splunk-soar-sdk 3.0.0__tar.gz → 3.1.0__tar.gz

{splunk_soar_sdk-3.0.0 → splunk_soar_sdk-3.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: splunk-soar-sdk
-Version: 3.0.0
+Version: 3.1.0
 Summary: The official framework for developing and testing Splunk SOAR Apps
 Project-URL: Homepage, https://github.com/phantomcyber/splunk-soar-sdk
 Project-URL: Documentation, https://github.com/phantomcyber/splunk-soar-sdk

{splunk_soar_sdk-3.0.0 → splunk_soar_sdk-3.1.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "splunk-soar-sdk"
-version = "3.0.0"
+version = "3.1.0"
 description = "The official framework for developing and testing Splunk SOAR Apps"
 readme = "README.md"
 requires-python = ">=3.13, <=3.14"

splunk_soar_sdk-3.1.0/release_notes.txt

@@ -0,0 +1,21 @@
+# [3.1.0](https://github.com/phantomcyber/splunk-soar-sdk/compare/3.0.0...3.1.0) (2025-10-27)
+
+
+### Features
+
+* add es finding model into sdk for platform and sdk use ([199cfdf](https://github.com/phantomcyber/splunk-soar-sdk/commit/199cfdf6dc53a8914cd63a7514479694ed950862))
+
+
+
+
+
+# [3.1.0](https://github.com/phantomcyber/splunk-soar-sdk/compare/3.0.0...3.1.0) (2025-10-27)
+
+
+### Features
+
+* add es finding model into sdk for platform and sdk use ([199cfdf](https://github.com/phantomcyber/splunk-soar-sdk/commit/199cfdf6dc53a8914cd63a7514479694ed950862))
+
+
+
+

splunk_soar_sdk-3.1.0/release_version.txt

@@ -0,0 +1 @@
+3.1.0

splunk_soar_sdk-3.1.0/src/soar_sdk/models/finding.py

@@ -0,0 +1,54 @@
+from pydantic import BaseModel
+from typing import Any
+
+
+class DrilldownSearch(BaseModel):
+    """Represents a drilldown search in a finding."""
+
+    name: str
+    search: str
+    earliest: str
+    latest: str
+
+
+class DrilldownDashboard(BaseModel):
+    """Represents a drilldown dashboard in a finding."""
+
+    dashboard: str
+    name: str
+    tokens: list[str] | None = None
+
+
+class Finding(BaseModel):
+    """Represents a finding to be created during on_finding.
+
+    Findings are stored in ES and can be associated with SOAR containers/artifacts
+    for investigation workflow.
+    """
+
+    class Config:
+        """Pydantic config."""
+
+        extra = "forbid"
+
+    rule_title: str
+    rule_description: str
+    security_domain: str
+    risk_object: str
+    risk_object_type: str
+    risk_score: float
+    status: str | None = None
+    urgency: str | None = None
+    owner: str | None = None
+    disposition: str | None = None
+    drilldown_searches: list[DrilldownSearch] | None = None
+    drilldown_dashboards: list[DrilldownDashboard] | None = None
+    annotations: dict[str, list[str]] | None = None
+    risk_event_count: int | None = None
+    all_risk_objects: list[str] | None = None
+    source: list[str] | None = None
+    exclude_map_fields: list[str] | None = None
+
+    def to_dict(self) -> dict[str, Any]:
+        """Convert the finding to a dictionary."""
+        return self.dict(exclude_none=True)

splunk_soar_sdk-3.1.0/tests/test_finding.py

@@ -0,0 +1,126 @@
+from soar_sdk.models.finding import Finding, DrilldownSearch, DrilldownDashboard
+from pydantic import ValidationError
+import pytest
+
+
+def test_finding_basic():
+    """Test basic Finding with required fields."""
+    finding = Finding(
+        rule_title="Test Finding",
+        rule_description="Test Description",
+        security_domain="threat",
+        risk_object="test@example.com",
+        risk_object_type="user",
+        risk_score=85.0,
+    )
+
+    finding_dict = finding.to_dict()
+    assert finding_dict["rule_title"] == "Test Finding"
+    assert finding_dict["security_domain"] == "threat"
+    assert finding_dict["risk_score"] == 85.0
+    assert "status" not in finding_dict
+
+
+def test_finding_with_complex_fields():
+    """Test Finding with drilldowns, annotations, and optional fields."""
+    drilldown_search = DrilldownSearch(
+        name="search_name", search="index=_internal", earliest="-1d", latest="now"
+    )
+    drilldown_dashboard = DrilldownDashboard(
+        dashboard="dash_id", name="Dashboard", tokens=["token1"]
+    )
+
+    finding = Finding(
+        rule_title="Risk Threshold Exceeded",
+        rule_description="24 hour risk threshold exceeded",
+        security_domain="threat",
+        risk_object="bad_user@splunk.com",
+        risk_object_type="user",
+        risk_score=100,
+        status="New",
+        drilldown_searches=[drilldown_search],
+        drilldown_dashboards=[drilldown_dashboard],
+        annotations={"mitre_attack": ["T1078", "T1537"]},
+        all_risk_objects=["user1@splunk.com", "user2@splunk.com"],
+    )
+
+    finding_dict = finding.to_dict()
+    assert finding_dict["status"] == "New"
+    assert len(finding_dict["drilldown_searches"]) == 1
+    assert finding_dict["drilldown_searches"][0]["name"] == "search_name"
+    assert len(finding_dict["drilldown_dashboards"]) == 1
+    assert finding_dict["annotations"]["mitre_attack"] == ["T1078", "T1537"]
+    assert len(finding_dict["all_risk_objects"]) == 2
+
+
+def test_finding_validation():
+    """Test Finding validation for invalid inputs."""
+    # Invalid attribute
+    with pytest.raises(ValidationError):
+        Finding(
+            rule_title="Test",
+            rule_description="Test",
+            security_domain="threat",
+            risk_object="test",
+            risk_object_type="user",
+            risk_score=50.0,
+            not_allowed="fail",
+        )
+
+    # Missing required fields
+    with pytest.raises(ValidationError):
+        Finding(rule_title="Test")
+
+    with pytest.raises(ValidationError):
+        Finding(
+            rule_title="Test",
+            rule_description="Test",
+            security_domain="threat",
+            risk_object="test",
+            risk_object_type="user",
+            risk_score="invalid",
+        )
+
+
+def test_finding_serialization():
+    """Test Finding serialization and deserialization."""
+    data = {
+        "rule_title": "Test Finding",
+        "rule_description": "Test Description",
+        "security_domain": "threat",
+        "risk_object": "test@example.com",
+        "risk_object_type": "user",
+        "risk_score": 75.0,
+        "status": "New",
+    }
+    finding = Finding(**data)
+    finding_dict = finding.to_dict()
+    new_finding = Finding(**finding_dict)
+    assert new_finding == finding
+
+
+def test_drilldown_search():
+    """Test DrilldownSearch model."""
+    drilldown = DrilldownSearch(
+        name="Test", search="index=main", earliest="-24h", latest="now"
+    )
+    assert drilldown.name == "Test"
+    assert drilldown.search == "index=main"
+
+    with pytest.raises(ValidationError):
+        DrilldownSearch(name="Test")
+
+
+def test_drilldown_dashboard():
+    """Test DrilldownDashboard model."""
+    dashboard = DrilldownDashboard(dashboard="dash_id", name="Dashboard Name")
+    assert dashboard.dashboard == "dash_id"
+    assert dashboard.tokens is None
+
+    dashboard_with_tokens = DrilldownDashboard(
+        dashboard="dash_id", name="Dashboard", tokens=["token1", "token2"]
+    )
+    assert len(dashboard_with_tokens.tokens) == 2
+
+    with pytest.raises(ValidationError):
+        DrilldownDashboard(name="Test")

{splunk_soar_sdk-3.0.0 → splunk_soar_sdk-3.1.0}/uv.lock

@@ -1131,7 +1131,7 @@ wheels = [
 
 [[package]]
 name = "splunk-soar-sdk"
-version = "3.0.0"
+version = "3.1.0"
 source = { editable = "." }
 dependencies = [
     { name = "beautifulsoup4", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'x86_64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" },

splunk_soar_sdk-3.0.0/release_notes.txt

@@ -1,49 +0,0 @@
-# [3.0.0](https://github.com/phantomcyber/splunk-soar-sdk/compare/2.3.7...3.0.0) (2025-10-27)
-
-
-* feat!: drop sdk py3.9 support + add py3.13 support + update min phantom version to 7.0.0 ([e05c5ab](https://github.com/phantomcyber/splunk-soar-sdk/commit/e05c5abc5a923f02be4ecae9c2ad6ff2c37cb4d9))
-
-
-### Bug Fixes
-
-* build with new pydantic version fix ([cfab060](https://github.com/phantomcyber/splunk-soar-sdk/commit/cfab060e34a5fddea3bc8fcb3ac3e247e1d9f64d))
-* use system for commitlint to fix node issue on M mac chips ([ff82ba4](https://github.com/phantomcyber/splunk-soar-sdk/commit/ff82ba4c1c3294b0a400ed6cf3891cbd74e3caa9))
-
-
-### Features
-
-* pydantic changes to v2 ([5c76f54](https://github.com/phantomcyber/splunk-soar-sdk/commit/5c76f54d706449073df0ca85ad4cbe3af450d49c))
-
-
-### BREAKING CHANGES
-
-* Python 3.9 is no longer supported
-
-
-
-
-
-# [3.0.0](https://github.com/phantomcyber/splunk-soar-sdk/compare/2.3.7...3.0.0) (2025-10-27)
-
-
-* feat!: drop sdk py3.9 support + add py3.13 support + update min phantom version to 7.0.0 ([e05c5ab](https://github.com/phantomcyber/splunk-soar-sdk/commit/e05c5abc5a923f02be4ecae9c2ad6ff2c37cb4d9))
-
-
-### Bug Fixes
-
-* build with new pydantic version fix ([cfab060](https://github.com/phantomcyber/splunk-soar-sdk/commit/cfab060e34a5fddea3bc8fcb3ac3e247e1d9f64d))
-* use system for commitlint to fix node issue on M mac chips ([ff82ba4](https://github.com/phantomcyber/splunk-soar-sdk/commit/ff82ba4c1c3294b0a400ed6cf3891cbd74e3caa9))
-
-
-### Features
-
-* pydantic changes to v2 ([5c76f54](https://github.com/phantomcyber/splunk-soar-sdk/commit/5c76f54d706449073df0ca85ad4cbe3af450d49c))
-
-
-### BREAKING CHANGES
-
-* Python 3.9 is no longer supported
-
-
-
-

splunk_soar_sdk-3.0.0/release_version.txt

@@ -1 +0,0 @@
-3.0.0