taegis-sdk-python 1.6.1__tar.gz → 1.6.3__tar.gz

{taegis_sdk_python-1.6.1 → taegis_sdk_python-1.6.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.6.1
+Version: 1.6.3
 Summary: Taegis Python SDK
 Project-URL: Homepage, https://github.com/secureworks/taegis-sdk-python
 Project-URL: Bug Reports, https://github.com/secureworks/taegis-sdk-python/issues
@@ -197,7 +197,7 @@ Requires-Dist: aiohttp
 Requires-Dist: backoff
 Requires-Dist: dataclasses-json
 Requires-Dist: filelock>=3.12.4
-Requires-Dist: gql<4,>=3.5.0
+Requires-Dist: gql>=4
 Requires-Dist: graphql-core
 Requires-Dist: jinja2
 Requires-Dist: oauthlib

{taegis_sdk_python-1.6.1 → taegis_sdk_python-1.6.3}/pyproject.toml

@@ -24,7 +24,7 @@ dependencies = [
     "aiohttp",
     "dataclasses-json",
     "filelock>=3.12.4",
-    "gql>=3.5.0,<4",
+    "gql>=4",
     "graphql-core",
     "oauthlib",
     "pyjwt>=2.8.0",

{taegis_sdk_python-1.6.1 → taegis_sdk_python-1.6.3}/taegis_sdk_python/_version.py

@@ -1,3 +1,3 @@
 """Version idenitier."""
 
-__version__ = "1.6.1"
+__version__ = "1.6.3"

{taegis_sdk_python-1.6.1 → taegis_sdk_python-1.6.3}/taegis_sdk_python/middlewares/utils.py

@@ -23,7 +23,7 @@ def scrub_dict(d: Mapping):
     access_tokens = get_access_tokens()
 
     if "authorization" in d:
-        token = d["Authorization"].replace("Bearer ")
+        token = d["Authorization"].replace("Bearer ", "")
         access_tokens.append(token)
 
     scrubbed = d.copy()

{taegis_sdk_python-1.6.1 → taegis_sdk_python-1.6.3}/taegis_sdk_python/service_core.py

@@ -10,14 +10,14 @@ import threading
 from datetime import datetime, timedelta
 from typing import TYPE_CHECKING, Any, Dict, List, Optional, Union
 
-from gql import Client, gql
+from gql import Client, GraphQLRequest
 from gql.transport import Transport
 from gql.transport.aiohttp import AIOHTTPTransport
+from gql.transport.aiohttp_websockets import AIOHTTPWebsocketsTransport
 from graphql import GraphQLError, GraphQLField, GraphQLSchema
 
 from taegis_sdk_python._version import __version__
 from taegis_sdk_python.errors import InvalidGraphQLEndpoint
-from taegis_sdk_python.transport.aiohttp_websockets import AIOHTTPWebsocketsTransport
 from taegis_sdk_python.utils import async_block, prepare_variables, remove_node
 
 if TYPE_CHECKING:  # pragma: no cover
@@ -497,13 +497,22 @@ class ServiceCore:
                 }
             )
 
-        query = gql(query_string)
-        return await self.sync_client.execute_async(
-            query,
+        graphql_request = GraphQLRequest(
+            request=query_string,
             variable_values=prepare_variables(variables),
+        )
+
+        client = self.sync_client
+
+        response = await client.execute_async(
+            graphql_request,
             extra_args=extra_args,
         )
 
+        self.service.response_headers = client.transport.response_headers
+
+        return response
+
     @async_block
     async def subscribe(
         self, query_string: str, variables: Optional[Dict[str, Any]] = None
@@ -522,15 +531,21 @@ class ServiceCore:
         List[Any]
             List of subscription results
         """
-        query = gql(query_string)
+        graphql_request = GraphQLRequest(
+            request=query_string,
+            variable_values=prepare_variables(variables),
+        )
+
         results = []
-        async with self.ws_client as session:
-            async for result in session.subscribe(
-                query,
-                variable_values=prepare_variables(variables),
-            ):
+
+        client = self.ws_client
+
+        async with client as session:
+            async for result in session.subscribe(graphql_request):
                 results.append(result)
 
+        self.service.response_headers = client.transport.response_headers
+
         return results[:-1]
 
     @async_block
@@ -576,7 +591,7 @@ class ServiceCore:
             # output string is valid
             for _ in range(10000):
                 try:
-                    session.client.validate(gql(query_string))
+                    session.client.validate(GraphQLRequest(request=query_string))
                     break
 
                 except GraphQLError as exc:

{taegis_sdk_python-1.6.1 → taegis_sdk_python-1.6.3}/taegis_sdk_python/services/__init__.py

@@ -4,12 +4,14 @@ Taegis SDK Python GraphQL Service manager.
 
 import logging
 import threading
+from collections.abc import Mapping
 from ssl import SSLContext
 from typing import Any, Dict, Literal, Optional, Union
 
 import aiohttp
 from aiohttp.client_reqrep import Fingerprint
 from aiohttp.typedefs import LooseHeaders
+from multidict import CIMultiDict, CIMultiDictProxy
 
 from taegis_sdk_python._consts import (
     TAEGIS_ENVIRONMENT_URLS,
@@ -102,6 +104,7 @@ class GraphQLService:
         max_message_size: int = 0,
         use_universal_authentication: bool = False,
         middlewares=None,
+        reuse_request_id=False,
     ):  # pylint: disable=too-many-statements
         """
         GraphQLService
@@ -144,6 +147,8 @@ class GraphQLService:
         ValueError
             environment must be charlie, delta, echo, or foxtrot (or equivalent)
         """
+        self.response_headers: CIMultiDictProxy[str] = CIMultiDictProxy(CIMultiDict())
+
         self._environments = environments or TAEGIS_ENVIRONMENT_URLS
         self._environment = environment or list(self._environments)[0]
         self._use_universal_authentication = use_universal_authentication
@@ -177,6 +182,7 @@ class GraphQLService:
         self._execute_timeout = execute_timeout
         self._max_message_size = max_message_size
         self._middlewares = middlewares or ()
+        self._reuse_request_id = reuse_request_id
 
         self._access_points = None
         self._agent = None
@@ -231,6 +237,37 @@ class GraphQLService:
         self._vdr = None
         self._xdr_central_connector = None
 
+    def __eq__(self, other):
+        """Compare equality of a GraphQLService.
+
+        As the GraphQService is a network service, equality is limited to the
+        context in which a request will be made.
+        """
+        if isinstance(other, GraphQLService):
+            return (
+                self.tenant_id == other.tenant_id
+                and self._environments[self.environment]
+                == other._environments[other.environment]
+                and self.url == other.url
+                and self.gateway == other.gateway
+            )
+        return NotImplemented
+
+    def __hash__(self):
+        """Hash of a GraphQLService.
+
+        As the GraphQService is a network service, hash values are limited to the
+        context in which a request will be made.
+        """
+        return hash(
+            (
+                self.tenant_id,
+                self._environments[self.environment],
+                self.url,
+                self.gateway,
+            )
+        )
+
     def __call__(self, **kwargs):
         if threading.get_ident() not in self._context_kwargs:
             self._context_kwargs[threading.get_ident()] = []
@@ -313,6 +350,11 @@ class GraphQLService:
         """Taegis Tenant Context."""
         return self._context_manager.get("tenant_id", self._tenant_id)
 
+    @property
+    def reuse_request_id(self):
+        """Reuse Previous Taegis X-Request-Id in response_headers."""
+        return self._context_manager.get("reuse_request_id", self._reuse_request_id)
+
     @property
     def access_token(self):
         """Taegis Access Token."""
@@ -357,6 +399,13 @@ class GraphQLService:
         if self.tenant_id:
             headers["X-Tenant-Context"] = self.tenant_id
 
+        if (
+            self.reuse_request_id
+            and isinstance(self.response_headers, Mapping)
+            and (x_request_id := self.response_headers.get("X-Request-Id"))
+        ):
+            headers["X-Amzn-Trace-Id"] = x_request_id
+
         headers.update(self.extra_headers)
 
         return headers

{taegis_sdk_python-1.6.1 → taegis_sdk_python-1.6.3}/taegis_sdk_python/services/assets2/types.py

@@ -108,6 +108,8 @@ class AssetSearchOrderByInputV2(str, Enum):
     VULNERABILITY_STATUS_DESC = "vulnerability_status_desc"
     VENDOR_PROVIDED_HEALTH_ASC = "vendor_provided_health_asc"
     VENDOR_PROVIDED_HEALTH_DESC = "vendor_provided_health_desc"
+    VENDOR_PROVIDED_HEALTH_RAW_ASC = "vendor_provided_health_raw_asc"
+    VENDOR_PROVIDED_HEALTH_RAW_DESC = "vendor_provided_health_raw_desc"
     USERNAME_ASC = "username_asc"
     USERNAME_DESC = "username_desc"
     REBOOT_REQUIRED_ASC = "reboot_required_asc"
@@ -118,6 +120,8 @@ class AssetSearchOrderByInputV2(str, Enum):
     BIOS_SERIAL_DESC = "bios_serial_desc"
     FIRST_DISK_SERIAL_ASC = "first_disk_serial_asc"
     FIRST_DISK_SERIAL_DESC = "first_disk_serial_desc"
+    PENDING_UNINSTALL_ASC = "pending_uninstall_asc"
+    PENDING_UNINSTALL_DESC = "pending_uninstall_desc"
 
 
 class AssetHostnameSearchOrderByInput(str, Enum):
@@ -1208,6 +1212,9 @@ class AssetWhereInputV2:
     sensor_version: Optional[str] = field(
         default=None, metadata=config(field_name="sensorVersion")
     )
+    vendor_provided_health_raw: Optional[str] = field(
+        default=None, metadata=config(field_name="vendorProvidedHealthRaw")
+    )
     system_type: Optional[str] = field(
         default=None, metadata=config(field_name="systemType")
     )
@@ -1250,6 +1257,12 @@ class AssetWhereInputV2:
     reboot_required: Optional[bool] = field(
         default=None, metadata=config(field_name="rebootRequired")
     )
+    agent_mode: Optional[str] = field(
+        default=None, metadata=config(field_name="agentMode")
+    )
+    pending_uninstall: Optional[bool] = field(
+        default=None, metadata=config(field_name="pendingUninstall")
+    )
     and_: Optional[List["AssetWhereInputV2"]] = field(
         default=None, metadata=config(field_name="and")
     )
@@ -1408,9 +1421,18 @@ class AssetV2:
     uninstall: Optional[bool] = field(
         default=None, metadata=config(field_name="uninstall")
     )
+    vendor_provided_health_raw: Optional[str] = field(
+        default=None, metadata=config(field_name="vendorProvidedHealthRaw")
+    )
     reboot_required: Optional[bool] = field(
         default=None, metadata=config(field_name="rebootRequired")
     )
+    agent_mode: Optional[str] = field(
+        default=None, metadata=config(field_name="agentMode")
+    )
+    pending_uninstall: Optional[bool] = field(
+        default=None, metadata=config(field_name="pendingUninstall")
+    )
     hostnames: Optional[List[HostnameV2]] = field(
         default=None, metadata=config(field_name="hostnames")
     )

{taegis_sdk_python-1.6.1 → taegis_sdk_python-1.6.3}/taegis_sdk_python/services/authz/queries.py

@@ -262,7 +262,7 @@ class TaegisSDKAuthzQuery:
         raise GraphQLNoRowsInResultSetError("for query authzCanSubjectAssumeAllTenants")
 
     def authz_can_subject_assign_role(
-        self, id_: str
+        self, id_: str, target_subject_id: Optional[str] = None
     ) -> AuthzCanSubjectAssignRoleResponse:
         """Check if the subject can assign the input role."""
         endpoint = "authzCanSubjectAssignRole"
@@ -271,6 +271,7 @@ class TaegisSDKAuthzQuery:
             endpoint=endpoint,
             variables={
                 "id": prepare_input(id_),
+                "targetSubjectID": prepare_input(target_subject_id),
             },
             output=build_output_string(AuthzCanSubjectAssignRoleResponse),
         )

{taegis_sdk_python-1.6.1 → taegis_sdk_python-1.6.3}/taegis_sdk_python/services/authz/types.py

@@ -404,6 +404,9 @@ class AuthzCanSubjectAssignRoleResponse:
     subject_can_assign: Optional[bool] = field(
         default=None, metadata=config(field_name="subjectCanAssign")
     )
+    subject_can_deactivate: Optional[bool] = field(
+        default=None, metadata=config(field_name="subjectCanDeactivate")
+    )
     role: Optional[AuthzRole] = field(default=None, metadata=config(field_name="role"))
     absent_permissions: Optional[List[AuthzPermission]] = field(
         default=None, metadata=config(field_name="absentPermissions")

{taegis_sdk_python-1.6.1 → taegis_sdk_python-1.6.3}/taegis_sdk_python/services/entity_context/types.py

@@ -955,6 +955,7 @@ class EntityContextEntity:
 
     id: Optional[str] = field(default=None, metadata=config(field_name="id"))
     type: Optional[str] = field(default=None, metadata=config(field_name="type"))
+    subtype: Optional[str] = field(default=None, metadata=config(field_name="subtype"))
     first_seen: Optional[str] = field(
         default=None, metadata=config(field_name="firstSeen")
     )

{taegis_sdk_python-1.6.1 → taegis_sdk_python-1.6.3}/taegis_sdk_python/services/investigations2/mutations.py

@@ -72,7 +72,7 @@ class TaegisSDKInvestigations2Mutation:
         The response will include the evidence that the service will attempt to add to the case.
 
         Adding evidence to cases is an asynchronous operation.
-        It will typically finish pretty quickly, but added alerts/events will may not show up in the returned case until the async job is fully complete.
+        It will typically finish pretty quickly, but added detections/events will may not show up in the returned case until the async job is fully complete.
         The processing status, that is found on the case type will reflect the state of the processing job.
         Once the status is set to 'SUCCESS' the background job is complete and requesting the case will return the related evidence.
 
@@ -98,7 +98,7 @@ class TaegisSDKInvestigations2Mutation:
         The response will include the evidence that the service will attempt to remove from the case.
 
         Removing evidence from cases is an asynchronous operation.
-        It will typically finish pretty quickly, but removed alerts/events will can remain attached to the case until the async job is fully complete.
+        It will typically finish pretty quickly, but removed detections/events will can remain attached to the case until the async job is fully complete.
         The processing status, that is found on the case type will reflect the state of the processing job.
         Once the status is set to 'SUCCESS' the background job is complete and requesting the case will only return evidence that was not removed.
 
@@ -119,14 +119,14 @@ class TaegisSDKInvestigations2Mutation:
 
     def close_case(self, input_: CloseCaseInput) -> Case:
         """closeCase will close an existing case.
-        If the case has alerts attached to it, the alertsResolutionStatus field is required and alerts will be resolved based on the provided status.
+        If the case has detections attached to it, the detectionsResolutionStatus field is required and detections will be resolved based on the provided status.
         Once a case is closed, it can no longer be edited or have evidence added to it while in the closed state, it can only be archived.
         A closed case can be reopened if changes are needed after closing.
 
         Resolving evidence in a case is an asynchronous operation.
-        It will typically finish pretty quickly, but resolving alerts will may not reflect the updated status until the async job is fully complete.
+        It will typically finish pretty quickly, but resolving detections will may not reflect the updated status until the async job is fully complete.
         The processing status, that is found on the case type will reflect the state of the processing job.
-        Once the status is set to 'SUCCESS' the background job is complete and the alerts will have been updated.
+        Once the status is set to 'SUCCESS' the background job is complete and the detections will have been updated.
 
         Adding, removing or updating evidence (closing a case) while other jobs are processing for a given case will cause the jobs to queue.
         Jobs will be worked through in the order they were received.."""

{taegis_sdk_python-1.6.1 → taegis_sdk_python-1.6.3}/taegis_sdk_python/services/investigations2/queries.py

@@ -157,7 +157,7 @@ class TaegisSDKInvestigations2Query:
         raise GraphQLNoRowsInResultSetError("for query exportCaseResources")
 
     def case_timeline(self, arguments: CaseTimelineArguments) -> CaseTimeline:
-        """caseTimeline returns a case timeline detailing the order of alerts, events and other actions taken in relation to a case.."""
+        """caseTimeline returns a case timeline detailing the order of detections, events and other actions taken in relation to a case.."""
         endpoint = "caseTimeline"
 
         result = self.service.execute_query(