Metadata-Version: 2.4
Name: g6-alert-core
Version: 1.0.1
Summary: Shared domain layer for the Guardsix Alert SDKs (Standalone + Fleet)
Author: Guardsix Security Team
License-Expression: Apache-2.0
Keywords: guardsix,logpoint,siem,alert,detection,security,sdk
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Operating System :: OS Independent
Requires-Python: >=3.11
Description-Content-Type: text/markdown
License-File: LICENSE
License-File: NOTICE
Requires-Dist: pyyaml<7,>=6.0
Requires-Dist: tabulate<1,>=0.9.0
Requires-Dist: werkzeug<4,>=3.1.9
Provides-Extra: dev
Requires-Dist: pytest>=7.0.0; extra == "dev"
Requires-Dist: pytest-cov>=4.0.0; extra == "dev"
Requires-Dist: ruff==0.15.20; extra == "dev"
Requires-Dist: mypy>=1.9.0; extra == "dev"
Requires-Dist: types-PyYAML>=6.0.0; extra == "dev"
Requires-Dist: types-tabulate>=0.9.0; extra == "dev"
Dynamic: license-file

# g6-alert-core

Shared domain layer for the Guardsix Alert SDK (`g6-alert`).

This package provides the pure, transport-agnostic code shared between the
Standalone and Fleet backends:

| Module | Contents |
|--------|----------|
| `transport` | `Target` (frozen dataclass identifying one destination), `Transport` (ABC every backend implements) |
| `auth` | `Auth` (ABC every backend's credential handling implements) |
| `client` | `AlertClient` facade, `TargetResult`, `any_failed`, `all_ok` — the mode-agnostic API `g6-alert` and library callers use |
| `exceptions` | Unified exception hierarchy (`AlertSDKError` base; `FleetAlertSDKError` alias; unified `APIError`) |
| `security` | `validate_yaml_path`, `load_yaml_rule` (O_NOFOLLOW + `secure_filename`), `path_is_within`, `has_traversal` |
| `discovery` | `load_discovery_json`, `find_pool`, `get_nodes_from_pool`, `get_pool_summary` — Fleet's `discovery.json` model |
| `rules` | `validate_yaml_rule`, `normalize_status`, `normalize_repo_field`, `extract_mitre_entries`, `minimum_guardsix_version_violation`, `build_rule_metadata` |
| `packs` | `load_pack_manifest`, `resolve_repo_list_strict` and related repo-resolution helpers |
| `mitre` | Standalone's MITRE ATT&CK CSV map — `~/.g6/mitre_map.csv` if present, else the CSV bundled with this package; Fleet resolves attack tags via its own live API instead |
| `timerange` | `parse_timerange`, `format_timerange` — converts rule YAML's `detection.timerange` (e.g. `"2 hr"`) to/from the Alert API's `timerange_day`/`timerange_hour`/`timerange_minute` fields, of which only one may be non-zero |
| `version` | `parse_version`, `meets_minimum_version` — backs the `minimum_guardsix_version` rule-YAML gate (Fleet only) |
| `formatting` | `format_date`, `truncate_text`, `format_alert_summary`, `tabulate_table`, `print_table` |
| `jinja` | `jinja_from_field_mapping` (parameterised; reproduces both SDK variants byte-for-byte) |

No HTTP or CLI concerns live here — depends only on `pyyaml`, `tabulate`, and
`werkzeug`. `transport`/`auth` define the seam the two backends implement, but
neither module makes network calls itself.

---

## Installation

Installed automatically as a dependency when you install `g6-alert`:

```bash
pip install g6-alert
```

To install this package alone from PyPI:

```bash
pip install g6-alert-core
```

### From source (development)

To install both packages editable from this monorepo:

```bash
pip install -e ./g6_alert_core -e ./g6-alert
```

To install and test this package in isolation:

```bash
pip install -e ".[dev]"
pytest -q
```

See the [`g6-alert` documentation](https://pypi.org/project/g6-alert/) for full SDK and CLI documentation.

---

## Contributing

External contributions are closed for now. This package is distributed through PyPI
(`pip install g6-alert-core`), and is installed automatically with `g6-alert`.

---

## License

Copyright 2026 Guardsix A/S. Licensed under the Apache License, Version 2.0.
See the LICENSE and NOTICE files for the full terms.
