taegis-sdk-python 1.0.0a8__tar.gz → 1.0.0a10__tar.gz

{taegis-sdk-python-1.0.0a8/taegis_sdk_python.egg-info → taegis-sdk-python-1.0.0a10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: taegis-sdk-python
-Version: 1.0.0a8
+Version: 1.0.0a10
 Summary: Taegis Python SDK
 Home-page: https://github.com/secureworks/taegis-sdk-python
 Author: Secureworks

taegis-sdk-python-1.0.0a10/taegis_sdk_python/_version.py

@@ -0,0 +1 @@
+__version__ = "v1.0.0-alpha10"

{taegis-sdk-python-1.0.0a8 → taegis-sdk-python-1.0.0a10}/taegis_sdk_python/authentication.py

@@ -178,7 +178,9 @@ def get_token_by_oauth(
 
 
 def get_token_by_password_grant(
-    request_url: str, username: str
+    request_url: str,
+    username: str,
+    password: Optional[str] = None,
 ) -> str:  # pragma: no cover
     """Get an access token by username/password with mfa.
 
@@ -201,7 +203,8 @@ def get_token_by_password_grant(
     """
     auth_uri = "/auth/api/v2/auth/token"
 
-    password = getpass("Password: ")
+    if not password:
+        password = getpass("Password: ")
 
     response = post(
         f"{request_url}{auth_uri}",

{taegis-sdk-python-1.0.0a8 → taegis-sdk-python-1.0.0a10}/taegis_sdk_python/service_core.py

@@ -78,16 +78,20 @@ class ServiceCore:
     @property
     def ws_client(self) -> Client:
         """GraphQL WebSockets Transport with Client."""
+        subprotocols = [
+            "graphql-ws",
+            f"access-token-{self.service.access_token}",
+        ]
+
+        if self.service.tenant_id:
+            subprotocols.append(f"x-tenant-context-{self.service.tenant_id}")
+
         transport = WebsocketsTransport(
             f"{self.wss_url}{self.gateway}",
             headers={
                 "User-Agent": f"taegis_sdk_python/{__version__}",
             },
-            subprotocols=[
-                "graphql-ws",
-                f"x-tenant-context-{self.service.tenant_id}",
-                f"access-token-{self.service.access_token}",
-            ],
+            subprotocols=subprotocols,
             connect_args={"max_size": None},
         )
         client = Client(transport=transport, fetch_schema_from_transport=True)

{taegis-sdk-python-1.0.0a8 → taegis-sdk-python-1.0.0a10}/taegis_sdk_python/services/__init__.py

@@ -17,6 +17,7 @@ from taegis_sdk_python.services.audits import AuditsService
 from taegis_sdk_python.services.clients import ClientsService
 from taegis_sdk_python.services.collector import CollectorService
 from taegis_sdk_python.services.comments import CommentsService
+from taegis_sdk_python.services.detector_registry import DetectorRegistryService
 from taegis_sdk_python.services.endpoint_command_manager import (
     EndpointCommandManagerService,
 )
@@ -32,6 +33,7 @@ from taegis_sdk_python.services.investigations2 import Investigations2Service
 from taegis_sdk_python.services.mitre_attack_info import MitreAttackInfoService
 from taegis_sdk_python.services.notebooks import NotebooksService
 from taegis_sdk_python.services.notifications import NotificationsService
+from taegis_sdk_python.services.preferences import PreferencesService
 from taegis_sdk_python.services.rules import RulesService
 from taegis_sdk_python.services.sharelinks import SharelinksService
 from taegis_sdk_python.services.tenants import TenantsService
@@ -91,6 +93,7 @@ class GraphQLService:
         self._clients = None
         self._collector = None
         self._comments = None
+        self._detector_registry = None
         self._endpoint_command_manager = None
         self._endpoint_management_service = None
         self._entity_profile = None
@@ -102,6 +105,7 @@ class GraphQLService:
         self._mitre_attack_info = None
         self._notebooks = None
         self._notifications = None
+        self._preferences = None
         self._rules = None
         self._core = None
         self._sharelinks = None
@@ -242,6 +246,13 @@ class GraphQLService:
             self._comments = CommentsService(self)
         return self._comments
 
+    @property
+    def detector_registry(self):
+        """Detector Registry Service Endpoint."""
+        if not self._detector_registry:
+            self._detector_registry = DetectorRegistryService(self)
+        return self._detector_registry
+
     @property
     def endpoint_command_manager(self):
         """Endpoint Command Manager Service Endpoint."""
@@ -319,6 +330,13 @@ class GraphQLService:
             self._notifications = NotificationsService(self)
         return self._notifications
 
+    @property
+    def preferences(self):
+        """Preferences Service Endpoint."""
+        if not self._preferences:
+            self._preferences = PreferencesService(self)
+        return self._preferences
+
     @property
     def rules(self):
         """Rules Service Endpoint."""

{taegis-sdk-python-1.0.0a8 → taegis-sdk-python-1.0.0a10}/taegis_sdk_python/services/assets2/types.py

@@ -62,6 +62,8 @@ class AssetSearchOrderByInputV2(str, Enum):
     CONNECTION_STATUS_DESC = "connection_status_desc"
     ISOLATION_STATUS_ASC = "isolation_status_asc"
     ISOLATION_STATUS_DESC = "isolation_status_desc"
+    DESIRED_ISOLATION_STATUS_ASC = "desired_isolation_status_asc"
+    DESIRED_ISOLATION_STATUS_DESC = "desired_isolation_status_desc"
     IP_ADDRESS_ASC = "ip_address_asc"
     IP_ADDRESS_DESC = "ip_address_desc"
     ENDPOINT_TYPE_ASC = "endpoint_type_asc"
@@ -82,6 +84,13 @@ class AssetSearchOrderByInputV2(str, Enum):
     TAG_DESC = "tag_desc"
 
 
+class InvestigationsOrderByInput(str, Enum):
+    """InvestigationsOrderByInput."""
+
+    CREATED_AT_ASC = "created_at_asc"
+    CREATED_AT_DESC = "created_at_desc"
+
+
 class CanIsolateResponse(str, Enum):
     """CanIsolateResponse."""
 
@@ -199,10 +208,20 @@ class TagV2:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class Investigation:
-    """Investigation."""
+class AssetInvestigation:
+    """AssetInvestigation."""
 
     id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    investigation_id: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationId")
+    )
+    created_at: Optional[str] = field(
+        default=None, metadata=config(field_name="createdAt")
+    )
+    updated_at: Optional[str] = field(
+        default=None, metadata=config(field_name="updatedAt")
+    )
+    host_id: Optional[str] = field(default=None, metadata=config(field_name="hostId"))
 
 
 @dataclass_json
@@ -397,6 +416,9 @@ class AssetWhereInputV2:
     created_at_gte: Optional[str] = field(
         default=None, metadata=config(field_name="createdAt_gte")
     )
+    desired_isolation_status: Optional[str] = field(
+        default=None, metadata=config(field_name="desiredIsolationStatus")
+    )
     group_name: Optional[str] = field(
         default=None, metadata=config(field_name="groupName")
     )
@@ -585,6 +607,9 @@ class AssetV2:
     isolation_status: Optional[str] = field(
         default=None, metadata=config(field_name="isolationStatus")
     )
+    desired_isolation_status: Optional[str] = field(
+        default=None, metadata=config(field_name="desiredIsolationStatus")
+    )
     model: Optional[str] = field(default=None, metadata=config(field_name="model"))
     cloud_provider_name: Optional[str] = field(
         default=None, metadata=config(field_name="cloudProviderName")
@@ -611,7 +636,7 @@ class AssetV2:
     endpoint_group: Optional[EndpointGroupV2] = field(
         default=None, metadata=config(field_name="endpointGroup")
     )
-    investigations: Optional[List[Investigation]] = field(
+    investigations: Optional[List[AssetInvestigation]] = field(
         default=None, metadata=config(field_name="investigations")
     )
 

{taegis-sdk-python-1.0.0a8 → taegis-sdk-python-1.0.0a10}/taegis_sdk_python/services/audits/types.py

@@ -198,6 +198,12 @@ class AuditEventResult:
 class AllAuditsInput:
     """AllAuditsInput."""
 
+    tenant_ids: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="tenantIDs")
+    )
+    session_id: Optional[str] = field(
+        default=None, metadata=config(field_name="sessionID")
+    )
     offset: Optional[int] = field(default=None, metadata=config(field_name="offset"))
     limit: Optional[int] = field(default=None, metadata=config(field_name="limit"))
     before: Optional[str] = field(default=None, metadata=config(field_name="before"))
@@ -215,6 +221,12 @@ class AllAuditsInput:
 class AuditSearchInput:
     """AuditSearchInput."""
 
+    tenant_ids: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="tenantIDs")
+    )
+    session_id: Optional[str] = field(
+        default=None, metadata=config(field_name="sessionID")
+    )
     offset: Optional[int] = field(default=None, metadata=config(field_name="offset"))
     limit: Optional[int] = field(default=None, metadata=config(field_name="limit"))
     id: Optional[str] = field(default=None, metadata=config(field_name="id"))

taegis-sdk-python-1.0.0a10/taegis_sdk_python/services/detector_registry/__init__.py

@@ -0,0 +1,33 @@
+""""DetectorRegistry Service."""
+from taegis_sdk_python.service_core import ServiceCore
+from taegis_sdk_python.services.detector_registry.mutations import (
+    TaegisSDKDetectorRegistryMutation,
+)
+from taegis_sdk_python.services.detector_registry.queries import (
+    TaegisSDKDetectorRegistryQuery,
+)
+from taegis_sdk_python.services.detector_registry.subscriptions import (
+    TaegisSDKDetectorRegistrySubscription,
+)
+
+
+class DetectorRegistryService(ServiceCore):
+    """Taegis DetectorRegistry Service."""
+
+    @property
+    def query(self):
+        if not self._queries:
+            self._queries = TaegisSDKDetectorRegistryQuery(self)
+        return self._queries
+
+    @property
+    def mutation(self):
+        if not self._mutations:
+            self._mutations = TaegisSDKDetectorRegistryMutation(self)
+        return self._mutations
+
+    @property
+    def subscription(self):
+        if not self._subscriptions:
+            self._subscriptions = TaegisSDKDetectorRegistrySubscription(self)
+        return self._subscriptions

taegis-sdk-python-1.0.0a10/taegis_sdk_python/services/detector_registry/mutations.py

@@ -0,0 +1,29 @@
+"""DetectorRegistry Mutation."""
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any, List, Dict, Optional, Tuple, Union
+
+from taegis_sdk_python.utils import (
+    build_output_string,
+    prepare_input,
+    parse_union_result,
+)
+from taegis_sdk_python.services.detector_registry.types import *
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.detector_registry import DetectorRegistryService
+
+
+class TaegisSDKDetectorRegistryMutation:
+    """Teagis Detector_registry Mutation operations."""
+
+    def __init__(self, service: DetectorRegistryService):
+        self.service = service

taegis-sdk-python-1.0.0a10/taegis_sdk_python/services/detector_registry/queries.py

@@ -0,0 +1,91 @@
+"""DetectorRegistry Query."""
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any, List, Dict, Optional, Tuple, Union
+
+from taegis_sdk_python.utils import (
+    build_output_string,
+    prepare_input,
+    parse_union_result,
+)
+from taegis_sdk_python.services.detector_registry.types import *
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.detector_registry import DetectorRegistryService
+
+
+class TaegisSDKDetectorRegistryQuery:
+    """Teagis Detector_registry Query operations."""
+
+    def __init__(self, service: DetectorRegistryService):
+        self.service = service
+
+    def detector(self, id_: str) -> RegisteredDetector:
+        """returns registered detector by ID."""
+        endpoint = "detector"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "id": prepare_input(id_),
+            },
+            output=build_output_string(RegisteredDetector),
+        )
+        if result.get(endpoint) is not None:
+            return RegisteredDetector.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detector")
+
+    def detectors(self) -> List[RegisteredDetector]:
+        """returns all detectors."""
+        endpoint = "detectors"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={},
+            output=build_output_string(RegisteredDetector),
+        )
+        if result.get(endpoint) is not None:
+            return RegisteredDetector.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query detectors")
+
+    def search_detectors(self, input_: SearchDetectors) -> List[RegisteredDetector]:
+        """searches detectors given the input criteria."""
+        endpoint = "searchDetectors"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "input": prepare_input(input_),
+            },
+            output=build_output_string(RegisteredDetector),
+        )
+        if result.get(endpoint) is not None:
+            return RegisteredDetector.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query searchDetectors")
+
+    def detector_by_name(self, display_name: str) -> List[str]:
+        """returns ids that match the given registered detector name."""
+        endpoint = "detectorByName"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "displayName": prepare_input(display_name),
+            },
+            output="",
+        )
+        if result.get(endpoint) is not None:
+            return result.get(endpoint)
+        raise GraphQLNoRowsInResultSetError("for query detectorByName")

taegis-sdk-python-1.0.0a10/taegis_sdk_python/services/detector_registry/subscriptions.py

@@ -0,0 +1,29 @@
+"""DetectorRegistry Subscription."""
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any, List, Dict, Optional, Tuple, Union
+
+from taegis_sdk_python.utils import (
+    build_output_string,
+    prepare_input,
+    parse_union_result,
+)
+from taegis_sdk_python.services.detector_registry.types import *
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.detector_registry import DetectorRegistryService
+
+
+class TaegisSDKDetectorRegistrySubscription:
+    """Teagis Detector_registry Subscription operations."""
+
+    def __init__(self, service: DetectorRegistryService):
+        self.service = service

taegis-sdk-python-1.0.0a10/taegis_sdk_python/services/detector_registry/types.py

@@ -0,0 +1,89 @@
+"""DetectorRegistry Types and Enums."""
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code
+
+# Autogenerated
+# DO NOT MODIFY
+
+from typing import Optional, List, Dict, Union, Any, Tuple
+
+
+from enum import Enum
+
+
+from dataclasses import dataclass, field
+from dataclasses_json import dataclass_json, config
+
+
+class State(str, Enum):
+    """State."""
+
+    DEPLOYED = "deployed"
+    RESEARCH = "research"
+    DISABLED = "disabled"
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class SearchDetectors:
+    """SearchDetectors."""
+
+    ids: Optional[List[str]] = field(default=None, metadata=config(field_name="ids"))
+    creator_names: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="creatorNames")
+    )
+    display_names: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="displayNames")
+    )
+    tags: Optional[List[str]] = field(default=None, metadata=config(field_name="tags"))
+    maintainers: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="maintainers")
+    )
+    archived: Optional[bool] = field(
+        default=None, metadata=config(field_name="archived")
+    )
+    alerting_rule: Optional[bool] = field(
+        default=None, metadata=config(field_name="alertingRule")
+    )
+    created_on_or_after: Optional[str] = field(
+        default=None, metadata=config(field_name="createdOnOrAfter")
+    )
+    created_before: Optional[str] = field(
+        default=None, metadata=config(field_name="createdBefore")
+    )
+    updated_on_or_after: Optional[str] = field(
+        default=None, metadata=config(field_name="updatedOnOrAfter")
+    )
+    updated_before: Optional[str] = field(
+        default=None, metadata=config(field_name="updatedBefore")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class RegisteredDetector:
+    """RegisteredDetector."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    creator_name: Optional[str] = field(
+        default=None, metadata=config(field_name="creatorName")
+    )
+    display_name: Optional[str] = field(
+        default=None, metadata=config(field_name="displayName")
+    )
+    tags: Optional[List[str]] = field(default=None, metadata=config(field_name="tags"))
+    maintainers: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="maintainers")
+    )
+    archived: Optional[bool] = field(
+        default=None, metadata=config(field_name="archived")
+    )
+    alerting_rule: Optional[bool] = field(
+        default=None, metadata=config(field_name="alertingRule")
+    )
+    created_at: Optional[str] = field(
+        default=None, metadata=config(field_name="createdAt")
+    )
+    updated_at: Optional[str] = field(
+        default=None, metadata=config(field_name="updatedAt")
+    )
+    state: Optional[State] = field(default=None, metadata=config(field_name="state"))

{taegis-sdk-python-1.0.0a8 → taegis-sdk-python-1.0.0a10}/taegis_sdk_python/services/investigations2/mutations.py

@@ -83,6 +83,29 @@ class TaegisSDKInvestigations2Mutation:
             return AddEvidenceToInvestigationResult.from_dict(result.get(endpoint))
         raise GraphQLNoRowsInResultSetError("for mutation addEvidenceToInvestigation")
 
+    def remove_evidence_from_investigation(
+        self, input_: RemoveEvidenceFromInvestigationInput
+    ) -> RemoveEvidenceFromInvestigationResult:
+        """Remove evidence from an existing investigation
+
+        This is a background job, it will be pretty quick, but removed alerts/events will likely still be present in the returned investigation
+        The processing status will reflect where the the investigation is at in the processing job.
+        """
+        endpoint = "removeEvidenceFromInvestigation"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "input": prepare_input(input_),
+            },
+            output=build_output_string(RemoveEvidenceFromInvestigationResult),
+        )
+        if result.get(endpoint) is not None:
+            return RemoveEvidenceFromInvestigationResult.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError(
+            "for mutation removeEvidenceFromInvestigation"
+        )
+
     def create_investigation_rule(
         self, input_: CreateInvestigationRuleInput
     ) -> InvestigationRule:

{taegis-sdk-python-1.0.0a8 → taegis-sdk-python-1.0.0a10}/taegis_sdk_python/services/investigations2/queries.py

@@ -43,6 +43,23 @@ class TaegisSDKInvestigations2Query:
             return InvestigationV2.from_dict(result.get(endpoint))
         raise GraphQLNoRowsInResultSetError("for query investigationV2")
 
+    def investigations_v2(
+        self, arguments: InvestigationsV2Arguments
+    ) -> InvestigationsV2:
+        """Search investigations."""
+        endpoint = "investigationsV2"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "arguments": prepare_input(arguments),
+            },
+            output=build_output_string(InvestigationsV2),
+        )
+        if result.get(endpoint) is not None:
+            return InvestigationsV2.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query investigationsV2")
+
     def investigation_rule(
         self, arguments: InvestigationRuleArguments
     ) -> InvestigationRule:

{taegis-sdk-python-1.0.0a8 → taegis-sdk-python-1.0.0a10}/taegis_sdk_python/services/investigations2/types.py

@@ -125,6 +125,25 @@ class AddEvidenceToInvestigationInput:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class RemoveEvidenceFromInvestigationInput:
+    """RemoveEvidenceFromInvestigationInput."""
+
+    investigation_id: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationId")
+    )
+    alerts: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="alerts")
+    )
+    events: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="events")
+    )
+    assets: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="assets")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class DeleteInvestigationRuleInput:
@@ -152,6 +171,25 @@ class AddEvidenceToInvestigationResult:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class RemoveEvidenceFromInvestigationResult:
+    """RemoveEvidenceFromInvestigationResult."""
+
+    investigation_id: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationId")
+    )
+    alerts: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="alerts")
+    )
+    events: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="events")
+    )
+    assets: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="assets")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class CreateInvestigationTemplateInput:
@@ -466,6 +504,9 @@ class CreateInvestigationRuleInput:
     template_id: Optional[str] = field(
         default=None, metadata=config(field_name="templateId")
     )
+    response_data: Optional[dict] = field(
+        default=None, metadata=config(field_name="responseData")
+    )
     state: Optional[InvestigationRuleState] = field(
         default=None, metadata=config(field_name="state")
     )
@@ -514,11 +555,27 @@ class UpdateInvestigationRuleInput:
     template_id: Optional[str] = field(
         default=None, metadata=config(field_name="templateId")
     )
+    response_data: Optional[dict] = field(
+        default=None, metadata=config(field_name="responseData")
+    )
     state: Optional[InvestigationRuleState] = field(
         default=None, metadata=config(field_name="state")
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class InvestigationsV2Arguments:
+    """InvestigationsV2Arguments."""
+
+    page: Optional[int] = field(default=None, metadata=config(field_name="page"))
+    per_page: Optional[int] = field(default=None, metadata=config(field_name="perPage"))
+    cql: Optional[str] = field(default=None, metadata=config(field_name="cql"))
+    order_by: Optional[PaginationOrder] = field(
+        default=None, metadata=config(field_name="orderBy")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class ExportInvestigationResourcesArgument:
@@ -971,6 +1028,19 @@ class InvestigationV2:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class InvestigationsV2:
+    """InvestigationsV2."""
+
+    total_count: Optional[int] = field(
+        default=None, metadata=config(field_name="totalCount")
+    )
+    investigations: Optional[List[InvestigationV2]] = field(
+        default=None, metadata=config(field_name="investigations")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class InvestigationTemplates: