taegis-sdk-python 1.6.11.1__tar.gz → 1.6.12__tar.gz

{taegis_sdk_python-1.6.11.1 → taegis_sdk_python-1.6.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.6.11.1
+Version: 1.6.12
 Summary: Taegis Python SDK
 Project-URL: Homepage, https://github.com/secureworks/taegis-sdk-python
 Project-URL: Bug Reports, https://github.com/secureworks/taegis-sdk-python/issues

{taegis_sdk_python-1.6.11.1 → taegis_sdk_python-1.6.12}/taegis_sdk_python/_version.py

@@ -1,3 +1,3 @@
 """Version idenitier."""
 
-__version__ = "1.6.11.1"
+__version__ = "1.6.12"

{taegis_sdk_python-1.6.11.1 → taegis_sdk_python-1.6.12}/taegis_sdk_python/services/entity_context/types.py

@@ -110,6 +110,15 @@ class ENTITY_CONTEXT_PROPERTY_COMPARATOR(str, Enum):
     ENDS_WITH = "ENDS_WITH"
 
 
+class EntityContextDataSourceHealthState(str, Enum):
+    """EntityContextDataSourceHealthState."""
+
+    UNKNOWN_HEALTH_STATE = "UNKNOWN_HEALTH_STATE"
+    HEALTHY = "HEALTHY"
+    NO_DATA = "NO_DATA"
+    WARNING = "WARNING"
+
+
 class EntityContextAddToTypeInput(str, Enum):
     """EntityContextAddToTypeInput."""
 
@@ -263,6 +272,26 @@ class ThreatContextURLInfo:
     id: Optional[str] = field(default=None, metadata=config(field_name="id"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EntityContextDataSourceCollector:
+    """EntityContextDataSourceCollector."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EntityContextDataSourceTag:
+    """EntityContextDataSourceTag."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    key: Optional[str] = field(default=None, metadata=config(field_name="key"))
+    value: Optional[str] = field(default=None, metadata=config(field_name="value"))
+    tenant: Optional[str] = field(default=None, metadata=config(field_name="tenant"))
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class EntityContextAssetEndpointGroupV2:
@@ -646,6 +675,37 @@ class EntityContextPivotQLOptions:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EntityContextDataSourceEnrichment:
+    """EntityContextDataSourceEnrichment."""
+
+    source_id: Optional[str] = field(
+        default=None, metadata=config(field_name="sourceId")
+    )
+    last_seen_at: Optional[str] = field(
+        default=None, metadata=config(field_name="lastSeenAt")
+    )
+    service: Optional[str] = field(default=None, metadata=config(field_name="service"))
+    sensor_type: Optional[str] = field(
+        default=None, metadata=config(field_name="sensorType")
+    )
+    collector: Optional[EntityContextDataSourceCollector] = field(
+        default=None, metadata=config(field_name="collector")
+    )
+    tags: Optional[List[EntityContextDataSourceTag]] = field(
+        default=None, metadata=config(field_name="tags")
+    )
+    health: Optional[Union[EntityContextDataSourceHealthState, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(EntityContextDataSourceHealthState, x),
+            field_name="health",
+        ),
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class EntityContextsArguments:
@@ -969,6 +1029,9 @@ class EntityContextEntityEnrichments:
     asset: Optional[EntityContextAssetEnrichment] = field(
         default=None, metadata=config(field_name="asset")
     )
+    data_source: Optional[EntityContextDataSourceEnrichment] = field(
+        default=None, metadata=config(field_name="dataSource")
+    )
     whois: Optional[EntityContextWhoIs] = field(
         default=None, metadata=config(field_name="whois")
     )

{taegis_sdk_python-1.6.11.1 → taegis_sdk_python-1.6.12}/taegis_sdk_python/services/investigations2/types.py

@@ -3289,6 +3289,15 @@ class Case:
     is_created_by_partner: Optional[bool] = field(
         default=None, metadata=config(field_name="isCreatedByPartner")
     )
+    detections_count: Optional[int] = field(
+        default=None, metadata=config(field_name="detectionsCount")
+    )
+    events_count: Optional[int] = field(
+        default=None, metadata=config(field_name="eventsCount")
+    )
+    assets_count: Optional[int] = field(
+        default=None, metadata=config(field_name="assetsCount")
+    )
     type: Optional[CaseType] = field(default=None, metadata=config(field_name="type"))
     primary_status: Optional[CasePrimaryStatus] = field(
         default=None, metadata=config(field_name="primaryStatus")

{taegis_sdk_python-1.6.11.1 → taegis_sdk_python-1.6.12}/taegis_sdk_python/services/process_trees/queries.py

@@ -40,6 +40,7 @@ class TaegisSDKProcessTreesQuery:
         resource_id: Optional[str] = None,
         order_by_input: Optional[List[OrderByInput]] = None,
         next_token: Optional[str] = None,
+        page_size: Optional[int] = None,
     ) -> Children:
         """None."""
         endpoint = "processChildren"
@@ -53,6 +54,7 @@ class TaegisSDKProcessTreesQuery:
                 "resourceID": prepare_input(resource_id),
                 "orderByInput": prepare_input(order_by_input),
                 "nextToken": prepare_input(next_token),
+                "pageSize": prepare_input(page_size),
             },
             output=build_output_string(
                 Children,

{taegis_sdk_python-1.6.11.1 → taegis_sdk_python-1.6.12}/taegis_sdk_python/services/rules/types.py

@@ -43,6 +43,7 @@ class RuleEventType(str, Enum):
     TAEGIS_AGENT_DETECTION = "taegis_agent_detection"
     DETECTION_FINDING = "detection_finding"
     TECHNIQUE_FINDING = "technique_finding"
+    IAM_ANALYSIS_FINDING = "iam_analysis_finding"
     MULTI_EVENT = "multi_event"
 
 
@@ -70,6 +71,7 @@ class RuleType(str, Enum):
     REDQL = "REDQL"
     QL = "QL"
     DWL = "DWL"
+    DETECTOR = "DETECTOR"
 
 
 class RuleAction(str, Enum):
@@ -327,7 +329,17 @@ class SearchRulesInput:
         default=None, metadata=config(field_name="attackTechniqueIds")
     )
     rule_types: Optional[str] = field(
-        default=None, metadata=config(field_name="ruleTypes")
+        default=None,
+        metadata=config(
+            metadata={
+                "deprecated": True,
+                "deprecation_reason": "Use ruleSource instead. ruleTypes will be removed in a future release.",
+            },
+            field_name="ruleTypes",
+        ),
+    )
+    rule_sources: Optional[str] = field(
+        default=None, metadata=config(field_name="ruleSources")
     )
 
 
@@ -381,7 +393,17 @@ class RuleFacetAggregationsInput:
         default=None, metadata=config(field_name="attackTechniqueIds")
     )
     rule_types: Optional[str] = field(
-        default=None, metadata=config(field_name="ruleTypes")
+        default=None,
+        metadata=config(
+            metadata={
+                "deprecated": True,
+                "deprecation_reason": "Use ruleSource instead. ruleTypes will be removed in a future release.",
+            },
+            field_name="ruleTypes",
+        ),
+    )
+    rule_sources: Optional[str] = field(
+        default=None, metadata=config(field_name="ruleSources")
     )
 
 
@@ -962,6 +984,9 @@ class Rule:
     attack_categories: Optional[List[str]] = field(
         default=None, metadata=config(field_name="attackCategories")
     )
+    attack_tactics: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="attackTactics")
+    )
     deleted: Optional[bool] = field(default=None, metadata=config(field_name="deleted"))
     created_at: Optional[str] = field(
         default=None, metadata=config(field_name="createdAt")

{taegis_sdk_python-1.6.11.1 → taegis_sdk_python-1.6.12}/taegis_sdk_python/services/users/types.py

@@ -985,6 +985,9 @@ class TDRUser:
     managed_by_central: Optional[bool] = field(
         default=None, metadata=config(field_name="managed_by_central")
     )
+    is_sophos_mdr: Optional[bool] = field(
+        default=None, metadata=config(field_name="is_sophos_mdr")
+    )
     tenants: Optional[List[TDRUserTenant]] = field(
         default=None,
         metadata=config(