taegis-sdk-python 1.4.1__tar.gz → 1.4.3__tar.gz

{taegis_sdk_python-1.4.1/taegis_sdk_python.egg-info → taegis_sdk_python-1.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.4.1
+Version: 1.4.3
 Summary: Taegis Python SDK
 Home-page: https://github.com/secureworks/taegis-sdk-python
 Author: Secureworks

taegis_sdk_python-1.4.3/taegis_sdk_python/_version.py

@@ -0,0 +1 @@
+__version__ = "v1.4.3"

{taegis_sdk_python-1.4.1 → taegis_sdk_python-1.4.3}/taegis_sdk_python/services/__init__.py

@@ -1,5 +1,5 @@
 """
-This needs to be a generated file.  Need to make jinja template.
+Taegis SDK Python GraphQL Service manager.
 """
 
 import logging
@@ -33,6 +33,7 @@ from taegis_sdk_python.services.clients import ClientsService
 from taegis_sdk_python.services.collector import CollectorService
 from taegis_sdk_python.services.comments import CommentsService
 from taegis_sdk_python.services.contracted_endpoint import ContractedEndpointService
+from taegis_sdk_python.services.cql_metadata import CqlMetadataService
 from taegis_sdk_python.services.datasources import DatasourcesService
 from taegis_sdk_python.services.detector_registry import DetectorRegistryService
 from taegis_sdk_python.services.endpoint_command_manager import (
@@ -186,6 +187,7 @@ class GraphQLService:
         self._collector = None
         self._comments = None
         self._contracted_endpoint = None
+        self._cql_metadata = None
         self._datasources = None
         self._detector_registry = None
         self._endpoint_command_manager = None
@@ -509,6 +511,13 @@ class GraphQLService:
             self._contracted_endpoint = ContractedEndpointService(self)
         return self._contracted_endpoint
 
+    @property
+    def cql_metadata(self):
+        """CqlMetadata Service Endpoint."""
+        if not self._cql_metadata:
+            self._cql_metadata = CqlMetadataService(self)
+        return self._cql_metadata
+
     @property
     def datasources(self):
         """Datasources Service Endpoint."""

{taegis_sdk_python-1.4.1 → taegis_sdk_python-1.4.3}/taegis_sdk_python/services/alerts/types.py

@@ -905,6 +905,12 @@ class EntityHost:
     )
     os: Optional[str] = field(default=None, metadata=config(field_name="os"))
     os_arch: Optional[str] = field(default=None, metadata=config(field_name="os_arch"))
+    sensor_id: Optional[str] = field(
+        default=None, metadata=config(field_name="sensor_id")
+    )
+    sensor_type: Optional[str] = field(
+        default=None, metadata=config(field_name="sensor_type")
+    )
     vendor_agent_device_id: Optional[str] = field(
         default=None, metadata=config(field_name="vendor_agent_device_id")
     )

{taegis_sdk_python-1.4.1 → taegis_sdk_python-1.4.3}/taegis_sdk_python/services/alerts_history/types.py

@@ -654,8 +654,8 @@ class Collection:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class EntityAuthDomain:
-    """EntityAuthDomain."""
+class EntityAuthDomainSnapshot:
+    """EntityAuthDomainSnapshot."""
 
     property_type: Optional[str] = field(
         default=None, metadata=config(field_name="property_type")
@@ -667,8 +667,8 @@ class EntityAuthDomain:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class EntityCertificate:
-    """EntityCertificate."""
+class EntityCertificateSnapshot:
+    """EntityCertificateSnapshot."""
 
     property_type: Optional[str] = field(
         default=None, metadata=config(field_name="property_type")
@@ -746,8 +746,8 @@ class EntityCertificate:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class EntityCloudObject:
-    """EntityCloudObject."""
+class EntityCloudObjectSnapshot:
+    """EntityCloudObjectSnapshot."""
 
     property_type: Optional[str] = field(
         default=None, metadata=config(field_name="property_type")
@@ -765,8 +765,8 @@ class EntityCloudObject:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class EntityCloudResource:
-    """EntityCloudResource."""
+class EntityCloudResourceSnapshot:
+    """EntityCloudResourceSnapshot."""
 
     property_type: Optional[str] = field(
         default=None, metadata=config(field_name="property_type")
@@ -784,8 +784,8 @@ class EntityCloudResource:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class EntityCloudUser:
-    """EntityCloudUser."""
+class EntityCloudUserSnapshot:
+    """EntityCloudUserSnapshot."""
 
     property_type: Optional[str] = field(
         default=None, metadata=config(field_name="property_type")
@@ -803,8 +803,8 @@ class EntityCloudUser:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class EntityDnsServer:
-    """EntityDnsServer."""
+class EntityDnsServerSnapshot:
+    """EntityDnsServerSnapshot."""
 
     property_type: Optional[str] = field(
         default=None, metadata=config(field_name="property_type")
@@ -823,8 +823,8 @@ class EntityDnsServer:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class EntityDomainName:
-    """EntityDomainName."""
+class EntityDomainNameSnapshot:
+    """EntityDomainNameSnapshot."""
 
     property_type: Optional[str] = field(
         default=None, metadata=config(field_name="property_type")
@@ -836,8 +836,8 @@ class EntityDomainName:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class EntityEmail:
-    """EntityEmail."""
+class EntityEmailSnapshot:
+    """EntityEmailSnapshot."""
 
     property_type: Optional[str] = field(
         default=None, metadata=config(field_name="property_type")
@@ -864,8 +864,8 @@ class EntityEmail:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class EntityEmailAddress:
-    """EntityEmailAddress."""
+class EntityEmailAddressSnapshot:
+    """EntityEmailAddressSnapshot."""
 
     property_type: Optional[str] = field(
         default=None, metadata=config(field_name="property_type")
@@ -877,8 +877,8 @@ class EntityEmailAddress:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class EntityFile:
-    """EntityFile."""
+class EntityFileSnapshot:
+    """EntityFileSnapshot."""
 
     property_type: Optional[str] = field(
         default=None, metadata=config(field_name="property_type")
@@ -918,8 +918,8 @@ class EntityFile:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class EntityFileHash:
-    """EntityFileHash."""
+class EntityFileHashSnapshot:
+    """EntityFileHashSnapshot."""
 
     property_type: Optional[str] = field(
         default=None, metadata=config(field_name="property_type")
@@ -934,8 +934,8 @@ class EntityFileHash:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class EntityFunction:
-    """EntityFunction."""
+class EntityFunctionSnapshot:
+    """EntityFunctionSnapshot."""
 
     property_type: Optional[str] = field(
         default=None, metadata=config(field_name="property_type")
@@ -948,8 +948,8 @@ class EntityFunction:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class EntityHost:
-    """EntityHost."""
+class EntityHostSnapshot:
+    """EntityHostSnapshot."""
 
     property_type: Optional[str] = field(
         default=None, metadata=config(field_name="property_type")
@@ -969,6 +969,12 @@ class EntityHost:
     )
     os: Optional[str] = field(default=None, metadata=config(field_name="os"))
     os_arch: Optional[str] = field(default=None, metadata=config(field_name="os_arch"))
+    sensor_id: Optional[str] = field(
+        default=None, metadata=config(field_name="sensor_id")
+    )
+    sensor_type: Optional[str] = field(
+        default=None, metadata=config(field_name="sensor_type")
+    )
     vendor_agent_device_id: Optional[str] = field(
         default=None, metadata=config(field_name="vendor_agent_device_id")
     )
@@ -979,8 +985,8 @@ class EntityHost:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class EntityIpAddress:
-    """EntityIpAddress."""
+class EntityIpAddressSnapshot:
+    """EntityIpAddressSnapshot."""
 
     property_type: Optional[str] = field(
         default=None, metadata=config(field_name="property_type")
@@ -1027,8 +1033,8 @@ class EntityIpAddress:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class EntityProcess:
-    """EntityProcess."""
+class EntityProcessSnapshot:
+    """EntityProcessSnapshot."""
 
     property_type: Optional[str] = field(
         default=None, metadata=config(field_name="property_type")
@@ -1059,8 +1065,8 @@ class EntityProcess:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class EntityRegistryKey:
-    """EntityRegistryKey."""
+class EntityRegistryKeySnapshot:
+    """EntityRegistryKeySnapshot."""
 
     property_type: Optional[str] = field(
         default=None, metadata=config(field_name="property_type")
@@ -1073,8 +1079,8 @@ class EntityRegistryKey:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class EntityScheduledTask:
-    """EntityScheduledTask."""
+class EntityScheduledTaskSnapshot:
+    """EntityScheduledTaskSnapshot."""
 
     property_type: Optional[str] = field(
         default=None, metadata=config(field_name="property_type")
@@ -1087,8 +1093,8 @@ class EntityScheduledTask:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class EntityScript:
-    """EntityScript."""
+class EntityScriptSnapshot:
+    """EntityScriptSnapshot."""
 
     property_type: Optional[str] = field(
         default=None, metadata=config(field_name="property_type")
@@ -1110,8 +1116,8 @@ class EntityScript:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class EntityService:
-    """EntityService."""
+class EntityServiceSnapshot:
+    """EntityServiceSnapshot."""
 
     property_type: Optional[str] = field(
         default=None, metadata=config(field_name="property_type")
@@ -1136,8 +1142,8 @@ class EntityService:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class EntityTaskAction:
-    """EntityTaskAction."""
+class EntityTaskActionSnapshot:
+    """EntityTaskActionSnapshot."""
 
     property_type: Optional[str] = field(
         default=None, metadata=config(field_name="property_type")
@@ -1165,8 +1171,8 @@ class EntityTaskAction:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class EntityUser:
-    """EntityUser."""
+class EntityUserSnapshot:
+    """EntityUserSnapshot."""
 
     property_type: Optional[str] = field(
         default=None, metadata=config(field_name="property_type")
@@ -1199,8 +1205,8 @@ class EntityUser:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class EntityUrl:
-    """EntityUrl."""
+class EntityUrlSnapshot:
+    """EntityUrlSnapshot."""
 
     property_type: Optional[str] = field(
         default=None, metadata=config(field_name="property_type")
@@ -1856,29 +1862,29 @@ class AlertSnapshotMetadata:
     )
 
 
-Properties = Union[
-    EntityAuthDomain,
-    EntityCertificate,
-    EntityCloudObject,
-    EntityCloudResource,
-    EntityCloudUser,
-    EntityDnsServer,
-    EntityDomainName,
-    EntityEmail,
-    EntityEmailAddress,
-    EntityFile,
-    EntityFileHash,
-    EntityFunction,
-    EntityHost,
-    EntityIpAddress,
-    EntityProcess,
-    EntityRegistryKey,
-    EntityScheduledTask,
-    EntityScript,
-    EntityService,
-    EntityTaskAction,
-    EntityUser,
-    EntityUrl,
+PropertiesSnapshot = Union[
+    EntityAuthDomainSnapshot,
+    EntityCertificateSnapshot,
+    EntityCloudObjectSnapshot,
+    EntityCloudResourceSnapshot,
+    EntityCloudUserSnapshot,
+    EntityDnsServerSnapshot,
+    EntityDomainNameSnapshot,
+    EntityEmailSnapshot,
+    EntityEmailAddressSnapshot,
+    EntityFileSnapshot,
+    EntityFileHashSnapshot,
+    EntityFunctionSnapshot,
+    EntityHostSnapshot,
+    EntityIpAddressSnapshot,
+    EntityProcessSnapshot,
+    EntityRegistryKeySnapshot,
+    EntityScheduledTaskSnapshot,
+    EntityScriptSnapshot,
+    EntityServiceSnapshot,
+    EntityTaskActionSnapshot,
+    EntityUserSnapshot,
+    EntityUrlSnapshot,
 ]
 
 
@@ -1958,8 +1964,8 @@ class ThirdPartyDetail:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class StructuredEntity:
-    """StructuredEntity."""
+class StructuredEntitySnapshot:
+    """StructuredEntitySnapshot."""
 
     id: Optional[str] = field(default=None, metadata=config(field_name="id"))
     identifiers: Optional[List[str]] = field(
@@ -1973,10 +1979,11 @@ class StructuredEntity:
             field_name="perspective",
         ),
     )
-    properties: Optional[Properties] = field(
+    properties: Optional[PropertiesSnapshot] = field(
         default=None,
         metadata=config(
-            decoder=lambda x: parse_union_result(Properties, x), field_name="properties"
+            decoder=lambda x: parse_union_result(PropertiesSnapshot, x),
+            field_name="properties",
         ),
     )
 
@@ -2179,10 +2186,10 @@ class AlertSnapshot:
     key_entities: Optional[List[EntityMetadata]] = field(
         default=None, metadata=config(field_name="key_entities")
     )
-    source_entities: Optional[List[StructuredEntity]] = field(
+    source_entities: Optional[List[StructuredEntitySnapshot]] = field(
         default=None, metadata=config(field_name="source_entities")
     )
-    target_entities: Optional[List[StructuredEntity]] = field(
+    target_entities: Optional[List[StructuredEntitySnapshot]] = field(
         default=None, metadata=config(field_name="target_entities")
     )
     event_ids: Optional[List[AuxiliaryEvent]] = field(

{taegis_sdk_python-1.4.1 → taegis_sdk_python-1.4.3}/taegis_sdk_python/services/assets2/types.py

@@ -40,6 +40,7 @@ class EndpointTypeV2(str, Enum):
     ENDPOINT_SENTINELONE = "ENDPOINT_SENTINELONE"
     ENDPOINT_HARFANG_LAB = "ENDPOINT_HARFANG_LAB"
     ENDPOINT_SOPHOS_CIXA = "ENDPOINT_SOPHOS_CIXA"
+    ENDPOINT_SOPHOS_XDR = "ENDPOINT_SOPHOS_XDR"
 
 
 class FacetInfoOrderByInputV2(str, Enum):

{taegis_sdk_python-1.4.1 → taegis_sdk_python-1.4.3}/taegis_sdk_python/services/authz/__init__.py

@@ -1,11 +1,9 @@
-""""Authz Service."""
+"""Authz Service."""
 
 from taegis_sdk_python.service_core import ServiceCore
 from taegis_sdk_python.services.authz.mutations import TaegisSDKAuthzMutation
 from taegis_sdk_python.services.authz.queries import TaegisSDKAuthzQuery
-from taegis_sdk_python.services.authz.subscriptions import (
-    TaegisSDKAuthzSubscription,
-)
+from taegis_sdk_python.services.authz.subscriptions import TaegisSDKAuthzSubscription
 
 
 class AuthzService(ServiceCore):

{taegis_sdk_python-1.4.1 → taegis_sdk_python-1.4.3}/taegis_sdk_python/services/authz/queries.py

@@ -342,6 +342,17 @@ class TaegisSDKAuthzQuery:
             )
         raise GraphQLNoRowsInResultSetError("for query authzSupportedFeatures")
 
+    def authz_subject_central_role(self) -> AuthzRole:
+        """Identify the equivalent central role for the requesting subject in the current tenant context."""
+        endpoint = "authzSubjectCentralRole"
+
+        result = self.service.execute_query(
+            endpoint=endpoint, variables={}, output=build_output_string(AuthzRole)
+        )
+        if result.get(endpoint) is not None:
+            return AuthzRole.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query authzSubjectCentralRole")
+
     def authz_can_user_assume_tenant(self) -> bool:
         """DEPRECATED: Please use authzCanSubjectAssumeTenant."""
         endpoint = "authzCanUserAssumeTenant"

{taegis_sdk_python-1.4.1 → taegis_sdk_python-1.4.3}/taegis_sdk_python/services/authz/types.py

@@ -373,6 +373,9 @@ class AuthzRole:
         default=None, metadata=config(field_name="updatedBy")
     )
     deleted: Optional[bool] = field(default=None, metadata=config(field_name="deleted"))
+    central_role: Optional[str] = field(
+        default=None, metadata=config(field_name="centralRole")
+    )
     policies: Optional[List[AuthzPolicy]] = field(
         default=None, metadata=config(field_name="policies")
     )

{taegis_sdk_python-1.4.1 → taegis_sdk_python-1.4.3}/taegis_sdk_python/services/clients/mutations.py

@@ -32,7 +32,12 @@ class TaegisSDKClientsMutation:
     def __init__(self, service: ClientsService):
         self.service = service
 
-    def create_client(self, name: str, roles: Optional[List[str]] = None) -> NewClient:
+    def create_client(
+        self,
+        name: str,
+        roles: Optional[List[str]] = None,
+        input_: Optional[CreateClientInput] = None,
+    ) -> NewClient:
         """Create a new client (SCWX (tenant 5000) clients are disallowed). The new client will be assigned the TenantAnalyst role if the `roles` parameter is omitted."""
         endpoint = "createClient"
 
@@ -41,6 +46,7 @@ class TaegisSDKClientsMutation:
             variables={
                 "name": prepare_input(name),
                 "roles": prepare_input(roles),
+                "input": prepare_input(input_),
             },
             output=build_output_string(NewClient),
         )

{taegis_sdk_python-1.4.1 → taegis_sdk_python-1.4.3}/taegis_sdk_python/services/clients/types.py

@@ -93,6 +93,26 @@ class ClientRoleAssignmentInput:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class CreateClientInput:
+    """CreateClientInput."""
+
+    owner_tenant_id: Optional[str] = field(
+        default=None, metadata=config(field_name="ownerTenantID")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class CreateClientInternalInput:
+    """CreateClientInternalInput."""
+
+    owner_tenant_id: Optional[str] = field(
+        default=None, metadata=config(field_name="ownerTenantID")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class CredentialValidationResult:
@@ -134,6 +154,9 @@ class Client:
     tenant_id: Optional[str] = field(
         default=None, metadata=config(field_name="tenantID")
     )
+    owner_tenant_id: Optional[str] = field(
+        default=None, metadata=config(field_name="ownerTenantID")
+    )
     created_at: Optional[str] = field(
         default=None,
         metadata=config(

taegis_sdk_python-1.4.3/taegis_sdk_python/services/cql_metadata/__init__.py

@@ -0,0 +1,32 @@
+""""CqlMetadata Service."""
+
+from taegis_sdk_python.service_core import ServiceCore
+from taegis_sdk_python.services.cql_metadata.mutations import (
+    TaegisSDKCqlMetadataMutation,
+)
+from taegis_sdk_python.services.cql_metadata.queries import TaegisSDKCqlMetadataQuery
+from taegis_sdk_python.services.cql_metadata.subscriptions import (
+    TaegisSDKCqlMetadataSubscription,
+)
+
+
+class CqlMetadataService(ServiceCore):
+    """Taegis CqlMetadata Service."""
+
+    @property
+    def query(self):
+        if not self._queries:
+            self._queries = TaegisSDKCqlMetadataQuery(self)
+        return self._queries
+
+    @property
+    def mutation(self):
+        if not self._mutations:
+            self._mutations = TaegisSDKCqlMetadataMutation(self)
+        return self._mutations
+
+    @property
+    def subscription(self):
+        if not self._subscriptions:
+            self._subscriptions = TaegisSDKCqlMetadataSubscription(self)
+        return self._subscriptions

taegis_sdk_python-1.4.3/taegis_sdk_python/services/cql_metadata/mutations.py

@@ -0,0 +1,33 @@
+"""CqlMetadata Mutation."""
+
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python._consts import TaegisEnum
+from taegis_sdk_python.services.cql_metadata.types import *
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.cql_metadata import CqlMetadataService
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKCqlMetadataMutation:
+    """Taegis Cql_metadata Mutation operations."""
+
+    def __init__(self, service: CqlMetadataService):
+        self.service = service

taegis_sdk_python-1.4.3/taegis_sdk_python/services/cql_metadata/queries.py

@@ -0,0 +1,51 @@
+"""CqlMetadata Query."""
+
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+from taegis_sdk_python._consts import TaegisEnum
+from taegis_sdk_python.services.cql_metadata.types import *
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.cql_metadata import CqlMetadataService
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKCqlMetadataQuery:
+    """Taegis Cql_metadata Query operations."""
+
+    def __init__(self, service: CqlMetadataService):
+        self.service = service
+
+    def validate_event_query(
+        self, query: str, options: Optional[EventQueryOptions] = None
+    ) -> ValidatorResults:
+        """Validates a query string and returns a valid boolean or an error."""
+        endpoint = "validateEventQuery"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "query": prepare_input(query),
+                "options": prepare_input(options),
+            },
+            output=build_output_string(ValidatorResults),
+        )
+        if result.get(endpoint) is not None:
+            return ValidatorResults.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query validateEventQuery")