taegis-sdk-python 1.2.4__tar.gz → 1.2.5__tar.gz

{taegis-sdk-python-1.2.4/taegis_sdk_python.egg-info → taegis-sdk-python-1.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: taegis-sdk-python
-Version: 1.2.4
+Version: 1.2.5
 Summary: Taegis Python SDK
 Home-page: https://github.com/secureworks/taegis-sdk-python
 Author: Secureworks

taegis-sdk-python-1.2.5/taegis_sdk_python/_version.py

@@ -0,0 +1 @@
+__version__ = "v1.2.5"

{taegis-sdk-python-1.2.4 → taegis-sdk-python-1.2.5}/taegis_sdk_python/services/authz/types.py

@@ -41,6 +41,7 @@ class AuthzSupportedFeatureTarget(str, Enum):
 
     TENANT = "TENANT"
     CHILD_TENANTS = "CHILD_TENANTS"
+    PARTNER_TENANTS = "PARTNER_TENANTS"
 
 
 @dataclass_json
@@ -185,6 +186,9 @@ class AuthzSupportedFeatureState:
     enabled_in_child_tenants: Optional[bool] = field(
         default=None, metadata=config(field_name="enabledInChildTenants")
     )
+    enabled_in_partner_tenants: Optional[bool] = field(
+        default=None, metadata=config(field_name="enabledInPartnerTenants")
+    )
 
 
 @dataclass_json

{taegis-sdk-python-1.2.4 → taegis-sdk-python-1.2.5}/taegis_sdk_python/services/endpoint_command_manager/types.py

@@ -26,6 +26,7 @@ class FetchRequestPathTypeEnum(str, Enum):
     """FetchRequestPathTypeEnum."""
 
     FILE = "FILE"
+    DIAGNOSTICS = "DIAGNOSTICS"
 
 
 class FetchRequestReasonCodeEnum(str, Enum):
@@ -33,6 +34,7 @@ class FetchRequestReasonCodeEnum(str, Enum):
 
     REASONCODE_UNSPECIFIED = "REASONCODE_UNSPECIFIED"
     POSSIBLY_MALICIOUS = "POSSIBLY_MALICIOUS"
+    TROUBLESHOOTING = "TROUBLESHOOTING"
 
 
 class StatusEnum(str, Enum):

{taegis-sdk-python-1.2.4 → taegis-sdk-python-1.2.5}/taegis_sdk_python/services/events/types.py

@@ -18,7 +18,6 @@ class SearchTarget(str, Enum):
     """SearchTarget."""
 
     ATHENA = "Athena"
-    PRESTO = "Presto"
     ATHENA_HUDI = "AthenaHudi"
     ATHENA_HUDI_STAGING = "AthenaHudiStaging"
 

{taegis-sdk-python-1.2.4 → taegis-sdk-python-1.2.5}/taegis_sdk_python/services/investigations2/types.py

@@ -692,6 +692,14 @@ class TDRUser:
     id: Optional[str] = field(default=None, metadata=config(field_name="id"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class TenantV4:
+    """TenantV4."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class Subject:
@@ -894,6 +902,20 @@ class InvestigationTypeCount:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class InvestigationTenantCount:
+    """InvestigationTenantCount."""
+
+    tenant_id: Optional[str] = field(
+        default=None, metadata=config(field_name="tenantId")
+    )
+    count: Optional[int] = field(default=None, metadata=config(field_name="count"))
+    tenant: Optional[TenantV4] = field(
+        default=None, metadata=config(field_name="tenant")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class InvestigationsV2Arguments:
@@ -1111,6 +1133,22 @@ class CommentsV2Arguments:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class InvestigationProcessingStatus:
+    """InvestigationProcessingStatus."""
+
+    assets: Optional[InvestigationProcessingState] = field(
+        default=None, metadata=config(field_name="assets")
+    )
+    events: Optional[InvestigationProcessingState] = field(
+        default=None, metadata=config(field_name="events")
+    )
+    alerts: Optional[InvestigationProcessingState] = field(
+        default=None, metadata=config(field_name="alerts")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class AggregatedCounts:
@@ -1128,21 +1166,8 @@ class AggregatedCounts:
     priority: Optional[List[InvestigationPriorityCount]] = field(
         default=None, metadata=config(field_name="priority")
     )
-
-
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class InvestigationProcessingStatus:
-    """InvestigationProcessingStatus."""
-
-    assets: Optional[InvestigationProcessingState] = field(
-        default=None, metadata=config(field_name="assets")
-    )
-    events: Optional[InvestigationProcessingState] = field(
-        default=None, metadata=config(field_name="events")
-    )
-    alerts: Optional[InvestigationProcessingState] = field(
-        default=None, metadata=config(field_name="alerts")
+    tenant: Optional[List[InvestigationTenantCount]] = field(
+        default=None, metadata=config(field_name="tenant")
     )
 
 
@@ -1539,6 +1564,9 @@ class InvestigationV2:
     assignee_subject: Optional[Subject] = field(
         default=None, metadata=config(field_name="assigneeSubject")
     )
+    tenant: Optional[TenantV4] = field(
+        default=None, metadata=config(field_name="tenant")
+    )
     created_by: Optional[TDRUser] = field(
         default=None, metadata=config(field_name="createdBy")
     )
@@ -1560,7 +1588,9 @@ class InvestigationV2:
     comments_count: Optional[InvestigationCommentsCount] = field(
         default=None, metadata=config(field_name="commentsCount")
     )
-    metric: Optional[Metric] = field(default=None, metadata=config(field_name="metric"))
+    metrics: Optional[Metric] = field(
+        default=None, metadata=config(field_name="metrics")
+    )
     entities_evidence: Optional[List[EntityEvidence]] = field(
         default=None,
         metadata=config(
@@ -1578,6 +1608,13 @@ class InvestigationV2:
             field_name="assignee",
         ),
     )
+    metric: Optional[Metric] = field(
+        default=None,
+        metadata=config(
+            metadata={"deprecated": True, "deprecation_reason": "use metrics"},
+            field_name="metric",
+        ),
+    )
 
 
 @dataclass_json

{taegis-sdk-python-1.2.4 → taegis-sdk-python-1.2.5}/taegis_sdk_python/services/threat/mutations.py

@@ -59,60 +59,3 @@ class TaegisSDKThreatMutation:
         if result.get(endpoint) is not None:
             return result.get(endpoint)
         raise GraphQLNoRowsInResultSetError("for mutation threatDeleteDocument")
-
-    def create_list(self, input_: CreateListInput) -> ThreatList:
-        """None."""
-        endpoint = "createList"
-
-        log.warning(
-            f"GraphQL Mutation `{endpoint}` is deprecated: 'No longer supported'"
-        )
-
-        result = self.service.execute_mutation(
-            endpoint=endpoint,
-            variables={
-                "input": prepare_input(input_),
-            },
-            output=build_output_string(ThreatList),
-        )
-        if result.get(endpoint) is not None:
-            return ThreatList.from_dict(result.get(endpoint))
-        raise GraphQLNoRowsInResultSetError("for mutation createList")
-
-    def delete_list(self, input_: DeleteListInput) -> bool:
-        """None."""
-        endpoint = "deleteList"
-
-        log.warning(
-            f"GraphQL Mutation `{endpoint}` is deprecated: 'No longer supported'"
-        )
-
-        result = self.service.execute_mutation(
-            endpoint=endpoint,
-            variables={
-                "input": prepare_input(input_),
-            },
-            output="",
-        )
-        if result.get(endpoint) is not None:
-            return result.get(endpoint)
-        raise GraphQLNoRowsInResultSetError("for mutation deleteList")
-
-    def restore_list(self, input_: DeleteListInput) -> bool:
-        """None."""
-        endpoint = "restoreList"
-
-        log.warning(
-            f"GraphQL Mutation `{endpoint}` is deprecated: 'No longer supported'"
-        )
-
-        result = self.service.execute_mutation(
-            endpoint=endpoint,
-            variables={
-                "input": prepare_input(input_),
-            },
-            output="",
-        )
-        if result.get(endpoint) is not None:
-            return result.get(endpoint)
-        raise GraphQLNoRowsInResultSetError("for mutation restoreList")

{taegis-sdk-python-1.2.4 → taegis-sdk-python-1.2.5}/taegis_sdk_python/services/threat/queries.py

@@ -170,7 +170,9 @@ class TaegisSDKThreatQuery:
         raise GraphQLNoRowsInResultSetError("for query threatGetRelated")
 
     def threat_watchlist(self, type_: ThreatParentType) -> List[ThreatRelationship]:
-        """Gets a watchlist by type. All results are considered **high confidence**.."""
+        """Gets a watchlist by type. All results are considered **high confidence**.
+        Only IP and DOMAIN types are supported. Used the paged service threatTimsMalwareFiles for FILE types..
+        """
         endpoint = "threatWatchlist"
 
         result = self.service.execute_query(
@@ -186,6 +188,30 @@ class TaegisSDKThreatQuery:
             )
         raise GraphQLNoRowsInResultSetError("for query threatWatchlist")
 
+    def threat_tims_malware_files(
+        self, last_created: Optional[str] = None
+    ) -> PagedMalwareFiles:
+        """Get all TIMS 2.0 Malware file hashes. All results are considered **high confidence**.
+        This is a paged service, requiring repeated queries. Total number of results can number over 750k.
+        For the initial query, do not provide any search parameters or set 'last_created' to null.
+        Subsequent queries should include the previous query's 'last_created' result from 'PagedMalwareFiles.last_created'
+        as the input parameter. Returns pages of 10,000 at a time, sorted by the indicators field 'created' in desc order.
+        The returned field 'has_more' will be false when the last page is returned.
+        * Note: 'created' refers to an internal field associated with the indicator, not the time the indicator was first found.
+        It is only used for sorting.."""
+        endpoint = "threatTimsMalwareFiles"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "last_created": prepare_input(last_created),
+            },
+            output=build_output_string(PagedMalwareFiles),
+        )
+        if result.get(endpoint) is not None:
+            return PagedMalwareFiles.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query threatTimsMalwareFiles")
+
     def threat_indicator_publications(self, id_: str) -> List[ThreatReport]:
         """Gets publications related to indicators.."""
         endpoint = "threatIndicatorPublications"
@@ -315,74 +341,3 @@ class TaegisSDKThreatQuery:
                 [r or {} for r in result.get(endpoint)], many=True
             )
         raise GraphQLNoRowsInResultSetError("for query threatIndicatorsIntelligence")
-
-    def lists(self, arguments: ListsArguments) -> Lists:
-        """Retrieves Custom Lists for the respective tenant."""
-        endpoint = "lists"
-
-        log.warning(f"GraphQL Query `{endpoint}` is deprecated: 'No longer supported'")
-
-        result = self.service.execute_query(
-            endpoint=endpoint,
-            variables={
-                "arguments": prepare_input(arguments),
-            },
-            output=build_output_string(Lists),
-        )
-        if result.get(endpoint) is not None:
-            return Lists.from_dict(result.get(endpoint))
-        raise GraphQLNoRowsInResultSetError("for query lists")
-
-    def list(self, id_: str, arguments: ListsArguments) -> ThreatList:
-        """Retrieves a custom list by ID."""
-        endpoint = "list"
-
-        log.warning(f"GraphQL Query `{endpoint}` is deprecated: 'No longer supported'")
-
-        result = self.service.execute_query(
-            endpoint=endpoint,
-            variables={
-                "id": prepare_input(id_),
-                "arguments": prepare_input(arguments),
-            },
-            output=build_output_string(ThreatList),
-        )
-        if result.get(endpoint) is not None:
-            return ThreatList.from_dict(result.get(endpoint))
-        raise GraphQLNoRowsInResultSetError("for query list")
-
-    def list_items_by_tag(self, tag: str, arguments: ListsArguments) -> ListItems:
-        """Retrieves list items that contains the specified tag (case sensitive)."""
-        endpoint = "listItemsByTag"
-
-        log.warning(f"GraphQL Query `{endpoint}` is deprecated: 'No longer supported'")
-
-        result = self.service.execute_query(
-            endpoint=endpoint,
-            variables={
-                "tag": prepare_input(tag),
-                "arguments": prepare_input(arguments),
-            },
-            output=build_output_string(ListItems),
-        )
-        if result.get(endpoint) is not None:
-            return ListItems.from_dict(result.get(endpoint))
-        raise GraphQLNoRowsInResultSetError("for query listItemsByTag")
-
-    def list_items_by_name(self, name: str, arguments: ListsArguments) -> ListItems:
-        """Retrieves list items by indicator name."""
-        endpoint = "listItemsByName"
-
-        log.warning(f"GraphQL Query `{endpoint}` is deprecated: 'No longer supported'")
-
-        result = self.service.execute_query(
-            endpoint=endpoint,
-            variables={
-                "name": prepare_input(name),
-                "arguments": prepare_input(arguments),
-            },
-            output=build_output_string(ListItems),
-        )
-        if result.get(endpoint) is not None:
-            return ListItems.from_dict(result.get(endpoint))
-        raise GraphQLNoRowsInResultSetError("for query listItemsByName")