diff --git a/src/_incydr_cli/cmds/sessions.py b/src/_incydr_cli/cmds/sessions.py index b27433c0..5b9712f6 100644 --- a/src/_incydr_cli/cmds/sessions.py +++ b/src/_incydr_cli/cmds/sessions.py @@ -72,6 +72,11 @@ def sessions(): help="Limit search to sessions beginning before this date and time. " "Accepts a date/time in yyyy-MM-dd (UTC) or yyyy-MM-dd HH:MM:SS (UTC+24-hr time) format.", ) +@click.option( + "--type", + default=None, + help="Limit search to sessions of this type. Acceptable types are STANDARD or ACCOUNT_TAKE_OVER", +) @click.option( "--no-alerts", is_flag=True, @@ -123,6 +128,7 @@ def search( actor_id: Optional[str] = None, start: Optional[str] = None, end: Optional[str] = None, + type: Optional[str] = None, no_alerts: bool = False, risk_indicators: Optional[str] = None, state: Optional[List[str]] = None, @@ -162,6 +168,7 @@ def search( sessions_gen = client.sessions.v1.iter_all( actor_id=actor_id, start_time=start, + type=type, end_time=end, has_alerts=not no_alerts, risk_indicators=risk_indicators.split(",") if risk_indicators else None, diff --git a/src/_incydr_sdk/sessions/client.py b/src/_incydr_sdk/sessions/client.py index 80e4dd6a..2bdc2cdb 100644 --- a/src/_incydr_sdk/sessions/client.py +++ b/src/_incydr_sdk/sessions/client.py @@ -37,6 +37,7 @@ def get_page( actor_id: str = None, start_time: Union[str, datetime, int] = None, end_time: Union[str, datetime, int] = None, + type: str = None, has_alerts: bool = True, sort_key: Optional[SortKeys] = None, risk_indicators: List[str] = None, @@ -59,6 +60,7 @@ def get_page( * **actor_id**: `str | None` - Only include items generated by this actor. * **start_time**: `datetime | str | int | None` - Only include items beginning on or after this date and time. Can be a date-formatted string, a `datetime` instance, or a POSIX `int` timestamp. * **end_time**: `datetime | str | int | None` - Only include items beginning before this date and time. Can be a date-formatted string, a `datetime` instance, or a POSIX `int` timestamp. + * **type**: `str` - Only include items matching this type. Examples include STANDARD, ACCOUNT_TAKE_OVER. * **has_alerts**: `bool` - Only include items that have a matching alert status. Defaults to `True`. * **sort_key**: [`SortKeys`][items-sort-keys] - `end_time` or `score`. Value on which the results will be sorted. Defaults to `end time`. * **risk_indicators**: `List[str] | None` - List of risk indicator IDs that must be present on the items before they are returned. @@ -93,6 +95,7 @@ def get_page( actor_id=actor_id, on_or_after=start_time, before=end_time, + type=type, has_alerts=str(has_alerts).lower() if has_alerts is not None else None, order_by=sort_key, risk_indicators=risk_indicators, @@ -113,6 +116,7 @@ def iter_all( actor_id: str = None, start_time: Union[str, datetime, int] = None, end_time: Union[str, datetime, int] = None, + type: str = None, has_alerts: bool = True, sort_key: Optional[SortKeys] = None, risk_indicators: List[str] = None, @@ -136,6 +140,7 @@ def iter_all( actor_id=actor_id, start_time=start_time, end_time=end_time, + type=type, has_alerts=has_alerts, sort_key=sort_key, risk_indicators=risk_indicators, @@ -217,6 +222,7 @@ def update_state_by_criteria( actor_id: str = None, start_time: Union[str, datetime, int] = None, end_time: Union[str, datetime, int] = None, + type: str = None, has_alerts: bool = True, risk_indicators: List[str] = None, states: List[SessionStates] = None, @@ -236,6 +242,7 @@ def update_state_by_criteria( * **actor_id**: `str | None` - The ID of the actor to limit the search to. * **start_time**: `datetime | str | int | None` - Only include items beginning on or after this date and time. Can be a date-formatted string, a `datetime` instance, or a POSIX `int` timestamp. * **end_time**: `datetime | str | int | None` - Only include items beginning before this date and time. Can be a date-formatted string, a `datetime` instance, or a POSIX `int` timestamp. + * **type**: `str` - Only include items matching this type. Examples include STANDARD, ACCOUNT_TAKE_OVER. * **has_alerts**: `bool` - Only include items that have a matching alert status. Defaults to `True`. * **sort_key**: [`SortKeys`][items-sort-keys] - `end_time` or `score`. Value on which the results will be sorted. Defaults to `end time`. * **risk_indicators**: `List[str] | None` - List of risk indicator IDs that must be present on the items before they are returned. @@ -270,6 +277,7 @@ def update_state_by_criteria( actor_id=actor_id, on_or_after=start_time, before=end_time, + type=type, has_alerts=str(has_alerts).lower() if has_alerts is not None else None, risk_indicators=risk_indicators, state=states, diff --git a/src/_incydr_sdk/sessions/models/models.py b/src/_incydr_sdk/sessions/models/models.py index a040a7fa..002381f1 100644 --- a/src/_incydr_sdk/sessions/models/models.py +++ b/src/_incydr_sdk/sessions/models/models.py @@ -71,6 +71,7 @@ class SessionsCriteriaRequest(BaseModel): actor_id: Optional[str] = None on_or_after: Optional[int] = None before: Optional[int] = None + type: Optional[int] = None has_alerts: Optional[str] = None risk_indicators: Optional[List[str]] = None state: Optional[List[SessionStates]] = None diff --git a/src/_incydr_sdk/sessions/models/response.py b/src/_incydr_sdk/sessions/models/response.py index bb573da9..ec37f73a 100644 --- a/src/_incydr_sdk/sessions/models/response.py +++ b/src/_incydr_sdk/sessions/models/response.py @@ -20,6 +20,7 @@ class Session(ResponseModel): **Fields**: * **actor_id**: `str` The ID of the actor that generated the session. + * **type**: `str` The type of the session. * **begin_time**: `datetime` The date and time when this session began. * **content_inspection_results**: `List[ContentInspectionResult]` The results of content inspection. * **context_summary**: `str` An English summary of the contextual aspects of this session is any were identified. @@ -42,6 +43,7 @@ class Session(ResponseModel): """ actor_id: Optional[str] = Field(None, alias="actorId") + type: Optional[str] = Field(None) begin_time: Optional[int] = Field(None, alias="beginTime") content_inspection_results: Optional[ContentInspectionResult] = Field( None, alias="contentInspectionResults" diff --git a/tests/test_sessions.py b/tests/test_sessions.py index 29ffec4b..9f8f1eb3 100644 --- a/tests/test_sessions.py +++ b/tests/test_sessions.py @@ -30,6 +30,7 @@ TEST_SESSION = { "actorId": TEST_SESSION_ID, + "type": "STANDARD", "beginTime": POSIX_TS, "contentInspectionResults": {"detectedOnAlerts": ["PII"]}, "contextSummary": "string",