INTEG-3142 - add type

Author: ceciliastevens

src/_incydr_cli/cmds/sessions.py

@@ -72,6 +72,11 @@ def sessions():
     help="Limit search to sessions beginning before this date and time. "
     "Accepts a date/time in yyyy-MM-dd (UTC) or yyyy-MM-dd HH:MM:SS (UTC+24-hr time) format.",
 )
+@click.option(
+    "--type",
+    default=None,
+    help="Limit search to sessions of this type. Acceptable types are STANDARD or ACCOUNT_TAKE_OVER"
+)
 @click.option(
     "--no-alerts",
     is_flag=True,
@@ -123,6 +128,7 @@ def search(
     actor_id: Optional[str] = None,
     start: Optional[str] = None,
     end: Optional[str] = None,
+    type: Optional[str] = None,
     no_alerts: bool = False,
     risk_indicators: Optional[str] = None,
     state: Optional[List[str]] = None,
@@ -162,6 +168,7 @@ def search(
     sessions_gen = client.sessions.v1.iter_all(
         actor_id=actor_id,
         start_time=start,
+        type=type,
         end_time=end,
         has_alerts=not no_alerts,
         risk_indicators=risk_indicators.split(",") if risk_indicators else None,

src/_incydr_sdk/sessions/client.py

@@ -37,6 +37,7 @@ def get_page(
         actor_id: str = None,
         start_time: Union[str, datetime, int] = None,
         end_time: Union[str, datetime, int] = None,
+        type: str = None,
         has_alerts: bool = True,
         sort_key: Optional[SortKeys] = None,
         risk_indicators: List[str] = None,
@@ -59,6 +60,7 @@ def get_page(
         * **actor_id**: `str | None` - Only include items generated by this actor.
         * **start_time**: `datetime | str | int | None` - Only include items beginning on or after this date and time.  Can be a date-formatted string, a `datetime` instance, or a POSIX `int` timestamp.
         * **end_time**: `datetime | str | int | None` - Only include items beginning before this date and time.  Can be a date-formatted string, a `datetime` instance, or a POSIX `int` timestamp.
+        * **type**: `str` - Only include items matching this type. Examples include STANDARD, ACCOUNT_TAKE_OVER.        
         * **has_alerts**: `bool` - Only include items that have a matching alert status. Defaults to `True`.
         * **sort_key**: [`SortKeys`][items-sort-keys] - `end_time` or `score`. Value on which the results will be sorted. Defaults to `end time`.
         * **risk_indicators**: `List[str] | None` - List of risk indicator IDs that must be present on the items before they are returned.
@@ -93,6 +95,7 @@ def get_page(
             actor_id=actor_id,
             on_or_after=start_time,
             before=end_time,
+            type=type,
             has_alerts=str(has_alerts).lower() if has_alerts is not None else None,
             order_by=sort_key,
             risk_indicators=risk_indicators,
@@ -113,6 +116,7 @@ def iter_all(
         actor_id: str = None,
         start_time: Union[str, datetime, int] = None,
         end_time: Union[str, datetime, int] = None,
+        type: str = None,
         has_alerts: bool = True,
         sort_key: Optional[SortKeys] = None,
         risk_indicators: List[str] = None,
@@ -136,6 +140,7 @@ def iter_all(
                 actor_id=actor_id,
                 start_time=start_time,
                 end_time=end_time,
+                type=type,
                 has_alerts=has_alerts,
                 sort_key=sort_key,
                 risk_indicators=risk_indicators,
@@ -217,6 +222,7 @@ def update_state_by_criteria(
         actor_id: str = None,
         start_time: Union[str, datetime, int] = None,
         end_time: Union[str, datetime, int] = None,
+        type: str = None,
         has_alerts: bool = True,
         risk_indicators: List[str] = None,
         states: List[SessionStates] = None,
@@ -236,6 +242,7 @@ def update_state_by_criteria(
         * **actor_id**: `str | None` - The ID of the actor to limit the search to.
         * **start_time**: `datetime | str | int | None` - Only include items beginning on or after this date and time.  Can be a date-formatted string, a `datetime` instance, or a POSIX `int` timestamp.
         * **end_time**: `datetime | str | int | None` - Only include items beginning before this date and time.  Can be a date-formatted string, a `datetime` instance, or a POSIX `int` timestamp.
+        * **type**: `str` - Only include items matching this type. Examples include STANDARD, ACCOUNT_TAKE_OVER.
         * **has_alerts**: `bool` - Only include items that have a matching alert status. Defaults to `True`.
         * **sort_key**: [`SortKeys`][items-sort-keys] - `end_time` or `score`. Value on which the results will be sorted. Defaults to `end time`.
         * **risk_indicators**: `List[str] | None` - List of risk indicator IDs that must be present on the items before they are returned.
@@ -270,6 +277,7 @@ def update_state_by_criteria(
             actor_id=actor_id,
             on_or_after=start_time,
             before=end_time,
+            type=type,
             has_alerts=str(has_alerts).lower() if has_alerts is not None else None,
             risk_indicators=risk_indicators,
             state=states,

src/_incydr_sdk/sessions/models/models.py

@@ -71,6 +71,7 @@ class SessionsCriteriaRequest(BaseModel):
     actor_id: Optional[str] = None
     on_or_after: Optional[int] = None
     before: Optional[int] = None
+    type: Optional[int] = None
     has_alerts: Optional[str] = None
     risk_indicators: Optional[List[str]] = None
     state: Optional[List[SessionStates]] = None

src/_incydr_sdk/sessions/models/response.py

@@ -20,6 +20,7 @@ class Session(ResponseModel):
     **Fields**:
 
     * **actor_id**: `str` The ID of the actor that generated the session.
+    * **type**: `str` The type of the session.
     * **begin_time**: `datetime` The date and time when this session began.
     * **content_inspection_results**: `List[ContentInspectionResult]` The results of content inspection.
     * **context_summary**: `str` An English summary of the contextual aspects of this session is any were identified.
@@ -42,6 +43,7 @@ class Session(ResponseModel):
     """
 
     actor_id: Optional[str] = Field(None, alias="actorId")
+    type: Optional[str] = Field(None)
     begin_time: Optional[int] = Field(None, alias="beginTime")
     content_inspection_results: Optional[ContentInspectionResult] = Field(
         None, alias="contentInspectionResults"

tests/test_sessions.py

@@ -30,6 +30,7 @@
 
 TEST_SESSION = {
     "actorId": TEST_SESSION_ID,
+    "type": "STANDARD",
     "beginTime": POSIX_TS,
     "contentInspectionResults": {"detectedOnAlerts": ["PII"]},
     "contextSummary": "string",