tcex 4.0.11.dev2__tar.gz → 5.0.0.dev0__tar.gz

{tcex-4.0.11.dev2/tcex.egg-info → tcex-5.0.0.dev0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tcex
-Version: 4.0.11.dev2
+Version: 5.0.0.dev0
 Summary: ThreatConnect Exchange App Framework
 Author-email: ThreatConnect <support@threatconnect.com>
 License-Expression: Apache-2.0
@@ -27,7 +27,8 @@ Requires-Dist: isort>=6.0.0
 Requires-Dist: jmespath>=1.0.1
 Requires-Dist: paho-mqtt<3.0.0
 Requires-Dist: pyaes>=1.6.1
-Requires-Dist: pydantic<2.0.0
+Requires-Dist: pydantic-core<3.0.0,>=2.10.0
+Requires-Dist: pydantic<3.0.0,>=2.10.0
 Requires-Dist: python-dateutil>=2.9.0.post0
 Requires-Dist: pyyaml>=6.0.2
 Requires-Dist: redis<5.0.0

{tcex-4.0.11.dev2 → tcex-5.0.0.dev0}/pyproject.toml

@@ -1,7 +1,7 @@
 # Specify the build backend for PEP 517 builds
 [build-system]
 build-backend = "setuptools.build_meta"
-requires = ["setuptools>=61"]
+requires = ["requests", "setuptools>=61"]
 
 # Project metadata and configuration
 [project]
@@ -31,7 +31,8 @@ dependencies = [
   "jmespath>=1.0.1",
   "paho-mqtt<3.0.0",
   "pyaes>=1.6.1",
-  "pydantic<2.0.0",
+  "pydantic-core>=2.10.0,<3.0.0",
+  "pydantic>=2.10.0,<3.0.0",
   "python-dateutil>=2.9.0.post0",
   "pyyaml>=6.0.2",
   "redis<5.0.0",
@@ -78,6 +79,7 @@ dev = [
 ]
 test = [
   "deepdiff>=8.2.0",
+  "python-dotenv>=1.2.1",
   "fakeredis>=2.27.0",
   "pytest>=8.3.4",
   "pytest-cov>=6.0.0",
@@ -99,6 +101,34 @@ exclude = ["tests*", "local-*"]
 # Tool configurations
 #
 
+# This must remain while code_operations still uses isort directly.
+[tool.isort]
+dedup_headings = false
+include_trailing_comma = true
+known_first_party = ""
+known_local_folder = "."
+known_third_party = ""
+line_length = 100
+profile = "black"
+
+[tool.uv.extra-build-dependencies]
+tcex = [
+  "arrow>=1.3.0",
+  "black>=25.1.0",
+  "inflection>=0.5.1",
+  "jmespath>=1.0.1",
+  "paho-mqtt<2.0.0",
+  "pyaes>=1.6.1",
+  "pydantic>2.0.0",
+  "python-dateutil>=2.9.0.post0",
+  "pyyaml>=6.0.2",
+  "redis<5.0.0",
+  "requests>=2.32.3",
+  "rich>=13.9.4",
+  "semantic-version>=2.10.0",
+  "wrapt>=1.17.2",
+]
+
 # Configuration for bumpversion tool
 [tool.bumpversion]
 # Allow version bumping even if there are uncommitted changes
@@ -108,7 +138,7 @@ commit = false
 # Additional arguments to pass to the git commit command
 commit_args = "--no-verify"
 # The current version of the project
-current_version = "4.0.11-dev2"
+current_version = "5.0.0-dev0"
 # The commit message template used when committing version bumps
 message = "Version updated from {current_version} to {new_version}"
 # Regular expression for parsing version strings
@@ -149,19 +179,6 @@ filename = "tcex/__metadata__.py"
 ignore-words-list = "ore"
 skip = "*.cspell*,*.history,*local,uv.lock"
 
-# Configuration for isort import sorter
-[tool.isort]
-dedup_headings = false
-import_heading_firstparty = "first-party"
-import_heading_stdlib = "standard library"
-import_heading_thirdparty = "third-party"
-include_trailing_comma = true
-known_first_party = ""
-known_local_folder = "."
-known_third_party = ""
-line_length = 100
-profile = "black"
-
 # Configuration for pyright type checker
 [tool.pyright]
 # https://github.com/microsoft/pyright/blob/main/docs/configuration.md#sample-pyprojecttoml-file
@@ -185,6 +202,8 @@ junit_family = "xunit2"
 testpaths = [
   "tests",
 ]
+# Enable multiprocessing support for pytest
+# addopts = "--numprocesses=auto --dist=loadgroup"
 
 # Configuration for ruff linter and formatter
 [tool.ruff]
@@ -240,7 +259,7 @@ ignore = [
   "PLR0915", # Too many statements
   "PT006", # Wrong name(s) type in ..., expected ...
   "TC001", # Move application import ... into a type-checking block
-  "TC003", # Use `if TYPE_CHECKING:` for imports only used for type checking
+  "TC003", # Move standard library import ... into a type-checking block
   "TC006", # Checks for unquoted type expressions in typing.cast() calls.
   "TID252", # Prefer absolute imports over relative imports from parent modules
 ]
@@ -306,8 +325,57 @@ select = [
 [tool.ruff.lint.extend-per-file-ignores]
 "__init__.py" = ["F401"]
 
+[tool.ruff.lint.isort]
+# Define a default section for any imports that don't fit into the specified section-order.
+default-section = "first-party"
+
+# A list of modules to consider standard-library, in addition to those known to Ruff in advance
+extra-standard-library = []
+
+# Map known_first_party to known-first-party
+known-first-party = ["tcex"]
+
+# Map known_local_folder to known-local-folder
+known-local-folder = ["."]
+
+# Map known_third_party to known-third-party
+known-third-party = [
+  "arrow",
+  "cryptography",
+  "dotenv",
+  "pydantic",
+  "pydantic_core",
+  "pydantic_settings",
+  "pytest",
+  "redis",
+  "requests",
+  "semantic_version",
+]
+
+# Override in which order the sections should be output. Can be used to move custom sections.
+section-order = ["future", "standard-library", "third-party", "first-party", "local-folder"]
+
+# Equivalent to include_trailing_comma = true
+split-on-trailing-comma = true
+
 # Pydocstyle configuration for ruff linter
 [tool.ruff.lint.pydocstyle]
 # https://docs.astral.sh/ruff/linter/
 
 convention = "google"
+
+[tool.cibuildwheel]
+# You can also put cibuildwheel config here instead of env vars
+build = "cp38-* cp39-* cp310-* cp311-* cp312-*"
+skip = "*-win32 *-manylinux_i686 *-musllinux_i686 pp*"
+
+[tool.cibuildwheel.linux]
+before-build = "pip install -U pip setuptools wheel"
+repair-wheel-command = "auditwheel repair -w {dest_dir} {wheel}"
+
+[tool.cibuildwheel.macos]
+before-build = "pip install -U pip setuptools wheel"
+repair-wheel-command = "delocate-wheel --require-archs {delocate_archs} -w {dest_dir} -v {wheel}"
+
+[tool.cibuildwheel.windows]
+before-build = "pip install -U pip setuptools wheel"

{tcex-4.0.11.dev2 → tcex-5.0.0.dev0}/tcex/__init__.py

@@ -1,10 +1,8 @@
 """TcEx Framework Module"""
 
-# standard library
 import contextlib
 import logging
 
-# first-party
 from tcex.__metadata__ import __license__, __version__
 from tcex.logger.cache_handler import CacheHandler
 from tcex.logger.trace_logger import TraceLogger
@@ -33,6 +31,6 @@ def initialize_logger():
 # init logger before instantiating tcex
 initialize_logger()
 
+
 with contextlib.suppress(ImportError):
-    # first-party
     from tcex.tcex import TcEx

{tcex-4.0.11.dev2 → tcex-5.0.0.dev0}/tcex/__metadata__.py

@@ -1,4 +1,4 @@
 """TcEx Framework Module"""
 
 __license__ = 'Apache-2.0'
-__version__ = '4.0.11-dev2'
+__version__ = '5.0.0-dev0'

{tcex-4.0.11.dev2 → tcex-5.0.0.dev0}/tcex/api/api.py

@@ -1,9 +1,7 @@
 """TcEx Framework Module"""
 
-# third-party
 from requests import Session  # TYPE-CHECKING
 
-# first-party
 from tcex.api.tc.tc import TC
 from tcex.input.input import Input  # TYPE-CHECKING
 from tcex.pleb.cached_property import cached_property
@@ -24,8 +22,5 @@ class API:
 
     @cached_property
     def tc(self) -> TC:
-        """Return a TC instance.
-
-        TC is a top-level class for accessing the ThreatConnect API.
-        """
+        """Return a case management instance."""
         return TC(self.inputs, self.session_tc)

{tcex-4.0.11.dev2 → tcex-5.0.0.dev0}/tcex/api/tc/tc.py

@@ -1,11 +1,10 @@
 """TcEx Framework Module"""
 
-# third-party
-from requests import Session  # TYPE-CHECKING
+from requests import Session
 
-# first-party
 from tcex.api.tc.ti_transform import TiTransform, TiTransforms
 from tcex.api.tc.ti_transform.model import GroupTransformModel, IndicatorTransformModel
+from tcex.api.tc.ti_transform.model.transform_model import AssociationTransformModel
 from tcex.api.tc.util.threat_intel_util import ThreatIntelUtil
 from tcex.api.tc.v2.v2 import V2
 from tcex.api.tc.v3.v3 import V3
@@ -26,6 +25,11 @@ class TC:
         self.inputs = inputs
         self.session_tc = session_tc
 
+    @staticmethod
+    def association_transform(transform: dict) -> AssociationTransformModel:
+        """Return a association transform model."""
+        return AssociationTransformModel(**transform)
+
     @staticmethod
     def group_transform(transform: dict) -> GroupTransformModel:
         """Return a group transform model."""
@@ -39,7 +43,7 @@ class TC:
     @staticmethod
     def ti_transform(
         ti_dict: dict,
-        transforms: list[GroupTransformModel | IndicatorTransformModel],
+        transforms: list[AssociationTransformModel | GroupTransformModel | IndicatorTransformModel],
     ) -> TiTransform:
         """Return an instance of TI Transform class."""
         return TiTransform(ti_dict, transforms)
@@ -47,14 +51,10 @@ class TC:
     @staticmethod
     def ti_transforms(
         ti_dict: list[dict],
-        transforms: list[GroupTransformModel | IndicatorTransformModel],
-        *,
-        seperate_batch_associations: bool = False,
+        transforms: list[AssociationTransformModel | GroupTransformModel | IndicatorTransformModel],
     ) -> TiTransforms:
         """Return an instance of TI Transforms class."""
-        return TiTransforms(
-            ti_dict, transforms, seperate_batch_associations=seperate_batch_associations
-        )
+        return TiTransforms(ti_dict, transforms)
 
     @cached_property
     def utils(self) -> ThreatIntelUtil:

{tcex-4.0.11.dev2 → tcex-5.0.0.dev0}/tcex/api/tc/ti_transform/__init__.py

@@ -1,6 +1,5 @@
 """TcEx Framework Module"""
 
-# first-party
 from tcex.api.tc.ti_transform.ti_predefined_functions import (
     ProcessingFunctions,
     transform_builder_to_model,

{tcex-4.0.11.dev2 → tcex-5.0.0.dev0}/tcex/api/tc/ti_transform/model/__init__.py

@@ -1,6 +1,5 @@
 """TcEx Framework Module"""
 
-# first-party
 from tcex.api.tc.ti_transform.model.transform_model import (
     AttributeTransformModel,
     DatetimeTransformModel,

{tcex-4.0.11.dev2 → tcex-5.0.0.dev0}/tcex/api/tc/ti_transform/model/transform_model.py

@@ -1,11 +1,11 @@
 """Model Definition"""
 
-# standard library
 from collections.abc import Callable
+from typing import Annotated, Any, TypeAlias
+
+from pydantic import BaseModel, Discriminator, Field, Tag, field_validator, model_validator
 
-# third-party
 from jmespath import compile as jmespath_compile
-from pydantic import BaseModel, Extra, Field, root_validator, validator
 
 
 # reusable validator
@@ -16,14 +16,14 @@ def _always_array(value: list | str) -> list[str]:
     return value
 
 
-class PredefinedFunctionModel(BaseModel, extra=Extra.forbid):
+class PredefinedFunctionModel(BaseModel, extra='forbid'):
     """Model Definitions"""
 
     name: str = Field(..., description='The name of the static method.')
     params: dict | None = Field({}, description='The parameters for the static method.')
 
 
-class TransformModel(BaseModel, extra=Extra.forbid):
+class TransformModel(BaseModel, extra='forbid'):
     """Model Definition"""
 
     filter_map: dict | None = Field(None, description='')
@@ -32,7 +32,7 @@ class TransformModel(BaseModel, extra=Extra.forbid):
     for_each: Callable | PredefinedFunctionModel | None = Field(None, description='')
     static_map: dict | None = Field(None, description='')
 
-    @validator('filter_map', 'static_map', pre=True)
+    @field_validator('filter_map', 'static_map', mode='before')
     @classmethod
     def _lower_map_keys(cls, v):
         """Validate static_map."""
@@ -41,7 +41,7 @@ class TransformModel(BaseModel, extra=Extra.forbid):
         return v
 
     # root validator that ensure at least one indicator value/summary is set
-    @root_validator()
+    @model_validator(mode='before')
     @classmethod
     def _required_transform(cls, v: dict):
         """Validate either static_map or method is defined."""
@@ -58,13 +58,13 @@ class TransformModel(BaseModel, extra=Extra.forbid):
         return v
 
 
-class PathTransformModel(BaseModel, extra=Extra.forbid):
+class PathTransformModel(BaseModel, extra='forbid'):
     """."""
 
-    default: str | None = Field(None, description='')
+    default: int | str | None = Field(None, description='')
     path: str | None = Field(None, description='')
 
-    @validator('path')
+    @field_validator('path')
     @classmethod
     def _validate_path(cls, v):
         """Validate path."""
@@ -77,7 +77,7 @@ class PathTransformModel(BaseModel, extra=Extra.forbid):
         return v
 
     # root validator that ensure at least one indicator value/summary is set
-    @root_validator()
+    @model_validator(mode='before')
     @classmethod
     def _default_or_path(cls, values):
         """Validate either default or path is defined."""
@@ -87,22 +87,22 @@ class PathTransformModel(BaseModel, extra=Extra.forbid):
         return values
 
 
-class MetadataTransformModel(PathTransformModel, extra=Extra.forbid):
+class MetadataTransformModel(PathTransformModel, extra='forbid'):
     """."""
 
     transform: list[TransformModel] | None = Field(None, description='')
 
     # validators
-    _transform_array = validator('transform', allow_reuse=True, pre=True)(_always_array)
+    _transform_array = field_validator('transform', mode='before')(_always_array)
 
 
-class ValueTransformModel(BaseModel, extra=Extra.forbid):
+class ValueTransformModel(BaseModel, extra='forbid'):
     """."""
 
     value: str | MetadataTransformModel
 
 
-class FileOccurrenceTransformModel(BaseModel, extra=Extra.forbid):
+class FileOccurrenceTransformModel(BaseModel, extra='forbid'):
     """."""
 
     file_name: str | MetadataTransformModel | None = Field(None, description='')
@@ -110,22 +110,22 @@ class FileOccurrenceTransformModel(BaseModel, extra=Extra.forbid):
     date: str | MetadataTransformModel | None = Field(None, description='')
 
 
-class DatetimeTransformModel(PathTransformModel, extra=Extra.forbid):
+class DatetimeTransformModel(PathTransformModel, extra='forbid'):
     """."""
 
 
-class AssociatedGroupTransform(ValueTransformModel, extra=Extra.forbid):
+class AssociatedGroupTransform(ValueTransformModel, extra='forbid'):
     """."""
 
 
-class AssociatedIndicatorFromGroupTransform(BaseModel, extra=Extra.forbid):
+class AssociatedIndicatorFromGroupTransform(BaseModel, extra='forbid'):
     """."""
 
     summary: str | MetadataTransformModel = Field(..., description='')
     indicator_type: str | MetadataTransformModel = Field(..., description='')
 
 
-class AssociatedIndicatorFromIndicatorTransform(BaseModel, extra=Extra.forbid):
+class AssociatedIndicatorFromIndicatorTransform(BaseModel, extra='forbid'):
     """."""
 
     summary: str | MetadataTransformModel = Field(..., description='')
@@ -133,7 +133,7 @@ class AssociatedIndicatorFromIndicatorTransform(BaseModel, extra=Extra.forbid):
     association_type: str | MetadataTransformModel = Field(..., description='')
 
 
-class AttributeTransformModel(ValueTransformModel, extra=Extra.forbid):
+class AttributeTransformModel(ValueTransformModel, extra='forbid'):
     """."""
 
     displayed: bool | MetadataTransformModel = Field(default=False, description='')
@@ -142,18 +142,18 @@ class AttributeTransformModel(ValueTransformModel, extra=Extra.forbid):
     pinned: bool | MetadataTransformModel = Field(default=False, description='')
 
 
-class SecurityLabelTransformModel(ValueTransformModel, extra=Extra.forbid):
+class SecurityLabelTransformModel(ValueTransformModel, extra='forbid'):
     """."""
 
     color: MetadataTransformModel | None = Field(None, description='')
     description: MetadataTransformModel | None = Field(None, description='')
 
 
-class TagTransformModel(ValueTransformModel, extra=Extra.forbid):
+class TagTransformModel(ValueTransformModel, extra='forbid'):
     """."""
 
 
-class TiTransformModel(BaseModel, extra=Extra.forbid):
+class TiTransformModel(BaseModel, extra='forbid'):
     """."""
 
     applies: Callable | None = Field(None, description='')
@@ -172,7 +172,7 @@ class TiTransformModel(BaseModel, extra=Extra.forbid):
     xid: MetadataTransformModel | None = Field(None, description='')
 
 
-class GroupTransformModel(TiTransformModel, extra=Extra.forbid):
+class GroupTransformModel(TiTransformModel, extra='forbid'):
     """."""
 
     associated_indicators: list[AssociatedIndicatorFromGroupTransform] = Field([], description='')
@@ -202,7 +202,7 @@ class GroupTransformModel(TiTransformModel, extra=Extra.forbid):
     severity: MetadataTransformModel | None = Field(None, description='')
 
 
-class IndicatorTransformModel(TiTransformModel, extra=Extra.forbid):
+class IndicatorTransformModel(TiTransformModel, extra='forbid'):
     """."""
 
     associated_indicators: list[AssociatedIndicatorFromIndicatorTransform] = Field(
@@ -223,10 +223,10 @@ class IndicatorTransformModel(TiTransformModel, extra=Extra.forbid):
     active: MetadataTransformModel | None = Field(None, description='')
 
     # root validator that ensure at least one indicator value/summary is set
-    @root_validator()
+    @model_validator(mode='before')
     @classmethod
     def _one_indicator_value(cls, values):
-        """Validate that one set of credentials is provided for the TC API."""
+        """Validate that at least one indicator value is provided."""
 
         if not any(
             [
@@ -235,8 +235,67 @@ class IndicatorTransformModel(TiTransformModel, extra=Extra.forbid):
                 values.get('value3'),
             ]
         ):
-            ex_msg = (
-                'An indicator transform must be defined (e.g., summary, value1, value2, value3).'
-            )
+            ex_msg = 'An indicator transform must be defined (e.g., value1, value2, value3).'
             raise ValueError(ex_msg)
         return values
+
+
+class GroupToGroupAssociation(BaseModel, extra='forbid'):
+    """."""
+
+    xid_1: MetadataTransformModel = Field(..., description='')
+    xid_2: MetadataTransformModel = Field(..., description='')
+
+
+class GroupToIndicatorAssociation(BaseModel, extra='forbid'):
+    """."""
+
+    xid: MetadataTransformModel = Field(..., description='')
+    indicator_value: MetadataTransformModel = Field(..., description='')
+    indicator_type: MetadataTransformModel = Field(..., description='')
+
+
+class IndicatorToIndicatorAssociation(BaseModel, extra='forbid'):
+    """."""
+
+    indicator_value_1: MetadataTransformModel = Field(..., description='')
+    indicator_type_1: MetadataTransformModel = Field(..., description='')
+    indicator_value_2: MetadataTransformModel = Field(..., description='')
+    indicator_type_2: MetadataTransformModel = Field(..., description='')
+    custom_association_type: MetadataTransformModel = Field(..., description='')
+
+
+def get_association_discriminator(v: Any) -> str:
+    """Return the association type discriminator value."""
+    if isinstance(v, BaseModel):
+        return v.__class__.__name__
+
+    if 'xid_1' in v and 'xid_2' in v:
+        return GroupToGroupAssociation.__name__
+    if 'xid' in v and 'indicator_value' in v and 'indicator_type' in v:
+        return GroupToIndicatorAssociation.__name__
+    if (
+        'indicator_value_1' in v
+        and 'indicator_type_1' in v
+        and 'indicator_value_2' in v
+        and 'indicator_type_2' in v
+        and 'custom_association_type' in v
+    ):
+        return IndicatorToIndicatorAssociation.__name__
+    msg = f'Could not determine association type for {v}.'
+    raise ValueError(msg)
+
+
+AssociationTypes: TypeAlias = Annotated[
+    Annotated[GroupToGroupAssociation, Tag(GroupToGroupAssociation.__name__)]
+    | Annotated[GroupToIndicatorAssociation, Tag(GroupToIndicatorAssociation.__name__)]
+    | Annotated[IndicatorToIndicatorAssociation, Tag(IndicatorToIndicatorAssociation.__name__)],
+    Discriminator(get_association_discriminator),
+]
+
+
+class AssociationTransformModel(BaseModel, extra='forbid'):
+    """."""
+
+    applies: Callable | None = Field(None, description='')
+    associations: list[AssociationTypes] = Field(default_factory=list, description='')

{tcex-4.0.11.dev2 → tcex-5.0.0.dev0}/tcex/api/tc/ti_transform/ti_predefined_functions.py

@@ -1,19 +1,20 @@
 """TcEx Framework Module"""
 
-# standard library
 import hashlib
 import json
 import uuid
 from collections.abc import Iterable
 from inspect import _empty, signature
-from typing import TypedDict
+from typing import TYPE_CHECKING, TypedDict
 
-# first-party
 from tcex.api.tc.ti_transform.model.transform_model import (
     GroupTransformModel,
     IndicatorTransformModel,
 )
 
+if TYPE_CHECKING:
+    from tcex import TcEx
+
 
 class TransformBuilderExport(TypedDict):
     """Basic definition of a transform exported from Transform Builder."""
@@ -98,9 +99,9 @@ def custom_function_definition(definition: FunctionDefinition):
 class ProcessingFunctions:
     """Predefined functions to use in transforms."""
 
-    def __init__(self, tcex) -> None:
+    def __init__(self, tcex: 'TcEx') -> None:
         """."""
-        self.tcex = tcex
+        self.tcex: TcEx = tcex
         self.custom_fns = {}
 
     @custom_function_definition(
@@ -132,20 +133,9 @@ class ProcessingFunctions:
         """Allow for custom processing to be described."""
         fn = self.custom_fns.get(name.lower())
         if not fn:
-            ex_msg = f'Custom function not implemented: {name}:{description}'
-            ex_msg += f'\ncustom_fns: {self.custom_fns}'
+            ex_msg = f'Custom function not implemented: {description}'
             raise NotImplementedError(ex_msg)
-        # Get the list of supported parameters for the function
-
-        # Build params dynamically based on the function signature
-        all_args = {'ti_dict': ti_dict, 'transform': transform, **kwargs}
-        sig_params = signature(fn).parameters
-
-        # Only pass arguments that the function accepts
-        filtered_args = {
-            k: v for k, v in all_args.items() if k in sig_params or 'kwargs' in sig_params
-        }
-        return fn(value, **filtered_args)
+        return fn(value, ti_dict=ti_dict, transform=transform, **kwargs)
 
     def static_map(self, value, mapping: dict):
         """Map values to static values.
@@ -156,6 +146,22 @@ class ProcessingFunctions:
             mapping = json.loads(mapping)
         return mapping.get(str(value), value)
 
+    def deduplicate_array(self, value: list) -> list:
+        """Remove duplicate values from an array."""
+        return list(set(value))
+
+    def slice_array(self, value: list, start: int = 0, end: int | None = None) -> list:
+        """Slice an array."""
+        return value[start:end]
+
+    def remove_trailing_whitespace(self, value: str) -> str:
+        """Remove trailing whitespace from a string."""
+        return value.rstrip()
+
+    def remove_leading_whitespace(self, value: str) -> str:
+        """Remove leading whitespace from a string."""
+        return value.lstrip()
+
     def value_in(self, value, values: str, delimiter: str = ','):
         """Return the value if it is in the list of values, else return None."""
         if not values.startswith('"'):
@@ -183,6 +189,14 @@ class ProcessingFunctions:
 
         return table
 
+    def defang(self, value: str) -> str:
+        """Defangs URLs, IPs, and common indicators to make them inert."""
+        return self.tcex.util.defang(value)
+
+    def refang(self, value: str) -> str:
+        """Refangs URLs, IPs, and common indicators to make them active."""
+        return self.tcex.util.refang(value)
+
     def any_to_datetime(self, value):
         """Convert any value to a datetime object."""
         return self.tcex.util.any_to_datetime(value).isoformat()
@@ -279,7 +293,7 @@ class ProcessingFunctions:
                                 api_def['kwargs'][kwarg]
                             )
         except Exception as ex:
-            # first-party
+            # import here to avoid circular import
             from tcex.api.tc.ti_transform import TransformException  # noqa: PLC0415
 
             ex_msg = f'{context}{additional_context}'