taegis-sdk-python 1.4.6__tar.gz → 1.4.8__tar.gz

{taegis_sdk_python-1.4.6/taegis_sdk_python.egg-info → taegis_sdk_python-1.4.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.4.6
+Version: 1.4.8
 Summary: Taegis Python SDK
 Home-page: https://github.com/secureworks/taegis-sdk-python
 Author: Secureworks

taegis_sdk_python-1.4.8/taegis_sdk_python/_version.py

@@ -0,0 +1 @@
+__version__ = "v1.4.8"

{taegis_sdk_python-1.4.6 → taegis_sdk_python-1.4.8}/taegis_sdk_python/services/assets2/types.py

@@ -18,6 +18,13 @@ from taegis_sdk_python._consts import TaegisEnum
 from taegis_sdk_python.utils import encode_enum, decode_enum, parse_union_result
 
 
+class ArchiveStatus(str, Enum):
+    """ArchiveStatus."""
+
+    ARCHIVED = "ARCHIVED"
+    NOT_ARCHIVED = "NOT_ARCHIVED"
+
+
 class AssetState(str, Enum):
     """AssetState."""
 
@@ -28,6 +35,15 @@ class AssetState(str, Enum):
     HEALTHY = "Healthy"
 
 
+class VendorHealthState(str, Enum):
+    """VendorHealthState."""
+
+    UNKNOWN_HEALTH = "UNKNOWN_HEALTH"
+    GOOD = "GOOD"
+    NEEDS_ATTENTION = "NEEDS_ATTENTION"
+    CRITICAL = "CRITICAL"
+
+
 class EndpointTypeV2(str, Enum):
     """EndpointTypeV2."""
 
@@ -40,7 +56,7 @@ class EndpointTypeV2(str, Enum):
     ENDPOINT_SENTINELONE = "ENDPOINT_SENTINELONE"
     ENDPOINT_HARFANG_LAB = "ENDPOINT_HARFANG_LAB"
     ENDPOINT_SOPHOS_CIXA = "ENDPOINT_SOPHOS_CIXA"
-    ENDPOINT_SOPHOS_XDR = "ENDPOINT_SOPHOS_XDR"
+    ENDPOINT_SOPHOS = "ENDPOINT_SOPHOS"
 
 
 class FacetInfoOrderByInputV2(str, Enum):
@@ -93,6 +109,18 @@ class AssetSearchOrderByInputV2(str, Enum):
     TAG_DESC = "tag_desc"
     VULNERABILITY_STATUS_ASC = "vulnerability_status_asc"
     VULNERABILITY_STATUS_DESC = "vulnerability_status_desc"
+    VENDOR_PROVIDED_HEALTH_ASC = "vendor_provided_health_asc"
+    VENDOR_PROVIDED_HEALTH_DESC = "vendor_provided_health_desc"
+    USERNAME_ASC = "username_asc"
+    USERNAME_DESC = "username_desc"
+    REBOOT_REQUIRED_ASC = "reboot_required_asc"
+    REBOOT_REQUIRED_DESC = "reboot_required_desc"
+    SYSTEM_VOLUME_SERIAL_ASC = "system_volume_serial_asc"
+    SYSTEM_VOLUME_SERIAL_DESC = "system_volume_serial_desc"
+    BIOS_SERIAL_ASC = "bios_serial_asc"
+    BIOS_SERIAL_DESC = "bios_serial_desc"
+    FIRST_DISK_SERIAL_ASC = "first_disk_serial_asc"
+    FIRST_DISK_SERIAL_DESC = "first_disk_serial_desc"
 
 
 class AssetHostnameSearchOrderByInput(str, Enum):
@@ -1068,7 +1096,11 @@ class AssetWhereInputV2:
         default=None, metadata=config(field_name="cloudInstanceId_autocomplete")
     )
     connection_status: Optional[str] = field(
-        default=None, metadata=config(field_name="connectionStatus")
+        default=None,
+        metadata=config(
+            metadata={"deprecated": True, "deprecation_reason": "No longer supported"},
+            field_name="connectionStatus",
+        ),
     )
     created_at: Optional[str] = field(
         default=None, metadata=config(field_name="createdAt")
@@ -1218,8 +1250,8 @@ class AssetWhereInputV2:
     vulnerability_status_autocomplete: Optional[str] = field(
         default=None, metadata=config(field_name="vulnerabilityStatus_autocomplete")
     )
-    is_archived: Optional[str] = field(
-        default=None, metadata=config(field_name="isArchived")
+    reboot_required: Optional[bool] = field(
+        default=None, metadata=config(field_name="rebootRequired")
     )
     and_: Optional[List["AssetWhereInputV2"]] = field(
         default=None, metadata=config(field_name="and")
@@ -1230,6 +1262,14 @@ class AssetWhereInputV2:
     not_: Optional["AssetWhereInputV2"] = field(
         default=None, metadata=config(field_name="not")
     )
+    vendor_provided_health: Optional[Union[VendorHealthState, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(VendorHealthState, x),
+            field_name="vendorProvidedHealth",
+        ),
+    )
     tags: Optional[TagWhereInputV2] = field(
         default=None, metadata=config(field_name="tags")
     )
@@ -1239,6 +1279,14 @@ class AssetWhereInputV2:
     tags_autocomplete: Optional[TagWhereInputV2] = field(
         default=None, metadata=config(field_name="tags_autocomplete")
     )
+    archived_status: Optional[Union[ArchiveStatus, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(ArchiveStatus, x),
+            field_name="archivedStatus",
+        ),
+    )
 
 
 @dataclass_json
@@ -1344,7 +1392,16 @@ class AssetV2:
     cloud_instance_id: Optional[str] = field(
         default=None, metadata=config(field_name="cloudInstanceId")
     )
-    status: Optional[str] = field(default=None, metadata=config(field_name="status"))
+    status: Optional[str] = field(
+        default=None,
+        metadata=config(
+            metadata={
+                "deprecated": True,
+                "deprecation_reason": "use field vendorProvidedHealth",
+            },
+            field_name="status",
+        ),
+    )
     un_installable: Optional[bool] = field(
         default=None, metadata=config(field_name="unInstallable")
     )
@@ -1354,6 +1411,9 @@ class AssetV2:
     uninstall: Optional[bool] = field(
         default=None, metadata=config(field_name="uninstall")
     )
+    reboot_required: Optional[bool] = field(
+        default=None, metadata=config(field_name="rebootRequired")
+    )
     hostnames: Optional[List[HostnameV2]] = field(
         default=None, metadata=config(field_name="hostnames")
     )
@@ -1384,6 +1444,22 @@ class AssetV2:
     connection_details: Optional[ConnectionDetails] = field(
         default=None, metadata=config(field_name="connectionDetails")
     )
+    vendor_provided_health: Optional[Union[VendorHealthState, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(VendorHealthState, x),
+            field_name="vendorProvidedHealth",
+        ),
+    )
+    archived_status: Optional[Union[ArchiveStatus, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(ArchiveStatus, x),
+            field_name="archivedStatus",
+        ),
+    )
 
 
 @dataclass_json
@@ -1483,6 +1559,7 @@ class AssetFilter:
     asset_state: Optional[List[Union[AssetState, TaegisEnum]]] = field(
         default=None,
         metadata=config(
+            metadata={"deprecated": True, "deprecation_reason": "No longer supported"},
             encoder=encode_enum,
             decoder=lambda x: decode_enum(AssetState, x),
             field_name="assetState",

{taegis_sdk_python-1.4.6 → taegis_sdk_python-1.4.8}/taegis_sdk_python/services/collector/types.py

@@ -86,6 +86,7 @@ class ImageType(str, Enum):
     OVA = "OVA"
     AZURE = "AZURE"
     GCP = "GCP"
+    QCOW2 = "QCOW2"
 
 
 @dataclass_json

{taegis_sdk_python-1.4.6 → taegis_sdk_python-1.4.8}/taegis_sdk_python/services/rules/queries.py

@@ -488,3 +488,39 @@ class TaegisSDKRulesQuery:
         if result.get(endpoint) is not None:
             return RuleFacetAggregationsOutput.from_dict(result.get(endpoint))
         raise GraphQLNoRowsInResultSetError("for query ruleFacetAggregations")
+
+    def ql_rules_tenants_details(
+        self, event_type: Union[RuleEventType, TaegisEnum]
+    ) -> List[QLTenants]:
+        """Returns a list of tenants, parents, and organizations with QL rules for the specified event type."""
+        endpoint = "qlRulesTenantsDetails"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "eventType": prepare_input(event_type),
+            },
+            output=build_output_string(QLTenants),
+        )
+        if result.get(endpoint) is not None:
+            return QLTenants.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query qlRulesTenantsDetails")
+
+    def ql_rules_tenants(
+        self, event_type: Union[RuleEventType, TaegisEnum]
+    ) -> List[str]:
+        """Returns a list of tenant IDs with QL rules for the specified event type."""
+        endpoint = "qlRulesTenants"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "eventType": prepare_input(event_type),
+            },
+            output="",
+        )
+        if result.get(endpoint) is not None:
+            return result.get(endpoint)
+        raise GraphQLNoRowsInResultSetError("for query qlRulesTenants")

{taegis_sdk_python-1.4.6 → taegis_sdk_python-1.4.8}/taegis_sdk_python/services/rules/types.py

@@ -44,6 +44,8 @@ class RuleEventType(str, Enum):
     THREAD_INJECTION = "thread_injection"
     PROCESS_MODULE = "process_module"
     TAEGIS_AGENT_DETECTION = "taegis_agent_detection"
+    DETECTION_FINDING = "detection_finding"
+    TECHNIQUE_FINDING = "technique_finding"
 
 
 class RuleEndpointPlatform(str, Enum):
@@ -134,6 +136,15 @@ class RuleDay(str, Enum):
     SUNDAY = "Sunday"
 
 
+class QLTenantType(str, Enum):
+    """QLTenantType."""
+
+    QL_TENANT = "QLTenant"
+    QL_PARTNER = "QLPartner"
+    QL_ORGANIZATION = "QLOrganization"
+    QL_UNKNOWN = "QLUnknown"
+
+
 class RuleResolutionStatus(str, Enum):
     """RuleResolutionStatus."""
 
@@ -369,6 +380,15 @@ class AggregationPair:
     value: Optional[int] = field(default=None, metadata=config(field_name="value"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class QLTenantIDs:
+    """QLTenantIDs."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    type: Optional[int] = field(default=None, metadata=config(field_name="type"))
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class TDRUser:
@@ -498,6 +518,22 @@ class RuleMetrics:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class QLTenants:
+    """QLTenants."""
+
+    tenant: Optional[str] = field(default=None, metadata=config(field_name="tenant"))
+    tenant_type: Optional[Union[QLTenantType, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(QLTenantType, x),
+            field_name="tenantType",
+        ),
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class RuleCountResponse:
@@ -663,6 +699,9 @@ class SearchRulesByFieldInput:
     )
     cve: Optional[str] = field(default=None, metadata=config(field_name="cve"))
     vid: Optional[int] = field(default=None, metadata=config(field_name="vid"))
+    aggressive_threat_detection: Optional[bool] = field(
+        default=None, metadata=config(field_name="aggressiveThreatDetection")
+    )
     enabled: Optional[bool] = field(default=None, metadata=config(field_name="enabled"))
     deleted: Optional[bool] = field(default=None, metadata=config(field_name="deleted"))
     updated_at: Optional[str] = field(
@@ -753,6 +792,9 @@ class RuleInput:
         default=None, metadata=config(field_name="attackCategories")
     )
     enabled: Optional[bool] = field(default=None, metadata=config(field_name="enabled"))
+    aggressive_threat_detection: Optional[bool] = field(
+        default=None, metadata=config(field_name="aggressiveThreatDetection")
+    )
     event_type: Optional[Union[RuleEventType, TaegisEnum]] = field(
         default=None,
         metadata=config(
@@ -863,6 +905,9 @@ class Rule:
         default=None, metadata=config(field_name="confidence")
     )
     enabled: Optional[bool] = field(default=None, metadata=config(field_name="enabled"))
+    aggressive_threat_detection: Optional[bool] = field(
+        default=None, metadata=config(field_name="aggressiveThreatDetection")
+    )
     create_alert: Optional[bool] = field(
         default=None, metadata=config(field_name="createAlert")
     )

{taegis_sdk_python-1.4.6 → taegis_sdk_python-1.4.8}/taegis_sdk_python/services/tenants/types.py

@@ -453,36 +453,6 @@ class TenantDecommissionAgentSummary:
     count: Optional[int] = field(default=None, metadata=config(field_name="count"))
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class RegisteredDomain:
-    """RegisteredDomain."""
-
-    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
-    tenant_id: Optional[str] = field(
-        default=None, metadata=config(field_name="tenantID")
-    )
-    domain: Optional[str] = field(default=None, metadata=config(field_name="domain"))
-    verified: Optional[bool] = field(
-        default=None, metadata=config(field_name="verified")
-    )
-    verification_txt: Optional[str] = field(
-        default=None, metadata=config(field_name="verificationTxt")
-    )
-    created_at: Optional[str] = field(
-        default=None, metadata=config(field_name="createdAt")
-    )
-    updated_at: Optional[str] = field(
-        default=None, metadata=config(field_name="updatedAt")
-    )
-    created_by: Optional[str] = field(
-        default=None, metadata=config(field_name="createdBy")
-    )
-    updated_by: Optional[str] = field(
-        default=None, metadata=config(field_name="updatedBy")
-    )
-
-
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class NewService:
@@ -1668,3 +1638,36 @@ class SSOConnectionConfigResponse:
     sso_connection_configuration: Optional[SSOConnectionConfiguration] = field(
         default=None, metadata=config(field_name="ssoConnectionConfiguration")
     )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class RegisteredDomain:
+    """RegisteredDomain."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    tenant_id: Optional[str] = field(
+        default=None, metadata=config(field_name="tenantID")
+    )
+    domain: Optional[str] = field(default=None, metadata=config(field_name="domain"))
+    verified: Optional[bool] = field(
+        default=None, metadata=config(field_name="verified")
+    )
+    verification_txt: Optional[str] = field(
+        default=None, metadata=config(field_name="verificationTxt")
+    )
+    created_at: Optional[str] = field(
+        default=None, metadata=config(field_name="createdAt")
+    )
+    updated_at: Optional[str] = field(
+        default=None, metadata=config(field_name="updatedAt")
+    )
+    created_by: Optional[str] = field(
+        default=None, metadata=config(field_name="createdBy")
+    )
+    updated_by: Optional[str] = field(
+        default=None, metadata=config(field_name="updatedBy")
+    )
+    sso_connections: Optional[List[SSOConnection]] = field(
+        default=None, metadata=config(field_name="ssoConnections")
+    )

{taegis_sdk_python-1.4.6 → taegis_sdk_python-1.4.8}/taegis_sdk_python/services/threat/queries.py

@@ -345,6 +345,7 @@ class TaegisSDKThreatQuery:
         object_type: Union[ThreatFacetObject, TaegisEnum],
         filters: Optional[ThreatFilter] = None,
         page: Optional[ThreatPageInput] = None,
+        sort_by: Optional[List[SortByInput]] = None,
     ) -> ThreatIntelligence:
         """Retrieves all intelligence based on input threat object type and filters."""
         endpoint = "threatIntelligence"
@@ -355,6 +356,7 @@ class TaegisSDKThreatQuery:
                 "objectType": prepare_input(object_type),
                 "filters": prepare_input(filters),
                 "page": prepare_input(page),
+                "sortBy": prepare_input(sort_by),
             },
             output=build_output_string(ThreatIntelligence),
         )

{taegis_sdk_python-1.4.6 → taegis_sdk_python-1.4.8}/taegis_sdk_python/services/threat/types.py

@@ -18,6 +18,26 @@ from taegis_sdk_python._consts import TaegisEnum
 from taegis_sdk_python.utils import encode_enum, decode_enum, parse_union_result
 
 
+class SortByDirectionInput(str, Enum):
+    """SortByDirectionInput."""
+
+    ASC = "asc"
+    DESC = "desc"
+
+
+class SortByFieldInput(str, Enum):
+    """SortByFieldInput."""
+
+    MALWARE_FAMILY = "malware_family"
+    MALWARE_LAST_SEEN = "malware_last_seen"
+    MALWARE_TYPE = "malware_type"
+    THREAT_GROUP_NAME = "threat_group_name"
+    THREAT_GROUP_THEMATIC_AREA = "threat_group_thematic_area"
+    THREAT_GROUP_STATUS = "threat_group_status"
+    REPORT_NAME = "report_name"
+    REPORT_PUBLISHED = "report_published"
+
+
 class ThreatFacetObject(str, Enum):
     """ThreatFacetObject."""
 
@@ -1386,6 +1406,29 @@ class ThreatReport:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class SortByInput:
+    """SortByInput."""
+
+    field_: Optional[Union[SortByFieldInput, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(SortByFieldInput, x),
+            field_name="field",
+        ),
+    )
+    direction: Optional[Union[SortByDirectionInput, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(SortByDirectionInput, x),
+            field_name="direction",
+        ),
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class ThreatIdentityInput:
@@ -1562,6 +1605,13 @@ class ThreatWhereInput:
     report_id_contains: Optional[str] = field(
         default=None, metadata=config(field_name="reportID_contains")
     )
+    report: Optional[str] = field(default=None, metadata=config(field_name="report"))
+    report_contains: Optional[str] = field(
+        default=None, metadata=config(field_name="report_contains")
+    )
+    text_search: Optional[str] = field(
+        default=None, metadata=config(field_name="textSearch")
+    )
     and_: Optional[List["ThreatWhereInput"]] = field(
         default=None, metadata=config(field_name="and")
     )
@@ -1931,6 +1981,9 @@ class ThreatMalware:
     modified: Optional[str] = field(
         default=None, metadata=config(field_name="modified")
     )
+    is_priority_threat: Optional[bool] = field(
+        default=None, metadata=config(field_name="is_priority_threat")
+    )
     family: Optional[str] = field(default=None, metadata=config(field_name="family"))
     aliases: Optional[List[str]] = field(
         default=None, metadata=config(field_name="aliases")

{taegis_sdk_python-1.4.6 → taegis_sdk_python-1.4.8}/taegis_sdk_python/services/trip/mutations.py

@@ -119,3 +119,22 @@ class TaegisSDKTripMutation:
         if result.get(endpoint) is not None:
             return ApiIntegrationUpdateResponse.from_dict(result.get(endpoint))
         raise GraphQLNoRowsInResultSetError("for mutation resumeApiIntegration")
+
+    def retry_api_integration_provisioning(
+        self, id_: int
+    ) -> ApiIntegrationUpdateResponse:
+        """Given a parent integration id, this will retry provisioning all child integrations if they are in a failed state."""
+        endpoint = "retryApiIntegrationProvisioning"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "id": prepare_input(id_),
+            },
+            output=build_output_string(ApiIntegrationUpdateResponse),
+        )
+        if result.get(endpoint) is not None:
+            return ApiIntegrationUpdateResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError(
+            "for mutation retryApiIntegrationProvisioning"
+        )

{taegis_sdk_python-1.4.6 → taegis_sdk_python-1.4.8}/taegis_sdk_python/services/users/types.py

@@ -533,6 +533,29 @@ class PartnerRegistrationInput:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class UserIDExchangeDataResponse:
+    """UserIDExchangeDataResponse."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    email: Optional[str] = field(default=None, metadata=config(field_name="email"))
+    given_name: Optional[str] = field(
+        default=None, metadata=config(field_name="given_name")
+    )
+    family_name: Optional[str] = field(
+        default=None, metadata=config(field_name="family_name")
+    )
+    preferred_language: Optional[Union[TDRUsersLanguage, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(TDRUsersLanguage, x),
+            field_name="preferred_language",
+        ),
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class MigrateSSOUsersInput:

{taegis_sdk_python-1.4.6 → taegis_sdk_python-1.4.8/taegis_sdk_python.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.4.6
+Version: 1.4.8
 Summary: Taegis Python SDK
 Home-page: https://github.com/secureworks/taegis-sdk-python
 Author: Secureworks

taegis_sdk_python-1.4.6/taegis_sdk_python/_version.py

@@ -1 +0,0 @@
-__version__ = "v1.4.6"