taegis-sdk-python 1.2.11__tar.gz → 1.2.14__tar.gz

{taegis_sdk_python-1.2.11/taegis_sdk_python.egg-info → taegis_sdk_python-1.2.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: taegis-sdk-python
-Version: 1.2.11
+Version: 1.2.14
 Summary: Taegis Python SDK
 Home-page: https://github.com/secureworks/taegis-sdk-python
 Author: Secureworks

taegis_sdk_python-1.2.14/taegis_sdk_python/_version.py

@@ -0,0 +1 @@
+__version__ = "v1.2.14"

{taegis_sdk_python-1.2.11 → taegis_sdk_python-1.2.14}/taegis_sdk_python/services/assets2/types.py

@@ -1150,6 +1150,9 @@ class AssetWhereInputV2:
     system_type: Optional[str] = field(
         default=None, metadata=config(field_name="systemType")
     )
+    un_installable: Optional[bool] = field(
+        default=None, metadata=config(field_name="unInstallable")
+    )
     updated_at: Optional[str] = field(
         default=None, metadata=config(field_name="updatedAt")
     )

{taegis_sdk_python-1.2.11 → taegis_sdk_python-1.2.14}/taegis_sdk_python/services/investigations2/types.py

@@ -79,6 +79,7 @@ class InvestigationType(str, Enum):
     MANAGED_XDR_OT_INVESTIGATION = "MANAGED_XDR_OT_INVESTIGATION"
     OT_INVESTIGATION = "OT_INVESTIGATION"
     DETECTION_RESEARCH = "DETECTION_RESEARCH"
+    INFORMATIONAL = "INFORMATIONAL"
 
 
 class InvestigationProcessingState(str, Enum):
@@ -1133,6 +1134,40 @@ class InvestigationV2TimelineArguments:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class CommentsV2Arguments:
+    """CommentsV2Arguments."""
+
+    investigation_id: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationId")
+    )
+    page: Optional[int] = field(default=None, metadata=config(field_name="page"))
+    per_page: Optional[int] = field(default=None, metadata=config(field_name="perPage"))
+    order_by: Optional[PaginationOrder] = field(
+        default=None, metadata=config(field_name="orderBy")
+    )
+    visibility: Optional[CommentVisibilityFilter] = field(
+        default=None, metadata=config(field_name="visibility")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class InvestigationProcessingStatus:
+    """InvestigationProcessingStatus."""
+
+    assets: Optional[InvestigationProcessingState] = field(
+        default=None, metadata=config(field_name="assets")
+    )
+    events: Optional[InvestigationProcessingState] = field(
+        default=None, metadata=config(field_name="events")
+    )
+    alerts: Optional[InvestigationProcessingState] = field(
+        default=None, metadata=config(field_name="alerts")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class InvestigationV2TimelineEntity:
@@ -1149,11 +1184,11 @@ class InvestigationV2TimelineEntity:
     created_at: Optional[str] = field(
         default=None, metadata=config(field_name="createdAt")
     )
-    timestamp: Optional[str] = field(
-        default=None, metadata=config(field_name="timestamp")
+    resource_id: Optional[str] = field(
+        default=None, metadata=config(field_name="resourceId")
     )
-    entity_id: Optional[str] = field(
-        default=None, metadata=config(field_name="entityId")
+    resource_created_at: Optional[str] = field(
+        default=None, metadata=config(field_name="resourceCreatedAt")
     )
     description: Optional[str] = field(
         default=None, metadata=config(field_name="description")
@@ -1161,50 +1196,52 @@ class InvestigationV2TimelineEntity:
     descriptor: Optional[str] = field(
         default=None, metadata=config(field_name="descriptor")
     )
-    user_id: Optional[str] = field(default=None, metadata=config(field_name="userId"))
-    user_subject: Optional[Subject] = field(
-        default=None, metadata=config(field_name="userSubject")
+    subject_id: Optional[str] = field(
+        default=None, metadata=config(field_name="subjectId")
     )
-    user: Optional[TDRUser] = field(
+    is_partner_only: Optional[bool] = field(
+        default=None, metadata=config(field_name="isPartnerOnly")
+    )
+    entity_id: Optional[str] = field(
         default=None,
         metadata=config(
-            metadata={"deprecated": True, "deprecation_reason": "use userSubject"},
-            field_name="user",
+            metadata={"deprecated": True, "deprecation_reason": "use resourceId"},
+            field_name="entityId",
         ),
     )
-
-
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class CommentsV2Arguments:
-    """CommentsV2Arguments."""
-
-    investigation_id: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationId")
-    )
-    page: Optional[int] = field(default=None, metadata=config(field_name="page"))
-    per_page: Optional[int] = field(default=None, metadata=config(field_name="perPage"))
-    order_by: Optional[PaginationOrder] = field(
-        default=None, metadata=config(field_name="orderBy")
+    timestamp: Optional[str] = field(
+        default=None,
+        metadata=config(
+            metadata={
+                "deprecated": True,
+                "deprecation_reason": "use resourceCreatedAt",
+            },
+            field_name="timestamp",
+        ),
     )
-    visibility: Optional[CommentVisibilityFilter] = field(
-        default=None, metadata=config(field_name="visibility")
+    user_id: Optional[str] = field(
+        default=None,
+        metadata=config(
+            metadata={"deprecated": True, "deprecation_reason": "use subjectId"},
+            field_name="userId",
+        ),
     )
-
-
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class InvestigationProcessingStatus:
-    """InvestigationProcessingStatus."""
-
-    assets: Optional[InvestigationProcessingState] = field(
-        default=None, metadata=config(field_name="assets")
+    subject: Optional[Subject] = field(
+        default=None, metadata=config(field_name="subject")
     )
-    events: Optional[InvestigationProcessingState] = field(
-        default=None, metadata=config(field_name="events")
+    user: Optional[TDRUser] = field(
+        default=None,
+        metadata=config(
+            metadata={"deprecated": True, "deprecation_reason": "use subject"},
+            field_name="user",
+        ),
     )
-    alerts: Optional[InvestigationProcessingState] = field(
-        default=None, metadata=config(field_name="alerts")
+    user_subject: Optional[Subject] = field(
+        default=None,
+        metadata=config(
+            metadata={"deprecated": True, "deprecation_reason": "use subject"},
+            field_name="userSubject",
+        ),
     )
 
 

{taegis_sdk_python-1.2.11 → taegis_sdk_python-1.2.14}/taegis_sdk_python/services/tenants/types.py

@@ -389,6 +389,9 @@ class SSOConnectionParameters:
 class SAMLConnectionParameters:
     """SAMLConnectionParameters."""
 
+    metadata_url: Optional[str] = field(
+        default=None, metadata=config(field_name="metadataURL")
+    )
     signing_cert: Optional[str] = field(
         default=None, metadata=config(field_name="signingCert")
     )
@@ -1030,29 +1033,6 @@ class TenantDecommissionRequest:
     )
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class NewSSOConnectionInput:
-    """NewSSOConnectionInput."""
-
-    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
-    domains: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="domains")
-    )
-    testers: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="testers")
-    )
-    type: Optional[SSOConnectionType] = field(
-        default=None, metadata=config(field_name="type")
-    )
-    connection_configuration: Optional[ConnectionConfiguration] = field(
-        default=None, metadata=config(field_name="connectionConfiguration")
-    )
-    auth0_domain_type: Optional[Auth0DomainType] = field(
-        default=None, metadata=config(field_name="auth0DomainType")
-    )
-
-
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class UpdateSSOConnectionInput:
@@ -1131,6 +1111,32 @@ class TenantSSOConnectionQueryInput:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class NewSSOConnectionInput:
+    """NewSSOConnectionInput."""
+
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    domains: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="domains")
+    )
+    testers: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="testers")
+    )
+    type: Optional[SSOConnectionType] = field(
+        default=None, metadata=config(field_name="type")
+    )
+    connection_configuration: Optional[ConnectionConfiguration] = field(
+        default=None, metadata=config(field_name="connectionConfiguration")
+    )
+    external_provider: Optional[ExternalProvider] = field(
+        default=None, metadata=config(field_name="externalProvider")
+    )
+    auth0_domain_type: Optional[Auth0DomainType] = field(
+        default=None, metadata=config(field_name="auth0DomainType")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class Tenant:

{taegis_sdk_python-1.2.11 → taegis_sdk_python-1.2.14}/taegis_sdk_python/services/tenants4/types.py

@@ -168,6 +168,9 @@ class TenantsQuery:
     )
     count: Optional[int] = field(default=None, metadata=config(field_name="count"))
     cql: Optional[str] = field(default=None, metadata=config(field_name="cql"))
+    read_partner_roots: Optional[bool] = field(
+        default=None, metadata=config(field_name="readPartnerRoots")
+    )
     enabled_in: Optional[List[TenantRegion]] = field(
         default=None, metadata=config(field_name="enabledIn")
     )

{taegis_sdk_python-1.2.11 → taegis_sdk_python-1.2.14}/taegis_sdk_python/services/threat/types.py

@@ -270,6 +270,14 @@ class ThreatObjectType(str, Enum):
     REPORT = "report"
     COUNTRY = "country"
     CVE = "CVE"
+    SWID = "swid"
+    XDR_EVENT_FILTER = "xdr_event_filter"
+    ATTACK_TACTIC = "attack_tactic"
+    ATTACK_TECHNIQUE = "attack_technique"
+    RED_CLOAK_WATCH_LIST = "red_cloak_watch_list"
+    RED_CLOAK_INSPECTOR_RULE = "red_cloak_inspector_rule"
+    RED_CLOAK_YARA_RULE = "red_cloak_yara_rule"
+    TAEGIS_YARA_RULE = "taegis_yara_rule"
 
 
 @dataclass_json
@@ -362,38 +370,6 @@ class ThreatTip:
     )
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class ThreatSwid:
-    """ThreatSwid."""
-
-    id: Optional[str] = field(default=None, metadata=config(field_name="Id"))
-    author: Optional[str] = field(default=None, metadata=config(field_name="Author"))
-    created_at: Optional[str] = field(
-        default=None, metadata=config(field_name="CreatedAt")
-    )
-    engine_group_name: Optional[str] = field(
-        default=None, metadata=config(field_name="EngineGroupName")
-    )
-    file_name: Optional[str] = field(
-        default=None, metadata=config(field_name="FileName")
-    )
-    priority: Optional[int] = field(
-        default=None, metadata=config(field_name="Priority")
-    )
-    priority_value: Optional[str] = field(
-        default=None, metadata=config(field_name="PriorityValue")
-    )
-    revision: Optional[int] = field(
-        default=None, metadata=config(field_name="Revision")
-    )
-    swid: Optional[int] = field(default=None, metadata=config(field_name="Swid"))
-    swid_name: Optional[str] = field(
-        default=None, metadata=config(field_name="SwidName")
-    )
-    text: Optional[str] = field(default=None, metadata=config(field_name="Text"))
-
-
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class ThreatSwidInput:
@@ -462,6 +438,40 @@ class ThreatGroupInput:
     tags: Optional[List[str]] = field(default=None, metadata=config(field_name="tags"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EventFilter:
+    """EventFilter."""
+
+    key_string: Optional[str] = field(
+        default=None, metadata=config(field_name="key_string")
+    )
+    pattern: Optional[str] = field(default=None, metadata=config(field_name="pattern"))
+    is_case_sensitive: Optional[bool] = field(
+        default=None, metadata=config(field_name="is_case_sensitive")
+    )
+    is_inverted: Optional[bool] = field(
+        default=None, metadata=config(field_name="is_inverted")
+    )
+    test_should: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="test_should")
+    )
+    test_should_not: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="test_should_not")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class ReferenceList:
+    """ReferenceList."""
+
+    description: Optional[str] = field(
+        default=None, metadata=config(field_name="description")
+    )
+    url: Optional[str] = field(default=None, metadata=config(field_name="url"))
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class ThreatAnalysis:
@@ -724,6 +734,41 @@ class ThreatReportInput:
     tags: Optional[List[str]] = field(default=None, metadata=config(field_name="tags"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class ThreatSwid:
+    """ThreatSwid."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="Id"))
+    author: Optional[str] = field(default=None, metadata=config(field_name="Author"))
+    created_at: Optional[str] = field(
+        default=None, metadata=config(field_name="CreatedAt")
+    )
+    engine_group_name: Optional[str] = field(
+        default=None, metadata=config(field_name="EngineGroupName")
+    )
+    file_name: Optional[str] = field(
+        default=None, metadata=config(field_name="FileName")
+    )
+    priority: Optional[int] = field(
+        default=None, metadata=config(field_name="Priority")
+    )
+    priority_value: Optional[str] = field(
+        default=None, metadata=config(field_name="PriorityValue")
+    )
+    revision: Optional[int] = field(
+        default=None, metadata=config(field_name="Revision")
+    )
+    swid: Optional[int] = field(default=None, metadata=config(field_name="Swid"))
+    swid_name: Optional[str] = field(
+        default=None, metadata=config(field_name="SwidName")
+    )
+    text: Optional[str] = field(default=None, metadata=config(field_name="Text"))
+    type: Optional[ThreatObjectType] = field(
+        default=None, metadata=config(field_name="type")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class ThreatGroup:
@@ -823,6 +868,240 @@ class CVE:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class AttackTactic:
+    """AttackTactic."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    attack_tactic_id: Optional[str] = field(
+        default=None, metadata=config(field_name="attack_tactic_id")
+    )
+    label: Optional[str] = field(default=None, metadata=config(field_name="label"))
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    description: Optional[str] = field(
+        default=None, metadata=config(field_name="description")
+    )
+    author: Optional[str] = field(default=None, metadata=config(field_name="author"))
+    creation_date: Optional[str] = field(
+        default=None, metadata=config(field_name="creation_date")
+    )
+    modified_date: Optional[str] = field(
+        default=None, metadata=config(field_name="modified_date")
+    )
+    references: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="references")
+    )
+    related_attack: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="related_attack")
+    )
+    type: Optional[ThreatObjectType] = field(
+        default=None, metadata=config(field_name="type")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class AttackTechnique:
+    """AttackTechnique."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    attack_technique_id: Optional[str] = field(
+        default=None, metadata=config(field_name="attack_technique_id")
+    )
+    label: Optional[str] = field(default=None, metadata=config(field_name="label"))
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    description: Optional[str] = field(
+        default=None, metadata=config(field_name="description")
+    )
+    author: Optional[str] = field(default=None, metadata=config(field_name="author"))
+    creation_date: Optional[str] = field(
+        default=None, metadata=config(field_name="creation_date")
+    )
+    modified_date: Optional[str] = field(
+        default=None, metadata=config(field_name="modified_date")
+    )
+    references: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="references")
+    )
+    related_attack: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="related_attack")
+    )
+    related_capec: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="related_capec")
+    )
+    type: Optional[ThreatObjectType] = field(
+        default=None, metadata=config(field_name="type")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class RedCloakWatchList:
+    """RedCloakWatchList."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    label: Optional[str] = field(default=None, metadata=config(field_name="label"))
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    description: Optional[str] = field(
+        default=None, metadata=config(field_name="description")
+    )
+    classification: Optional[str] = field(
+        default=None, metadata=config(field_name="classification")
+    )
+    confidence_value: Optional[str] = field(
+        default=None, metadata=config(field_name="confidence_value")
+    )
+    created_by: Optional[str] = field(
+        default=None, metadata=config(field_name="created_by")
+    )
+    last_modified_by: Optional[str] = field(
+        default=None, metadata=config(field_name="last_modified_by")
+    )
+    creation_time: Optional[str] = field(
+        default=None, metadata=config(field_name="creation_time")
+    )
+    criteria: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="criteria")
+    )
+    doc_type: Optional[str] = field(
+        default=None, metadata=config(field_name="doc_type")
+    )
+    enabled: Optional[bool] = field(default=None, metadata=config(field_name="enabled"))
+    endpoint_platform: Optional[str] = field(
+        default=None, metadata=config(field_name="endpoint_platform")
+    )
+    countermeasure_visibility: Optional[int] = field(
+        default=None, metadata=config(field_name="countermeasure_visibility")
+    )
+    resources: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="resources")
+    )
+    tag: Optional[str] = field(default=None, metadata=config(field_name="tag"))
+    domains: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="domains")
+    )
+    allowed_domains: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="allowed_domains")
+    )
+    day: Optional[str] = field(default=None, metadata=config(field_name="day"))
+    type: Optional[ThreatObjectType] = field(
+        default=None, metadata=config(field_name="type")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class RedCloakInspectorRule:
+    """RedCloakInspectorRule."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    label: Optional[str] = field(default=None, metadata=config(field_name="label"))
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    description: Optional[str] = field(
+        default=None, metadata=config(field_name="description")
+    )
+    rule_type: Optional[str] = field(
+        default=None, metadata=config(field_name="rule_type")
+    )
+    rule: Optional[str] = field(default=None, metadata=config(field_name="rule"))
+    threat_groups: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="threat_groups")
+    )
+    active: Optional[bool] = field(default=None, metadata=config(field_name="active"))
+    classification: Optional[str] = field(
+        default=None, metadata=config(field_name="classification")
+    )
+    resources: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="resources")
+    )
+    tags: Optional[List[str]] = field(default=None, metadata=config(field_name="tags"))
+    type: Optional[ThreatObjectType] = field(
+        default=None, metadata=config(field_name="type")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class RedCloakYaraRule:
+    """RedCloakYaraRule."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    label: Optional[str] = field(default=None, metadata=config(field_name="label"))
+    yara_id: Optional[str] = field(default=None, metadata=config(field_name="yara_id"))
+    event_description: Optional[str] = field(
+        default=None, metadata=config(field_name="event_description")
+    )
+    author: Optional[str] = field(default=None, metadata=config(field_name="author"))
+    metadata: Optional[str] = field(
+        default=None, metadata=config(field_name="metadata")
+    )
+    metadata_ver: Optional[str] = field(
+        default=None, metadata=config(field_name="metadata_ver")
+    )
+    strings: Optional[str] = field(default=None, metadata=config(field_name="strings"))
+    condition: Optional[str] = field(
+        default=None, metadata=config(field_name="condition")
+    )
+    threat_group: Optional[str] = field(
+        default=None, metadata=config(field_name="threat_group")
+    )
+    rule_severity: Optional[str] = field(
+        default=None, metadata=config(field_name="rule_severity")
+    )
+    tlp: Optional[str] = field(default=None, metadata=config(field_name="tlp"))
+    mss: Optional[str] = field(default=None, metadata=config(field_name="mss"))
+    type: Optional[ThreatObjectType] = field(
+        default=None, metadata=config(field_name="type")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class TaegisYaraRule:
+    """TaegisYaraRule."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    label: Optional[str] = field(default=None, metadata=config(field_name="label"))
+    event_description: Optional[str] = field(
+        default=None, metadata=config(field_name="event_description")
+    )
+    author: Optional[str] = field(default=None, metadata=config(field_name="author"))
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    classification: Optional[str] = field(
+        default=None, metadata=config(field_name="classification")
+    )
+    yara_id: Optional[str] = field(default=None, metadata=config(field_name="yara_id"))
+    attack_categories: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="attack_categories")
+    )
+    severity_float: Optional[float] = field(
+        default=None, metadata=config(field_name="severity_float")
+    )
+    confidence_float: Optional[float] = field(
+        default=None, metadata=config(field_name="confidence_float")
+    )
+    active: Optional[bool] = field(default=None, metadata=config(field_name="active"))
+    creation_date: Optional[str] = field(
+        default=None, metadata=config(field_name="creation_date")
+    )
+    modified_date: Optional[str] = field(
+        default=None, metadata=config(field_name="modified_date")
+    )
+    taegis_alert_visibility: Optional[str] = field(
+        default=None, metadata=config(field_name="taegis_alert_visibility")
+    )
+    taegis_create_alert: Optional[bool] = field(
+        default=None, metadata=config(field_name="taegis_create_alert")
+    )
+    metadata_ver: Optional[str] = field(
+        default=None, metadata=config(field_name="metadata_ver")
+    )
+    type: Optional[ThreatObjectType] = field(
+        default=None, metadata=config(field_name="type")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class PagedMalwareFiles:
@@ -928,6 +1207,51 @@ class ThreatVid:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class XdrEventFilter:
+    """XdrEventFilter."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    label: Optional[str] = field(default=None, metadata=config(field_name="label"))
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    event_type: Optional[str] = field(
+        default=None, metadata=config(field_name="event_type")
+    )
+    visibility: Optional[str] = field(
+        default=None, metadata=config(field_name="visibility")
+    )
+    result_visibility: Optional[str] = field(
+        default=None, metadata=config(field_name="result_visibility")
+    )
+    severity_float: Optional[float] = field(
+        default=None, metadata=config(field_name="severity_float")
+    )
+    confidence_float: Optional[float] = field(
+        default=None, metadata=config(field_name="confidence_float")
+    )
+    enabled: Optional[bool] = field(default=None, metadata=config(field_name="enabled"))
+    create_alert: Optional[bool] = field(
+        default=None, metadata=config(field_name="create_alert")
+    )
+    tags: Optional[List[str]] = field(default=None, metadata=config(field_name="tags"))
+    related_attack: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="related_attack")
+    )
+    endpoint_platforms: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="endpoint_platforms")
+    )
+    type: Optional[ThreatObjectType] = field(
+        default=None, metadata=config(field_name="type")
+    )
+    references_list: Optional[List[ReferenceList]] = field(
+        default=None, metadata=config(field_name="references_list")
+    )
+    event_filters: Optional[List[EventFilter]] = field(
+        default=None, metadata=config(field_name="event_filters")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class ThreatIdentity: