taegis-sdk-python 1.2.10__tar.gz → 1.2.13__tar.gz

{taegis_sdk_python-1.2.10/taegis_sdk_python.egg-info → taegis_sdk_python-1.2.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: taegis-sdk-python
-Version: 1.2.10
+Version: 1.2.13
 Summary: Taegis Python SDK
 Home-page: https://github.com/secureworks/taegis-sdk-python
 Author: Secureworks

taegis_sdk_python-1.2.13/taegis_sdk_python/_version.py

@@ -0,0 +1 @@
+__version__ = "v1.2.13"

{taegis_sdk_python-1.2.10 → taegis_sdk_python-1.2.13}/taegis_sdk_python/services/assets2/types.py

@@ -1150,6 +1150,9 @@ class AssetWhereInputV2:
     system_type: Optional[str] = field(
         default=None, metadata=config(field_name="systemType")
     )
+    un_installable: Optional[bool] = field(
+        default=None, metadata=config(field_name="unInstallable")
+    )
     updated_at: Optional[str] = field(
         default=None, metadata=config(field_name="updatedAt")
     )

{taegis_sdk_python-1.2.10 → taegis_sdk_python-1.2.13}/taegis_sdk_python/services/endpoint_command_manager/mutations.py

@@ -186,3 +186,33 @@ class TaegisSDKEndpointCommandManagerMutation:
         if result.get(endpoint) is not None:
             return Result.from_dict(result.get(endpoint))
         raise GraphQLNoRowsInResultSetError("for mutation sendUnblockUser")
+
+    def release_file(self, input_: QuarantinedFileCommandInput) -> Result:
+        """release a file from quarantine."""
+        endpoint = "releaseFile"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "input": prepare_input(input_),
+            },
+            output=build_output_string(Result),
+        )
+        if result.get(endpoint) is not None:
+            return Result.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for mutation releaseFile")
+
+    def delete_file(self, input_: QuarantinedFileCommandInput) -> Result:
+        """issue the command to the endpoint to delete a file that has been quarantined."""
+        endpoint = "deleteFile"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "input": prepare_input(input_),
+            },
+            output=build_output_string(Result),
+        )
+        if result.get(endpoint) is not None:
+            return Result.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for mutation deleteFile")

{taegis_sdk_python-1.2.10 → taegis_sdk_python-1.2.13}/taegis_sdk_python/services/endpoint_command_manager/types.py

@@ -183,6 +183,24 @@ class IsolationExclusionRuleResult:
     reason: Optional[str] = field(default=None, metadata=config(field_name="Reason"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class QuarantinedFileCommandInput:
+    """QuarantinedFileCommandInput."""
+
+    endpoint_id: Optional[str] = field(
+        default=None, metadata=config(field_name="EndpointID")
+    )
+    file_id: Optional[str] = field(default=None, metadata=config(field_name="FileID"))
+    file_path: Optional[str] = field(
+        default=None, metadata=config(field_name="FilePath")
+    )
+    reason: Optional[str] = field(default=None, metadata=config(field_name="Reason"))
+    request_id: Optional[str] = field(
+        default=None, metadata=config(field_name="RequestID")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class HashAndType:

{taegis_sdk_python-1.2.10 → taegis_sdk_python-1.2.13}/taegis_sdk_python/services/investigations2/types.py

@@ -79,6 +79,7 @@ class InvestigationType(str, Enum):
     MANAGED_XDR_OT_INVESTIGATION = "MANAGED_XDR_OT_INVESTIGATION"
     OT_INVESTIGATION = "OT_INVESTIGATION"
     DETECTION_RESEARCH = "DETECTION_RESEARCH"
+    INFORMATIONAL = "INFORMATIONAL"
 
 
 class InvestigationProcessingState(str, Enum):

{taegis_sdk_python-1.2.10 → taegis_sdk_python-1.2.13}/taegis_sdk_python/services/tenant_profiles/types.py

@@ -74,6 +74,7 @@ class SecurityControlServiceMtp(str, Enum):
     SECURE_EMAIL_GATEWAY = "SECURE_EMAIL_GATEWAY"
     VPN_GATEWAY = "VPN_GATEWAY"
     VULNERABILITY_SCANNING = "VULNERABILITY_SCANNING"
+    DOMAIN_CONTROLLER = "DOMAIN_CONTROLLER"
     OTHER = "OTHER"
 
 

{taegis_sdk_python-1.2.10 → taegis_sdk_python-1.2.13}/taegis_sdk_python/services/tenants/types.py

@@ -108,6 +108,13 @@ class SSOConnectionStatus(str, Enum):
     DISABLED = "Disabled"
 
 
+class ExternalProvider(str, Enum):
+    """ExternalProvider."""
+
+    AUTH0 = "AUTH0"
+    COGNITO = "COGNITO"
+
+
 class Auth0DomainType(str, Enum):
     """Auth0DomainType."""
 
