taegis-sdk-python 1.6.10__tar.gz → 1.6.12__tar.gz

{taegis_sdk_python-1.6.10 → taegis_sdk_python-1.6.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.6.10
+Version: 1.6.12
 Summary: Taegis Python SDK
 Project-URL: Homepage, https://github.com/secureworks/taegis-sdk-python
 Project-URL: Bug Reports, https://github.com/secureworks/taegis-sdk-python/issues

{taegis_sdk_python-1.6.10 → taegis_sdk_python-1.6.12}/taegis_sdk_python/_version.py

@@ -1,3 +1,3 @@
 """Version idenitier."""
 
-__version__ = "1.6.10"
+__version__ = "1.6.12"

{taegis_sdk_python-1.6.10 → taegis_sdk_python-1.6.12}/taegis_sdk_python/services/alerts_history/types.py

@@ -923,6 +923,9 @@ class EntityFileSnapshot:
     hash_sha512: Optional[str] = field(
         default=None, metadata=config(field_name="hash_sha512")
     )
+    email_message_id: Optional[str] = field(
+        default=None, metadata=config(field_name="email_message_id")
+    )
 
 
 @dataclass_json
@@ -984,6 +987,9 @@ class EntityHostSnapshot:
     sensor_type: Optional[str] = field(
         default=None, metadata=config(field_name="sensor_type")
     )
+    system_type: Optional[str] = field(
+        default=None, metadata=config(field_name="system_type")
+    )
     vendor_agent_device_id: Optional[str] = field(
         default=None, metadata=config(field_name="vendor_agent_device_id")
     )
@@ -1032,6 +1038,9 @@ class EntityIpAddressSnapshot:
     ip_geo_country_geoname_id: Optional[int] = field(
         default=None, metadata=config(field_name="ip_geo_country_geoname_id")
     )
+    ip_geo_hash: Optional[str] = field(
+        default=None, metadata=config(field_name="ip_geo_hash")
+    )
     ip_geo_latitude: Optional[float] = field(
         default=None, metadata=config(field_name="ip_geo_latitude")
     )
@@ -1222,6 +1231,9 @@ class EntityUserSnapshot:
     user_is_admin: Optional[bool] = field(
         default=None, metadata=config(field_name="user_is_admin")
     )
+    identity_types_csv: Optional[str] = field(
+        default=None, metadata=config(field_name="identity_types_csv")
+    )
 
 
 @dataclass_json
@@ -1992,6 +2004,7 @@ class StructuredEntitySnapshot:
     identifiers: Optional[List[str]] = field(
         default=None, metadata=config(field_name="identifiers")
     )
+    subtype: Optional[str] = field(default=None, metadata=config(field_name="subtype"))
     perspective: Optional[Union[EntityPerspective, TaegisEnum]] = field(
         default=None,
         metadata=config(

{taegis_sdk_python-1.6.10 → taegis_sdk_python-1.6.12}/taegis_sdk_python/services/authz/types.py

@@ -57,6 +57,7 @@ class AuthzSubjectIDType(str, Enum):
 
     TAEGIS = "TAEGIS"
     CENTRAL = "CENTRAL"
+    UNKNOWN = "UNKNOWN"
 
 
 @dataclass_json

{taegis_sdk_python-1.6.10 → taegis_sdk_python-1.6.12}/taegis_sdk_python/services/collector/mutations.py

@@ -514,3 +514,24 @@ class TaegisSDKCollectorMutation:
         if result.get(endpoint) is not None:
             return Service.from_dict(result.get(endpoint))
         raise GraphQLNoRowsInResultSetError("for mutation createService")
+
+    def update_cluster_network(
+        self, cluster_id: str, update_network_input: UpdateNetworkInput
+    ) -> Network:
+        """Update the Network config of a given cluster when its in provisioning state."""
+        endpoint = "updateClusterNetwork"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "clusterID": prepare_input(cluster_id),
+                "updateNetworkInput": prepare_input(update_network_input),
+            },
+            output=build_output_string(
+                Network,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return Network.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for mutation updateClusterNetwork")

{taegis_sdk_python-1.6.10 → taegis_sdk_python-1.6.12}/taegis_sdk_python/services/collector/types.py

@@ -317,6 +317,23 @@ class Network:
     proxy: Optional[str] = field(default=None, metadata=config(field_name="proxy"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class UpdateNetworkInput:
+    """UpdateNetworkInput."""
+
+    dhcp: Optional[bool] = field(default=None, metadata=config(field_name="dhcp"))
+    hostname: Optional[str] = field(
+        default=None, metadata=config(field_name="hostname")
+    )
+    address: Optional[str] = field(default=None, metadata=config(field_name="address"))
+    mask: Optional[str] = field(default=None, metadata=config(field_name="mask"))
+    gateway: Optional[str] = field(default=None, metadata=config(field_name="gateway"))
+    dns: Optional[List[str]] = field(default=None, metadata=config(field_name="dns"))
+    ntp: Optional[List[str]] = field(default=None, metadata=config(field_name="ntp"))
+    proxy: Optional[str] = field(default=None, metadata=config(field_name="proxy"))
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class HostsInput:

{taegis_sdk_python-1.6.10 → taegis_sdk_python-1.6.12}/taegis_sdk_python/services/entity_context/types.py

@@ -110,6 +110,15 @@ class ENTITY_CONTEXT_PROPERTY_COMPARATOR(str, Enum):
     ENDS_WITH = "ENDS_WITH"
 
 
+class EntityContextDataSourceHealthState(str, Enum):
+    """EntityContextDataSourceHealthState."""
+
+    UNKNOWN_HEALTH_STATE = "UNKNOWN_HEALTH_STATE"
+    HEALTHY = "HEALTHY"
+    NO_DATA = "NO_DATA"
+    WARNING = "WARNING"
+
+
 class EntityContextAddToTypeInput(str, Enum):
     """EntityContextAddToTypeInput."""
 
@@ -263,6 +272,26 @@ class ThreatContextURLInfo:
     id: Optional[str] = field(default=None, metadata=config(field_name="id"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EntityContextDataSourceCollector:
+    """EntityContextDataSourceCollector."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EntityContextDataSourceTag:
+    """EntityContextDataSourceTag."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    key: Optional[str] = field(default=None, metadata=config(field_name="key"))
+    value: Optional[str] = field(default=None, metadata=config(field_name="value"))
+    tenant: Optional[str] = field(default=None, metadata=config(field_name="tenant"))
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class EntityContextAssetEndpointGroupV2:
@@ -646,6 +675,37 @@ class EntityContextPivotQLOptions:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EntityContextDataSourceEnrichment:
+    """EntityContextDataSourceEnrichment."""
+
+    source_id: Optional[str] = field(
+        default=None, metadata=config(field_name="sourceId")
+    )
+    last_seen_at: Optional[str] = field(
+        default=None, metadata=config(field_name="lastSeenAt")
+    )
+    service: Optional[str] = field(default=None, metadata=config(field_name="service"))
+    sensor_type: Optional[str] = field(
+        default=None, metadata=config(field_name="sensorType")
+    )
+    collector: Optional[EntityContextDataSourceCollector] = field(
+        default=None, metadata=config(field_name="collector")
+    )
+    tags: Optional[List[EntityContextDataSourceTag]] = field(
+        default=None, metadata=config(field_name="tags")
+    )
+    health: Optional[Union[EntityContextDataSourceHealthState, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(EntityContextDataSourceHealthState, x),
+            field_name="health",
+        ),
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class EntityContextsArguments:
@@ -969,6 +1029,9 @@ class EntityContextEntityEnrichments:
     asset: Optional[EntityContextAssetEnrichment] = field(
         default=None, metadata=config(field_name="asset")
     )
+    data_source: Optional[EntityContextDataSourceEnrichment] = field(
+        default=None, metadata=config(field_name="dataSource")
+    )
     whois: Optional[EntityContextWhoIs] = field(
         default=None, metadata=config(field_name="whois")
     )

{taegis_sdk_python-1.6.10 → taegis_sdk_python-1.6.12}/taegis_sdk_python/services/investigations2/mutations.py

@@ -127,34 +127,6 @@ class TaegisSDKInvestigations2Mutation:
             return RemoveEvidenceFromCaseResult.from_dict(result.get(endpoint))
         raise GraphQLNoRowsInResultSetError("for mutation removeEvidenceFromCase")
 
-    def close_case(self, input_: CloseCaseInput) -> Case:
-        """closeCase will close an existing case.
-        If the case has detections attached to it, the detectionsResolutionStatus field is required and detections will be resolved based on the provided status.
-        Once a case is closed, it can no longer be edited or have evidence added to it while in the closed state, it can only be archived.
-        A closed case can be reopened if changes are needed after closing.
-
-        Resolving evidence in a case is an asynchronous operation.
-        It will typically finish pretty quickly, but resolving detections will may not reflect the updated status until the async job is fully complete.
-        The processing status, that is found on the case type will reflect the state of the processing job.
-        Once the status is set to 'SUCCESS' the background job is complete and the detections will have been updated.
-
-        Adding, removing or updating evidence (closing a case) while other jobs are processing for a given case will cause the jobs to queue.
-        Jobs will be worked through in the order they were received.."""
-        endpoint = "closeCase"
-
-        result = self.service.execute_mutation(
-            endpoint=endpoint,
-            variables={
-                "input": prepare_input(input_),
-            },
-            output=build_output_string(
-                Case, exclude_deprecated_output=self.service.exclude_deprecated_output
-            ),
-        )
-        if result.get(endpoint) is not None:
-            return Case.from_dict(result.get(endpoint))
-        raise GraphQLNoRowsInResultSetError("for mutation closeCase")
-
     def create_case_rule(self, input_: CreateCaseRuleInput) -> CaseRule:
         """createCaseRule accepts input to create a new auto-case rule.."""
         endpoint = "createCaseRule"
@@ -265,28 +237,6 @@ class TaegisSDKInvestigations2Mutation:
             return CaseTemplate.from_dict(result.get(endpoint))
         raise GraphQLNoRowsInResultSetError("for mutation deleteCaseTemplate")
 
-    def import_case_resources(
-        self, input_: ImportCaseResourcesInput
-    ) -> List[CaseResource]:
-        """importCaseResources will import case resources (rules & templates) from a YAML file.
-        The input YAML structure can be retrieved from a YAML string exported from the exportCaseResources query..
-        """
-        endpoint = "importCaseResources"
-
-        result = self.service.execute_mutation(
-            endpoint=endpoint,
-            variables={
-                "input": prepare_input(input_),
-            },
-            output=build_output_string(
-                CaseResource,
-                exclude_deprecated_output=self.service.exclude_deprecated_output,
-            ),
-        )
-        if result.get(endpoint) is not None:
-            return [parse_union_result(CaseResource, r) for r in result.get(endpoint)]
-        raise GraphQLNoRowsInResultSetError("for mutation importCaseResources")
-
     def add_case_comment(self, input_: AddCaseComment) -> CaseComment:
         """addCaseComment adds a comment to an existing case.."""
         endpoint = "addCaseComment"
@@ -346,84 +296,6 @@ class TaegisSDKInvestigations2Mutation:
             return CaseComment.from_dict(result.get(endpoint))
         raise GraphQLNoRowsInResultSetError("for mutation deleteCaseComment")
 
-    def archive_case(self, input_: ArchiveCaseInput) -> Case:
-        """archiveCase archives an existing case.
-        Only cases that are closed can be archived.
-        There may be some cases that are archived but not in closed states, these are legacy cases that were archived before the closed requirement was introduced..
-        """
-        endpoint = "archiveCase"
-
-        result = self.service.execute_mutation(
-            endpoint=endpoint,
-            variables={
-                "input": prepare_input(input_),
-            },
-            output=build_output_string(
-                Case, exclude_deprecated_output=self.service.exclude_deprecated_output
-            ),
-        )
-        if result.get(endpoint) is not None:
-            return Case.from_dict(result.get(endpoint))
-        raise GraphQLNoRowsInResultSetError("for mutation archiveCase")
-
-    def unarchive_case(self, input_: UnarchiveCaseInput) -> Case:
-        """unarchiveCase unarchives an archived case.."""
-        endpoint = "unarchiveCase"
-
-        result = self.service.execute_mutation(
-            endpoint=endpoint,
-            variables={
-                "input": prepare_input(input_),
-            },
-            output=build_output_string(
-                Case, exclude_deprecated_output=self.service.exclude_deprecated_output
-            ),
-        )
-        if result.get(endpoint) is not None:
-            return Case.from_dict(result.get(endpoint))
-        raise GraphQLNoRowsInResultSetError("for mutation unarchiveCase")
-
-    def archive_cases(self, input_: ArchiveCasesInput) -> ArchivedCases:
-        """archiveCases archives a set of existing cases.
-        Only cases that are closed can be archived.
-        The response will include the ids of the cases that were successfully archived and will not return errors for cases that could not be archived..
-        """
-        endpoint = "archiveCases"
-
-        result = self.service.execute_mutation(
-            endpoint=endpoint,
-            variables={
-                "input": prepare_input(input_),
-            },
-            output=build_output_string(
-                ArchivedCases,
-                exclude_deprecated_output=self.service.exclude_deprecated_output,
-            ),
-        )
-        if result.get(endpoint) is not None:
-            return ArchivedCases.from_dict(result.get(endpoint))
-        raise GraphQLNoRowsInResultSetError("for mutation archiveCases")
-
-    def unarchive_cases(self, input_: UnarchiveCasesInput) -> UnarchivedCases:
-        """unarchiveCases unarchives a set of archived cases.
-        The response will include the ids of the cases that were successfully unarchived and will not return errors for cases that could not be unarchived..
-        """
-        endpoint = "unarchiveCases"
-
-        result = self.service.execute_mutation(
-            endpoint=endpoint,
-            variables={
-                "input": prepare_input(input_),
-            },
-            output=build_output_string(
-                UnarchivedCases,
-                exclude_deprecated_output=self.service.exclude_deprecated_output,
-            ),
-        )
-        if result.get(endpoint) is not None:
-            return UnarchivedCases.from_dict(result.get(endpoint))
-        raise GraphQLNoRowsInResultSetError("for mutation unarchiveCases")
-
     def start_case_file_upload(
         self, input_: StartCaseFileUploadInput
     ) -> CaseFileUpload:

{taegis_sdk_python-1.6.10 → taegis_sdk_python-1.6.12}/taegis_sdk_python/services/investigations2/queries.py

@@ -156,28 +156,6 @@ class TaegisSDKInvestigations2Query:
             return CaseTemplates.from_dict(result.get(endpoint))
         raise GraphQLNoRowsInResultSetError("for query caseTemplates")
 
-    def export_case_resources(
-        self, arguments: ExportCaseResourcesArguments
-    ) -> CaseResourceExport:
-        """exportCaseResources returns a YAML string representation for auto-case resources (rules & templates).
-        The returned string can be saved into a file and imported back into the system using importCaseResources..
-        """
-        endpoint = "exportCaseResources"
-
-        result = self.service.execute_query(
-            endpoint=endpoint,
-            variables={
-                "arguments": prepare_input(arguments),
-            },
-            output=build_output_string(
-                CaseResourceExport,
-                exclude_deprecated_output=self.service.exclude_deprecated_output,
-            ),
-        )
-        if result.get(endpoint) is not None:
-            return CaseResourceExport.from_dict(result.get(endpoint))
-        raise GraphQLNoRowsInResultSetError("for query exportCaseResources")
-
     def case_comments(self, arguments: CaseCommentsArguments) -> CaseComments:
         """comments returns all the comments for a case."""
         endpoint = "caseComments"
@@ -295,30 +273,6 @@ class TaegisSDKInvestigations2Query:
             return CaseFiles.from_dict(result.get(endpoint))
         raise GraphQLNoRowsInResultSetError("for query caseFiles")
 
-    def cases_aggregation(
-        self, arguments: CasesAggregationArguments
-    ) -> CasesAggregation:
-        """casesAggregation allows aggregating data for cases.
-        It cannot be used to fetch individual cases or lists of cases, only aggregate data.
-        It should not be used by external clients and should only be called from the Taegis UI.
-        Use of this endpoint is discouraged as it may be changed at any time without notice..
-        """
-        endpoint = "casesAggregation"
-
-        result = self.service.execute_query(
-            endpoint=endpoint,
-            variables={
-                "arguments": prepare_input(arguments),
-            },
-            output=build_output_string(
-                CasesAggregation,
-                exclude_deprecated_output=self.service.exclude_deprecated_output,
-            ),
-        )
-        if result.get(endpoint) is not None:
-            return CasesAggregation.from_dict(result.get(endpoint))
-        raise GraphQLNoRowsInResultSetError("for query casesAggregation")
-
     def cases_is_key_findings_rich_text(self, id_: str) -> bool:
         """DO NOT USE: casesIsKeyFindingsRichText is meant for the Taegis/Central UIs only. It may be removed at any time without notice."""
         endpoint = "casesIsKeyFindingsRichText"