taegis-sdk-python 1.0.0rc1__tar.gz → 1.0.2__tar.gz

{taegis-sdk-python-1.0.0rc1/taegis_sdk_python.egg-info → taegis-sdk-python-1.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: taegis-sdk-python
-Version: 1.0.0rc1
+Version: 1.0.2
 Summary: Taegis Python SDK
 Home-page: https://github.com/secureworks/taegis-sdk-python
 Author: Secureworks

taegis-sdk-python-1.0.2/taegis_sdk_python/_version.py

@@ -0,0 +1 @@
+__version__ = "v1.0.2"

{taegis-sdk-python-1.0.0rc1 → taegis-sdk-python-1.0.2}/taegis_sdk_python/service_core.py

@@ -13,7 +13,7 @@ from gql.transport.websockets import WebsocketsTransport
 from graphql import GraphQLField, GraphQLSchema, GraphQLError
 from taegis_sdk_python._version import __version__
 from taegis_sdk_python.errors import InvalidGraphQLEndpoint
-from taegis_sdk_python.utils import async_block, prepare_variables
+from taegis_sdk_python.utils import async_block, prepare_variables, remove_node
 
 if TYPE_CHECKING:  # pragma: no cover
     from taegis_sdk_python.services import GraphQLService
@@ -252,35 +252,31 @@ class ServiceCore:
         str
             GraphQL string
         """
+        query_string = self._build_output_query(
+            operation_type=operation_type,
+            endpoint=endpoint,
+            graphql_field=graphql_field,
+            output=output,
+        )
+        query_string = " ".join(query_string.split())
+
         # open a connection for introspection and download schema
         with self.sync_client as session:
             # if multiple fields are invalid, we want to iterate until the
             # output string is valid
-            while True:
-                query_string = self._build_output_query(
-                    operation_type=operation_type,
-                    endpoint=endpoint,
-                    graphql_field=graphql_field,
-                    output=output,
-                )
-
-                # we don't want to infinitely process this, so if we break
-                # if the output string doesn't exist, or all the fields have been
-                # removed
-                if not (output or any(char not in {" ", "{", "}"} for char in output)):
-                    break
-
+            for _ in range(10000):
                 try:
                     session.client.validate(gql(query_string))
                     break
 
                 except GraphQLError as exc:
                     if "Cannot query field" in exc.message:
-                        for node in exc.nodes:
-                            log.warning(
-                                f"{self.service.environment} - field {node.name.value} not found.  Removing from query string..."
-                            )
-                            output = output.replace(node.name.value, "")
+                        log.warning(
+                            f"{self.service.environment} - field {exc.nodes[0].name.value} not found.  Removing from query string..."
+                        )
+                        query_string = remove_node(
+                            query_string, exc.nodes[0], exc.locations[0]
+                        )
                     else:
                         raise exc
 

{taegis-sdk-python-1.0.0rc1 → taegis-sdk-python-1.0.2}/taegis_sdk_python/services/__init__.py

@@ -28,6 +28,7 @@ from taegis_sdk_python.services.entity_profile import EntityProfileService
 from taegis_sdk_python.services.event_search import EventSearchService
 from taegis_sdk_python.services.events import EventsService
 from taegis_sdk_python.services.exports import ExportsService
+from taegis_sdk_python.services.fast_ioc import FastIocService
 from taegis_sdk_python.services.investigations import InvestigationsService
 from taegis_sdk_python.services.investigations2 import Investigations2Service
 from taegis_sdk_python.services.mitre_attack_info import MitreAttackInfoService
@@ -37,6 +38,7 @@ from taegis_sdk_python.services.preferences import PreferencesService
 from taegis_sdk_python.services.roadrunner import RoadrunnerService
 from taegis_sdk_python.services.rules import RulesService
 from taegis_sdk_python.services.sharelinks import SharelinksService
+from taegis_sdk_python.services.tenant_profiles import TenantProfilesService
 from taegis_sdk_python.services.tenants import TenantsService
 from taegis_sdk_python.services.threat import ThreatService
 from taegis_sdk_python.services.trip import TripService
@@ -108,6 +110,7 @@ class GraphQLService:
         self._event_search = None
         self._events = None
         self._exports = None
+        self._fast_ioc = None
         self._investigations = None
         self._investigations2 = None
         self._mitre_attack_info = None
@@ -118,6 +121,7 @@ class GraphQLService:
         self._rules = None
         self._core = None
         self._sharelinks = None
+        self._tenant_profiles = None
         self._tenants = None
         self._threat = None
         self._trip = None
@@ -313,6 +317,13 @@ class GraphQLService:
             self._exports = ExportsService(self)
         return self._exports
 
+    @property
+    def fast_ioc(self):
+        """Fast IOC Service Endpoint."""
+        if not self._fast_ioc:
+            self._fast_ioc = FastIocService(self)
+        return self._fast_ioc
+
     @property
     def investigations(self):
         """Investigations Service Endpoint."""
@@ -383,6 +394,13 @@ class GraphQLService:
             self._sharelinks = SharelinksService(self)
         return self._sharelinks
 
+    @property
+    def tenant_profiles(self):
+        """Tenant Profiles Service Endpoint."""
+        if not self._tenant_profiles:
+            self._tenant_profiles = TenantProfilesService(self)
+        return self._tenant_profiles
+
     @property
     def tenants(self):
         """Tenants Service Endpoint."""

{taegis-sdk-python-1.0.0rc1 → taegis-sdk-python-1.0.2}/taegis_sdk_python/services/agent/types.py

@@ -51,6 +51,8 @@ class AgentChannel(str, Enum):
     CANARY = "CANARY"
     QE_PREV = "QE_PREV"
     QE_NEXT = "QE_NEXT"
+    WEEKLY = "WEEKLY"
+    WEEKLY_NEXT = "WEEKLY_NEXT"
 
 
 @dataclass_json

{taegis-sdk-python-1.0.0rc1 → taegis-sdk-python-1.0.2}/taegis_sdk_python/services/assets2/types.py

@@ -425,28 +425,43 @@ class AssetWhereInputV2:
     group_name_contains: Optional[str] = field(
         default=None, metadata=config(field_name="groupName_contains")
     )
+    group_name_autocomplete: Optional[str] = field(
+        default=None, metadata=config(field_name="groupName_autocomplete")
+    )
     host_id: Optional[str] = field(default=None, metadata=config(field_name="hostId"))
     host_id_contains: Optional[str] = field(
         default=None, metadata=config(field_name="hostId_contains")
     )
+    host_id_autocomplete: Optional[str] = field(
+        default=None, metadata=config(field_name="hostId_autocomplete")
+    )
     hostname: Optional[str] = field(
         default=None, metadata=config(field_name="hostname")
     )
     hostname_contains: Optional[str] = field(
         default=None, metadata=config(field_name="hostname_contains")
     )
+    hostname_autocomplete: Optional[str] = field(
+        default=None, metadata=config(field_name="hostname_autocomplete")
+    )
     investigation_id: Optional[str] = field(
         default=None, metadata=config(field_name="investigationId")
     )
     investigation_id_contains: Optional[str] = field(
         default=None, metadata=config(field_name="investigationId_contains")
     )
+    investigation_id_autocomplete: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationId_autocomplete")
+    )
     ip_address: Optional[str] = field(
         default=None, metadata=config(field_name="ipAddress")
     )
     ip_address_contains: Optional[str] = field(
         default=None, metadata=config(field_name="ipAddress_contains")
     )
+    ip_address_autocomplete: Optional[str] = field(
+        default=None, metadata=config(field_name="ipAddress_autocomplete")
+    )
     isolation_status: Optional[str] = field(
         default=None, metadata=config(field_name="isolationStatus")
     )
@@ -471,6 +486,9 @@ class AssetWhereInputV2:
     mac_address_contains: Optional[str] = field(
         default=None, metadata=config(field_name="macAddress_contains")
     )
+    mac_address_autocomplete: Optional[str] = field(
+        default=None, metadata=config(field_name="macAddress_autocomplete")
+    )
     os_distributor: Optional[str] = field(
         default=None, metadata=config(field_name="osDistributor")
     )
@@ -507,6 +525,9 @@ class AssetWhereInputV2:
     username_contains: Optional[str] = field(
         default=None, metadata=config(field_name="username_contains")
     )
+    username_autocomplete: Optional[str] = field(
+        default=None, metadata=config(field_name="username_autocomplete")
+    )
     and_: Optional[List["AssetWhereInputV2"]] = field(
         default=None, metadata=config(field_name="and")
     )
@@ -522,6 +543,9 @@ class AssetWhereInputV2:
     tags_contains: Optional[TagWhereInputV2] = field(
         default=None, metadata=config(field_name="tags_contains")
     )
+    tags_autocomplete: Optional[TagWhereInputV2] = field(
+        default=None, metadata=config(field_name="tags_autocomplete")
+    )
 
