Skip to content

StructuredEntity default output requests non-existent GraphQL type EntityApplication in 2.0.1/2.0.2 (works in 2.0.0) #8

Description

@kamonabe

Summary

Since 2.0.1, querying alert source_entities / target_entities (type StructuredEntity)
with the SDK's default generated output fails with:

GraphQLError: Unknown type 'EntityApplication'. Did you mean 'IdentityApplication',
'Application', 'EntityFunction', 'EntityTaskAction', or 'IdentityApplicationType'?

The same query, environment, and credentials work correctly with 2.0.0.

The default output string generated for StructuredEntity.properties includes an inline
fragment ... on EntityApplication { ... }, but this type does not exist in the server
schema for the environment we tested (delta), so the whole query is rejected.

Environment

  • taegis-sdk-python: fails on 2.0.1 and 2.0.2; works on 2.0.0
  • Taegis environment: delta
  • Python: 3.12
  • Auth: CLIENT_ID / CLIENT_SECRET (machine-to-machine)

Reproduction

  1. Build the default output for StructuredEntity and inspect it:
from taegis_sdk_python.services.alerts.types import StructuredEntity
from taegis_sdk_python.utils import build_output_string

s = build_output_string(StructuredEntity)
print("EntityApplication" in s)
  • On 2.0.1 / 2.0.2: prints True (output contains ... on EntityApplication { ... })
  • On 2.0.0: prints False
  1. Run an alerts search requesting source_entities (or target_entities) with the
    default output against the delta environment. On 2.0.1/2.0.2 this raises the
    Unknown type 'EntityApplication' GraphQLError shown above. On 2.0.0 it returns
    results normally.

Minimal shape of the query (values omitted):

FROM alert WHERE sensor_types = '<...>' AND status = 'OPEN' EARLIEST=-30d

output field (abbreviated): alerts { list { id source_entities { id identifiers display_name subtype perspective properties { ... } } } }

Observed SDK-side difference (no server/customer data)

build_output_string(StructuredEntity):

version contains EntityApplication inline fragment (... on) count
2.0.0 no 22
2.0.1 yes 23
2.0.2 yes 23

The single added inline fragment between 2.0.0 and 2.0.1 is EntityApplication.

Expected vs Actual

  • Expected: default output for StructuredEntity should be accepted by the server
    (or should not request a type the server does not expose).
  • Actual: default output requests EntityApplication, which the server rejects
    (Unknown type 'EntityApplication'), failing the entire query.

Workarounds we found

  • Pin to 2.0.0 (default output does not include EntityApplication).
  • Or, on 2.0.1/2.0.2, request StructuredEntity without properties
    (e.g. source_entities { id identifiers display_name subtype perspective }),
    which avoids the offending fragment but loses properties.

Question

Is EntityApplication expected to exist in all environments' schemas, or was it renamed
(the server hint suggests Application / IdentityApplication)? Should the generated
default output be aligned with the current server schema, or made resilient to
unknown union members?

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions