taegis-sdk-python 1.6.13__tar.gz → 1.6.15__tar.gz

{taegis_sdk_python-1.6.13 → taegis_sdk_python-1.6.15}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.6.13
+Version: 1.6.15
 Summary: Taegis Python SDK
 Project-URL: Homepage, https://github.com/secureworks/taegis-sdk-python
 Project-URL: Bug Reports, https://github.com/secureworks/taegis-sdk-python/issues

{taegis_sdk_python-1.6.13 → taegis_sdk_python-1.6.15}/taegis_sdk_python/_version.py

@@ -1,3 +1,3 @@
 """Version idenitier."""
 
-__version__ = "1.6.13"
+__version__ = "1.6.15"

taegis_sdk_python-1.6.15/taegis_sdk_python/middlewares/curl/_default.py

@@ -0,0 +1,60 @@
+"""Logs a curl command representation that makes the same HTTP request as the provided request"""
+
+import logging
+from shlex import quote
+
+from aiohttp import (
+    BytesPayload,
+    ClientHandlerType,
+    ClientRequest,
+    ClientResponse,
+)
+
+from taegis_sdk_python.middlewares.utils import scrub_dict
+
+log = logging.getLogger(__name__)
+
+
+async def to_curl(request: ClientRequest, handler: ClientHandlerType) -> ClientResponse:
+    """
+    Logs a curl command representation that makes the same HTTP request as
+    the provided request object.
+    """
+    command = []
+
+    inferred_method = "GET"
+    if request.body is not None:
+        inferred_method = "POST"
+    if request.method != inferred_method:
+        command.append("-X " + quote(request.method))
+
+    headers = scrub_dict(request.headers)
+
+    for k, v in headers.items():
+        if v:
+            command.append("-H " + quote(f"{k}: {v}"))
+        else:
+            # -H 'Accept:' disables sending the Accept header, use semicolon to send
+            # empty header
+            command.append("-H " + quote(f"{k};"))
+
+    if body := request.body:
+        if isinstance(body, (bytes, BytesPayload)):
+            body = body.decode("utf-8")
+        else:
+            log.error(f"Unsupported body type for curl middleware: {type(body)}, request.body must be bytes or BytesPayload")
+            return await handler(request)
+
+        data_type = "-d"
+        if body.startswith("@"):  # -d @filename causes curl to read from file
+            data_type = "--data-raw"
+        command.append(data_type + " " + quote(body))
+
+    command.append(quote(str(request.url)))
+
+    joiner = " "
+    if len(command) > 3:
+        joiner = " \\\n  "
+    log.info(f"curl {joiner.join(command)}")
+
+    return await handler(request)

{taegis_sdk_python-1.6.13 → taegis_sdk_python-1.6.15}/taegis_sdk_python/services/alerts/mutations.py

@@ -165,3 +165,109 @@ class TaegisSDKAlertsMutation:
         raise GraphQLNoRowsInResultSetError(
             "for mutation alertsServiceUpdateThreatScoreV2"
         )
+
+    def detection_update_investigation_info(
+        self, in_: Optional[UpdateInvestigationRequestInput] = None
+    ) -> UpdateInvestigationResponse:
+        """No developer notes."""
+        endpoint = "detectionUpdateInvestigationInfo"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                UpdateInvestigationResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return UpdateInvestigationResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError(
+            "for mutation detectionUpdateInvestigationInfo"
+        )
+
+    def detection_update_resolution_info(
+        self, in_: Optional[UpdateResolutionRequestInput] = None
+    ) -> UpdateResolutionResponse:
+        """Add a resolution or modify an existing resolution for a give list of alert IDs."""
+        endpoint = "detectionUpdateResolutionInfo"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                UpdateResolutionResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return UpdateResolutionResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError(
+            "for mutation detectionUpdateResolutionInfo"
+        )
+
+    def detection_bulk_investigations_processor(
+        self, in_: Optional[BulkInvestigationsRequestInput] = None
+    ) -> BulkInvestigationsResponse:
+        """Bulk add alerts to an existing investigation by providing either a query or list of alert IDs. If a query is provided, then all alerts matching the query will be added to the investigation."""
+        endpoint = "detectionBulkInvestigationsProcessor"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                BulkInvestigationsResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return BulkInvestigationsResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError(
+            "for mutation detectionBulkInvestigationsProcessor"
+        )
+
+    def detection_update_threat_score(
+        self, in_: UpdateThreatScoreRequestInput
+    ) -> UpdateThreatScoreResponse:
+        """Update threat score for a given list of alert IDs."""
+        endpoint = "detectionUpdateThreatScore"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                UpdateThreatScoreResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return UpdateThreatScoreResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for mutation detectionUpdateThreatScore")
+
+    def detection_update_threat_score_v2(
+        self, in_: UpdateThreatScoreV2RequestInput
+    ) -> UpdateThreatScoreResponse:
+        """Update threat score v2 for a given list of alert IDs."""
+        endpoint = "detectionUpdateThreatScoreV2"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                UpdateThreatScoreResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return UpdateThreatScoreResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for mutation detectionUpdateThreatScoreV2")

{taegis_sdk_python-1.6.13 → taegis_sdk_python-1.6.15}/taegis_sdk_python/services/alerts/queries.py

@@ -199,3 +199,161 @@ class TaegisSDKAlertsQuery:
         raise GraphQLNoRowsInResultSetError(
             "for query alertsServiceAggregateAlertsBySeverity"
         )
+
+    def detection_retrieve_by_id(
+        self, in_: Optional[GetByIDRequestInput] = None
+    ) -> AlertsResponse:
+        """Provide a list of Alert IDs to retrieve each alert's detail."""
+        endpoint = "detectionRetrieveById"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                AlertsResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detectionRetrieveById")
+
+    def detection_retrieve_by_host(
+        self, in_: Optional[GetByIDRequestInput] = None
+    ) -> AlertsResponse:
+        """Provide a list of Host IDs to retrieve alert details about each alert that contains those hosts."""
+        endpoint = "detectionRetrieveByHost"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                AlertsResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detectionRetrieveByHost")
+
+    def detection_retrieve_by_entity(
+        self, in_: Optional[GetByIDRequestInput] = None
+    ) -> AlertsResponse:
+        """Provide a list of entities to retrieve alert details about each alert that contains those entities."""
+        endpoint = "detectionRetrieveByEntity"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                AlertsResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detectionRetrieveByEntity")
+
+    def detection_retrieve_by_group_key(
+        self, in_: Optional[GetByIDRequestInput] = None
+    ) -> AlertsResponse:
+        """Provide a list of entities to retrieve alert details about each alert that contains the group_key. This is used by the service to aid in alert deduplication. This would not commonly be used by a tenant of XDR."""
+        endpoint = "detectionRetrieveByGroupKey"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                AlertsResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detectionRetrieveByGroupKey")
+
+    def detection_count_by_tenant(
+        self, in_: AlertsCountByTenantInput
+    ) -> AlertsCountByTenantResponse:
+        """Returns the count of alerts per tenant. Allows a CQL query, but any aggregation or pipe will be ignored."""
+        endpoint = "detectionCountByTenant"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                AlertsCountByTenantResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsCountByTenantResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detectionCountByTenant")
+
+    def detection_search(
+        self, in_: Optional[SearchRequestInput] = None
+    ) -> AlertsResponse:
+        """Search alerts using Query Language. This is the same query language provided in Advanced Search page in Taegis XDR."""
+        endpoint = "detectionSearch"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                AlertsResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detectionSearch")
+
+    def detection_poll(self, in_: Optional[PollRequestInput] = None) -> AlertsResponse:
+        """Poll for results for a specific `search_id`."""
+        endpoint = "detectionPoll"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                AlertsResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detectionPoll")
+
+    def detection_aggregates_by_severity(
+        self, in_: Optional[AggregateAlertsBySeverityInputInput] = None
+    ) -> AlertsAggregateResponse:
+        """Pull alert severity aggregates based on `group_by` parameters: domain, watchlist, hostname, detector, user."""
+        endpoint = "detectionAggregatesBySeverity"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                AlertsAggregateResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsAggregateResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detectionAggregatesBySeverity")

{taegis_sdk_python-1.6.13 → taegis_sdk_python-1.6.15}/taegis_sdk_python/services/alerts/subscriptions.py

@@ -55,3 +55,27 @@ class TaegisSDKAlertsSubscription:
         raise GraphQLNoRowsInResultSetError(
             "for subscription alertsServiceBulkResolutionProcessor"
         )
+
+    def detection_bulk_resolution_processor(
+        self, in_: Optional[BulkResolutionRequestInput] = None
+    ) -> List[BulkResolutionResponse]:
+        """Add a resolution or modify an existing resolution for multiple alerts selected with a CQL query."""
+        endpoint = "detectionBulkResolutionProcessor"
+
+        result = self.service.execute_subscription(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                BulkResolutionResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if any(r.get(endpoint) for r in result):
+            return BulkResolutionResponse.schema().load(
+                [r.get(endpoint, {}) or {} for r in result], many=True
+            )
+        raise GraphQLNoRowsInResultSetError(
+            "for subscription detectionBulkResolutionProcessor"
+        )

{taegis_sdk_python-1.6.13 → taegis_sdk_python-1.6.15}/taegis_sdk_python/services/investigations2/types.py

@@ -223,6 +223,25 @@ class CaseLink:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class PageInfo:
+    """PageInfo."""
+
+    start_cursor: Optional[str] = field(
+        default=None, metadata=config(field_name="startCursor")
+    )
+    end_cursor: Optional[str] = field(
+        default=None, metadata=config(field_name="endCursor")
+    )
+    has_next_page: Optional[bool] = field(
+        default=None, metadata=config(field_name="hasNextPage")
+    )
+    has_previous_page: Optional[bool] = field(
+        default=None, metadata=config(field_name="hasPreviousPage")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class AddEvidenceToCaseResult:
@@ -460,6 +479,21 @@ class TDRUser:
     id: Optional[str] = field(default=None, metadata=config(field_name="id"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class IncidentAdvisor:
+    """IncidentAdvisor."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    email: Optional[str] = field(default=None, metadata=config(field_name="email"))
+    given_name: Optional[str] = field(
+        default=None, metadata=config(field_name="givenName")
+    )
+    family_name: Optional[str] = field(
+        default=None, metadata=config(field_name="familyName")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class InvestigationsAggregation:
@@ -881,15 +915,22 @@ class CaseArguments:
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class CasesArguments:
-    """CasesArguments."""
+class OffsetPagination:
+    """OffsetPagination."""
 
-    query: Optional[str] = field(default=None, metadata=config(field_name="query"))
     page: Optional[int] = field(default=None, metadata=config(field_name="page"))
     per_page: Optional[int] = field(default=None, metadata=config(field_name="perPage"))
-    tenant_service_filters: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="tenantServiceFilters")
-    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class CursorPagination:
+    """CursorPagination."""
+
+    first: Optional[int] = field(default=None, metadata=config(field_name="first"))
+    after: Optional[str] = field(default=None, metadata=config(field_name="after"))
+    last: Optional[int] = field(default=None, metadata=config(field_name="last"))
+    before: Optional[str] = field(default=None, metadata=config(field_name="before"))
 
 
 @dataclass_json
@@ -939,6 +980,7 @@ class CasePrimaryStatusesArguments:
     transition_from_id: Optional[str] = field(
         default=None, metadata=config(field_name="transitionFromId")
     )
+    case_id: Optional[str] = field(default=None, metadata=config(field_name="caseId"))
 
 
 @dataclass_json
@@ -2061,8 +2103,8 @@ class CreateCaseInput:
     host_ids: Optional[List[str]] = field(
         default=None, metadata=config(field_name="hostIds")
     )
-    incident_advisor: Optional[str] = field(
-        default=None, metadata=config(field_name="incidentAdvisor")
+    incident_advisor_id: Optional[str] = field(
+        default=None, metadata=config(field_name="incidentAdvisorId")
     )
     source_id: Optional[str] = field(
         default=None, metadata=config(field_name="sourceId")
@@ -2114,8 +2156,8 @@ class UpdateCaseInput:
     assignee_id: Optional[str] = field(
         default=None, metadata=config(field_name="assigneeId")
     )
-    incident_advisor: Optional[str] = field(
-        default=None, metadata=config(field_name="incidentAdvisor")
+    incident_advisor_id: Optional[str] = field(
+        default=None, metadata=config(field_name="incidentAdvisorId")
     )
     close_reason: Optional[str] = field(
         default=None, metadata=config(field_name="closeReason")
@@ -2199,6 +2241,19 @@ class UpdateCaseTemplateInput:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class CasesPagination:
+    """CasesPagination."""
+
+    offset: Optional[OffsetPagination] = field(
+        default=None, metadata=config(field_name="offset")
+    )
+    cursor: Optional[CursorPagination] = field(
+        default=None, metadata=config(field_name="cursor")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class CreateCaseRuleInput:
@@ -3487,8 +3542,8 @@ class Case:
         default=None, metadata=config(field_name="riskScore")
     )
     rule_id: Optional[str] = field(default=None, metadata=config(field_name="ruleId"))
-    incident_advisor: Optional[str] = field(
-        default=None, metadata=config(field_name="incidentAdvisor")
+    incident_advisor_id: Optional[str] = field(
+        default=None, metadata=config(field_name="incidentAdvisorId")
     )
     is_created_by_partner: Optional[bool] = field(
         default=None, metadata=config(field_name="isCreatedByPartner")
@@ -3550,6 +3605,9 @@ class Case:
             field_name="managedBy",
         ),
     )
+    incident_advisor: Optional[IncidentAdvisor] = field(
+        default=None, metadata=config(field_name="incidentAdvisor")
+    )
 
 
 @dataclass_json
@@ -3772,19 +3830,6 @@ InvestigationResource = Union[
 ]
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class Cases:
-    """Cases."""
-
-    total_count: Optional[int] = field(
-        default=None, metadata=config(field_name="totalCount")
-    )
-    cases: Optional[List[Case]] = field(
-        default=None, metadata=config(field_name="cases")
-    )
-
-
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class CaseTemplates:
@@ -3943,6 +3988,20 @@ class InvestigationFilesV2:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class CasesArguments:
+    """CasesArguments."""
+
+    query: Optional[str] = field(default=None, metadata=config(field_name="query"))
+    tenant_service_filters: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="tenantServiceFilters")
+    )
+    pagination: Optional[CasesPagination] = field(
+        default=None, metadata=config(field_name="pagination")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class ExportInvestigationResourcesArguments:
@@ -3953,6 +4012,22 @@ class ExportInvestigationResourcesArguments:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class Cases:
+    """Cases."""
+
+    total_count: Optional[int] = field(
+        default=None, metadata=config(field_name="totalCount")
+    )
+    cases: Optional[List[Case]] = field(
+        default=None, metadata=config(field_name="cases")
+    )
+    page_info: Optional[PageInfo] = field(
+        default=None, metadata=config(field_name="pageInfo")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class InvestigationsV2:

{taegis_sdk_python-1.6.13 → taegis_sdk_python-1.6.15}/taegis_sdk_python/services/tenants/mutations.py

@@ -350,7 +350,7 @@ class TaegisSDKTenantsMutation:
         raise GraphQLNoRowsInResultSetError("for mutation changeTenantHierarchy")
 
     def update_tenant_hierarchy(self, input_: UpdateTenantHierarchyInput) -> Tenant:
-        """Updates tenant hierarchy with explicit partner and optional organization. Handles same-partner and cross-partner moves. Requires TenantHierarchy:Update."""
+        """Updates tenant hierarchy with explicit partner and optional organization. Handles same-partner and cross-partner moves. Requires TenantHierarchy:Update (internal role)."""
         endpoint = "updateTenantHierarchy"
 
         result = self.service.execute_mutation(

{taegis_sdk_python-1.6.13 → taegis_sdk_python-1.6.15}/taegis_sdk_python/services/tenants4/types.py

@@ -508,6 +508,9 @@ class TenantV4:
     is_partner: Optional[bool] = field(
         default=None, metadata=config(field_name="isPartner")
     )
+    is_sophos_mdr_provider: Optional[bool] = field(
+        default=None, metadata=config(field_name="isSophosMDRProvider")
+    )
     has_support_enabled: Optional[bool] = field(
         default=None, metadata=config(field_name="hasSupportEnabled")
     )

{taegis_sdk_python-1.6.13 → taegis_sdk_python-1.6.15}/taegis_sdk_python/services/threat_score/types.py

@@ -69,6 +69,9 @@ class EntityEvidenceData:
     blocklist_rate_flag: Optional[bool] = field(
         default=None, metadata=config(field_name="blocklistRateFlag")
     )
+    entity_in_past_tpb_or_fp_alert: Optional[bool] = field(
+        default=None, metadata=config(field_name="entityInPastTpbOrFpAlert")
+    )
 
 
 @dataclass_json

{taegis_sdk_python-1.6.13 → taegis_sdk_python-1.6.15}/taegis_sdk_python/services/trigger_action/mutations.py

@@ -41,7 +41,10 @@ class TaegisSDKTriggerActionMutation:
             variables={
                 "input": prepare_input(input_),
             },
-            output=build_output_string(PlaybookExecution),
+            output=build_output_string(
+                PlaybookExecution,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
         )
         if result.get(endpoint) is not None:
             return PlaybookExecution.from_dict(result.get(endpoint))
@@ -56,7 +59,10 @@ class TaegisSDKTriggerActionMutation:
             variables={
                 "input": prepare_input(input_),
             },
-            output=build_output_string(BulkActions),
+            output=build_output_string(
+                BulkActions,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
         )
         if result.get(endpoint) is not None:
             return BulkActions.from_dict(result.get(endpoint))
@@ -84,7 +90,10 @@ class TaegisSDKTriggerActionMutation:
                 "targetResource": prepare_input(target_resource),
                 "reason": prepare_input(reason),
             },
-            output=build_output_string(PlaybookExecution),
+            output=build_output_string(
+                PlaybookExecution,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
         )
         if result.get(endpoint) is not None:
             return PlaybookExecution.from_dict(result.get(endpoint))
@@ -105,7 +114,10 @@ class TaegisSDKTriggerActionMutation:
             variables={
                 "input": prepare_input(input_),
             },
-            output=build_output_string(PlaybookExecution),
+            output=build_output_string(
+                PlaybookExecution,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
         )
         if result.get(endpoint) is not None:
             return PlaybookExecution.schema().load(
@@ -128,7 +140,10 @@ class TaegisSDKTriggerActionMutation:
             variables={
                 "input": prepare_input(input_),
             },
-            output=build_output_string(PlaybookExecution),
+            output=build_output_string(
+                PlaybookExecution,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
         )
         if result.get(endpoint) is not None:
             return PlaybookExecution.schema().load(