {python_precedence=}, {platform_precedence=}"
         )
 
-    _manylinux_precedence = [
+    _manylinux_precedence: ClassVar[list[str]] = [
         "_2_28",  # glibc 2.28, latest stable version, supports Ubuntu 18.10+ and RHEL/Oracle 8+
         "_2_17",  # glibc 2.17, LTS-ish, supports Ubuntu 13.10+ and RHEL/Oracle 7+
         "2014",  # Synonym for _2_17
     ]
-    platform_precedence_x86_64 = [
+    platform_precedence_x86_64: ClassVar[list[str]] = [
         *[f"manylinux{version}_x86_64" for version in _manylinux_precedence],
         "any",
     ]
-    platform_precedence_aarch64 = [
+    platform_precedence_aarch64: ClassVar[list[str]] = [
         *[f"manylinux{version}_aarch64" for version in _manylinux_precedence],
         "any",
     ]
 
-    build_from_source_warning_triggered = False
+    build_from_source_warning_triggered: bool = False
 
     def _resolve(
         self, abi_precedence: list[str], python_precedence: list[str]
@@ -348,32 +354,32 @@ class UvPackage(BaseModel):
 
         return wheel
 
-    def resolve_py39(self) -> DependencyWheel:
-        """Resolve the dependency wheel for Python 3.9."""
+    def resolve_py313(self) -> DependencyWheel:
+        """Resolve the dependency wheel for Python 3.13."""
         return self._resolve(
             abi_precedence=[
-                "cp39",  # Python 3.9-specific ABI
+                "cp313",  # Python 3.13-specific ABI
                 "abi3",  # Python 3 stable ABI
                 "none",  # Source wheels -- no ABI
             ],
             python_precedence=[
-                "cp39",  # Binary wheel for Python 3.9
-                "pp39",  # Source wheel for Python 3.9
+                "cp313",  # Binary wheel for Python 3.13
+                "pp313",  # Source wheel for Python 3.13
                 "py3",  # Source wheel for any Python 3.x
             ],
         )
 
-    def resolve_py313(self) -> DependencyWheel:
-        """Resolve the dependency wheel for Python 3.13."""
+    def resolve_py314(self) -> DependencyWheel:
+        """Resolve the dependency wheel for Python 3.14."""
         return self._resolve(
             abi_precedence=[
-                "cp313",  # Python 3.13-specific ABI
+                "cp314",  # Python 3.14-specific ABI
                 "abi3",  # Python 3 stable ABI
                 "none",  # Source wheels -- no ABI
             ],
             python_precedence=[
-                "cp313",  # Binary wheel for Python 3.13
-                "pp313",  # Source wheel for Python 3.13
+                "cp314",  # Binary wheel for Python 3.14
+                "pp314",  # Source wheel for Python 3.14
                 "py3",  # Source wheel for any Python 3.x
             ],
         )
@@ -446,21 +452,21 @@ class UvLock(BaseModel):
         packages: list[UvPackage],
     ) -> tuple[DependencyList, DependencyList]:
         """Resolve the dependencies for the given packages."""
-        py39_wheels: list[DependencyWheel] = []
         py313_wheels: list[DependencyWheel] = []
+        py314_wheels: list[DependencyWheel] = []
 
         for package in packages:
-            wheel_39 = package.resolve_py39()
             wheel_313 = package.resolve_py313()
+            wheel_314 = package.resolve_py314()
 
-            if wheel_39 == wheel_313:
-                wheel_39.add_platform_prefix("shared")
+            if wheel_313 == wheel_314:
                 wheel_313.add_platform_prefix("shared")
+                wheel_314.add_platform_prefix("shared")
             else:
-                wheel_39.add_platform_prefix("python39")
                 wheel_313.add_platform_prefix("python313")
+                wheel_314.add_platform_prefix("python314")
 
-            py39_wheels.append(wheel_39)
             py313_wheels.append(wheel_313)
+            py314_wheels.append(wheel_314)
 
-        return DependencyList(wheel=py39_wheels), DependencyList(wheel=py313_wheels)
+        return DependencyList(wheel=py313_wheels), DependencyList(wheel=py314_wheels)

soar_sdk/meta/webhooks.py

@@ -1,6 +1,5 @@
-from pydantic import BaseModel, Field, validator
+from pydantic import BaseModel, Field, field_validator
 from ipaddress import ip_network
-from typing import Optional
 
 
 class WebhookRouteMeta(BaseModel):
@@ -8,25 +7,26 @@ class WebhookRouteMeta(BaseModel):
 
     url_pattern: str
     allowed_methods: list[str] = Field(default_factory=lambda: ["GET", "POST"])
-    declaration_path: Optional[str] = None
-    declaration_lineno: Optional[int] = None
+    declaration_path: str | None = None
+    declaration_lineno: int | None = None
 
 
 class WebhookMeta(BaseModel):
     """Metadata for a complex webhook definition which may contain multiple routes."""
 
-    handler: Optional[str]
+    handler: str | None
     requires_auth: bool = True
     allowed_headers: list[str] = Field(default_factory=list)
     ip_allowlist: list[str] = Field(default_factory=lambda: ["0.0.0.0/0", "::/0"])
     routes: list[WebhookRouteMeta] = Field(default_factory=list)
 
-    @validator("ip_allowlist", each_item=True)
-    def validate_ip_allowlist(cls, value: str) -> str:
+    @field_validator("ip_allowlist")
+    @classmethod
+    def validate_ip_allowlist(cls, value: list[str]) -> list[str]:
         """Enforces all values of the 'ip_allowlist' field are valid IPv4 or IPv6 CIDRs."""
-        try:
-            ip_network(value)
-        except ValueError as e:
-            raise ValueError(f"{value} is not a valid IPv4 or IPv6 CIDR") from e
-
+        for item in value:
+            try:
+                ip_network(item)
+            except ValueError as e:
+                raise ValueError(f"{item} is not a valid IPv4 or IPv6 CIDR") from e
         return value

soar_sdk/models/artifact.py

@@ -1,5 +1,5 @@
-from typing import Optional, Any, Union
-from pydantic import BaseModel
+from typing import Any
+from pydantic import BaseModel, ConfigDict
 
 
 class Artifact(BaseModel):
@@ -8,29 +8,26 @@ class Artifact(BaseModel):
     This class allows users to create artifacts when yielding from an 'on poll' action.
     """
 
-    class Config:
-        """Pydantic config. Unknown keys are disallowed in this model."""
+    model_config = ConfigDict(extra="forbid")
 
-        extra = "forbid"
-
-    name: Optional[str] = None
-    label: Optional[str] = None
-    description: Optional[str] = None
-    type: Optional[str] = None
-    severity: Optional[str] = None
-    source_data_identifier: Optional[str] = None
-    container_id: Optional[int] = None
-    data: Optional[dict[str, Any]] = None
+    name: str | None = None
+    label: str | None = None
+    description: str | None = None
+    type: str | None = None
+    severity: str | None = None
+    source_data_identifier: str | None = None
+    container_id: int | None = None
+    data: dict[str, Any] | None = None
     run_automation: bool = False
-    owner_id: Optional[Union[int, str]] = None
-    cef: Optional[dict[str, Any]] = None
-    cef_types: Optional[dict[str, list[str]]] = None
-    ingest_app_id: Optional[Union[int, str]] = None
-    tags: Optional[Union[list[str], str]] = None
-    start_time: Optional[str] = None
-    end_time: Optional[str] = None
-    kill_chain: Optional[str] = None
+    owner_id: int | str | None = None
+    cef: dict[str, Any] | None = None
+    cef_types: dict[str, list[str]] | None = None
+    ingest_app_id: int | str | None = None
+    tags: list[str] | str | None = None
+    start_time: str | None = None
+    end_time: str | None = None
+    kill_chain: str | None = None
 
     def to_dict(self) -> dict[str, Any]:
         """Convert the artifact to a dictionary (needed for save_artifact)."""
-        return self.dict(exclude_none=True)
+        return self.model_dump(exclude_none=True)