pycti 5.12.14__py3-none-any.whl → 5.12.15__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of pycti might be problematic. Click here for more details.
- pycti/__init__.py +1 -1
- pycti/api/__init__.py +0 -3
- pycti/api/opencti_api_client.py +10 -56
- pycti/api/opencti_api_connector.py +1 -2
- pycti/api/opencti_api_playbook.py +3 -4
- pycti/api/opencti_api_work.py +15 -12
- pycti/connector/__init__.py +0 -3
- pycti/connector/opencti_connector_helper.py +63 -58
- pycti/connector/opencti_metric_handler.py +8 -5
- pycti/entities/__init__.py +0 -3
- pycti/entities/opencti_attack_pattern.py +17 -11
- pycti/entities/opencti_campaign.py +15 -9
- pycti/entities/opencti_case_incident.py +39 -43
- pycti/entities/opencti_case_rfi.py +34 -46
- pycti/entities/opencti_case_rft.py +35 -44
- pycti/entities/opencti_channel.py +15 -9
- pycti/entities/opencti_course_of_action.py +15 -9
- pycti/entities/opencti_data_component.py +17 -14
- pycti/entities/opencti_data_source.py +12 -16
- pycti/entities/opencti_event.py +15 -9
- pycti/entities/opencti_external_reference.py +20 -15
- pycti/entities/opencti_feedback.py +36 -46
- pycti/entities/opencti_grouping.py +22 -20
- pycti/entities/opencti_identity.py +15 -8
- pycti/entities/opencti_incident.py +13 -9
- pycti/entities/opencti_indicator.py +18 -15
- pycti/entities/opencti_infrastructure.py +15 -9
- pycti/entities/opencti_intrusion_set.py +12 -8
- pycti/entities/opencti_kill_chain_phase.py +16 -12
- pycti/entities/opencti_label.py +16 -12
- pycti/entities/opencti_language.py +13 -9
- pycti/entities/opencti_location.py +13 -9
- pycti/entities/opencti_malware.py +15 -9
- pycti/entities/opencti_malware_analysis.py +17 -9
- pycti/entities/opencti_marking_definition.py +15 -11
- pycti/entities/opencti_narrative.py +15 -9
- pycti/entities/opencti_note.py +35 -20
- pycti/entities/opencti_observed_data.py +34 -19
- pycti/entities/opencti_opinion.py +37 -20
- pycti/entities/opencti_report.py +36 -20
- pycti/entities/opencti_stix.py +8 -19
- pycti/entities/opencti_stix_core_object.py +15 -9
- pycti/entities/opencti_stix_core_relationship.py +69 -52
- pycti/entities/opencti_stix_cyber_observable.py +78 -62
- pycti/entities/opencti_stix_domain_object.py +75 -55
- pycti/entities/opencti_stix_nested_ref_relationship.py +21 -14
- pycti/entities/opencti_stix_object_or_stix_relationship.py +4 -7
- pycti/entities/opencti_stix_sighting_relationship.py +34 -26
- pycti/entities/opencti_task.py +37 -44
- pycti/entities/opencti_threat_actor.py +7 -4
- pycti/entities/opencti_threat_actor_group.py +10 -8
- pycti/entities/opencti_threat_actor_individual.py +10 -9
- pycti/entities/opencti_tool.py +15 -9
- pycti/entities/opencti_vocabulary.py +11 -13
- pycti/entities/opencti_vulnerability.py +15 -9
- pycti/utils/opencti_logger.py +64 -0
- pycti/utils/opencti_stix2.py +30 -24
- pycti/utils/opencti_stix2_update.py +2 -6
- {pycti-5.12.14.dist-info → pycti-5.12.15.dist-info}/METADATA +1 -1
- pycti-5.12.15.dist-info/RECORD +68 -0
- pycti-5.12.14.dist-info/RECORD +0 -67
- {pycti-5.12.14.dist-info → pycti-5.12.15.dist-info}/LICENSE +0 -0
- {pycti-5.12.14.dist-info → pycti-5.12.15.dist-info}/WHEEL +0 -0
- {pycti-5.12.14.dist-info → pycti-5.12.15.dist-info}/top_level.txt +0 -0
|
@@ -5,8 +5,6 @@ import uuid
|
|
|
5
5
|
from dateutil.parser import parse
|
|
6
6
|
from stix2.canonicalization.Canonicalize import canonicalize
|
|
7
7
|
|
|
8
|
-
from pycti.entities import LOGGER
|
|
9
|
-
|
|
10
8
|
|
|
11
9
|
class CaseRft:
|
|
12
10
|
def __init__(self, opencti):
|
|
@@ -494,7 +492,9 @@ class CaseRft:
|
|
|
494
492
|
with_files = kwargs.get("withFiles", False)
|
|
495
493
|
if get_all:
|
|
496
494
|
first = 500
|
|
497
|
-
|
|
495
|
+
self.opencti.app_logger.info(
|
|
496
|
+
"Listing Case Rfts with filters", {"filters": json.dumps(filters)}
|
|
497
|
+
)
|
|
498
498
|
query = (
|
|
499
499
|
"""
|
|
500
500
|
query CaseRfts($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: CaseRftsOrdering, $orderMode: OrderingMode) {
|
|
@@ -538,7 +538,7 @@ class CaseRft:
|
|
|
538
538
|
final_data = final_data + data
|
|
539
539
|
while result["data"]["caseRfts"]["pageInfo"]["hasNextPage"]:
|
|
540
540
|
after = result["date"]["caseRfts"]["pageInfo"]["endCursor"]
|
|
541
|
-
self.opencti.
|
|
541
|
+
self.opencti.app_logger.info("Listing Case Rfts", {"after": after})
|
|
542
542
|
result = self.opencti.query(
|
|
543
543
|
query,
|
|
544
544
|
{
|
|
@@ -572,7 +572,7 @@ class CaseRft:
|
|
|
572
572
|
custom_attributes = kwargs.get("customAttributes", None)
|
|
573
573
|
with_files = kwargs.get("withFiles", False)
|
|
574
574
|
if id is not None:
|
|
575
|
-
self.opencti.
|
|
575
|
+
self.opencti.app_logger.info("Reading Case Rft", {"id": id})
|
|
576
576
|
query = (
|
|
577
577
|
"""
|
|
578
578
|
query CaseRft($id: String!) {
|
|
@@ -643,13 +643,12 @@ class CaseRft:
|
|
|
643
643
|
"stixObjectOrStixRelationshipId", None
|
|
644
644
|
)
|
|
645
645
|
if id is not None and stix_object_or_stix_relationship_id is not None:
|
|
646
|
-
self.opencti.
|
|
647
|
-
"
|
|
648
|
-
|
|
649
|
-
|
|
650
|
-
|
|
651
|
-
|
|
652
|
-
+ "}",
|
|
646
|
+
self.opencti.app_logger.info(
|
|
647
|
+
"Checking StixObjectOrStixRelationship in CaseRft",
|
|
648
|
+
{
|
|
649
|
+
"stix_object_or_stix_relationship_id": stix_object_or_stix_relationship_id,
|
|
650
|
+
"id": id,
|
|
651
|
+
},
|
|
653
652
|
)
|
|
654
653
|
query = """
|
|
655
654
|
query CaseRftContainsStixObjectOrStixRelationship($id: String!, $stixObjectOrStixRelationshipId: String!) {
|
|
@@ -665,9 +664,8 @@ class CaseRft:
|
|
|
665
664
|
)
|
|
666
665
|
return result["data"]["caseRftContainsStixObjectOrStixRelationship"]
|
|
667
666
|
else:
|
|
668
|
-
self.opencti.
|
|
669
|
-
"
|
|
670
|
-
"[opencti_caseRft] Missing parameters: id or stixObjectOrStixRelationshipId",
|
|
667
|
+
self.opencti.app_logger.error(
|
|
668
|
+
"[opencti_caseRft] Missing parameters: id or stixObjectOrStixRelationshipId"
|
|
671
669
|
)
|
|
672
670
|
|
|
673
671
|
"""
|
|
@@ -697,7 +695,7 @@ class CaseRft:
|
|
|
697
695
|
takedown_types = kwargs.get("takedown_types", None)
|
|
698
696
|
|
|
699
697
|
if name is not None:
|
|
700
|
-
self.opencti.
|
|
698
|
+
self.opencti.app_logger.info("Creating Case Rft", {"name": name})
|
|
701
699
|
query = """
|
|
702
700
|
mutation CaseRftAdd($input: CaseRftAddInput!) {
|
|
703
701
|
caseRftAdd(input: $input) {
|
|
@@ -734,10 +732,7 @@ class CaseRft:
|
|
|
734
732
|
)
|
|
735
733
|
return self.opencti.process_multiple_fields(result["data"]["caseRftAdd"])
|
|
736
734
|
else:
|
|
737
|
-
self.opencti.
|
|
738
|
-
"error",
|
|
739
|
-
"[opencti_caseRft] Missing parameters: name",
|
|
740
|
-
)
|
|
735
|
+
self.opencti.app_logger.error("[opencti_caseRft] Missing parameters: name")
|
|
741
736
|
|
|
742
737
|
"""
|
|
743
738
|
Add a Stix-Entity object to Case Rft object (object_refs)
|
|
@@ -753,13 +748,12 @@ class CaseRft:
|
|
|
753
748
|
"stixObjectOrStixRelationshipId", None
|
|
754
749
|
)
|
|
755
750
|
if id is not None and stix_object_or_stix_relationship_id is not None:
|
|
756
|
-
self.opencti.
|
|
757
|
-
"
|
|
758
|
-
|
|
759
|
-
|
|
760
|
-
|
|
761
|
-
|
|
762
|
-
+ "}",
|
|
751
|
+
self.opencti.app_logger.info(
|
|
752
|
+
"Adding StixObjectOrStixRelationship in CaseRft",
|
|
753
|
+
{
|
|
754
|
+
"stix_object_or_stix_relationship_id": stix_object_or_stix_relationship_id,
|
|
755
|
+
"id": id,
|
|
756
|
+
},
|
|
763
757
|
)
|
|
764
758
|
query = """
|
|
765
759
|
mutation CaseRftEditRelationAdd($id: ID!, $input: StixRefRelationshipAddInput) {
|
|
@@ -782,9 +776,8 @@ class CaseRft:
|
|
|
782
776
|
)
|
|
783
777
|
return True
|
|
784
778
|
else:
|
|
785
|
-
self.opencti.
|
|
786
|
-
"
|
|
787
|
-
"[opencti_caseRft] Missing parameters: id and stixObjectOrStixRelationshipId",
|
|
779
|
+
self.opencti.app_logger.info(
|
|
780
|
+
"[opencti_caseRft] Missing parameters: id and stixObjectOrStixRelationshipId"
|
|
788
781
|
)
|
|
789
782
|
return False
|
|
790
783
|
|
|
@@ -802,13 +795,12 @@ class CaseRft:
|
|
|
802
795
|
"stixObjectOrStixRelationshipId", None
|
|
803
796
|
)
|
|
804
797
|
if id is not None and stix_object_or_stix_relationship_id is not None:
|
|
805
|
-
self.opencti.
|
|
806
|
-
"
|
|
807
|
-
|
|
808
|
-
|
|
809
|
-
|
|
810
|
-
|
|
811
|
-
+ "}",
|
|
798
|
+
self.opencti.app_logger.info(
|
|
799
|
+
"Removing StixObjectOrStixRelationship in CaseRft",
|
|
800
|
+
{
|
|
801
|
+
"stix_object_or_stix_relationship_id": stix_object_or_stix_relationship_id,
|
|
802
|
+
"id": id,
|
|
803
|
+
},
|
|
812
804
|
)
|
|
813
805
|
query = """
|
|
814
806
|
mutation CaseRftEditRelationDelete($id: ID!, $toId: StixRef!, $relationship_type: String!) {
|
|
@@ -829,9 +821,8 @@ class CaseRft:
|
|
|
829
821
|
)
|
|
830
822
|
return True
|
|
831
823
|
else:
|
|
832
|
-
self.opencti.
|
|
833
|
-
"
|
|
834
|
-
"[opencti_caseRft] Missing parameters: id and stixObjectOrStixRelationshipId",
|
|
824
|
+
self.opencti.app_logger.error(
|
|
825
|
+
"[opencti_caseRft] Missing parameters: id and stixObjectOrStixRelationshipId"
|
|
835
826
|
)
|
|
836
827
|
return False
|
|
837
828
|
|
|
@@ -897,14 +888,14 @@ class CaseRft:
|
|
|
897
888
|
update=update,
|
|
898
889
|
)
|
|
899
890
|
else:
|
|
900
|
-
self.opencti.
|
|
901
|
-
"
|
|
891
|
+
self.opencti.app_logger.error(
|
|
892
|
+
"[opencti_caseRft] Missing parameters: stixObject"
|
|
902
893
|
)
|
|
903
894
|
|
|
904
895
|
def delete(self, **kwargs):
|
|
905
896
|
id = kwargs.get("id", None)
|
|
906
897
|
if id is not None:
|
|
907
|
-
self.opencti.
|
|
898
|
+
self.opencti.app_logger.info("Deleting Case RFT", {"id": id})
|
|
908
899
|
query = """
|
|
909
900
|
mutation CaseRFTDelete($id: ID!) {
|
|
910
901
|
stixDomainObjectEdit(id: $id) {
|
|
@@ -914,5 +905,5 @@ class CaseRft:
|
|
|
914
905
|
"""
|
|
915
906
|
self.opencti.query(query, {"id": id})
|
|
916
907
|
else:
|
|
917
|
-
self.opencti.
|
|
908
|
+
self.opencti.app_logger.error("[opencti_case_rft] Missing parameters: id")
|
|
918
909
|
return None
|
|
@@ -5,8 +5,6 @@ import uuid
|
|
|
5
5
|
|
|
6
6
|
from stix2.canonicalization.Canonicalize import canonicalize
|
|
7
7
|
|
|
8
|
-
from pycti.entities import LOGGER
|
|
9
|
-
|
|
10
8
|
|
|
11
9
|
class Channel:
|
|
12
10
|
def __init__(self, opencti):
|
|
@@ -252,7 +250,9 @@ class Channel:
|
|
|
252
250
|
if get_all:
|
|
253
251
|
first = 100
|
|
254
252
|
|
|
255
|
-
|
|
253
|
+
self.opencti.app_logger.info(
|
|
254
|
+
"Listing Channels with filters", {"filters": json.dumps(filters)}
|
|
255
|
+
)
|
|
256
256
|
query = (
|
|
257
257
|
"""
|
|
258
258
|
query Channels($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: ChannelsOrdering, $orderMode: OrderingMode) {
|
|
@@ -296,7 +296,7 @@ class Channel:
|
|
|
296
296
|
final_data = final_data + data
|
|
297
297
|
while result["data"]["channels"]["pageInfo"]["hasNextPage"]:
|
|
298
298
|
after = result["data"]["channels"]["pageInfo"]["endCursor"]
|
|
299
|
-
|
|
299
|
+
self.opencti.app_logger.info("Listing Channels", {"after": after})
|
|
300
300
|
result = self.opencti.query(
|
|
301
301
|
query,
|
|
302
302
|
{
|
|
@@ -330,7 +330,7 @@ class Channel:
|
|
|
330
330
|
custom_attributes = kwargs.get("customAttributes", None)
|
|
331
331
|
with_files = kwargs.get("withFiles", False)
|
|
332
332
|
if id is not None:
|
|
333
|
-
|
|
333
|
+
self.opencti.app_logger.info("Reading Channel", {"id": id})
|
|
334
334
|
query = (
|
|
335
335
|
"""
|
|
336
336
|
query Channel($id: String!) {
|
|
@@ -355,7 +355,9 @@ class Channel:
|
|
|
355
355
|
else:
|
|
356
356
|
return None
|
|
357
357
|
else:
|
|
358
|
-
|
|
358
|
+
self.opencti.app_logger.error(
|
|
359
|
+
"[opencti_channel] Missing parameters: id or filters"
|
|
360
|
+
)
|
|
359
361
|
return None
|
|
360
362
|
|
|
361
363
|
"""
|
|
@@ -385,7 +387,7 @@ class Channel:
|
|
|
385
387
|
update = kwargs.get("update", False)
|
|
386
388
|
|
|
387
389
|
if name is not None:
|
|
388
|
-
|
|
390
|
+
self.opencti.app_logger.info("Creating Channel", {"name": name})
|
|
389
391
|
query = """
|
|
390
392
|
mutation ChannelAdd($input: ChannelAddInput!) {
|
|
391
393
|
channelAdd(input: $input) {
|
|
@@ -422,7 +424,9 @@ class Channel:
|
|
|
422
424
|
)
|
|
423
425
|
return self.opencti.process_multiple_fields(result["data"]["channelAdd"])
|
|
424
426
|
else:
|
|
425
|
-
|
|
427
|
+
self.opencti.app_logger.error(
|
|
428
|
+
"[opencti_channel] Missing parameters: name and description"
|
|
429
|
+
)
|
|
426
430
|
|
|
427
431
|
"""
|
|
428
432
|
Import an Channel object from a STIX2 object
|
|
@@ -486,4 +490,6 @@ class Channel:
|
|
|
486
490
|
update=update,
|
|
487
491
|
)
|
|
488
492
|
else:
|
|
489
|
-
|
|
493
|
+
self.opencti.app_logger.error(
|
|
494
|
+
"[opencti_channel] Missing parameters: stixObject"
|
|
495
|
+
)
|
|
@@ -5,8 +5,6 @@ import uuid
|
|
|
5
5
|
|
|
6
6
|
from stix2.canonicalization.Canonicalize import canonicalize
|
|
7
7
|
|
|
8
|
-
from pycti.entities import LOGGER
|
|
9
|
-
|
|
10
8
|
|
|
11
9
|
class CourseOfAction:
|
|
12
10
|
def __init__(self, opencti):
|
|
@@ -255,7 +253,9 @@ class CourseOfAction:
|
|
|
255
253
|
if get_all:
|
|
256
254
|
first = 100
|
|
257
255
|
|
|
258
|
-
|
|
256
|
+
self.opencti.app_logger.info(
|
|
257
|
+
"Listing Courses-Of-Action with filters", {"filters": json.dumps(filters)}
|
|
258
|
+
)
|
|
259
259
|
query = (
|
|
260
260
|
"""
|
|
261
261
|
query CoursesOfAction($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: CoursesOfActionOrdering, $orderMode: OrderingMode) {
|
|
@@ -299,7 +299,9 @@ class CourseOfAction:
|
|
|
299
299
|
final_data = final_data + data
|
|
300
300
|
while result["data"]["coursesOfAction"]["pageInfo"]["hasNextPage"]:
|
|
301
301
|
after = result["data"]["coursesOfAction"]["pageInfo"]["endCursor"]
|
|
302
|
-
|
|
302
|
+
self.opencti.app_logger.info(
|
|
303
|
+
"Listing Courses-Of-Action", {"after": after}
|
|
304
|
+
)
|
|
303
305
|
result = self.opencti.query(
|
|
304
306
|
query,
|
|
305
307
|
{
|
|
@@ -333,7 +335,7 @@ class CourseOfAction:
|
|
|
333
335
|
custom_attributes = kwargs.get("customAttributes", None)
|
|
334
336
|
with_files = kwargs.get("withFiles", False)
|
|
335
337
|
if id is not None:
|
|
336
|
-
|
|
338
|
+
self.opencti.app_logger.info("Reading Course-Of-Action", {"id": id})
|
|
337
339
|
query = (
|
|
338
340
|
"""
|
|
339
341
|
query CourseOfAction($id: String!) {
|
|
@@ -360,7 +362,9 @@ class CourseOfAction:
|
|
|
360
362
|
else:
|
|
361
363
|
return None
|
|
362
364
|
else:
|
|
363
|
-
|
|
365
|
+
self.opencti.app_logger.error(
|
|
366
|
+
"[opencti_course_of_action] Missing parameters: id or filters"
|
|
367
|
+
)
|
|
364
368
|
return None
|
|
365
369
|
|
|
366
370
|
"""
|
|
@@ -390,7 +394,7 @@ class CourseOfAction:
|
|
|
390
394
|
update = kwargs.get("update", False)
|
|
391
395
|
|
|
392
396
|
if name is not None:
|
|
393
|
-
|
|
397
|
+
self.opencti.app_logger.info("Creating Course Of Action", {"name": name})
|
|
394
398
|
query = """
|
|
395
399
|
mutation CourseOfActionAdd($input: CourseOfActionAddInput!) {
|
|
396
400
|
courseOfActionAdd(input: $input) {
|
|
@@ -429,7 +433,7 @@ class CourseOfAction:
|
|
|
429
433
|
result["data"]["courseOfActionAdd"]
|
|
430
434
|
)
|
|
431
435
|
else:
|
|
432
|
-
|
|
436
|
+
self.opencti.app_logger.error(
|
|
433
437
|
"[opencti_course_of_action] Missing parameters: name and description"
|
|
434
438
|
)
|
|
435
439
|
|
|
@@ -518,4 +522,6 @@ class CourseOfAction:
|
|
|
518
522
|
update=update,
|
|
519
523
|
)
|
|
520
524
|
else:
|
|
521
|
-
|
|
525
|
+
self.opencti.app_logger.error(
|
|
526
|
+
"[opencti_course_of_action] Missing parameters: stixObject"
|
|
527
|
+
)
|
|
@@ -5,8 +5,6 @@ import uuid
|
|
|
5
5
|
|
|
6
6
|
from stix2.canonicalization.Canonicalize import canonicalize
|
|
7
7
|
|
|
8
|
-
from pycti.entities import LOGGER
|
|
9
|
-
|
|
10
8
|
|
|
11
9
|
class DataComponent:
|
|
12
10
|
def __init__(self, opencti):
|
|
@@ -286,7 +284,9 @@ class DataComponent:
|
|
|
286
284
|
if get_all:
|
|
287
285
|
first = 100
|
|
288
286
|
|
|
289
|
-
|
|
287
|
+
self.opencti.app_logger.info(
|
|
288
|
+
"Listing Data-Components with filters", {"filters": json.dumps(filters)}
|
|
289
|
+
)
|
|
290
290
|
query = (
|
|
291
291
|
"""
|
|
292
292
|
query DataComponents($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: DataComponentsOrdering, $orderMode: OrderingMode) {
|
|
@@ -330,7 +330,9 @@ class DataComponent:
|
|
|
330
330
|
final_data = final_data + data
|
|
331
331
|
while result["data"]["dataComponents"]["pageInfo"]["hasNextPage"]:
|
|
332
332
|
after = result["data"]["dataComponents"]["pageInfo"]["endCursor"]
|
|
333
|
-
|
|
333
|
+
self.opencti.app_logger.info(
|
|
334
|
+
"Listing Data-Components", {"after": after}
|
|
335
|
+
)
|
|
334
336
|
result = self.opencti.query(
|
|
335
337
|
query,
|
|
336
338
|
{
|
|
@@ -364,7 +366,7 @@ class DataComponent:
|
|
|
364
366
|
custom_attributes = kwargs.get("customAttributes", None)
|
|
365
367
|
with_files = kwargs.get("withFiles", False)
|
|
366
368
|
if id is not None:
|
|
367
|
-
self.opencti.
|
|
369
|
+
self.opencti.app_logger.info("Reading Data-Component", {"id": id})
|
|
368
370
|
query = (
|
|
369
371
|
"""
|
|
370
372
|
query DataComponent($id: String!) {
|
|
@@ -389,8 +391,8 @@ class DataComponent:
|
|
|
389
391
|
else:
|
|
390
392
|
return None
|
|
391
393
|
else:
|
|
392
|
-
self.opencti.
|
|
393
|
-
"
|
|
394
|
+
self.opencti.app_logger.error(
|
|
395
|
+
"[opencti_data_component] Missing parameters: id or filters"
|
|
394
396
|
)
|
|
395
397
|
return None
|
|
396
398
|
|
|
@@ -421,8 +423,10 @@ class DataComponent:
|
|
|
421
423
|
update = kwargs.get("update", False)
|
|
422
424
|
|
|
423
425
|
if name is not None:
|
|
424
|
-
self.opencti.
|
|
425
|
-
self.opencti.
|
|
426
|
+
self.opencti.app_logger.info("Creating Data Component", {"name": name})
|
|
427
|
+
self.opencti.app_logger.info(
|
|
428
|
+
"Creating Data Component", {"data": str(kwargs)}
|
|
429
|
+
)
|
|
426
430
|
query = """
|
|
427
431
|
mutation DataComponentAdd($input: DataComponentAddInput!) {
|
|
428
432
|
dataComponentAdd(input: $input) {
|
|
@@ -461,9 +465,8 @@ class DataComponent:
|
|
|
461
465
|
result["data"]["dataComponentAdd"]
|
|
462
466
|
)
|
|
463
467
|
else:
|
|
464
|
-
self.opencti.
|
|
465
|
-
"
|
|
466
|
-
"[opencti_data_component] Missing parameters: name and description",
|
|
468
|
+
self.opencti.app_logger.error(
|
|
469
|
+
"[opencti_data_component] Missing parameters: name and description"
|
|
467
470
|
)
|
|
468
471
|
|
|
469
472
|
"""
|
|
@@ -541,8 +544,8 @@ class DataComponent:
|
|
|
541
544
|
update=update,
|
|
542
545
|
)
|
|
543
546
|
else:
|
|
544
|
-
self.opencti.
