taegis-sdk-python 1.4.4__tar.gz → 1.4.5__tar.gz

{taegis_sdk_python-1.4.4/taegis_sdk_python.egg-info → taegis_sdk_python-1.4.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.4.4
+Version: 1.4.5
 Summary: Taegis Python SDK
 Home-page: https://github.com/secureworks/taegis-sdk-python
 Author: Secureworks

taegis_sdk_python-1.4.5/taegis_sdk_python/_version.py

@@ -0,0 +1 @@
+__version__ = "v1.4.5"

{taegis_sdk_python-1.4.4 → taegis_sdk_python-1.4.5}/taegis_sdk_python/services/alerts/types.py

@@ -850,6 +850,18 @@ class EntityFile:
     file_type_detected: Optional[str] = field(
         default=None, metadata=config(field_name="file_type_detected")
     )
+    hash_md5: Optional[str] = field(
+        default=None, metadata=config(field_name="hash_md5")
+    )
+    hash_sha1: Optional[str] = field(
+        default=None, metadata=config(field_name="hash_sha1")
+    )
+    hash_sha256: Optional[str] = field(
+        default=None, metadata=config(field_name="hash_sha256")
+    )
+    hash_sha512: Optional[str] = field(
+        default=None, metadata=config(field_name="hash_sha512")
+    )
 
 
 @dataclass_json
@@ -997,6 +1009,18 @@ class EntityProcess:
     process_is_admin: Optional[bool] = field(
         default=None, metadata=config(field_name="process_is_admin")
     )
+    hash_md5: Optional[str] = field(
+        default=None, metadata=config(field_name="hash_md5")
+    )
+    hash_sha1: Optional[str] = field(
+        default=None, metadata=config(field_name="hash_sha1")
+    )
+    hash_sha256: Optional[str] = field(
+        default=None, metadata=config(field_name="hash_sha256")
+    )
+    hash_sha512: Optional[str] = field(
+        default=None, metadata=config(field_name="hash_sha512")
+    )
 
 
 @dataclass_json
@@ -3164,6 +3188,7 @@ class Alert2:
     threat_score_v2: Optional[float] = field(
         default=None, metadata=config(field_name="threat_score_v2")
     )
+    vids: Optional[List[int]] = field(default=None, metadata=config(field_name="vids"))
     observation: Optional[bool] = field(
         default=None,
         metadata=config(

{taegis_sdk_python-1.4.4 → taegis_sdk_python-1.4.5}/taegis_sdk_python/services/investigations2/types.py

@@ -30,6 +30,13 @@ class AlertResolutionStatus(str, Enum):
     SUPPRESSED = "SUPPRESSED"
 
 
+class TemplateUsage(str, Enum):
+    """TemplateUsage."""
+
+    MANUAL = "MANUAL"
+    AUTO_INVESTIGATION = "AUTO_INVESTIGATION"
+
+
 class InvestigationRuleState(str, Enum):
     """InvestigationRuleState."""
 
@@ -369,80 +376,6 @@ class RemoveEvidenceFromInvestigationResult:
     )
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class CreateInvestigationTemplateInput:
-    """CreateInvestigationTemplateInput."""
-
-    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
-    title: Optional[str] = field(default=None, metadata=config(field_name="title"))
-    description: Optional[str] = field(
-        default=None, metadata=config(field_name="description")
-    )
-    tags: Optional[List[str]] = field(default=None, metadata=config(field_name="tags"))
-    investigation_type: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationType")
-    )
-    investigation_priority: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationPriority")
-    )
-    investigation_title: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationTitle")
-    )
-    investigation_tags: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="investigationTags")
-    )
-    investigation_key_findings: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationKeyFindings")
-    )
-    investigation_key_findings_prompts: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="investigationKeyFindingsPrompts")
-    )
-    investigation_assignee: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationAssignee")
-    )
-    investigation_status: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationStatus")
-    )
-
-
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class UpdateInvestigationTemplateInput:
-    """UpdateInvestigationTemplateInput."""
-
-    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
-    title: Optional[str] = field(default=None, metadata=config(field_name="title"))
-    description: Optional[str] = field(
-        default=None, metadata=config(field_name="description")
-    )
-    tags: Optional[List[str]] = field(default=None, metadata=config(field_name="tags"))
-    investigation_type: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationType")
-    )
-    investigation_priority: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationPriority")
-    )
-    investigation_title: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationTitle")
-    )
-    investigation_tags: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="investigationTags")
-    )
-    investigation_key_findings: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationKeyFindings")
-    )
-    investigation_key_findings_prompts: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="investigationKeyFindingsPrompts")
-    )
-    investigation_assignee: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationAssignee")
-    )
-    investigation_status: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationStatus")
-    )
-
-
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class DeleteInvestigationTemplateInput:
@@ -876,6 +809,96 @@ class InvestigationAssigneeCount:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class CreateInvestigationTemplateInput:
+    """CreateInvestigationTemplateInput."""
+
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    title: Optional[str] = field(default=None, metadata=config(field_name="title"))
+    description: Optional[str] = field(
+        default=None, metadata=config(field_name="description")
+    )
+    tags: Optional[List[str]] = field(default=None, metadata=config(field_name="tags"))
+    investigation_type: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationType")
+    )
+    investigation_priority: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationPriority")
+    )
+    investigation_title: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationTitle")
+    )
+    investigation_tags: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="investigationTags")
+    )
+    investigation_key_findings: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationKeyFindings")
+    )
+    investigation_key_findings_prompts: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="investigationKeyFindingsPrompts")
+    )
+    investigation_assignee: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationAssignee")
+    )
+    investigation_status: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationStatus")
+    )
+    usages: Optional[List[Union[TemplateUsage, TaegisEnum]]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(TemplateUsage, x),
+            field_name="usages",
+        ),
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class UpdateInvestigationTemplateInput:
+    """UpdateInvestigationTemplateInput."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    title: Optional[str] = field(default=None, metadata=config(field_name="title"))
+    description: Optional[str] = field(
+        default=None, metadata=config(field_name="description")
+    )
+    tags: Optional[List[str]] = field(default=None, metadata=config(field_name="tags"))
+    investigation_type: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationType")
+    )
+    investigation_priority: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationPriority")
+    )
+    investigation_title: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationTitle")
+    )
+    investigation_tags: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="investigationTags")
+    )
+    investigation_key_findings: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationKeyFindings")
+    )
+    investigation_key_findings_prompts: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="investigationKeyFindingsPrompts")
+    )
+    investigation_assignee: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationAssignee")
+    )
+    investigation_status: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationStatus")
+    )
+    usages: Optional[List[Union[TemplateUsage, TaegisEnum]]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(TemplateUsage, x),
+            field_name="usages",
+        ),
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class InvestigationsV2Arguments:
@@ -1488,6 +1511,69 @@ class AggregatedCounts:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class CommentV2:
+    """CommentV2."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    author_id: Optional[str] = field(
+        default=None, metadata=config(field_name="authorId")
+    )
+    created_at: Optional[str] = field(
+        default=None, metadata=config(field_name="createdAt")
+    )
+    updated_at: Optional[str] = field(
+        default=None, metadata=config(field_name="updatedAt")
+    )
+    comment: Optional[str] = field(default=None, metadata=config(field_name="comment"))
+    investigation_id: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationId")
+    )
+    tenant_id: Optional[str] = field(
+        default=None, metadata=config(field_name="tenantId")
+    )
+    mentions_ids: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="mentionsIds")
+    )
+    read_by_ids: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="readByIds")
+    )
+    is_internal: Optional[bool] = field(
+        default=None, metadata=config(field_name="isInternal")
+    )
+    author_subject: Optional[Subject] = field(
+        default=None, metadata=config(field_name="authorSubject")
+    )
+    mentions_subjects: Optional[List[Subject]] = field(
+        default=None, metadata=config(field_name="mentionsSubjects")
+    )
+    read_by_subjects: Optional[List[Subject]] = field(
+        default=None, metadata=config(field_name="readBySubjects")
+    )
+    author: Optional[TDRUser] = field(
+        default=None,
+        metadata=config(
+            metadata={"deprecated": True, "deprecation_reason": "use authorSubject"},
+            field_name="author",
+        ),
+    )
+    mentions_users: Optional[List[TDRUser]] = field(
+        default=None,
+        metadata=config(
+            metadata={"deprecated": True, "deprecation_reason": "use mentionsSubjects"},
+            field_name="mentionsUsers",
+        ),
+    )
+    read_by: Optional[List[TDRUser]] = field(
+        default=None,
+        metadata=config(
+            metadata={"deprecated": True, "deprecation_reason": "use readBySubjects"},
+            field_name="readBy",
+        ),
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class InvestigationTemplate:
@@ -1548,6 +1634,14 @@ class InvestigationTemplate:
     investigation_assignee_subject: Optional[Subject] = field(
         default=None, metadata=config(field_name="investigationAssigneeSubject")
     )
+    usages: Optional[List[Union[TemplateUsage, TaegisEnum]]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(TemplateUsage, x),
+            field_name="usages",
+        ),
+    )
     created_by: Optional[TDRUser] = field(
         default=None,
         metadata=config(
@@ -1574,69 +1668,6 @@ class InvestigationTemplate:
     )
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class CommentV2:
-    """CommentV2."""
-
-    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
-    author_id: Optional[str] = field(
-        default=None, metadata=config(field_name="authorId")
-    )
-    created_at: Optional[str] = field(
-        default=None, metadata=config(field_name="createdAt")
-    )
-    updated_at: Optional[str] = field(
-        default=None, metadata=config(field_name="updatedAt")
-    )
-    comment: Optional[str] = field(default=None, metadata=config(field_name="comment"))
-    investigation_id: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationId")
-    )
-    tenant_id: Optional[str] = field(
-        default=None, metadata=config(field_name="tenantId")
-    )
-    mentions_ids: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="mentionsIds")
-    )
-    read_by_ids: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="readByIds")
-    )
-    is_internal: Optional[bool] = field(
-        default=None, metadata=config(field_name="isInternal")
-    )
-    author_subject: Optional[Subject] = field(
-        default=None, metadata=config(field_name="authorSubject")
-    )
-    mentions_subjects: Optional[List[Subject]] = field(
-        default=None, metadata=config(field_name="mentionsSubjects")
-    )
-    read_by_subjects: Optional[List[Subject]] = field(
-        default=None, metadata=config(field_name="readBySubjects")
-    )
-    author: Optional[TDRUser] = field(
-        default=None,
-        metadata=config(
-            metadata={"deprecated": True, "deprecation_reason": "use authorSubject"},
-            field_name="author",
-        ),
-    )
-    mentions_users: Optional[List[TDRUser]] = field(
-        default=None,
-        metadata=config(
-            metadata={"deprecated": True, "deprecation_reason": "use mentionsSubjects"},
-            field_name="mentionsUsers",
-        ),
-    )
-    read_by: Optional[List[TDRUser]] = field(
-        default=None,
-        metadata=config(
-            metadata={"deprecated": True, "deprecation_reason": "use readBySubjects"},
-            field_name="readBy",
-        ),
-    )
-
-
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class InvestigationRule:

{taegis_sdk_python-1.4.4 → taegis_sdk_python-1.4.5}/taegis_sdk_python/services/multi_tenant_ioc/types.py

@@ -36,17 +36,11 @@ class Operator(str, Enum):
     MATCHES_REGEX = "MATCHES_REGEX"
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class EventWindow:
-    """EventWindow."""
+class BackendStrategy(str, Enum):
+    """BackendStrategy."""
 
-    earliest_event: Optional[str] = field(
-        default=None, metadata=config(field_name="earliestEvent")
-    )
-    latest_event: Optional[str] = field(
-        default=None, metadata=config(field_name="latestEvent")
-    )
+    ATHENA = "ATHENA"
+    TRINO = "TRINO"
 
 
 @dataclass_json
@@ -88,6 +82,27 @@ class TenantsInput:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EventWindow:
+    """EventWindow."""
+
+    earliest_event: Optional[str] = field(
+        default=None, metadata=config(field_name="earliestEvent")
+    )
+    latest_event: Optional[str] = field(
+        default=None, metadata=config(field_name="latestEvent")
+    )
+    backend_strategy: Optional[Union[BackendStrategy, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(BackendStrategy, x),
+            field_name="backendStrategy",
+        ),
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class EventCountByLogicalType:
@@ -106,20 +121,6 @@ class EventCountByLogicalType:
     )
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class EventCountResult:
-    """EventCountResult."""
-
-    next: Optional[str] = field(default=None, metadata=config(field_name="next"))
-    results: Optional[List[EventCountByLogicalType]] = field(
-        default=None, metadata=config(field_name="results")
-    )
-    error: Optional[DataAvailabilityError] = field(
-        default=None, metadata=config(field_name="error")
-    )
-
-
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class LogicalTypeFilter:
@@ -146,6 +147,28 @@ class LogicalTypeFilter:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EventCountResult:
+    """EventCountResult."""
+
+    next: Optional[str] = field(default=None, metadata=config(field_name="next"))
+    results: Optional[List[EventCountByLogicalType]] = field(
+        default=None, metadata=config(field_name="results")
+    )
+    backend_strategy: Optional[Union[BackendStrategy, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(BackendStrategy, x),
+            field_name="backendStrategy",
+        ),
+    )
+    error: Optional[DataAvailabilityError] = field(
+        default=None, metadata=config(field_name="error")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class EventAggregationArguments:
@@ -165,3 +188,11 @@ class EventAggregationArguments:
     tenants_context: Optional[TenantsInput] = field(
         default=None, metadata=config(field_name="tenantsContext")
     )
+    backend_strategy: Optional[Union[BackendStrategy, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(BackendStrategy, x),
+            field_name="backendStrategy",
+        ),
+    )

