Summary
Since 2.0.1, querying alert source_entities / target_entities (type StructuredEntity)
with the SDK's default generated output fails with:
GraphQLError: Unknown type 'EntityApplication'. Did you mean 'IdentityApplication',
'Application', 'EntityFunction', 'EntityTaskAction', or 'IdentityApplicationType'?
The same query, environment, and credentials work correctly with 2.0.0.
The default output string generated for StructuredEntity.properties includes an inline
fragment ... on EntityApplication { ... }, but this type does not exist in the server
schema for the environment we tested (delta), so the whole query is rejected.
Environment
taegis-sdk-python: fails on 2.0.1 and 2.0.2; works on 2.0.0
- Taegis environment:
delta
- Python: 3.12
- Auth:
CLIENT_ID / CLIENT_SECRET (machine-to-machine)
Reproduction
- Build the default output for
StructuredEntity and inspect it:
from taegis_sdk_python.services.alerts.types import StructuredEntity
from taegis_sdk_python.utils import build_output_string
s = build_output_string(StructuredEntity)
print("EntityApplication" in s)
- On
2.0.1 / 2.0.2: prints True (output contains ... on EntityApplication { ... })
- On
2.0.0: prints False
- Run an alerts search requesting
source_entities (or target_entities) with the
default output against the delta environment. On 2.0.1/2.0.2 this raises the
Unknown type 'EntityApplication' GraphQLError shown above. On 2.0.0 it returns
results normally.
Minimal shape of the query (values omitted):
FROM alert WHERE sensor_types = '<...>' AND status = 'OPEN' EARLIEST=-30d
output field (abbreviated): alerts { list { id source_entities { id identifiers display_name subtype perspective properties { ... } } } }
Observed SDK-side difference (no server/customer data)
build_output_string(StructuredEntity):
| version |
contains EntityApplication |
inline fragment (... on) count |
| 2.0.0 |
no |
22 |
| 2.0.1 |
yes |
23 |
| 2.0.2 |
yes |
23 |
The single added inline fragment between 2.0.0 and 2.0.1 is EntityApplication.
Expected vs Actual
- Expected: default output for
StructuredEntity should be accepted by the server
(or should not request a type the server does not expose).
- Actual: default output requests
EntityApplication, which the server rejects
(Unknown type 'EntityApplication'), failing the entire query.
Workarounds we found
- Pin to
2.0.0 (default output does not include EntityApplication).
- Or, on 2.0.1/2.0.2, request
StructuredEntity without properties
(e.g. source_entities { id identifiers display_name subtype perspective }),
which avoids the offending fragment but loses properties.
Question
Is EntityApplication expected to exist in all environments' schemas, or was it renamed
(the server hint suggests Application / IdentityApplication)? Should the generated
default output be aligned with the current server schema, or made resilient to
unknown union members?
Summary
Since
2.0.1, querying alertsource_entities/target_entities(typeStructuredEntity)with the SDK's default generated output fails with:
The same query, environment, and credentials work correctly with
2.0.0.The default output string generated for
StructuredEntity.propertiesincludes an inlinefragment
... on EntityApplication { ... }, but this type does not exist in the serverschema for the environment we tested (
delta), so the whole query is rejected.Environment
taegis-sdk-python: fails on2.0.1and2.0.2; works on2.0.0deltaCLIENT_ID/CLIENT_SECRET(machine-to-machine)Reproduction
StructuredEntityand inspect it:2.0.1/2.0.2: printsTrue(output contains... on EntityApplication { ... })2.0.0: printsFalsesource_entities(ortarget_entities) with thedefault output against the
deltaenvironment. On2.0.1/2.0.2this raises theUnknown type 'EntityApplication'GraphQLError shown above. On2.0.0it returnsresults normally.
Minimal shape of the query (values omitted):
output field (abbreviated):
alerts { list { id source_entities { id identifiers display_name subtype perspective properties { ... } } } }Observed SDK-side difference (no server/customer data)
build_output_string(StructuredEntity):EntityApplication... on) countThe single added inline fragment between 2.0.0 and 2.0.1 is
EntityApplication.Expected vs Actual
StructuredEntityshould be accepted by the server(or should not request a type the server does not expose).
EntityApplication, which the server rejects(
Unknown type 'EntityApplication'), failing the entire query.Workarounds we found
2.0.0(default output does not includeEntityApplication).StructuredEntitywithoutproperties(e.g.
source_entities { id identifiers display_name subtype perspective }),which avoids the offending fragment but loses
properties.Question
Is
EntityApplicationexpected to exist in all environments' schemas, or was it renamed(the server hint suggests
Application/IdentityApplication)? Should the generateddefault output be aligned with the current server schema, or made resilient to
unknown union members?