2.6.0

2.6.0 - 2025-07-23

Added

• Support for subgroups in file event queries and saved searches. See this documentation for more details about this type of query.
• New methods for EventQuery() to enable more flexible filtering:
  • is_any
  • is_none
  • date_range
  • subquery
• New methods to download files by XFC content ID.
  • sdk.files.download_file_by_xfc_content_id and sdk.files.stream_file_by_xfc_content_id
  • incydr files download-by-xfc-id

Fixed

• An issue where in some cases saved searches could not be retrieved.

2.5.0

2.5.0 - 2025-06-06

Added

• The orgs and legal_hold clients to the SDK.
• The orgs and legal-hold command groups to the CLI.

2.4.0

2.4.0 - 2025-05-27

Added

• The files client to the SDK with two methods:
  • sdk.files.v1.download_file_by_sha256 to download a file and save it in the file system.
  • sdk.files.v1.stream_file_by_sha256 to stream a file, allowing more control over how it is downloaded.
• Added the files download command to the CLI to download a file by SHA256 hash.

2.3.1

2.3.1 - 2025-05-13

Fixed

• An issue where Sessions validation would fail due to an updated content inspection schema.

Updated

• CSV and JSON input for the CLI's bulk agent commands will now look for agentGuid as a column header, in addition to agent_id, agentId, and guid.

2.3.0

2.3.0 - 2025-03-18

Added

• watchlists.v2 methods are added to the SDK, for parity with the API.
• New CLI watchlist commands list-excluded-actors and list-included-actors to replace the deprecated list-excluded-users and list-included-users.

Updated

• The CLI's watchlists commands now use the v2 watchlist API. These commands correctly use actor_id instead of user_id. While the previous user_id parameters will still work for now, we recommend that users switch as soon as possible to using actor_id instead.

Fixed

• A bug where the api endpoint used to download audit log events was incorrect.

Deprecated

• Devices methods in the SDK and CLI are deprecated. Use the Agents methods instead.
• Risk Profiles methods in the SDK and CLI, already deprecated, are more clearly marked.
• The SDK's watchlists.v1 methods are deprecated.
• The CLI's watchlist group list-excluded-users and list-included-users commands are deprecated. Use list-excluded-actors and list-included-actors instead.

2.2.4

2.2.4 - 2025-03-11

Added

• Improved documentation to clarify that all agent health issues can be queried and filtered using the CLI and SDK.

2.2.3

2.2.3 - 2025-02-05

Fixed

• A bug where in some rare cases searching file events could cause the SDK to throw a validation error on the server's correct response.

2.2.2

2.2.2 - 2025-01-08

Fixed

• A bug where dates (e.g. 2025-01-08) were incorrectly converted to timestamps when querying sessions.

2.2.1

2.2.1 - 2024-12-18

Added

• Added support for pyton 3.13.

Updated

• The CLI and SDK now have user-agent headers consistent with Code42 current standards.

Removed

• Removed support for python 3.7 and 3.8, which are end-of-life.

v2.2.0

2.2.0 - 2024-11-18

Updated

• Updated the FileEventV2 model to all existing fields at this time. For example, the recently added responseControls response object is now available on the model.
• Updated EventQuery objects to allow filtering by any string by removing the requirement that filter terms and values must match explicitly defined fields. This allows end users to filter by fields recently added to the file event response without requiring an SDK update.
• client.actors.v1.get_actor_by_name now defaults to prefer_parent=True. Previously, it defaulted to False.