Skip to content

Commit 25c204e

Browse files
Merge pull request #172 from code42/INTEG-3173/risk-indicators
Integ 3173/risk indicators
2 parents d85c1bd + b83dc9c commit 25c204e

26 files changed

Lines changed: 834 additions & 17 deletions

CHANGELOG.md

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,18 @@
99
how a consumer would use the library or CLI tool (e.g. adding unit tests, updating documentation, etc) are not captured
1010
here.
1111

12-
## Unreleased
12+
## 2.12.0 - 2026-05-04
1313

1414
### Added
1515
- Added the `sdk.file-events.v2.search_groups` method to get approximate aggregate file event counts by a given grouping term.
1616
- Added the `GroupingEventQuery` class, used to make these queries.
1717
- Added the cli command `incydr file-events search-groups` to get approximate aggregate file event counts by a given grouping term.
18-
18+
- Added the `type` parameter to session search methods and commands, allowing users to filter results to STANDARD or ACCOUNT_TAKE_OVER.
19+
- Added the `is_high_value` option to trusted activity methods in the SDK, and the `--high-value` option to trusted activity methods in the CLI.
20+
- Added the ability to specify domain trust for browser destinations, allowing users to specify when users should be allowed to use certain destinations when logged-in using a trusted domain.
21+
- Added the ability to specify trust for file-transfer tools when adding a trusted domain.
22+
- Added the `risk-indicator-categories` client to the SDK, allowing the listing of risk indicator categories, subcategories, and risk indicators.
23+
- Added the `risk-indicator-categories` command to the CLI, allowing the listing of risk indicator categories.
1924

2025
## 2.11.0 - 2026-02-10
2126

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Risk Indicator Categories Commands
2+
3+
::: mkdocs-click
4+
:module: _incydr_cli.cmds.risk_indicator_categories
5+
:command: risk_indicator_categories
6+
:list_subcommands:

docs/sdk/client.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,4 @@
33

44
::: incydr.Client
55
:docstring:
6-
:members: settings session request_history actors agents alerts alert_rules audit_log cases customer departments devices directory_groups file_events sessions trusted_activities users risk_profiles watchlists
6+
:members: settings session request_history actors agents alerts alert_rules audit_log cases customer departments devices directory_groups file_events sessions trusted_activities users risk_profiles watchlists risk_indicator_categories
Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Risk Indicator Categories
2+
3+
::: _incydr_sdk.risk_indicator_categories.client.RiskIndicatorCategoriesV1
4+
:docstring:
5+
:members:

docs/sdk/enums.md

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -604,6 +604,8 @@ Devices has been replaced by [Agents](#agents)
604604
* **FILE_UPLOAD** = `"FILE_UPLOAD"`
605605
* **GIT_PUSH** = `"GIT_PUSH"`
606606
* **GIT_REPOSITORY_URI** = `"GIT_REPOSITORY_URI"`
607+
* **USER_ACCOUNT_UPLOAD** = `"USER_ACCOUNT_UPLOAD"`
608+
* **FILE_TRANSFER** = `"FILE_TRANSFER"`
607609

608610
### Cloud Sync Apps
609611

@@ -631,6 +633,30 @@ Devices has been replaced by [Agents](#agents)
631633

632634
* **GMAIL** = `"GMAIL"`
633635
* **OFFICE_365** = `"OFFICE_365"`
636+
* **GOOGLE_DRIVE** = `"GOOGLE_DRIVE"`
637+
638+
639+
### Browser Destinations
640+
641+
::: incydr.enums.trusted_activities.BrowserDestination
642+
:docstring:
643+
644+
* **AIRTABLE** = `"AIRTABLE"`
645+
* **AMAZON_WEB_SERVICES** = `"AMAZON_WEB_SERVICES"`
646+
* **BLACKBOX** = `"BLACKBOX"`
647+
* **BOX** = `"BOX"`
648+
* **CHATGPT** = `"CHATGPT"`
649+
* **CLAUDE** = `"CLAUDE"`
650+
* **CONCUR** = `"CONCUR"`
651+
* **CURSOR** = `"CURSOR"`
652+
* **DROPBOX** = `"DROPBOX"`
653+
* **GOOGLE_WORKSPACE** = `"GOOGLE_WORKSPACE"`
654+
* **MICROSOFT_365** = `"MICROSOFT_365"`
655+
* **NOTTA** = `"NOTTA"`
656+
* **OTTER** = `"OTTER"`
657+
* **PERPLEXITY** = `"PERPLEXITY"`
658+
* **SLACK** = `"SLACK"`
659+
* **YOU_DOT_COM** = `"YOU_DOT_COM"`
634660

635661
### Principal Types
636662

docs/sdk/models.md

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -329,3 +329,26 @@ ExcludedUsersList is deprecated. Use ExcludedActorsList instead.
329329

330330
::: incydr.models.IncludedDirectoryGroup
331331
:docstring:
332+
333+
## Risk Indicator Categories
334+
---
335+
336+
### `RiskIndicator` model
337+
338+
::: incydr.models.RiskIndicator
339+
:docstring:
340+
341+
### `RiskIndicatorSubcategory` model
342+
343+
::: incydr.models.RiskIndicatorSubcategory
344+
:docstring:
345+
346+
### `RiskIndicatorCategory` model
347+
348+
::: incydr.models.RiskIndicatorCategory
349+
:docstring:
350+
351+
### `RiskIndicatorCategoriesResponsePage` model
352+
353+
::: incydr.models.RiskIndicatorCategoriesResponsePage
354+
:docstring:

mkdocs.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ nav:
5555
- File Event Querying: 'sdk/clients/file_event_queries.md'
5656
- Legal Hold: 'sdk/clients/legal_hold.md'
5757
- Orgs: 'sdk/clients/orgs.md'
58+
- Risk Indicator Categories: 'sdk/clients/risk_indicator_categories.md'
5859
- Sessions: 'sdk/clients/sessions.md'
5960
- Trusted Activites: 'sdk/clients/trusted_activities.md'
6061
- Users: 'sdk/clients/users.md'
@@ -84,6 +85,7 @@ nav:
8485
- Files: 'cli/cmds/files.md'
8586
- Legal Hold: 'cli/cmds/legal_hold.md'
8687
- Orgs: 'cli/cmds/orgs.md'
88+
- Risk Indicator Categories: 'cli/cmds/risk_indicator_categories.md'
8789
- Sessions: 'cli/cmds/sessions.md'
8890
- Trusted Activites: 'cli/cmds/trusted_activities.md'
8991
- Users: 'cli/cmds/users.md'
Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
import itertools
2+
from typing import Iterator
3+
from typing import Optional
4+
5+
import click
6+
7+
from _incydr_cli import console
8+
from _incydr_cli import logging_options
9+
from _incydr_cli import render
10+
from _incydr_cli.cmds.options.output_options import columns_option
11+
from _incydr_cli.cmds.options.output_options import table_format_option
12+
from _incydr_cli.cmds.options.output_options import TableFormat
13+
from _incydr_cli.core import IncydrCommand
14+
from _incydr_cli.core import IncydrGroup
15+
from _incydr_sdk.core.client import Client
16+
from _incydr_sdk.risk_indicator_categories.models import RiskIndicator
17+
18+
19+
@click.group(cls=IncydrGroup)
20+
@logging_options
21+
def risk_indicator_categories():
22+
"""View and manage risk indicators."""
23+
24+
25+
@risk_indicator_categories.command("list", cls=IncydrCommand)
26+
@table_format_option
27+
@columns_option
28+
@logging_options
29+
def list_categories(
30+
format_: Optional[TableFormat] = None,
31+
columns: Optional[str] = None,
32+
):
33+
"""
34+
List Risk Indicators by category and subcategory.
35+
"""
36+
client = Client()
37+
categories = client.risk_indicator_categories.v1.list_categories().categories
38+
39+
if format_ == TableFormat.table:
40+
columns = columns or [
41+
"id",
42+
"name",
43+
"description",
44+
"category_name",
45+
"category_id",
46+
"subcategory_name",
47+
"subcategory_id",
48+
"type",
49+
]
50+
render.table(
51+
RiskIndicatorTableEntry,
52+
iter_risk_indicator_table_entries(categories),
53+
columns=columns,
54+
flat=False,
55+
)
56+
elif format_ == TableFormat.csv:
57+
render.csv(
58+
RiskIndicatorTableEntry,
59+
iter_risk_indicator_table_entries(categories),
60+
columns=columns,
61+
flat=True,
62+
)
63+
else:
64+
printed = False
65+
for indicator in iter_risk_indicator_table_entries(categories):
66+
printed = True
67+
if format_ == TableFormat.json_pretty:
68+
console.print_json(indicator.json())
69+
else:
70+
click.echo(indicator.json())
71+
if not printed:
72+
console.print("No results found.")
73+
74+
75+
class RiskIndicatorTableEntry(RiskIndicator):
76+
category_name: str
77+
category_id: str
78+
category_description: Optional[str]
79+
subcategory_name: str
80+
subcategory_id: str
81+
subcategory_description: Optional[str]
82+
type: str
83+
84+
85+
def iter_risk_indicator_table_entries(categories) -> Iterator[RiskIndicatorTableEntry]:
86+
for category in categories:
87+
for subcategory in category.subcategories:
88+
for indicator, indicator_type in itertools.chain(
89+
((i, "standard") for i in subcategory.standard_indicators),
90+
((i, "custom") for i in subcategory.custom_indicators),
91+
):
92+
yield RiskIndicatorTableEntry(
93+
id=indicator.id,
94+
name=indicator.name,
95+
description=indicator.description,
96+
category_name=category.name,
97+
category_id=category.id,
98+
category_description=category.description,
99+
subcategory_name=subcategory.name,
100+
subcategory_id=subcategory.id,
101+
subcategory_description=subcategory.description,
102+
type=indicator_type,
103+
)

src/_incydr_cli/cmds/sessions.py

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,11 @@ def sessions():
7272
help="Limit search to sessions beginning before this date and time. "
7373
"Accepts a date/time in yyyy-MM-dd (UTC) or yyyy-MM-dd HH:MM:SS (UTC+24-hr time) format.",
7474
)
75+
@click.option(
76+
"--type",
77+
default=None,
78+
help="Limit search to sessions of this type. Acceptable types are STANDARD or ACCOUNT_TAKE_OVER",
79+
)
7580
@click.option(
7681
"--no-alerts",
7782
is_flag=True,
@@ -123,6 +128,7 @@ def search(
123128
actor_id: Optional[str] = None,
124129
start: Optional[str] = None,
125130
end: Optional[str] = None,
131+
type: Optional[str] = None,
126132
no_alerts: bool = False,
127133
risk_indicators: Optional[str] = None,
128134
state: Optional[List[str]] = None,
@@ -162,6 +168,7 @@ def search(
162168
sessions_gen = client.sessions.v1.iter_all(
163169
actor_id=actor_id,
164170
start_time=start,
171+
type=type,
165172
end_time=end,
166173
has_alerts=not no_alerts,
167174
risk_indicators=risk_indicators.split(",") if risk_indicators else None,

0 commit comments

Comments
 (0)