splunk-soar-sdk 2.3.7__tar.gz → 3.1.0__tar.gz

{splunk_soar_sdk-2.3.7 → splunk_soar_sdk-3.1.0}/.github/workflows/code_quality.yml

@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: [3.9, 3.13]
+        python-version: [3.13, 3.14]
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -46,7 +46,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: [3.9, 3.13]
+        python-version: [3.13, 3.14]
     steps:
       - name: Checkout code
         uses: actions/checkout@v4

{splunk_soar_sdk-2.3.7 → splunk_soar_sdk-3.1.0}/.pre-commit-config.yaml

@@ -61,5 +61,5 @@ repos:
     hooks:
       - id: commitlint
         stages: [commit-msg]
-        language_version: '22.15.0'
+        language_version: system
         additional_dependencies: ['@commitlint/config-conventional']

{splunk_soar_sdk-2.3.7 → splunk_soar_sdk-3.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: splunk-soar-sdk
-Version: 2.3.7
+Version: 3.1.0
 Summary: The official framework for developing and testing Splunk SOAR Apps
 Project-URL: Homepage, https://github.com/phantomcyber/splunk-soar-sdk
 Project-URL: Documentation, https://github.com/phantomcyber/splunk-soar-sdk
@@ -16,19 +16,18 @@ Classifier: Natural Language :: English
 Classifier: Programming Language :: Python :: 3
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Typing :: Typed
-Requires-Python: <3.14,>=3.9
-Requires-Dist: beautifulsoup4==4.10.0
+Requires-Python: <=3.14,>=3.13
+Requires-Dist: beautifulsoup4>=4.10.0
 Requires-Dist: bleach>=6.2.0
 Requires-Dist: build>=1.3.0
 Requires-Dist: click<8.2.0,>=8.0.0
-Requires-Dist: distro==1.8.0
+Requires-Dist: distro>=1.8.0
 Requires-Dist: httpx>=0.28.1
 Requires-Dist: humanize>=4.12.2
 Requires-Dist: jinja2>=3.1.0
 Requires-Dist: packaging>=25.0
-Requires-Dist: pydantic<2
+Requires-Dist: pydantic<3,>=2
 Requires-Dist: requests<3
-Requires-Dist: responses==0.22.0
 Requires-Dist: setuptools>=80.9.0
 Requires-Dist: toml<1,>=0.10.2
 Requires-Dist: tqdm>=4.67.1

splunk_soar_sdk-3.1.0/commitlint.config.js

@@ -0,0 +1 @@
+module.exports = { extends: ['@commitlint/config-conventional'] };

{splunk_soar_sdk-2.3.7 → splunk_soar_sdk-3.1.0}/pyproject.toml

@@ -1,9 +1,9 @@
 [project]
 name = "splunk-soar-sdk"
-version = "2.3.7"
+version = "3.1.0"
 description = "The official framework for developing and testing Splunk SOAR Apps"
 readme = "README.md"
-requires-python = ">=3.9, <3.14"
+requires-python = ">=3.13, <=3.14"
 license = "Apache-2.0"
 license-files = ["LICENSE"]
 keywords = ["cisco", "splunk", "soar", "phantom", "app", "connector", "sdk"]
@@ -31,11 +31,10 @@ dependencies = [
     "typer>=0.12.5, <1",
     "click>=8.0.0, <8.2.0",
     # SOAR phantom lib dependencies
-    "beautifulsoup4==4.10.0",
-    "distro==1.8.0",
-    "pydantic<2",
+    "beautifulsoup4>=4.10.0",
+    "distro>=1.8.0",
+    "pydantic>=2,<3",
     "requests<3",
-    "responses==0.22.0",
     "httpx>=0.28.1",
     "tqdm>=4.67.1",
     "humanize>=4.12.2",
@@ -81,6 +80,7 @@ dev = [
     "tomlkit>=0.13.2",
     "types-beautifulsoup4>=4.12.0.5,<5",
     "types-requests>=2.31.0.1,<3",
+    "types-toml>=0.10.8,<1",
     "types-tqdm>=4.67.0.20250417",
     "types-urllib3>=1.26.25.13,<2",
 ]
@@ -103,18 +103,18 @@ url = "https://pypi.python.org/simple"
 
 [tool.uv]
 environments = [
-    "sys_platform == 'linux' and platform_machine == 'x86_64' and python_version == '3.9'",
     "sys_platform == 'linux' and platform_machine == 'x86_64' and python_version == '3.13'",
-    "sys_platform == 'linux' and platform_machine == 'aarch64' and python_version == '3.9'",
+    "sys_platform == 'linux' and platform_machine == 'x86_64' and python_version == '3.14'",
     "sys_platform == 'linux' and platform_machine == 'aarch64' and python_version == '3.13'",
-    "sys_platform == 'darwin' and platform_machine == 'x86_64' and python_version == '3.9'",
+    "sys_platform == 'linux' and platform_machine == 'aarch64' and python_version == '3.14'",
     "sys_platform == 'darwin' and platform_machine == 'x86_64' and python_version == '3.13'",
-    "sys_platform == 'darwin' and platform_machine == 'arm64' and python_version == '3.9'",
+    "sys_platform == 'darwin' and platform_machine == 'x86_64' and python_version == '3.14'",
     "sys_platform == 'darwin' and platform_machine == 'arm64' and python_version == '3.13'",
+    "sys_platform == 'darwin' and platform_machine == 'arm64' and python_version == '3.14'",
 ]
 required-environments = [
-    "sys_platform == 'linux' and platform_machine == 'x86_64' and python_version == '3.9'",
     "sys_platform == 'linux' and platform_machine == 'x86_64' and python_version == '3.13'",
+    "sys_platform == 'linux' and platform_machine == 'x86_64' and python_version == '3.14'",
 ]
 
 [tool.pytest.ini_options]
@@ -144,7 +144,7 @@ exclude_lines = [
 [tool.ruff]
 output-format = "full"  # <full|concise>
 fix = true
-target-version = "py39"
+target-version = "py313"
 
 [tool.ruff.lint]
 select = [

splunk_soar_sdk-3.1.0/release_notes.txt

@@ -0,0 +1,21 @@
+# [3.1.0](https://github.com/phantomcyber/splunk-soar-sdk/compare/3.0.0...3.1.0) (2025-10-27)
+
+
+### Features
+
+* add es finding model into sdk for platform and sdk use ([199cfdf](https://github.com/phantomcyber/splunk-soar-sdk/commit/199cfdf6dc53a8914cd63a7514479694ed950862))
+
+
+
+
+
+# [3.1.0](https://github.com/phantomcyber/splunk-soar-sdk/compare/3.0.0...3.1.0) (2025-10-27)
+
+
+### Features
+
+* add es finding model into sdk for platform and sdk use ([199cfdf](https://github.com/phantomcyber/splunk-soar-sdk/commit/199cfdf6dc53a8914cd63a7514479694ed950862))
+
+
+
+

splunk_soar_sdk-3.1.0/release_version.txt

@@ -0,0 +1 @@
+3.1.0

{splunk_soar_sdk-2.3.7 → splunk_soar_sdk-3.1.0}/src/soar_sdk/abstract.py

@@ -1,5 +1,5 @@
 from abc import abstractmethod
-from typing import Any, Optional, Union, Generic, TypeVar
+from typing import Any, Generic, TypeVar
 from collections.abc import Mapping, Iterable, AsyncIterable
 
 from soar_sdk.apis.vault import Vault
@@ -8,9 +8,9 @@ from soar_sdk.apis.container import Container
 from soar_sdk.action_results import ActionOutput
 import httpx
 from pydantic.dataclasses import dataclass
-from pydantic import validator
+from pydantic import field_validator
 
