def download_oat_file(
    token: str, oat_file_id: str, pipeline_id: str
) -> Optional[BytesIO]:
    """Download OAT package
    Args:
        token (str): account token
        oat_file_id (str): Identification associated with an OAT event
        pipeline_id (str): Unique alphanumeric string that identifies a data pipeline.
    Returns:
        Optional[BytesIO]
    """

    url = f"{XDR_HOST_URL}/v1.0/preview/ath/oat/dataPipelines/{pipeline_id}/packages/{oat_file_id}"
    headers = get_header(
        {
            "Authorization": f"Bearer {token}",
            "Content-Type": "application/gzip",
        }
    )
    logger.info(f"Download oat file url: {url}")

    response = requests.get(url, headers=headers)
    logger.info(
        f"Download oat file response status_code: {response.status_code}, "
        f"response headers: {get_trace_log(response.headers)}"
    )

    if response.status_code == requests.codes.bad_request:
        response_data = response.json()
        if (
            response_data.get("error", {}).get("innererror", {}).get("code", "")
            == "OutOfRetentionTime"
        ):
            logger.warning(
                f"The OAT file is out of retention time, file_id: {oat_file_id}"
            )
            return None
    if response.status_code in [requests.codes.forbidden, requests.codes.not_found]:
        logger.error(f"response status code: {response.status_code}")
        return None

    response.raise_for_status()

    bytes_io = BytesIO()
    with gzip.GzipFile(filename="", fileobj=bytes_io, mode="wb") as fp:
        bytes_written = fp.write(response.content)
    bytes_io.seek(0)
    logger.info(f"Download oat file total bytes: {bytes_written}")

    return bytes_io
Download OAT package
    Args:
        token (str): account token
        oat_file_id (str): Identification associated with an OAT event
        pipeline_id (str): Unique alphanumeric string that identifies a data pipeline.
    Returns:
        Optional[BytesIO]
    
Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/shared_code/services/oat_service.py