|
|
545
|
-
"
|
|
547
|
+
self.opencti.app_logger.error(
|
|
548
|
+
"[opencti_data_source] Missing parameters: stixObject"
|
|
546
549
|
)
|
|
547
550
|
|
|
548
551
|
def process_multiple_fields(self, data):
|
|
@@ -5,8 +5,6 @@ import uuid
|
|
|
5
5
|
|
|
6
6
|
from stix2.canonicalization.Canonicalize import canonicalize
|
|
7
7
|
|
|
8
|
-
from pycti.entities import LOGGER
|
|
9
|
-
|
|
10
8
|
|
|
11
9
|
class DataSource:
|
|
12
10
|
def __init__(self, opencti):
|
|
@@ -254,9 +252,8 @@ class DataSource:
|
|
|
254
252
|
if get_all:
|
|
255
253
|
first = 100
|
|
256
254
|
|
|
257
|
-
self.opencti.
|
|
258
|
-
"
|
|
259
|
-
"Listing Data-Sources with filters " + json.dumps(filters) + ".",
|
|
255
|
+
self.opencti.app_logger.info(
|
|
256
|
+
"Listing Data-Sources with filters", {"filters": json.dumps(filters)}
|
|
260
257
|
)
|
|
261
258
|
query = (
|
|
262
259
|
"""
|
|
@@ -301,7 +298,7 @@ class DataSource:
|
|
|
301
298
|
final_data = final_data + data
|
|
302
299
|
while result["data"]["dataSources"]["pageInfo"]["hasNextPage"]:
|
|
303
300
|
after = result["data"]["dataSources"]["pageInfo"]["endCursor"]
|
|
304
|
-
|
|
301
|
+
self.opencti.app_logger.info("Listing Data-Sources", {"after": after})
|
|
305
302
|
result = self.opencti.query(
|
|
306
303
|
query,
|
|
307
304
|
{
|
|
@@ -335,7 +332,7 @@ class DataSource:
|
|
|
335
332
|
custom_attributes = kwargs.get("customAttributes", None)
|
|
336
333
|
with_files = kwargs.get("withFiles", False)
|
|
337
334
|
if id is not None:
|
|
338
|
-
self.opencti.
|
|
335
|
+
self.opencti.app_logger.info("Reading Data-Source", {"id": id})
|
|
339
336
|
query = (
|
|
340
337
|
"""
|
|
341
338
|
query DataSource($id: String!) {
|
|
@@ -360,8 +357,8 @@ class DataSource:
|
|
|
360
357
|
else:
|
|
361
358
|
return None
|
|
362
359
|
else:
|
|
363
|
-
self.opencti.
|
|
364
|
-
"
|
|
360
|
+
self.opencti.app_logger.error(
|
|
361
|
+
"[opencti_data_source] Missing parameters: id or filters"
|
|
365
362
|
)
|
|
366
363
|
return None
|
|
367
364
|
|
|
@@ -393,8 +390,8 @@ class DataSource:
|
|
|
393
390
|
update = kwargs.get("update", False)
|
|
394
391
|
|
|
395
392
|
if name is not None:
|
|
396
|
-
self.opencti.
|
|
397
|
-
self.opencti.
|
|
393
|
+
self.opencti.app_logger.info("Creating Data Source", {"name": name})
|
|
394
|
+
self.opencti.app_logger.info("Creating Data Source", {"data": str(kwargs)})
|
|
398
395
|
query = """
|
|
399
396
|
mutation DataSourceAdd($input: DataSourceAddInput!) {
|
|
400
397
|
dataSourceAdd(input: $input) {
|
|
@@ -432,9 +429,8 @@ class DataSource:
|
|
|
432
429
|
)
|
|
433
430
|
return self.opencti.process_multiple_fields(result["data"]["dataSourceAdd"])
|
|
434
431
|
else:
|
|
435
|
-
self.opencti.
|
|
436
|
-
"
|
|
437
|
-
"[opencti_data_source] Missing parameters: name and description",
|
|
432
|
+
self.opencti.app_logger.error(
|
|
433
|
+
"[opencti_data_source] Missing parameters: name and description"
|
|
438
434
|
)
|
|
439
435
|
|
|
440
436
|
"""
|
|
@@ -517,6 +513,6 @@ class DataSource:
|
|
|
517
513
|
update=update,
|
|
518
514
|
)
|
|
519
515
|
else:
|
|
520
|
-
self.opencti.
|
|
521
|
-
"
|
|
516
|
+
self.opencti.app_logger.error(
|
|
517
|
+
"[opencti_data_source] Missing parameters: stixObject"
|
|
522
518
|
)
|
pycti/entities/opencti_event.py
CHANGED
|
@@ -5,8 +5,6 @@ import uuid
|
|
|
5
5
|
|
|
6
6
|
from stix2.canonicalization.Canonicalize import canonicalize
|
|
7
7
|
|
|
8
|
-
from pycti.entities import LOGGER
|
|
9
|
-
|
|
10
8
|
|
|
11
9
|
class Event:
|
|
12
10
|
def __init__(self, opencti):
|
|
@@ -256,7 +254,9 @@ class Event:
|
|
|
256
254
|
if get_all:
|
|
257
255
|
first = 100
|
|
258
256
|
|
|
259
|
-
|
|
257
|
+
self.opencti.app_logger.info(
|
|
258
|
+
"Listing Events with filters", {"filters": json.dumps(filters)}
|
|
259
|
+
)
|
|
260
260
|
query = (
|
|
261
261
|
"""
|
|
262
262
|
query Events($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: EventsOrdering, $orderMode: OrderingMode) {
|
|
@@ -300,7 +300,7 @@ class Event:
|
|
|
300
300
|
final_data = final_data + data
|
|
301
301
|
while result["data"]["events"]["pageInfo"]["hasNextPage"]:
|
|
302
302
|
after = result["data"]["events"]["pageInfo"]["endCursor"]
|
|
303
|
-
|
|
303
|
+
self.opencti.app_logger.info("Listing Events", {"after": after})
|
|
304
304
|
result = self.opencti.query(
|
|
305
305
|
query,
|
|
306
306
|
{
|
|
@@ -334,7 +334,7 @@ class Event:
|
|
|
334
334
|
custom_attributes = kwargs.get("customAttributes", None)
|
|
335
335
|
with_files = kwargs.get("withFiles", False)
|
|
336
336
|
if id is not None:
|
|
337
|
-
|
|
337
|
+
self.opencti.app_logger.info("Reading Event", {"id": id})
|
|
338
338
|
query = (
|
|
339
339
|
"""
|
|
340
340
|
query Event($id: String!) {
|
|
@@ -359,7 +359,9 @@ class Event:
|
|
|
359
359
|
else:
|
|
360
360
|
return None
|
|
361
361
|
else:
|
|
362
|
-
|
|
362
|
+
self.opencti.app_logger.error(
|
|
363
|
+
"[opencti_event] Missing parameters: id or filters"
|
|
364
|
+
)
|
|
363
365
|
return None
|
|
364
366
|
|
|
365
367
|
"""
|
|
@@ -390,7 +392,7 @@ class Event:
|
|
|
390
392
|
update = kwargs.get("update", False)
|
|
391
393
|
|
|
392
394
|
if name is not None:
|
|
393
|
-
|
|
395
|
+
self.opencti.app_logger.info("Creating Event", {"name": name})
|
|
394
396
|
query = """
|
|
395
397
|
mutation EventAdd($input: EventAddInput!) {
|
|
396
398
|
eventAdd(input: $input) {
|
|
@@ -428,7 +430,9 @@ class Event:
|
|
|
428
430
|
)
|
|
429
431
|
return self.opencti.process_multiple_fields(result["data"]["eventAdd"])
|
|
430
432
|
else:
|
|
431
|
-
|
|
433
|
+
self.opencti.app_logger.error(
|
|
434
|
+
"[opencti_event] Missing parameters: name and description"
|
|
435
|
+
)
|
|
432
436
|
|
|
433
437
|
"""
|
|
434
438
|
Import an Event object from a STIX2 object
|
|
@@ -495,4 +499,6 @@ class Event:
|
|
|
495
499
|
update=update,
|
|
496
500
|
)
|
|
497
501
|
else:
|
|
498
|
-
|
|
502
|
+
self.opencti.app_logger.error(
|
|
503
|
+
"[opencti_event] Missing parameters: stixObject"
|
|
504
|
+
)
|