{taegis_sdk_python-1.4.4 → taegis_sdk_python-1.4.5}/taegis_sdk_python/transport/aiohttp_websockets.py

@@ -355,11 +355,9 @@ class AIOHTTPWebsocketsTransport(AsyncTransport):
                 answer_id = int(str(answer.get("id")))
 
                 if answer_type in ["next", "error"]:
-
                     payload = answer.get("payload")
 
                     if answer_type == "next":
-
                         if not isinstance(payload, dict):
                             raise ValueError("payload is not a dict")
 
@@ -378,7 +376,6 @@ class AIOHTTPWebsocketsTransport(AsyncTransport):
                         answer_type = "data"
 
                     elif answer_type == "error":
-
                         if not isinstance(payload, list):
                             raise ValueError("payload is not a list")
 
@@ -426,14 +423,12 @@ class AIOHTTPWebsocketsTransport(AsyncTransport):
                 answer_id = int(str(answer.get("id")))
 
                 if answer_type in ["data", "error"]:
-
                     payload = answer.get("payload")
 
                     if not isinstance(payload, dict):
                         raise ValueError("payload is not a dict")
 
                     if answer_type == "data":
-
                         if "errors" not in payload and "data" not in payload:
                             raise ValueError(
                                 "payload does not contain 'data' or 'errors' fields"
@@ -446,7 +441,6 @@ class AIOHTTPWebsocketsTransport(AsyncTransport):
                         )
 
                     elif answer_type == "error":
-
                         raise TransportQueryError(
                             str(payload), query_id=answer_id, errors=[payload]
                         )
@@ -634,7 +628,6 @@ class AIOHTTPWebsocketsTransport(AsyncTransport):
             self.subprotocol == self.GRAPHQLWS_SUBPROTOCOL
             and self.ping_interval is not None
         ):
-
             self.send_ping_task = asyncio.ensure_future(self._send_ping_coro())
 
     async def _close_hook(self):
@@ -795,7 +788,6 @@ class AIOHTTPWebsocketsTransport(AsyncTransport):
         answer_id: Optional[int],
         execution_result: Optional[ExecutionResult],
     ) -> None:
-
         try:
             # Put the answer in the queue
             if answer_id is not None:
@@ -820,7 +812,6 @@ class AIOHTTPWebsocketsTransport(AsyncTransport):
 
         try:
             while True:
-
                 # Wait the next answer from the websocket server
                 try:
                     answer = await self._receive()
@@ -995,7 +986,6 @@ class AIOHTTPWebsocketsTransport(AsyncTransport):
         log.debug("_close_coro: starting")
 
         try:
-
             try:
                 # Properly shut down liveness checker if enabled
                 if self.check_keep_alive_task is not None:
@@ -1053,7 +1043,6 @@ class AIOHTTPWebsocketsTransport(AsyncTransport):
                 self.client_session_args
                 and self.client_session_args.get("connector_owner") is False
             ):
-
                 log.debug("connector_owner is False -> not closing connector")
 
             else:
@@ -1098,7 +1087,6 @@ class AIOHTTPWebsocketsTransport(AsyncTransport):
             log.warning(f"Exception catched in _close_coro: {repr(exc)}")
 
         finally:
-
             log.debug("_close_coro: final cleanup")
 
             self.websocket = None
@@ -1113,7 +1101,6 @@ class AIOHTTPWebsocketsTransport(AsyncTransport):
         log.debug(f"_fail: starting with exception: {repr(e)}")
 
         if self.close_task is None:
-
             if self._wait_closed.is_set():
                 log.debug("_fail started but transport is already closed")
             else:
@@ -1209,7 +1196,6 @@ class AIOHTTPWebsocketsTransport(AsyncTransport):
         try:
             # Loop over the received answers
             while True:
-
                 # Wait for the answer from the queue of this query_id
                 # This can raise a TransportError or ConnectionClosed exception.
                 answer_type, execution_result = await listener.get()

{taegis_sdk_python-1.4.4 → taegis_sdk_python-1.4.5/taegis_sdk_python.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.4.4
+Version: 1.4.5
 Summary: Taegis Python SDK
 Home-page: https://github.com/secureworks/taegis-sdk-python
 Author: Secureworks

taegis_sdk_python-1.4.4/taegis_sdk_python/_version.py

@@ -1 +0,0 @@
-__version__ = "v1.4.4"