taegis-sdk-python 1.6.14__tar.gz → 1.6.15__tar.gz

{taegis_sdk_python-1.6.14 → taegis_sdk_python-1.6.15}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.6.14
+Version: 1.6.15
 Summary: Taegis Python SDK
 Project-URL: Homepage, https://github.com/secureworks/taegis-sdk-python
 Project-URL: Bug Reports, https://github.com/secureworks/taegis-sdk-python/issues

{taegis_sdk_python-1.6.14 → taegis_sdk_python-1.6.15}/taegis_sdk_python/_version.py

@@ -1,3 +1,3 @@
 """Version idenitier."""
 
-__version__ = "1.6.14"
+__version__ = "1.6.15"

taegis_sdk_python-1.6.15/taegis_sdk_python/middlewares/curl/_default.py

@@ -0,0 +1,60 @@
+"""Logs a curl command representation that makes the same HTTP request as the provided request"""
+
+import logging
+from shlex import quote
+
+from aiohttp import (
+    BytesPayload,
+    ClientHandlerType,
+    ClientRequest,
+    ClientResponse,
+)
+
+from taegis_sdk_python.middlewares.utils import scrub_dict
+
+log = logging.getLogger(__name__)
+
+
+async def to_curl(request: ClientRequest, handler: ClientHandlerType) -> ClientResponse:
+    """
+    Logs a curl command representation that makes the same HTTP request as
+    the provided request object.
+    """
+    command = []
+
+    inferred_method = "GET"
+    if request.body is not None:
+        inferred_method = "POST"
+    if request.method != inferred_method:
+        command.append("-X " + quote(request.method))
+
+    headers = scrub_dict(request.headers)
+
+    for k, v in headers.items():
+        if v:
+            command.append("-H " + quote(f"{k}: {v}"))
+        else:
+            # -H 'Accept:' disables sending the Accept header, use semicolon to send
+            # empty header
+            command.append("-H " + quote(f"{k};"))
+
+    if body := request.body:
+        if isinstance(body, (bytes, BytesPayload)):
+            body = body.decode("utf-8")
+        else:
+            log.error(f"Unsupported body type for curl middleware: {type(body)}, request.body must be bytes or BytesPayload")
+            return await handler(request)
+
+        data_type = "-d"
+        if body.startswith("@"):  # -d @filename causes curl to read from file
+            data_type = "--data-raw"
+        command.append(data_type + " " + quote(body))
+
+    command.append(quote(str(request.url)))
+
+    joiner = " "
+    if len(command) > 3:
+        joiner = " \\\n  "
+    log.info(f"curl {joiner.join(command)}")
+
+    return await handler(request)

{taegis_sdk_python-1.6.14 → taegis_sdk_python-1.6.15}/taegis_sdk_python/services/alerts/mutations.py

@@ -165,3 +165,109 @@ class TaegisSDKAlertsMutation:
         raise GraphQLNoRowsInResultSetError(
             "for mutation alertsServiceUpdateThreatScoreV2"
         )
+
+    def detection_update_investigation_info(
+        self, in_: Optional[UpdateInvestigationRequestInput] = None
+    ) -> UpdateInvestigationResponse:
+        """No developer notes."""
+        endpoint = "detectionUpdateInvestigationInfo"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                UpdateInvestigationResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return UpdateInvestigationResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError(
+            "for mutation detectionUpdateInvestigationInfo"
+        )
+
+    def detection_update_resolution_info(
+        self, in_: Optional[UpdateResolutionRequestInput] = None
+    ) -> UpdateResolutionResponse:
+        """Add a resolution or modify an existing resolution for a give list of alert IDs."""
+        endpoint = "detectionUpdateResolutionInfo"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                UpdateResolutionResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return UpdateResolutionResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError(
+            "for mutation detectionUpdateResolutionInfo"
+        )
+
+    def detection_bulk_investigations_processor(
+        self, in_: Optional[BulkInvestigationsRequestInput] = None
+    ) -> BulkInvestigationsResponse:
+        """Bulk add alerts to an existing investigation by providing either a query or list of alert IDs. If a query is provided, then all alerts matching the query will be added to the investigation."""
+        endpoint = "detectionBulkInvestigationsProcessor"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                BulkInvestigationsResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return BulkInvestigationsResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError(
+            "for mutation detectionBulkInvestigationsProcessor"
+        )
+
+    def detection_update_threat_score(
+        self, in_: UpdateThreatScoreRequestInput
+    ) -> UpdateThreatScoreResponse:
+        """Update threat score for a given list of alert IDs."""
+        endpoint = "detectionUpdateThreatScore"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                UpdateThreatScoreResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return UpdateThreatScoreResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for mutation detectionUpdateThreatScore")
+
+    def detection_update_threat_score_v2(
+        self, in_: UpdateThreatScoreV2RequestInput
+    ) -> UpdateThreatScoreResponse:
+        """Update threat score v2 for a given list of alert IDs."""
+        endpoint = "detectionUpdateThreatScoreV2"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                UpdateThreatScoreResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return UpdateThreatScoreResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for mutation detectionUpdateThreatScoreV2")

{taegis_sdk_python-1.6.14 → taegis_sdk_python-1.6.15}/taegis_sdk_python/services/alerts/queries.py

@@ -199,3 +199,161 @@ class TaegisSDKAlertsQuery:
         raise GraphQLNoRowsInResultSetError(
             "for query alertsServiceAggregateAlertsBySeverity"
         )
+
+    def detection_retrieve_by_id(
+        self, in_: Optional[GetByIDRequestInput] = None
+    ) -> AlertsResponse:
+        """Provide a list of Alert IDs to retrieve each alert's detail."""
+        endpoint = "detectionRetrieveById"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                AlertsResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detectionRetrieveById")
+
+    def detection_retrieve_by_host(
+        self, in_: Optional[GetByIDRequestInput] = None
+    ) -> AlertsResponse:
+        """Provide a list of Host IDs to retrieve alert details about each alert that contains those hosts."""
+        endpoint = "detectionRetrieveByHost"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                AlertsResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detectionRetrieveByHost")
+
+    def detection_retrieve_by_entity(
+        self, in_: Optional[GetByIDRequestInput] = None
+    ) -> AlertsResponse:
+        """Provide a list of entities to retrieve alert details about each alert that contains those entities."""
+        endpoint = "detectionRetrieveByEntity"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                AlertsResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detectionRetrieveByEntity")
+
+    def detection_retrieve_by_group_key(
+        self, in_: Optional[GetByIDRequestInput] = None
+    ) -> AlertsResponse:
+        """Provide a list of entities to retrieve alert details about each alert that contains the group_key. This is used by the service to aid in alert deduplication. This would not commonly be used by a tenant of XDR."""
+        endpoint = "detectionRetrieveByGroupKey"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                AlertsResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detectionRetrieveByGroupKey")
+
+    def detection_count_by_tenant(
+        self, in_: AlertsCountByTenantInput
+    ) -> AlertsCountByTenantResponse:
+        """Returns the count of alerts per tenant. Allows a CQL query, but any aggregation or pipe will be ignored."""
+        endpoint = "detectionCountByTenant"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                AlertsCountByTenantResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsCountByTenantResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detectionCountByTenant")
+
+    def detection_search(
+        self, in_: Optional[SearchRequestInput] = None
+    ) -> AlertsResponse:
+        """Search alerts using Query Language. This is the same query language provided in Advanced Search page in Taegis XDR."""
+        endpoint = "detectionSearch"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                AlertsResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detectionSearch")
+
+    def detection_poll(self, in_: Optional[PollRequestInput] = None) -> AlertsResponse:
+        """Poll for results for a specific `search_id`."""
+        endpoint = "detectionPoll"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                AlertsResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detectionPoll")
+
+    def detection_aggregates_by_severity(
+        self, in_: Optional[AggregateAlertsBySeverityInputInput] = None
+    ) -> AlertsAggregateResponse:
+        """Pull alert severity aggregates based on `group_by` parameters: domain, watchlist, hostname, detector, user."""
+        endpoint = "detectionAggregatesBySeverity"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                AlertsAggregateResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsAggregateResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detectionAggregatesBySeverity")

{taegis_sdk_python-1.6.14 → taegis_sdk_python-1.6.15}/taegis_sdk_python/services/alerts/subscriptions.py

@@ -55,3 +55,27 @@ class TaegisSDKAlertsSubscription:
         raise GraphQLNoRowsInResultSetError(
             "for subscription alertsServiceBulkResolutionProcessor"
         )
+
+    def detection_bulk_resolution_processor(
+        self, in_: Optional[BulkResolutionRequestInput] = None
+    ) -> List[BulkResolutionResponse]:
+        """Add a resolution or modify an existing resolution for multiple alerts selected with a CQL query."""
+        endpoint = "detectionBulkResolutionProcessor"
+
+        result = self.service.execute_subscription(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                BulkResolutionResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if any(r.get(endpoint) for r in result):
+            return BulkResolutionResponse.schema().load(
+                [r.get(endpoint, {}) or {} for r in result], many=True
+            )
+        raise GraphQLNoRowsInResultSetError(
+            "for subscription detectionBulkResolutionProcessor"
+        )

{taegis_sdk_python-1.6.14 → taegis_sdk_python-1.6.15}/taegis_sdk_python/services/investigations2/types.py

@@ -980,6 +980,7 @@ class CasePrimaryStatusesArguments:
     transition_from_id: Optional[str] = field(
         default=None, metadata=config(field_name="transitionFromId")
     )
+    case_id: Optional[str] = field(default=None, metadata=config(field_name="caseId"))
 
 
 @dataclass_json
@@ -3996,26 +3997,6 @@ class CasesArguments:
     tenant_service_filters: Optional[List[str]] = field(
         default=None, metadata=config(field_name="tenantServiceFilters")
     )
-    page: Optional[int] = field(
-        default=None,
-        metadata=config(
-            metadata={
-                "deprecated": True,
-                "deprecation_reason": "use pagination.offset.page",
-            },
-            field_name="page",
-        ),
-    )
-    per_page: Optional[int] = field(
-        default=None,
-        metadata=config(
-            metadata={
-                "deprecated": True,
-                "deprecation_reason": "use pagination.offset.perPage",
-            },
-            field_name="perPage",
-        ),
-    )
     pagination: Optional[CasesPagination] = field(
         default=None, metadata=config(field_name="pagination")
     )

{taegis_sdk_python-1.6.14 → taegis_sdk_python-1.6.15}/taegis_sdk_python/services/tenants/mutations.py

@@ -350,7 +350,7 @@ class TaegisSDKTenantsMutation:
         raise GraphQLNoRowsInResultSetError("for mutation changeTenantHierarchy")
 
     def update_tenant_hierarchy(self, input_: UpdateTenantHierarchyInput) -> Tenant:
-        """Updates tenant hierarchy with explicit partner and optional organization. Handles same-partner and cross-partner moves. Requires TenantHierarchy:Update."""
+        """Updates tenant hierarchy with explicit partner and optional organization. Handles same-partner and cross-partner moves. Requires TenantHierarchy:Update (internal role)."""
         endpoint = "updateTenantHierarchy"
 
         result = self.service.execute_mutation(

{taegis_sdk_python-1.6.14 → taegis_sdk_python-1.6.15}/taegis_sdk_python/services/trip/queries.py

@@ -72,6 +72,28 @@ class TaegisSDKTripQuery:
             )
         raise GraphQLNoRowsInResultSetError("for query listApiIntegrations")
 
+    def list_api_integrations_v2(
+        self, filter_: Optional[ListApiIntegrationsFilter] = None
+    ) -> List[ApiIntegrationSummary]:
+        """No developer notes."""
+        endpoint = "listApiIntegrationsV2"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "filter": prepare_input(filter_),
+            },
+            output=build_output_string(
+                ApiIntegrationSummary,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return ApiIntegrationSummary.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query listApiIntegrationsV2")
+
     def api_integration(self, id_: int) -> ApiIntegration:
         """No developer notes."""
         endpoint = "apiIntegration"

{taegis_sdk_python-1.6.14 → taegis_sdk_python-1.6.15}/taegis_sdk_python/services/trip/types.py

@@ -102,6 +102,19 @@ class TripEnvConfig:
     value: Optional[str] = field(default=None, metadata=config(field_name="value"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class ListApiIntegrationsFilter:
+    """ListApiIntegrationsFilter."""
+
+    product_id: Optional[int] = field(
+        default=None, metadata=config(field_name="productId")
+    )
+    integration_id: Optional[int] = field(
+        default=None, metadata=config(field_name="integrationId")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class ApiIntegrationHistory: