taegis-sdk-python 1.4.11__tar.gz → 1.4.13__tar.gz

{taegis_sdk_python-1.4.11/taegis_sdk_python.egg-info → taegis_sdk_python-1.4.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.4.11
+Version: 1.4.13
 Summary: Taegis Python SDK
 Home-page: https://github.com/secureworks/taegis-sdk-python
 Author: Secureworks

{taegis_sdk_python-1.4.11 → taegis_sdk_python-1.4.13}/taegis_sdk_python/_consts.py

@@ -12,6 +12,8 @@ TAEGIS_ENVIRONMENT_URLS = {
     "EU": "https://api.echo.taegis.secureworks.com",
     "foxtrot": "https://api.foxtrot.taegis.secureworks.com",
     "US3": "https://api.foxtrot.taegis.secureworks.com",
+    "golf": "https://api.golf.taegis.secureworks.com",
+    "EUW1": "https://api.golf.taegis.secureworks.com",
 }
 
 
@@ -25,6 +27,8 @@ TAEGIS_TENANTS_URLS = {
     "EU": "https://api-tenants.echo.taegis.secureworks.com",
     "foxtrot": "https://api-tenants.foxtrot.taegis.secureworks.com",
     "US3": "https://api-tenants.foxtrot.taegis.secureworks.com",
+    "golf": "https://api-tenants.golf.taegis.secureworks.com",
+    "EUW1": "https://api-tenants.golf.taegis.secureworks.com",
 }
 
 UNIVERSAL_ENVIRONMENT = "universal"

taegis_sdk_python-1.4.13/taegis_sdk_python/_version.py

@@ -0,0 +1 @@
+__version__ = "v1.4.13"

{taegis_sdk_python-1.4.11 → taegis_sdk_python-1.4.13}/taegis_sdk_python/services/__init__.py

@@ -45,6 +45,7 @@ from taegis_sdk_python.services.endpoint_management_service import (
 from taegis_sdk_python.services.event_search import EventSearchService
 from taegis_sdk_python.services.events import EventsService
 from taegis_sdk_python.services.exports import ExportsService
+from taegis_sdk_python.services.entity_context import EntityContextService
 from taegis_sdk_python.services.fast_ioc import FastIocService
 from taegis_sdk_python.services.file_info import FileInfoService
 from taegis_sdk_python.services.ingest_stats import IngestStatsService
@@ -73,6 +74,7 @@ from taegis_sdk_python.services.trigger_action import TriggerActionService
 from taegis_sdk_python.services.trip import TripService
 from taegis_sdk_python.services.users import UsersService
 from taegis_sdk_python.services.vdr import VDRService
+from taegis_sdk_python.services.xdr_central_connector import XdrCentralConnectorService
 
 __all__ = ["GraphQLService"]
 
@@ -192,6 +194,7 @@ class GraphQLService:
         self._detector_registry = None
         self._endpoint_command_manager = None
         self._endpoint_management_service = None
+        self._entity_context = None
         self._event_search = None
         self._events = None
         self._exports = None
@@ -224,6 +227,7 @@ class GraphQLService:
         self._trip = None
         self._users = None
         self._vdr = None
+        self._xdr_central_connector = None
 
     def __call__(self, **kwargs):
         if threading.get_ident() not in self._context_kwargs:
@@ -546,6 +550,13 @@ class GraphQLService:
             self._endpoint_management_service = EndpointManagementServiceService(self)
         return self._endpoint_management_service
 
+    @property
+    def entity_context(self):
+        """Entity Context Service Endpoint."""
+        if not self._entity_context:
+            self._entity_context = EntityContextService(self)
+        return self._entity_context
+
     @property
     def event_search(self):
         """Events Search Service Endpoint."""
@@ -660,7 +671,19 @@ class GraphQLService:
 
     @property
     def process_tress(self):
-        """Preferences Service Endpoint."""
+        """Process Trees Service Endpoint."""
+
+        log.warning(
+            "Please use service.process_trees instead of service.process_tress."
+        )
+
+        if not self._process_trees:
+            self._process_trees = ProcessTreesService(self)
+        return self._process_trees
+
+    @property
+    def process_trees(self):
+        """Process Trees Service Endpoint."""
         if not self._process_trees:
             self._process_trees = ProcessTreesService(self)
         return self._process_trees
@@ -769,3 +792,10 @@ class GraphQLService:
         if not self._vdr:
             self._vdr = VDRService(self)
         return self._vdr
+
+    @property
+    def xdr_central_connector(self):
+        """XDR Central Connector Service Endpoint."""
+        if not self._xdr_central_connector:
+            self._xdr_central_connector = XdrCentralConnectorService(self)
+        return self._xdr_central_connector

taegis_sdk_python-1.4.13/taegis_sdk_python/services/entity_context/__init__.py

@@ -0,0 +1,34 @@
+""""EntityContext Service."""
+
+from taegis_sdk_python.service_core import ServiceCore
+from taegis_sdk_python.services.entity_context.mutations import (
+    TaegisSDKEntityContextMutation,
+)
+from taegis_sdk_python.services.entity_context.queries import (
+    TaegisSDKEntityContextQuery,
+)
+from taegis_sdk_python.services.entity_context.subscriptions import (
+    TaegisSDKEntityContextSubscription,
+)
+
+
+class EntityContextService(ServiceCore):
+    """Taegis EntityContext Service."""
+
+    @property
+    def query(self):
+        if not self._queries:
+            self._queries = TaegisSDKEntityContextQuery(self)
+        return self._queries
+
+    @property
+    def mutation(self):
+        if not self._mutations:
+            self._mutations = TaegisSDKEntityContextMutation(self)
+        return self._mutations
+
+    @property
+    def subscription(self):
+        if not self._subscriptions:
+            self._subscriptions = TaegisSDKEntityContextSubscription(self)
+        return self._subscriptions

taegis_sdk_python-1.4.13/taegis_sdk_python/services/entity_context/mutations.py

@@ -0,0 +1,61 @@
+"""EntityContext Mutation."""
+
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python._consts import TaegisEnum
+from taegis_sdk_python.services.entity_context.types import *
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.entity_context import EntityContextService
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKEntityContextMutation:
+    """Taegis Entity_context Mutation operations."""
+
+    def __init__(self, service: EntityContextService):
+        self.service = service
+
+    def entity_context_add_to(
+        self,
+        entry_point: EntityContextEntryPoint,
+        to_add: EntityContextAddToInput,
+        filters: Optional[EntityContextGroupedSubgraphFilters] = None,
+    ) -> EntityContextGroupedSubgraphForResponse:
+        """Mutation to add an subgraph to the graph.
+        The entrypoint specifies the type of object you are adding to and will syncronously call the coresponding API.
+        Afterwards a subgraph will be generated from the resource ids in options and added to the graph.
+        If multiple Ids are specified, the mutation will be applied to all of them and returned as one subgraph..
+        """
+        endpoint = "entityContextAddTo"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "entryPoint": prepare_input(entry_point),
+                "toAdd": prepare_input(to_add),
+                "filters": prepare_input(filters),
+            },
+            output=build_output_string(EntityContextGroupedSubgraphForResponse),
+        )
+        if result.get(endpoint) is not None:
+            return EntityContextGroupedSubgraphForResponse.from_dict(
+                result.get(endpoint)
+            )
+        raise GraphQLNoRowsInResultSetError("for mutation entityContextAddTo")

taegis_sdk_python-1.4.13/taegis_sdk_python/services/entity_context/queries.py

@@ -0,0 +1,237 @@
+"""EntityContext Query."""
+
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+from taegis_sdk_python._consts import TaegisEnum
+from taegis_sdk_python.services.entity_context.types import *
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.entity_context import EntityContextService
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKEntityContextQuery:
+    """Taegis Entity_context Query operations."""
+
+    def __init__(self, service: EntityContextService):
+        self.service = service
+
+    def entity_context(
+        self, entity_id: str, origin: Optional[EntityContextOrigin] = None
+    ) -> EntityContextEntity:
+        """Returns a single entity that matches the provided id. Must use hashed global id of the entity.."""
+        endpoint = "entityContext"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "entityID": prepare_input(entity_id),
+                "origin": prepare_input(origin),
+            },
+            output=build_output_string(EntityContextEntity),
+        )
+        if result.get(endpoint) is not None:
+            return EntityContextEntity.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query entityContext")
+
+    def entity_context_by_identifiers(
+        self,
+        identifiers: EntityContextIdByIdentifiers,
+        origin: Optional[EntityContextOrigin] = None,
+    ) -> EntityContextEntity:
+        """Returns a single entity that matches the provided id. Must use valid set or superset of identifiers.
+        EntityContextIdByIdentifiers.matchWeakerIdentifiers must be set to false, as only a single entity may be returned by this query.
+        Use 'entityContexts' for multiple entities by identifiers.."""
+        endpoint = "entityContextByIdentifiers"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "identifiers": prepare_input(identifiers),
+                "origin": prepare_input(origin),
+            },
+            output=build_output_string(EntityContextEntity),
+        )
+        if result.get(endpoint) is not None:
+            return EntityContextEntity.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query entityContextByIdentifiers")
+
+    def entity_contexts(
+        self,
+        arguments: EntityContextsArguments,
+        page: Optional[EntityContextPageInput] = None,
+    ) -> EntityContexts:
+        """Returns a list of entities that match the arguments.."""
+        endpoint = "entityContexts"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "arguments": prepare_input(arguments),
+                "page": prepare_input(page),
+            },
+            output=build_output_string(EntityContexts),
+        )
+        if result.get(endpoint) is not None:
+            return EntityContexts.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query entityContexts")
+
+    def entity_context_edge(
+        self, edge_id: str, origin: Optional[EntityContextOrigin] = None
+    ) -> EntityContextEdge:
+        """Returns a single edge that matches the provided id. Must use hashed global id of the edge.."""
+        endpoint = "entityContextEdge"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "edgeId": prepare_input(edge_id),
+                "origin": prepare_input(origin),
+            },
+            output=build_output_string(EntityContextEdge),
+        )
+        if result.get(endpoint) is not None:
+            return EntityContextEdge.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query entityContextEdge")
+
+    def entity_context_grouped_subgraph_for(
+        self,
+        entry_point: EntityContextEntryPoint,
+        filters: Optional[EntityContextGroupedSubgraphFilters] = None,
+        source: Optional[EntityContextSourceInput] = None,
+        options: Optional[Any] = None,
+    ) -> EntityContextGroupedSubgraphForResponse:
+        """Returns a subgraph with any edges of the same type between two entities grouped together.
+        The data source for the subgraph can be from the graph, on-demand, or a on-demand fallback.
+        Choosing to retrieve only data currently present in the graph will be the fastest option.
+        ON_DEMAND_FALLBACK is the default and is a compromise of the two, first searching the graph
+        and then populating the missing data with on-demand data (which can be much slower)..
+        """
+        endpoint = "entityContextGroupedSubgraphFor"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "entryPoint": prepare_input(entry_point),
+                "filters": prepare_input(filters),
+                "source": prepare_input(source),
+                "options": prepare_input(options),
+            },
+            output=build_output_string(EntityContextGroupedSubgraphForResponse),
+        )
+        if result.get(endpoint) is not None:
+            return EntityContextGroupedSubgraphForResponse.from_dict(
+                result.get(endpoint)
+            )
+        raise GraphQLNoRowsInResultSetError("for query entityContextGroupedSubgraphFor")
+
+    def entity_context_related_resources(
+        self,
+        entry_point: EntityContextEntryPoint,
+        time_filter: Optional[EntityContextTimeFilters] = None,
+        page: Optional[EntityContextPageInput] = None,
+    ) -> EntityContextRelatedResources:
+        """Provides a list of related events, alerts, and investigations for a given element. If the entryPoint is of type Entity
+        it will look at all the edges that are incoming or outgoing to the provided entities. All other entryPoint types will
+        correspond to an edge, which will look at the incoming or outgoing edges from the provided edges vertices.
+
+        Warning: It is possible for data to be missing for highly connected entrypoints. This is because we have a hard limit on
+        the number of edges we can explore to prevent timeouts.."""
+        endpoint = "entityContextRelatedResources"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "entryPoint": prepare_input(entry_point),
+                "timeFilter": prepare_input(time_filter),
+                "page": prepare_input(page),
+            },
+            output=build_output_string(EntityContextRelatedResources),
+        )
+        if result.get(endpoint) is not None:
+            return EntityContextRelatedResources.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query entityContextRelatedResources")
+
+    def entity_context_associated_entities(
+        self,
+        entry_point: EntityContextEntryPoint,
+        filters: EntityContextAssociatedEntitiesFilters = EntityContextAssociatedEntitiesFilters.from_dict(
+            {
+                "sortOrder": "DESC",
+                "filter": {"timeFilter": {"lastSeen": {}}, "collectProperties": True},
+            }
+        ),
+        page: Optional[EntityContextPageInput] = None,
+        source: Optional[EntityContextSourceInput] = None,
+    ) -> EntityContextAssociatedEntitiesResponse:
+        """Provides a list of related entities for a given element. If the entrypoint is an entity, it will return just the
+        input entity. If its an edge or resource, it will return the entities connected to the edge or resource. If page is
+        null it will return all entities. If page is not null, it will return a page of entities sorted by the filters
+
+        Warning: It is possible for data to be missing for highly connected entrypoints. This is because we have a hard limit on
+        the number of edges we can explore to prevent timeouts.."""
+        endpoint = "entityContextAssociatedEntities"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "entryPoint": prepare_input(entry_point),
+                "filters": prepare_input(filters),
+                "page": prepare_input(page),
+                "source": prepare_input(source),
+            },
+            output=build_output_string(EntityContextAssociatedEntitiesResponse),
+        )
+        if result.get(endpoint) is not None:
+            return EntityContextAssociatedEntitiesResponse.from_dict(
+                result.get(endpoint)
+            )
+        raise GraphQLNoRowsInResultSetError("for query entityContextAssociatedEntities")
+
+    def entity_context_pivot_ql(
+        self,
+        entry_point: EntityContextEntryPoint,
+        options: EntityContextPivotQLOptions = EntityContextPivotQLOptions.from_dict(
+            {
+                "aggregation": "PER_ENTITY",
+                "type": "EVENTS",
+                "useStructuredEntities": True,
+            }
+        ),
+        source: Optional[EntityContextSourceInput] = None,
+    ) -> List[EntityContextPivotQLQuery]:
+        """Provides a list of QL queries that can be used to pivot from the provided entry point. If the entrypoint is an
+        edge, event, alert, or investigation, it will return a list of queries that can be used to pivot to the entities
+        associated with them.."""
+        endpoint = "entityContextPivotQL"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "entryPoint": prepare_input(entry_point),
+                "options": prepare_input(options),
+                "source": prepare_input(source),
+            },
+            output=build_output_string(EntityContextPivotQLQuery),
+        )
+        if result.get(endpoint) is not None:
+            return EntityContextPivotQLQuery.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query entityContextPivotQL")

taegis_sdk_python-1.4.13/taegis_sdk_python/services/entity_context/subscriptions.py

@@ -0,0 +1,33 @@
+"""EntityContext Subscription."""
+
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python._consts import TaegisEnum
+from taegis_sdk_python.services.entity_context.types import *
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.entity_context import EntityContextService
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKEntityContextSubscription:
+    """Taegis Entity_context Subscription operations."""
+
+    def __init__(self, service: EntityContextService):
+        self.service = service