@@ -1124,65 +1131,6 @@ class TenantSSOConnectionQueryInput:
     )
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class SSOConnection:
-    """SSOConnection."""
-
-    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
-    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
-    external_name: Optional[str] = field(
-        default=None, metadata=config(field_name="externalName")
-    )
-    external_id: Optional[str] = field(
-        default=None, metadata=config(field_name="externalID")
-    )
-    tenant_id: Optional[str] = field(
-        default=None, metadata=config(field_name="tenantID")
-    )
-    updated_at: Optional[str] = field(
-        default=None, metadata=config(field_name="updatedAt")
-    )
-    created_at: Optional[str] = field(
-        default=None, metadata=config(field_name="createdAt")
-    )
-    cert_name: Optional[str] = field(
-        default=None, metadata=config(field_name="certName")
-    )
-    expires_at: Optional[str] = field(
-        default=None, metadata=config(field_name="expiresAt")
-    )
-    not_before: Optional[str] = field(
-        default=None, metadata=config(field_name="notBefore")
-    )
-    issuer: Optional[str] = field(default=None, metadata=config(field_name="issuer"))
-    subject: Optional[str] = field(default=None, metadata=config(field_name="subject"))
-    domains: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="domains")
-    )
-    testers: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="testers")
-    )
-    type: Optional[SSOConnectionType] = field(
-        default=None, metadata=config(field_name="type")
-    )
-    status: Optional[SSOConnectionStatus] = field(
-        default=None, metadata=config(field_name="status")
-    )
-    environment: Optional[SSOEnvironment] = field(
-        default=None, metadata=config(field_name="environment")
-    )
-    sso_connection_parameters: Optional[SSOConnectionParameters] = field(
-        default=None, metadata=config(field_name="ssoConnectionParameters")
-    )
-    sso_connection_idp_config: Optional[SSOConnectionConfiguration] = field(
-        default=None, metadata=config(field_name="ssoConnectionIDPConfig")
-    )
-    auth0_domain_type: Optional[Auth0DomainType] = field(
-        default=None, metadata=config(field_name="auth0DomainType")
-    )
-
-
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class Tenant:
@@ -1273,6 +1221,68 @@ class Tenant:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class SSOConnection:
+    """SSOConnection."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    external_name: Optional[str] = field(
+        default=None, metadata=config(field_name="externalName")
+    )
+    external_id: Optional[str] = field(
+        default=None, metadata=config(field_name="externalID")
+    )
+    tenant_id: Optional[str] = field(
+        default=None, metadata=config(field_name="tenantID")
+    )
+    updated_at: Optional[str] = field(
+        default=None, metadata=config(field_name="updatedAt")
+    )
+    created_at: Optional[str] = field(
+        default=None, metadata=config(field_name="createdAt")
+    )
+    cert_name: Optional[str] = field(
+        default=None, metadata=config(field_name="certName")
+    )
+    expires_at: Optional[str] = field(
+        default=None, metadata=config(field_name="expiresAt")
+    )
+    not_before: Optional[str] = field(
+        default=None, metadata=config(field_name="notBefore")
+    )
+    issuer: Optional[str] = field(default=None, metadata=config(field_name="issuer"))
+    subject: Optional[str] = field(default=None, metadata=config(field_name="subject"))
+    domains: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="domains")
+    )
+    testers: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="testers")
+    )
+    type: Optional[SSOConnectionType] = field(
+        default=None, metadata=config(field_name="type")
+    )
+    status: Optional[SSOConnectionStatus] = field(
+        default=None, metadata=config(field_name="status")
+    )
+    environment: Optional[SSOEnvironment] = field(
+        default=None, metadata=config(field_name="environment")
+    )
+    external_provider: Optional[ExternalProvider] = field(
+        default=None, metadata=config(field_name="externalProvider")
+    )
+    sso_connection_parameters: Optional[SSOConnectionParameters] = field(
+        default=None, metadata=config(field_name="ssoConnectionParameters")
+    )
+    sso_connection_idp_config: Optional[SSOConnectionConfiguration] = field(
+        default=None, metadata=config(field_name="ssoConnectionIDPConfig")
+    )
+    auth0_domain_type: Optional[Auth0DomainType] = field(
+        default=None, metadata=config(field_name="auth0DomainType")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class TenantsQuery:

{taegis_sdk_python-1.2.10 → taegis_sdk_python-1.2.13}/taegis_sdk_python/services/threat/types.py

@@ -270,6 +270,14 @@ class ThreatObjectType(str, Enum):
     REPORT = "report"
     COUNTRY = "country"
     CVE = "CVE"
+    SWID = "swid"
+    XDR_EVENT_FILTER = "xdr_event_filter"
+    ATTACK_TACTIC = "attack_tactic"
+    ATTACK_TECHNIQUE = "attack_technique"
+    RED_CLOAK_WATCH_LIST = "red_cloak_watch_list"
+    RED_CLOAK_INSPECTOR_RULE = "red_cloak_inspector_rule"
+    RED_CLOAK_YARA_RULE = "red_cloak_yara_rule"
+    TAEGIS_YARA_RULE = "taegis_yara_rule"
 
 
 @dataclass_json
@@ -362,38 +370,6 @@ class ThreatTip:
     )
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class ThreatSwid:
-    """ThreatSwid."""
-
-    id: Optional[str] = field(default=None, metadata=config(field_name="Id"))
-    author: Optional[str] = field(default=None, metadata=config(field_name="Author"))
-    created_at: Optional[str] = field(
-        default=None, metadata=config(field_name="CreatedAt")
-    )
-    engine_group_name: Optional[str] = field(
-        default=None, metadata=config(field_name="EngineGroupName")
-    )
-    file_name: Optional[str] = field(
-        default=None, metadata=config(field_name="FileName")
-    )
-    priority: Optional[int] = field(
-        default=None, metadata=config(field_name="Priority")
-    )
-    priority_value: Optional[str] = field(
-        default=None, metadata=config(field_name="PriorityValue")
-    )
-    revision: Optional[int] = field(
-        default=None, metadata=config(field_name="Revision")
-    )
-    swid: Optional[int] = field(default=None, metadata=config(field_name="Swid"))
-    swid_name: Optional[str] = field(
-        default=None, metadata=config(field_name="SwidName")
-    )
-    text: Optional[str] = field(default=None, metadata=config(field_name="Text"))
-
-
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class ThreatSwidInput:
@@ -462,6 +438,40 @@ class ThreatGroupInput:
     tags: Optional[List[str]] = field(default=None, metadata=config(field_name="tags"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EventFilter:
+    """EventFilter."""
+
+    key_string: Optional[str] = field(
+        default=None, metadata=config(field_name="key_string")
+    )
+    pattern: Optional[str] = field(default=None, metadata=config(field_name="pattern"))
+    is_case_sensitive: Optional[bool] = field(
+        default=None, metadata=config(field_name="is_case_sensitive")
+    )
+    is_inverted: Optional[bool] = field(
+        default=None, metadata=config(field_name="is_inverted")
+    )
+    test_should: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="test_should")
+    )
+    test_should_not: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="test_should_not")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class ReferenceList:
+    """ReferenceList."""
+
+    description: Optional[str] = field(
+        default=None, metadata=config(field_name="description")
+    )
+    url: Optional[str] = field(default=None, metadata=config(field_name="url"))
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class ThreatAnalysis:
@@ -724,6 +734,41 @@ class ThreatReportInput:
     tags: Optional[List[str]] = field(default=None, metadata=config(field_name="tags"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class ThreatSwid:
+    """ThreatSwid."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="Id"))
+    author: Optional[str] = field(default=None, metadata=config(field_name="Author"))
+    created_at: Optional[str] = field(
+        default=None, metadata=config(field_name="CreatedAt")
+    )
+    engine_group_name: Optional[str] = field(
+        default=None, metadata=config(field_name="EngineGroupName")
+    )
+    file_name: Optional[str] = field(
+        default=None, metadata=config(field_name="FileName")
+    )
+    priority: Optional[int] = field(
+        default=None, metadata=config(field_name="Priority")
+    )
+    priority_value: Optional[str] = field(
+        default=None, metadata=config(field_name="PriorityValue")
+    )
+    revision: Optional[int] = field(
+        default=None, metadata=config(field_name="Revision")
+    )
+    swid: Optional[int] = field(default=None, metadata=config(field_name="Swid"))
+    swid_name: Optional[str] = field(
+        default=None, metadata=config(field_name="SwidName")
+    )
+    text: Optional[str] = field(default=None, metadata=config(field_name="Text"))
+    type: Optional[ThreatObjectType] = field(
+        default=None, metadata=config(field_name="type")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class ThreatGroup:
@@ -823,6 +868,240 @@ class CVE:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class AttackTactic:
+    """AttackTactic."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    attack_tactic_id: Optional[str] = field(
+        default=None, metadata=config(field_name="attack_tactic_id")
+    )
+    label: Optional[str] = field(default=None, metadata=config(field_name="label"))
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    description: Optional[str] = field(
+        default=None, metadata=config(field_name="description")
+    )
+    author: Optional[str] = field(default=None, metadata=config(field_name="author"))
+    creation_date: Optional[str] = field(
+        default=None, metadata=config(field_name="creation_date")
+    )
+    modified_date: Optional[str] = field(
+        default=None, metadata=config(field_name="modified_date")
+    )
+    references: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="references")
+    )
+    related_attack: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="related_attack")
+    )
+    type: Optional[ThreatObjectType] = field(
+        default=None, metadata=config(field_name="type")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class AttackTechnique:
+    """AttackTechnique."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    attack_technique_id: Optional[str] = field(
+        default=None, metadata=config(field_name="attack_technique_id")
+    )
+    label: Optional[str] = field(default=None, metadata=config(field_name="label"))
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    description: Optional[str] = field(
+        default=None, metadata=config(field_name="description")
+    )
+    author: Optional[str] = field(default=None, metadata=config(field_name="author"))
+    creation_date: Optional[str] = field(
+        default=None, metadata=config(field_name="creation_date")
+    )
+    modified_date: Optional[str] = field(
+        default=None, metadata=config(field_name="modified_date")
+    )
+    references: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="references")
+    )
+    related_attack: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="related_attack")
+    )
+    related_capec: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="related_capec")
+    )
+    type: Optional[ThreatObjectType] = field(
+        default=None, metadata=config(field_name="type")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class RedCloakWatchList:
+    """RedCloakWatchList."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    label: Optional[str] = field(default=None, metadata=config(field_name="label"))
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    description: Optional[str] = field(
+        default=None, metadata=config(field_name="description")
+    )
+    classification: Optional[str] = field(
+        default=None, metadata=config(field_name="classification")
+    )
+    confidence_value: Optional[str] = field(
+        default=None, metadata=config(field_name="confidence_value")
+    )
+    created_by: Optional[str] = field(
+        default=None, metadata=config(field_name="created_by")
+    )
+    last_modified_by: Optional[str] = field(
+        default=None, metadata=config(field_name="last_modified_by")
+    )
+    creation_time: Optional[str] = field(
+        default=None, metadata=config(field_name="creation_time")
+    )
+    criteria: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="criteria")
+    )
+    doc_type: Optional[str] = field(
+        default=None, metadata=config(field_name="doc_type")
+    )
+    enabled: Optional[bool] = field(default=None, metadata=config(field_name="enabled"))
+    endpoint_platform: Optional[str] = field(
+        default=None, metadata=config(field_name="endpoint_platform")
+    )
+    countermeasure_visibility: Optional[int] = field(
+        default=None, metadata=config(field_name="countermeasure_visibility")
+    )
+    resources: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="resources")
+    )
+    tag: Optional[str] = field(default=None, metadata=config(field_name="tag"))
+    domains: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="domains")
+    )
+    allowed_domains: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="allowed_domains")
+    )
+    day: Optional[str] = field(default=None, metadata=config(field_name="day"))
+    type: Optional[ThreatObjectType] = field(
+        default=None, metadata=config(field_name="type")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class RedCloakInspectorRule:
+    """RedCloakInspectorRule."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    label: Optional[str] = field(default=None, metadata=config(field_name="label"))
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    description: Optional[str] = field(
+        default=None, metadata=config(field_name="description")
+    )
+    rule_type: Optional[str] = field(
+        default=None, metadata=config(field_name="rule_type")
+    )
+    rule: Optional[str] = field(default=None, metadata=config(field_name="rule"))
+    threat_groups: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="threat_groups")
+    )
+    active: Optional[bool] = field(default=None, metadata=config(field_name="active"))
+    classification: Optional[str] = field(
+        default=None, metadata=config(field_name="classification")
+    )
+    resources: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="resources")
+    )
+    tags: Optional[List[str]] = field(default=None, metadata=config(field_name="tags"))
+    type: Optional[ThreatObjectType] = field(
+        default=None, metadata=config(field_name="type")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class RedCloakYaraRule:
+    """RedCloakYaraRule."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    label: Optional[str] = field(default=None, metadata=config(field_name="label"))
+    yara_id: Optional[str] = field(default=None, metadata=config(field_name="yara_id"))
+    event_description: Optional[str] = field(
+        default=None, metadata=config(field_name="event_description")
+    )
+    author: Optional[str] = field(default=None, metadata=config(field_name="author"))
+    metadata: Optional[str] = field(
+        default=None, metadata=config(field_name="metadata")
+    )
+    metadata_ver: Optional[str] = field(
+        default=None, metadata=config(field_name="metadata_ver")
+    )
+    strings: Optional[str] = field(default=None, metadata=config(field_name="strings"))
+    condition: Optional[str] = field(
+        default=None, metadata=config(field_name="condition")
+    )
+    threat_group: Optional[str] = field(
+        default=None, metadata=config(field_name="threat_group")
+    )
+    rule_severity: Optional[str] = field(
+        default=None, metadata=config(field_name="rule_severity")
+    )
+    tlp: Optional[str] = field(default=None, metadata=config(field_name="tlp"))
+    mss: Optional[str] = field(default=None, metadata=config(field_name="mss"))
+    type: Optional[ThreatObjectType] = field(
+        default=None, metadata=config(field_name="type")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class TaegisYaraRule:
+    """TaegisYaraRule."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    label: Optional[str] = field(default=None, metadata=config(field_name="label"))
+    event_description: Optional[str] = field(
+        default=None, metadata=config(field_name="event_description")
+    )
+    author: Optional[str] = field(default=None, metadata=config(field_name="author"))
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    classification: Optional[str] = field(
+        default=None, metadata=config(field_name="classification")
+    )
+    yara_id: Optional[str] = field(default=None, metadata=config(field_name="yara_id"))
+    attack_categories: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="attack_categories")
+    )
+    severity_float: Optional[float] = field(
+        default=None, metadata=config(field_name="severity_float")
+    )
+    confidence_float: Optional[float] = field(
+        default=None, metadata=config(field_name="confidence_float")
+    )
+    active: Optional[bool] = field(default=None, metadata=config(field_name="active"))
+    creation_date: Optional[str] = field(
+        default=None, metadata=config(field_name="creation_date")
+    )
+    modified_date: Optional[str] = field(
+        default=None, metadata=config(field_name="modified_date")
+    )
+    taegis_alert_visibility: Optional[str] = field(
+        default=None, metadata=config(field_name="taegis_alert_visibility")
+    )
+    taegis_create_alert: Optional[bool] = field(
+        default=None, metadata=config(field_name="taegis_create_alert")
+    )
+    metadata_ver: Optional[str] = field(
+        default=None, metadata=config(field_name="metadata_ver")
+    )
+    type: Optional[ThreatObjectType] = field(
+        default=None, metadata=config(field_name="type")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class PagedMalwareFiles:
@@ -928,6 +1207,51 @@ class ThreatVid:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class XdrEventFilter:
+    """XdrEventFilter."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    label: Optional[str] = field(default=None, metadata=config(field_name="label"))
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    event_type: Optional[str] = field(
+        default=None, metadata=config(field_name="event_type")
+    )
+    visibility: Optional[str] = field(
+        default=None, metadata=config(field_name="visibility")
+    )
+    result_visibility: Optional[str] = field(
+        default=None, metadata=config(field_name="result_visibility")
+    )
+    severity_float: Optional[float] = field(
+        default=None, metadata=config(field_name="severity_float")
+    )
+    confidence_float: Optional[float] = field(
+        default=None, metadata=config(field_name="confidence_float")
+    )
+    enabled: Optional[bool] = field(default=None, metadata=config(field_name="enabled"))
+    create_alert: Optional[bool] = field(
+        default=None, metadata=config(field_name="create_alert")
+    )
+    tags: Optional[List[str]] = field(default=None, metadata=config(field_name="tags"))
+    related_attack: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="related_attack")
+    )
+    endpoint_platforms: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="endpoint_platforms")
+    )
+    type: Optional[ThreatObjectType] = field(
+        default=None, metadata=config(field_name="type")
+    )
+    references_list: Optional[List[ReferenceList]] = field(
+        default=None, metadata=config(field_name="references_list")
+    )
+    event_filters: Optional[List[EventFilter]] = field(
+        default=None, metadata=config(field_name="event_filters")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class ThreatIdentity:

{taegis_sdk_python-1.2.10 → taegis_sdk_python-1.2.13}/taegis_sdk_python/services/users/types.py

@@ -495,6 +495,7 @@ class TDRUserInfoInput:
 class AuthorizeCheckResponse:
     """AuthorizeCheckResponse."""
 
+    domain: Optional[str] = field(default=None, metadata=config(field_name="domain"))
     connection: Optional[AuthorizeCheckConnection] = field(
         default=None, metadata=config(field_name="connection")
     )