 
 @dataclass_json

{taegis-sdk-python-1.0.0rc1 → taegis-sdk-python-1.0.2}/taegis_sdk_python/services/clients/types.py

@@ -72,6 +72,12 @@ class Client:
     environment: Optional[str] = field(
         default=None, metadata=config(field_name="environment")
     )
+    token_request_time: Optional[str] = field(
+        default=None, metadata=config(field_name="token_request_time")
+    )
+    token_request_count: Optional[int] = field(
+        default=None, metadata=config(field_name="token_request_count")
+    )
     role_assignments: Optional[List[ClientRoleAssignment]] = field(
         default=None, metadata=config(field_name="role_assignments")
     )

{taegis-sdk-python-1.0.0rc1 → taegis-sdk-python-1.0.2}/taegis_sdk_python/services/collector/queries.py

@@ -45,6 +45,46 @@ class TaegisSDKCollectorQuery:
             return Cluster.from_dict(result.get(endpoint))
         raise GraphQLNoRowsInResultSetError("for query getCluster")
 
+    def get_cluster_backlog_count(
+        self, cluster_id: str, time_range: TimeRange
+    ) -> List[ClusterNodeTimeSeries]:
+        """None."""
+        endpoint = "getClusterBacklogCount"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "clusterID": prepare_input(cluster_id),
+                "timeRange": prepare_input(time_range),
+            },
+            output=build_output_string(ClusterNodeTimeSeries),
+        )
+        if result.get(endpoint) is not None:
+            return ClusterNodeTimeSeries.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query getClusterBacklogCount")
+
+    def get_cluster_backlog_age(
+        self, cluster_id: str, time_range: TimeRange
+    ) -> List[ClusterNodeTimeSeries]:
+        """None."""
+        endpoint = "getClusterBacklogAge"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "clusterID": prepare_input(cluster_id),
+                "timeRange": prepare_input(time_range),
+            },
+            output=build_output_string(ClusterNodeTimeSeries),
+        )
+        if result.get(endpoint) is not None:
+            return ClusterNodeTimeSeries.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query getClusterBacklogAge")
+
     def get_clusters_by_ids(self, cluster_ids: List[str]) -> List[Cluster]:
         """Get clusters by IDs."""
         endpoint = "getClustersByIDs"

{taegis-sdk-python-1.0.0rc1 → taegis-sdk-python-1.0.2}/taegis_sdk_python/services/collector/types.py

@@ -336,6 +336,15 @@ class AggregateRateByCollector:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class TimeSeries:
+    """TimeSeries."""
+
+    time: Optional[str] = field(default=None, metadata=config(field_name="time"))
+    value: Optional[str] = field(default=None, metadata=config(field_name="value"))
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class FlowRate:
@@ -619,6 +628,24 @@ class NetworkInput:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class ClusterNodeTimeSeries:
+    """ClusterNodeTimeSeries."""
+
+    cluster_id: Optional[str] = field(
+        default=None, metadata=config(field_name="clusterID")
+    )
+    tenant: Optional[str] = field(default=None, metadata=config(field_name="tenant"))
+    node_id: Optional[str] = field(default=None, metadata=config(field_name="nodeId"))
+    node_name: Optional[str] = field(
+        default=None, metadata=config(field_name="nodeName")
+    )
+    val: Optional[List[TimeSeries]] = field(
+        default=None, metadata=config(field_name="val")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class LogLastSeenMetrics:

{taegis-sdk-python-1.0.0rc1 → taegis-sdk-python-1.0.2}/taegis_sdk_python/services/endpoint_management_service/types.py

@@ -65,6 +65,9 @@ class EndpointGroup:
     is_system_generated: Optional[bool] = field(
         default=None, metadata=config(field_name="isSystemGenerated")
     )
+    is_default: Optional[bool] = field(
+        default=None, metadata=config(field_name="isDefault")
+    )
     desired_agent_version: Optional[str] = field(
         default=None, metadata=config(field_name="desiredAgentVersion")
     )

{taegis-sdk-python-1.0.0rc1 → taegis-sdk-python-1.0.2}/taegis_sdk_python/services/events/types.py

@@ -78,6 +78,17 @@ class LogicalType(str, Enum):
     TIMESTAMP = "Timestamp"
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class BackendTargetingStrategy:
+    """BackendTargetingStrategy."""
+
+    primary: Optional[int] = field(default=None, metadata=config(field_name="primary"))
+    exclude: Optional[List[int]] = field(
+        default=None, metadata=config(field_name="exclude")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class Event:
@@ -85,6 +96,9 @@ class Event:
 
     id: Optional[str] = field(default=None, metadata=config(field_name="id"))
     values: Optional[dict] = field(default=None, metadata=config(field_name="values"))
+    backends: Optional[List[int]] = field(
+        default=None, metadata=config(field_name="backends")
+    )
 
 
 @dataclass_json
@@ -144,6 +158,27 @@ class EventFetchOptions:
     normalize_event_keys: Optional[bool] = field(
         default=None, metadata=config(field_name="normalizeEventKeys")
     )
+    backend_strategy: Optional[BackendTargetingStrategy] = field(
+        default=None, metadata=config(field_name="backendStrategy")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class Field:
+    """Field."""
+
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    searchable: Optional[bool] = field(
+        default=None, metadata=config(field_name="searchable")
+    )
+    debug: Optional[bool] = field(default=None, metadata=config(field_name="debug"))
+    base_type: Optional[BaseType] = field(
+        default=None, metadata=config(field_name="baseType")
+    )
+    logical_type: Optional[LogicalType] = field(
+        default=None, metadata=config(field_name="logicalType")
+    )
 
 
 @dataclass_json
@@ -171,28 +206,27 @@ class EventQueryOptions:
         default=None, metadata=config(field_name="includeMitreAttackInfoData")
     )
     save_to_cache: Optional[bool] = field(
-        default=None, metadata=config(field_name="saveToCache")
+        default=None,
+        metadata=config(
+            metadata={
+                "deprecated": True,
+                "deprecation_reason": "Moving to backendStrategy as an exclusion option",
+            },
+            field_name="saveToCache",
+        ),
     )
     search_target: Optional[SearchTarget] = field(
-        default=None, metadata=config(field_name="searchTarget")
-    )
-
-
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class Field:
-    """Field."""
-
-    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
-    searchable: Optional[bool] = field(
-        default=None, metadata=config(field_name="searchable")
-    )
-    debug: Optional[bool] = field(default=None, metadata=config(field_name="debug"))
-    base_type: Optional[BaseType] = field(
-        default=None, metadata=config(field_name="baseType")
+        default=None,
+        metadata=config(
+            metadata={
+                "deprecated": True,
+                "deprecation_reason": "Moving to backendStrategy",
+            },
+            field_name="searchTarget",
+        ),
     )
-    logical_type: Optional[LogicalType] = field(
-        default=None, metadata=config(field_name="logicalType")
+    backend_strategy: Optional[BackendTargetingStrategy] = field(
+        default=None, metadata=config(field_name="backendStrategy")
     )
 
 
@@ -212,7 +246,19 @@ class EventQueryResult:
         default=None, metadata=config(field_name="completed")
     )
     expires: Optional[str] = field(default=None, metadata=config(field_name="expires"))
-    backend: Optional[str] = field(default=None, metadata=config(field_name="backend"))
+    backend: Optional[str] = field(
+        default=None,
+        metadata=config(
+            metadata={
+                "deprecated": True,
+                "deprecation_reason": "Moved to backendTarget",
+            },
+            field_name="backend",
+        ),
+    )
+    backend_target: Optional[int] = field(
+        default=None, metadata=config(field_name="backendTarget")
+    )
     facets: Optional[dict] = field(default=None, metadata=config(field_name="facets"))
     rows: Optional[List[dict]] = field(default=None, metadata=config(field_name="rows"))
     progress: Optional[EventQueryProgress] = field(

{taegis-sdk-python-1.0.0rc1 → taegis-sdk-python-1.0.2}/taegis_sdk_python/services/exports/types.py

@@ -310,45 +310,6 @@ class SchedulesFilters:
     )
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class ScheduleEditInput:
-    """ScheduleEditInput."""
-
-    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
-    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
-    description: Optional[str] = field(
-        default=None, metadata=config(field_name="description")
-    )
-    filters: Optional[dict] = field(default=None, metadata=config(field_name="filters"))
-    interval: Optional[int] = field(
-        default=None, metadata=config(field_name="interval")
-    )
-    day_of_month: Optional[int] = field(
-        default=None, metadata=config(field_name="dayOfMonth")
-    )
-    recipients: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="recipients")
-    )
-    red_ql_query: Optional[str] = field(
-        default=None, metadata=config(field_name="redQLQuery")
-    )
-    generate_csv_export: Optional[bool] = field(
-        default=None, metadata=config(field_name="generateCSVExport")
-    )
-    run_at: Optional[str] = field(default=None, metadata=config(field_name="runAt"))
-    share_with_admin_group: Optional[bool] = field(
-        default=None, metadata=config(field_name="shareWithAdminGroup")
-    )
-    locale: Optional[str] = field(default=None, metadata=config(field_name="locale"))
-    chart_type: Optional[ReportChartType] = field(
-        default=None, metadata=config(field_name="chartType")
-    )
-    cadence: Optional[Cadence] = field(
-        default=None, metadata=config(field_name="cadence")
-    )
-
-
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class ReportsFilters:
@@ -513,6 +474,48 @@ class AllSchedulesInput:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class ScheduleEditInput:
+    """ScheduleEditInput."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    description: Optional[str] = field(
+        default=None, metadata=config(field_name="description")
+    )
+    filters: Optional[dict] = field(default=None, metadata=config(field_name="filters"))
+    interval: Optional[int] = field(
+        default=None, metadata=config(field_name="interval")
+    )
+    day_of_month: Optional[int] = field(
+        default=None, metadata=config(field_name="dayOfMonth")
+    )
+    recipients: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="recipients")
+    )
+    red_ql_query: Optional[str] = field(
+        default=None, metadata=config(field_name="redQLQuery")
+    )
+    generate_csv_export: Optional[bool] = field(
+        default=None, metadata=config(field_name="generateCSVExport")
+    )
+    run_at: Optional[str] = field(default=None, metadata=config(field_name="runAt"))
+    share_with_admin_group: Optional[bool] = field(
+        default=None, metadata=config(field_name="shareWithAdminGroup")
+    )
+    locale: Optional[str] = field(default=None, metadata=config(field_name="locale"))
+    chart_type: Optional[ReportChartType] = field(
+        default=None, metadata=config(field_name="chartType")
+    )
+    cadence: Optional[Cadence] = field(
+        default=None, metadata=config(field_name="cadence")
+    )
+    export_types: Optional[List[ExportType]] = field(
+        default=None, metadata=config(field_name="exportTypes")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class NewScheduleInput:
@@ -558,6 +561,9 @@ class NewScheduleInput:
     cadence: Optional[Cadence] = field(
         default=None, metadata=config(field_name="cadence")
     )
+    export_types: Optional[List[ExportType]] = field(
+        default=None, metadata=config(field_name="exportTypes")
+    )
     visualizations: Optional[List[VisualizationInput]] = field(
         default=None, metadata=config(field_name="visualizations")
     )
@@ -620,6 +626,9 @@ class Schedule:
     creator: Optional[TDRUser] = field(
         default=None, metadata=config(field_name="creator")
     )
+    export_types: Optional[List[ExportType]] = field(
+        default=None, metadata=config(field_name="exportTypes")
+    )
     visualizations: Optional[List[Visualization]] = field(
         default=None, metadata=config(field_name="visualizations")
     )

taegis-sdk-python-1.0.2/taegis_sdk_python/services/fast_ioc/__init__.py

@@ -0,0 +1,29 @@
+""""FastIoc Service."""
+from taegis_sdk_python.service_core import ServiceCore
+from taegis_sdk_python.services.fast_ioc.mutations import TaegisSDKFastIocMutation
+from taegis_sdk_python.services.fast_ioc.queries import TaegisSDKFastIocQuery
+from taegis_sdk_python.services.fast_ioc.subscriptions import (
+    TaegisSDKFastIocSubscription,
+)
+
+
+class FastIocService(ServiceCore):
+    """Taegis FastIoc Service."""
+
+    @property
+    def query(self):
+        if not self._queries:
+            self._queries = TaegisSDKFastIocQuery(self)
+        return self._queries
+
+    @property
+    def mutation(self):
+        if not self._mutations:
+            self._mutations = TaegisSDKFastIocMutation(self)
+        return self._mutations
+
+    @property
+    def subscription(self):
+        if not self._subscriptions:
+            self._subscriptions = TaegisSDKFastIocSubscription(self)
+        return self._subscriptions

taegis-sdk-python-1.0.2/taegis_sdk_python/services/fast_ioc/mutations.py

@@ -0,0 +1,31 @@
+"""FastIoc Mutation."""
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+from taegis_sdk_python.services.fast_ioc.types import *
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.fast_ioc import FastIocService
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKFastIocMutation:
+    """Teagis Fast_ioc Mutation operations."""
+
+    def __init__(self, service: FastIocService):
+        self.service = service