taegis-sdk-python 1.6.14__tar.gz → 1.6.16__tar.gz

{taegis_sdk_python-1.6.14 → taegis_sdk_python-1.6.16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.6.14
+Version: 1.6.16
 Summary: Taegis Python SDK
 Project-URL: Homepage, https://github.com/secureworks/taegis-sdk-python
 Project-URL: Bug Reports, https://github.com/secureworks/taegis-sdk-python/issues

{taegis_sdk_python-1.6.14 → taegis_sdk_python-1.6.16}/taegis_sdk_python/_version.py

@@ -1,3 +1,3 @@
 """Version idenitier."""
 
-__version__ = "1.6.14"
+__version__ = "1.6.16"

{taegis_sdk_python-1.6.14 → taegis_sdk_python-1.6.16}/taegis_sdk_python/middlewares/__init__.py

@@ -1,6 +1,7 @@
 """Taegis SDK Middlewares."""
 
+from taegis_sdk_python.middlewares.curl import to_curl
 from taegis_sdk_python.middlewares.logging import headers_logging_middleware
 from taegis_sdk_python.middlewares.retry import retry_middleware
 
-__all__ = ["headers_logging_middleware", "retry_middleware"]
+__all__ = ["headers_logging_middleware", "retry_middleware", "to_curl"]

taegis_sdk_python-1.6.16/taegis_sdk_python/middlewares/curl/__init__.py

@@ -0,0 +1,5 @@
+"""Taegis SDK Curl Middlewares."""
+
+from ._default import to_curl
+
+__all__ = ["to_curl"]

taegis_sdk_python-1.6.16/taegis_sdk_python/middlewares/curl/_default.py

@@ -0,0 +1,57 @@
+"""Logs a curl command representation that makes the same HTTP request as the provided request"""
+
+import logging
+from shlex import quote
+
+from aiohttp import BytesPayload, ClientHandlerType, ClientRequest, ClientResponse
+
+from taegis_sdk_python.middlewares.utils import scrub_dict
+
+log = logging.getLogger(__name__)
+
+
+async def to_curl(request: ClientRequest, handler: ClientHandlerType) -> ClientResponse:
+    """
+    Logs a curl command representation that makes the same HTTP request as
+    the provided request object.
+    """
+    command = []
+
+    inferred_method = "GET"
+    if request.body is not None:
+        inferred_method = "POST"
+    if request.method != inferred_method:
+        command.append("-X " + quote(request.method))
+
+    headers = scrub_dict(request.headers)
+
+    for k, v in headers.items():
+        if v:
+            command.append("-H " + quote(f"{k}: {v}"))
+        else:
+            # -H 'Accept:' disables sending the Accept header, use semicolon to send
+            # empty header
+            command.append("-H " + quote(f"{k};"))
+
+    if body := request.body:
+        if isinstance(body, (bytes, BytesPayload)):
+            body = body.decode("utf-8")
+        else:
+            log.error(
+                f"Unsupported body type for curl middleware: {type(body)}, request.body must be bytes or BytesPayload"
+            )
+            return await handler(request)
+
+        data_type = "-d"
+        if body.startswith("@"):  # -d @filename causes curl to read from file
+            data_type = "--data-raw"
+        command.append(data_type + " " + quote(body))
+
+    command.append(quote(str(request.url)))
+
+    joiner = " "
+    if len(command) > 3:
+        joiner = " \\\n  "
+    log.info(f"curl {joiner.join(command)}")
+
+    return await handler(request)

{taegis_sdk_python-1.6.14 → taegis_sdk_python-1.6.16}/taegis_sdk_python/services/__init__.py

@@ -34,6 +34,7 @@ from taegis_sdk_python.services.byoti import ByotiService
 from taegis_sdk_python.services.clients import ClientsService
 from taegis_sdk_python.services.collector import CollectorService
 from taegis_sdk_python.services.comments import CommentsService
+from taegis_sdk_python.services.context_summarizer import ContextSummarizerService
 from taegis_sdk_python.services.contracted_endpoint import ContractedEndpointService
 from taegis_sdk_python.services.cql_metadata import CqlMetadataService
 from taegis_sdk_python.services.datasources import DatasourcesService
@@ -47,6 +48,7 @@ from taegis_sdk_python.services.endpoint_management_service import (
 from taegis_sdk_python.services.entity_context import EntityContextService
 from taegis_sdk_python.services.escalation_policies import EscalationPoliciesService
 from taegis_sdk_python.services.event_search import EventSearchService
+from taegis_sdk_python.services.event_stats import EventStatsService
 from taegis_sdk_python.services.events import EventsService
 from taegis_sdk_python.services.exports import ExportsService
 from taegis_sdk_python.services.fast_ioc import FastIocService
@@ -204,6 +206,7 @@ class GraphQLService:
         self._clients = None
         self._collector = None
         self._comments = None
+        self._context_summarizer = None
         self._contracted_endpoint = None
         self._cql_metadata = None
         self._datasources = None
@@ -212,6 +215,7 @@ class GraphQLService:
         self._endpoint_management_service = None
         self._entity_context = None
         self._event_search = None
+        self._event_stats = None
         self._escalation_policies = None
         self._events = None
         self._exports = None
@@ -584,6 +588,13 @@ class GraphQLService:
             self._comments = CommentsService(self)
         return self._comments
 
+    @property
+    def context_summarizer(self):
+        """Context Summarizer Service Endpoint."""
+        if not self._context_summarizer:
+            self._context_summarizer = ContextSummarizerService(self)
+        return self._context_summarizer
+
     @property
     def contracted_endpoint(self):
         """ContractedEndpoint Service Endpoint."""
@@ -647,6 +658,13 @@ class GraphQLService:
             self._event_search = EventSearchService(self)
         return self._event_search
 
+    @property
+    def event_stats(self):
+        """EventStats Service Endpoint."""
+        if not self._event_stats:
+            self._event_stats = EventStatsService(self)
+        return self._event_stats
+
     @property
     def events(self):
         """Events Service Endpoint."""

{taegis_sdk_python-1.6.14 → taegis_sdk_python-1.6.16}/taegis_sdk_python/services/alerts/mutations.py

@@ -165,3 +165,109 @@ class TaegisSDKAlertsMutation:
         raise GraphQLNoRowsInResultSetError(
             "for mutation alertsServiceUpdateThreatScoreV2"
         )
+
+    def detection_update_investigation_info(
+        self, in_: Optional[UpdateInvestigationRequestInput] = None
+    ) -> UpdateInvestigationResponse:
+        """No developer notes."""
+        endpoint = "detectionUpdateInvestigationInfo"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                UpdateInvestigationResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return UpdateInvestigationResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError(
+            "for mutation detectionUpdateInvestigationInfo"
+        )
+
+    def detection_update_resolution_info(
+        self, in_: Optional[UpdateResolutionRequestInput] = None
+    ) -> UpdateResolutionResponse:
+        """Add a resolution or modify an existing resolution for a give list of alert IDs."""
+        endpoint = "detectionUpdateResolutionInfo"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                UpdateResolutionResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return UpdateResolutionResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError(
+            "for mutation detectionUpdateResolutionInfo"
+        )
+
+    def detection_bulk_investigations_processor(
+        self, in_: Optional[BulkInvestigationsRequestInput] = None
+    ) -> BulkInvestigationsResponse:
+        """Bulk add alerts to an existing investigation by providing either a query or list of alert IDs. If a query is provided, then all alerts matching the query will be added to the investigation."""
+        endpoint = "detectionBulkInvestigationsProcessor"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                BulkInvestigationsResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return BulkInvestigationsResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError(
+            "for mutation detectionBulkInvestigationsProcessor"
+        )
+
+    def detection_update_threat_score(
+        self, in_: UpdateThreatScoreRequestInput
+    ) -> UpdateThreatScoreResponse:
+        """Update threat score for a given list of alert IDs."""
+        endpoint = "detectionUpdateThreatScore"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                UpdateThreatScoreResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return UpdateThreatScoreResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for mutation detectionUpdateThreatScore")
+
+    def detection_update_threat_score_v2(
+        self, in_: UpdateThreatScoreV2RequestInput
+    ) -> UpdateThreatScoreResponse:
+        """Update threat score v2 for a given list of alert IDs."""
+        endpoint = "detectionUpdateThreatScoreV2"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                UpdateThreatScoreResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return UpdateThreatScoreResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for mutation detectionUpdateThreatScoreV2")

{taegis_sdk_python-1.6.14 → taegis_sdk_python-1.6.16}/taegis_sdk_python/services/alerts/queries.py

@@ -199,3 +199,161 @@ class TaegisSDKAlertsQuery:
         raise GraphQLNoRowsInResultSetError(
             "for query alertsServiceAggregateAlertsBySeverity"
         )
+
+    def detection_retrieve_by_id(
+        self, in_: Optional[GetByIDRequestInput] = None
+    ) -> AlertsResponse:
+        """Provide a list of Alert IDs to retrieve each alert's detail."""
+        endpoint = "detectionRetrieveById"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                AlertsResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detectionRetrieveById")
+
+    def detection_retrieve_by_host(
+        self, in_: Optional[GetByIDRequestInput] = None
+    ) -> AlertsResponse:
+        """Provide a list of Host IDs to retrieve alert details about each alert that contains those hosts."""
+        endpoint = "detectionRetrieveByHost"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                AlertsResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detectionRetrieveByHost")
+
+    def detection_retrieve_by_entity(
+        self, in_: Optional[GetByIDRequestInput] = None
+    ) -> AlertsResponse:
+        """Provide a list of entities to retrieve alert details about each alert that contains those entities."""
+        endpoint = "detectionRetrieveByEntity"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                AlertsResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detectionRetrieveByEntity")
+
+    def detection_retrieve_by_group_key(
+        self, in_: Optional[GetByIDRequestInput] = None
+    ) -> AlertsResponse:
+        """Provide a list of entities to retrieve alert details about each alert that contains the group_key. This is used by the service to aid in alert deduplication. This would not commonly be used by a tenant of XDR."""
+        endpoint = "detectionRetrieveByGroupKey"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                AlertsResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detectionRetrieveByGroupKey")
+
+    def detection_count_by_tenant(
+        self, in_: AlertsCountByTenantInput
+    ) -> AlertsCountByTenantResponse:
+        """Returns the count of alerts per tenant. Allows a CQL query, but any aggregation or pipe will be ignored."""
+        endpoint = "detectionCountByTenant"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                AlertsCountByTenantResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsCountByTenantResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detectionCountByTenant")
+
+    def detection_search(
+        self, in_: Optional[SearchRequestInput] = None
+    ) -> AlertsResponse:
+        """Search alerts using Query Language. This is the same query language provided in Advanced Search page in Taegis XDR."""
+        endpoint = "detectionSearch"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                AlertsResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detectionSearch")
+
+    def detection_poll(self, in_: Optional[PollRequestInput] = None) -> AlertsResponse:
+        """Poll for results for a specific `search_id`."""
+        endpoint = "detectionPoll"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                AlertsResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detectionPoll")
+
+    def detection_aggregates_by_severity(
+        self, in_: Optional[AggregateAlertsBySeverityInputInput] = None
+    ) -> AlertsAggregateResponse:
+        """Pull alert severity aggregates based on `group_by` parameters: domain, watchlist, hostname, detector, user."""
+        endpoint = "detectionAggregatesBySeverity"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                AlertsAggregateResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return AlertsAggregateResponse.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query detectionAggregatesBySeverity")

{taegis_sdk_python-1.6.14 → taegis_sdk_python-1.6.16}/taegis_sdk_python/services/alerts/subscriptions.py

@@ -55,3 +55,27 @@ class TaegisSDKAlertsSubscription:
         raise GraphQLNoRowsInResultSetError(
             "for subscription alertsServiceBulkResolutionProcessor"
         )
+
+    def detection_bulk_resolution_processor(
+        self, in_: Optional[BulkResolutionRequestInput] = None
+    ) -> List[BulkResolutionResponse]:
+        """Add a resolution or modify an existing resolution for multiple alerts selected with a CQL query."""
+        endpoint = "detectionBulkResolutionProcessor"
+
+        result = self.service.execute_subscription(
+            endpoint=endpoint,
+            variables={
+                "in": prepare_input(in_),
+            },
+            output=build_output_string(
+                BulkResolutionResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if any(r.get(endpoint) for r in result):
+            return BulkResolutionResponse.schema().load(
+                [r.get(endpoint, {}) or {} for r in result], many=True
+            )
+        raise GraphQLNoRowsInResultSetError(
+            "for subscription detectionBulkResolutionProcessor"
+        )

taegis_sdk_python-1.6.16/taegis_sdk_python/services/context_summarizer/__init__.py

@@ -0,0 +1,30 @@
+"""ContextSummarizer Service."""
+
+from taegis_sdk_python.service_core import ServiceCore
+from taegis_sdk_python.services.context_summarizer.mutations import TaegisSDKContextSummarizerMutation
+from taegis_sdk_python.services.context_summarizer.queries import TaegisSDKContextSummarizerQuery
+from taegis_sdk_python.services.context_summarizer.subscriptions import (
+    TaegisSDKContextSummarizerSubscription,
+)
+
+
+class ContextSummarizerService(ServiceCore):
+    """Taegis ContextSummarizer Service."""
+
+    @property
+    def query(self):
+        if not self._queries:
+            self._queries = TaegisSDKContextSummarizerQuery(self)
+        return self._queries
+
+    @property
+    def mutation(self):
+        if not self._mutations:
+            self._mutations = TaegisSDKContextSummarizerMutation(self)
+        return self._mutations
+
+    @property
+    def subscription(self):
+        if not self._subscriptions:
+            self._subscriptions = TaegisSDKContextSummarizerSubscription(self)
+        return self._subscriptions

taegis_sdk_python-1.6.16/taegis_sdk_python/services/context_summarizer/mutations.py

@@ -0,0 +1,33 @@
+"""ContextSummarizer Mutation."""
+
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python._consts import TaegisEnum
+from taegis_sdk_python.services.context_summarizer.types import *
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.context_summarizer import ContextSummarizerService
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKContextSummarizerMutation:
+    """Taegis Context_summarizer Mutation operations."""
+
+    def __init__(self, service: ContextSummarizerService):
+        self.service = service