taegis-sdk-python 1.6.17__tar.gz → 1.6.19__tar.gz

{taegis_sdk_python-1.6.17 → taegis_sdk_python-1.6.19}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.6.17
+Version: 1.6.19
 Summary: Taegis Python SDK
 Project-URL: Homepage, https://github.com/secureworks/taegis-sdk-python
 Project-URL: Bug Reports, https://github.com/secureworks/taegis-sdk-python/issues
@@ -192,6 +192,7 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.9
 Requires-Dist: aiohttp
 Requires-Dist: backoff
@@ -200,6 +201,7 @@ Requires-Dist: filelock>=3.12.4
 Requires-Dist: gql>=4
 Requires-Dist: graphql-core
 Requires-Dist: jinja2
+Requires-Dist: multidict
 Requires-Dist: oauthlib
 Requires-Dist: pyjwt>=2.8.0
 Requires-Dist: python-dateutil

{taegis_sdk_python-1.6.17 → taegis_sdk_python-1.6.19}/pyproject.toml

@@ -19,6 +19,7 @@ classifiers = [
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
 ]
 dependencies = [
     "aiohttp",
@@ -35,6 +36,7 @@ dependencies = [
     "websockets",
     "jinja2",
     "backoff",
+    "multidict"
 ]
 
 [project.optional-dependencies]

taegis_sdk_python-1.6.19/taegis_sdk_python/_consts.py

@@ -0,0 +1,66 @@
+"""Taegis Constants."""
+
+from enum import Enum
+
+from multidict import CIMultiDict
+
+TAEGIS_ENVIRONMENT_URLS = CIMultiDict(
+    charlie="https://api.ctpx.secureworks.com",
+    production="https://api.ctpx.secureworks.com",
+    us1="https://api.ctpx.secureworks.com",
+    delta="https://api.delta.taegis.secureworks.com",
+    us2="https://api.delta.taegis.secureworks.com",
+    echo="https://api.echo.taegis.secureworks.com",
+    eu="https://api.echo.taegis.secureworks.com",
+    foxtrot="https://api.foxtrot.taegis.secureworks.com",
+    us3="https://api.foxtrot.taegis.secureworks.com",
+    golf="https://api.golf.taegis.secureworks.com",
+    euw1="https://api.golf.taegis.secureworks.com",
+    hotel="https://api.hotel.taegis.secureworks.com",
+    apse2="https://api.hotel.taegis.secureworks.com",
+    india="https://api.india.taegis.secureworks.com",
+    aps1="https://api.india.taegis.secureworks.com",
+    juliet="https://api.juliet.taegis.secureworks.com",
+    apne1="https://api.juliet.taegis.secureworks.com",
+    kilo="https://api.kilo.taegis.secureworks.com",
+    sae1="https://api.kilo.taegis.secureworks.com",
+    quebec="https://api.quebec.taegis.secureworks.com",
+    cac1="https://api.quebec.taegis.secureworks.com",
+)
+
+
+TAEGIS_TENANTS_URLS = CIMultiDict(
+    charlie="https://api.tenants.ctpx.secureworks.com",
+    production="https://api.tenants.ctpx.secureworks.com",
+    us1="https://api.tenants.ctpx.secureworks.com",
+    delta="https://api-tenants.delta.taegis.secureworks.com",
+    us2="https://api-tenants.delta.taegis.secureworks.com",
+    echo="https://api-tenants.echo.taegis.secureworks.com",
+    eu="https://api-tenants.echo.taegis.secureworks.com",
+    foxtrot="https://api-tenants.foxtrot.taegis.secureworks.com",
+    us3="https://api-tenants.foxtrot.taegis.secureworks.com",
+    golf="https://api-tenants.golf.taegis.secureworks.com",
+    euw1="https://api-tenants.golf.taegis.secureworks.com",
+    hotel="https://api-tenants.hotel.taegis.secureworks.com",
+    apse2="https://api-tenants.hotel.taegis.secureworks.com",
+    india="https://api-tenants.india.taegis.secureworks.com",
+    aps1="https://api-tenants.india.taegis.secureworks.com",
+    juliet="https://api-tenants.juliet.taegis.secureworks.com",
+    apne1="https://api-tenants.juliet.taegis.secureworks.com",
+    kilo="https://api-tenants.kilo.taegis.secureworks.com",
+    sae1="https://api-tenants.kilo.taegis.secureworks.com",
+    quebec="https://api-tenants.quebec.taegis.secureworks.com",
+    cac1="https://api-tenants.quebec.taegis.secureworks.com",
+)
+
+
+UNIVERSAL_ENVIRONMENT = "universal"
+UNIVERSAL_AUTHENTICATION_URL = "https://api.taegis.secureworks.com"
+
+DEFAULT_GATEWAY = "/graphql"
+
+
+class TaegisEnum(str, Enum):
+    """Handler for Unknown Enums."""
+
+    UNKNOWN = "TAEGIS_SDK_PYTHON_UNKNOWN"

{taegis_sdk_python-1.6.17 → taegis_sdk_python-1.6.19}/taegis_sdk_python/_version.py

@@ -1,3 +1,3 @@
 """Version idenitier."""
 
-__version__ = "1.6.17"
+__version__ = "1.6.19"

{taegis_sdk_python-1.6.17 → taegis_sdk_python-1.6.19}/taegis_sdk_python/services/__init__.py

@@ -53,6 +53,7 @@ from taegis_sdk_python.services.events import EventsService
 from taegis_sdk_python.services.exports import ExportsService
 from taegis_sdk_python.services.fast_ioc import FastIocService
 from taegis_sdk_python.services.file_info import FileInfoService
+from taegis_sdk_python.services.health import HealthService
 from taegis_sdk_python.services.ingest_stats import IngestStatsService
 from taegis_sdk_python.services.investigations import InvestigationsService
 from taegis_sdk_python.services.investigations2 import Investigations2Service
@@ -98,7 +99,7 @@ class GraphQLService:
         *,
         environment: Optional[str] = None,
         tenant_id: Optional[str] = None,
-        environments: Optional[Dict[str, str]] = None,
+        environments: Optional[Union[Dict[str, str], CIMultiDict[str, str]]] = None,
         gateway: Optional[str] = None,
         extra_headers: Optional[Dict[str, Any]] = None,
         schema_expiry: int = 5,
@@ -157,7 +158,11 @@ class GraphQLService:
         """
         self.response_headers: CIMultiDictProxy[str] = CIMultiDictProxy(CIMultiDict())
 
-        self._environments = environments or TAEGIS_ENVIRONMENT_URLS
+        if not environments:
+            self._environments = TAEGIS_ENVIRONMENT_URLS
+        else:
+            self._environments = CIMultiDict(environments)
+
         self._environment = environment or list(self._environments)[0]
         self._use_universal_authentication = use_universal_authentication
 
@@ -220,6 +225,7 @@ class GraphQLService:
         self._events = None
         self._exports = None
         self._fast_ioc = None
+        self._health = None
         self._file_info = None
         self._ingest_stats = None
         self._investigations = None
@@ -686,6 +692,13 @@ class GraphQLService:
             self._fast_ioc = FastIocService(self)
         return self._fast_ioc
 
+    @property
+    def health(self):
+        """Health Service Endpoint."""
+        if not self._health:
+            self._health = HealthService(self)
+        return self._health
+
     @property
     def file_info(self):
         """FileInfo Service Endpoint."""

{taegis_sdk_python-1.6.17 → taegis_sdk_python-1.6.19}/taegis_sdk_python/services/alerts/types.py

@@ -36,6 +36,7 @@ class ResolutionStatus(str, Enum):
     OTHER = "OTHER"
     SUPPRESSED = "SUPPRESSED"
     AUTO_CLOSE = "AUTO_CLOSE"
+    DISMISSED = "DISMISSED"
 
 
 class Origin(str, Enum):

{taegis_sdk_python-1.6.17 → taegis_sdk_python-1.6.19}/taegis_sdk_python/services/assets2/types.py

@@ -405,11 +405,32 @@ class TagV2:
         default=None, metadata=config(field_name="updatedAt")
     )
     tag: Optional[str] = field(default=None, metadata=config(field_name="tag"))
-    key: Optional[str] = field(default=None, metadata=config(field_name="key"))
-    value: Optional[str] = field(default=None, metadata=config(field_name="value"))
+    key: Optional[str] = field(
+        default=None,
+        metadata=config(
+            metadata={
+                "deprecated": True,
+                "deprecation_reason": "Use the tag field instead. Key/value separation is inconsistent across endpoint types.",
+            },
+            field_name="key",
+        ),
+    )
+    value: Optional[str] = field(
+        default=None,
+        metadata=config(
+            metadata={
+                "deprecated": True,
+                "deprecation_reason": "Use the tag field instead. Key/value separation is inconsistent across endpoint types.",
+            },
+            field_name="value",
+        ),
+    )
     is_vendor_tag: Optional[bool] = field(
         default=None, metadata=config(field_name="isVendorTag")
     )
+    is_sophos_tag: Optional[bool] = field(
+        default=None, metadata=config(field_name="isSophosTag")
+    )
 
 
 @dataclass_json

{taegis_sdk_python-1.6.17 → taegis_sdk_python-1.6.19}/taegis_sdk_python/services/contracted_endpoint/queries.py

@@ -56,6 +56,10 @@ class TaegisSDKContractedEndpointQuery:
         """No developer notes."""
         endpoint = "projectIRHoursForTenantID"
 
+        log.warning(
+            f"GraphQL Query `{endpoint}` is deprecated: 'Use endpointCountForTenantID instead. Planned removal: 2026-09-01'"
+        )
+
         result = self.service.execute_query(endpoint=endpoint, variables={}, output="")
         if result.get(endpoint) is not None:
             return result.get(endpoint)

{taegis_sdk_python-1.6.17 → taegis_sdk_python-1.6.19}/taegis_sdk_python/services/contracted_endpoint/types.py

@@ -40,7 +40,14 @@ class ContractedEndpoints:
         default=None, metadata=config(field_name="endpointCount")
     )
     service: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="service")
+        default=None,
+        metadata=config(
+            metadata={
+                "deprecated": True,
+                "deprecation_reason": "Service list is best-effort only and may be empty if tenant service lookup fails.",
+            },
+            field_name="service",
+        ),
     )
     service_date: Optional[str] = field(
         default=None, metadata=config(field_name="serviceDate")

{taegis_sdk_python-1.6.17 → taegis_sdk_python-1.6.19}/taegis_sdk_python/services/event_stats/queries.py

@@ -36,6 +36,10 @@ class TaegisSDKEventStatsQuery:
         """Get effective agents count for the given tenant and time range."""
         endpoint = "effectiveAgents"
 
+        log.warning(
+            f"GraphQL Query `{endpoint}` is deprecated: 'Use `eventStatsQuery` instead'"
+        )
+
         result = self.service.execute_query(
             endpoint=endpoint,
             variables={

{taegis_sdk_python-1.6.17 → taegis_sdk_python-1.6.19}/taegis_sdk_python/services/events/types.py

@@ -172,6 +172,9 @@ class EventFetchOptions:
     normalize_event_keys: Optional[bool] = field(
         default=None, metadata=config(field_name="normalizeEventKeys")
     )
+    metadata: Optional[dict] = field(
+        default=None, metadata=config(field_name="metadata")
+    )
     backend_strategy: Optional[BackendStrategy] = field(
         default=None, metadata=config(field_name="backendStrategy")
     )

taegis_sdk_python-1.6.19/taegis_sdk_python/services/health/__init__.py

@@ -0,0 +1,35 @@
+"""Health Service."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from taegis_sdk_python.service_core import ServiceCore
+from taegis_sdk_python.services.health.mutations import TaegisSDKHealthMutation
+from taegis_sdk_python.services.health.queries import TaegisSDKHealthQuery
+from taegis_sdk_python.services.health.subscriptions import TaegisSDKHealthSubscription
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services import GraphQLService
+
+
+class HealthService(ServiceCore):
+    """Taegis Health Service."""
+
+    @property
+    def query(self):
+        if not self._queries:
+            self._queries = TaegisSDKHealthQuery(self)
+        return self._queries
+
+    @property
+    def mutation(self):
+        if not self._mutations:
+            self._mutations = TaegisSDKHealthMutation(self)
+        return self._mutations
+
+    @property
+    def subscription(self):
+        if not self._subscriptions:
+            self._subscriptions = TaegisSDKHealthSubscription(self)
+        return self._subscriptions

taegis_sdk_python-1.6.19/taegis_sdk_python/services/health/mutations.py

@@ -0,0 +1,54 @@
+"""Health Mutation."""
+
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python._consts import TaegisEnum
+from taegis_sdk_python.services.health.types import *
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.health import HealthService
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKHealthMutation:
+    """Taegis Health Mutation operations."""
+
+    def __init__(self, service: HealthService):
+        self.service = service
+
+    def ndr_health_clear_health_status(
+        self, device_name: str, alert_name: str
+    ) -> NDRHealthStatus:
+        """Clear Health Alert."""
+        endpoint = "ndrHealthClearHealthStatus"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "deviceName": prepare_input(device_name),
+                "alertName": prepare_input(alert_name),
+            },
+            output=build_output_string(
+                NDRHealthStatus,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return NDRHealthStatus.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for mutation ndrHealthClearHealthStatus")

taegis_sdk_python-1.6.19/taegis_sdk_python/services/health/queries.py

@@ -0,0 +1,111 @@
+"""Health Query."""
+
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python._consts import TaegisEnum
+from taegis_sdk_python.services.health.types import *
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.health import HealthService
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKHealthQuery:
+    """Taegis Health Query operations."""
+
+    def __init__(self, service: HealthService):
+        self.service = service
+
+    def ndr_health_last_event(self, device_name: str) -> NDRHealthLastEvents:
+        """Query to get event timestamps."""
+        endpoint = "ndrHealthLastEvent"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "deviceName": prepare_input(device_name),
+            },
+            output=build_output_string(
+                NDRHealthLastEvents,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return NDRHealthLastEvents.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query ndrHealthLastEvent")
+
+    def ndr_health_status(self, device_name: str) -> List[NDRHealthStatus]:
+        """Query to get health status of a device."""
+        endpoint = "ndrHealthStatus"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "deviceName": prepare_input(device_name),
+            },
+            output=build_output_string(
+                NDRHealthStatus,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return NDRHealthStatus.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query ndrHealthStatus")
+
+    def ndr_health_statuses(self) -> List[NDRHealthStatuses]:
+        """Query to get list of devices with health status of each device."""
+        endpoint = "ndrHealthStatuses"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={},
+            output=build_output_string(
+                NDRHealthStatuses,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return NDRHealthStatuses.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query ndrHealthStatuses")
+
+    def ndr_health_metrics(
+        self, ndr_health_metrics_query: NDRHealthMetricsQuery
+    ) -> List[NDRHealthMetricsResponse]:
+        """Query to get health metrics of a device for the requested type."""
+        endpoint = "ndrHealthMetrics"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "ndrHealthMetricsQuery": prepare_input(ndr_health_metrics_query),
+            },
+            output=build_output_string(
+                NDRHealthMetricsResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return NDRHealthMetricsResponse.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query ndrHealthMetrics")

taegis_sdk_python-1.6.19/taegis_sdk_python/services/health/subscriptions.py

@@ -0,0 +1,33 @@
+"""Health Subscription."""
+
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python._consts import TaegisEnum
+from taegis_sdk_python.services.health.types import *
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.health import HealthService
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKHealthSubscription:
+    """Taegis Health Subscription operations."""
+
+    def __init__(self, service: HealthService):
+        self.service = service

taegis_sdk_python-1.6.19/taegis_sdk_python/services/health/types.py

@@ -0,0 +1,174 @@
+"""Health Types and Enums."""
+
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code
+
+# Autogenerated
+# DO NOT MODIFY
+
+from dataclasses import dataclass, field
+from enum import Enum
+from typing import Any, Dict, List, Optional, Tuple, Union
+
+from dataclasses_json import config, dataclass_json
+
+from taegis_sdk_python._consts import TaegisEnum
+from taegis_sdk_python.utils import decode_enum, encode_enum, parse_union_result
+
+
+class NdrHealthState(str, Enum):
+    """NdrHealthState."""
+
+    UP = "UP"
+    DOWN = "DOWN"
+    WARNING = "WARNING"
+
+
+class OverAllHealthState(str, Enum):
+    """OverAllHealthState."""
+
+    HEALTHY = "HEALTHY"
+    WARNING = "WARNING"
+    NODATA = "NODATA"
+
+
+class NdrHealthMetricName(str, Enum):
+    """NdrHealthMetricName."""
+
+    MEMORY_USAGE = "MEMORY_USAGE"
+    CPU_UTILIZATION = "CPU_UTILIZATION"
+    DISK_USAGE = "DISK_USAGE"
+    NETWORK_INTERFACE_ERRORS = "NETWORK_INTERFACE_ERRORS"
+    NETWORK_INTERFACE_PACKETS = "NETWORK_INTERFACE_PACKETS"
+    NETWORK_INTERFACE_THROUGHPUT = "NETWORK_INTERFACE_THROUGHPUT"
+    IPS_ENGINE_EVENTS = "IPS_ENGINE_EVENTS"
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class NDRHealthMetric:
+    """NDRHealthMetric."""
+
+    time: Optional[str] = field(default=None, metadata=config(field_name="time"))
+    value: Optional[float] = field(default=None, metadata=config(field_name="value"))
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class NDRHealthLastEvents:
+    """NDRHealthLastEvents."""
+
+    heartbeat: Optional[str] = field(
+        default=None, metadata=config(field_name="heartbeat")
+    )
+    security: Optional[str] = field(
+        default=None, metadata=config(field_name="security")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class NDRHealthMetricsQuery:
+    """NDRHealthMetricsQuery."""
+
+    device_name: Optional[str] = field(
+        default=None, metadata=config(field_name="deviceName")
+    )
+    start_time: Optional[str] = field(
+        default=None, metadata=config(field_name="startTime")
+    )
+    end_time: Optional[str] = field(default=None, metadata=config(field_name="endTime"))
+    data_interval: Optional[str] = field(
+        default=None, metadata=config(field_name="dataInterval")
+    )
+    metric_name: Optional[Union[NdrHealthMetricName, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(NdrHealthMetricName, x),
+            field_name="metricName",
+        ),
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class NDRHealthMetricSeries:
+    """NDRHealthMetricSeries."""
+
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    min: Optional[float] = field(default=None, metadata=config(field_name="min"))
+    max: Optional[float] = field(default=None, metadata=config(field_name="max"))
+    avg: Optional[float] = field(default=None, metadata=config(field_name="avg"))
+    last: Optional[float] = field(default=None, metadata=config(field_name="last"))
+    metric_series: Optional[List[NDRHealthMetric]] = field(
+        default=None, metadata=config(field_name="metricSeries")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class NDRHealthMetrics:
+    """NDRHealthMetrics."""
+
+    metric_name: Optional[str] = field(
+        default=None, metadata=config(field_name="metricName")
+    )
+    metrics_list: Optional[List[NDRHealthMetricSeries]] = field(
+        default=None, metadata=config(field_name="metricsList")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class NDRHealthMetricsResponse:
+    """NDRHealthMetricsResponse."""
+
+    metrics: Optional[List[NDRHealthMetrics]] = field(
+        default=None, metadata=config(field_name="metrics")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class NDRHealthStatus:
+    """NDRHealthStatus."""
+
+    alert_name: Optional[str] = field(
+        default=None, metadata=config(field_name="alertName")
+    )
+    timestamp: Optional[str] = field(
+        default=None, metadata=config(field_name="timestamp")
+    )
+    tenant_id: Optional[int] = field(
+        default=None, metadata=config(field_name="tenantId")
+    )
+    details: Optional[str] = field(default=None, metadata=config(field_name="details"))
+    status: Optional[Union[NdrHealthState, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(NdrHealthState, x),
+            field_name="status",
+        ),
+    )
+    over_allstatus: Optional[Union[OverAllHealthState, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(OverAllHealthState, x),
+            field_name="overAllstatus",
+        ),
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class NDRHealthStatuses:
+    """NDRHealthStatuses."""
+
+    device_name: Optional[str] = field(
+        default=None, metadata=config(field_name="deviceName")
+    )
+    health_status: Optional[List[NDRHealthStatus]] = field(
+        default=None, metadata=config(field_name="healthStatus")
+    )