taegis-sdk-python 1.6.1__tar.gz → 1.6.2__tar.gz

{taegis_sdk_python-1.6.1 → taegis_sdk_python-1.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.6.1
+Version: 1.6.2
 Summary: Taegis Python SDK
 Project-URL: Homepage, https://github.com/secureworks/taegis-sdk-python
 Project-URL: Bug Reports, https://github.com/secureworks/taegis-sdk-python/issues
@@ -197,7 +197,7 @@ Requires-Dist: aiohttp
 Requires-Dist: backoff
 Requires-Dist: dataclasses-json
 Requires-Dist: filelock>=3.12.4
-Requires-Dist: gql<4,>=3.5.0
+Requires-Dist: gql>=4
 Requires-Dist: graphql-core
 Requires-Dist: jinja2
 Requires-Dist: oauthlib

{taegis_sdk_python-1.6.1 → taegis_sdk_python-1.6.2}/pyproject.toml

@@ -24,7 +24,7 @@ dependencies = [
     "aiohttp",
     "dataclasses-json",
     "filelock>=3.12.4",
-    "gql>=3.5.0,<4",
+    "gql>=4",
     "graphql-core",
     "oauthlib",
     "pyjwt>=2.8.0",

{taegis_sdk_python-1.6.1 → taegis_sdk_python-1.6.2}/taegis_sdk_python/_version.py

@@ -1,3 +1,3 @@
 """Version idenitier."""
 
-__version__ = "1.6.1"
+__version__ = "1.6.2"

{taegis_sdk_python-1.6.1 → taegis_sdk_python-1.6.2}/taegis_sdk_python/middlewares/utils.py

@@ -23,7 +23,7 @@ def scrub_dict(d: Mapping):
     access_tokens = get_access_tokens()
 
     if "authorization" in d:
-        token = d["Authorization"].replace("Bearer ")
+        token = d["Authorization"].replace("Bearer ", "")
         access_tokens.append(token)
 
     scrubbed = d.copy()

{taegis_sdk_python-1.6.1 → taegis_sdk_python-1.6.2}/taegis_sdk_python/service_core.py

@@ -10,14 +10,14 @@ import threading
 from datetime import datetime, timedelta
 from typing import TYPE_CHECKING, Any, Dict, List, Optional, Union
 
-from gql import Client, gql
+from gql import Client, GraphQLRequest
 from gql.transport import Transport
 from gql.transport.aiohttp import AIOHTTPTransport
+from gql.transport.aiohttp_websockets import AIOHTTPWebsocketsTransport
 from graphql import GraphQLError, GraphQLField, GraphQLSchema
 
 from taegis_sdk_python._version import __version__
 from taegis_sdk_python.errors import InvalidGraphQLEndpoint
-from taegis_sdk_python.transport.aiohttp_websockets import AIOHTTPWebsocketsTransport
 from taegis_sdk_python.utils import async_block, prepare_variables, remove_node
 
 if TYPE_CHECKING:  # pragma: no cover
@@ -497,13 +497,22 @@ class ServiceCore:
                 }
             )
 
-        query = gql(query_string)
-        return await self.sync_client.execute_async(
-            query,
+        graphql_request = GraphQLRequest(
+            request=query_string,
             variable_values=prepare_variables(variables),
+        )
+
+        client = self.sync_client
+
+        response = await client.execute_async(
+            graphql_request,
             extra_args=extra_args,
         )
 
+        self.service.response_headers = client.transport.response_headers
+
+        return response
+
     @async_block
     async def subscribe(
         self, query_string: str, variables: Optional[Dict[str, Any]] = None
@@ -522,15 +531,21 @@ class ServiceCore:
         List[Any]
             List of subscription results
         """
-        query = gql(query_string)
+        graphql_request = GraphQLRequest(
+            request=query_string,
+            variable_values=prepare_variables(variables),
+        )
+
         results = []
-        async with self.ws_client as session:
-            async for result in session.subscribe(
-                query,
-                variable_values=prepare_variables(variables),
-            ):
+
+        client = self.ws_client
+
+        async with client as session:
+            async for result in session.subscribe(graphql_request):
                 results.append(result)
 
+        self.service.response_headers = client.transport.response_headers
+
         return results[:-1]
 
     @async_block
@@ -576,7 +591,7 @@ class ServiceCore:
             # output string is valid
             for _ in range(10000):
                 try:
-                    session.client.validate(gql(query_string))
+                    session.client.validate(GraphQLRequest(request=query_string))
                     break
 
                 except GraphQLError as exc:

{taegis_sdk_python-1.6.1 → taegis_sdk_python-1.6.2}/taegis_sdk_python/services/__init__.py

@@ -4,12 +4,14 @@ Taegis SDK Python GraphQL Service manager.
 
 import logging
 import threading
+from collections.abc import Mapping
 from ssl import SSLContext
 from typing import Any, Dict, Literal, Optional, Union
 
 import aiohttp
 from aiohttp.client_reqrep import Fingerprint
 from aiohttp.typedefs import LooseHeaders
+from multidict import CIMultiDict, CIMultiDictProxy
 
 from taegis_sdk_python._consts import (
     TAEGIS_ENVIRONMENT_URLS,
@@ -102,6 +104,7 @@ class GraphQLService:
         max_message_size: int = 0,
         use_universal_authentication: bool = False,
         middlewares=None,
+        reuse_request_id=False,
     ):  # pylint: disable=too-many-statements
         """
         GraphQLService
@@ -144,6 +147,8 @@ class GraphQLService:
         ValueError
             environment must be charlie, delta, echo, or foxtrot (or equivalent)
         """
+        self.response_headers: CIMultiDictProxy[str] = CIMultiDictProxy(CIMultiDict())
+
         self._environments = environments or TAEGIS_ENVIRONMENT_URLS
         self._environment = environment or list(self._environments)[0]
         self._use_universal_authentication = use_universal_authentication
@@ -177,6 +182,7 @@ class GraphQLService:
         self._execute_timeout = execute_timeout
         self._max_message_size = max_message_size
         self._middlewares = middlewares or ()
+        self._reuse_request_id = reuse_request_id
 
         self._access_points = None
         self._agent = None
@@ -231,6 +237,37 @@ class GraphQLService:
         self._vdr = None
         self._xdr_central_connector = None
 
+    def __eq__(self, other):
+        """Compare equality of a GraphQLService.
+
+        As the GraphQService is a network service, equality is limited to the
+        context in which a request will be made.
+        """
+        if isinstance(other, GraphQLService):
+            return (
+                self.tenant_id == other.tenant_id
+                and self._environments[self.environment]
+                == other._environments[other.environment]
+                and self.url == other.url
+                and self.gateway == other.gateway
+            )
+        return NotImplemented
+
+    def __hash__(self):
+        """Hash of a GraphQLService.
+
+        As the GraphQService is a network service, hash values are limited to the
+        context in which a request will be made.
+        """
+        return hash(
+            (
+                self.tenant_id,
+                self._environments[self.environment],
+                self.url,
+                self.gateway,
+            )
+        )
+
     def __call__(self, **kwargs):
         if threading.get_ident() not in self._context_kwargs:
             self._context_kwargs[threading.get_ident()] = []
@@ -313,6 +350,11 @@ class GraphQLService:
         """Taegis Tenant Context."""
         return self._context_manager.get("tenant_id", self._tenant_id)
 
+    @property
+    def reuse_request_id(self):
+        """Reuse Previous Taegis X-Request-Id in response_headers."""
+        return self._context_manager.get("reuse_request_id", self._reuse_request_id)
+
     @property
     def access_token(self):
         """Taegis Access Token."""
@@ -357,6 +399,13 @@ class GraphQLService:
         if self.tenant_id:
             headers["X-Tenant-Context"] = self.tenant_id
 
+        if (
+            self.reuse_request_id
+            and isinstance(self.response_headers, Mapping)
+            and (x_request_id := self.response_headers.get("X-Request-Id"))
+        ):
+            headers["X-Amzn-Trace-Id"] = x_request_id
+
         headers.update(self.extra_headers)
 
         return headers

{taegis_sdk_python-1.6.1 → taegis_sdk_python-1.6.2}/taegis_sdk_python/services/assets2/types.py

@@ -108,6 +108,8 @@ class AssetSearchOrderByInputV2(str, Enum):
     VULNERABILITY_STATUS_DESC = "vulnerability_status_desc"
     VENDOR_PROVIDED_HEALTH_ASC = "vendor_provided_health_asc"
     VENDOR_PROVIDED_HEALTH_DESC = "vendor_provided_health_desc"
+    VENDOR_PROVIDED_HEALTH_RAW_ASC = "vendor_provided_health_raw_asc"
+    VENDOR_PROVIDED_HEALTH_RAW_DESC = "vendor_provided_health_raw_desc"
     USERNAME_ASC = "username_asc"
     USERNAME_DESC = "username_desc"
     REBOOT_REQUIRED_ASC = "reboot_required_asc"
@@ -118,6 +120,8 @@ class AssetSearchOrderByInputV2(str, Enum):
     BIOS_SERIAL_DESC = "bios_serial_desc"
     FIRST_DISK_SERIAL_ASC = "first_disk_serial_asc"
     FIRST_DISK_SERIAL_DESC = "first_disk_serial_desc"
+    PENDING_UNINSTALL_ASC = "pending_uninstall_asc"
+    PENDING_UNINSTALL_DESC = "pending_uninstall_desc"
 
 
 class AssetHostnameSearchOrderByInput(str, Enum):
@@ -1208,6 +1212,9 @@ class AssetWhereInputV2:
     sensor_version: Optional[str] = field(
         default=None, metadata=config(field_name="sensorVersion")
     )
+    vendor_provided_health_raw: Optional[str] = field(
+        default=None, metadata=config(field_name="vendorProvidedHealthRaw")
+    )
     system_type: Optional[str] = field(
         default=None, metadata=config(field_name="systemType")
     )
@@ -1250,6 +1257,12 @@ class AssetWhereInputV2:
     reboot_required: Optional[bool] = field(
         default=None, metadata=config(field_name="rebootRequired")
     )
+    agent_mode: Optional[str] = field(
+        default=None, metadata=config(field_name="agentMode")
+    )
+    pending_uninstall: Optional[bool] = field(
+        default=None, metadata=config(field_name="pendingUninstall")
+    )
     and_: Optional[List["AssetWhereInputV2"]] = field(
         default=None, metadata=config(field_name="and")
     )
@@ -1408,9 +1421,18 @@ class AssetV2:
     uninstall: Optional[bool] = field(
         default=None, metadata=config(field_name="uninstall")
     )
+    vendor_provided_health_raw: Optional[str] = field(
+        default=None, metadata=config(field_name="vendorProvidedHealthRaw")
+    )
     reboot_required: Optional[bool] = field(
         default=None, metadata=config(field_name="rebootRequired")
     )
+    agent_mode: Optional[str] = field(
+        default=None, metadata=config(field_name="agentMode")
+    )
+    pending_uninstall: Optional[bool] = field(
+        default=None, metadata=config(field_name="pendingUninstall")
+    )
     hostnames: Optional[List[HostnameV2]] = field(
         default=None, metadata=config(field_name="hostnames")
     )

{taegis_sdk_python-1.6.1 → taegis_sdk_python-1.6.2}/taegis_sdk_python/services/entity_context/types.py

@@ -955,6 +955,7 @@ class EntityContextEntity:
 
     id: Optional[str] = field(default=None, metadata=config(field_name="id"))
     type: Optional[str] = field(default=None, metadata=config(field_name="type"))
+    subtype: Optional[str] = field(default=None, metadata=config(field_name="subtype"))
     first_seen: Optional[str] = field(
         default=None, metadata=config(field_name="firstSeen")
     )

{taegis_sdk_python-1.6.1 → taegis_sdk_python-1.6.2}/taegis_sdk_python/services/investigations2/types.py

@@ -2431,68 +2431,6 @@ class CommentsV2Arguments:
     )
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class CaseTemplate:
-    """CaseTemplate."""
-
-    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
-    created_by_id: Optional[str] = field(
-        default=None, metadata=config(field_name="createdById")
-    )
-    created_at: Optional[str] = field(
-        default=None, metadata=config(field_name="createdAt")
-    )
-    updated_by_id: Optional[str] = field(
-        default=None, metadata=config(field_name="updatedById")
-    )
-    updated_at: Optional[str] = field(
-        default=None, metadata=config(field_name="updatedAt")
-    )
-    tenant_id: Optional[str] = field(
-        default=None, metadata=config(field_name="tenantId")
-    )
-    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
-    title: Optional[str] = field(default=None, metadata=config(field_name="title"))
-    description: Optional[str] = field(
-        default=None, metadata=config(field_name="description")
-    )
-    tags: Optional[List[str]] = field(default=None, metadata=config(field_name="tags"))
-    case_type: Optional[str] = field(
-        default=None, metadata=config(field_name="caseType")
-    )
-    case_priority: Optional[str] = field(
-        default=None, metadata=config(field_name="casePriority")
-    )
-    case_title: Optional[str] = field(
-        default=None, metadata=config(field_name="caseTitle")
-    )
-    case_tags: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="caseTags")
-    )
-    case_key_findings: Optional[str] = field(
-        default=None, metadata=config(field_name="caseKeyFindings")
-    )
-    case_key_findings_prompts: Optional[List[str]] = field(
-        default=None, metadata=config(field_name="caseKeyFindingsPrompts")
-    )
-    case_assignee: Optional[str] = field(
-        default=None, metadata=config(field_name="caseAssignee")
-    )
-    case_secondary_status: Optional[str] = field(
-        default=None, metadata=config(field_name="caseSecondaryStatus")
-    )
-    created_by_subject: Optional[Subject] = field(
-        default=None, metadata=config(field_name="createdBySubject")
-    )
-    updated_by_subject: Optional[Subject] = field(
-        default=None, metadata=config(field_name="updatedBySubject")
-    )
-    case_assignee_subject: Optional[Subject] = field(
-        default=None, metadata=config(field_name="caseAssigneeSubject")
-    )
-
-
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class CaseProcessingStatus:
@@ -2793,6 +2731,79 @@ class CaseEvidence:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class CaseTemplate:
+    """CaseTemplate."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    created_by_id: Optional[str] = field(
+        default=None, metadata=config(field_name="createdById")
+    )
+    created_at: Optional[str] = field(
+        default=None, metadata=config(field_name="createdAt")
+    )
+    updated_by_id: Optional[str] = field(
+        default=None, metadata=config(field_name="updatedById")
+    )
+    updated_at: Optional[str] = field(
+        default=None, metadata=config(field_name="updatedAt")
+    )
+    tenant_id: Optional[str] = field(
+        default=None, metadata=config(field_name="tenantId")
+    )
+    name: Optional[str] = field(default=None, metadata=config(field_name="name"))
+    title: Optional[str] = field(default=None, metadata=config(field_name="title"))
+    description: Optional[str] = field(
+        default=None, metadata=config(field_name="description")
+    )
+    tags: Optional[List[str]] = field(default=None, metadata=config(field_name="tags"))
+    case_type: Optional[str] = field(
+        default=None, metadata=config(field_name="caseType")
+    )
+    case_priority: Optional[str] = field(
+        default=None, metadata=config(field_name="casePriority")
+    )
+    case_title: Optional[str] = field(
+        default=None, metadata=config(field_name="caseTitle")
+    )
+    case_tags: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="caseTags")
+    )
+    case_key_findings: Optional[str] = field(
+        default=None, metadata=config(field_name="caseKeyFindings")
+    )
+    case_key_findings_prompts: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="caseKeyFindingsPrompts")
+    )
+    case_assignee: Optional[str] = field(
+        default=None, metadata=config(field_name="caseAssignee")
+    )
+    case_secondary_status: Optional[str] = field(
+        default=None, metadata=config(field_name="caseSecondaryStatus")
+    )
+    is_shared_with_child_tenants: Optional[bool] = field(
+        default=None, metadata=config(field_name="isSharedWithChildTenants")
+    )
+    created_by_subject: Optional[Subject] = field(
+        default=None, metadata=config(field_name="createdBySubject")
+    )
+    updated_by_subject: Optional[Subject] = field(
+        default=None, metadata=config(field_name="updatedBySubject")
+    )
+    case_assignee_subject: Optional[Subject] = field(
+        default=None, metadata=config(field_name="caseAssigneeSubject")
+    )
+    usages: Optional[List[Union[TemplateUsage, TaegisEnum]]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(TemplateUsage, x),
+            field_name="usages",
+        ),
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class CaseRule:

{taegis_sdk_python-1.6.1 → taegis_sdk_python-1.6.2}/taegis_sdk_python/services/tenants4/types.py

@@ -133,6 +133,9 @@ class MappedTenant:
     xdr_ownership: Optional[str] = field(
         default=None, metadata=config(field_name="xdrOwnership")
     )
+    hydrate_to: Optional[str] = field(
+        default=None, metadata=config(field_name="hydrateTo")
+    )
     last_refresh: Optional[str] = field(
         default=None, metadata=config(field_name="lastRefresh")
     )

{taegis_sdk_python-1.6.1 → taegis_sdk_python-1.6.2}/taegis_sdk_python/services/threat/types.py

@@ -53,6 +53,7 @@ class ThreatFacetObject(str, Enum):
     THREAT_GROUP = "threat_group"
     MALWARE = "malware"
     REPORT = "report"
+    ALL = "all"
 
 
 class ThreatParentType(str, Enum):