Sentineliqsdk

Modern Python library of utility classes for SentinelIQ analyzers and responders.

Note: This SDK now exposes only the modern API (Python 3.13). Legacy helper aliases such as getData, getParam, checkTlp, and notSupported were removed. Migrate to get_data, get_param, and rely on automatic TLP/PAP enforcement in Worker.

Installing

To install this package, run:

pip install sentineliqsdk

Using

Example usage:

from __future__ import annotations

import json

from sentineliqsdk import Analyzer, Extractor, Worker, runner, WorkerInput


class EchoAnalyzer(Analyzer):
    def execute(self):
        value = self.get_data()
        return self.report({"echo": value})

    def run(self):
        return self.execute()


if __name__ == "__main__":
    # Option A: instantiate directly
    report = EchoAnalyzer(WorkerInput(data_type="ip", data="1.2.3.4")).run()
    print(json.dumps(report.full_report, ensure_ascii=False))

    # Option B: use runner with input_data
    runner(EchoAnalyzer, WorkerInput(data_type="ip", data="8.8.8.8"))

Internal structure (for maintainers):

• src/sentineliqsdk/core/worker.py
• src/sentineliqsdk/analyzers/base.py
• src/sentineliqsdk/responders/base.py
• src/sentineliqsdk/extractors/regex.py (Extractor uses stdlib validators: ipaddress, urlparse)

Extractor

The Extractor detects common IOC types using Python's standard library instead of complex regular expressions:

• ip: ipaddress.ip_address
• url/uri: urllib.parse.urlparse
• mail: email.utils.parseaddr
• hash: length + hex digits check
• domain/fqdn/registry/user‑agent: simple heuristics aligned with the test suite

Migration (Breaking Changes)

• Import from the top-level package only:
  • Before: from sentineliqsdk.analyzer import Analyzer
  • After: from sentineliqsdk import Analyzer
• Removed legacy helpers: getData, getParam, checkTlp, notSupported, unexpectedError.
• Removed legacy config key: config.auto_extract_artifacts (use config.auto_extract).
• Removed legacy module paths: sentineliqsdk.analyzer, sentineliqsdk.responder, sentineliqsdk.worker, sentineliqsdk.extractor (all exported at top-level instead).

Contributing