taegis-sdk-python 1.1.5__tar.gz → 1.1.7__tar.gz

{taegis-sdk-python-1.1.5/taegis_sdk_python.egg-info → taegis-sdk-python-1.1.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: taegis-sdk-python
-Version: 1.1.5
+Version: 1.1.7
 Summary: Taegis Python SDK
 Home-page: https://github.com/secureworks/taegis-sdk-python
 Author: Secureworks

taegis-sdk-python-1.1.7/taegis_sdk_python/_version.py

@@ -0,0 +1 @@
+__version__ = "v1.1.7"

{taegis-sdk-python-1.1.5 → taegis-sdk-python-1.1.7}/taegis_sdk_python/service_core.py

@@ -5,12 +5,13 @@ Taegis ServiceCore manager.
 from __future__ import annotations
 
 import logging
-from typing import TYPE_CHECKING, Dict, List, Optional, Any
+from datetime import datetime, timedelta
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Union
 
 from gql import Client, gql
 from gql.transport.requests import RequestsHTTPTransport
 from gql.transport.websockets import WebsocketsTransport
-from graphql import GraphQLField, GraphQLSchema, GraphQLError
+from graphql import GraphQLError, GraphQLField, GraphQLSchema
 from taegis_sdk_python._version import __version__
 from taegis_sdk_python.errors import InvalidGraphQLEndpoint
 from taegis_sdk_python.utils import async_block, prepare_variables, remove_node
@@ -22,6 +23,60 @@ if TYPE_CHECKING:  # pragma: no cover
 log = logging.getLogger(__name__)
 
 
+class SchemaCache:
+    """GraphQL Schema Cache."""
+
+    def __init__(self, schema: Optional[GraphQLSchema] = None, expires: int = 5):
+        """Initialize SchemaCache.
+
+        Parameters
+        ----------
+        schema : Optional[GraphQLSchema], optional
+            GraphQL schema object, by default None
+        expires : int, optional
+            Schema expires in minutes, by default 5
+        """
+        self._schema = schema
+        self._inserted_at = datetime.now()
+        self.expires = expires
+
+    @property
+    def schema(self) -> Union[GraphQLSchema, None]:
+        """Return GraphQLSchema if it exists and is not expired.
+
+        Returns
+        -------
+        Union[GraphQLSchema, None]
+            GraphQL Schema
+        """
+        if self._inserted_at + timedelta(minutes=self.expires) < datetime.now():
+            self.schema = None
+        return self._schema
+
+    @schema.setter
+    def schema(self, schema: Optional[GraphQLSchema]):
+        """Set schema and update inserted_at.
+
+        Parameters
+        ----------
+        schema :
+            _description_
+        """
+        if self._schema is not schema:
+            self._schema = schema
+            self._inserted_at = datetime.now()
+
+    def should_fetch_schema(self) -> bool:
+        """Return True if schema is should be fetched in transport.
+
+        Returns
+        -------
+        bool
+            True if schema is should be fetched in transport.
+        """
+        return not self.schema
+
+
 class ServiceCore:
     """Taegis GraphQL Service core functionality."""
 
@@ -31,22 +86,24 @@ class ServiceCore:
         self._urls = self.service._environments
         self._gateway = self.service._gateway
 
+        self._schema = SchemaCache(schema=None, expires=self.service.schema_expiry)
+
         self._queries = None
         self._mutations = None
         self._subscriptions = None
 
     @property
-    def sync_url(self):
+    def sync_url(self) -> str:
         """Syncronous URL."""
         return self.service.url or self._urls.get(self.service.environment)
 
     @property
-    def wss_url(self):
+    def wss_url(self) -> str:
         """WebSockets URL."""
         return self.sync_url.replace("https", "wss")
 
     @property
-    def gateway(self):
+    def gateway(self) -> str:
         """GraphQL Gateway"""
         return self.service.gateway or self._gateway
 
@@ -72,7 +129,16 @@ class ServiceCore:
             f"{self.sync_url}{self.gateway}",
             headers=self.service.headers,
         )
-        client = Client(transport=transport, fetch_schema_from_transport=True)
+
+        client = Client(
+            transport=transport,
+            schema=self._schema.schema,
+            fetch_schema_from_transport=self._schema.should_fetch_schema(),
+        )
+
+        with client:
+            self._schema.schema = client.schema
+
         return client
 
     @property
@@ -83,6 +149,12 @@ class ServiceCore:
             f"access-token-{self.service.access_token}",
         ]
 
