pycti 5.12.13__py3-none-any.whl → 5.12.15__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of pycti might be problematic. Click here for more details.
- pycti/__init__.py +1 -1
- pycti/api/__init__.py +0 -3
- pycti/api/opencti_api_client.py +10 -56
- pycti/api/opencti_api_connector.py +1 -2
- pycti/api/opencti_api_playbook.py +3 -4
- pycti/api/opencti_api_work.py +15 -12
- pycti/connector/__init__.py +0 -3
- pycti/connector/opencti_connector_helper.py +63 -54
- pycti/connector/opencti_metric_handler.py +8 -5
- pycti/entities/__init__.py +0 -3
- pycti/entities/opencti_attack_pattern.py +17 -11
- pycti/entities/opencti_campaign.py +15 -9
- pycti/entities/opencti_case_incident.py +39 -43
- pycti/entities/opencti_case_rfi.py +34 -46
- pycti/entities/opencti_case_rft.py +35 -44
- pycti/entities/opencti_channel.py +15 -9
- pycti/entities/opencti_course_of_action.py +15 -9
- pycti/entities/opencti_data_component.py +17 -14
- pycti/entities/opencti_data_source.py +12 -16
- pycti/entities/opencti_event.py +15 -9
- pycti/entities/opencti_external_reference.py +20 -15
- pycti/entities/opencti_feedback.py +36 -46
- pycti/entities/opencti_grouping.py +22 -20
- pycti/entities/opencti_identity.py +15 -8
- pycti/entities/opencti_incident.py +13 -9
- pycti/entities/opencti_indicator.py +18 -15
- pycti/entities/opencti_infrastructure.py +15 -9
- pycti/entities/opencti_intrusion_set.py +12 -8
- pycti/entities/opencti_kill_chain_phase.py +16 -12
- pycti/entities/opencti_label.py +16 -12
- pycti/entities/opencti_language.py +13 -9
- pycti/entities/opencti_location.py +13 -9
- pycti/entities/opencti_malware.py +15 -9
- pycti/entities/opencti_malware_analysis.py +17 -9
- pycti/entities/opencti_marking_definition.py +15 -11
- pycti/entities/opencti_narrative.py +15 -9
- pycti/entities/opencti_note.py +35 -20
- pycti/entities/opencti_observed_data.py +34 -19
- pycti/entities/opencti_opinion.py +37 -20
- pycti/entities/opencti_report.py +36 -20
- pycti/entities/opencti_stix.py +8 -19
- pycti/entities/opencti_stix_core_object.py +15 -9
- pycti/entities/opencti_stix_core_relationship.py +69 -52
- pycti/entities/opencti_stix_cyber_observable.py +78 -62
- pycti/entities/opencti_stix_domain_object.py +75 -55
- pycti/entities/opencti_stix_nested_ref_relationship.py +21 -14
- pycti/entities/opencti_stix_object_or_stix_relationship.py +4 -7
- pycti/entities/opencti_stix_sighting_relationship.py +34 -26
- pycti/entities/opencti_task.py +37 -44
- pycti/entities/opencti_threat_actor.py +7 -4
- pycti/entities/opencti_threat_actor_group.py +10 -8
- pycti/entities/opencti_threat_actor_individual.py +10 -9
- pycti/entities/opencti_tool.py +15 -9
- pycti/entities/opencti_vocabulary.py +11 -13
- pycti/entities/opencti_vulnerability.py +15 -9
- pycti/utils/opencti_logger.py +64 -0
- pycti/utils/opencti_stix2.py +30 -24
- pycti/utils/opencti_stix2_update.py +2 -6
- {pycti-5.12.13.dist-info → pycti-5.12.15.dist-info}/METADATA +1 -1
- pycti-5.12.15.dist-info/RECORD +68 -0
- pycti-5.12.13.dist-info/RECORD +0 -67
- {pycti-5.12.13.dist-info → pycti-5.12.15.dist-info}/LICENSE +0 -0
- {pycti-5.12.13.dist-info → pycti-5.12.15.dist-info}/WHEEL +0 -0
- {pycti-5.12.13.dist-info → pycti-5.12.15.dist-info}/top_level.txt +0 -0
|
@@ -5,8 +5,6 @@ import uuid
|
|
|
5
5
|
|
|
6
6
|
from stix2.canonicalization.Canonicalize import canonicalize
|
|
7
7
|
|
|
8
|
-
from pycti.entities import LOGGER
|
|
9
|
-
|
|
10
8
|
|
|
11
9
|
class AttackPattern:
|
|
12
10
|
def __init__(self, opencti):
|
|
@@ -289,7 +287,9 @@ class AttackPattern:
|
|
|
289
287
|
if get_all:
|
|
290
288
|
first = 500
|
|
291
289
|
|
|
292
|
-
|
|
290
|
+
self.opencti.app_logger.info(
|
|
291
|
+
"Listing Attack-Patterns with filters", {"filters": json.dumps(filters)}
|
|
292
|
+
)
|
|
293
293
|
query = (
|
|
294
294
|
"""
|
|
295
295
|
query AttackPatterns($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: AttackPatternsOrdering, $orderMode: OrderingMode) {
|
|
@@ -333,7 +333,9 @@ class AttackPattern:
|
|
|
333
333
|
final_data = final_data + data
|
|
334
334
|
while result["data"]["attackPatterns"]["pageInfo"]["hasNextPage"]:
|
|
335
335
|
after = result["data"]["attackPatterns"]["pageInfo"]["endCursor"]
|
|
336
|
-
|
|
336
|
+
self.opencti.app_logger.info(
|
|
337
|
+
"Listing Attack-Patterns", {"after": after}
|
|
338
|
+
)
|
|
337
339
|
result = self.opencti.query(
|
|
338
340
|
query,
|
|
339
341
|
{
|
|
@@ -367,7 +369,7 @@ class AttackPattern:
|
|
|
367
369
|
custom_attributes = kwargs.get("customAttributes", None)
|
|
368
370
|
with_files = kwargs.get("withFiles", False)
|
|
369
371
|
if id is not None:
|
|
370
|
-
|
|
372
|
+
self.opencti.app_logger.info("Reading Attack-Pattern", {"id": id})
|
|
371
373
|
query = (
|
|
372
374
|
"""
|
|
373
375
|
query AttackPattern($id: String!) {
|
|
@@ -392,7 +394,9 @@ class AttackPattern:
|
|
|
392
394
|
else:
|
|
393
395
|
return None
|
|
394
396
|
else:
|
|
395
|
-
|
|
397
|
+
self.opencti.app_logger.error(
|
|
398
|
+
"[opencti_attack_pattern] Missing parameters: id or filters"
|
|
399
|
+
)
|
|
396
400
|
return None
|
|
397
401
|
|
|
398
402
|
"""
|
|
@@ -426,7 +430,7 @@ class AttackPattern:
|
|
|
426
430
|
update = kwargs.get("update", False)
|
|
427
431
|
|
|
428
432
|
if name is not None:
|
|
429
|
-
|
|
433
|
+
self.opencti.app_logger.info("Creating Attack-Pattern", {"name": name})
|
|
430
434
|
query = """
|
|
431
435
|
mutation AttackPatternAdd($input: AttackPatternAddInput!) {
|
|
432
436
|
attackPatternAdd(input: $input) {
|
|
@@ -469,7 +473,7 @@ class AttackPattern:
|
|
|
469
473
|
result["data"]["attackPatternAdd"]
|
|
470
474
|
)
|
|
471
475
|
else:
|
|
472
|
-
|
|
476
|
+
self.opencti.app_logger.error(
|
|
473
477
|
"[opencti_attack_pattern] Missing parameters: name and description"
|
|
474
478
|
)
|
|
475
479
|
|
|
@@ -598,12 +602,14 @@ class AttackPattern:
|
|
|
598
602
|
update=update,
|
|
599
603
|
)
|
|
600
604
|
else:
|
|
601
|
-
|
|
605
|
+
self.opencti.app_logger.error(
|
|
606
|
+
"[opencti_attack_pattern] Missing parameters: stixObject"
|
|
607
|
+
)
|
|
602
608
|
|
|
603
609
|
def delete(self, **kwargs):
|
|
604
610
|
id = kwargs.get("id", None)
|
|
605
611
|
if id is not None:
|
|
606
|
-
|
|
612
|
+
self.opencti.app_logger.info("Deleting Attack Pattern", {"id": id})
|
|
607
613
|
query = """
|
|
608
614
|
mutation AttackPatternEdit($id: ID!) {
|
|
609
615
|
attackPatternEdit(id: $id) {
|
|
@@ -613,5 +619,5 @@ class AttackPattern:
|
|
|
613
619
|
"""
|
|
614
620
|
self.opencti.query(query, {"id": id})
|
|
615
621
|
else:
|
|
616
|
-
|
|
622
|
+
self.opencti.app_logger.error("[attack_pattern] Missing parameters: id")
|
|
617
623
|
return None
|
|
@@ -5,8 +5,6 @@ import uuid
|
|
|
5
5
|
|
|
6
6
|
from stix2.canonicalization.Canonicalize import canonicalize
|
|
7
7
|
|
|
8
|
-
from pycti.entities import LOGGER
|
|
9
|
-
|
|
10
8
|
|
|
11
9
|
class Campaign:
|
|
12
10
|
def __init__(self, opencti):
|
|
@@ -256,7 +254,9 @@ class Campaign:
|
|
|
256
254
|
if get_all:
|
|
257
255
|
first = 100
|
|
258
256
|
|
|
259
|
-
|
|
257
|
+
self.opencti.app_logger.info(
|
|
258
|
+
"Listing Campaigns with filters", {"filters": json.dumps(filters)}
|
|
259
|
+
)
|
|
260
260
|
query = (
|
|
261
261
|
"""
|
|
262
262
|
query Campaigns($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: CampaignsOrdering, $orderMode: OrderingMode) {
|
|
@@ -300,7 +300,7 @@ class Campaign:
|
|
|
300
300
|
final_data = final_data + data
|
|
301
301
|
while result["data"]["campaigns"]["pageInfo"]["hasNextPage"]:
|
|
302
302
|
after = result["data"]["campaigns"]["pageInfo"]["endCursor"]
|
|
303
|
-
|
|
303
|
+
self.opencti.app_logger.info("Listing Campaigns", {"after": after})
|
|
304
304
|
result = self.opencti.query(
|
|
305
305
|
query,
|
|
306
306
|
{
|
|
@@ -334,7 +334,7 @@ class Campaign:
|
|
|
334
334
|
custom_attributes = kwargs.get("customAttributes", None)
|
|
335
335
|
with_files = kwargs.get("withFiles", False)
|
|
336
336
|
if id is not None:
|
|
337
|
-
|
|
337
|
+
self.opencti.app_logger.info("Reading Campaign", {"id": id})
|
|
338
338
|
query = (
|
|
339
339
|
"""
|
|
340
340
|
query Campaign($id: String!) {
|
|
@@ -359,7 +359,9 @@ class Campaign:
|
|
|
359
359
|
else:
|
|
360
360
|
return None
|
|
361
361
|
else:
|
|
362
|
-
|
|
362
|
+
self.opencti.app_logger.error(
|
|
363
|
+
"[opencti_campaign] Missing parameters: id or filters"
|
|
364
|
+
)
|
|
363
365
|
return None
|
|
364
366
|
|
|
365
367
|
"""
|
|
@@ -391,7 +393,7 @@ class Campaign:
|
|
|
391
393
|
update = kwargs.get("update", False)
|
|
392
394
|
|
|
393
395
|
if name is not None:
|
|
394
|
-
|
|
396
|
+
self.opencti.app_logger.info("Creating Campaign", {"name": name})
|
|
395
397
|
query = """
|
|
396
398
|
mutation CampaignAdd($input: CampaignAddInput!) {
|
|
397
399
|
campaignAdd(input: $input) {
|
|
@@ -430,7 +432,9 @@ class Campaign:
|
|
|
430
432
|
)
|
|
431
433
|
return self.opencti.process_multiple_fields(result["data"]["campaignAdd"])
|
|
432
434
|
else:
|
|
433
|
-
|
|
435
|
+
self.opencti.app_logger.error(
|
|
436
|
+
"[opencti_campaign] Missing parameters: name and description"
|
|
437
|
+
)
|
|
434
438
|
|
|
435
439
|
"""
|
|
436
440
|
Import a Campaign object from a STIX2 object
|
|
@@ -500,4 +504,6 @@ class Campaign:
|
|
|
500
504
|
update=update,
|
|
501
505
|
)
|
|
502
506
|
else:
|
|
503
|
-
|
|
507
|
+
self.opencti.app_logger.error(
|
|
508
|
+
"[opencti_campaign] Missing parameters: stixObject"
|
|
509
|
+
)
|
|
@@ -5,8 +5,6 @@ import uuid
|
|
|
5
5
|
from dateutil.parser import parse
|
|
6
6
|
from stix2.canonicalization.Canonicalize import canonicalize
|
|
7
7
|
|
|
8
|
-
from pycti.entities import LOGGER
|
|
9
|
-
|
|
10
8
|
|
|
11
9
|
class CaseIncident:
|
|
12
10
|
def __init__(self, opencti):
|
|
@@ -499,7 +497,9 @@ class CaseIncident:
|
|
|
499
497
|
if get_all:
|
|
500
498
|
first = 500
|
|
501
499
|
|
|
502
|
-
|
|
500
|
+
self.opencti.app_logger.info(
|
|
501
|
+
"Listing Case Incidents with filters", {"filters": json.dumps(filters)}
|
|
502
|
+
)
|
|
503
503
|
query = (
|
|
504
504
|
"""
|
|
505
505
|
query CaseIncidents($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: CaseIncidentsOrdering, $orderMode: OrderingMode) {
|
|
@@ -543,7 +543,7 @@ class CaseIncident:
|
|
|
543
543
|
final_data = final_data + data
|
|
544
544
|
while result["data"]["caseIncidents"]["pageInfo"]["hasNextPage"]:
|
|
545
545
|
after = result["date"]["caseIncidents"]["pageInfo"]["endCursor"]
|
|
546
|
-
self.opencti.
|
|
546
|
+
self.opencti.app_logger.info("Listing Case Incidents", {"after": after})
|
|
547
547
|
result = self.opencti.query(
|
|
548
548
|
query,
|
|
549
549
|
{
|
|
@@ -577,7 +577,7 @@ class CaseIncident:
|
|
|
577
577
|
custom_attributes = kwargs.get("customAttributes", None)
|
|
578
578
|
with_files = kwargs.get("withFiles", False)
|
|
579
579
|
if id is not None:
|
|
580
|
-
self.opencti.
|
|
580
|
+
self.opencti.app_logger.info("Reading Case Incident", {"id": id})
|
|
581
581
|
query = (
|
|
582
582
|
"""
|
|
583
583
|
query CaseIncident($id: String!) {
|
|
@@ -648,13 +648,12 @@ class CaseIncident:
|
|
|
648
648
|
"stixObjectOrStixRelationshipId", None
|
|
649
649
|
)
|
|
650
650
|
if id is not None and stix_object_or_stix_relationship_id is not None:
|
|
651
|
-
self.opencti.
|
|
652
|
-
"
|
|
653
|
-
|
|
654
|
-
|
|
655
|
-
|
|
656
|
-
|
|
657
|
-
+ "}",
|
|
651
|
+
self.opencti.app_logger.info(
|
|
652
|
+
"Checking StixObjectOrStixRelationship in CaseIncident",
|
|
653
|
+
{
|
|
654
|
+
"stix_object_or_stix_relationship_id": stix_object_or_stix_relationship_id,
|
|
655
|
+
"id": id,
|
|
656
|
+
},
|
|
658
657
|
)
|
|
659
658
|
query = """
|
|
660
659
|
query CaseIncidentContainsStixObjectOrStixRelationship($id: String!, $stixObjectOrStixRelationshipId: String!) {
|
|
@@ -670,9 +669,8 @@ class CaseIncident:
|
|
|
670
669
|
)
|
|
671
670
|
return result["data"]["caseIncidentContainsStixObjectOrStixRelationship"]
|
|
672
671
|
else:
|
|
673
|
-
self.opencti.
|
|
674
|
-
"
|
|
675
|
-
"[opencti_caseIncident] Missing parameters: id or stixObjectOrStixRelationshipId",
|
|
672
|
+
self.opencti.app_logger.error(
|
|
673
|
+
"[opencti_caseIncident] Missing parameters: id or stixObjectOrStixRelationshipId"
|
|
676
674
|
)
|
|
677
675
|
|
|
678
676
|
"""
|
|
@@ -706,7 +704,7 @@ class CaseIncident:
|
|
|
706
704
|
update = kwargs.get("update", False)
|
|
707
705
|
|
|
708
706
|
if name is not None:
|
|
709
|
-
self.opencti.
|
|
707
|
+
self.opencti.app_logger.info("Creating Case Incident", {"name": name})
|
|
710
708
|
query = """
|
|
711
709
|
mutation CaseIncidentAdd($input: CaseIncidentAddInput!) {
|
|
712
710
|
caseIncidentAdd(input: $input) {
|
|
@@ -749,9 +747,8 @@ class CaseIncident:
|
|
|
749
747
|
result["data"]["caseIncidentAdd"]
|
|
750
748
|
)
|
|
751
749
|
else:
|
|
752
|
-
self.opencti.
|
|
753
|
-
"
|
|
754
|
-
"[opencti_caseIncident] Missing parameters: name",
|
|
750
|
+
self.opencti.app_logger.error(
|
|
751
|
+
"[opencti_caseIncident] Missing parameters: name"
|
|
755
752
|
)
|
|
756
753
|
|
|
757
754
|
"""
|
|
@@ -768,14 +765,14 @@ class CaseIncident:
|
|
|
768
765
|
"stixObjectOrStixRelationshipId", None
|
|
769
766
|
)
|
|
770
767
|
if id is not None and stix_object_or_stix_relationship_id is not None:
|
|
771
|
-
self.opencti.
|
|
772
|
-
"
|
|
773
|
-
|
|
774
|
-
|
|
775
|
-
|
|
776
|
-
|
|
777
|
-
+ "}",
|
|
768
|
+
self.opencti.app_logger.info(
|
|
769
|
+
"Adding StixObjectOrStixRelationship to CaseIncident",
|
|
770
|
+
{
|
|
771
|
+
"stix_object_or_stix_relationship_id": stix_object_or_stix_relationship_id,
|
|
772
|
+
"id": id,
|
|
773
|
+
},
|
|
778
774
|
)
|
|
775
|
+
|
|
779
776
|
query = """
|
|
780
777
|
mutation CaseIncidentEditRelationAdd($id: ID!, $input: StixRefRelationshipAddInput!) {
|
|
781
778
|
stixDomainObjectEdit(id: $id) {
|
|
@@ -797,9 +794,8 @@ class CaseIncident:
|
|
|
797
794
|
)
|
|
798
795
|
return True
|
|
799
796
|
else:
|
|
800
|
-
self.opencti.
|
|
801
|
-
"
|
|
802
|
-
"[opencti_caseIncident] Missing parameters: id and stixObjectOrStixRelationshipId",
|
|
797
|
+
self.opencti.app_logger.error(
|
|
798
|
+
"[opencti_caseIncident] Missing parameters: id and stixObjectOrStixRelationshipId"
|
|
803
799
|
)
|
|
804
800
|
return False
|
|
805
801
|
|
|
@@ -817,13 +813,12 @@ class CaseIncident:
|
|
|
817
813
|
"stixObjectOrStixRelationshipId", None
|
|
818
814
|
)
|
|
819
815
|
if id is not None and stix_object_or_stix_relationship_id is not None:
|
|
820
|
-
self.opencti.
|
|
821
|
-
"
|
|
822
|
-
|
|
823
|
-
|
|
824
|
-
|
|
825
|
-
|
|
826
|
-
+ "}",
|
|
816
|
+
self.opencti.app_logger.info(
|
|
817
|
+
"Removing StixObjectOrStixRelationship to CaseIncident",
|
|
818
|
+
{
|
|
819
|
+
"stix_object_or_stix_relationship_id": stix_object_or_stix_relationship_id,
|
|
820
|
+
"id": id,
|
|
821
|
+
},
|
|
827
822
|
)
|
|
828
823
|
query = """
|
|
829
824
|
mutation CaseIncidentEditRelationDelete($id: ID!, $toId: StixRef!, $relationship_type: String!) {
|
|
@@ -844,9 +839,8 @@ class CaseIncident:
|
|
|
844
839
|
)
|
|
845
840
|
return True
|
|
846
841
|
else:
|
|
847
|
-
self.opencti.
|
|
848
|
-
"
|
|
849
|
-
"[opencti_caseIncident] Missing parameters: id and stixObjectOrStixRelationshipId",
|
|
842
|
+
self.opencti.app_logger.error(
|
|
843
|
+
"[opencti_caseIncident] Missing parameters: id and stixObjectOrStixRelationshipId"
|
|
850
844
|
)
|
|
851
845
|
return False
|
|
852
846
|
|
|
@@ -930,14 +924,14 @@ class CaseIncident:
|
|
|
930
924
|
update=update,
|
|
931
925
|
)
|
|
932
926
|
else:
|
|
933
|
-
self.opencti.
|
|
934
|
-
"
|
|
927
|
+
self.opencti.app_logger.error(
|
|
928
|
+
"[opencti_caseIncident] Missing parameters: stixObject"
|
|
935
929
|
)
|
|
936
930
|
|
|
937
931
|
def delete(self, **kwargs):
|
|
938
932
|
id = kwargs.get("id", None)
|
|
939
933
|
if id is not None:
|
|
940
|
-
self.opencti.
|
|
934
|
+
self.opencti.app_logger.info("Deleting Case Incident", {"id": id})
|
|
941
935
|
query = """
|
|
942
936
|
mutation CaseIncidentDelete($id: ID!) {
|
|
943
937
|
stixDomainObjectEdit(id: $id) {
|
|
@@ -947,5 +941,7 @@ class CaseIncident:
|
|
|
947
941
|
"""
|
|
948
942
|
self.opencti.query(query, {"id": id})
|
|
949
943
|
else:
|
|
950
|
-
self.opencti.
|
|
944
|
+
self.opencti.app_logger.error(
|
|
945
|
+
"[opencti_case_incident] Missing parameters: id"
|
|
946
|
+
)
|
|
951
947
|
return None
|
|
@@ -5,8 +5,6 @@ import uuid
|
|
|
5
5
|
from dateutil.parser import parse
|
|
6
6
|
from stix2.canonicalization.Canonicalize import canonicalize
|
|
7
7
|
|
|
8
|
-
from pycti.entities import LOGGER
|
|
9
|
-
|
|
10
8
|
|
|
11
9
|
class CaseRfi:
|
|
12
10
|
def __init__(self, opencti):
|
|
@@ -495,9 +493,8 @@ class CaseRfi:
|
|
|
495
493
|
if get_all:
|
|
496
494
|
first = 500
|
|
497
495
|
|
|
498
|
-
self.opencti.
|
|
499
|
-
"
|
|
500
|
-
"Listing Case Rfis with filters " + json.dumps(filters) + ".",
|
|
496
|
+
self.opencti.app_logger.info(
|
|
497
|
+
"Listing Case Rfis with filters", {"filters": json.dumps(filters)}
|
|
501
498
|
)
|
|
502
499
|
query = (
|
|
503
500
|
"""
|
|
@@ -542,7 +539,7 @@ class CaseRfi:
|
|
|
542
539
|
final_data = final_data + data
|
|
543
540
|
while result["data"]["caseRfis"]["pageInfo"]["hasNextPage"]:
|
|
544
541
|
after = result["date"]["caseRfis"]["pageInfo"]["endCursor"]
|
|
545
|
-
self.opencti.
|
|
542
|
+
self.opencti.app_logger.info("Listing Case Rfis", {"after": after})
|
|
546
543
|
result = self.opencti.query(
|
|
547
544
|
query,
|
|
548
545
|
{
|
|
@@ -576,7 +573,7 @@ class CaseRfi:
|
|
|
576
573
|
custom_attributes = kwargs.get("customAttributes", None)
|
|
577
574
|
with_files = kwargs.get("withFiles", False)
|
|
578
575
|
if id is not None:
|
|
579
|
-
self.opencti.
|
|
576
|
+
self.opencti.app_logger.info("Reading Case Rfi", {"id": id})
|
|
580
577
|
query = (
|
|
581
578
|
"""
|
|
582
579
|
query CaseRfi($id: String!) {
|
|
@@ -647,13 +644,12 @@ class CaseRfi:
|
|
|
647
644
|
"stixObjectOrStixRelationshipId", None
|
|
648
645
|
)
|
|
649
646
|
if id is not None and stix_object_or_stix_relationship_id is not None:
|
|
650
|
-
self.opencti.
|
|
651
|
-
"
|
|
652
|
-
|
|
653
|
-
|
|
654
|
-
|
|
655
|
-
|
|
656
|
-
+ "}",
|
|
647
|
+
self.opencti.app_logger.info(
|
|
648
|
+
"Checking StixObjectOrStixRelationship in CaseRfi",
|
|
649
|
+
{
|
|
650
|
+
"stix_object_or_stix_relationship_id": stix_object_or_stix_relationship_id,
|
|
651
|
+
"id": id,
|
|
652
|
+
},
|
|
657
653
|
)
|
|
658
654
|
query = """
|
|
659
655
|
query CaseRfiContainsStixObjectOrStixRelationship($id: String!, $stixObjectOrStixRelationshipId: String!) {
|
|
@@ -669,9 +665,8 @@ class CaseRfi:
|
|
|
669
665
|
)
|
|
670
666
|
return result["data"]["caseRfiContainsStixObjectOrStixRelationship"]
|
|
671
667
|
else:
|
|
672
|
-
self.opencti.
|
|
673
|
-
"
|
|
674
|
-
"[opencti_caseRfi] Missing parameters: id or stixObjectOrStixRelationshipId",
|
|
668
|
+
self.opencti.app_logger.error(
|
|
669
|
+
"[opencti_caseRfi] Missing parameters: id or stixObjectOrStixRelationshipId"
|
|
675
670
|
)
|
|
676
671
|
|
|
677
672
|
"""
|
|
@@ -701,7 +696,7 @@ class CaseRfi:
|
|
|
701
696
|
information_types = kwargs.get("information_types", None)
|
|
702
697
|
|
|
703
698
|
if name is not None:
|
|
704
|
-
self.opencti.
|
|
699
|
+
self.opencti.app_logger.info("Creating Case Rfi", {"name": name})
|
|
705
700
|
query = """
|
|
706
701
|
mutation CaseRfiAdd($input: CaseRfiAddInput!) {
|
|
707
702
|
caseRfiAdd(input: $input) {
|
|
@@ -738,10 +733,7 @@ class CaseRfi:
|
|
|
738
733
|
)
|
|
739
734
|
return self.opencti.process_multiple_fields(result["data"]["caseRfiAdd"])
|
|
740
735
|
else:
|
|
741
|
-
self.opencti.
|
|
742
|
-
"error",
|
|
743
|
-
"[opencti_caseRfi] Missing parameters: name",
|
|
744
|
-
)
|
|
736
|
+
self.opencti.app_logger.error("[opencti_caseRfi] Missing parameters: name")
|
|
745
737
|
|
|
746
738
|
"""
|
|
747
739
|
Add a Stix-Entity object to Case Rfi object (object_refs)
|
|
@@ -757,13 +749,12 @@ class CaseRfi:
|
|
|
757
749
|
"stixObjectOrStixRelationshipId", None
|
|
758
750
|
)
|
|
759
751
|
if id is not None and stix_object_or_stix_relationship_id is not None:
|
|
760
|
-
self.opencti.
|
|
761
|
-
"
|
|
762
|
-
|
|
763
|
-
|
|
764
|
-
|
|
765
|
-
|
|
766
|
-
+ "}",
|
|
752
|
+
self.opencti.app_logger.info(
|
|
753
|
+
"Adding StixObjectOrStixRelationship in CaseRfi",
|
|
754
|
+
{
|
|
755
|
+
"stix_object_or_stix_relationship_id": stix_object_or_stix_relationship_id,
|
|
756
|
+
"id": id,
|
|
757
|
+
},
|
|
767
758
|
)
|
|
768
759
|
query = """
|
|
769
760
|
mutation CaseRfiEditRelationAdd($id: ID!, $input: StixRefRelationshipAddInput) {
|
|
@@ -786,9 +777,8 @@ class CaseRfi:
|
|
|
786
777
|
)
|
|
787
778
|
return True
|
|
788
779
|
else:
|
|
789
|
-
self.opencti.
|
|
790
|
-
"
|
|
791
|
-
"[opencti_caseRfi] Missing parameters: id and stixObjectOrStixRelationshipId",
|
|
780
|
+
self.opencti.app_logger.info(
|
|
781
|
+
"[opencti_caseRfi] Missing parameters: id and stixObjectOrStixRelationshipId"
|
|
792
782
|
)
|
|
793
783
|
return False
|
|
794
784
|
|
|
@@ -806,13 +796,12 @@ class CaseRfi:
|
|
|
806
796
|
"stixObjectOrStixRelationshipId", None
|
|
807
797
|
)
|
|
808
798
|
if id is not None and stix_object_or_stix_relationship_id is not None:
|
|
809
|
-
self.opencti.
|
|
810
|
-
"
|
|
811
|
-
|
|
812
|
-
|
|
813
|
-
|
|
814
|
-
|
|
815
|
-
+ "}",
|
|
799
|
+
self.opencti.app_logger.info(
|
|
800
|
+
"Removing StixObjectOrStixRelationship in CaseRfi",
|
|
801
|
+
{
|
|
802
|
+
"stix_object_or_stix_relationship_id": stix_object_or_stix_relationship_id,
|
|
803
|
+
"id": id,
|
|
804
|
+
},
|
|
816
805
|
)
|
|
817
806
|
query = """
|
|
818
807
|
mutation CaseRfiEditRelationDelete($id: ID!, $toId: StixRef!, $relationship_type: String!) {
|
|
@@ -833,9 +822,8 @@ class CaseRfi:
|
|
|
833
822
|
)
|
|
834
823
|
return True
|
|
835
824
|
else:
|
|
836
|
-
self.opencti.
|
|
837
|
-
"
|
|
838
|
-
"[opencti_caseRfi] Missing parameters: id and stixObjectOrStixRelationshipId",
|
|
825
|
+
self.opencti.app_logger.error(
|
|
826
|
+
"[opencti_caseRfi] Missing parameters: id and stixObjectOrStixRelationshipId"
|
|
839
827
|
)
|
|
840
828
|
return False
|
|
841
829
|
|
|
@@ -901,14 +889,14 @@ class CaseRfi:
|
|
|
901
889
|
else None,
|
|
902
890
|
)
|
|
903
891
|
else:
|
|
904
|
-
self.opencti.
|
|
905
|
-
"
|
|
892
|
+
self.opencti.app_logger.error(
|
|
893
|
+
"[opencti_caseRfi] Missing parameters: stixObject"
|
|
906
894
|
)
|
|
907
895
|
|
|
908
896
|
def delete(self, **kwargs):
|
|
909
897
|
id = kwargs.get("id", None)
|
|
910
898
|
if id is not None:
|
|
911
|
-
|
|
899
|
+
self.opencti.app_logger.info("Deleting Case RFI", {"id": id})
|
|
912
900
|
query = """
|
|
913
901
|
mutation CaseRFIDelete($id: ID!) {
|
|
914
902
|
stixDomainObjectEdit(id: $id) {
|
|
@@ -918,5 +906,5 @@ class CaseRfi:
|
|
|
918
906
|
"""
|
|
919
907
|
self.opencti.query(query, {"id": id})
|
|
920
908
|
else:
|
|
921
|
-
|
|
909
|
+
self.opencti.app_logger.error("[opencti_case_rfi] Missing parameters: id")
|
|
922
910
|
return None
|