taegis-sdk-python 1.6.3__tar.gz → 1.6.5__tar.gz

{taegis_sdk_python-1.6.3 → taegis_sdk_python-1.6.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.6.3
+Version: 1.6.5
 Summary: Taegis Python SDK
 Project-URL: Homepage, https://github.com/secureworks/taegis-sdk-python
 Project-URL: Bug Reports, https://github.com/secureworks/taegis-sdk-python/issues

{taegis_sdk_python-1.6.3 → taegis_sdk_python-1.6.5}/taegis_sdk_python/_version.py

@@ -1,3 +1,3 @@
 """Version idenitier."""
 
-__version__ = "1.6.3"
+__version__ = "1.6.5"

{taegis_sdk_python-1.6.3 → taegis_sdk_python-1.6.5}/taegis_sdk_python/services/assets2/queries.py

@@ -420,3 +420,72 @@ class TaegisSDKAssets2Query:
         if result.get(endpoint) is not None:
             return AssetsMacAddress.from_dict(result.get(endpoint))
         raise GraphQLNoRowsInResultSetError("for query assetsMacAddress")
+
+    def network_info_by_host_id(self, host_id: str) -> List[NetworkInfo]:
+        """ "Retrieve network information for a host based on a provided host_id."""
+        endpoint = "networkInfoByHostID"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "hostId": prepare_input(host_id),
+            },
+            output=build_output_string(NetworkInfo),
+        )
+        if result.get(endpoint) is not None:
+            return NetworkInfo.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query networkInfoByHostID")
+
+    def network_info_by_hostname(
+        self,
+        event_time: str,
+        host_name: str,
+        exact_match_count: int,
+        endpoint_types: Union[EndpointTypeV2, TaegisEnum],
+    ) -> List[NetworkInfo]:
+        """ "Retrieve network information for a host based on a provided hostname."""
+        endpoint = "networkInfoByHostname"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "eventTime": prepare_input(event_time),
+                "hostName": prepare_input(host_name),
+                "exactMatchCount": prepare_input(exact_match_count),
+                "endpointTypes": prepare_input(endpoint_types),
+            },
+            output=build_output_string(NetworkInfo),
+        )
+        if result.get(endpoint) is not None:
+            return NetworkInfo.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query networkInfoByHostname")
+
+    def network_info_by_ip_address(
+        self,
+        event_time: str,
+        ip_address: str,
+        exact_match_count: int,
+        endpoint_types: Union[EndpointTypeV2, TaegisEnum],
+    ) -> List[NetworkInfo]:
+        """ "Retrieve network information for a host based on a provided ip address."""
+        endpoint = "networkInfoByIpAddress"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "eventTime": prepare_input(event_time),
+                "ipAddress": prepare_input(ip_address),
+                "exactMatchCount": prepare_input(exact_match_count),
+                "endpointTypes": prepare_input(endpoint_types),
+            },
+            output=build_output_string(NetworkInfo),
+        )
+        if result.get(endpoint) is not None:
+            return NetworkInfo.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query networkInfoByIpAddress")

{taegis_sdk_python-1.6.3 → taegis_sdk_python-1.6.5}/taegis_sdk_python/services/assets2/types.py

@@ -481,6 +481,23 @@ class PageInfoV2:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class NetworkInfo:
+    """NetworkInfo."""
+
+    host_id: Optional[str] = field(default=None, metadata=config(field_name="hostId"))
+    host_name: Optional[str] = field(
+        default=None, metadata=config(field_name="hostName")
+    )
+    ip_addresses: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="ipAddresses")
+    )
+    ethernet_addresses: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="ethernetAddresses")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class AssetHostname:

taegis_sdk_python-1.6.5/taegis_sdk_python/services/datasources/mutations.py

@@ -0,0 +1,117 @@
+"""Datasources Mutation."""
+
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python._consts import TaegisEnum
+from taegis_sdk_python.services.datasources.types import *
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.datasources import DatasourcesService
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKDatasourcesMutation:
+    """Taegis Datasources Mutation operations."""
+
+    def __init__(self, service: DatasourcesService):
+        self.service = service
+
+    def delete_data_source_assets(
+        self, delete_asset_input: List[DeleteAssetInput]
+    ) -> List[DeletedAsset]:
+        """Executes a delete operation on all included data sources for a specified tenant. Returns an array of
+        deleted assets with metadata. Authorization permission is required with delete access to the collector
+        object.."""
+        endpoint = "deleteDataSourceAssets"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "deleteAssetInput": prepare_input(delete_asset_input),
+            },
+            output=build_output_string(DeletedAsset),
+        )
+        if result.get(endpoint) is not None:
+            return DeletedAsset.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for mutation deleteDataSourceAssets")
+
+    def delete_data_source_tag(self, tag_id: str) -> bool:
+        """Deleted a tag by its ID. Returns true if the tag was successfully deleted.."""
+        endpoint = "deleteDataSourceTag"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "tagId": prepare_input(tag_id),
+            },
+            output="",
+        )
+        if result.get(endpoint) is not None:
+            return result.get(endpoint)
+        raise GraphQLNoRowsInResultSetError("for mutation deleteDataSourceTag")
+
+    def detach_data_source_tag(self, input_: DataSourceTagOperationInput) -> List[str]:
+        """Detaches an existing tag from datasource(s). Returns the assetIDs that were detached from the tag.."""
+        endpoint = "detachDataSourceTag"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "input": prepare_input(input_),
+            },
+            output="",
+        )
+        if result.get(endpoint) is not None:
+            return result.get(endpoint)
+        raise GraphQLNoRowsInResultSetError("for mutation detachDataSourceTag")
+
+    def create_data_source_tag(self, input_: CreateDataSourceTagInput) -> DataSourceTag:
+        """Creates a new tag and associates it with existing datasource(s). Returns the created tag. This API
+        allows a maximum of 100 tags to be created for a given tenant.."""
+        endpoint = "createDataSourceTag"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "input": prepare_input(input_),
+            },
+            output=build_output_string(DataSourceTag),
+        )
+        if result.get(endpoint) is not None:
+            return DataSourceTag.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for mutation createDataSourceTag")
+
+    def attach_data_source_tag(self, input_: DataSourceTagOperationInput) -> List[str]:
+        """Attaches or associates an existing tag to datasource(s). Returns the assetIDs attached to the tag.
+        A maximum of 100 assetIDs can be associated in a single operation. A single asset can have up to 16 tags attached to it..
+        """
+        endpoint = "attachDataSourceTag"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "input": prepare_input(input_),
+            },
+            output="",
+        )
+        if result.get(endpoint) is not None:
+            return result.get(endpoint)
+        raise GraphQLNoRowsInResultSetError("for mutation attachDataSourceTag")

{taegis_sdk_python-1.6.3 → taegis_sdk_python-1.6.5}/taegis_sdk_python/services/datasources/queries.py

@@ -124,3 +124,31 @@ class TaegisSDKDatasourcesQuery:
         if result.get(endpoint) is not None:
             return LastSeenAssetsQueryResult.from_dict(result.get(endpoint))
         raise GraphQLNoRowsInResultSetError("for query dataSourceLastSeenAssetsQuery")
+
+    def get_data_source_tags(self) -> List[DataSourceTag]:
+        """Fetches all tags associated with a given tenant.."""
+        endpoint = "getDataSourceTags"
+
+        result = self.service.execute_query(
+            endpoint=endpoint, variables={}, output=build_output_string(DataSourceTag)
+        )
+        if result.get(endpoint) is not None:
+            return DataSourceTag.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query getDataSourceTags")
+
+    def get_data_source_tag(self, tag_id: str) -> DataSourceTag:
+        """Fetches a specific tag by its ID.."""
+        endpoint = "getDataSourceTag"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "tagId": prepare_input(tag_id),
+            },
+            output=build_output_string(DataSourceTag),
+        )
+        if result.get(endpoint) is not None:
+            return DataSourceTag.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query getDataSourceTag")

{taegis_sdk_python-1.6.3 → taegis_sdk_python-1.6.5}/taegis_sdk_python/services/datasources/types.py

@@ -26,6 +26,7 @@ class AuthzAction(str, Enum):
 
     READ = "READ"
     DELETE = "DELETE"
+    CREATE = "CREATE"
 
 
 class HealthState(str, Enum):
@@ -160,6 +161,9 @@ class DataSourcesWhereInput:
     collector_id: Optional[List[str]] = field(
         default=None, metadata=config(field_name="collectorId")
     )
+    tag_id: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="tagId")
+    )
 
 
 @dataclass_json
@@ -189,11 +193,61 @@ class ClusterIdentity:
     name: Optional[str] = field(default=None, metadata=config(field_name="name"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class DataSourceTag:
+    """DataSourceTag."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    tenant: Optional[str] = field(default=None, metadata=config(field_name="tenant"))
+    key: Optional[str] = field(default=None, metadata=config(field_name="key"))
+    value: Optional[str] = field(default=None, metadata=config(field_name="value"))
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class CreateDataSourceTagInput:
+    """CreateDataSourceTagInput."""
+
+    key: Optional[str] = field(default=None, metadata=config(field_name="key"))
+    value: Optional[str] = field(default=None, metadata=config(field_name="value"))
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class DataSourceTagOperationInput:
+    """DataSourceTagOperationInput."""
+
+    tag_id: Optional[str] = field(default=None, metadata=config(field_name="tagId"))
+    asset_ids: Optional[List[str]] = field(
+        default=None, metadata=config(field_name="assetIds")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class DataSourceAssetsFilter:
+    """DataSourceAssetsFilter."""
+
+    status: Optional[List[Union[HealthState, TaegisEnum]]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(HealthState, x),
+            field_name="status",
+        ),
+    )
+    where: Optional[DataSourcesWhereInput] = field(
+        default=None, metadata=config(field_name="where")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class LastSeenAsset:
     """LastSeenAsset."""
 
+    asset_id: Optional[str] = field(default=None, metadata=config(field_name="assetId"))
     source_id: Optional[str] = field(
         default=None, metadata=config(field_name="sourceId")
     )
@@ -221,24 +275,15 @@ class LastSeenAsset:
     collector: Optional[ClusterIdentity] = field(
         default=None, metadata=config(field_name="collector")
     )
+    tags: Optional[List[DataSourceTag]] = field(
+        default=None, metadata=config(field_name="tags")
+    )
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class DataSourceAssetsFilter:
-    """DataSourceAssetsFilter."""
-
-    status: Optional[List[Union[HealthState, TaegisEnum]]] = field(
-        default=None,
-        metadata=config(
-            encoder=encode_enum,
-            decoder=lambda x: decode_enum(HealthState, x),
-            field_name="status",
-        ),
-    )
-    where: Optional[DataSourcesWhereInput] = field(
-        default=None, metadata=config(field_name="where")
-    )
+FilterValueResponse = Union[
+    FilterValue,
+    ClusterIdentity,
+]
 
 
 @dataclass_json
@@ -273,12 +318,6 @@ class LastSeenAssetsQueryResult:
     )
 
 
-FilterValueResponse = Union[
-    FilterValue,
-    ClusterIdentity,
-]
-
-
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class FilterValues:

{taegis_sdk_python-1.6.3 → taegis_sdk_python-1.6.5}/taegis_sdk_python/services/entity_context/queries.py

@@ -204,6 +204,30 @@ class TaegisSDKEntityContextQuery:
             )
         raise GraphQLNoRowsInResultSetError("for query entityContextAssociatedEntities")
 
+    def entity_context_associated_entity_types(
+        self,
+        entry_point: EntityContextSingleEntryPoint,
+        source: Optional[EntityContextSourceInput] = None,
+    ) -> EntityContextAssociatedEntityTypesResponse:
+        """None."""
+        endpoint = "entityContextAssociatedEntityTypes"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "entryPoint": prepare_input(entry_point),
+                "source": prepare_input(source),
+            },
+            output=build_output_string(EntityContextAssociatedEntityTypesResponse),
+        )
+        if result.get(endpoint) is not None:
+            return EntityContextAssociatedEntityTypesResponse.from_dict(
+                result.get(endpoint)
+            )
+        raise GraphQLNoRowsInResultSetError(
+            "for query entityContextAssociatedEntityTypes"
+        )
+
     def entity_context_pivot_ql(
         self,
         entry_point: EntityContextEntryPoint,

{taegis_sdk_python-1.6.3 → taegis_sdk_python-1.6.5}/taegis_sdk_python/services/entity_context/types.py

@@ -197,6 +197,15 @@ class EntityContextPageInput:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EntityContextTypeCounts:
+    """EntityContextTypeCounts."""
+
+    type: Optional[str] = field(default=None, metadata=config(field_name="type"))
+    count: Optional[int] = field(default=None, metadata=config(field_name="count"))
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class EntityContextPageInfo:
@@ -392,6 +401,22 @@ class EntityContextWhoIsContact:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EntityContextSingleEntryPoint:
+    """EntityContextSingleEntryPoint."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+    type: Optional[Union[EntityContextEntryPointType, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(EntityContextEntryPointType, x),
+            field_name="type",
+        ),
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class EntityContextOrigin:
@@ -461,6 +486,20 @@ class EntityContextRelatedResources:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class EntityContextAssociatedEntityTypesResponse:
+    """EntityContextAssociatedEntityTypesResponse."""
+
+    total_count: Optional[int] = field(
+        default=None, metadata=config(field_name="totalCount")
+    )
+    error: Optional[str] = field(default=None, metadata=config(field_name="error"))
+    types: Optional[List[EntityContextTypeCounts]] = field(
+        default=None, metadata=config(field_name="types")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class EntityContextPropertyQuery:

{taegis_sdk_python-1.6.3 → taegis_sdk_python-1.6.5}/taegis_sdk_python/services/investigations2/queries.py

@@ -289,6 +289,21 @@ class TaegisSDKInvestigations2Query:
             return CasesAggregation.from_dict(result.get(endpoint))
         raise GraphQLNoRowsInResultSetError("for query casesAggregation")
 
+    def cases_is_key_findings_rich_text(self, id_: str) -> bool:
+        """DO NOT USE: casesIsKeyFindingsRichText is meant for the Taegis/Central UIs only. It may be removed at any time without notice."""
+        endpoint = "casesIsKeyFindingsRichText"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "id": prepare_input(id_),
+            },
+            output="",
+        )
+        if result.get(endpoint) is not None:
+            return result.get(endpoint)
+        raise GraphQLNoRowsInResultSetError("for query casesIsKeyFindingsRichText")
+
     def investigation_v2(self, arguments: InvestigationV2Arguments) -> InvestigationV2:
         """investigationV2 gets a single Investigation.."""
         endpoint = "investigationV2"

{taegis_sdk_python-1.6.3 → taegis_sdk_python-1.6.5}/taegis_sdk_python/services/subjects/types.py

@@ -58,6 +58,14 @@ class CentralUser:
     id: Optional[str] = field(default=None, metadata=config(field_name="id"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class CentralClient:
+    """CentralClient."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class CacheInvalidateInput:
@@ -87,6 +95,7 @@ SubjectIdentity = Union[
     TDRUser,
     Client,
     CentralUser,
+    CentralClient,
 ]
 
 

{taegis_sdk_python-1.6.3 → taegis_sdk_python-1.6.5}/taegis_sdk_python/services/tenants4/types.py

@@ -111,6 +111,21 @@ class CachedEntryType(str, Enum):
     ALL_LICENSES_FOR_TENANT = "ALL_LICENSES_FOR_TENANT"
 
 
+class RetentionMonths(str, Enum):
+    """RetentionMonths."""
+
+    UNKNOWN_MONTHS = "UNKNOWN_MONTHS"
+    ZERO_MONTHS = "ZERO_MONTHS"
+    ONE_MONTH = "ONE_MONTH"
+    THREE_MONTHS = "THREE_MONTHS"
+    TWELVE_MONTHS = "TWELVE_MONTHS"
+    THIRTEEN_MONTHS = "THIRTEEN_MONTHS"
+    EIGHTEEN_MONTHS = "EIGHTEEN_MONTHS"
+    TWENTY_FOUR_MONTHS = "TWENTY_FOUR_MONTHS"
+    THIRTY_SIX_MONTHS = "THIRTY_SIX_MONTHS"
+    SIXTY_MONTHS = "SIXTY_MONTHS"
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class MappedTenant:
@@ -263,6 +278,22 @@ class DeleteCachedEntriesOutput:
     message: Optional[str] = field(default=None, metadata=config(field_name="message"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class RetentionPolicy:
+    """RetentionPolicy."""
+
+    months: Optional[int] = field(default=None, metadata=config(field_name="months"))
+    period: Optional[Union[RetentionMonths, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(RetentionMonths, x),
+            field_name="period",
+        ),
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class ProductCatalogInput:
@@ -406,6 +437,12 @@ class TenantV4:
     support_inherited: Optional[bool] = field(
         default=None, metadata=config(field_name="supportInherited")
     )
+    allow_response_actions: Optional[bool] = field(
+        default=None, metadata=config(field_name="allowResponseActions")
+    )
+    actions_approver: Optional[str] = field(
+        default=None, metadata=config(field_name="actionsApprover")
+    )
     expires_at: Optional[str] = field(
         default=None, metadata=config(field_name="expiresAt")
     )
@@ -446,6 +483,9 @@ class TenantV4:
     central_tenant: Optional[MappedTenant] = field(
         default=None, metadata=config(field_name="centralTenant")
     )
+    data_retention_policy: Optional[RetentionPolicy] = field(
+        default=None, metadata=config(field_name="dataRetentionPolicy")
+    )
 
 
 @dataclass_json

{taegis_sdk_python-1.6.3 → taegis_sdk_python-1.6.5}/taegis_sdk_python/services/threat/queries.py

@@ -136,17 +136,44 @@ class TaegisSDKThreatQuery:
         raise GraphQLNoRowsInResultSetError("for query threatIdentitiesByConfidence")
 
     def threat_watchlist(
-        self, type_: Union[ThreatParentType, TaegisEnum]
+        self,
+        type_: Union[ThreatParentType, TaegisEnum],
+        page: Optional[PageInput] = None,
+        filters: Optional[WatchlistFilter] = None,
     ) -> List[ThreatRelationship]:
         """Gets a watchlist by type. All results are considered **high confidence**.
         Only IP and DOMAIN types are supported. FILE type has been removed from this endpoint.
-        Instead, use the paged endpoint threatTimsMalwareFiles for FILE types.."""
+        Instead, use the paged endpoint threatTimsMalwareFiles for FILE types.
+
+        Results are sorted by the 'created' field in descending order (newest first).
+
+        Additional filtering options:
+        - filters.timeRange: Optional time range filter. If not provided, returns all records.
+          Usage scenarios:
+            - Only start provided: Returns all records from the specified start time to now (no upper bound)
+            - Only end provided: Returns all records from the beginning up to the specified end time (no lower bound)
+            - Both provided: Returns records within the specified time range
+            - Neither provided: Returns all records (no time filtering)
+          Example: filters: { timeRange: { start: "2024-01-01T00:00:00Z", end: "2024-01-31T23:59:59Z" } }
+        - filters.where: Field-specific filtering (targetRef and confidence)
+          Examples:
+            Confidence Range: filters: { where: { confidence_gte: 70, confidence_lte: 90 } }
+            Confidence Minimum: filters: { where: { confidence_gte: 80 } }
+            Confidence Maximum: filters: { where: { confidence_lte: 50 } }
+            Target Filter: filters: { where: { or: [{ targetRef: "malware_name" }] } }
+          Note: Each filter should use either confidence fields OR targetRef, not both in the same where clause
+        - page: Optional pagination controls (offset/limit). If not provided, returns ALL results.
+          When paginating, clients must detect the last page by checking if the number of returned
+          results is less than the requested limit, or if an empty array is returned..
+        """
         endpoint = "threatWatchlist"
 
         result = self.service.execute_query(
             endpoint=endpoint,
             variables={
                 "type": prepare_input(type_),
+                "page": prepare_input(page),
+                "filters": prepare_input(filters),
             },
             output=build_output_string(ThreatRelationship),
         )
@@ -157,22 +184,40 @@ class TaegisSDKThreatQuery:
         raise GraphQLNoRowsInResultSetError("for query threatWatchlist")
 
     def threat_tims_malware_files(
-        self, last_created: Optional[str] = None
+        self,
+        last_created: Optional[str] = None,
+        filters: Optional[MalwareFileFilter] = None,
     ) -> PagedMalwareFiles:
         """Get all TIMS 2.0 Malware file hashes. All results are considered **high confidence**.
-        This is a paged service, requiring repeated queries. Total number of results can number over 750k.
+        This is a cursor-based paged service, requiring repeated queries. Total number of results can number over 750k.
         For the initial query, do not provide any search parameters or set 'last_created' to null.
         Subsequent queries should include the previous query's 'last_created' result from 'PagedMalwareFiles.last_created'
         as the input parameter. Returns pages of 10,000 at a time, sorted by the indicators field 'created' in desc order.
         The returned field 'has_more' will be false when the last page is returned.
         * Note: 'created' refers to an internal field associated with the indicator, not the time the indicator was first found.
-        It is only used for sorting.."""
+        It is only used for sorting.
+
+        Additional filtering options:
+        - filters.timeRange: Optional time range filter. If not provided, returns all records.
+          Usage scenarios:
+            - Only start provided: Returns all records from the specified start time to now (no upper bound)
+            - Only end provided: Returns all records from the beginning up to the specified end time (no lower bound)
+            - Both provided: Returns records within the specified time range
+            - Neither provided: Returns all records (no time filtering)
+          Example: filters: { timeRange: { start: "2024-01-01T00:00:00Z", end: "2024-01-31T23:59:59Z" } }
+        - filters.where: Threat description filtering via OR array format only
+          Example: filters: { where: { or: [{ threatDescription: "malware_name" }] } }
+
+        Pagination: Uses cursor-based pagination with 'last_created' parameter. For small time ranges
+        (results < 10k), all data is returned in one response. For larger datasets, use 'last_created'
+        to paginate through results.."""
         endpoint = "threatTimsMalwareFiles"
 
         result = self.service.execute_query(
             endpoint=endpoint,
             variables={
                 "last_created": prepare_input(last_created),
+                "filters": prepare_input(filters),
             },
             output=build_output_string(PagedMalwareFiles),
         )