taegis-sdk-python 1.2.7__tar.gz → 1.2.9__tar.gz

{taegis_sdk_python-1.2.7/taegis_sdk_python.egg-info → taegis_sdk_python-1.2.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: taegis-sdk-python
-Version: 1.2.7
+Version: 1.2.9
 Summary: Taegis Python SDK
 Home-page: https://github.com/secureworks/taegis-sdk-python
 Author: Secureworks

taegis_sdk_python-1.2.9/requirements-dev.txt

@@ -0,0 +1,2 @@
+pylint==3.2.3
+black

{taegis_sdk_python-1.2.7 → taegis_sdk_python-1.2.9}/setup.py

@@ -1,6 +1,9 @@
-import setuptools
+"""setup.py"""
+
 from pathlib import Path
 
+import setuptools
+
 README = Path() / "README.md"
 if not README.exists():
     raise RuntimeError(f"{README.name} does not exist")

{taegis_sdk_python-1.2.7 → taegis_sdk_python-1.2.9}/taegis_sdk_python/__init__.py

@@ -1,6 +1,7 @@
 """
 Commonly-used functions and data types from this package.
 """
+
 from taegis_sdk_python.errors import (
     ServiceCoreException,
     InvalidAuthenticationMethod,

taegis_sdk_python-1.2.9/taegis_sdk_python/_version.py

@@ -0,0 +1 @@
+__version__ = "v1.2.9"

{taegis_sdk_python-1.2.7 → taegis_sdk_python-1.2.9}/taegis_sdk_python/errors.py

@@ -2,6 +2,7 @@
 
 Taegis Python SDK Exception class definitions.
 """
+
 from typing import List, Optional
 
 

{taegis_sdk_python-1.2.7 → taegis_sdk_python-1.2.9}/taegis_sdk_python/service_core.py

@@ -292,7 +292,34 @@ class ServiceCore:
     def execute_query(
         self, endpoint: str, output: str, variables: Optional[Dict[str, Any]] = None
     ) -> Any:
-        """Execute a GraphQL Query."""
+        """Execute a GraphQL Query.
+
+        Parameters
+        ----------
+        endpoint : str
+            GraphQL Query Endpoint
+            example: 'alertsServiceSearch'
+        output : str
+            Requested output fields in the API result set.
+            example: 'alerts { list { id metadata { title } } }'
+            example: 'investigations { id description }'
+            helper function:
+                from taegis_sdk_python import build_output_string
+                from taegis_sdk_python.services.alerts.types import AlertsReponse
+                print(build_output_string(AlertsResponse))
+        variables : Optional[Dict[str, Any]], optional
+            Variables submitted to GraphQL Operation, by default None
+            example: {'in': {'cql_query': 'FROM alert EARLIEST=-1d', 'offset': 0, 'limit': 10 } }
+
+        Returns
+        -------
+        Any
+            Query Results
+
+        Raises
+        ------
+        InvalidGraphQLEndpoint
+        """
         operation_type = "query"
         graphql_field = self.get_sync_schema().query_type.fields.get(endpoint)
         if not graphql_field:
@@ -318,7 +345,34 @@ class ServiceCore:
     def execute_mutation(
         self, endpoint: str, output: str, variables: Optional[Dict[str, Any]] = None
     ) -> Any:
-        """Execute a GraphQL Mutation."""
+        """Execute a GraphQL Mutation.
+
+        Parameters
+        ----------
+        endpoint : str
+            GraphQL Mutation Endpoint
+            example: 'alertsServiceSearch'
+        output : str
+            Requested output fields in the API result set.
+            example: 'alerts { list { id metadata { title } } }'
+            example: 'investigations { id description }'
+            helper function:
+                from taegis_sdk_python import build_output_string
+                from taegis_sdk_python.services.alerts.types import AlertsReponse
+                print(build_output_string(AlertsResponse))
+        variables : Optional[Dict[str, Any]], optional
+            Variables submitted to GraphQL Operation, by default None
+            example: {'in': {'cql_query': 'FROM alert EARLIEST=-1d', 'offset': 0, 'limit': 10 } }
+
+        Returns
+        -------
+        Any
+            Mutation Results
+
+        Raises
+        ------
+        InvalidGraphQLEndpoint
+        """
         operation_type = "mutation"
         graphql_field = self.get_sync_schema().mutation_type.fields.get(endpoint)
         if not graphql_field:
@@ -344,7 +398,34 @@ class ServiceCore:
     def execute_subscription(
         self, endpoint: str, output: str, variables: Optional[Dict[str, Any]] = None
     ) -> List[Any]:
-        """Execute a GraphQL Subscription."""
+        """Execute a GraphQL Subscription.
+
+        Parameters
+        ----------
+        endpoint : str
+            GraphQL Subscription Endpoint
+            example: 'alertsServiceSearch'
+        output : str
+            Requested output fields in the API result set.
+            example: 'alerts { list { id metadata { title } } }'
+            example: 'investigations { id description }'
+            helper function:
+                from taegis_sdk_python import build_output_string
+                from taegis_sdk_python.services.alerts.types import AlertsReponse
+                print(build_output_string(AlertsResponse))
+        variables : Optional[Dict[str, Any]], optional
+            Variables submitted to GraphQL Operation, by default None
+            example: {'in': {'cql_query': 'FROM alert EARLIEST=-1d', 'offset': 0, 'limit': 10 } }
+
+        Returns
+        -------
+        List[Any]
+            List of Subscription Results
+
+        Raises
+        ------
+        InvalidGraphQLEndpoint
+        """
         operation_type = "subscription"
         graphql_field = self.get_ws_schema().subscription_type.fields.get(endpoint)
         if not graphql_field:
@@ -370,7 +451,20 @@ class ServiceCore:
     def execute(
         self, query_string: str, variables: Optional[Dict[str, Any]] = None
     ) -> Any:
-        """Execute a syncronous GraphQL string."""
+        """Execute a GraphQL string.
+
+        Parameters
+        ----------
+        query_string : str
+            GraphQL string
+        variables : Optional[Dict[str, Any]], optional
+            Variables for query/mutation, by default None
+
+        Returns
+        -------
+        Any
+            Query/Mutation results
+        """
         query = gql(query_string)
         return self.sync_client.execute(
             query,
@@ -381,7 +475,20 @@ class ServiceCore:
     async def subscribe(
         self, query_string: str, variables: Optional[Dict[str, Any]] = None
     ) -> List[Any]:
-        """Execute a subsciption GraphQL string."""
+        """Execute a subsciption GraphQL string.
+
+        Parameters
+        ----------
+        query_string : str
+            GraphQL string
+        variables : Optional[Dict[str, Any]], optional
+            Variables for subscription, by default None
+
+        Returns
+        -------
+        List[Any]
+            List of subscription results
+        """
         query = gql(query_string)
         results = []
         async with self.ws_client as session:

{taegis_sdk_python-1.2.7 → taegis_sdk_python-1.2.9}/taegis_sdk_python/services/__init__.py

@@ -55,6 +55,7 @@ from taegis_sdk_python.services.threat import ThreatService
 from taegis_sdk_python.services.threat_score import ThreatScoreService
 from taegis_sdk_python.services.trip import TripService
 from taegis_sdk_python.services.users import UsersService
+from taegis_sdk_python.services.vdr import VDRService
 
 __all__ = ["GraphQLService"]
 
@@ -154,6 +155,7 @@ class GraphQLService:
         self._threat_score = None
         self._trip = None
         self._users = None
+        self._vdr = None
 
     def __call__(self, **kwargs):
         if threading.get_ident() not in self._context_kwargs:
@@ -559,3 +561,10 @@ class GraphQLService:
         if not self._users:
             self._users = UsersService(self)
         return self._users
+
+    @property
+    def vdr(self):
+        """Users Service Endpoint."""
+        if not self._vdr:
+            self._vdr = VDRService(self)
+        return self._vdr

{taegis_sdk_python-1.2.7 → taegis_sdk_python-1.2.9}/taegis_sdk_python/services/access_points/__init__.py

@@ -1,4 +1,5 @@
 """AccessPoints Service."""
+
 from taegis_sdk_python.service_core import ServiceCore
 from taegis_sdk_python.services.access_points.mutations import (
     TaegisSDKAccessPointsMutation,

{taegis_sdk_python-1.2.7 → taegis_sdk_python-1.2.9}/taegis_sdk_python/services/alerts/__init__.py

@@ -1,4 +1,5 @@
 """Alerts Service."""
+
 from taegis_sdk_python.service_core import ServiceCore
 from taegis_sdk_python.services.alerts.mutations import TaegisSDKAlertsMutation
 from taegis_sdk_python.services.alerts.queries import TaegisSDKAlertsQuery

{taegis_sdk_python-1.2.7 → taegis_sdk_python-1.2.9}/taegis_sdk_python/services/alerts/queries.py

@@ -104,6 +104,23 @@ class TaegisSDKAlertsQuery:
             "for query alertsServiceRetrieveAlertsByGroupKey"
         )
 
+    def alerts_count_by_tenant(
+        self, in_: AlertsCountByTenantInput
+    ) -> AlertsCountByTenantResponse:
+        """Returns the count of alerts per tenant. Allows a CQL query, but any aggregation or pipe will be ignored.."""
+        endpoint = "alertsCountByTenant"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(AlertsCountByTenantResponse),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsCountByTenantResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query alertsCountByTenant")
+
     def alerts_service_search(
         self, in_: Optional[SearchRequestInput] = None
     ) -> AlertsResponse:

{taegis_sdk_python-1.2.7 → taegis_sdk_python-1.2.9}/taegis_sdk_python/services/alerts/types.py

@@ -210,6 +210,19 @@ class PollRequestInput:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class AlertsCountByTenantInput:
+    """AlertsCountByTenantInput."""
+
+    ql_query: Optional[str] = field(
+        default=None, metadata=config(field_name="ql_query")
+    )
+    tenant_service_filters: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="tenant_service_filters")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class SearchRequestInput:
@@ -508,6 +521,14 @@ class AggregationKeys:
     value: Optional[str] = field(default=None, metadata=config(field_name="value"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class TenantV4:
+    """TenantV4."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class AlertRuleReference:
@@ -1259,6 +1280,27 @@ class AlertsAggregateResponse_AlertsAggregation:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class AlertsCountByTenantResponseItem:
+    """AlertsCountByTenantResponseItem."""
+
+    count: Optional[int] = field(default=None, metadata=config(field_name="count"))
+    tenant: Optional[TenantV4] = field(
+        default=None, metadata=config(field_name="tenant")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class AlertsCountByTenantResponse:
+    """AlertsCountByTenantResponse."""
+
+    items: Optional[List[AlertsCountByTenantResponseItem]] = field(
+        default=None, metadata=config(field_name="items")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class BulkResolutionResponse:
@@ -1619,6 +1661,29 @@ class ResolutionMetadata:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class TuningUpdate:
+    """TuningUpdate."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    field_name: Optional[str] = field(
+        default=None, metadata=config(field_name="field_name")
+    )
+    severity_value: Optional[float] = field(
+        default=None, metadata=config(field_name="severity_value")
+    )
+    suppressed_value: Optional[bool] = field(
+        default=None, metadata=config(field_name="suppressed_value")
+    )
+    origin_value: Optional[Origin] = field(
+        default=None, metadata=config(field_name="origin_value")
+    )
+    changed_at: Optional[Timestamp] = field(
+        default=None, metadata=config(field_name="changed_at")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class AuthScanDetail:
@@ -2033,7 +2098,14 @@ class AlertsInvestigationInfo:
         default=None, metadata=config(field_name="alert_resource_id")
     )
     initial_access_vector_info: Optional[List[InitialAccessVectorInfo]] = field(
-        default=None, metadata=config(field_name="initial_access_vector_info")
+        default=None,
+        metadata=config(
+            metadata={
+                "deprecated": True,
+                "deprecation_reason": "data no longer exists",
+            },
+            field_name="initial_access_vector_info",
+        ),
     )
 
 
@@ -2090,7 +2162,14 @@ class BulkInvestigationsResponse:
         default=None, metadata=config(field_name="status")
     )
     access_vector_info: Optional[List[AlertsInvestigationInfo]] = field(
-        default=None, metadata=config(field_name="access_vector_info")
+        default=None,
+        metadata=config(
+            metadata={
+                "deprecated": True,
+                "deprecation_reason": "data no longer exists",
+            },
+            field_name="access_vector_info",
+        ),
     )
 
 
@@ -2111,7 +2190,14 @@ class UpdateInvestigationResponse:
         default=None, metadata=config(field_name="status")
     )
     access_vector_info: Optional[List[AlertsInvestigationInfo]] = field(
-        default=None, metadata=config(field_name="access_vector_info")
+        default=None,
+        metadata=config(
+            metadata={
+                "deprecated": True,
+                "deprecation_reason": "data no longer exists",
+            },
+            field_name="access_vector_info",
+        ),
     )
 
 
@@ -2238,7 +2324,14 @@ class Alert2:
         default=None, metadata=config(field_name="attack_technique_ids")
     )
     tenant_id: Optional[str] = field(
-        default=None, metadata=config(field_name="tenant_id")
+        default=None,
+        metadata=config(
+            metadata={
+                "deprecated": True,
+                "deprecation_reason": "being replaced with Tenant field",
+            },
+            field_name="tenant_id",
+        ),
     )
     parent_tenant_id: Optional[str] = field(
         default=None, metadata=config(field_name="parent_tenant_id")
@@ -2262,6 +2355,9 @@ class Alert2:
     visibility: Optional[Visibility] = field(
         default=None, metadata=config(field_name="visibility")
     )
+    tenant: Optional[TenantV4] = field(
+        default=None, metadata=config(field_name="tenant")
+    )
     suppression_rules: Optional[List[AlertRuleReference]] = field(
         default=None, metadata=config(field_name="suppression_rules")
     )
@@ -2277,6 +2373,9 @@ class Alert2:
     severity_history: Optional[List[SeverityUpdate]] = field(
         default=None, metadata=config(field_name="severity_history")
     )
+    tuning_history: Optional[List[TuningUpdate]] = field(
+        default=None, metadata=config(field_name="tuning_history")
+    )
     entities: Optional[EntityRelationships] = field(
         default=None, metadata=config(field_name="entities")
     )

{taegis_sdk_python-1.2.7 → taegis_sdk_python-1.2.9}/taegis_sdk_python/services/assets/__init__.py

@@ -1,4 +1,5 @@
 """"Assets Service."""
+
 from taegis_sdk_python.service_core import ServiceCore
 from taegis_sdk_python.services.assets.mutations import TaegisSDKAssetsMutation
 from taegis_sdk_python.services.assets.queries import TaegisSDKAssetsQuery

{taegis_sdk_python-1.2.7 → taegis_sdk_python-1.2.9}/taegis_sdk_python/services/assets2/__init__.py

@@ -1,4 +1,5 @@
 """"Assets2 Service."""
+
 from taegis_sdk_python.service_core import ServiceCore
 from taegis_sdk_python.services.assets2.mutations import TaegisSDKAssets2Mutation
 from taegis_sdk_python.services.assets2.queries import TaegisSDKAssets2Query

{taegis_sdk_python-1.2.7 → taegis_sdk_python-1.2.9}/taegis_sdk_python/services/assets2/mutations.py

@@ -155,8 +155,7 @@ class TaegisSDKAssets2Mutation:
     ) -> BulkOpPayloadV2:
         """Start a job to assign the endpoints matching the filter criteria to the
         investigation in the input. Use the task ID in the response to poll the
-        assignBulkAssetsToInvestigationStatus query to determine if the job succeeded..
-        """
+        assignBulkAssetsToInvestigationStatus query to determine if the job succeeded.."""
         endpoint = "assignBulkAssetsToInvestigation"
 
         result = self.service.execute_mutation(
@@ -177,8 +176,7 @@ class TaegisSDKAssets2Mutation:
     ) -> BulkOpPayloadV2:
         """Start a job to delete the provided investigation from the endpoints matching
         the filter criteria in the input. Use the task ID in the response to poll the
-        bulkDeleteInvestigationForEndpointsStatus query to determine if the job succeeded..
-        """
+        bulkDeleteInvestigationForEndpointsStatus query to determine if the job succeeded.."""
         endpoint = "bulkDeleteInvestigationForEndpoints"
 
         result = self.service.execute_mutation(
@@ -197,7 +195,7 @@ class TaegisSDKAssets2Mutation:
     def bulk_reconnect_native_assets(
         self, input_: BulkReconnectNativeAssetsInput
     ) -> BulkOpPayloadV2:
-        """None."""
+        """Start a job to reconnect taegis endpoints matching the filter criteria in the input.."""
         endpoint = "bulkReconnectNativeAssets"
 
         result = self.service.execute_mutation(
@@ -214,7 +212,7 @@ class TaegisSDKAssets2Mutation:
     def bulk_uninstall_native_assets(
         self, input_: BulkUninstallNativeAssetsInput
     ) -> BulkOpPayloadV2:
-        """None."""
+        """Start a job to uninstall taegis endpoints matching the filter criteria in the input.."""
         endpoint = "bulkUninstallNativeAssets"
 
         result = self.service.execute_mutation(