taegis-sdk-python 1.6.2__tar.gz → 1.6.4__tar.gz

{taegis_sdk_python-1.6.2 → taegis_sdk_python-1.6.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.6.2
+Version: 1.6.4
 Summary: Taegis Python SDK
 Project-URL: Homepage, https://github.com/secureworks/taegis-sdk-python
 Project-URL: Bug Reports, https://github.com/secureworks/taegis-sdk-python/issues

{taegis_sdk_python-1.6.2 → taegis_sdk_python-1.6.4}/taegis_sdk_python/_version.py

@@ -1,3 +1,3 @@
 """Version idenitier."""
 
-__version__ = "1.6.2"
+__version__ = "1.6.4"

{taegis_sdk_python-1.6.2 → taegis_sdk_python-1.6.4}/taegis_sdk_python/services/assets2/queries.py

@@ -420,3 +420,72 @@ class TaegisSDKAssets2Query:
         if result.get(endpoint) is not None:
             return AssetsMacAddress.from_dict(result.get(endpoint))
         raise GraphQLNoRowsInResultSetError("for query assetsMacAddress")
+
+    def network_info_by_host_id(self, host_id: str) -> List[NetworkInfo]:
+        """ "Retrieve network information for a host based on a provided host_id."""
+        endpoint = "networkInfoByHostID"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "hostId": prepare_input(host_id),
+            },
+            output=build_output_string(NetworkInfo),
+        )
+        if result.get(endpoint) is not None:
+            return NetworkInfo.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query networkInfoByHostID")
+
+    def network_info_by_hostname(
+        self,
+        event_time: str,
+        host_name: str,
+        exact_match_count: int,
+        endpoint_types: Union[EndpointTypeV2, TaegisEnum],
+    ) -> List[NetworkInfo]:
+        """ "Retrieve network information for a host based on a provided hostname."""
+        endpoint = "networkInfoByHostname"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "eventTime": prepare_input(event_time),
+                "hostName": prepare_input(host_name),
+                "exactMatchCount": prepare_input(exact_match_count),
+                "endpointTypes": prepare_input(endpoint_types),
+            },
+            output=build_output_string(NetworkInfo),
+        )
+        if result.get(endpoint) is not None:
+            return NetworkInfo.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query networkInfoByHostname")
+
+    def network_info_by_ip_address(
+        self,
+        event_time: str,
+        ip_address: str,
+        exact_match_count: int,
+        endpoint_types: Union[EndpointTypeV2, TaegisEnum],
+    ) -> List[NetworkInfo]:
+        """ "Retrieve network information for a host based on a provided ip address."""
+        endpoint = "networkInfoByIpAddress"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "eventTime": prepare_input(event_time),
+                "ipAddress": prepare_input(ip_address),
+                "exactMatchCount": prepare_input(exact_match_count),
+                "endpointTypes": prepare_input(endpoint_types),
+            },
+            output=build_output_string(NetworkInfo),
+        )
+        if result.get(endpoint) is not None:
+            return NetworkInfo.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query networkInfoByIpAddress")

{taegis_sdk_python-1.6.2 → taegis_sdk_python-1.6.4}/taegis_sdk_python/services/assets2/types.py

@@ -481,6 +481,23 @@ class PageInfoV2:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class NetworkInfo:
+    """NetworkInfo."""
+
+    host_id: Optional[str] = field(default=None, metadata=config(field_name="hostId"))
+    host_name: Optional[str] = field(
+        default=None, metadata=config(field_name="hostName")
+    )
+    ip_addresses: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="ipAddresses")
+    )
+    ethernet_addresses: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="ethernetAddresses")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class AssetHostname:

{taegis_sdk_python-1.6.2 → taegis_sdk_python-1.6.4}/taegis_sdk_python/services/authz/queries.py

@@ -262,7 +262,7 @@ class TaegisSDKAuthzQuery:
         raise GraphQLNoRowsInResultSetError("for query authzCanSubjectAssumeAllTenants")
 
     def authz_can_subject_assign_role(
-        self, id_: str
+        self, id_: str, target_subject_id: Optional[str] = None
     ) -> AuthzCanSubjectAssignRoleResponse:
         """Check if the subject can assign the input role."""
         endpoint = "authzCanSubjectAssignRole"
@@ -271,6 +271,7 @@ class TaegisSDKAuthzQuery:
             endpoint=endpoint,
             variables={
                 "id": prepare_input(id_),
+                "targetSubjectID": prepare_input(target_subject_id),
             },
             output=build_output_string(AuthzCanSubjectAssignRoleResponse),
         )

{taegis_sdk_python-1.6.2 → taegis_sdk_python-1.6.4}/taegis_sdk_python/services/authz/types.py

@@ -404,6 +404,9 @@ class AuthzCanSubjectAssignRoleResponse:
     subject_can_assign: Optional[bool] = field(
         default=None, metadata=config(field_name="subjectCanAssign")
     )
+    subject_can_deactivate: Optional[bool] = field(
+        default=None, metadata=config(field_name="subjectCanDeactivate")
+    )
     role: Optional[AuthzRole] = field(default=None, metadata=config(field_name="role"))
     absent_permissions: Optional[List[AuthzPermission]] = field(
         default=None, metadata=config(field_name="absentPermissions")

taegis_sdk_python-1.6.4/taegis_sdk_python/services/datasources/mutations.py

@@ -0,0 +1,117 @@
+"""Datasources Mutation."""
+
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python._consts import TaegisEnum
+from taegis_sdk_python.services.datasources.types import *
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.datasources import DatasourcesService
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKDatasourcesMutation:
+    """Taegis Datasources Mutation operations."""
+
+    def __init__(self, service: DatasourcesService):
+        self.service = service
+
+    def delete_data_source_assets(
+        self, delete_asset_input: List[DeleteAssetInput]
+    ) -> List[DeletedAsset]:
+        """Executes a delete operation on all included data sources for a specified tenant. Returns an array of
+        deleted assets with metadata. Authorization permission is required with delete access to the collector
+        object.."""
+        endpoint = "deleteDataSourceAssets"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "deleteAssetInput": prepare_input(delete_asset_input),
+            },
+            output=build_output_string(DeletedAsset),
+        )
+        if result.get(endpoint) is not None:
+            return DeletedAsset.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for mutation deleteDataSourceAssets")
+
+    def delete_data_source_tag(self, tag_id: str) -> bool:
+        """Deleted a tag by its ID. Returns true if the tag was successfully deleted.."""
+        endpoint = "deleteDataSourceTag"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "tagId": prepare_input(tag_id),
+            },
+            output="",
+        )
+        if result.get(endpoint) is not None:
+            return result.get(endpoint)
+        raise GraphQLNoRowsInResultSetError("for mutation deleteDataSourceTag")
+
+    def detach_data_source_tag(self, input_: DataSourceTagOperationInput) -> List[str]:
+        """Detaches an existing tag from datasource(s). Returns the assetIDs that were detached from the tag.."""
+        endpoint = "detachDataSourceTag"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "input": prepare_input(input_),
+            },
+            output="",
+        )
+        if result.get(endpoint) is not None:
+            return result.get(endpoint)
+        raise GraphQLNoRowsInResultSetError("for mutation detachDataSourceTag")
+
+    def create_data_source_tag(self, input_: CreateDataSourceTagInput) -> DataSourceTag:
+        """Creates a new tag and associates it with existing datasource(s). Returns the created tag. This API
+        allows a maximum of 100 tags to be created for a given tenant.."""
+        endpoint = "createDataSourceTag"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "input": prepare_input(input_),
+            },
+            output=build_output_string(DataSourceTag),
+        )
+        if result.get(endpoint) is not None:
+            return DataSourceTag.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for mutation createDataSourceTag")
+
+    def attach_data_source_tag(self, input_: DataSourceTagOperationInput) -> List[str]:
+        """Attaches or associates an existing tag to datasource(s). Returns the assetIDs attached to the tag.
+        A maximum of 100 assetIDs can be associated in a single operation. A single asset can have up to 16 tags attached to it..
+        """
+        endpoint = "attachDataSourceTag"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "input": prepare_input(input_),
+            },
+            output="",
+        )
+        if result.get(endpoint) is not None:
+            return result.get(endpoint)
+        raise GraphQLNoRowsInResultSetError("for mutation attachDataSourceTag")

{taegis_sdk_python-1.6.2 → taegis_sdk_python-1.6.4}/taegis_sdk_python/services/datasources/queries.py

@@ -124,3 +124,31 @@ class TaegisSDKDatasourcesQuery:
         if result.get(endpoint) is not None:
             return LastSeenAssetsQueryResult.from_dict(result.get(endpoint))
         raise GraphQLNoRowsInResultSetError("for query dataSourceLastSeenAssetsQuery")
+
+    def get_data_source_tags(self) -> List[DataSourceTag]:
+        """Fetches all tags associated with a given tenant.."""
+        endpoint = "getDataSourceTags"
+
+        result = self.service.execute_query(
+            endpoint=endpoint, variables={}, output=build_output_string(DataSourceTag)
+        )
+        if result.get(endpoint) is not None:
+            return DataSourceTag.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query getDataSourceTags")
+
+    def get_data_source_tag(self, tag_id: str) -> DataSourceTag:
+        """Fetches a specific tag by its ID.."""
+        endpoint = "getDataSourceTag"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "tagId": prepare_input(tag_id),
+            },
+            output=build_output_string(DataSourceTag),
+        )
+        if result.get(endpoint) is not None:
+            return DataSourceTag.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query getDataSourceTag")

{taegis_sdk_python-1.6.2 → taegis_sdk_python-1.6.4}/taegis_sdk_python/services/datasources/types.py

@@ -26,6 +26,7 @@ class AuthzAction(str, Enum):
 
     READ = "READ"
     DELETE = "DELETE"
+    CREATE = "CREATE"
 
 
 class HealthState(str, Enum):
@@ -160,6 +161,9 @@ class DataSourcesWhereInput:
     collector_id: Optional[List[str]] = field(
         default=None, metadata=config(field_name="collectorId")
     )
+    tag_id: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="tagId")
+    )
 
 
 @dataclass_json
@@ -189,11 +193,61 @@ class ClusterIdentity:
     name: Optional[str] = field(default=None, metadata=config(field_name="name"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class DataSourceTag:
+    """DataSourceTag."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    tenant: Optional[str] = field(default=None, metadata=config(field_name="tenant"))
+    key: Optional[str] = field(default=None, metadata=config(field_name="key"))
+    value: Optional[str] = field(default=None, metadata=config(field_name="value"))
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class CreateDataSourceTagInput:
+    """CreateDataSourceTagInput."""
+
+    key: Optional[str] = field(default=None, metadata=config(field_name="key"))
+    value: Optional[str] = field(default=None, metadata=config(field_name="value"))
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class DataSourceTagOperationInput:
+    """DataSourceTagOperationInput."""
+
+    tag_id: Optional[str] = field(default=None, metadata=config(field_name="tagId"))
+    asset_ids: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="assetIds")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class DataSourceAssetsFilter:
+    """DataSourceAssetsFilter."""
+
+    status: Optional[List[Union[HealthState, TaegisEnum]]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(HealthState, x),
+            field_name="status",
+        ),
+    )
+    where: Optional[DataSourcesWhereInput] = field(
+        default=None, metadata=config(field_name="where")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class LastSeenAsset:
     """LastSeenAsset."""
 
+    asset_id: Optional[str] = field(default=None, metadata=config(field_name="assetId"))
     source_id: Optional[str] = field(
         default=None, metadata=config(field_name="sourceId")
     )
@@ -221,24 +275,15 @@ class LastSeenAsset:
     collector: Optional[ClusterIdentity] = field(
         default=None, metadata=config(field_name="collector")
     )
+    tags: Optional[List[DataSourceTag]] = field(
+        default=None, metadata=config(field_name="tags")
+    )
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class DataSourceAssetsFilter:
-    """DataSourceAssetsFilter."""
-
-    status: Optional[List[Union[HealthState, TaegisEnum]]] = field(
-        default=None,
-        metadata=config(
-            encoder=encode_enum,
-            decoder=lambda x: decode_enum(HealthState, x),
-            field_name="status",
-        ),
-    )
-    where: Optional[DataSourcesWhereInput] = field(
-        default=None, metadata=config(field_name="where")
-    )
+FilterValueResponse = Union[
+    FilterValue,
+    ClusterIdentity,
+]
 
 
 @dataclass_json
@@ -273,12 +318,6 @@ class LastSeenAssetsQueryResult:
     )
 
 
-FilterValueResponse = Union[
-    FilterValue,
-    ClusterIdentity,
-]
-
-
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class FilterValues:

{taegis_sdk_python-1.6.2 → taegis_sdk_python-1.6.4}/taegis_sdk_python/services/entity_context/queries.py

@@ -204,6 +204,30 @@ class TaegisSDKEntityContextQuery:
             )
         raise GraphQLNoRowsInResultSetError("for query entityContextAssociatedEntities")
 
+    def entity_context_associated_entity_types(
+        self,
+        entry_point: EntityContextSingleEntryPoint,
+        source: Optional[EntityContextSourceInput] = None,
+    ) -> EntityContextAssociatedEntityTypesResponse:
+        """None."""
+        endpoint = "entityContextAssociatedEntityTypes"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "entryPoint": prepare_input(entry_point),
+                "source": prepare_input(source),
+            },
+            output=build_output_string(EntityContextAssociatedEntityTypesResponse),
+        )
+        if result.get(endpoint) is not None:
+            return EntityContextAssociatedEntityTypesResponse.from_dict(
+                result.get(endpoint)
+            )
+        raise GraphQLNoRowsInResultSetError(
+            "for query entityContextAssociatedEntityTypes"
+        )
+
     def entity_context_pivot_ql(
         self,
         entry_point: EntityContextEntryPoint,

{taegis_sdk_python-1.6.2 → taegis_sdk_python-1.6.4}/taegis_sdk_python/services/entity_context/types.py

@@ -197,6 +197,15 @@ class EntityContextPageInput:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EntityContextTypeCounts:
+    """EntityContextTypeCounts."""
+
+    type: Optional[str] = field(default=None, metadata=config(field_name="type"))
+    count: Optional[int] = field(default=None, metadata=config(field_name="count"))
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class EntityContextPageInfo:
@@ -392,6 +401,22 @@ class EntityContextWhoIsContact:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EntityContextSingleEntryPoint:
+    """EntityContextSingleEntryPoint."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    type: Optional[Union[EntityContextEntryPointType, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(EntityContextEntryPointType, x),
+            field_name="type",
+        ),
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class EntityContextOrigin:
@@ -461,6 +486,20 @@ class EntityContextRelatedResources:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EntityContextAssociatedEntityTypesResponse:
+    """EntityContextAssociatedEntityTypesResponse."""
+
+    total_count: Optional[int] = field(
+        default=None, metadata=config(field_name="totalCount")
+    )
+    error: Optional[str] = field(default=None, metadata=config(field_name="error"))
+    types: Optional[List[EntityContextTypeCounts]] = field(
+        default=None, metadata=config(field_name="types")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class EntityContextPropertyQuery:

{taegis_sdk_python-1.6.2 → taegis_sdk_python-1.6.4}/taegis_sdk_python/services/investigations2/mutations.py

@@ -72,7 +72,7 @@ class TaegisSDKInvestigations2Mutation:
         The response will include the evidence that the service will attempt to add to the case.
 
         Adding evidence to cases is an asynchronous operation.
-        It will typically finish pretty quickly, but added alerts/events will may not show up in the returned case until the async job is fully complete.
+        It will typically finish pretty quickly, but added detections/events will may not show up in the returned case until the async job is fully complete.
         The processing status, that is found on the case type will reflect the state of the processing job.
         Once the status is set to 'SUCCESS' the background job is complete and requesting the case will return the related evidence.
 
@@ -98,7 +98,7 @@ class TaegisSDKInvestigations2Mutation:
         The response will include the evidence that the service will attempt to remove from the case.
 
         Removing evidence from cases is an asynchronous operation.
-        It will typically finish pretty quickly, but removed alerts/events will can remain attached to the case until the async job is fully complete.
+        It will typically finish pretty quickly, but removed detections/events will can remain attached to the case until the async job is fully complete.
         The processing status, that is found on the case type will reflect the state of the processing job.
         Once the status is set to 'SUCCESS' the background job is complete and requesting the case will only return evidence that was not removed.
 
@@ -119,14 +119,14 @@ class TaegisSDKInvestigations2Mutation:
 
     def close_case(self, input_: CloseCaseInput) -> Case:
         """closeCase will close an existing case.
-        If the case has alerts attached to it, the alertsResolutionStatus field is required and alerts will be resolved based on the provided status.
+        If the case has detections attached to it, the detectionsResolutionStatus field is required and detections will be resolved based on the provided status.
         Once a case is closed, it can no longer be edited or have evidence added to it while in the closed state, it can only be archived.
         A closed case can be reopened if changes are needed after closing.
 
         Resolving evidence in a case is an asynchronous operation.
-        It will typically finish pretty quickly, but resolving alerts will may not reflect the updated status until the async job is fully complete.
+        It will typically finish pretty quickly, but resolving detections will may not reflect the updated status until the async job is fully complete.
         The processing status, that is found on the case type will reflect the state of the processing job.
-        Once the status is set to 'SUCCESS' the background job is complete and the alerts will have been updated.
+        Once the status is set to 'SUCCESS' the background job is complete and the detections will have been updated.
 
         Adding, removing or updating evidence (closing a case) while other jobs are processing for a given case will cause the jobs to queue.
         Jobs will be worked through in the order they were received.."""

{taegis_sdk_python-1.6.2 → taegis_sdk_python-1.6.4}/taegis_sdk_python/services/investigations2/queries.py

@@ -157,7 +157,7 @@ class TaegisSDKInvestigations2Query:
         raise GraphQLNoRowsInResultSetError("for query exportCaseResources")
 
     def case_timeline(self, arguments: CaseTimelineArguments) -> CaseTimeline:
-        """caseTimeline returns a case timeline detailing the order of alerts, events and other actions taken in relation to a case.."""
+        """caseTimeline returns a case timeline detailing the order of detections, events and other actions taken in relation to a case.."""
         endpoint = "caseTimeline"
 
         result = self.service.execute_query(