taegis-sdk-python 1.6.3__tar.gz → 1.6.4__tar.gz

{taegis_sdk_python-1.6.3 → taegis_sdk_python-1.6.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.6.3
+Version: 1.6.4
 Summary: Taegis Python SDK
 Project-URL: Homepage, https://github.com/secureworks/taegis-sdk-python
 Project-URL: Bug Reports, https://github.com/secureworks/taegis-sdk-python/issues

{taegis_sdk_python-1.6.3 → taegis_sdk_python-1.6.4}/taegis_sdk_python/_version.py

@@ -1,3 +1,3 @@
 """Version idenitier."""
 
-__version__ = "1.6.3"
+__version__ = "1.6.4"

{taegis_sdk_python-1.6.3 → taegis_sdk_python-1.6.4}/taegis_sdk_python/services/assets2/queries.py

@@ -420,3 +420,72 @@ class TaegisSDKAssets2Query:
         if result.get(endpoint) is not None:
             return AssetsMacAddress.from_dict(result.get(endpoint))
         raise GraphQLNoRowsInResultSetError("for query assetsMacAddress")
+
+    def network_info_by_host_id(self, host_id: str) -> List[NetworkInfo]:
+        """ "Retrieve network information for a host based on a provided host_id."""
+        endpoint = "networkInfoByHostID"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "hostId": prepare_input(host_id),
+            },
+            output=build_output_string(NetworkInfo),
+        )
+        if result.get(endpoint) is not None:
+            return NetworkInfo.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query networkInfoByHostID")
+
+    def network_info_by_hostname(
+        self,
+        event_time: str,
+        host_name: str,
+        exact_match_count: int,
+        endpoint_types: Union[EndpointTypeV2, TaegisEnum],
+    ) -> List[NetworkInfo]:
+        """ "Retrieve network information for a host based on a provided hostname."""
+        endpoint = "networkInfoByHostname"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "eventTime": prepare_input(event_time),
+                "hostName": prepare_input(host_name),
+                "exactMatchCount": prepare_input(exact_match_count),
+                "endpointTypes": prepare_input(endpoint_types),
+            },
+            output=build_output_string(NetworkInfo),
+        )
+        if result.get(endpoint) is not None:
+            return NetworkInfo.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query networkInfoByHostname")
+
+    def network_info_by_ip_address(
+        self,
+        event_time: str,
+        ip_address: str,
+        exact_match_count: int,
+        endpoint_types: Union[EndpointTypeV2, TaegisEnum],
+    ) -> List[NetworkInfo]:
+        """ "Retrieve network information for a host based on a provided ip address."""
+        endpoint = "networkInfoByIpAddress"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "eventTime": prepare_input(event_time),
+                "ipAddress": prepare_input(ip_address),
+                "exactMatchCount": prepare_input(exact_match_count),
+                "endpointTypes": prepare_input(endpoint_types),
+            },
+            output=build_output_string(NetworkInfo),
+        )
+        if result.get(endpoint) is not None:
+            return NetworkInfo.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query networkInfoByIpAddress")

{taegis_sdk_python-1.6.3 → taegis_sdk_python-1.6.4}/taegis_sdk_python/services/assets2/types.py

@@ -481,6 +481,23 @@ class PageInfoV2:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class NetworkInfo:
+    """NetworkInfo."""
+
+    host_id: Optional[str] = field(default=None, metadata=config(field_name="hostId"))
+    host_name: Optional[str] = field(
+        default=None, metadata=config(field_name="hostName")
+    )
+    ip_addresses: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="ipAddresses")
+    )
+    ethernet_addresses: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="ethernetAddresses")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class AssetHostname:

taegis_sdk_python-1.6.4/taegis_sdk_python/services/datasources/mutations.py

@@ -0,0 +1,117 @@
+"""Datasources Mutation."""
+
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python._consts import TaegisEnum
+from taegis_sdk_python.services.datasources.types import *
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.datasources import DatasourcesService
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKDatasourcesMutation:
+    """Taegis Datasources Mutation operations."""
+
+    def __init__(self, service: DatasourcesService):
+        self.service = service
+
+    def delete_data_source_assets(
+        self, delete_asset_input: List[DeleteAssetInput]
+    ) -> List[DeletedAsset]:
+        """Executes a delete operation on all included data sources for a specified tenant. Returns an array of
+        deleted assets with metadata. Authorization permission is required with delete access to the collector
+        object.."""
+        endpoint = "deleteDataSourceAssets"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "deleteAssetInput": prepare_input(delete_asset_input),
+            },
+            output=build_output_string(DeletedAsset),
+        )
+        if result.get(endpoint) is not None:
+            return DeletedAsset.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for mutation deleteDataSourceAssets")
+
+    def delete_data_source_tag(self, tag_id: str) -> bool:
+        """Deleted a tag by its ID. Returns true if the tag was successfully deleted.."""
+        endpoint = "deleteDataSourceTag"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "tagId": prepare_input(tag_id),
+            },
+            output="",
+        )
+        if result.get(endpoint) is not None:
+            return result.get(endpoint)
+        raise GraphQLNoRowsInResultSetError("for mutation deleteDataSourceTag")
+
+    def detach_data_source_tag(self, input_: DataSourceTagOperationInput) -> List[str]:
+        """Detaches an existing tag from datasource(s). Returns the assetIDs that were detached from the tag.."""
+        endpoint = "detachDataSourceTag"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "input": prepare_input(input_),
+            },
+            output="",
+        )
+        if result.get(endpoint) is not None:
+            return result.get(endpoint)
+        raise GraphQLNoRowsInResultSetError("for mutation detachDataSourceTag")
+
+    def create_data_source_tag(self, input_: CreateDataSourceTagInput) -> DataSourceTag:
+        """Creates a new tag and associates it with existing datasource(s). Returns the created tag. This API
+        allows a maximum of 100 tags to be created for a given tenant.."""
+        endpoint = "createDataSourceTag"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "input": prepare_input(input_),
+            },
+            output=build_output_string(DataSourceTag),
+        )
+        if result.get(endpoint) is not None:
+            return DataSourceTag.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for mutation createDataSourceTag")
+
+    def attach_data_source_tag(self, input_: DataSourceTagOperationInput) -> List[str]:
+        """Attaches or associates an existing tag to datasource(s). Returns the assetIDs attached to the tag.
+        A maximum of 100 assetIDs can be associated in a single operation. A single asset can have up to 16 tags attached to it..
+        """
+        endpoint = "attachDataSourceTag"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "input": prepare_input(input_),
+            },
+            output="",
+        )
+        if result.get(endpoint) is not None:
+            return result.get(endpoint)
+        raise GraphQLNoRowsInResultSetError("for mutation attachDataSourceTag")

{taegis_sdk_python-1.6.3 → taegis_sdk_python-1.6.4}/taegis_sdk_python/services/datasources/queries.py

@@ -124,3 +124,31 @@ class TaegisSDKDatasourcesQuery:
         if result.get(endpoint) is not None:
             return LastSeenAssetsQueryResult.from_dict(result.get(endpoint))
         raise GraphQLNoRowsInResultSetError("for query dataSourceLastSeenAssetsQuery")
+
+    def get_data_source_tags(self) -> List[DataSourceTag]:
+        """Fetches all tags associated with a given tenant.."""
+        endpoint = "getDataSourceTags"
+
+        result = self.service.execute_query(
+            endpoint=endpoint, variables={}, output=build_output_string(DataSourceTag)
+        )
+        if result.get(endpoint) is not None:
+            return DataSourceTag.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query getDataSourceTags")
+
+    def get_data_source_tag(self, tag_id: str) -> DataSourceTag:
+        """Fetches a specific tag by its ID.."""
+        endpoint = "getDataSourceTag"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "tagId": prepare_input(tag_id),
+            },
+            output=build_output_string(DataSourceTag),
+        )
+        if result.get(endpoint) is not None:
+            return DataSourceTag.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query getDataSourceTag")

{taegis_sdk_python-1.6.3 → taegis_sdk_python-1.6.4}/taegis_sdk_python/services/datasources/types.py

@@ -26,6 +26,7 @@ class AuthzAction(str, Enum):
 
     READ = "READ"
     DELETE = "DELETE"
+    CREATE = "CREATE"
 
 
 class HealthState(str, Enum):
@@ -160,6 +161,9 @@ class DataSourcesWhereInput:
     collector_id: Optional[List[str]] = field(
         default=None, metadata=config(field_name="collectorId")
     )
+    tag_id: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="tagId")
+    )
 
 
 @dataclass_json
@@ -189,11 +193,61 @@ class ClusterIdentity:
     name: Optional[str] = field(default=None, metadata=config(field_name="name"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class DataSourceTag:
+    """DataSourceTag."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    tenant: Optional[str] = field(default=None, metadata=config(field_name="tenant"))
+    key: Optional[str] = field(default=None, metadata=config(field_name="key"))
+    value: Optional[str] = field(default=None, metadata=config(field_name="value"))
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class CreateDataSourceTagInput:
+    """CreateDataSourceTagInput."""
+
+    key: Optional[str] = field(default=None, metadata=config(field_name="key"))
+    value: Optional[str] = field(default=None, metadata=config(field_name="value"))
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class DataSourceTagOperationInput:
+    """DataSourceTagOperationInput."""
+
+    tag_id: Optional[str] = field(default=None, metadata=config(field_name="tagId"))
+    asset_ids: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="assetIds")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class DataSourceAssetsFilter:
+    """DataSourceAssetsFilter."""
+
+    status: Optional[List[Union[HealthState, TaegisEnum]]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(HealthState, x),
+            field_name="status",
+        ),
+    )
+    where: Optional[DataSourcesWhereInput] = field(
+        default=None, metadata=config(field_name="where")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class LastSeenAsset:
     """LastSeenAsset."""
 
+    asset_id: Optional[str] = field(default=None, metadata=config(field_name="assetId"))
     source_id: Optional[str] = field(
         default=None, metadata=config(field_name="sourceId")
     )
@@ -221,24 +275,15 @@ class LastSeenAsset:
     collector: Optional[ClusterIdentity] = field(
         default=None, metadata=config(field_name="collector")
     )
+    tags: Optional[List[DataSourceTag]] = field(
+        default=None, metadata=config(field_name="tags")
+    )
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class DataSourceAssetsFilter:
-    """DataSourceAssetsFilter."""
-
-    status: Optional[List[Union[HealthState, TaegisEnum]]] = field(
-        default=None,
-        metadata=config(
-            encoder=encode_enum,
-            decoder=lambda x: decode_enum(HealthState, x),
-            field_name="status",
-        ),
-    )
-    where: Optional[DataSourcesWhereInput] = field(
-        default=None, metadata=config(field_name="where")
-    )
+FilterValueResponse = Union[
+    FilterValue,
+    ClusterIdentity,
+]
 
 
 @dataclass_json
@@ -273,12 +318,6 @@ class LastSeenAssetsQueryResult:
     )
 
 
-FilterValueResponse = Union[
-    FilterValue,
-    ClusterIdentity,
-]
-
-
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class FilterValues:

{taegis_sdk_python-1.6.3 → taegis_sdk_python-1.6.4}/taegis_sdk_python/services/entity_context/queries.py

@@ -204,6 +204,30 @@ class TaegisSDKEntityContextQuery:
             )
         raise GraphQLNoRowsInResultSetError("for query entityContextAssociatedEntities")
 
+    def entity_context_associated_entity_types(
+        self,
+        entry_point: EntityContextSingleEntryPoint,
+        source: Optional[EntityContextSourceInput] = None,
+    ) -> EntityContextAssociatedEntityTypesResponse:
+        """None."""
+        endpoint = "entityContextAssociatedEntityTypes"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "entryPoint": prepare_input(entry_point),
+                "source": prepare_input(source),
+            },
+            output=build_output_string(EntityContextAssociatedEntityTypesResponse),
+        )
+        if result.get(endpoint) is not None:
+            return EntityContextAssociatedEntityTypesResponse.from_dict(
+                result.get(endpoint)
+            )
+        raise GraphQLNoRowsInResultSetError(
+            "for query entityContextAssociatedEntityTypes"
+        )
+
     def entity_context_pivot_ql(
         self,
         entry_point: EntityContextEntryPoint,

{taegis_sdk_python-1.6.3 → taegis_sdk_python-1.6.4}/taegis_sdk_python/services/entity_context/types.py

@@ -197,6 +197,15 @@ class EntityContextPageInput:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EntityContextTypeCounts:
+    """EntityContextTypeCounts."""
+
+    type: Optional[str] = field(default=None, metadata=config(field_name="type"))
+    count: Optional[int] = field(default=None, metadata=config(field_name="count"))
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class EntityContextPageInfo:
@@ -392,6 +401,22 @@ class EntityContextWhoIsContact:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EntityContextSingleEntryPoint:
+    """EntityContextSingleEntryPoint."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    type: Optional[Union[EntityContextEntryPointType, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(EntityContextEntryPointType, x),
+            field_name="type",
+        ),
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class EntityContextOrigin:
@@ -461,6 +486,20 @@ class EntityContextRelatedResources:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EntityContextAssociatedEntityTypesResponse:
+    """EntityContextAssociatedEntityTypesResponse."""
+
+    total_count: Optional[int] = field(
+        default=None, metadata=config(field_name="totalCount")
+    )
+    error: Optional[str] = field(default=None, metadata=config(field_name="error"))
+    types: Optional[List[EntityContextTypeCounts]] = field(
+        default=None, metadata=config(field_name="types")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class EntityContextPropertyQuery:

{taegis_sdk_python-1.6.3 → taegis_sdk_python-1.6.4}/taegis_sdk_python/services/threat/queries.py

@@ -136,17 +136,45 @@ class TaegisSDKThreatQuery:
         raise GraphQLNoRowsInResultSetError("for query threatIdentitiesByConfidence")
 
     def threat_watchlist(
-        self, type_: Union[ThreatParentType, TaegisEnum]
+        self,
+        type_: Union[ThreatParentType, TaegisEnum],
+        added_after: Optional[str] = None,
+        added_before: Optional[str] = None,
+        page: Optional[PageInput] = None,
+        filters: Optional[WatchlistFilter] = None,
     ) -> List[ThreatRelationship]:
         """Gets a watchlist by type. All results are considered **high confidence**.
         Only IP and DOMAIN types are supported. FILE type has been removed from this endpoint.
-        Instead, use the paged endpoint threatTimsMalwareFiles for FILE types.."""
+        Instead, use the paged endpoint threatTimsMalwareFiles for FILE types.
+
+        Results are sorted by the 'created' field in descending order (newest first).
+
+        Additional filtering options:
+        - addedAfter: input timestamp to filter records created after this time
+        - addedBefore: input timestamp to filter records created before this time
+        - page: Optional pagination controls (offset/limit). If not provided, returns ALL results.
+          When paginating, clients must detect the last page by checking if the number of returned
+          results is less than the requested limit, or if an empty array is returned.
+        - filters: Supports targetRef and confidence filtering
+          Examples:
+            Confidence Range: filters: { where: { confidence_gte: 70, confidence_lte: 90 } }
+            Confidence Minimum: filters: { where: { confidence_gte: 80 } }
+            Confidence Maximum: filters: { where: { confidence_lte: 50 } }
+            Target Filter: filters: { where: { or: [{ targetRef: "malware_name" }] } }
+          Note: Each filter should use either confidence fields OR targetRef, not both in the same where clause
+
+        Time range examples:
+          - addedAfter: "2024-01-01T00:00:00Z", addedBefore: "2024-01-31T23:59:59Z"."""
         endpoint = "threatWatchlist"
 
         result = self.service.execute_query(
             endpoint=endpoint,
             variables={
                 "type": prepare_input(type_),
+                "addedAfter": prepare_input(added_after),
+                "addedBefore": prepare_input(added_before),
+                "page": prepare_input(page),
+                "filters": prepare_input(filters),
             },
             output=build_output_string(ThreatRelationship),
         )
@@ -157,22 +185,42 @@ class TaegisSDKThreatQuery:
         raise GraphQLNoRowsInResultSetError("for query threatWatchlist")
 
     def threat_tims_malware_files(
-        self, last_created: Optional[str] = None
+        self,
+        last_created: Optional[str] = None,
+        added_after: Optional[str] = None,
+        added_before: Optional[str] = None,
+        filters: Optional[MalwareFileFilter] = None,
     ) -> PagedMalwareFiles:
         """Get all TIMS 2.0 Malware file hashes. All results are considered **high confidence**.
-        This is a paged service, requiring repeated queries. Total number of results can number over 750k.
+        This is a cursor-based paged service, requiring repeated queries. Total number of results can number over 750k.
         For the initial query, do not provide any search parameters or set 'last_created' to null.
         Subsequent queries should include the previous query's 'last_created' result from 'PagedMalwareFiles.last_created'
         as the input parameter. Returns pages of 10,000 at a time, sorted by the indicators field 'created' in desc order.
         The returned field 'has_more' will be false when the last page is returned.
         * Note: 'created' refers to an internal field associated with the indicator, not the time the indicator was first found.
-        It is only used for sorting.."""
+        It is only used for sorting.
+
+        Additional filtering options:
+        - addedAfter: input timestamp to filter records created after this time
+        - addedBefore: input timestamp to filter records created before this time
+        - filters: Supports threat description filtering via OR array format only
+          Example: filters: { where: { or: [{ threatDescription: "malware_name" }] } }
+
+        Time range examples:
+          - addedAfter: "2024-01-01T00:00:00Z", addedBefore: "2024-01-31T23:59:59Z"
+
+        Pagination: Uses cursor-based pagination with 'last_created' parameter. For small time ranges
+        (results < 10k), all data is returned in one response. For larger datasets, use 'last_created'
+        to paginate through results.."""
         endpoint = "threatTimsMalwareFiles"
 
         result = self.service.execute_query(
             endpoint=endpoint,
             variables={
                 "last_created": prepare_input(last_created),
+                "addedAfter": prepare_input(added_after),
+                "addedBefore": prepare_input(added_before),
+                "filters": prepare_input(filters),
             },
             output=build_output_string(PagedMalwareFiles),
         )

{taegis_sdk_python-1.6.3 → taegis_sdk_python-1.6.4}/taegis_sdk_python/services/threat/types.py

@@ -346,6 +346,15 @@ class ThreatPageInput:
     limit: Optional[int] = field(default=None, metadata=config(field_name="limit"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class PageInput:
+    """PageInput."""
+
+    limit: Optional[int] = field(default=None, metadata=config(field_name="limit"))
+    offset: Optional[int] = field(default=None, metadata=config(field_name="offset"))
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class Facet:
@@ -887,6 +896,38 @@ class ThreatReportInput:
     tags: Optional[List[str]] = field(default=None, metadata=config(field_name="tags"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class MalwareFileWhereInput:
+    """MalwareFileWhereInput."""
+
+    threat_description: Optional[str] = field(
+        default=None, metadata=config(field_name="threatDescription")
+    )
+    or_: Optional[List["MalwareFileWhereInput"]] = field(
+        default=None, metadata=config(field_name="or")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class WatchlistWhereInput:
+    """WatchlistWhereInput."""
+
+    target_ref: Optional[str] = field(
+        default=None, metadata=config(field_name="targetRef")
+    )
+    confidence_gte: Optional[int] = field(
+        default=None, metadata=config(field_name="confidence_gte")
+    )
+    confidence_lte: Optional[int] = field(
+        default=None, metadata=config(field_name="confidence_lte")
+    )
+    or_: Optional[List["WatchlistWhereInput"]] = field(
+        default=None, metadata=config(field_name="or")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class FacetInfo:
@@ -2292,6 +2333,26 @@ class IndicatorFilter:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class MalwareFileFilter:
+    """MalwareFileFilter."""
+
+    where: Optional[MalwareFileWhereInput] = field(
+        default=None, metadata=config(field_name="where")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class WatchlistFilter:
+    """WatchlistFilter."""
+
+    where: Optional[WatchlistWhereInput] = field(
+        default=None, metadata=config(field_name="where")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class ThreatIdentityRelationship: