taegis-sdk-python 1.6.4__tar.gz → 1.6.5__tar.gz

{taegis_sdk_python-1.6.4 → taegis_sdk_python-1.6.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.6.4
+Version: 1.6.5
 Summary: Taegis Python SDK
 Project-URL: Homepage, https://github.com/secureworks/taegis-sdk-python
 Project-URL: Bug Reports, https://github.com/secureworks/taegis-sdk-python/issues

{taegis_sdk_python-1.6.4 → taegis_sdk_python-1.6.5}/taegis_sdk_python/_version.py

@@ -1,3 +1,3 @@
 """Version idenitier."""
 
-__version__ = "1.6.4"
+__version__ = "1.6.5"

{taegis_sdk_python-1.6.4 → taegis_sdk_python-1.6.5}/taegis_sdk_python/services/investigations2/queries.py

@@ -289,6 +289,21 @@ class TaegisSDKInvestigations2Query:
             return CasesAggregation.from_dict(result.get(endpoint))
         raise GraphQLNoRowsInResultSetError("for query casesAggregation")
 
+    def cases_is_key_findings_rich_text(self, id_: str) -> bool:
+        """DO NOT USE: casesIsKeyFindingsRichText is meant for the Taegis/Central UIs only. It may be removed at any time without notice."""
+        endpoint = "casesIsKeyFindingsRichText"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "id": prepare_input(id_),
+            },
+            output="",
+        )
+        if result.get(endpoint) is not None:
+            return result.get(endpoint)
+        raise GraphQLNoRowsInResultSetError("for query casesIsKeyFindingsRichText")
+
     def investigation_v2(self, arguments: InvestigationV2Arguments) -> InvestigationV2:
         """investigationV2 gets a single Investigation.."""
         endpoint = "investigationV2"

{taegis_sdk_python-1.6.4 → taegis_sdk_python-1.6.5}/taegis_sdk_python/services/subjects/types.py

@@ -58,6 +58,14 @@ class CentralUser:
     id: Optional[str] = field(default=None, metadata=config(field_name="id"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class CentralClient:
+    """CentralClient."""
+
+    id: Optional[str] = field(default=None, metadata=config(field_name="id"))
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class CacheInvalidateInput:
@@ -87,6 +95,7 @@ SubjectIdentity = Union[
     TDRUser,
     Client,
     CentralUser,
+    CentralClient,
 ]
 
 

{taegis_sdk_python-1.6.4 → taegis_sdk_python-1.6.5}/taegis_sdk_python/services/tenants4/types.py

@@ -111,6 +111,21 @@ class CachedEntryType(str, Enum):
     ALL_LICENSES_FOR_TENANT = "ALL_LICENSES_FOR_TENANT"
 
 
+class RetentionMonths(str, Enum):
+    """RetentionMonths."""
+
+    UNKNOWN_MONTHS = "UNKNOWN_MONTHS"
+    ZERO_MONTHS = "ZERO_MONTHS"
+    ONE_MONTH = "ONE_MONTH"
+    THREE_MONTHS = "THREE_MONTHS"
+    TWELVE_MONTHS = "TWELVE_MONTHS"
+    THIRTEEN_MONTHS = "THIRTEEN_MONTHS"
+    EIGHTEEN_MONTHS = "EIGHTEEN_MONTHS"
+    TWENTY_FOUR_MONTHS = "TWENTY_FOUR_MONTHS"
+    THIRTY_SIX_MONTHS = "THIRTY_SIX_MONTHS"
+    SIXTY_MONTHS = "SIXTY_MONTHS"
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class MappedTenant:
@@ -263,6 +278,22 @@ class DeleteCachedEntriesOutput:
     message: Optional[str] = field(default=None, metadata=config(field_name="message"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class RetentionPolicy:
+    """RetentionPolicy."""
+
+    months: Optional[int] = field(default=None, metadata=config(field_name="months"))
+    period: Optional[Union[RetentionMonths, TaegisEnum]] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(RetentionMonths, x),
+            field_name="period",
+        ),
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class ProductCatalogInput:
@@ -406,6 +437,12 @@ class TenantV4:
     support_inherited: Optional[bool] = field(
         default=None, metadata=config(field_name="supportInherited")
     )
+    allow_response_actions: Optional[bool] = field(
+        default=None, metadata=config(field_name="allowResponseActions")
+    )
+    actions_approver: Optional[str] = field(
+        default=None, metadata=config(field_name="actionsApprover")
+    )
     expires_at: Optional[str] = field(
         default=None, metadata=config(field_name="expiresAt")
     )
@@ -446,6 +483,9 @@ class TenantV4:
     central_tenant: Optional[MappedTenant] = field(
         default=None, metadata=config(field_name="centralTenant")
     )
+    data_retention_policy: Optional[RetentionPolicy] = field(
+        default=None, metadata=config(field_name="dataRetentionPolicy")
+    )
 
 
 @dataclass_json

{taegis_sdk_python-1.6.4 → taegis_sdk_python-1.6.5}/taegis_sdk_python/services/threat/queries.py

@@ -138,8 +138,6 @@ class TaegisSDKThreatQuery:
     def threat_watchlist(
         self,
         type_: Union[ThreatParentType, TaegisEnum],
-        added_after: Optional[str] = None,
-        added_before: Optional[str] = None,
         page: Optional[PageInput] = None,
         filters: Optional[WatchlistFilter] = None,
     ) -> List[ThreatRelationship]:
@@ -150,29 +148,30 @@ class TaegisSDKThreatQuery:
         Results are sorted by the 'created' field in descending order (newest first).
 
         Additional filtering options:
-        - addedAfter: input timestamp to filter records created after this time
-        - addedBefore: input timestamp to filter records created before this time
-        - page: Optional pagination controls (offset/limit). If not provided, returns ALL results.
-          When paginating, clients must detect the last page by checking if the number of returned
-          results is less than the requested limit, or if an empty array is returned.
-        - filters: Supports targetRef and confidence filtering
+        - filters.timeRange: Optional time range filter. If not provided, returns all records.
+          Usage scenarios:
+            - Only start provided: Returns all records from the specified start time to now (no upper bound)
+            - Only end provided: Returns all records from the beginning up to the specified end time (no lower bound)
+            - Both provided: Returns records within the specified time range
+            - Neither provided: Returns all records (no time filtering)
+          Example: filters: { timeRange: { start: "2024-01-01T00:00:00Z", end: "2024-01-31T23:59:59Z" } }
+        - filters.where: Field-specific filtering (targetRef and confidence)
           Examples:
             Confidence Range: filters: { where: { confidence_gte: 70, confidence_lte: 90 } }
             Confidence Minimum: filters: { where: { confidence_gte: 80 } }
             Confidence Maximum: filters: { where: { confidence_lte: 50 } }
             Target Filter: filters: { where: { or: [{ targetRef: "malware_name" }] } }
           Note: Each filter should use either confidence fields OR targetRef, not both in the same where clause
-
-        Time range examples:
-          - addedAfter: "2024-01-01T00:00:00Z", addedBefore: "2024-01-31T23:59:59Z"."""
+        - page: Optional pagination controls (offset/limit). If not provided, returns ALL results.
+          When paginating, clients must detect the last page by checking if the number of returned
+          results is less than the requested limit, or if an empty array is returned..
+        """
         endpoint = "threatWatchlist"
 
         result = self.service.execute_query(
             endpoint=endpoint,
             variables={
                 "type": prepare_input(type_),
-                "addedAfter": prepare_input(added_after),
-                "addedBefore": prepare_input(added_before),
                 "page": prepare_input(page),
                 "filters": prepare_input(filters),
             },
@@ -187,8 +186,6 @@ class TaegisSDKThreatQuery:
     def threat_tims_malware_files(
         self,
         last_created: Optional[str] = None,
-        added_after: Optional[str] = None,
-        added_before: Optional[str] = None,
         filters: Optional[MalwareFileFilter] = None,
     ) -> PagedMalwareFiles:
         """Get all TIMS 2.0 Malware file hashes. All results are considered **high confidence**.
@@ -201,14 +198,16 @@ class TaegisSDKThreatQuery:
         It is only used for sorting.
 
         Additional filtering options:
-        - addedAfter: input timestamp to filter records created after this time
-        - addedBefore: input timestamp to filter records created before this time
-        - filters: Supports threat description filtering via OR array format only
+        - filters.timeRange: Optional time range filter. If not provided, returns all records.
+          Usage scenarios:
+            - Only start provided: Returns all records from the specified start time to now (no upper bound)
+            - Only end provided: Returns all records from the beginning up to the specified end time (no lower bound)
+            - Both provided: Returns records within the specified time range
+            - Neither provided: Returns all records (no time filtering)
+          Example: filters: { timeRange: { start: "2024-01-01T00:00:00Z", end: "2024-01-31T23:59:59Z" } }
+        - filters.where: Threat description filtering via OR array format only
           Example: filters: { where: { or: [{ threatDescription: "malware_name" }] } }
 
-        Time range examples:
-          - addedAfter: "2024-01-01T00:00:00Z", addedBefore: "2024-01-31T23:59:59Z"
-
         Pagination: Uses cursor-based pagination with 'last_created' parameter. For small time ranges
         (results < 10k), all data is returned in one response. For larger datasets, use 'last_created'
         to paginate through results.."""
@@ -218,8 +217,6 @@ class TaegisSDKThreatQuery:
             endpoint=endpoint,
             variables={
                 "last_created": prepare_input(last_created),
-                "addedAfter": prepare_input(added_after),
-                "addedBefore": prepare_input(added_before),
                 "filters": prepare_input(filters),
             },
             output=build_output_string(PagedMalwareFiles),

{taegis_sdk_python-1.6.4 → taegis_sdk_python-1.6.5}/taegis_sdk_python/services/threat/types.py

@@ -355,6 +355,15 @@ class PageInput:
     offset: Optional[int] = field(default=None, metadata=config(field_name="offset"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class ThreatTimeRangeInput:
+    """ThreatTimeRangeInput."""
+
+    start: Optional[str] = field(default=None, metadata=config(field_name="start"))
+    end: Optional[str] = field(default=None, metadata=config(field_name="end"))
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class Facet:
@@ -1510,6 +1519,32 @@ class IndicatorWhereInput:
     )
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class MalwareFileFilter:
+    """MalwareFileFilter."""
+
+    where: Optional[MalwareFileWhereInput] = field(
+        default=None, metadata=config(field_name="where")
+    )
+    time_range: Optional[ThreatTimeRangeInput] = field(
+        default=None, metadata=config(field_name="timeRange")
+    )
+
+
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class WatchlistFilter:
+    """WatchlistFilter."""
+
+    where: Optional[WatchlistWhereInput] = field(
+        default=None, metadata=config(field_name="where")
+    )
+    time_range: Optional[ThreatTimeRangeInput] = field(
+        default=None, metadata=config(field_name="timeRange")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class SortByInput:
@@ -2333,26 +2368,6 @@ class IndicatorFilter:
     )
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class MalwareFileFilter:
-    """MalwareFileFilter."""
-
-    where: Optional[MalwareFileWhereInput] = field(
-        default=None, metadata=config(field_name="where")
-    )
-
-
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class WatchlistFilter:
-    """WatchlistFilter."""
-
-    where: Optional[WatchlistWhereInput] = field(
-        default=None, metadata=config(field_name="where")
-    )
-
-
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class ThreatIdentityRelationship:
@@ -2474,6 +2489,9 @@ class ThreatIndicatorIntelligence:
     groups: Optional[List[ThreatGroupRelationship]] = field(
         default=None, metadata=config(field_name="groups")
     )
+    watchlists: Optional[List[ThreatRelationship]] = field(
+        default=None, metadata=config(field_name="watchlists")
+    )
 
 
 @dataclass_json

{taegis_sdk_python-1.6.4 → taegis_sdk_python-1.6.5}/taegis_sdk_python/services/trip/queries.py

@@ -130,3 +130,16 @@ class TaegisSDKTripQuery:
                 [r or {} for r in result.get(endpoint)], many=True
             )
         raise GraphQLNoRowsInResultSetError("for query getEnvConfig")
+
+    def list_allowed_products_for_tenant(self) -> List[ApiProduct]:
+        """None."""
+        endpoint = "listAllowedProductsForTenant"
+
+        result = self.service.execute_query(
+            endpoint=endpoint, variables={}, output=build_output_string(ApiProduct)
+        )
+        if result.get(endpoint) is not None:
+            return ApiProduct.schema().load(
+                [r or {} for r in result.get(endpoint)], many=True
+            )
+        raise GraphQLNoRowsInResultSetError("for query listAllowedProductsForTenant")

{taegis_sdk_python-1.6.4 → taegis_sdk_python-1.6.5}/taegis_sdk_python/services/users/mutations.py

@@ -130,6 +130,25 @@ class TaegisSDKUsersMutation:
             "for mutation currentTDRUserChangeEmailAddress"
         )
 
+    def current_tdruser_change_email_validate(
+        self, change_email_input: ChangeEmailAddressValidationInput
+    ) -> TDRUser:
+        """Validate the account owner initiated email address change."""
+        endpoint = "currentTDRUserChangeEmailValidate"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "changeEmailInput": prepare_input(change_email_input),
+            },
+            output=build_output_string(TDRUser),
+        )
+        if result.get(endpoint) is not None:
+            return TDRUser.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError(
+            "for mutation currentTDRUserChangeEmailValidate"
+        )
+
     def remove_tdruser_roles(self, id_: str, roles: List[str]) -> TDRUser:
         """Remove roles from a user. Roles can either contain the role ID or role assignment ID."""
         endpoint = "removeTDRUserRoles"

{taegis_sdk_python-1.6.4 → taegis_sdk_python-1.6.5}/taegis_sdk_python/services/users/types.py

@@ -432,6 +432,22 @@ class SetLastLoginInput:
     last_ip: Optional[str] = field(default=None, metadata=config(field_name="last_ip"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class ChangeEmailAddressValidationInput:
+    """ChangeEmailAddressValidationInput."""
+
+    ticket_id: Optional[str] = field(
+        default=None, metadata=config(field_name="ticket_id")
+    )
+    email_address: Optional[str] = field(
+        default=None, metadata=config(field_name="email_address")
+    )
+    new_email_address: Optional[str] = field(
+        default=None, metadata=config(field_name="new_email_address")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class TDRUserInviteInput: