taegis-sdk-python 1.2.19__tar.gz → 1.2.21__tar.gz

{taegis_sdk_python-1.2.19/taegis_sdk_python.egg-info → taegis_sdk_python-1.2.21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: taegis-sdk-python
-Version: 1.2.19
+Version: 1.2.21
 Summary: Taegis Python SDK
 Home-page: https://github.com/secureworks/taegis-sdk-python
 Author: Secureworks

taegis_sdk_python-1.2.21/taegis_sdk_python/_version.py

@@ -0,0 +1 @@
+__version__ = "v1.2.21"

{taegis_sdk_python-1.2.19 → taegis_sdk_python-1.2.21}/taegis_sdk_python/service_core.py

@@ -257,6 +257,7 @@ class ServiceCore:
             proxy=self.service.proxy,
             proxy_auth=self.service.proxy_auth,
             proxy_headers=self.service.proxy_headers,
+            connect_args={"max_msg_size": self.service.max_message_size},
         )
 
         client = Client(

{taegis_sdk_python-1.2.19 → taegis_sdk_python-1.2.21}/taegis_sdk_python/services/__init__.py

@@ -61,6 +61,7 @@ from taegis_sdk_python.services.tenants import TenantsService
 from taegis_sdk_python.services.tenants4 import Tenants4Service
 from taegis_sdk_python.services.threat import ThreatService
 from taegis_sdk_python.services.threat_score import ThreatScoreService
+from taegis_sdk_python.services.trigger_action import TriggerActionService
 from taegis_sdk_python.services.trip import TripService
 from taegis_sdk_python.services.users import UsersService
 from taegis_sdk_python.services.vdr import VDRService
@@ -88,6 +89,7 @@ class GraphQLService:
         trust_env: bool = False,
         ssl: Optional[Union[SSLContext, Literal[False], Fingerprint]] = None,
         execute_timeout: Optional[Union[int, float]] = 30,
+        max_message_size: int = 0,
     ):  # pylint: disable=too-many-statements
         """
         GraphQLService
@@ -106,11 +108,29 @@ class GraphQLService:
             Extra HTTP Headers to be included in API calls
         schema_expiry: int, optional
             Expire time for GraphQL Schema Caching in minutes, by default 1
+        proxy: str, optional
+            Proxy URL for API requests
+            Examples:
+                http://proxy.example.com:8080
+                http://username:password@proxy.example.com:8080
+        proxy_auth: aiohttp.BasicAuth, optional
+            Examples:
+                aiohttp.BasicAuth("username", "password")
+        proxy_headers: Optional[LooseHeaders], optional
+            Proxy Headers for API requests
+        trust_env: bool, optional
+            Trust Environment Variables for Proxy Authentication
+        ssl: Optional[Union[SSLContext, Literal[False], Fingerprint]], optional
+            SSL Context for API requests
+        execute_timeout: Optional[Union[int, float]], optional
+            Timeout for GraphQL Execute in seconds, by default 30
+        max_message_size: int, optional
+            Max Message Size for Subscriptions, by default 0
 
         Raises
         ------
         ValueError
-            environment must be charlie, delta, or echo
+            environment must be charlie, delta, echo, or foxtrot (or equivalent)
         """
         self._environments = environments or TAEGIS_ENVIRONMENT_URLS
         self._environment = environment or list(self._environments)[0]
@@ -142,6 +162,7 @@ class GraphQLService:
         self._trust_env = trust_env
 
         self._execute_timeout = execute_timeout
+        self._max_message_size = max_message_size
 
         self._access_points = None
         self._agent = None
@@ -185,6 +206,7 @@ class GraphQLService:
         self._tenants4 = None
         self._threat = None
         self._threat_score = None
+        self._trigger_action = None
         self._trip = None
         self._users = None
         self._vdr = None
@@ -293,6 +315,11 @@ class GraphQLService:
         """GraphQL Schema Timeout."""
         return self._context_manager.get("schema_expiry", self._schema_expiry)
 
+    @property
+    def max_message_size(self):
+        """Max Message Size for Subscriptions."""
+        return self._context_manager.get("max_message_size", self._max_message_size)
+
     @property
     def input_value_deprecation(self):
         """GraphQL Query Deprecated Input Fields in Schema."""
@@ -642,6 +669,13 @@ class GraphQLService:
             self._threat_score = ThreatScoreService(self)
         return self._threat_score
 
+    @property
+    def trigger_action(self):
+        """Trigger Action Service Endpoint."""
+        if not self._trigger_action:
+            self._trigger_action = TriggerActionService(self)
+        return self._trigger_action
+
     @property
     def trip(self):
         """Trip Service Endpoint."""
@@ -658,7 +692,7 @@ class GraphQLService:
 
     @property
     def vdr(self):
-        """Users Service Endpoint."""
+        """VDR Service Endpoint."""
         if not self._vdr:
             self._vdr = VDRService(self)
         return self._vdr

{taegis_sdk_python-1.2.19 → taegis_sdk_python-1.2.21}/taegis_sdk_python/services/rules/types.py

@@ -42,6 +42,7 @@ class RuleEventType(str, Enum):
     THIRDPARTYALERT = "thirdpartyalert"
     THREAD_INJECTION = "thread_injection"
     PROCESS_MODULE = "process_module"
+    TAEGIS_AGENT_DETECTION = "taegis_agent_detection"
 
 
 class RuleEndpointPlatform(str, Enum):

taegis_sdk_python-1.2.21/taegis_sdk_python/services/trigger_action/__init__.py

@@ -0,0 +1,34 @@
+""""TriggerAction Service."""
+
+from taegis_sdk_python.service_core import ServiceCore
+from taegis_sdk_python.services.trigger_action.mutations import (
+    TaegisSDKTriggerActionMutation,
+)
+from taegis_sdk_python.services.trigger_action.queries import (
+    TaegisSDKTriggerActionQuery,
+)
+from taegis_sdk_python.services.trigger_action.subscriptions import (
+    TaegisSDKTriggerActionSubscription,
+)
+
+
+class TriggerActionService(ServiceCore):
+    """Taegis TriggerAction Service."""
+
+    @property
+    def query(self):
+        if not self._queries:
+            self._queries = TaegisSDKTriggerActionQuery(self)
+        return self._queries
+
+    @property
+    def mutation(self):
+        if not self._mutations:
+            self._mutations = TaegisSDKTriggerActionMutation(self)
+        return self._mutations
+
+    @property
+    def subscription(self):
+        if not self._subscriptions:
+            self._subscriptions = TaegisSDKTriggerActionSubscription(self)
+        return self._subscriptions

taegis_sdk_python-1.2.21/taegis_sdk_python/services/trigger_action/mutations.py

@@ -0,0 +1,136 @@
+"""TriggerAction Mutation."""
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python._consts import TaegisEnum
+from taegis_sdk_python.services.trigger_action.types import *
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.trigger_action import TriggerActionService
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKTriggerActionMutation:
+    """Taegis Trigger_action Mutation operations."""
+
+    def __init__(self, service: TriggerActionService):
+        self.service = service
+
+    def execute_action(self, input_: ExecuteActionInput) -> PlaybookExecution:
+        """executeAction executes a playbook against an object."""
+        endpoint = "executeAction"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "input": prepare_input(input_),
+            },
+            output=build_output_string(PlaybookExecution),
+        )
+        if result.get(endpoint) is not None:
+            return PlaybookExecution.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for mutation executeAction")
+
+    def execute_bulk_action(self, input_: ExecuteBulkActionInput) -> BulkActions:
+        """executeBulkAction executes a playbook against a list of entities."""
+        endpoint = "executeBulkAction"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "input": prepare_input(input_),
+            },
+            output=build_output_string(BulkActions),
+        )
+        if result.get(endpoint) is not None:
+            return BulkActions.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for mutation executeBulkAction")
+
+    def execute_playbook_action(
+        self,
+        playbook_action: str,
+        inputs: Any,
+        target_resource: Optional[str] = None,
+        reason: Optional[str] = None,
+    ) -> PlaybookExecution:
+        """executePlaybookAction is deprecated, use executePlaybookActionsV2 instead. This endpoint does not support entities."""
+        endpoint = "executePlaybookAction"
+
+        log.warning(
+            f"GraphQL Mutation `{endpoint}` is deprecated: 'Use executeBulkAction instead'"
+        )
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "playbookAction": prepare_input(playbook_action),
+                "inputs": prepare_input(inputs),
+                "targetResource": prepare_input(target_resource),
+                "reason": prepare_input(reason),
+            },
+            output=build_output_string(PlaybookExecution),
+        )
+        if result.get(endpoint) is not None:
+            return PlaybookExecution.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for mutation executePlaybookAction")
+
+    def execute_playbook_actions(
+        self, input_: List[ExecutePlaybookActionInput]
+    ) -> List[PlaybookExecution]:
+        """executePlaybookActions is deprecated, use executePlaybookActionsV2 instead. This endpoint does not support entities."""
+        endpoint = "executePlaybookActions"
+
+        log.warning(
+            f"GraphQL Mutation `{endpoint}` is deprecated: 'Use executeBulkAction instead'"
+        )
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "input": prepare_input(input_),
+            },
+            output=build_output_string(PlaybookExecution),
+        )
+        if result.get(endpoint) is not None:
+            return PlaybookExecution.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for mutation executePlaybookActions")
+
+    def execute_playbook_actions_v2(
+        self, input_: List[ExecutePlaybookActionV2Input]
+    ) -> List[PlaybookExecution]:
+        """executePlaybookActionsV2 starts a playbook response or context lookup action."""
+        endpoint = "executePlaybookActionsV2"
+
+        log.warning(
+            f"GraphQL Mutation `{endpoint}` is deprecated: 'Use executeBulkAction instead'"
+        )
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "input": prepare_input(input_),
+            },
+            output=build_output_string(PlaybookExecution),
+        )
+        if result.get(endpoint) is not None:
+            return PlaybookExecution.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for mutation executePlaybookActionsV2")

taegis_sdk_python-1.2.21/taegis_sdk_python/services/trigger_action/queries.py

@@ -0,0 +1,172 @@
+"""TriggerAction Query."""
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python._consts import TaegisEnum
+from taegis_sdk_python.services.trigger_action.types import *
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.trigger_action import TriggerActionService
+
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKTriggerActionQuery:
+    """Taegis Trigger_action Query operations."""
+
+    def __init__(self, service: TriggerActionService):
+        self.service = service
+
+    def playbook_action_category(self, id_: str) -> PlaybookActionCategory:
+        """playbookActionCategory accepts an action id and returns the category the action falls into."""
+        endpoint = "playbookActionCategory"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "id": prepare_input(id_),
+            },
+            output=build_output_string(PlaybookActionCategory),
+        )
+        if result.get(endpoint) is not None:
+            return PlaybookActionCategory.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query playbookActionCategory")
+
+    def playbook_action_categories(self) -> List[PlaybookActionCategory]:
+        """playbookActionCategories return a list of all the possible categories an action can be tied to."""
+        endpoint = "playbookActionCategories"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={},
+            output=build_output_string(PlaybookActionCategory),
+        )
+        if result.get(endpoint) is not None:
+            return PlaybookActionCategory.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query playbookActionCategories")
+
+    def playbook_action_context(self, id_: str) -> PlaybookActionContext:
+        """playbookActionContext returns a single response action context."""
+        endpoint = "playbookActionContext"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "id": prepare_input(id_),
+            },
+            output=build_output_string(PlaybookActionContext),
+        )
+        if result.get(endpoint) is not None:
+            return PlaybookActionContext.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query playbookActionContext")
+
+    def playbook_action_contexts(self) -> List[PlaybookActionContext]:
+        """playbookActionContexts returns all registered action contexts that can be associated to response actions."""
+        endpoint = "playbookActionContexts"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={},
+            output=build_output_string(PlaybookActionContext),
+        )
+        if result.get(endpoint) is not None:
+            return PlaybookActionContext.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query playbookActionContexts")
+
+    def playbook_actions(
+        self,
+        playbook_action_context: str,
+        inputs: Any,
+        playbook_action_category: Optional[str] = None,
+    ) -> List[PlaybookAction]:
+        """playbookActions returns all actions that can be taken for a given context, category and input."""
+        endpoint = "playbookActions"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "playbookActionContext": prepare_input(playbook_action_context),
+                "playbookActionCategory": prepare_input(playbook_action_category),
+                "inputs": prepare_input(inputs),
+            },
+            output=build_output_string(PlaybookAction),
+        )
+        if result.get(endpoint) is not None:
+            return PlaybookAction.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query playbookActions")
+
+    def playbook_actions_configured(
+        self, arguments: Optional[PlaybookActionsConfiguredArguments] = None
+    ) -> List[PlaybookAction]:
+        """playbookActionsConfigured returns all known trigger actions
+
+        Scoped by the caller's tenant id."""
+        endpoint = "playbookActionsConfigured"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "arguments": prepare_input(arguments),
+            },
+            output=build_output_string(PlaybookAction),
+        )
+        if result.get(endpoint) is not None:
+            return PlaybookAction.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query playbookActionsConfigured")
+
+    def playbook_actions_v2(
+        self, arguments: PlaybookActionsV2Arguments
+    ) -> PlaybookActions:
+        """playbookActionsV2 returns all known trigger actions
+
+        Scoped by the caller's tenant id."""
+        endpoint = "playbookActionsV2"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "arguments": prepare_input(arguments),
+            },
+            output=build_output_string(PlaybookActions),
+        )
+        if result.get(endpoint) is not None:
+            return PlaybookActions.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query playbookActionsV2")
+
+    def evaluate_expr(self, input_: ExprInput) -> ExprResult:
+        """Test an expression against a context."""
+        endpoint = "evaluateExpr"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "input": prepare_input(input_),
+            },
+            output=build_output_string(ExprResult),
+        )
+        if result.get(endpoint) is not None:
+            return ExprResult.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query evaluateExpr")

taegis_sdk_python-1.2.21/taegis_sdk_python/services/trigger_action/subscriptions.py

@@ -0,0 +1,32 @@
+"""TriggerAction Subscription."""
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python._consts import TaegisEnum
+from taegis_sdk_python.services.trigger_action.types import *
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.trigger_action import TriggerActionService
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKTriggerActionSubscription:
+    """Taegis Trigger_action Subscription operations."""
+
+    def __init__(self, service: TriggerActionService):
+        self.service = service