taegis-sdk-python 1.6.17__tar.gz → 1.6.18__tar.gz

{taegis_sdk_python-1.6.17 → taegis_sdk_python-1.6.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.6.17
+Version: 1.6.18
 Summary: Taegis Python SDK
 Project-URL: Homepage, https://github.com/secureworks/taegis-sdk-python
 Project-URL: Bug Reports, https://github.com/secureworks/taegis-sdk-python/issues

{taegis_sdk_python-1.6.17 → taegis_sdk_python-1.6.18}/taegis_sdk_python/_version.py

@@ -1,3 +1,3 @@
 """Version idenitier."""
 
-__version__ = "1.6.17"
+__version__ = "1.6.18"

{taegis_sdk_python-1.6.17 → taegis_sdk_python-1.6.18}/taegis_sdk_python/services/__init__.py

@@ -53,6 +53,7 @@ from taegis_sdk_python.services.events import EventsService
 from taegis_sdk_python.services.exports import ExportsService
 from taegis_sdk_python.services.fast_ioc import FastIocService
 from taegis_sdk_python.services.file_info import FileInfoService
+from taegis_sdk_python.services.health import HealthService
 from taegis_sdk_python.services.ingest_stats import IngestStatsService
 from taegis_sdk_python.services.investigations import InvestigationsService
 from taegis_sdk_python.services.investigations2 import Investigations2Service
@@ -220,6 +221,7 @@ class GraphQLService:
         self._events = None
         self._exports = None
         self._fast_ioc = None
+        self._health = None
         self._file_info = None
         self._ingest_stats = None
         self._investigations = None
@@ -686,6 +688,13 @@ class GraphQLService:
             self._fast_ioc = FastIocService(self)
         return self._fast_ioc
 
+    @property
+    def health(self):
+        """Health Service Endpoint."""
+        if not self._health:
+            self._health = HealthService(self)
+        return self._health
+
     @property
     def file_info(self):
         """FileInfo Service Endpoint."""

{taegis_sdk_python-1.6.17 → taegis_sdk_python-1.6.18}/taegis_sdk_python/services/alerts/types.py

@@ -36,6 +36,7 @@ class ResolutionStatus(str, Enum):
     OTHER = "OTHER"
     SUPPRESSED = "SUPPRESSED"
     AUTO_CLOSE = "AUTO_CLOSE"
+    DISMISSED = "DISMISSED"
 
 
 class Origin(str, Enum):

{taegis_sdk_python-1.6.17 → taegis_sdk_python-1.6.18}/taegis_sdk_python/services/assets2/types.py

@@ -405,8 +405,26 @@ class TagV2:
         default=None, metadata=config(field_name="updatedAt")
     )
     tag: Optional[str] = field(default=None, metadata=config(field_name="tag"))
-    key: Optional[str] = field(default=None, metadata=config(field_name="key"))
-    value: Optional[str] = field(default=None, metadata=config(field_name="value"))
+    key: Optional[str] = field(
+        default=None,
+        metadata=config(
+            metadata={
+                "deprecated": True,
+                "deprecation_reason": "Use the tag field instead. Key/value separation is inconsistent across endpoint types.",
+            },
+            field_name="key",
+        ),
+    )
+    value: Optional[str] = field(
+        default=None,
+        metadata=config(
+            metadata={
+                "deprecated": True,
+                "deprecation_reason": "Use the tag field instead. Key/value separation is inconsistent across endpoint types.",
+            },
+            field_name="value",
+        ),
+    )
     is_vendor_tag: Optional[bool] = field(
         default=None, metadata=config(field_name="isVendorTag")
     )

{taegis_sdk_python-1.6.17 → taegis_sdk_python-1.6.18}/taegis_sdk_python/services/contracted_endpoint/queries.py

@@ -56,6 +56,10 @@ class TaegisSDKContractedEndpointQuery:
         """No developer notes."""
         endpoint = "projectIRHoursForTenantID"
 
+        log.warning(
+            f"GraphQL Query `{endpoint}` is deprecated: 'Use endpointCountForTenantID instead. Planned removal: 2026-09-01'"
+        )
+
         result = self.service.execute_query(endpoint=endpoint, variables={}, output="")
         if result.get(endpoint) is not None:
             return result.get(endpoint)

{taegis_sdk_python-1.6.17 → taegis_sdk_python-1.6.18}/taegis_sdk_python/services/event_stats/queries.py

@@ -36,6 +36,10 @@ class TaegisSDKEventStatsQuery:
         """Get effective agents count for the given tenant and time range."""
         endpoint = "effectiveAgents"
 
+        log.warning(
+            f"GraphQL Query `{endpoint}` is deprecated: 'Use `eventStatsQuery` instead'"
+        )
+
         result = self.service.execute_query(
             endpoint=endpoint,
             variables={

{taegis_sdk_python-1.6.17 → taegis_sdk_python-1.6.18}/taegis_sdk_python/services/events/types.py

@@ -172,6 +172,9 @@ class EventFetchOptions:
     normalize_event_keys: Optional[bool] = field(
         default=None, metadata=config(field_name="normalizeEventKeys")
     )
+    metadata: Optional[dict] = field(
+        default=None, metadata=config(field_name="metadata")
+    )
     backend_strategy: Optional[BackendStrategy] = field(
         default=None, metadata=config(field_name="backendStrategy")
     )

taegis_sdk_python-1.6.18/taegis_sdk_python/services/health/__init__.py

@@ -0,0 +1,35 @@
+"""Health Service."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from taegis_sdk_python.service_core import ServiceCore
+from taegis_sdk_python.services.health.mutations import TaegisSDKHealthMutation
+from taegis_sdk_python.services.health.queries import TaegisSDKHealthQuery
+from taegis_sdk_python.services.health.subscriptions import TaegisSDKHealthSubscription
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services import GraphQLService
+
+
+class HealthService(ServiceCore):
+    """Taegis Health Service."""
+
+    @property
+    def query(self):
+        if not self._queries:
+            self._queries = TaegisSDKHealthQuery(self)
+        return self._queries
+
+    @property
+    def mutation(self):
+        if not self._mutations:
+            self._mutations = TaegisSDKHealthMutation(self)
+        return self._mutations
+
+    @property
+    def subscription(self):
+        if not self._subscriptions:
+            self._subscriptions = TaegisSDKHealthSubscription(self)
+        return self._subscriptions

taegis_sdk_python-1.6.18/taegis_sdk_python/services/health/mutations.py

@@ -0,0 +1,54 @@
+"""Health Mutation."""
+
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python._consts import TaegisEnum
+from taegis_sdk_python.services.health.types import *
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.health import HealthService
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKHealthMutation:
+    """Taegis Health Mutation operations."""
+
+    def __init__(self, service: HealthService):
+        self.service = service
+
+    def ndr_health_clear_health_status(
+        self, device_name: str, alert_name: str
+    ) -> NDRHealthStatus:
+        """Clear Health Alert."""
+        endpoint = "ndrHealthClearHealthStatus"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "deviceName": prepare_input(device_name),
+                "alertName": prepare_input(alert_name),
+            },
+            output=build_output_string(
+                NDRHealthStatus,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return NDRHealthStatus.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for mutation ndrHealthClearHealthStatus")

taegis_sdk_python-1.6.18/taegis_sdk_python/services/health/queries.py

@@ -0,0 +1,111 @@
+"""Health Query."""
+
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python._consts import TaegisEnum
+from taegis_sdk_python.services.health.types import *
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.health import HealthService
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKHealthQuery:
+    """Taegis Health Query operations."""
+
+    def __init__(self, service: HealthService):
+        self.service = service
+
+    def ndr_health_last_event(self, device_name: str) -> NDRHealthLastEvents:
+        """Query to get event timestamps."""
+        endpoint = "ndrHealthLastEvent"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "deviceName": prepare_input(device_name),
+            },
+            output=build_output_string(
+                NDRHealthLastEvents,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return NDRHealthLastEvents.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query ndrHealthLastEvent")
+
+    def ndr_health_status(self, device_name: str) -> List[NDRHealthStatus]:
+        """Query to get health status of a device."""
+        endpoint = "ndrHealthStatus"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "deviceName": prepare_input(device_name),
+            },
+            output=build_output_string(
+                NDRHealthStatus,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return NDRHealthStatus.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query ndrHealthStatus")
+
+    def ndr_health_statuses(self) -> List[NDRHealthStatuses]:
+        """Query to get list of devices with health status of each device."""
+        endpoint = "ndrHealthStatuses"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={},
+            output=build_output_string(
+                NDRHealthStatuses,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return NDRHealthStatuses.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query ndrHealthStatuses")
+
+    def ndr_health_metrics(
+        self, ndr_health_metrics_query: NDRHealthMetricsQuery
+    ) -> List[NDRHealthMetricsResponse]:
+        """Query to get health metrics of a device for the requested type."""
+        endpoint = "ndrHealthMetrics"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "ndrHealthMetricsQuery": prepare_input(ndr_health_metrics_query),
+            },
+            output=build_output_string(
+                NDRHealthMetricsResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return NDRHealthMetricsResponse.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query ndrHealthMetrics")

taegis_sdk_python-1.6.18/taegis_sdk_python/services/health/subscriptions.py

@@ -0,0 +1,33 @@
+"""Health Subscription."""
+
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python._consts import TaegisEnum
+from taegis_sdk_python.services.health.types import *
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.health import HealthService
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKHealthSubscription:
+    """Taegis Health Subscription operations."""
+
+    def __init__(self, service: HealthService):
+        self.service = service

taegis_sdk_python-1.6.18/taegis_sdk_python/services/health/types.py

@@ -0,0 +1,174 @@
+"""Health Types and Enums."""
+
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code
+
+# Autogenerated
+# DO NOT MODIFY
+
+from dataclasses import dataclass, field
+from enum import Enum
+from typing import Any, Dict, List, Optional, Tuple, Union
+
+from dataclasses_json import config, dataclass_json
+
+from taegis_sdk_python._consts import TaegisEnum
+from taegis_sdk_python.utils import decode_enum, encode_enum, parse_union_result
+
+
+class NdrHealthState(str, Enum):
+    """NdrHealthState."""
+
+    UP = "UP"
+    DOWN = "DOWN"
+    WARNING = "WARNING"
+
+
+class OverAllHealthState(str, Enum):
+    """OverAllHealthState."""
+
+    HEALTHY = "HEALTHY"
+    WARNING = "WARNING"
+    NODATA = "NODATA"
+
+
+class NdrHealthMetricName(str, Enum):
+    """NdrHealthMetricName."""
+
+    MEMORY_USAGE = "MEMORY_USAGE"
+    CPU_UTILIZATION = "CPU_UTILIZATION"
+    DISK_USAGE = "DISK_USAGE"
+    NETWORK_INTERFACE_ERRORS = "NETWORK_INTERFACE_ERRORS"
+    NETWORK_INTERFACE_PACKETS = "NETWORK_INTERFACE_PACKETS"
+    NETWORK_INTERFACE_THROUGHPUT = "NETWORK_INTERFACE_THROUGHPUT"
+    IPS_ENGINE_EVENTS = "IPS_ENGINE_EVENTS"
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class NDRHealthMetric:
+    """NDRHealthMetric."""
+
+    time: Optional[str] = field(default=None, metadata=config(field_name="time"))
+    value: Optional[float] = field(default=None, metadata=config(field_name="value"))
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class NDRHealthLastEvents:
+    """NDRHealthLastEvents."""
+
+    heartbeat: Optional[str] = field(
+        default=None, metadata=config(field_name="heartbeat")
+    )
+    security: Optional[str] = field(
+        default=None, metadata=config(field_name="security")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class NDRHealthMetricsQuery:
+    """NDRHealthMetricsQuery."""
+
+    device_name: Optional[str] = field(
+        default=None, metadata=config(field_name="deviceName")
+    )
+    start_time: Optional[str] = field(
+        default=None, metadata=config(field_name="startTime")
+    )
+    end_time: Optional[str] = field(default=None, metadata=config(field_name="endTime"))
+    data_interval: Optional[str] = field(
+        default=None, metadata=config(field_name="dataInterval")
+    )
+    metric_name: Optional[Union[NdrHealthMetricName, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(NdrHealthMetricName, x),
+            field_name="metricName",
+        ),
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class NDRHealthMetricSeries:
+    """NDRHealthMetricSeries."""
+
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    min: Optional[float] = field(default=None, metadata=config(field_name="min"))
+    max: Optional[float] = field(default=None, metadata=config(field_name="max"))
+    avg: Optional[float] = field(default=None, metadata=config(field_name="avg"))
+    last: Optional[float] = field(default=None, metadata=config(field_name="last"))
+    metric_series: Optional[List[NDRHealthMetric]] = field(
+        default=None, metadata=config(field_name="metricSeries")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class NDRHealthMetrics:
+    """NDRHealthMetrics."""
+
+    metric_name: Optional[str] = field(
+        default=None, metadata=config(field_name="metricName")
+    )
+    metrics_list: Optional[List[NDRHealthMetricSeries]] = field(
+        default=None, metadata=config(field_name="metricsList")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class NDRHealthMetricsResponse:
+    """NDRHealthMetricsResponse."""
+
+    metrics: Optional[List[NDRHealthMetrics]] = field(
+        default=None, metadata=config(field_name="metrics")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class NDRHealthStatus:
+    """NDRHealthStatus."""
+
+    alert_name: Optional[str] = field(
+        default=None, metadata=config(field_name="alertName")
+    )
+    timestamp: Optional[str] = field(
+        default=None, metadata=config(field_name="timestamp")
+    )
+    tenant_id: Optional[int] = field(
+        default=None, metadata=config(field_name="tenantId")
+    )
+    details: Optional[str] = field(default=None, metadata=config(field_name="details"))
+    status: Optional[Union[NdrHealthState, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(NdrHealthState, x),
+            field_name="status",
+        ),
+    )
+    over_allstatus: Optional[Union[OverAllHealthState, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(OverAllHealthState, x),
+            field_name="overAllstatus",
+        ),
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class NDRHealthStatuses:
+    """NDRHealthStatuses."""
+
+    device_name: Optional[str] = field(
+        default=None, metadata=config(field_name="deviceName")
+    )
+    health_status: Optional[List[NDRHealthStatus]] = field(
+        default=None, metadata=config(field_name="healthStatus")
+    )

{taegis_sdk_python-1.6.17 → taegis_sdk_python-1.6.18}/taegis_sdk_python/services/investigations2/types.py

@@ -2557,54 +2557,6 @@ class CaseComment:
     )
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class CaseType:
-    """CaseType."""
-
-    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
-    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
-    title: Optional[str] = field(default=None, metadata=config(field_name="title"))
-    description: Optional[str] = field(
-        default=None, metadata=config(field_name="description")
-    )
-    tenant_id: Optional[str] = field(
-        default=None, metadata=config(field_name="tenantId")
-    )
-    created_by_id: Optional[str] = field(
-        default=None, metadata=config(field_name="createdById")
-    )
-    created_at: Optional[str] = field(
-        default=None, metadata=config(field_name="createdAt")
-    )
-    updated_by_id: Optional[str] = field(
-        default=None, metadata=config(field_name="updatedById")
-    )
-    updated_at: Optional[str] = field(
-        default=None, metadata=config(field_name="updatedAt")
-    )
-    supported_primary_status_ids: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="supportedPrimaryStatusIds")
-    )
-    supported_secondary_status_ids: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="supportedSecondaryStatusIds")
-    )
-    supported_primary_statuses: Optional[List[CasePrimaryStatus]] = field(
-        default=None, metadata=config(field_name="supportedPrimaryStatuses")
-    )
-    supported_secondary_statuses: Optional[List[CaseSecondaryStatus]] = field(
-        default=None, metadata=config(field_name="supportedSecondaryStatuses")
-    )
-    managed_by: Optional[Union[CaseManagedBy, TaegisEnum]] = field(
-        default=None,
-        metadata=config(
-            encoder=encode_enum,
-            decoder=lambda x: decode_enum(CaseManagedBy, x),
-            field_name="managedBy",
-        ),
-    )
-
-
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class CaseFile:
@@ -2982,6 +2934,60 @@ class CaseEvidence:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class CaseType:
+    """CaseType."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    title: Optional[str] = field(default=None, metadata=config(field_name="title"))
+    description: Optional[str] = field(
+        default=None, metadata=config(field_name="description")
+    )
+    tenant_id: Optional[str] = field(
+        default=None, metadata=config(field_name="tenantId")
+    )
+    created_by_id: Optional[str] = field(
+        default=None, metadata=config(field_name="createdById")
+    )
+    created_at: Optional[str] = field(
+        default=None, metadata=config(field_name="createdAt")
+    )
+    updated_by_id: Optional[str] = field(
+        default=None, metadata=config(field_name="updatedById")
+    )
+    updated_at: Optional[str] = field(
+        default=None, metadata=config(field_name="updatedAt")
+    )
+    supported_primary_status_ids: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="supportedPrimaryStatusIds")
+    )
+    supported_secondary_status_ids: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="supportedSecondaryStatusIds")
+    )
+    supported_primary_verdict_ids: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="supportedPrimaryVerdictIds")
+    )
+    supported_primary_statuses: Optional[List[CasePrimaryStatus]] = field(
+        default=None, metadata=config(field_name="supportedPrimaryStatuses")
+    )
+    supported_secondary_statuses: Optional[List[CaseSecondaryStatus]] = field(
+        default=None, metadata=config(field_name="supportedSecondaryStatuses")
+    )
+    supported_primary_verdicts: Optional[List[CasePrimaryVerdict]] = field(
+        default=None, metadata=config(field_name="supportedPrimaryVerdicts")
+    )
+    managed_by: Optional[Union[CaseManagedBy, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(CaseManagedBy, x),
+            field_name="managedBy",
+        ),
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class CreateCaseTemplateInput: