taegis-sdk-python 1.0.1__tar.gz → 1.0.2__tar.gz

{taegis-sdk-python-1.0.1/taegis_sdk_python.egg-info → taegis-sdk-python-1.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: taegis-sdk-python
-Version: 1.0.1
+Version: 1.0.2
 Summary: Taegis Python SDK
 Home-page: https://github.com/secureworks/taegis-sdk-python
 Author: Secureworks

taegis-sdk-python-1.0.2/taegis_sdk_python/_version.py

@@ -0,0 +1 @@
+__version__ = "v1.0.2"

{taegis-sdk-python-1.0.1 → taegis-sdk-python-1.0.2}/taegis_sdk_python/service_core.py

@@ -13,7 +13,7 @@ from gql.transport.websockets import WebsocketsTransport
 from graphql import GraphQLField, GraphQLSchema, GraphQLError
 from taegis_sdk_python._version import __version__
 from taegis_sdk_python.errors import InvalidGraphQLEndpoint
-from taegis_sdk_python.utils import async_block, prepare_variables
+from taegis_sdk_python.utils import async_block, prepare_variables, remove_node
 
 if TYPE_CHECKING:  # pragma: no cover
     from taegis_sdk_python.services import GraphQLService
@@ -252,35 +252,31 @@ class ServiceCore:
         str
             GraphQL string
         """
+        query_string = self._build_output_query(
+            operation_type=operation_type,
+            endpoint=endpoint,
+            graphql_field=graphql_field,
+            output=output,
+        )
+        query_string = " ".join(query_string.split())
+
         # open a connection for introspection and download schema
         with self.sync_client as session:
             # if multiple fields are invalid, we want to iterate until the
             # output string is valid
-            while True:
-                query_string = self._build_output_query(
-                    operation_type=operation_type,
-                    endpoint=endpoint,
-                    graphql_field=graphql_field,
-                    output=output,
-                )
-
-                # we don't want to infinitely process this, so if we break
-                # if the output string doesn't exist, or all the fields have been
-                # removed
-                if not (output or any(char not in {" ", "{", "}"} for char in output)):
-                    break
-
+            for _ in range(10000):
                 try:
                     session.client.validate(gql(query_string))
                     break
 
                 except GraphQLError as exc:
                     if "Cannot query field" in exc.message:
-                        for node in exc.nodes:
-                            log.warning(
-                                f"{self.service.environment} - field {node.name.value} not found.  Removing from query string..."
-                            )
-                            output = output.replace(node.name.value, "")
+                        log.warning(
+                            f"{self.service.environment} - field {exc.nodes[0].name.value} not found.  Removing from query string..."
+                        )
+                        query_string = remove_node(
+                            query_string, exc.nodes[0], exc.locations[0]
+                        )
                     else:
                         raise exc
 

{taegis-sdk-python-1.0.1 → taegis-sdk-python-1.0.2}/taegis_sdk_python/services/__init__.py

@@ -28,6 +28,7 @@ from taegis_sdk_python.services.entity_profile import EntityProfileService
 from taegis_sdk_python.services.event_search import EventSearchService
 from taegis_sdk_python.services.events import EventsService
 from taegis_sdk_python.services.exports import ExportsService
+from taegis_sdk_python.services.fast_ioc import FastIocService
 from taegis_sdk_python.services.investigations import InvestigationsService
 from taegis_sdk_python.services.investigations2 import Investigations2Service
 from taegis_sdk_python.services.mitre_attack_info import MitreAttackInfoService
@@ -109,6 +110,7 @@ class GraphQLService:
         self._event_search = None
         self._events = None
         self._exports = None
+        self._fast_ioc = None
         self._investigations = None
         self._investigations2 = None
         self._mitre_attack_info = None
@@ -315,6 +317,13 @@ class GraphQLService:
             self._exports = ExportsService(self)
         return self._exports
 
+    @property
+    def fast_ioc(self):
+        """Fast IOC Service Endpoint."""
+        if not self._fast_ioc:
+            self._fast_ioc = FastIocService(self)
+        return self._fast_ioc
+
     @property
     def investigations(self):
         """Investigations Service Endpoint."""

