taegis-sdk-python 1.5.2__tar.gz → 1.5.4__tar.gz

{taegis_sdk_python-1.5.2 → taegis_sdk_python-1.5.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.5.2
+Version: 1.5.4
 Summary: Taegis Python SDK
 Project-URL: Homepage, https://github.com/secureworks/taegis-sdk-python
 Project-URL: Bug Reports, https://github.com/secureworks/taegis-sdk-python/issues

{taegis_sdk_python-1.5.2 → taegis_sdk_python-1.5.4}/taegis_sdk_python/_version.py

@@ -1,3 +1,3 @@
 """Version idenitier."""
 
-__version__ = "1.5.2"
+__version__ = "1.5.4"

{taegis_sdk_python-1.5.2 → taegis_sdk_python-1.5.4}/taegis_sdk_python/services/alerts/types.py

@@ -862,6 +862,9 @@ class EntityFile:
     hash_sha512: Optional[str] = field(
         default=None, metadata=config(field_name="hash_sha512")
     )
+    email_message_id: Optional[str] = field(
+        default=None, metadata=config(field_name="email_message_id")
+    )
 
 
 @dataclass_json

{taegis_sdk_python-1.5.2 → taegis_sdk_python-1.5.4}/taegis_sdk_python/services/alerts_history/types.py

@@ -914,6 +914,18 @@ class EntityFileSnapshot:
     file_type_detected: Optional[str] = field(
         default=None, metadata=config(field_name="file_type_detected")
     )
+    hash_md5: Optional[str] = field(
+        default=None, metadata=config(field_name="hash_md5")
+    )
+    hash_sha1: Optional[str] = field(
+        default=None, metadata=config(field_name="hash_sha1")
+    )
+    hash_sha256: Optional[str] = field(
+        default=None, metadata=config(field_name="hash_sha256")
+    )
+    hash_sha512: Optional[str] = field(
+        default=None, metadata=config(field_name="hash_sha512")
+    )
 
 
 @dataclass_json
@@ -1061,6 +1073,18 @@ class EntityProcessSnapshot:
     process_is_admin: Optional[bool] = field(
         default=None, metadata=config(field_name="process_is_admin")
     )
+    hash_md5: Optional[str] = field(
+        default=None, metadata=config(field_name="hash_md5")
+    )
+    hash_sha1: Optional[str] = field(
+        default=None, metadata=config(field_name="hash_sha1")
+    )
+    hash_sha256: Optional[str] = field(
+        default=None, metadata=config(field_name="hash_sha256")
+    )
+    hash_sha512: Optional[str] = field(
+        default=None, metadata=config(field_name="hash_sha512")
+    )
 
 
 @dataclass_json

{taegis_sdk_python-1.5.2 → taegis_sdk_python-1.5.4}/taegis_sdk_python/services/assets2/types.py

@@ -1253,9 +1253,6 @@ class AssetWhereInputV2:
     reboot_required: Optional[bool] = field(
         default=None, metadata=config(field_name="rebootRequired")
     )
-    agent_mode: Optional[str] = field(
-        default=None, metadata=config(field_name="agentMode")
-    )
     and_: Optional[List["AssetWhereInputV2"]] = field(
         default=None, metadata=config(field_name="and")
     )
@@ -1417,9 +1414,6 @@ class AssetV2:
     reboot_required: Optional[bool] = field(
         default=None, metadata=config(field_name="rebootRequired")
     )
-    agent_mode: Optional[str] = field(
-        default=None, metadata=config(field_name="agentMode")
-    )
     hostnames: Optional[List[HostnameV2]] = field(
         default=None, metadata=config(field_name="hostnames")
     )

{taegis_sdk_python-1.5.2 → taegis_sdk_python-1.5.4}/taegis_sdk_python/services/threat/queries.py

@@ -408,7 +408,10 @@ class TaegisSDKThreatQuery:
         raise GraphQLNoRowsInResultSetError("for query threatFacetInfo")
 
     def threat_associated_indicators(
-        self, id_: str, page: Optional[ThreatPageInput] = None
+        self,
+        id_: str,
+        filters: Optional[IndicatorFilter] = None,
+        page: Optional[ThreatPageInput] = None,
     ) -> List[ThreatIndicator]:
         """Retrives all associated indicators to a malware or threat_group."""
         endpoint = "threatAssociatedIndicators"
@@ -417,6 +420,7 @@ class TaegisSDKThreatQuery:
             endpoint=endpoint,
             variables={
                 "ID": prepare_input(id_),
+                "filters": prepare_input(filters),
                 "page": prepare_input(page),
             },
             output=build_output_string(ThreatIndicator),

{taegis_sdk_python-1.5.2 → taegis_sdk_python-1.5.4}/taegis_sdk_python/services/threat/types.py

@@ -39,6 +39,9 @@ class SortByFieldInput(str, Enum):
 
     MALWARE_FAMILY = "malware_family"
     MALWARE_LAST_SEEN = "malware_last_seen"
+    MALWARE_ADDED_DATE = "malware_added_date"
+    MALWARE_LAST_UPDATED = "malware_last_updated"
+    MALWARE_FIRST_DISCOVERED = "malware_first_discovered"
     MALWARE_TYPE = "malware_type"
     THREAT_GROUP_NAME = "threat_group_name"
     THREAT_GROUP_THEMATIC_AREA = "threat_group_thematic_area"
@@ -1450,6 +1453,24 @@ class ThreatReport:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class IndicatorWhereInput:
+    """IndicatorWhereInput."""
+
+    or_: Optional[List["IndicatorWhereInput"]] = field(
+        default=None, metadata=config(field_name="or")
+    )
+    indicator_type: Optional[Union[ThreatIndicatorClass, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(ThreatIndicatorClass, x),
+            field_name="indicatorType",
+        ),
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class SortByInput:
@@ -2263,6 +2284,16 @@ class ThreatFilter:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class IndicatorFilter:
+    """IndicatorFilter."""
+
+    where: Optional[IndicatorWhereInput] = field(
+        default=None, metadata=config(field_name="where")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class ThreatIdentityRelationship:

{taegis_sdk_python-1.5.2 → taegis_sdk_python-1.5.4}/taegis_sdk_python/utils.py

@@ -255,7 +255,7 @@ def async_block(coro: Callable):
     return wrapper
 
 
-def prepare_input(value: Any) -> Any:
+def prepare_input(value: Any) -> Any: # pylint: disable=too-many-return-statements
     """Prepare input objects for submitting to GraphQL.
 
     Parameters
@@ -269,6 +269,7 @@ def prepare_input(value: Any) -> Any:
         _description_
     """
     if is_dataclass(value):
+        log.debug("Value is dataclass...")
         for field in dc_fields(value):
             letter_case = field.metadata.get("dataclasses_json", {}).get("letter_case")
             if letter_case:
@@ -284,12 +285,13 @@ def prepare_input(value: Any) -> Any:
 
         # return Dict[str. Any] where Any is not None
         return {
-            key: value
-            for key, value in value.to_dict(encode_json=True).items()
-            if value is not None and not value == TaegisEnum.UNKNOWN.value
+            key: prepare_input(val)
+            for key, val in value.to_dict(encode_json=True).items()
+            if val is not None and not val == TaegisEnum.UNKNOWN.value
         }
     # return value of Enum instead of the object
     if isinstance(value, Enum):
+        log.debug("Value is Enum...")
         if value is TaegisEnum.UNKNOWN:
             log.error(
                 "Input is of value TaegisEnum.UNKNOWN, "
@@ -298,9 +300,20 @@ def prepare_input(value: Any) -> Any:
             )
             return None
         return value.value
+
     if isinstance(value, list):
+        log.debug("Value is List...")
         return [prepare_input(item) for item in value]
 
+    if isinstance(value, dict):
+        log.debug("Value is Dict...")
+        # return Dict[str. Any] where Any is not None
+        return {
+            key: prepare_input(val)
+            for key, val in value.items()
+            if val is not None and not val == TaegisEnum.UNKNOWN.value
+        }
+
     if value == TaegisEnum.UNKNOWN.value:
         log.error(
             "Input is of value TaegisEnum.UNKNOWN, "
@@ -309,6 +322,7 @@ def prepare_input(value: Any) -> Any:
         )
         return None
 
+    log.debug(f"Value is other type({type(value)})...")
     return value