+        # we cannot build the async client and use it to fetch the schema
+        # due to async issues with the transport.  This will grab the schema
+        # from a sync client and use it to build the async client.
+        if not self._schema.schema:
+            self.sync_client  # pylint: disable=pointless-statement
+
         if self.service.tenant_id:
             subprotocols.append(f"x-tenant-context-{self.service.tenant_id}")
 
@@ -92,10 +164,32 @@ class ServiceCore:
             subprotocols=subprotocols,
             connect_args={"max_size": None},
         )
-        client = Client(transport=transport, fetch_schema_from_transport=True)
+
+        client = Client(
+            transport=transport,
+            schema=self._schema.schema,
+            fetch_schema_from_transport=self._schema.should_fetch_schema(),
+        )
+
         return client
 
-    def get_sync_schema(self) -> GraphQLSchema:
+    @property
+    def schema(self) -> GraphQLSchema:
+        """Retrieves introspection schema from Synchronous endpoint.
+
+        Returns
+        -------
+        GraphQLSchema
+        """
+        if not self._schema.schema:
+            self.sync_client  # pylint: disable=pointless-statement
+        return self._schema.schema
+
+    def clear_schema(self):
+        """Clears the introspection schema."""
+        self._schema.schema = None
+
+    def get_sync_schema(self) -> Union[GraphQLSchema, None]:
         """Retrieves introspection schema from Synchronous endpoint.
 
         Returns
@@ -108,7 +202,7 @@ class ServiceCore:
         return schema
 
     @async_block
-    async def get_ws_schema(self) -> GraphQLSchema:
+    async def get_ws_schema(self) -> Union[GraphQLSchema, None]:
         """Retrieves introspection schema from WebSockets endpoint.
 
         Returns

{taegis-sdk-python-1.1.5 → taegis-sdk-python-1.1.7}/taegis_sdk_python/services/__init__.py

@@ -63,7 +63,8 @@ class GraphQLService:
         environments: Optional[Dict[str, str]] = None,
         gateway: Optional[str] = None,
         extra_headers: Optional[Dict[str, Any]] = None,
-    ):
+        schema_expiry: int = 5,
+    ):  # pylint: disable=too-many-statements
         """
         GraphQLService
 
@@ -79,6 +80,8 @@ class GraphQLService:
             Default Taegis Gateway, can be overwritten by service
         extra_headers: Optional[Dict[str, Any]], optional
             Extra HTTP Headers to be included in API calls
+        schema_expiry: int, optional
+            Expire time for GraphQL Schema Caching in minutes, by default 1
 
         Raises
         ------
@@ -99,6 +102,7 @@ class GraphQLService:
             self._extra_headers = {}
         else:
             self._extra_headers = extra_headers
+        self._schema_expiry = schema_expiry
 
         self._access_points = None
         self._agent = None
@@ -224,6 +228,11 @@ class GraphQLService:
 
         return headers
 
+    @property
+    def schema_expiry(self):
+        """GraphQL Schema Timeout."""
+        return self._context_manager.get("schema_expiry", self._schema_expiry)
+
     @property
     def access_points(self):
         """Access Points Service Endpoint."""

{taegis-sdk-python-1.1.5 → taegis-sdk-python-1.1.7}/taegis_sdk_python/services/audits/types.py

@@ -136,6 +136,9 @@ class AuditInput:
     tenant_id: Optional[str] = field(
         default=None, metadata=config(field_name="tenantId")
     )
+    event_name: Optional[str] = field(
+        default=None, metadata=config(field_name="eventName")
+    )
     event_name_index: Optional[int] = field(
         default=None, metadata=config(field_name="eventNameIndex")
     )

{taegis-sdk-python-1.1.5 → taegis-sdk-python-1.1.7}/taegis_sdk_python/services/detector_registry/types.py

@@ -44,6 +44,9 @@ class SearchDetectors:
     alerting_rule: Optional[bool] = field(
         default=None, metadata=config(field_name="alertingRule")
     )
+    should_compact: Optional[bool] = field(
+        default=None, metadata=config(field_name="shouldCompact")
+    )
     created_on_or_after: Optional[str] = field(
         default=None, metadata=config(field_name="createdOnOrAfter")
     )
@@ -80,6 +83,9 @@ class RegisteredDetector:
     alerting_rule: Optional[bool] = field(
         default=None, metadata=config(field_name="alertingRule")
     )
+    should_compact: Optional[bool] = field(
+        default=None, metadata=config(field_name="shouldCompact")
+    )
     created_at: Optional[str] = field(
         default=None, metadata=config(field_name="createdAt")
     )

{taegis-sdk-python-1.1.5 → taegis-sdk-python-1.1.7}/taegis_sdk_python/services/investigations2/types.py

@@ -689,6 +689,14 @@ class TDRUser:
     id: Optional[str] = field(default=None, metadata=config(field_name="id"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class Subject:
+    """Subject."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class InvestigationFileMeta:
@@ -918,38 +926,6 @@ class ExportInvestigationResourcesArgument:
     )
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class InvestigationV2TimelineEntity:
-    """InvestigationV2TimelineEntity."""
-
-    type: Optional[str] = field(default=None, metadata=config(field_name="type"))
-    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
-    investigation_id: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationId")
-    )
-    tenant_id: Optional[str] = field(
-        default=None, metadata=config(field_name="tenantId")
-    )
-    created_at: Optional[str] = field(
-        default=None, metadata=config(field_name="createdAt")
-    )
-    timestamp: Optional[str] = field(
-        default=None, metadata=config(field_name="timestamp")
-    )
-    entity_id: Optional[str] = field(
-        default=None, metadata=config(field_name="entityId")
-    )
-    description: Optional[str] = field(
-        default=None, metadata=config(field_name="description")
-    )
-    descriptor: Optional[str] = field(
-        default=None, metadata=config(field_name="descriptor")
-    )
-    user_id: Optional[str] = field(default=None, metadata=config(field_name="userId"))
-    user: Optional[TDRUser] = field(default=None, metadata=config(field_name="user"))
-
-
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class InvestigationV2Type:
@@ -1079,6 +1055,41 @@ class InvestigationV2TimelineArguments:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class InvestigationV2TimelineEntity:
+    """InvestigationV2TimelineEntity."""
+
+    type: Optional[str] = field(default=None, metadata=config(field_name="type"))
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    investigation_id: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationId")
+    )
+    tenant_id: Optional[str] = field(
+        default=None, metadata=config(field_name="tenantId")
+    )
+    created_at: Optional[str] = field(
+        default=None, metadata=config(field_name="createdAt")
+    )
+    timestamp: Optional[str] = field(
+        default=None, metadata=config(field_name="timestamp")
+    )
+    entity_id: Optional[str] = field(
+        default=None, metadata=config(field_name="entityId")
+    )
+    description: Optional[str] = field(
+        default=None, metadata=config(field_name="description")
+    )
+    descriptor: Optional[str] = field(
+        default=None, metadata=config(field_name="descriptor")
+    )
+    user_id: Optional[str] = field(default=None, metadata=config(field_name="userId"))
+    user: Optional[TDRUser] = field(default=None, metadata=config(field_name="user"))
+    user_subject: Optional[Subject] = field(
+        default=None, metadata=config(field_name="userSubject")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class CommentsV2Arguments:
@@ -1113,6 +1124,22 @@ class AggregatedCounts:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class InvestigationProcessingStatus:
+    """InvestigationProcessingStatus."""
+
+    assets: Optional[InvestigationProcessingState] = field(
+        default=None, metadata=config(field_name="assets")
+    )
+    events: Optional[InvestigationProcessingState] = field(
+        default=None, metadata=config(field_name="events")
+    )
+    alerts: Optional[InvestigationProcessingState] = field(
+        default=None, metadata=config(field_name="alerts")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class InvestigationTemplate:
@@ -1167,72 +1194,20 @@ class InvestigationTemplate:
     created_by: Optional[TDRUser] = field(
         default=None, metadata=config(field_name="createdBy")
     )
+    created_by_subject: Optional[Subject] = field(
+        default=None, metadata=config(field_name="createdBySubject")
+    )
     updated_by: Optional[TDRUser] = field(
         default=None, metadata=config(field_name="updatedBy")
     )
+    updated_by_subject: Optional[Subject] = field(
+        default=None, metadata=config(field_name="updatedBySubject")
+    )
     investigation_assignee_user: Optional[TDRUser] = field(
         default=None, metadata=config(field_name="investigationAssigneeUser")
     )
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class InvestigationProcessingStatus:
-    """InvestigationProcessingStatus."""
-
-    assets: Optional[InvestigationProcessingState] = field(
-        default=None, metadata=config(field_name="assets")
-    )
-    events: Optional[InvestigationProcessingState] = field(
-        default=None, metadata=config(field_name="events")
-    )
-    alerts: Optional[InvestigationProcessingState] = field(
-        default=None, metadata=config(field_name="alerts")
-    )
-
-
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class CommentV2:
-    """CommentV2."""
-
-    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
-    created_at: Optional[str] = field(
-        default=None, metadata=config(field_name="createdAt")
-    )
-    updated_at: Optional[str] = field(
-        default=None, metadata=config(field_name="updatedAt")
-    )
-    author_id: Optional[str] = field(
-        default=None, metadata=config(field_name="authorId")
-    )
-    comment: Optional[str] = field(default=None, metadata=config(field_name="comment"))
-    investigation_id: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationId")
-    )
-    tenant_id: Optional[str] = field(
-        default=None, metadata=config(field_name="tenantId")
-    )
-    mentions_ids: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="mentionsIds")
-    )
-    read_by_ids: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="readByIds")
-    )
-    is_internal: Optional[bool] = field(
-        default=None, metadata=config(field_name="isInternal")
-    )
-    author: Optional[TDRUser] = field(
-        default=None, metadata=config(field_name="author")
-    )
-    mentions_users: Optional[List[TDRUser]] = field(
-        default=None, metadata=config(field_name="mentionsUsers")
-    )
-    read_by: Optional[List[TDRUser]] = field(
-        default=None, metadata=config(field_name="readBy")
-    )
-
-
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class InvestigationFileV2:
@@ -1270,9 +1245,15 @@ class InvestigationFileV2:
     uploaded_by: Optional[TDRUser] = field(
         default=None, metadata=config(field_name="uploadedBy")
     )
+    uploaded_by_subject: Optional[Subject] = field(
+        default=None, metadata=config(field_name="uploadedBySubject")
+    )
     deleted_by: Optional[TDRUser] = field(
         default=None, metadata=config(field_name="deletedBy")
     )
+    deleted_by_subject: Optional[Subject] = field(
+        default=None, metadata=config(field_name="deletedBySubject")
+    )
     metadata: Optional[InvestigationFileMeta] = field(
         default=None, metadata=config(field_name="metadata")
     )
@@ -1354,9 +1335,15 @@ class InvestigationRule:
     created_by: Optional[TDRUser] = field(
         default=None, metadata=config(field_name="createdBy")
     )
+    created_by_subject: Optional[Subject] = field(
+        default=None, metadata=config(field_name="createdBySubject")
+    )
     updated_by: Optional[TDRUser] = field(
         default=None, metadata=config(field_name="updatedBy")
     )
+    updated_by_subject: Optional[Subject] = field(
+        default=None, metadata=config(field_name="updatedBySubject")
+    )
     state: Optional[InvestigationRuleState] = field(
         default=None, metadata=config(field_name="state")
     )
@@ -1365,6 +1352,57 @@ class InvestigationRule:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class CommentV2:
+    """CommentV2."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    created_at: Optional[str] = field(
+        default=None, metadata=config(field_name="createdAt")
+    )
+    updated_at: Optional[str] = field(
+        default=None, metadata=config(field_name="updatedAt")
+    )
+    author_id: Optional[str] = field(
+        default=None, metadata=config(field_name="authorId")
+    )
+    comment: Optional[str] = field(default=None, metadata=config(field_name="comment"))
+    investigation_id: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationId")
+    )
+    tenant_id: Optional[str] = field(
+        default=None, metadata=config(field_name="tenantId")
+    )
+    mentions_ids: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="mentionsIds")
+    )
+    read_by_ids: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="readByIds")
+    )
+    is_internal: Optional[bool] = field(
+        default=None, metadata=config(field_name="isInternal")
+    )
+    author: Optional[TDRUser] = field(
+        default=None, metadata=config(field_name="author")
+    )
+    author_subject: Optional[Subject] = field(
+        default=None, metadata=config(field_name="authorSubject")
+    )
+    mentions_subjects: Optional[List[Subject]] = field(
+        default=None, metadata=config(field_name="mentionsSubjects")
+    )
+    mentions_users: Optional[List[TDRUser]] = field(
+        default=None, metadata=config(field_name="mentionsUsers")
+    )
+    read_by_subjects: Optional[List[Subject]] = field(
+        default=None, metadata=config(field_name="readBySubjects")
+    )
+    read_by: Optional[List[TDRUser]] = field(
+        default=None, metadata=config(field_name="readBy")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class InvestigationV2:
@@ -1489,15 +1527,27 @@ class InvestigationV2:
     contributors: Optional[List[TDRUser]] = field(
         default=None, metadata=config(field_name="contributors")
     )
+    contributor_subjects: Optional[List[Subject]] = field(
+        default=None, metadata=config(field_name="contributorSubjects")
+    )
     assignee: Optional[TDRUser] = field(
         default=None, metadata=config(field_name="assignee")
     )
+    assignee_subject: Optional[Subject] = field(
+        default=None, metadata=config(field_name="assigneeSubject")
+    )
     created_by: Optional[TDRUser] = field(
         default=None, metadata=config(field_name="createdBy")
     )
+    created_by_subject: Optional[Subject] = field(
+        default=None, metadata=config(field_name="createdBySubject")
+    )
     updated_by: Optional[TDRUser] = field(
         default=None, metadata=config(field_name="updatedBy")
     )
+    updated_by_subject: Optional[Subject] = field(
+        default=None, metadata=config(field_name="updatedBySubject")
+    )
     type: Optional[InvestigationType] = field(
         default=None, metadata=config(field_name="type")
     )

{taegis-sdk-python-1.1.5 → taegis-sdk-python-1.1.7}/taegis_sdk_python/services/preferences/mutations.py

@@ -159,3 +159,37 @@ class TaegisSDKPreferencesMutation:
         if result.get(endpoint) is not None:
             return PartnerPreference.from_dict(result.get(endpoint))
         raise GraphQLNoRowsInResultSetError("for mutation savePartnerPreferences")
+
+    def set_user_preferences(
+        self, user_preference_input: UserPreferenceInput
+    ) -> UserPreferenceDictionary:
+        """None."""
+        endpoint = "setUserPreferences"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "userPreferenceInput": prepare_input(user_preference_input),
+            },
+            output=build_output_string(UserPreferenceDictionary),
+        )
+        if result.get(endpoint) is not None:
+            return UserPreferenceDictionary.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for mutation setUserPreferences")
+
+    def unset_user_preferences(
+        self, unset_preference_selector: Optional[UnsetPreferenceSelector] = None
+    ) -> UserPreferenceDictionary:
+        """None."""
+        endpoint = "unsetUserPreferences"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "unsetPreferenceSelector": prepare_input(unset_preference_selector),
+            },
+            output=build_output_string(UserPreferenceDictionary),
+        )
+        if result.get(endpoint) is not None:
+            return UserPreferenceDictionary.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for mutation unsetUserPreferences")

{taegis-sdk-python-1.1.5 → taegis-sdk-python-1.1.7}/taegis_sdk_python/services/preferences/types.py

@@ -175,6 +175,23 @@ class listAllTenantPreferencesInput:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class UserPreferenceInput:
+    """UserPreferenceInput."""
+
+    category: Optional[str] = field(
+        default=None, metadata=config(field_name="category")
+    )
+    sub_key: Optional[str] = field(default=None, metadata=config(field_name="subKey"))
+    preference_items: Optional[dict] = field(
+        default=None, metadata=config(field_name="preferenceItems")
+    )
+    is_global: Optional[bool] = field(
+        default=None, metadata=config(field_name="isGlobal")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class PartnerPreference:
@@ -209,6 +226,42 @@ class PartnerPreference:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class UserPreferenceDictionary:
+    """UserPreferenceDictionary."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    user_id: Optional[str] = field(default=None, metadata=config(field_name="userID"))
+    category: Optional[str] = field(
+        default=None, metadata=config(field_name="category")
+    )
+    sub_key: Optional[str] = field(default=None, metadata=config(field_name="subKey"))
+    preferences: Optional[dict] = field(
+        default=None, metadata=config(field_name="preferences")
+    )
+    environment: Optional[str] = field(
+        default=None, metadata=config(field_name="environment")
+    )
+    created_at: Optional[str] = field(
+        default=None, metadata=config(field_name="createdAt")
+    )
+    updated_at: Optional[str] = field(
+        default=None, metadata=config(field_name="updatedAt")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class UnsetPreferenceSelector:
+    """UnsetPreferenceSelector."""
+
+    category: Optional[str] = field(
+        default=None, metadata=config(field_name="category")
+    )
+    sub_key: Optional[str] = field(default=None, metadata=config(field_name="subKey"))
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class UserPreference: