splunk-soar-sdk 3.8.1__tar.gz → 3.8.2__tar.gz

{splunk_soar_sdk-3.8.1 → splunk_soar_sdk-3.8.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: splunk-soar-sdk
-Version: 3.8.1
+Version: 3.8.2
 Summary: The official framework for developing and testing Splunk SOAR Apps
 Project-URL: Homepage, https://github.com/phantomcyber/splunk-soar-sdk
 Project-URL: Documentation, https://github.com/phantomcyber/splunk-soar-sdk

{splunk_soar_sdk-3.8.1 → splunk_soar_sdk-3.8.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "splunk-soar-sdk"
-version = "3.8.1"
+version = "3.8.2"
 description = "The official framework for developing and testing Splunk SOAR Apps"
 readme = "README.md"
 requires-python = ">=3.13, <3.15"

splunk_soar_sdk-3.8.2/release_notes.txt

@@ -0,0 +1,21 @@
+## [3.8.2](https://github.com/phantomcyber/splunk-soar-sdk/compare/3.8.1...3.8.2) (2026-01-26)
+
+
+### Bug Fixes
+
+* fix es finding model and usage ([3c8fc04](https://github.com/phantomcyber/splunk-soar-sdk/commit/3c8fc04228035f540ea1213eec2c54017e378a59))
+
+
+
+
+
+## [3.8.2](https://github.com/phantomcyber/splunk-soar-sdk/compare/3.8.1...3.8.2) (2026-01-26)
+
+
+### Bug Fixes
+
+* fix es finding model and usage ([3c8fc04](https://github.com/phantomcyber/splunk-soar-sdk/commit/3c8fc04228035f540ea1213eec2c54017e378a59))
+
+
+
+

splunk_soar_sdk-3.8.2/release_version.txt

@@ -0,0 +1 @@
+3.8.2

{splunk_soar_sdk-3.8.1 → splunk_soar_sdk-3.8.2}/src/soar_sdk/asset.py

@@ -300,3 +300,29 @@ class BaseAsset(BaseModel):
         if self._ingest_state is None:
             raise AppContextRequired()
         return self._ingest_state
+
+
+class ESIngestMixin:
+    """Mixin for apps that support ES polling (on_es_poll).
+
+    Add this mixin to your Asset class to include ES Ingest Settings fields.
+    These fields are configured in the ES UI and control how findings are created.
+
+    Example:
+        >>> class Asset(BaseAsset, ESIngestMixin):
+        ...     server: str = AssetField(description="API server URL")
+        ...     api_key: str = AssetField(description="API key", sensitive=True)
+    """
+
+    es_security_domain: str = AssetField(
+        required=False,
+        description="Security domain for ES findings",
+        default="threat",
+        category=FieldCategory.INGEST,
+    )
+    es_urgency: str = AssetField(
+        required=False,
+        description="Urgency level for ES findings",
+        default="medium",
+        category=FieldCategory.INGEST,
+    )

{splunk_soar_sdk-3.8.1 → splunk_soar_sdk-3.8.2}/src/soar_sdk/models/finding.py

@@ -21,20 +21,26 @@ class DrilldownDashboard(BaseModel):
 
 
 class Finding(BaseModel):
-    """Represents a finding to be created during on_finding.
+    """Represents a finding to be created during on_es_poll.
 
     Findings are stored in ES and can be associated with SOAR containers/artifacts
     for investigation workflow.
+
+    Only rule_title and security_domain are required. All other fields are optional
+    and will use ES defaults if not provided.
     """
 
     model_config = ConfigDict(extra="forbid")
 
+    # Required fields
     rule_title: str
-    rule_description: str
     security_domain: str
-    risk_object: str
-    risk_object_type: str
-    risk_score: float
+
+    # Optional fields
+    rule_description: str | None = None
+    risk_object: str | None = None
+    risk_object_type: str | None = None
+    risk_score: float | None = None
     status: str | None = None
     urgency: str | None = None
     owner: str | None = None

{splunk_soar_sdk-3.8.1 → splunk_soar_sdk-3.8.2}/uv.lock

@@ -1284,7 +1284,7 @@ wheels = [
 
 [[package]]
 name = "splunk-soar-sdk"
-version = "3.8.1"
+version = "3.8.2"
 source = { editable = "." }
 dependencies = [
     { name = "authlib", marker = "(platform_machine == 'arm64' and sys_platform == 'darwin') or (platform_machine == 'x86_64' and sys_platform == 'darwin') or (platform_machine == 'aarch64' and sys_platform == 'linux') or (platform_machine == 'x86_64' and sys_platform == 'linux')" },

splunk_soar_sdk-3.8.1/release_notes.txt

@@ -1,21 +0,0 @@
-## [3.8.1](https://github.com/phantomcyber/splunk-soar-sdk/compare/3.8.0...3.8.1) (2026-01-22)
-
-
-### Bug Fixes
-
-* make OutputField default to None instead of required ([b4b3c36](https://github.com/phantomcyber/splunk-soar-sdk/commit/b4b3c36eab97fc6f6cc16f8604272e85c483207c))
-
-
-
-
-
-## [3.8.1](https://github.com/phantomcyber/splunk-soar-sdk/compare/3.8.0...3.8.1) (2026-01-22)
-
-
-### Bug Fixes
-
-* make OutputField default to None instead of required ([b4b3c36](https://github.com/phantomcyber/splunk-soar-sdk/commit/b4b3c36eab97fc6f6cc16f8604272e85c483207c))
-
-
-
-

splunk_soar_sdk-3.8.1/release_version.txt

@@ -1 +0,0 @@
-3.8.1