Merge pull request #160 from code42/INTEG-2994/deprecate-alert-queries

INTEG-2994 - deprecate alert queries

Author: ceciliastevens

CHANGELOG.md

@@ -30,6 +30,9 @@
 ### Fixed
 - An issue where in some cases saved searches could not be retrieved.
 
+### Deprecated
+- Alert queries methods in the SDK, already deprecated, are more clearly marked.
+
 ## 2.5.0 - 2025-06-06
 
 ### Added

docs/sdk/clients/alert_queries.md

@@ -1,4 +1,6 @@
-# Alert Querying
+# Alert Querying (Deprecated)
+
+Alert queries are deprecated. Use [Sessions](sessions.md) instead.
 
 Use the `AlertQuery` class to create a query for searching and filtering Incydr alerts.  More details on how to use the `AlertQuery` class can be found in the [Query Building](#query-building) section below.
 

mkdocs.yml

@@ -45,7 +45,6 @@ nav:
       - Actors: 'sdk/clients/actors.md'
       - Agents: 'sdk/clients/agents.md'
       - Alert Rules: 'sdk/clients/alert_rules.md'
-      - Alert Querying: 'sdk/clients/alert_queries.md'
       - Audit Log: 'sdk/clients/audit_log.md'
       - Cases: 'sdk/clients/cases.md'
       - Customer: 'sdk/clients/customer.md'
@@ -61,6 +60,7 @@ nav:
       - Users: 'sdk/clients/users.md'
       - Watchlists: 'sdk/clients/watchlists.md'
       - Alerts (Deprecated): 'sdk/clients/alerts.md'
+      - Alert Querying (Deprecated): 'sdk/clients/alert_queries.md'
       - Devices (Deprecated): 'sdk/clients/devices.md'
       - Risk Profiles (Deprecated): 'sdk/clients/risk_profiles.md'
     - Enums: 'sdk/enums.md'

src/_incydr_sdk/queries/alerts.py

@@ -4,6 +4,7 @@
 from typing import List
 from typing import Optional
 from typing import Union
+from warnings import warn
 
 from pydantic import BaseModel
 from pydantic import ConfigDict
@@ -66,6 +67,8 @@ class FilterGroup(BaseModel):
 
 class AlertQuery(Model):
     """
+    This class is deprecated. Use the Sessions client instead.
+
     Class to build an alert query. Use the class methods to attach additional filter operators.
 
     Usage examples:
@@ -110,6 +113,11 @@ def __init__(
         on: Union[date, datetime, int, float, str] = None,
         **kwargs,
     ):
+        warn(
+            "Alerts are deprecated. Replaced by Sessions.",
+            DeprecationWarning,
+            stacklevel=2,
+        )
         groups = kwargs.get("groups") or []
         if on and any((start_date, end_date)):
             raise ValueError(