-JSONType = Union[dict[str, Any], list[Any], str, int, float, bool, None]
+JSONType = dict[str, Any] | list[Any] | str | int | float | bool | None
 SummaryType = TypeVar("SummaryType", bound=ActionOutput)
 
 
@@ -23,7 +23,8 @@ class SOARClientAuth:
     password: str = ""
     user_session_token: str = ""
 
-    @validator("base_url")
+    @field_validator("base_url")
+    @classmethod
     def validate_phantom_url(cls, value: str) -> str:
         """Validate and format the base URL for the SOAR API."""
         return (
@@ -74,13 +75,13 @@ class SOARClient(Generic[SummaryType]):
         self,
         endpoint: str,
         *,
-        params: Optional[Union[dict[str, Any], httpx.QueryParams]] = None,
-        headers: Optional[dict[str, str]] = None,
-        cookies: Optional[dict[str, str]] = None,
-        timeout: Optional[httpx.Timeout] = None,
-        auth: Optional[Union[httpx.Auth, tuple[str, str]]] = None,
+        params: dict[str, Any] | httpx.QueryParams | None = None,
+        headers: dict[str, str] | None = None,
+        cookies: dict[str, str] | None = None,
+        timeout: httpx.Timeout | None = None,
+        auth: httpx.Auth | tuple[str, str] | None = None,
         follow_redirects: bool = False,
-        extensions: Optional[Mapping[str, Any]] = None,
+        extensions: Mapping[str, Any] | None = None,
     ) -> httpx.Response:
         """Perform a GET request to the specific endpoint using the SOAR client."""
         response = self.client.get(
@@ -100,19 +101,17 @@ class SOARClient(Generic[SummaryType]):
         self,
         endpoint: str,
         *,
-        content: Optional[
-            Union[str, bytes, Iterable[bytes], AsyncIterable[bytes]]
-        ] = None,
-        data: Optional[Mapping[str, Any]] = None,
-        files: Optional[dict[str, Any]] = None,
-        json: Optional[JSONType] = None,
-        params: Optional[dict[str, Any]] = None,
-        headers: Optional[dict[str, str]] = None,
-        cookies: Optional[dict[str, str]] = None,
-        auth: Optional[Union[httpx.Auth, tuple[str, str]]] = None,
-        timeout: Optional[Union[float, httpx.Timeout]] = None,
+        content: str | bytes | Iterable[bytes] | AsyncIterable[bytes] | None = None,
+        data: Mapping[str, Any] | None = None,
+        files: dict[str, Any] | None = None,
+        json: JSONType | None = None,
+        params: dict[str, Any] | None = None,
+        headers: dict[str, str] | None = None,
+        cookies: dict[str, str] | None = None,
+        auth: httpx.Auth | tuple[str, str] | None = None,
+        timeout: float | httpx.Timeout | None = None,
         follow_redirects: bool = True,
-        extensions: Optional[Mapping[str, Any]] = None,
+        extensions: Mapping[str, Any] | None = None,
     ) -> httpx.Response:
         """Perform a POST request to the specific endpoint using the SOAR client."""
         headers = headers or {}
@@ -138,19 +137,17 @@ class SOARClient(Generic[SummaryType]):
         self,
         endpoint: str,
         *,
-        content: Optional[
-            Union[str, bytes, Iterable[bytes], AsyncIterable[bytes]]
-        ] = None,
-        data: Optional[Mapping[str, Any]] = None,
-        files: Optional[dict[str, Any]] = None,
-        json: Optional[JSONType] = None,
-        params: Optional[dict[str, Any]] = None,
-        headers: Optional[dict[str, str]] = None,
-        cookies: Optional[dict[str, str]] = None,
-        auth: Optional[Union[httpx.Auth, tuple[str, str]]] = None,
-        timeout: Optional[Union[float, httpx.Timeout]] = None,
+        content: str | bytes | Iterable[bytes] | AsyncIterable[bytes] | None = None,
+        data: Mapping[str, Any] | None = None,
+        files: dict[str, Any] | None = None,
+        json: JSONType | None = None,
+        params: dict[str, Any] | None = None,
+        headers: dict[str, str] | None = None,
+        cookies: dict[str, str] | None = None,
+        auth: httpx.Auth | tuple[str, str] | None = None,
+        timeout: float | httpx.Timeout | None = None,
         follow_redirects: bool = True,
-        extensions: Optional[Mapping[str, Any]] = None,
+        extensions: Mapping[str, Any] | None = None,
     ) -> httpx.Response:
         """Perform a PUT request to the specific endpoint using the SOAR client."""
         headers = headers or {}
@@ -176,13 +173,13 @@ class SOARClient(Generic[SummaryType]):
         self,
         endpoint: str,
         *,
-        params: Optional[Union[dict[str, Any], httpx.QueryParams]] = None,
-        headers: Optional[dict[str, str]] = None,
-        cookies: Optional[dict[str, str]] = None,
-        auth: Optional[Union[httpx.Auth, tuple[str, str]]] = None,
-        timeout: Optional[httpx.Timeout] = None,
+        params: dict[str, Any] | httpx.QueryParams | None = None,
+        headers: dict[str, str] | None = None,
+        cookies: dict[str, str] | None = None,
+        auth: httpx.Auth | tuple[str, str] | None = None,
+        timeout: httpx.Timeout | None = None,
         follow_redirects: bool = False,
-        extensions: Optional[Mapping[str, Any]] = None,
+        extensions: Mapping[str, Any] | None = None,
     ) -> httpx.Response:
         """Perform a DELETE request to the specific endpoint using the SOAR client."""
         headers = headers or {}
@@ -229,7 +226,7 @@ class SOARClient(Generic[SummaryType]):
         pass
 
     @abstractmethod
-    def get_summary(self) -> Optional[SummaryType]:
+    def get_summary(self) -> SummaryType | None:
         """Get the summary for the action run."""
         pass
 

{splunk_soar_sdk-2.3.7 → splunk_soar_sdk-3.1.0}/src/soar_sdk/action_results.py

@@ -1,12 +1,15 @@
-from typing import Optional, Union, get_origin, get_args, Any
+from typing import Union, get_origin, get_args, Any
 from collections.abc import Iterator
-from typing_extensions import NotRequired, TypedDict
-from pydantic import BaseModel, Field
+from typing_extensions import TypedDict
+from typing import NotRequired
+from pydantic import BaseModel, Field, ConfigDict
 import itertools
+import types
 
 from soar_sdk.compat import remove_when_soar_newer_than
 from soar_sdk.shims.phantom.action_result import ActionResult as PhantomActionResult
 from soar_sdk.meta.datatypes import as_datatype
+from soar_sdk.field_utils import parse_json_schema_extra
 
 remove_when_soar_newer_than(
     "7.0.0", "NotRequired from typing_extensions is in typing in Python 3.11+"
@@ -40,7 +43,7 @@ class ActionResult(PhantomActionResult):
         self,
         status: bool,
         message: str,
-        param: Optional[dict] = None,
+        param: dict | None = None,
     ) -> None:
         """Initialize an ActionResult with status, message, and optional parameters.
 
@@ -82,16 +85,16 @@ class OutputFieldSpecification(TypedDict):
     data_path: str
     data_type: str
     contains: NotRequired[list[str]]
-    example_values: NotRequired[list[Union[str, float, bool]]]
+    example_values: NotRequired[list[str | float | bool]]
     column_name: NotRequired[str]
     column_order: NotRequired[int]
 
 
 def OutputField(
-    cef_types: Optional[list[str]] = None,
-    example_values: Optional[list[Union[str, float, bool]]] = None,
-    alias: Optional[str] = None,
-    column_name: Optional[str] = None,
+    cef_types: list[str] | None = None,
+    example_values: list[str | float | bool] | None = None,
+    alias: str | None = None,
+    column_name: str | None = None,
 ) -> Any:  # noqa: ANN401
     """Define metadata for an action output field.
 
@@ -121,11 +124,18 @@ def OutputField(
         ...     )
         ...     count: int = OutputField(example_values=[1, 5, 10])
     """
+    json_schema_extra: dict[str, Any] = {}
+    if cef_types is not None:
+        json_schema_extra["cef_types"] = cef_types
+    if example_values is not None:
+        json_schema_extra["examples"] = example_values
+    if column_name is not None:
+        json_schema_extra["column_name"] = column_name
+
     return Field(
-        examples=example_values,
+        default=...,
         alias=alias,
-        cef_types=cef_types,
-        column_name=column_name,
+        json_schema_extra=json_schema_extra if json_schema_extra else None,
     )
 
 
@@ -158,11 +168,14 @@ class ActionOutput(BaseModel):
         Nested ActionOutput classes are supported for complex data structures.
     """
 
+    # Allow instantiation with both field names and aliases for backward compatibility
+    model_config = ConfigDict(populate_by_name=True)
+
     @classmethod
     def _to_json_schema(
         cls,
         parent_datapath: str = "action_result.data.*",
-        column_order_counter: Optional[itertools.count] = None,
+        column_order_counter: itertools.count | None = None,
     ) -> Iterator[OutputFieldSpecification]:
         """Convert the ActionOutput class to SOAR-compatible JSON schema.
 
@@ -191,15 +204,18 @@ class ActionOutput(BaseModel):
         if column_order_counter is None:
             column_order_counter = itertools.count()
 
-        for _field_name, field in cls.__fields__.items():
+        for _field_name, field in cls.model_fields.items():
             field_name = alias if (alias := field.alias) else _field_name
 
             field_type = field.annotation
+            if field_type is None:
+                continue
+
             datapath = parent_datapath + f".{field_name}"
 
             # Handle lists and optional types, even nested ones
             origin = get_origin(field_type)
-            while origin in [list, Union, Optional]:
+            while origin in [list, Union, types.UnionType]:
                 type_args = [
                     arg
                     for arg in get_args(field_type)
@@ -221,6 +237,11 @@ class ActionOutput(BaseModel):
                 field_type = type_args[0]
                 origin = get_origin(field_type)
 
+            if not isinstance(field_type, type):
+                raise TypeError(
+                    f"Output field {field_name} has invalid type annotation: {field_type}"
+                )
+
             if issubclass(field_type, ActionOutput):
                 # If the field is another ActionOutput, recursively call _to_json_schema
                 yield from field_type._to_json_schema(datapath, column_order_counter)
@@ -237,15 +258,17 @@ class ActionOutput(BaseModel):
                 data_path=datapath, data_type=type_name
             )
 
-            if cef_types := field.field_info.extra.get("cef_types"):
+            json_schema_extra = parse_json_schema_extra(field.json_schema_extra)
+
+            if cef_types := json_schema_extra.get("cef_types"):
                 schema_field["contains"] = cef_types
-            if examples := field.field_info.extra.get("examples"):
+            if examples := json_schema_extra.get("examples"):
                 schema_field["example_values"] = examples
 
             if field_type is bool:
                 schema_field["example_values"] = [True, False]
 
-            column_name = field.field_info.extra.get("column_name")
+            column_name = json_schema_extra.get("column_name")
 
             if column_name is not None:
                 schema_field["column_name"] = column_name

{splunk_soar_sdk-2.3.7 → splunk_soar_sdk-3.1.0}/src/soar_sdk/actions_manager.py

@@ -1,4 +1,4 @@
-from typing import Optional, Any
+from typing import Any
 import os
 
 from soar_sdk.compat import remove_when_soar_newer_than
@@ -31,7 +31,7 @@ class ActionsManager(BaseConnector):
         self.auth_state: dict = {}
         self.asset_cache: dict = {}
 
-    def get_action(self, identifier: str) -> Optional[Action]:
+    def get_action(self, identifier: str) -> Action | None:
         """Convenience method for getting an Action callable from its identifier.
 
         Returns None if there are no actions managed by this object matching the given
@@ -60,14 +60,12 @@ class ActionsManager(BaseConnector):
         """
         self._actions[action_identifier] = wrapped_function
 
-    def handle(
-        self, input_data: InputSpecification, handle: Optional[int] = None
-    ) -> str:
+    def handle(self, input_data: InputSpecification, handle: int | None = None) -> str:
         """Runs handling of the input data on connector."""
         action_id = input_data.identifier
         if self.get_action(action_id):
             self.print_progress_message = True
-            return self._handle_action(input_data.json(), handle or 0)
+            return self._handle_action(input_data.model_dump_json(), handle or 0)
         else:
             raise RuntimeError(
                 f"Action {action_id} not recognized"
@@ -86,7 +84,7 @@ class ActionsManager(BaseConnector):
 
         if handler := self.get_action(action_id):
             try:
-                params = handler.meta.parameters.parse_obj(param)
+                params = handler.meta.parameters.model_validate(param)
             except (ValueError, ValidationError) as e:
                 self.save_progress(
                     f"Validation Error - the params data for action could not be parsed: {e!s}"

{splunk_soar_sdk-2.3.7 → splunk_soar_sdk-3.1.0}/src/soar_sdk/apis/utils.py

@@ -1,5 +1,5 @@
 import httpx
-from typing import Optional, Any
+from typing import Any
 from collections.abc import Generator
 
 
@@ -11,9 +11,9 @@ def is_client_authenticated(client: httpx.Client) -> bool:
 def get_request_iter_pages(
     client: httpx.Client,
     endpoint: str,
-    params: Optional[dict] = None,
+    params: dict | None = None,
     page_size: int = 50,
-) -> Generator[Any, None, None]:
+) -> Generator[Any]:
     """Iterate through REST JSON results using the provided paging."""
     params = params or {}
 

{splunk_soar_sdk-2.3.7 → splunk_soar_sdk-3.1.0}/src/soar_sdk/apis/vault.py

@@ -1,4 +1,4 @@
-from typing import TYPE_CHECKING, Optional, Union
+from typing import TYPE_CHECKING
 from soar_sdk.models.vault_attachment import VaultAttachment
 from soar_sdk.shims.phantom.vault import PhantomVault, VaultBase
 
@@ -47,9 +47,9 @@ class Vault:
     def create_attachment(
         self,
         container_id: int,
-        file_content: Union[str, bytes],
+        file_content: str | bytes,
         file_name: str,
-        metadata: Optional[dict[str, str]] = None,
+        metadata: dict[str, str] | None = None,
     ) -> str:
         """Create a vault attachment from file content.
 
@@ -87,7 +87,7 @@ class Vault:
         container_id: int,
         file_location: str,
         file_name: str,
-        metadata: Optional[dict[str, str]] = None,
+        metadata: dict[str, str] | None = None,
     ) -> str:
         """Add an existing file to the vault as an attachment.
 
@@ -121,9 +121,9 @@ class Vault:
 
     def get_attachment(
         self,
-        vault_id: Optional[str] = None,
-        file_name: Optional[str] = None,
-        container_id: Optional[int] = None,
+        vault_id: str | None = None,
+        file_name: str | None = None,
+        container_id: int | None = None,
     ) -> list[VaultAttachment]:
         """Retrieve attachment(s) from the vault.
 
@@ -161,9 +161,9 @@ class Vault:
 
     def delete_attachment(
         self,
-        vault_id: Optional[str] = None,
-        file_name: Optional[str] = None,
-        container_id: Optional[int] = None,
+        vault_id: str | None = None,
+        file_name: str | None = None,
+        container_id: int | None = None,
         remove_all: bool = False,
     ) -> list[str]:
         """Delete attachment(s) from the vault.