Deletes jobs, ensuring the correct method is called. Args: *args: Additional arguments. **kwargs: Additional

Creates a job, setting it as a child of the specified parent if provided. Args: parent (optional): The parent job, if an

View enabled only with elastic. Allow to perform queries in the Plugin reports. Args: request (HttpRequest): The request

Handles POST request for user login. Args: request (Request): The request object containing user credentials. R

User has access to: - jobs with TLP = CLEAR or GREEN - jobs with TLP = AMBER or RED and - jobs made by ingestors if t

first check the secret in the environment then try to find the secret in AWS Secret Manager

Helper function that takes of care of requesting new analysis, reading response, polling for result and exception handling for a

Return the number of DB queries `operation()` runs. CaptureQueriesContext forces a debug cursor regardless of settings.DEBUG, so this works in th

Delete every message in the session (resets the conversation).

Perform a health check for the plugin. Args: user (User): The user instance. Returns: bool: Whether

Standard response for malicious detector analyzers :param observable: observable analyzed :type observable: str :param malicious: tell if

Update the plugin. Must be implemented by subclasses. Returns: bool: Whether the update was successful.

Returns observable classification for the given value.\n Only following types are supported: ip, domain, url, hash (md5, sha1, sha256)

Annotates parameters indicating if they are configured for a specific user. Args: config (PythonConfig): The configurati

Annotates the final value for a user, considering runtime, owner, organization, default, and test values. Args: config (

Determine the type of a generic observable. Supported types: email, filename, registry, xmpid

Return ``(True, 0)`` when the key is under the limit, or ``(False, retry_after_seconds)`` when it is exhausted. ``retry_after`` is an

Build the agent's tools bound to a single user. Each tool is produced by a factory that closes over `user`, so every ORM query the agent can

Handles GET request for retrieving API access token. Args: request (Request): The request object. Returns:

Retrieves a specific report object by job_id and report_id. Overrides the drf's default `get_object` method to fetch a report object

Record one action for *key* and return the new count. Uses ``incr`` which is atomic under Redis and sets a TTL so dead counters don't

Entrypoint function to execute the plugin. calls `before_run`, `run`, `after_run` in that order with exception handling.

Annotates configurations indicating if they are runnable. Args: user (User, optional): The user to check. Defaults to No

Map the page the user is on (the WebSocket context_url) to a compact prompt hint. Returns a fixed hint for a job or investigation detail page, or

Run one chat turn off-request and stream it to the user's WebSocket group. Enqueued by ChatConsumer.receive_json. The agent runs synchronously he

Refreshes the cache keys associated with the parameter's configuration class.

Store the previewed analysis inputs and return a fresh one-time pending id.

Validate one inbound message, resolve its session, and enqueue the agent turn. The frame is untrusted: it is validated/length-capped by

Return a per-test key so LocMemCache state from one test never leaks into another. SimpleTestCase does not flush the cache between tests, and all

A ChatConsumer wired for direct (synchronous) method calls. The consumer's sync methods (connect/receive_json/disconnect) are exercised directly

Clamp an LLM-supplied result limit into ``[1, MAX_RESULTS]``. Tool arguments are untrusted, so the raw ``limit`` is coerced to ``int`` and bounde