taegis-sdk-python 1.4.5__tar.gz → 1.4.6__tar.gz

{taegis_sdk_python-1.4.5/taegis_sdk_python.egg-info → taegis_sdk_python-1.4.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.4.5
+Version: 1.4.6
 Summary: Taegis Python SDK
 Home-page: https://github.com/secureworks/taegis-sdk-python
 Author: Secureworks

taegis_sdk_python-1.4.6/taegis_sdk_python/_version.py

@@ -0,0 +1 @@
+__version__ = "v1.4.6"

{taegis_sdk_python-1.4.5 → taegis_sdk_python-1.4.6}/taegis_sdk_python/services/alerts/types.py

@@ -2987,6 +2987,9 @@ class StructuredEntity:
     identifiers: Optional[List[str]] = field(
         default=None, metadata=config(field_name="identifiers")
     )
+    display_name: Optional[str] = field(
+        default=None, metadata=config(field_name="display_name")
+    )
     perspective: Optional[Union[EntityPerspective, TaegisEnum]] = field(
         default=None,
         metadata=config(

{taegis_sdk_python-1.4.5 → taegis_sdk_python-1.4.6}/taegis_sdk_python/services/assets2/types.py

@@ -1218,6 +1218,9 @@ class AssetWhereInputV2:
     vulnerability_status_autocomplete: Optional[str] = field(
         default=None, metadata=config(field_name="vulnerabilityStatus_autocomplete")
     )
+    is_archived: Optional[str] = field(
+        default=None, metadata=config(field_name="isArchived")
+    )
     and_: Optional[List["AssetWhereInputV2"]] = field(
         default=None, metadata=config(field_name="and")
     )

{taegis_sdk_python-1.4.5 → taegis_sdk_python-1.4.6}/taegis_sdk_python/services/clients/queries.py

@@ -60,6 +60,10 @@ class TaegisSDKClientsQuery:
         """Search Clients."""
         endpoint = "clients"
 
+        log.warning(
+            f"GraphQL Query `{endpoint}` is deprecated: 'Use clientsSearchResults instead, which includes totalCount and totalUnfilteredCount'"
+        )
+
         result = self.service.execute_query(
             endpoint=endpoint,
             variables={
@@ -78,3 +82,20 @@ class TaegisSDKClientsQuery:
                 [r or {} for r in result.get(endpoint)], many=True
             )
         raise GraphQLNoRowsInResultSetError("for query clients")
+
+    def clients_search(
+        self, filters: Optional[ClientsSearchInput] = None
+    ) -> ClientSearchResults:
+        """Returns clients matching the search criteria along with totalCount and totalUnfilteredCount."""
+        endpoint = "clientsSearch"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "filters": prepare_input(filters),
+            },
+            output=build_output_string(ClientSearchResults),
+        )
+        if result.get(endpoint) is not None:
+            return ClientSearchResults.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query clientsSearch")

{taegis_sdk_python-1.4.5 → taegis_sdk_python-1.4.6}/taegis_sdk_python/services/clients/types.py

@@ -93,6 +93,30 @@ class ClientRoleAssignmentInput:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class ClientsSearchInput:
+    """ClientsSearchInput."""
+
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    client_ids: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="clientIDs")
+    )
+    tenant_id: Optional[str] = field(
+        default=None, metadata=config(field_name="tenantID")
+    )
+    role_ids: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="roleIDs")
+    )
+    tenant_ids: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="tenantIDs")
+    )
+    page_offset: Optional[int] = field(
+        default=None, metadata=config(field_name="pageOffset")
+    )
+    per_page: Optional[int] = field(default=None, metadata=config(field_name="perPage"))
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class CreateClientInput:
@@ -236,6 +260,25 @@ class Client:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class ClientSearchResults:
+    """ClientSearchResults."""
+
+    result_count: Optional[int] = field(
+        default=None, metadata=config(field_name="result_count")
+    )
+    total_count: Optional[int] = field(
+        default=None, metadata=config(field_name="totalCount")
+    )
+    total_unfiltered_count: Optional[int] = field(
+        default=None, metadata=config(field_name="totalUnfilteredCount")
+    )
+    results: Optional[List[Client]] = field(
+        default=None, metadata=config(field_name="results")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class NewClient:

{taegis_sdk_python-1.4.5 → taegis_sdk_python-1.4.6}/taegis_sdk_python/services/collector/queries.py

@@ -729,7 +729,9 @@ class TaegisSDKCollectorQuery:
             return result.get(endpoint)
         raise GraphQLNoRowsInResultSetError("for query getClustersPasswordHash")
 
-    def get_data_collectors(self, input_: QlQueryInput) -> DataCollectorResult:
+    def get_data_collectors(
+        self, input_: CollectorsQlQueryInput
+    ) -> DataCollectorResult:
         """Searches and/or aggregates on Data collectors cql schema."""
         endpoint = "getDataCollectors"
 

{taegis_sdk_python-1.4.5 → taegis_sdk_python-1.4.6}/taegis_sdk_python/services/collector/types.py

@@ -713,8 +713,8 @@ class SyslogMessageCountV2Arguments:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class QlQueryInput:
-    """QlQueryInput."""
+class CollectorsQlQueryInput:
+    """CollectorsQlQueryInput."""
 
     cql_query: Optional[str] = field(
         default=None, metadata=config(field_name="cqlQuery")
@@ -725,8 +725,8 @@ class QlQueryInput:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class QLPageCursor:
-    """QLPageCursor."""
+class CollectorsPageCursor:
+    """CollectorsPageCursor."""
 
     next_cursor: Optional[str] = field(
         default=None, metadata=config(field_name="nextCursor")
@@ -1172,7 +1172,7 @@ class DataCollectorResult:
     data_collectors: Optional[List[DataCollector]] = field(
         default=None, metadata=config(field_name="dataCollectors")
     )
-    pagination: Optional[QLPageCursor] = field(
+    pagination: Optional[CollectorsPageCursor] = field(
         default=None, metadata=config(field_name="pagination")
     )
 

{taegis_sdk_python-1.4.5 → taegis_sdk_python-1.4.6}/taegis_sdk_python/services/datasources/mutations.py

@@ -35,7 +35,7 @@ class TaegisSDKDatasourcesMutation:
     def delete_data_source_assets(
         self, delete_asset_input: List[DeleteAssetInput]
     ) -> List[DeletedAsset]:
-        """Executes a delete operation on all included data sources for a specified tenant. Returns an array of all
+        """Executes a delete operation on all included data sources for a specified tenant. Returns an array of
         deleted assets with metadata. Authorization permission is required with delete access to the collector
         object.."""
         endpoint = "deleteDataSourceAssets"

{taegis_sdk_python-1.4.5 → taegis_sdk_python-1.4.6}/taegis_sdk_python/services/exports/types.py

@@ -71,6 +71,7 @@ class ReportChartType(str, Enum):
     INVESTIGATION_REPORT = "INVESTIGATION_REPORT"
     ISENSOR_REPORT = "ISENSOR_REPORT"
     PERFORMANCE_SUMMARY_REPORT = "PERFORMANCE_SUMMARY_REPORT"
+    AGENT_TREND_SUMMARY = "AGENT_TREND_SUMMARY"
 
 
 class ReportType(str, Enum):

taegis_sdk_python-1.4.6/taegis_sdk_python/services/process_trees/queries.py

@@ -0,0 +1,173 @@
+"""ProcessTrees Query."""
+
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+from taegis_sdk_python._consts import TaegisEnum
+from taegis_sdk_python.services.process_trees.types import *
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.process_trees import ProcessTreesService
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKProcessTreesQuery:
+    """Taegis Process_trees Query operations."""
+
+    def __init__(self, service: ProcessTreesService):
+        self.service = service
+
+    def process_children(
+        self,
+        tenant_id: str,
+        host_id: str,
+        process_correlation_id: str,
+        resource_id: Optional[str] = None,
+        order_by_input: Optional[List[OrderByInput]] = None,
+        next_token: Optional[str] = None,
+    ) -> Children:
+        """None."""
+        endpoint = "processChildren"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "tenantID": prepare_input(tenant_id),
+                "hostID": prepare_input(host_id),
+                "processCorrelationID": prepare_input(process_correlation_id),
+                "resourceID": prepare_input(resource_id),
+                "orderByInput": prepare_input(order_by_input),
+                "nextToken": prepare_input(next_token),
+            },
+            output=build_output_string(Children),
+        )
+        if result.get(endpoint) is not None:
+            return Children.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query processChildren")
+
+    def process_parent(
+        self,
+        tenant_id: str,
+        host_id: str,
+        parent_process_correlation_id: str,
+        resource_id: Optional[str] = None,
+    ) -> ProcessEvent:
+        """None."""
+        endpoint = "processParent"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "tenantID": prepare_input(tenant_id),
+                "hostID": prepare_input(host_id),
+                "parentProcessCorrelationID": prepare_input(
+                    parent_process_correlation_id
+                ),
+                "resourceID": prepare_input(resource_id),
+            },
+            output=build_output_string(ProcessEvent),
+        )
+        if result.get(endpoint) is not None:
+            return ProcessEvent.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query processParent")
+
+    def process_lineage(
+        self,
+        tenant_id: str,
+        host_id: str,
+        process_correlation_id: str,
+        resource_id: str,
+    ) -> ProcessLineage:
+        """None."""
+        endpoint = "processLineage"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "tenantID": prepare_input(tenant_id),
+                "hostID": prepare_input(host_id),
+                "processCorrelationID": prepare_input(process_correlation_id),
+                "resourceID": prepare_input(resource_id),
+            },
+            output=build_output_string(ProcessLineage),
+        )
+        if result.get(endpoint) is not None:
+            return ProcessLineage.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query processLineage")
+
+    def get_process_children(
+        self,
+        tenant_id: str,
+        host_id: str,
+        process_correlation_id: str,
+        resource_id: Optional[str] = None,
+        order_by_input: Optional[List[OrderByInput]] = None,
+        next_token: Optional[str] = None,
+    ) -> Children:
+        """None."""
+        endpoint = "GetProcessChildren"
+
+        log.warning(
+            f"GraphQL Query `{endpoint}` is deprecated: 'Use processChildren instead'"
+        )
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "tenantID": prepare_input(tenant_id),
+                "hostID": prepare_input(host_id),
+                "processCorrelationID": prepare_input(process_correlation_id),
+                "resourceID": prepare_input(resource_id),
+                "orderByInput": prepare_input(order_by_input),
+                "nextToken": prepare_input(next_token),
+            },
+            output=build_output_string(Children),
+        )
+        if result.get(endpoint) is not None:
+            return Children.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query GetProcessChildren")
+
+    def get_process_parent(
+        self,
+        tenant_id: str,
+        host_id: str,
+        parent_process_correlation_id: str,
+        resource_id: Optional[str] = None,
+    ) -> ProcessEvent:
+        """None."""
+        endpoint = "GetProcessParent"
+
+        log.warning(
+            f"GraphQL Query `{endpoint}` is deprecated: 'Use processParent instead'"
+        )
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "tenantID": prepare_input(tenant_id),
+                "hostID": prepare_input(host_id),
+                "parentProcessCorrelationID": prepare_input(
+                    parent_process_correlation_id
+                ),
+                "resourceID": prepare_input(resource_id),
+            },
+            output=build_output_string(ProcessEvent),
+        )
+        if result.get(endpoint) is not None:
+            return ProcessEvent.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query GetProcessParent")

{taegis_sdk_python-1.4.5 → taegis_sdk_python-1.4.6}/taegis_sdk_python/services/process_trees/types.py

@@ -7,11 +7,30 @@
 
 from dataclasses import dataclass, field
 
+from enum import Enum
+
 from typing import Any, Dict, List, Optional, Tuple, Union
 
 from dataclasses_json import config, dataclass_json
 
 
+from taegis_sdk_python._consts import TaegisEnum
+from taegis_sdk_python.utils import encode_enum, decode_enum, parse_union_result
+
+
+class OrderByDirectionInput(str, Enum):
+    """OrderByDirectionInput."""
+
+    ASC = "asc"
+    DESC = "desc"
+
+
+class OrderByFieldInput(str, Enum):
+    """OrderByFieldInput."""
+
+    PROCESS_CREATION_TIME = "processCreationTime"
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class ProgramHash:
@@ -78,9 +97,15 @@ class ProcessEvent:
     sensor_type: Optional[str] = field(
         default=None, metadata=config(field_name="sensorType")
     )
+    event_time_usec: Optional[int] = field(
+        default=None, metadata=config(field_name="eventTimeUsec")
+    )
     children_count: Optional[int] = field(
         default=None, metadata=config(field_name="childrenCount")
     )
+    alerts: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="alerts")
+    )
     program_hash: Optional[ProgramHash] = field(
         default=None, metadata=config(field_name="programHash")
     )
@@ -94,6 +119,43 @@ class Children:
     children_count: Optional[int] = field(
         default=None, metadata=config(field_name="childrenCount")
     )
+    next_token: Optional[str] = field(
+        default=None, metadata=config(field_name="nextToken")
+    )
     process_list: Optional[List[ProcessEvent]] = field(
         default=None, metadata=config(field_name="processList")
     )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class ProcessLineage:
+    """ProcessLineage."""
+
+    depth: Optional[int] = field(default=None, metadata=config(field_name="depth"))
+    lineage: Optional[List[ProcessEvent]] = field(
+        default=None, metadata=config(field_name="lineage")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class OrderByInput:
+    """OrderByInput."""
+
+    field_: Optional[Union[OrderByFieldInput, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(OrderByFieldInput, x),
+            field_name="field",
+        ),
+    )
+    direction: Optional[Union[OrderByDirectionInput, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(OrderByDirectionInput, x),
+            field_name="direction",
+        ),
+    )

{taegis_sdk_python-1.4.5 → taegis_sdk_python-1.4.6}/taegis_sdk_python/services/tenants4/queries.py

@@ -48,7 +48,7 @@ class TaegisSDKTenants4Query:
         raise GraphQLNoRowsInResultSetError("for query tenants")
 
     def tenant(self, id_: str) -> TenantV4:
-        """Retrieves a single tenant, tenant won't be returned if the subject does not have access to it (and requesting on an endpoint with authorization enabled)."""
+        """Retrieves a single tenant. Accepts a Taegis ID (numeric) or a Sophos ID (uuid). Tenant won't be returned if the subject does not have access to it (and requesting on an endpoint with authorization enabled)."""
         endpoint = "tenant"
 
         result = self.service.execute_query(

{taegis_sdk_python-1.4.5 → taegis_sdk_python-1.4.6}/taegis_sdk_python/services/tenants4/types.py

@@ -57,9 +57,6 @@ class MappedTenant:
     """MappedTenant."""
 
     id: Optional[str] = field(default=None, metadata=config(field_name="id"))
-    endpoint: Optional[str] = field(
-        default=None, metadata=config(field_name="endpoint")
-    )
     region: Optional[str] = field(default=None, metadata=config(field_name="region"))
     data_region: Optional[str] = field(
         default=None, metadata=config(field_name="dataRegion")

{taegis_sdk_python-1.4.5 → taegis_sdk_python-1.4.6/taegis_sdk_python.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.4.5
+Version: 1.4.6
 Summary: Taegis Python SDK
 Home-page: https://github.com/secureworks/taegis-sdk-python
 Author: Secureworks

taegis_sdk_python-1.4.5/taegis_sdk_python/_version.py

@@ -1 +0,0 @@
-__version__ = "v1.4.5"

taegis_sdk_python-1.4.5/taegis_sdk_python/services/process_trees/queries.py

@@ -1,83 +0,0 @@
-"""ProcessTrees Query."""
-
-# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
-
-
-# Autogenerated
-# DO NOT MODIFY
-
-from __future__ import annotations
-
-import logging
-from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
-
-from taegis_sdk_python import GraphQLNoRowsInResultSetError
-from taegis_sdk_python.utils import (
-    build_output_string,
-    parse_union_result,
-    prepare_input,
-)
-from taegis_sdk_python._consts import TaegisEnum
-from taegis_sdk_python.services.process_trees.types import *
-
-if TYPE_CHECKING:  # pragma: no cover
-    from taegis_sdk_python.services.process_trees import ProcessTreesService
-
-log = logging.getLogger(__name__)
-
-
-class TaegisSDKProcessTreesQuery:
-    """Taegis Process_trees Query operations."""
-
-    def __init__(self, service: ProcessTreesService):
-        self.service = service
-
-    def get_process_children(
-        self,
-        tenant_id: str,
-        host_id: str,
-        process_correlation_id: str,
-        resource_id: Optional[str] = None,
-    ) -> Children:
-        """None."""
-        endpoint = "GetProcessChildren"
-
-        result = self.service.execute_query(
-            endpoint=endpoint,
-            variables={
-                "tenantID": prepare_input(tenant_id),
-                "hostID": prepare_input(host_id),
-                "processCorrelationID": prepare_input(process_correlation_id),
-                "resourceID": prepare_input(resource_id),
-            },
-            output=build_output_string(Children),
-        )
-        if result.get(endpoint) is not None:
-            return Children.from_dict(result.get(endpoint))
-        raise GraphQLNoRowsInResultSetError("for query GetProcessChildren")
-
-    def get_process_parent(
-        self,
-        tenant_id: str,
-        host_id: str,
-        parent_process_correlation_id: str,
-        resource_id: Optional[str] = None,
-    ) -> ProcessEvent:
-        """None."""
-        endpoint = "GetProcessParent"
-
-        result = self.service.execute_query(
-            endpoint=endpoint,
-            variables={
-                "tenantID": prepare_input(tenant_id),
-                "hostID": prepare_input(host_id),
-                "parentProcessCorrelationID": prepare_input(
-                    parent_process_correlation_id
-                ),
-                "resourceID": prepare_input(resource_id),
-            },
-            output=build_output_string(ProcessEvent),
-        )
-        if result.get(endpoint) is not None:
-            return ProcessEvent.from_dict(result.get(endpoint))
-        raise GraphQLNoRowsInResultSetError("for query GetProcessParent")