add subgroups for search filters

Author: ceciliastevens

src/_incydr_sdk/core/settings.py

@@ -50,8 +50,7 @@ class IncydrSettings(BaseSettings):
     Usage:
 
         >> import incydr
-        >>> client = incydr.Client()
-        >>> client.settings.page_size = 10
+        >>> client = incydr.Client(page_size = 10)
 
     Settings can also be loaded from shell environment variables or .env files. Just prefix a setting's attribute name
     with `INCYDR_` when configuring via enviroment vars.

src/_incydr_sdk/file_events/models/response.py

@@ -1,3 +1,5 @@
+from __future__ import annotations
+
 from datetime import datetime
 from typing import List
 from typing import Optional
@@ -32,6 +34,17 @@ class SearchFilterGroup(ResponseModel):
     )
 
 
+class SearchFilterGroupV2(ResponseModel):
+    subgroup_clause: Optional[str] = Field(
+        alias="subgroupClause",
+        description="Grouping clause for subgroups.",
+        example="AND",
+    )
+    subgroups: Optional[List[Union[SearchFilterGroup, SearchFilterGroupV2]]] = Field(
+        description="One or more FilterGroups to be combined in a query, or a FilterSubgroupV2"
+    )
+
+
 class QueryProblem(ResponseModel):
     """
     A model containing data on a query problem.
@@ -99,7 +112,7 @@ class SavedSearch(ResponseModel):
     * **created_by_username**: `str` - The username of the user who created the saved search.
     * **creation_timestamp**: `datetime` - The time at which the saved search was created.
     * **group_clause**: `GroupClause` - `AND` or `OR`. Grouping clause for any specified groups. Defaults to `AND`.
-    * **groups**: `List[SearchFilterGroup]` - One or more FilterGroups to be combined in a query.
+    * **groups**: `List[Union[SearchFilterGroup, SearchFilterGroupV2]]` - One or more FilterGroups or FilterGroupV2s to be combined in a query.
     * **id**: `str` - The ID for the saved search.
     * **modified_by_uid**: `str` - The ID of the user who last modified the saved search.
     * **modified_by_username**: `str` - The username of the user who last modified the saved search.
@@ -139,7 +152,7 @@ class SavedSearch(ResponseModel):
         description="Grouping clause for any specified groups.",
         example="OR",
     )
-    groups: Optional[List[SearchFilterGroup]] = Field(
+    groups: Optional[List[Union[SearchFilterGroup, SearchFilterGroupV2]]] = Field(
         description="One or more FilterGroups to be combined in a query."
     )
     id: Optional[str] = Field(

tests/test_file_events.py

@@ -406,7 +406,93 @@
     srt_key=None,
     tenantId="c4e43418-07d9-4a9f-a138-29f39a124d33",
 )
-
+TEST_SAVED_SEARCH_3 = SavedSearch().parse_obj(
+    {
+        "apiVersion": 2,
+        "columns": None,
+        "createdByUID": "testcreatoruid",
+        "createdByUsername": "example@code42.com",
+        "creationTimestamp": "2025-02-04T15:36:59.926404Z",
+        "groupClause": "AND",
+        "groups": [
+            {
+                "filterClause": "AND",
+                "filters": [
+                    {
+                        "operator": "WITHIN_THE_LAST",
+                        "term": "@timestamp",
+                        "value": "P90D",
+                        "display": None,
+                    }
+                ],
+                "display": '{"data":{"isMultivalue":false},"version":"v2"}',
+            },
+            {
+                "filterClause": "OR",
+                "filters": [
+                    {
+                        "operator": "IS",
+                        "term": "file.category",
+                        "value": "Image",
+                        "display": None,
+                    }
+                ],
+                "display": '{"data":{"isMultivalue":true},"version":"v2"}',
+            },
+            {
+                "subgroupClause": "OR",
+                "subgroups": [
+                    {
+                        "subgroupClause": "AND",
+                        "subgroups": [
+                            {
+                                "filterClause": "AND",
+                                "filters": [
+                                    {
+                                        "operator": "IS",
+                                        "term": "file.name",
+                                        "value": "*gomez*",
+                                        "display": None,
+                                    }
+                                ],
+                                "display": '{"data":{"isMultivalue":false},"version":"v2"}',
+                            }
+                        ],
+                        "display": None,
+                    },
+                    {
+                        "subgroupClause": "AND",
+                        "subgroups": [
+                            {
+                                "filterClause": "AND",
+                                "filters": [
+                                    {
+                                        "operator": "IS",
+                                        "term": "file.name",
+                                        "value": "*Ticia*",
+                                        "display": None,
+                                    }
+                                ],
+                                "display": '{"data":{"isMultivalue":false},"version":"v2"}',
+                            }
+                        ],
+                        "display": None,
+                    },
+                ],
+                "display": None,
+            },
+        ],
+        "id": "test-search-id",
+        "modifiedByUID": "test-modified-uid",
+        "modifiedByUsername": "example@code42.com",
+        "modifiedTimestamp": "2025-02-04T15:36:59.926404Z",
+        "name": "Chad Ticia/Gomez block saved search",
+        "notes": "testing functionality of search blocks",
+        "srtDir": "desc",
+        "srtKey": None,
+        "tenantId": "test-tenant-id",
+    }
+)
 
 TEST_DICT_QUERY = {
     "groupClause": "AND",
@@ -487,6 +573,14 @@ def mock_get_saved_search(httpserver_auth):
     ).respond_with_json(search_data)
 
 
+@pytest.fixture
+def mock_get_saved_search_with_subgroups(httpserver_auth):
+    search_data = {"searches": [json.loads(TEST_SAVED_SEARCH_3.json())]}
+    httpserver_auth.expect_request(
+        f"/v2/file-events/saved-searches/{TEST_SAVED_SEARCH_ID}", method="GET"
+    ).respond_with_json(search_data)
+
+
 @pytest.fixture
 def mock_list_saved_searches(httpserver_auth):
     search_data = {
@@ -559,6 +653,15 @@ def test_get_saved_search_returns_expected_data(mock_get_saved_search):
     assert search.json() == TEST_SAVED_SEARCH_1.json()
 
 
+def test_get_saved_search_returns_expected_data_when_search_has_subgroups(
+    mock_get_saved_search_with_subgroups,
+):
+    client = Client()
+    search = client.file_events.v2.get_saved_search(TEST_SAVED_SEARCH_ID)
+    assert isinstance(search, SavedSearch)
+    assert search.json() == TEST_SAVED_SEARCH_3.json()
+
+
 # ************************************************ CLI ************************************************
 
 format_arg = pytest.mark.parametrize(