taegis-sdk-python 1.3.0__tar.gz → 1.4.0__tar.gz

{taegis_sdk_python-1.3.0/taegis_sdk_python.egg-info → taegis_sdk_python-1.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.3.0
+Version: 1.4.0
 Summary: Taegis Python SDK
 Home-page: https://github.com/secureworks/taegis-sdk-python
 Author: Secureworks

{taegis_sdk_python-1.3.0 → taegis_sdk_python-1.4.0}/taegis_sdk_python/_consts.py

@@ -27,6 +27,9 @@ TAEGIS_TENANTS_URLS = {
     "US3": "https://api-tenants.foxtrot.taegis.secureworks.com",
 }
 
+UNIVERSAL_ENVIRONMENT = "universal"
+UNIVERSAL_AUTHENTICATION_URL = "https://api.taegis.secureworks.com"
+
 
 class TaegisEnum(str, Enum):
     """Handler for Unknown Enums."""

taegis_sdk_python-1.4.0/taegis_sdk_python/_version.py

@@ -0,0 +1 @@
+__version__ = "v1.4.0"

{taegis_sdk_python-1.3.0 → taegis_sdk_python-1.4.0}/taegis_sdk_python/authentication.py

@@ -5,19 +5,16 @@ Authenication implementations for Taegis.
 
 import logging
 import os
-from getpass import getpass
-from time import time
-from typing import Any, Dict, Tuple, Union, Optional
 import threading
+from time import time
+from typing import Optional, Tuple, Union
 
 from oauthlib.oauth2 import BackendApplicationClient
 from requests import HTTPError, post
 from requests_oauthlib import OAuth2Session
+
 from taegis_sdk_python.config import get_config, write_to_config
-from taegis_sdk_python.errors import (
-    InvalidAuthenticationMethod,
-    MissingAccessTokenError,
-)
+from taegis_sdk_python.errors import MissingAccessTokenError
 from taegis_sdk_python.tokens import get_token_exp
 
 try:
@@ -30,34 +27,6 @@ logger = logging.getLogger(__name__)
 LOCK = threading.RLock()
 
 
-def check_username(
-    request_url: str, username: str
-) -> Dict[str, Any]:  # pragma: no cover
-    """Check if the user needs to login via password or sso.
-
-    Parameters
-    ----------
-    request_url : str
-        Taegis Environment URL
-    username : str
-        Username
-
-    Returns
-    -------
-    Dict[str, Any]
-        JSON response from username check
-    """
-    logger.debug("Checking login type for username...")
-    userlogin_endpoint = "/auth/userLogin"
-
-    response = post(
-        f"{request_url}{userlogin_endpoint}", json={"username": username}, timeout=300
-    )
-    logger.debug(response)
-
-    return response.json()
-
-
 def get_oauth_from_env(environment: str) -> Tuple[Optional[str], Optional[str]]:
     """
     Retrieve CLIENT_ID and CLIENT_SECRET credentials from environment.
@@ -116,28 +85,10 @@ def get_token(environment: str, request_url: str) -> str:  # pragma: no cover
                         request_url, client_id, client_secret
                     )
                 else:
-                    username = input("Username: ")
-                    response = check_username(request_url, username)
-                    external_provider = response.get("external_provider")
-
-                    if (
-                        response.get("login_type") == "username-password"
-                        and external_provider != "COGNITO"
-                    ):
-                        access_token = get_token_by_password_grant(
-                            request_url, username
-                        )
-                    elif (
-                        response.get("login_type") == "sso"
-                        or external_provider == "COGNITO"
-                    ):
-                        access_token = get_token_by_device_code_authorization(
-                            request_url, external_provider
-                        )
-                    else:
-                        raise InvalidAuthenticationMethod(
-                            message="No known authentication method for user"
-                        )
+                    access_token = get_token_by_device_code_authorization(request_url)
+
+                if not access_token:
+                    raise MissingAccessTokenError(message="Access token ")
 
                 write_to_config(environment, "access_token", access_token)
 
@@ -148,11 +99,14 @@ def get_cached_token(env: str) -> Union[str, None]:  # pragma: no cover
     """Get cached token from config file."""
     config = get_config()
 
+    logger.debug(f"Checking for cached token in config for {env}...")
     # check for token and expiry in config
     token = str(config.get(env, "access_token", fallback=""))
     if token and get_token_exp(token) >= int(time()) + 15:
+        logger.debug(f"Token found in config and not expired for {env}...")
         return token
 
+    logger.debug(f"Token not found in config or expired for {env}...")
     return None
 
 
@@ -198,82 +152,8 @@ def get_token_by_oauth(
     return access_token
 
 
-def get_token_by_password_grant(
-    request_url: str,
-    username: str,
-    password: Optional[str] = None,
-) -> str:  # pragma: no cover
-    """Get an access token by username/password with mfa.
-
-    Parameters
-    ----------
-    request_url : str
-        Endpoint URL for Taegis environment
-    username : str
-        User to authenticate
-
-    Returns
-    -------
-    str
-        Access token
-
-    Raises
-    ------
-    requests.HTTPError
-        Any issue with retrieving token via HTTP
-    """
-    auth_uri = "/universal-auth/token"
-
-    if not password:
-        password = getpass("Password: ")
-
-    response = post(
-        f"{request_url}{auth_uri}",
-        json={"username": username, "password": password, "grant_type": "password"},
-        timeout=300,
-    )
-
-    if access_token := response.json().get("access_token"):
-        return access_token
-
-    try:
-        mfa_token = response.json().get("mfa_token")
-    except JSONDecodeError as exc:
-        raise HTTPError(response.text, response=response) from exc
-
-    if not mfa_token:
-        raise HTTPError(response.text, response=response)
-
-    mfa_input = input("MFA Token: ")
-
-    response = post(
-        f"{request_url}{auth_uri}",
-        json={
-            "mfa_token": mfa_token,
-            "otp": mfa_input,
-            "grant_type": "http://ctpx.secureworks.com/grant-type/mfa-otp",
-        },
-        timeout=300,
-    )
-    response.raise_for_status()
-    try:
-        access_token = response.json().get("access_token")
-    except JSONDecodeError as exc:
-        raise HTTPError(response.text, response=response) from exc
-
-    if not access_token:
-        raise MissingAccessTokenError(
-            message="Access token not found",
-            comments=["Check credentials and MFA input."],
-            nested_exception=HTTPError(response.text, response=response),
-        )
-
-    return access_token
-
-
 def get_token_by_device_code_authorization(
     request_url: str,
-    external_provider: str,
 ) -> Union[str, None]:  # pragma: no cover
     """Get a user token via Device Code authorization.
 
@@ -291,14 +171,14 @@ def get_token_by_device_code_authorization(
     init_endpoint = "/universal-auth/device/code/auth"
     token_endpoint = "/universal-auth/device/code/token"
 
-    if external_provider == "COGNITO":
-        init_endpoint += "?version=2"
-        token_endpoint += "?version=2"
-
-    response = post(f"{request_url}{init_endpoint}", timeout=300)
+    init_url = f"{request_url}{init_endpoint}"
+    logger.debug(f"Init URL: {init_url}")
+    response = post(init_url, timeout=300)
+    logger.debug(f"Response: {response.text}")
 
     try:
         device_code_flow = response.json()
+
     except JSONDecodeError as exc:
         raise HTTPError(response.text, response=response) from exc
 

{taegis_sdk_python-1.3.0 → taegis_sdk_python-1.4.0}/taegis_sdk_python/services/__init__.py

@@ -11,7 +11,11 @@ import aiohttp
 from aiohttp.client_reqrep import Fingerprint
 from aiohttp.typedefs import LooseHeaders
 
-from taegis_sdk_python._consts import TAEGIS_ENVIRONMENT_URLS
+from taegis_sdk_python._consts import (
+    TAEGIS_ENVIRONMENT_URLS,
+    UNIVERSAL_AUTHENTICATION_URL,
+    UNIVERSAL_ENVIRONMENT,
+)
 from taegis_sdk_python._version import __version__
 from taegis_sdk_python.authentication import get_token
 from taegis_sdk_python.config import write_to_config
@@ -93,6 +97,7 @@ class GraphQLService:
         ssl: Optional[Union[SSLContext, Literal[False], Fingerprint]] = None,
         execute_timeout: Optional[Union[int, float]] = 300,
         max_message_size: int = 0,
+        use_universal_authentication: bool = False,
     ):  # pylint: disable=too-many-statements
         """
         GraphQLService
@@ -137,6 +142,7 @@ class GraphQLService:
         """
         self._environments = environments or TAEGIS_ENVIRONMENT_URLS
         self._environment = environment or list(self._environments)[0]
+        self._use_universal_authentication = use_universal_authentication
 
         if self._environment not in self._environments:
             raise ValueError(f"environment must be in {self._environments.keys()}")
@@ -253,11 +259,42 @@ class GraphQLService:
         """Taegis Environment."""
         return self._context_manager.get("environment", self._environment)
 