{taegis-sdk-python-1.0.1 → taegis-sdk-python-1.0.2}/taegis_sdk_python/services/assets2/types.py

@@ -425,28 +425,43 @@ class AssetWhereInputV2:
     group_name_contains: Optional[str] = field(
         default=None, metadata=config(field_name="groupName_contains")
     )
+    group_name_autocomplete: Optional[str] = field(
+        default=None, metadata=config(field_name="groupName_autocomplete")
+    )
     host_id: Optional[str] = field(default=None, metadata=config(field_name="hostId"))
     host_id_contains: Optional[str] = field(
         default=None, metadata=config(field_name="hostId_contains")
     )
+    host_id_autocomplete: Optional[str] = field(
+        default=None, metadata=config(field_name="hostId_autocomplete")
+    )
     hostname: Optional[str] = field(
         default=None, metadata=config(field_name="hostname")
     )
     hostname_contains: Optional[str] = field(
         default=None, metadata=config(field_name="hostname_contains")
     )
+    hostname_autocomplete: Optional[str] = field(
+        default=None, metadata=config(field_name="hostname_autocomplete")
+    )
     investigation_id: Optional[str] = field(
         default=None, metadata=config(field_name="investigationId")
     )
     investigation_id_contains: Optional[str] = field(
         default=None, metadata=config(field_name="investigationId_contains")
     )
+    investigation_id_autocomplete: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationId_autocomplete")
+    )
     ip_address: Optional[str] = field(
         default=None, metadata=config(field_name="ipAddress")
     )
     ip_address_contains: Optional[str] = field(
         default=None, metadata=config(field_name="ipAddress_contains")
     )
+    ip_address_autocomplete: Optional[str] = field(
+        default=None, metadata=config(field_name="ipAddress_autocomplete")
+    )
     isolation_status: Optional[str] = field(
         default=None, metadata=config(field_name="isolationStatus")
     )
@@ -471,6 +486,9 @@ class AssetWhereInputV2:
     mac_address_contains: Optional[str] = field(
         default=None, metadata=config(field_name="macAddress_contains")
     )
+    mac_address_autocomplete: Optional[str] = field(
+        default=None, metadata=config(field_name="macAddress_autocomplete")
+    )
     os_distributor: Optional[str] = field(
         default=None, metadata=config(field_name="osDistributor")
     )
@@ -507,6 +525,9 @@ class AssetWhereInputV2:
     username_contains: Optional[str] = field(
         default=None, metadata=config(field_name="username_contains")
     )
+    username_autocomplete: Optional[str] = field(
+        default=None, metadata=config(field_name="username_autocomplete")
+    )
     and_: Optional[List["AssetWhereInputV2"]] = field(
         default=None, metadata=config(field_name="and")
     )
@@ -522,6 +543,9 @@ class AssetWhereInputV2:
     tags_contains: Optional[TagWhereInputV2] = field(
         default=None, metadata=config(field_name="tags_contains")
     )
+    tags_autocomplete: Optional[TagWhereInputV2] = field(
+        default=None, metadata=config(field_name="tags_autocomplete")
+    )
 
 
 @dataclass_json

{taegis-sdk-python-1.0.1 → taegis-sdk-python-1.0.2}/taegis_sdk_python/services/exports/types.py

@@ -310,45 +310,6 @@ class SchedulesFilters:
     )
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class ScheduleEditInput:
-    """ScheduleEditInput."""
-
-    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
-    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
-    description: Optional[str] = field(
-        default=None, metadata=config(field_name="description")
-    )
-    filters: Optional[dict] = field(default=None, metadata=config(field_name="filters"))
-    interval: Optional[int] = field(
-        default=None, metadata=config(field_name="interval")
-    )
-    day_of_month: Optional[int] = field(
-        default=None, metadata=config(field_name="dayOfMonth")
-    )
-    recipients: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="recipients")
-    )
-    red_ql_query: Optional[str] = field(
-        default=None, metadata=config(field_name="redQLQuery")
-    )
-    generate_csv_export: Optional[bool] = field(
-        default=None, metadata=config(field_name="generateCSVExport")
-    )
-    run_at: Optional[str] = field(default=None, metadata=config(field_name="runAt"))
-    share_with_admin_group: Optional[bool] = field(
-        default=None, metadata=config(field_name="shareWithAdminGroup")
-    )
-    locale: Optional[str] = field(default=None, metadata=config(field_name="locale"))
-    chart_type: Optional[ReportChartType] = field(
-        default=None, metadata=config(field_name="chartType")
-    )
-    cadence: Optional[Cadence] = field(
-        default=None, metadata=config(field_name="cadence")
-    )
-
-
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class ReportsFilters:
@@ -513,6 +474,48 @@ class AllSchedulesInput:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class ScheduleEditInput:
+    """ScheduleEditInput."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    description: Optional[str] = field(
+        default=None, metadata=config(field_name="description")
+    )
+    filters: Optional[dict] = field(default=None, metadata=config(field_name="filters"))
+    interval: Optional[int] = field(
+        default=None, metadata=config(field_name="interval")
+    )
+    day_of_month: Optional[int] = field(
+        default=None, metadata=config(field_name="dayOfMonth")
+    )
+    recipients: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="recipients")
+    )
+    red_ql_query: Optional[str] = field(
+        default=None, metadata=config(field_name="redQLQuery")
+    )
+    generate_csv_export: Optional[bool] = field(
+        default=None, metadata=config(field_name="generateCSVExport")
+    )
+    run_at: Optional[str] = field(default=None, metadata=config(field_name="runAt"))
+    share_with_admin_group: Optional[bool] = field(
+        default=None, metadata=config(field_name="shareWithAdminGroup")
+    )
+    locale: Optional[str] = field(default=None, metadata=config(field_name="locale"))
+    chart_type: Optional[ReportChartType] = field(
+        default=None, metadata=config(field_name="chartType")
+    )
+    cadence: Optional[Cadence] = field(
+        default=None, metadata=config(field_name="cadence")
+    )
+    export_types: Optional[List[ExportType]] = field(
+        default=None, metadata=config(field_name="exportTypes")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class NewScheduleInput:
@@ -558,6 +561,9 @@ class NewScheduleInput:
     cadence: Optional[Cadence] = field(
         default=None, metadata=config(field_name="cadence")
     )
+    export_types: Optional[List[ExportType]] = field(
+        default=None, metadata=config(field_name="exportTypes")
+    )
     visualizations: Optional[List[VisualizationInput]] = field(
         default=None, metadata=config(field_name="visualizations")
     )
@@ -620,6 +626,9 @@ class Schedule:
     creator: Optional[TDRUser] = field(
         default=None, metadata=config(field_name="creator")
     )
+    export_types: Optional[List[ExportType]] = field(
+        default=None, metadata=config(field_name="exportTypes")
+    )
     visualizations: Optional[List[Visualization]] = field(
         default=None, metadata=config(field_name="visualizations")
     )

taegis-sdk-python-1.0.2/taegis_sdk_python/services/fast_ioc/__init__.py

@@ -0,0 +1,29 @@
+""""FastIoc Service."""
+from taegis_sdk_python.service_core import ServiceCore
+from taegis_sdk_python.services.fast_ioc.mutations import TaegisSDKFastIocMutation
+from taegis_sdk_python.services.fast_ioc.queries import TaegisSDKFastIocQuery
+from taegis_sdk_python.services.fast_ioc.subscriptions import (
+    TaegisSDKFastIocSubscription,
+)
+
+
+class FastIocService(ServiceCore):
+    """Taegis FastIoc Service."""
+
+    @property
+    def query(self):
+        if not self._queries:
+            self._queries = TaegisSDKFastIocQuery(self)
+        return self._queries
+
+    @property
+    def mutation(self):
+        if not self._mutations:
+            self._mutations = TaegisSDKFastIocMutation(self)
+        return self._mutations
+
+    @property
+    def subscription(self):
+        if not self._subscriptions:
+            self._subscriptions = TaegisSDKFastIocSubscription(self)
+        return self._subscriptions

taegis-sdk-python-1.0.2/taegis_sdk_python/services/fast_ioc/mutations.py

@@ -0,0 +1,31 @@
+"""FastIoc Mutation."""
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+from taegis_sdk_python.services.fast_ioc.types import *
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.fast_ioc import FastIocService
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKFastIocMutation:
+    """Teagis Fast_ioc Mutation operations."""
+
+    def __init__(self, service: FastIocService):
+        self.service = service

taegis-sdk-python-1.0.2/taegis_sdk_python/services/fast_ioc/queries.py

@@ -0,0 +1,89 @@
+"""FastIoc Query."""
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+from taegis_sdk_python.services.fast_ioc.types import *
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.fast_ioc import FastIocService
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKFastIocQuery:
+    """Teagis Fast_ioc Query operations."""
+
+    def __init__(self, service: FastIocService):
+        self.service = service
+
+    def event_window(self, arguments: EventAggregationArguments) -> EventWindow:
+        """Return the earliest and latest timestamps found for events within provided time range."""
+        endpoint = "eventWindow"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "arguments": prepare_input(arguments),
+            },
+            output=build_output_string(EventWindow),
+        )
+        if result.get(endpoint) is not None:
+            return EventWindow.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query eventWindow")
+
+    def event_count_by_logical_type(
+        self, arguments: EventAggregationArguments
+    ) -> EventCountResult:
+        """Generate a breakdown (histogram) of the aggregated count of events
+        that match the given constraints. The result rows are broken down per eventType and per day..
+        """
+        endpoint = "eventCountByLogicalType"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "arguments": prepare_input(arguments),
+            },
+            output=build_output_string(EventCountResult),
+        )
+        if result.get(endpoint) is not None:
+            return EventCountResult.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query eventCountByLogicalType")
+
+    def event_count_page(
+        self,
+        next_token: str,
+        session_key: Optional[str] = None,
+        limit: Optional[int] = None,
+    ) -> EventCountResult:
+        """Returns next page of results for eventCountByLogicalType if available.
+        If sessionKey not provided will fallback to auth header (single tenant search only)..
+        """
+        endpoint = "eventCountPage"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "nextToken": prepare_input(next_token),
+                "sessionKey": prepare_input(session_key),
+                "limit": prepare_input(limit),
+            },
+            output=build_output_string(EventCountResult),
+        )
+        if result.get(endpoint) is not None:
+            return EventCountResult.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query eventCountPage")

taegis-sdk-python-1.0.2/taegis_sdk_python/services/fast_ioc/subscriptions.py

@@ -0,0 +1,31 @@
+"""FastIoc Subscription."""
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+from taegis_sdk_python.services.fast_ioc.types import *
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.fast_ioc import FastIocService
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKFastIocSubscription:
+    """Teagis Fast_ioc Subscription operations."""
+
+    def __init__(self, service: FastIocService):
+        self.service = service

taegis-sdk-python-1.0.2/taegis_sdk_python/services/fast_ioc/types.py

@@ -0,0 +1,114 @@
+"""FastIoc Types and Enums."""
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code
+
+# Autogenerated
+# DO NOT MODIFY
+
+from typing import Optional, List, Dict, Union, Any, Tuple
+
+
+from dataclasses import dataclass, field
+from dataclasses_json import dataclass_json, config
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EventWindow:
+    """EventWindow."""
+
+    earliest_event: Optional[str] = field(
+        default=None, metadata=config(field_name="earliestEvent")
+    )
+    latest_event: Optional[str] = field(
+        default=None, metadata=config(field_name="latestEvent")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class TenantCount:
+    """TenantCount."""
+
+    tenant_id: Optional[str] = field(
+        default=None, metadata=config(field_name="tenantId")
+    )
+    count: Optional[int] = field(default=None, metadata=config(field_name="count"))
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class LogicalTypeFilter:
+    """LogicalTypeFilter."""
+
+    logical_type: Optional[str] = field(
+        default=None, metadata=config(field_name="logicalType")
+    )
+    values: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="values")
+    )
+    operator: Optional[str] = field(
+        default=None, metadata=config(field_name="operator")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class TenantsInput:
+    """TenantsInput."""
+
+    tenant_ids: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="tenantIds")
+    )
+    session_key: Optional[str] = field(
+        default=None, metadata=config(field_name="sessionKey")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EventCountByLogicalType:
+    """EventCountByLogicalType."""
+
+    matching_value: Optional[str] = field(
+        default=None, metadata=config(field_name="matchingValue")
+    )
+    event_type: Optional[str] = field(
+        default=None, metadata=config(field_name="eventType")
+    )
+    date: Optional[str] = field(default=None, metadata=config(field_name="date"))
+    count: Optional[int] = field(default=None, metadata=config(field_name="count"))
+    counts_by_tenant: Optional[List[TenantCount]] = field(
+        default=None, metadata=config(field_name="countsByTenant")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EventCountResult:
+    """EventCountResult."""
+
+    next: Optional[str] = field(default=None, metadata=config(field_name="next"))
+    results: Optional[List[EventCountByLogicalType]] = field(
+        default=None, metadata=config(field_name="results")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EventAggregationArguments:
+    """EventAggregationArguments."""
+
+    event_type_filter: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="eventTypeFilter")
+    )
+    earliest: Optional[str] = field(
+        default=None, metadata=config(field_name="earliest")
+    )
+    latest: Optional[str] = field(default=None, metadata=config(field_name="latest"))
+    limit: Optional[int] = field(default=None, metadata=config(field_name="limit"))
+    logical_type_filter: Optional[LogicalTypeFilter] = field(
+        default=None, metadata=config(field_name="logicalTypeFilter")
+    )
+    tenants_context: Optional[TenantsInput] = field(
+        default=None, metadata=config(field_name="tenantsContext")
+    )