taegis-sdk-python 1.4.4__tar.gz → 1.4.6__tar.gz

{taegis_sdk_python-1.4.4/taegis_sdk_python.egg-info → taegis_sdk_python-1.4.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.4.4
+Version: 1.4.6
 Summary: Taegis Python SDK
 Home-page: https://github.com/secureworks/taegis-sdk-python
 Author: Secureworks

taegis_sdk_python-1.4.6/taegis_sdk_python/_version.py

@@ -0,0 +1 @@
+__version__ = "v1.4.6"

{taegis_sdk_python-1.4.4 → taegis_sdk_python-1.4.6}/taegis_sdk_python/services/alerts/types.py

@@ -850,6 +850,18 @@ class EntityFile:
     file_type_detected: Optional[str] = field(
         default=None, metadata=config(field_name="file_type_detected")
     )
+    hash_md5: Optional[str] = field(
+        default=None, metadata=config(field_name="hash_md5")
+    )
+    hash_sha1: Optional[str] = field(
+        default=None, metadata=config(field_name="hash_sha1")
+    )
+    hash_sha256: Optional[str] = field(
+        default=None, metadata=config(field_name="hash_sha256")
+    )
+    hash_sha512: Optional[str] = field(
+        default=None, metadata=config(field_name="hash_sha512")
+    )
 
 
 @dataclass_json
@@ -997,6 +1009,18 @@ class EntityProcess:
     process_is_admin: Optional[bool] = field(
         default=None, metadata=config(field_name="process_is_admin")
     )
+    hash_md5: Optional[str] = field(
+        default=None, metadata=config(field_name="hash_md5")
+    )
+    hash_sha1: Optional[str] = field(
+        default=None, metadata=config(field_name="hash_sha1")
+    )
+    hash_sha256: Optional[str] = field(
+        default=None, metadata=config(field_name="hash_sha256")
+    )
+    hash_sha512: Optional[str] = field(
+        default=None, metadata=config(field_name="hash_sha512")
+    )
 
 
 @dataclass_json
@@ -2963,6 +2987,9 @@ class StructuredEntity:
     identifiers: Optional[List[str]] = field(
         default=None, metadata=config(field_name="identifiers")
     )
+    display_name: Optional[str] = field(
+        default=None, metadata=config(field_name="display_name")
+    )
     perspective: Optional[Union[EntityPerspective, TaegisEnum]] = field(
         default=None,
         metadata=config(
@@ -3164,6 +3191,7 @@ class Alert2:
     threat_score_v2: Optional[float] = field(
         default=None, metadata=config(field_name="threat_score_v2")
     )
+    vids: Optional[List[int]] = field(default=None, metadata=config(field_name="vids"))
     observation: Optional[bool] = field(
         default=None,
         metadata=config(

{taegis_sdk_python-1.4.4 → taegis_sdk_python-1.4.6}/taegis_sdk_python/services/assets2/types.py

@@ -1218,6 +1218,9 @@ class AssetWhereInputV2:
     vulnerability_status_autocomplete: Optional[str] = field(
         default=None, metadata=config(field_name="vulnerabilityStatus_autocomplete")
     )
+    is_archived: Optional[str] = field(
+        default=None, metadata=config(field_name="isArchived")
+    )
     and_: Optional[List["AssetWhereInputV2"]] = field(
         default=None, metadata=config(field_name="and")
     )

{taegis_sdk_python-1.4.4 → taegis_sdk_python-1.4.6}/taegis_sdk_python/services/clients/queries.py

@@ -60,6 +60,10 @@ class TaegisSDKClientsQuery:
         """Search Clients."""
         endpoint = "clients"
 
+        log.warning(
+            f"GraphQL Query `{endpoint}` is deprecated: 'Use clientsSearchResults instead, which includes totalCount and totalUnfilteredCount'"
+        )
+
         result = self.service.execute_query(
             endpoint=endpoint,
             variables={
@@ -78,3 +82,20 @@ class TaegisSDKClientsQuery:
                 [r or {} for r in result.get(endpoint)], many=True
             )
         raise GraphQLNoRowsInResultSetError("for query clients")
+
+    def clients_search(
+        self, filters: Optional[ClientsSearchInput] = None
+    ) -> ClientSearchResults:
+        """Returns clients matching the search criteria along with totalCount and totalUnfilteredCount."""
+        endpoint = "clientsSearch"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "filters": prepare_input(filters),
+            },
+            output=build_output_string(ClientSearchResults),
+        )
+        if result.get(endpoint) is not None:
+            return ClientSearchResults.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query clientsSearch")

{taegis_sdk_python-1.4.4 → taegis_sdk_python-1.4.6}/taegis_sdk_python/services/clients/types.py

@@ -93,6 +93,30 @@ class ClientRoleAssignmentInput:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class ClientsSearchInput:
+    """ClientsSearchInput."""
+
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    client_ids: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="clientIDs")
+    )
+    tenant_id: Optional[str] = field(
+        default=None, metadata=config(field_name="tenantID")
+    )
+    role_ids: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="roleIDs")
+    )
+    tenant_ids: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="tenantIDs")
+    )
+    page_offset: Optional[int] = field(
+        default=None, metadata=config(field_name="pageOffset")
+    )
+    per_page: Optional[int] = field(default=None, metadata=config(field_name="perPage"))
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class CreateClientInput:
@@ -236,6 +260,25 @@ class Client:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class ClientSearchResults:
+    """ClientSearchResults."""
+
+    result_count: Optional[int] = field(
+        default=None, metadata=config(field_name="result_count")
+    )
+    total_count: Optional[int] = field(
+        default=None, metadata=config(field_name="totalCount")
+    )
+    total_unfiltered_count: Optional[int] = field(
+        default=None, metadata=config(field_name="totalUnfilteredCount")
+    )
+    results: Optional[List[Client]] = field(
+        default=None, metadata=config(field_name="results")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class NewClient:

{taegis_sdk_python-1.4.4 → taegis_sdk_python-1.4.6}/taegis_sdk_python/services/collector/queries.py

@@ -729,7 +729,9 @@ class TaegisSDKCollectorQuery:
             return result.get(endpoint)
         raise GraphQLNoRowsInResultSetError("for query getClustersPasswordHash")
 
-    def get_data_collectors(self, input_: QlQueryInput) -> DataCollectorResult:
+    def get_data_collectors(
+        self, input_: CollectorsQlQueryInput
+    ) -> DataCollectorResult:
         """Searches and/or aggregates on Data collectors cql schema."""
         endpoint = "getDataCollectors"
 

{taegis_sdk_python-1.4.4 → taegis_sdk_python-1.4.6}/taegis_sdk_python/services/collector/types.py

@@ -713,8 +713,8 @@ class SyslogMessageCountV2Arguments:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class QlQueryInput:
-    """QlQueryInput."""
+class CollectorsQlQueryInput:
+    """CollectorsQlQueryInput."""
 
     cql_query: Optional[str] = field(
         default=None, metadata=config(field_name="cqlQuery")
@@ -725,8 +725,8 @@ class QlQueryInput:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class QLPageCursor:
-    """QLPageCursor."""
+class CollectorsPageCursor:
+    """CollectorsPageCursor."""
 
     next_cursor: Optional[str] = field(
         default=None, metadata=config(field_name="nextCursor")
@@ -1172,7 +1172,7 @@ class DataCollectorResult:
     data_collectors: Optional[List[DataCollector]] = field(
         default=None, metadata=config(field_name="dataCollectors")
     )
-    pagination: Optional[QLPageCursor] = field(
+    pagination: Optional[CollectorsPageCursor] = field(
         default=None, metadata=config(field_name="pagination")
     )
 

{taegis_sdk_python-1.4.4 → taegis_sdk_python-1.4.6}/taegis_sdk_python/services/datasources/mutations.py

@@ -35,7 +35,7 @@ class TaegisSDKDatasourcesMutation:
     def delete_data_source_assets(
         self, delete_asset_input: List[DeleteAssetInput]
     ) -> List[DeletedAsset]:
-        """Executes a delete operation on all included data sources for a specified tenant. Returns an array of all
+        """Executes a delete operation on all included data sources for a specified tenant. Returns an array of
         deleted assets with metadata. Authorization permission is required with delete access to the collector
         object.."""
         endpoint = "deleteDataSourceAssets"

{taegis_sdk_python-1.4.4 → taegis_sdk_python-1.4.6}/taegis_sdk_python/services/exports/types.py

@@ -71,6 +71,7 @@ class ReportChartType(str, Enum):
     INVESTIGATION_REPORT = "INVESTIGATION_REPORT"
     ISENSOR_REPORT = "ISENSOR_REPORT"
     PERFORMANCE_SUMMARY_REPORT = "PERFORMANCE_SUMMARY_REPORT"
+    AGENT_TREND_SUMMARY = "AGENT_TREND_SUMMARY"
 
 
 class ReportType(str, Enum):

{taegis_sdk_python-1.4.4 → taegis_sdk_python-1.4.6}/taegis_sdk_python/services/investigations2/types.py

@@ -30,6 +30,13 @@ class AlertResolutionStatus(str, Enum):
     SUPPRESSED = "SUPPRESSED"
 
 
+class TemplateUsage(str, Enum):
+    """TemplateUsage."""
+
+    MANUAL = "MANUAL"
+    AUTO_INVESTIGATION = "AUTO_INVESTIGATION"
+
+
 class InvestigationRuleState(str, Enum):
     """InvestigationRuleState."""
 
@@ -369,80 +376,6 @@ class RemoveEvidenceFromInvestigationResult:
     )
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class CreateInvestigationTemplateInput:
-    """CreateInvestigationTemplateInput."""
-
-    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
-    title: Optional[str] = field(default=None, metadata=config(field_name="title"))
-    description: Optional[str] = field(
-        default=None, metadata=config(field_name="description")
-    )
-    tags: Optional[List[str]] = field(default=None, metadata=config(field_name="tags"))
-    investigation_type: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationType")
-    )
-    investigation_priority: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationPriority")
-    )
-    investigation_title: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationTitle")
-    )
-    investigation_tags: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="investigationTags")
-    )
-    investigation_key_findings: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationKeyFindings")
-    )
-    investigation_key_findings_prompts: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="investigationKeyFindingsPrompts")
-    )
-    investigation_assignee: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationAssignee")
-    )
-    investigation_status: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationStatus")
-    )
-
-
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class UpdateInvestigationTemplateInput:
-    """UpdateInvestigationTemplateInput."""
-
-    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
-    title: Optional[str] = field(default=None, metadata=config(field_name="title"))
-    description: Optional[str] = field(
-        default=None, metadata=config(field_name="description")
-    )
-    tags: Optional[List[str]] = field(default=None, metadata=config(field_name="tags"))
-    investigation_type: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationType")
-    )
-    investigation_priority: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationPriority")
-    )
-    investigation_title: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationTitle")
-    )
-    investigation_tags: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="investigationTags")
-    )
-    investigation_key_findings: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationKeyFindings")
-    )
-    investigation_key_findings_prompts: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="investigationKeyFindingsPrompts")
-    )
-    investigation_assignee: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationAssignee")
-    )
-    investigation_status: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationStatus")
-    )
-
-
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class DeleteInvestigationTemplateInput:
@@ -876,6 +809,96 @@ class InvestigationAssigneeCount:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class CreateInvestigationTemplateInput:
+    """CreateInvestigationTemplateInput."""
+
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    title: Optional[str] = field(default=None, metadata=config(field_name="title"))
+    description: Optional[str] = field(
+        default=None, metadata=config(field_name="description")
+    )
+    tags: Optional[List[str]] = field(default=None, metadata=config(field_name="tags"))
+    investigation_type: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationType")
+    )
+    investigation_priority: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationPriority")
+    )
+    investigation_title: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationTitle")
+    )
+    investigation_tags: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="investigationTags")
+    )
+    investigation_key_findings: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationKeyFindings")
+    )
+    investigation_key_findings_prompts: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="investigationKeyFindingsPrompts")
+    )
+    investigation_assignee: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationAssignee")
+    )
+    investigation_status: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationStatus")
+    )
+    usages: Optional[List[Union[TemplateUsage, TaegisEnum]]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(TemplateUsage, x),
+            field_name="usages",
+        ),
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class UpdateInvestigationTemplateInput:
+    """UpdateInvestigationTemplateInput."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    title: Optional[str] = field(default=None, metadata=config(field_name="title"))
+    description: Optional[str] = field(
+        default=None, metadata=config(field_name="description")
+    )
+    tags: Optional[List[str]] = field(default=None, metadata=config(field_name="tags"))
+    investigation_type: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationType")
+    )
+    investigation_priority: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationPriority")
+    )
+    investigation_title: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationTitle")
+    )
+    investigation_tags: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="investigationTags")
+    )
+    investigation_key_findings: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationKeyFindings")
+    )
+    investigation_key_findings_prompts: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="investigationKeyFindingsPrompts")
+    )
+    investigation_assignee: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationAssignee")
+    )
+    investigation_status: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationStatus")
+    )
+    usages: Optional[List[Union[TemplateUsage, TaegisEnum]]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(TemplateUsage, x),
+            field_name="usages",
+        ),
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class InvestigationsV2Arguments:
@@ -1488,6 +1511,69 @@ class AggregatedCounts:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class CommentV2:
+    """CommentV2."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    author_id: Optional[str] = field(
+        default=None, metadata=config(field_name="authorId")
+    )
+    created_at: Optional[str] = field(
+        default=None, metadata=config(field_name="createdAt")
+    )
+    updated_at: Optional[str] = field(
+        default=None, metadata=config(field_name="updatedAt")
+    )
+    comment: Optional[str] = field(default=None, metadata=config(field_name="comment"))
+    investigation_id: Optional[str] = field(
+        default=None, metadata=config(field_name="investigationId")
+    )
+    tenant_id: Optional[str] = field(
+        default=None, metadata=config(field_name="tenantId")
+    )
+    mentions_ids: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="mentionsIds")
+    )
+    read_by_ids: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="readByIds")
+    )
+    is_internal: Optional[bool] = field(
+        default=None, metadata=config(field_name="isInternal")
+    )
+    author_subject: Optional[Subject] = field(
+        default=None, metadata=config(field_name="authorSubject")
+    )
+    mentions_subjects: Optional[List[Subject]] = field(
+        default=None, metadata=config(field_name="mentionsSubjects")
+    )
+    read_by_subjects: Optional[List[Subject]] = field(
+        default=None, metadata=config(field_name="readBySubjects")
+    )
+    author: Optional[TDRUser] = field(
+        default=None,
+        metadata=config(
+            metadata={"deprecated": True, "deprecation_reason": "use authorSubject"},
+            field_name="author",
+        ),
+    )
+    mentions_users: Optional[List[TDRUser]] = field(
+        default=None,
+        metadata=config(
+            metadata={"deprecated": True, "deprecation_reason": "use mentionsSubjects"},
+            field_name="mentionsUsers",
+        ),
+    )
+    read_by: Optional[List[TDRUser]] = field(
+        default=None,
+        metadata=config(
+            metadata={"deprecated": True, "deprecation_reason": "use readBySubjects"},
+            field_name="readBy",
+        ),
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class InvestigationTemplate:
@@ -1548,6 +1634,14 @@ class InvestigationTemplate:
     investigation_assignee_subject: Optional[Subject] = field(
         default=None, metadata=config(field_name="investigationAssigneeSubject")
     )
+    usages: Optional[List[Union[TemplateUsage, TaegisEnum]]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(TemplateUsage, x),
+            field_name="usages",
+        ),
+    )
     created_by: Optional[TDRUser] = field(
         default=None,
         metadata=config(
@@ -1574,69 +1668,6 @@ class InvestigationTemplate:
     )
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class CommentV2:
-    """CommentV2."""
-
-    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
-    author_id: Optional[str] = field(
-        default=None, metadata=config(field_name="authorId")
-    )
-    created_at: Optional[str] = field(
-        default=None, metadata=config(field_name="createdAt")
-    )
-    updated_at: Optional[str] = field(
-        default=None, metadata=config(field_name="updatedAt")
-    )
-    comment: Optional[str] = field(default=None, metadata=config(field_name="comment"))
-    investigation_id: Optional[str] = field(
-        default=None, metadata=config(field_name="investigationId")
-    )
-    tenant_id: Optional[str] = field(
-        default=None, metadata=config(field_name="tenantId")
-    )
-    mentions_ids: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="mentionsIds")
-    )
-    read_by_ids: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="readByIds")
-    )
-    is_internal: Optional[bool] = field(
-        default=None, metadata=config(field_name="isInternal")
-    )
-    author_subject: Optional[Subject] = field(
-        default=None, metadata=config(field_name="authorSubject")
-    )
-    mentions_subjects: Optional[List[Subject]] = field(
-        default=None, metadata=config(field_name="mentionsSubjects")
-    )
-    read_by_subjects: Optional[List[Subject]] = field(
-        default=None, metadata=config(field_name="readBySubjects")
-    )
-    author: Optional[TDRUser] = field(
-        default=None,
-        metadata=config(
-            metadata={"deprecated": True, "deprecation_reason": "use authorSubject"},
-            field_name="author",
-        ),
-    )
-    mentions_users: Optional[List[TDRUser]] = field(
-        default=None,
-        metadata=config(
-            metadata={"deprecated": True, "deprecation_reason": "use mentionsSubjects"},
-            field_name="mentionsUsers",
-        ),
-    )
-    read_by: Optional[List[TDRUser]] = field(
-        default=None,
-        metadata=config(
-            metadata={"deprecated": True, "deprecation_reason": "use readBySubjects"},
-            field_name="readBy",
-        ),
-    )
-
-
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class InvestigationRule:

{taegis_sdk_python-1.4.4 → taegis_sdk_python-1.4.6}/taegis_sdk_python/services/multi_tenant_ioc/types.py

@@ -36,17 +36,11 @@ class Operator(str, Enum):
     MATCHES_REGEX = "MATCHES_REGEX"
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class EventWindow:
-    """EventWindow."""
+class BackendStrategy(str, Enum):
+    """BackendStrategy."""
 
-    earliest_event: Optional[str] = field(
-        default=None, metadata=config(field_name="earliestEvent")
-    )
-    latest_event: Optional[str] = field(
-        default=None, metadata=config(field_name="latestEvent")
-    )
+    ATHENA = "ATHENA"
+    TRINO = "TRINO"
 
 
 @dataclass_json
@@ -88,6 +82,27 @@ class TenantsInput:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EventWindow:
+    """EventWindow."""
+
+    earliest_event: Optional[str] = field(
+        default=None, metadata=config(field_name="earliestEvent")
+    )
+    latest_event: Optional[str] = field(
+        default=None, metadata=config(field_name="latestEvent")
+    )
+    backend_strategy: Optional[Union[BackendStrategy, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(BackendStrategy, x),
+            field_name="backendStrategy",
+        ),
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class EventCountByLogicalType:
@@ -106,20 +121,6 @@ class EventCountByLogicalType:
     )
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class EventCountResult:
-    """EventCountResult."""
-
-    next: Optional[str] = field(default=None, metadata=config(field_name="next"))
-    results: Optional[List[EventCountByLogicalType]] = field(
-        default=None, metadata=config(field_name="results")
-    )
-    error: Optional[DataAvailabilityError] = field(
-        default=None, metadata=config(field_name="error")
-    )
-
-
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class LogicalTypeFilter:
@@ -146,6 +147,28 @@ class LogicalTypeFilter:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EventCountResult:
+    """EventCountResult."""
+
+    next: Optional[str] = field(default=None, metadata=config(field_name="next"))
+    results: Optional[List[EventCountByLogicalType]] = field(
+        default=None, metadata=config(field_name="results")
+    )
+    backend_strategy: Optional[Union[BackendStrategy, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(BackendStrategy, x),
+            field_name="backendStrategy",
+        ),
+    )
+    error: Optional[DataAvailabilityError] = field(
+        default=None, metadata=config(field_name="error")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class EventAggregationArguments:
@@ -165,3 +188,11 @@ class EventAggregationArguments:
     tenants_context: Optional[TenantsInput] = field(
         default=None, metadata=config(field_name="tenantsContext")
     )
+    backend_strategy: Optional[Union[BackendStrategy, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(BackendStrategy, x),
+            field_name="backendStrategy",
+        ),
+    )