+    @property
+    def authentication_environment(self):
+        """Taegis Authentication Environment."""
+        return self._context_manager.get(
+            "authentication_environment",
+            (
+                UNIVERSAL_ENVIRONMENT
+                if self.use_universal_authentication
+                else self.environment
+            ),
+        )
+
     @property
     def url(self):
         """Taegis Environment URL."""
         return self._context_manager.get("url")
 
+    @property
+    def authentication_url(self):
+        """Taegis Authentication URL."""
+        return self._context_manager.get(
+            "authentication_url",
+            (
+                UNIVERSAL_AUTHENTICATION_URL
+                if self.use_universal_authentication
+                else self._environments[self.environment]
+            ),
+        )
+
+    @property
+    def use_universal_authentication(self):
+        """Use Universal Authentication."""
+        return self._context_manager.get(
+            "use_universal_authentication", self._use_universal_authentication
+        )
+
     @property
     def gateway(self):
         """Taegis GraphQL Gateway."""
@@ -276,14 +313,14 @@ class GraphQLService:
         )
         if not access_token:
             access_token = get_token(
-                environment=self.environment,
-                request_url=self._environments.get(self.environment),
+                environment=self.authentication_environment,
+                request_url=self.authentication_url,
             )
         return access_token
 
     def clear_access_token(self):
         """Clear the current access token."""
-        write_to_config(self.environment, "access_token", "")
+        write_to_config(self.authentication_environment, "access_token", "")
 
     @property
     def output(self):

{taegis_sdk_python-1.3.0 → taegis_sdk_python-1.4.0}/taegis_sdk_python/services/alerts/types.py

@@ -3159,7 +3159,14 @@ class Alert2:
         default=None, metadata=config(field_name="threat_score_v2")
     )
     observation: Optional[bool] = field(
-        default=None, metadata=config(field_name="observation")
+        default=None,
+        metadata=config(
+            metadata={
+                "deprecated": True,
+                "deprecation_reason": "use threat_score_v2 value instead",
+            },
+            field_name="observation",
+        ),
     )
     metadata: Optional[AlertsMetadata] = field(
         default=None, metadata=config(field_name="metadata")

{taegis_sdk_python-1.3.0 → taegis_sdk_python-1.4.0}/taegis_sdk_python/services/threat/queries.py

@@ -387,3 +387,23 @@ class TaegisSDKThreatQuery:
                 [r or {} for r in result.get(endpoint)], many=True
             )
         raise GraphQLNoRowsInResultSetError("for query threatFacetInfo")
+
+    def threat_associated_indicators(
+        self, id_: str, page: Optional[ThreatPageInput] = None
+    ) -> List[ThreatIndicator]:
+        """Retrives all associated indicators to a malware or threat_group."""
+        endpoint = "threatAssociatedIndicators"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "ID": prepare_input(id_),
+                "page": prepare_input(page),
+            },
+            output=build_output_string(ThreatIndicator),
+        )
+        if result.get(endpoint) is not None:
+            return ThreatIndicator.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query threatAssociatedIndicators")

{taegis_sdk_python-1.3.0 → taegis_sdk_python-1.4.0}/taegis_sdk_python/services/threat/types.py

@@ -838,6 +838,9 @@ class ThreatReportInput:
 class FacetInfo:
     """FacetInfo."""
 
+    display_name: Optional[str] = field(
+        default=None, metadata=config(field_name="displayName")
+    )
     facet: Optional[str] = field(default=None, metadata=config(field_name="facet"))
     fields: Optional[List[FacetFieldInfo]] = field(
         default=None, metadata=config(field_name="fields")

{taegis_sdk_python-1.3.0 → taegis_sdk_python-1.4.0}/taegis_sdk_python/services/vdr/types.py

@@ -64,6 +64,7 @@ class VdrCounterThreatUnit(str, Enum):
     ISENSOR_RULES_TARGET = "ISENSOR_RULES_TARGET"
     ADVISORIES_MENTIONS = "ADVISORIES_MENTIONS"
     IDENTIFIED_MALWARE_THREAT_ACTORS = "IDENTIFIED_MALWARE_THREAT_ACTORS"
+    THREAT_ANALYSIS_MENTIONS = "THREAT_ANALYSIS_MENTIONS"
 
 
 class VdrExploitability(str, Enum):
@@ -73,6 +74,7 @@ class VdrExploitability(str, Enum):
     DOS_EXPLOIT_EXIST = "DOS_EXPLOIT_EXIST"
     REMOTE_EXPLOIT_EXIST = "REMOTE_EXPLOIT_EXIST"
     WEB_EXPLOIT_EXIST = "WEB_EXPLOIT_EXIST"
+    TRUSTED_EXPLOIT_EXIST = "TRUSTED_EXPLOIT_EXIST"
 
 
 class VdrAttackClass(str, Enum):

{taegis_sdk_python-1.3.0 → taegis_sdk_python-1.4.0}/taegis_sdk_python/utils.py

@@ -51,8 +51,7 @@ def unwrap(t: Field) -> Any:
     #
     # Neither of these need to be included to
     # generate GraphQL strings sent to the server
-    args = [arg for arg in get_args(
-        t) if arg != type(None) and arg != TaegisEnum]
+    args = [arg for arg in get_args(t) if arg != type(None) and arg != TaegisEnum]
 
     # Unwrap List[type]
     if hasattr(t, "_name") and t._name == "List":  # pylint: disable=protected-access
@@ -88,8 +87,7 @@ def build_output_dataclass(cls: Any) -> Any:
     output_fields = []
     for field in dc_fields(cls):
         log.debug(f"{field=}")
-        letter_case = field.metadata.get(
-            "dataclasses_json", {}).get("letter_case")
+        letter_case = field.metadata.get("dataclasses_json", {}).get("letter_case")
         if letter_case:
             field_name = letter_case(...)
         else:
@@ -146,8 +144,7 @@ def build_output_string(cls) -> str:
             if item == type(None):
                 continue
             output_string = build_output_string(item)
-            output_fields.append(
-                f"... on {item.__name__} {{ {output_string} }}")
+            output_fields.append(f"... on {item.__name__} {{ {output_string} }}")
 
     elif isinstance(cls, (list, tuple)):
         if len(cls) == 1:
@@ -160,8 +157,7 @@ def build_output_string(cls) -> str:
             if item == type(None):
                 continue
             output_string = build_output_string(item)
-            output_fields.append(
-                f"... on {item.__name__} {{ {output_string} }}")
+            output_fields.append(f"... on {item.__name__} {{ {output_string} }}")
         output_fields.append("}")
         log.debug("Generating output string.  Done...")
 
@@ -235,8 +231,7 @@ def build_output_string_from_introspection(field: Any) -> str:
         fields.append(name)
         scalar = graphql_unwrap_field(gql_type)
         if is_object_type(scalar):
-            fields.append(
-                f"{{ {build_output_string_from_introspection(scalar)} }}")
+            fields.append(f"{{ {build_output_string_from_introspection(scalar)} }}")
     return " ".join(fields)
 
 
@@ -275,8 +270,7 @@ def prepare_input(value: Any) -> Any:
     """
     if is_dataclass(value):
         for field in dc_fields(value):
-            letter_case = field.metadata.get(
-                "dataclasses_json", {}).get("letter_case")
+            letter_case = field.metadata.get("dataclasses_json", {}).get("letter_case")
             if letter_case:
                 field_name = letter_case(...)
             else:
@@ -348,7 +342,9 @@ def prepare_variables(
     return {key: value for key, value in variables.items() if value is not None}
 
 
-def parse_union_result(union, result: Union[List[Dict[str, Any]], Dict[str, Any]]) -> Any:
+def parse_union_result(
+    union, result: Union[List[Dict[str, Any]], Dict[str, Any]]
+) -> Any:
     """
     Coerse result into a type from union.
 

{taegis_sdk_python-1.3.0 → taegis_sdk_python-1.4.0/taegis_sdk_python.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.3.0
+Version: 1.4.0
 Summary: Taegis Python SDK
 Home-page: https://github.com/secureworks/taegis-sdk-python
 Author: Secureworks

taegis_sdk_python-1.3.0/taegis_sdk_python/_version.py

@@ -1 +0,0 @@
-__version__ = "v1.3.0"