pycti 5.12.14__py3-none-any.whl → 5.12.15__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of pycti might be problematic. Click here for more details.
- pycti/__init__.py +1 -1
- pycti/api/__init__.py +0 -3
- pycti/api/opencti_api_client.py +10 -56
- pycti/api/opencti_api_connector.py +1 -2
- pycti/api/opencti_api_playbook.py +3 -4
- pycti/api/opencti_api_work.py +15 -12
- pycti/connector/__init__.py +0 -3
- pycti/connector/opencti_connector_helper.py +63 -58
- pycti/connector/opencti_metric_handler.py +8 -5
- pycti/entities/__init__.py +0 -3
- pycti/entities/opencti_attack_pattern.py +17 -11
- pycti/entities/opencti_campaign.py +15 -9
- pycti/entities/opencti_case_incident.py +39 -43
- pycti/entities/opencti_case_rfi.py +34 -46
- pycti/entities/opencti_case_rft.py +35 -44
- pycti/entities/opencti_channel.py +15 -9
- pycti/entities/opencti_course_of_action.py +15 -9
- pycti/entities/opencti_data_component.py +17 -14
- pycti/entities/opencti_data_source.py +12 -16
- pycti/entities/opencti_event.py +15 -9
- pycti/entities/opencti_external_reference.py +20 -15
- pycti/entities/opencti_feedback.py +36 -46
- pycti/entities/opencti_grouping.py +22 -20
- pycti/entities/opencti_identity.py +15 -8
- pycti/entities/opencti_incident.py +13 -9
- pycti/entities/opencti_indicator.py +18 -15
- pycti/entities/opencti_infrastructure.py +15 -9
- pycti/entities/opencti_intrusion_set.py +12 -8
- pycti/entities/opencti_kill_chain_phase.py +16 -12
- pycti/entities/opencti_label.py +16 -12
- pycti/entities/opencti_language.py +13 -9
- pycti/entities/opencti_location.py +13 -9
- pycti/entities/opencti_malware.py +15 -9
- pycti/entities/opencti_malware_analysis.py +17 -9
- pycti/entities/opencti_marking_definition.py +15 -11
- pycti/entities/opencti_narrative.py +15 -9
- pycti/entities/opencti_note.py +35 -20
- pycti/entities/opencti_observed_data.py +34 -19
- pycti/entities/opencti_opinion.py +37 -20
- pycti/entities/opencti_report.py +36 -20
- pycti/entities/opencti_stix.py +8 -19
- pycti/entities/opencti_stix_core_object.py +15 -9
- pycti/entities/opencti_stix_core_relationship.py +69 -52
- pycti/entities/opencti_stix_cyber_observable.py +78 -62
- pycti/entities/opencti_stix_domain_object.py +75 -55
- pycti/entities/opencti_stix_nested_ref_relationship.py +21 -14
- pycti/entities/opencti_stix_object_or_stix_relationship.py +4 -7
- pycti/entities/opencti_stix_sighting_relationship.py +34 -26
- pycti/entities/opencti_task.py +37 -44
- pycti/entities/opencti_threat_actor.py +7 -4
- pycti/entities/opencti_threat_actor_group.py +10 -8
- pycti/entities/opencti_threat_actor_individual.py +10 -9
- pycti/entities/opencti_tool.py +15 -9
- pycti/entities/opencti_vocabulary.py +11 -13
- pycti/entities/opencti_vulnerability.py +15 -9
- pycti/utils/opencti_logger.py +64 -0
- pycti/utils/opencti_stix2.py +30 -24
- pycti/utils/opencti_stix2_update.py +2 -6
- {pycti-5.12.14.dist-info → pycti-5.12.15.dist-info}/METADATA +1 -1
- pycti-5.12.15.dist-info/RECORD +68 -0
- pycti-5.12.14.dist-info/RECORD +0 -67
- {pycti-5.12.14.dist-info → pycti-5.12.15.dist-info}/LICENSE +0 -0
- {pycti-5.12.14.dist-info → pycti-5.12.15.dist-info}/WHEEL +0 -0
- {pycti-5.12.14.dist-info → pycti-5.12.15.dist-info}/top_level.txt +0 -0
|
@@ -7,8 +7,6 @@ import uuid
|
|
|
7
7
|
import magic
|
|
8
8
|
from stix2.canonicalization.Canonicalize import canonicalize
|
|
9
9
|
|
|
10
|
-
from pycti.entities import LOGGER
|
|
11
|
-
|
|
12
10
|
|
|
13
11
|
class ExternalReference:
|
|
14
12
|
def __init__(self, opencti, file):
|
|
@@ -92,7 +90,9 @@ class ExternalReference:
|
|
|
92
90
|
if get_all:
|
|
93
91
|
first = 100
|
|
94
92
|
|
|
95
|
-
|
|
93
|
+
self.opencti.app_logger.info(
|
|
94
|
+
"Listing External-Reference with filters", {"filters": json.dumps(filters)}
|
|
95
|
+
)
|
|
96
96
|
query = (
|
|
97
97
|
"""
|
|
98
98
|
query ExternalReferences($filters: FilterGroup, $first: Int, $after: ID, $orderBy: ExternalReferencesOrdering, $orderMode: OrderingMode) {
|
|
@@ -135,7 +135,9 @@ class ExternalReference:
|
|
|
135
135
|
final_data = final_data + data
|
|
136
136
|
while result["data"]["externalReferences"]["pageInfo"]["hasNextPage"]:
|
|
137
137
|
after = result["data"]["externalReferences"]["pageInfo"]["endCursor"]
|
|
138
|
-
|
|
138
|
+
self.opencti.app_logger.info(
|
|
139
|
+
"Listing External-References", {"after": after}
|
|
140
|
+
)
|
|
139
141
|
result = self.opencti.query(
|
|
140
142
|
query,
|
|
141
143
|
{
|
|
@@ -168,7 +170,7 @@ class ExternalReference:
|
|
|
168
170
|
id = kwargs.get("id", None)
|
|
169
171
|
filters = kwargs.get("filters", None)
|
|
170
172
|
if id is not None:
|
|
171
|
-
|
|
173
|
+
self.opencti.app_logger.info("Reading External-Reference", {"id": id})
|
|
172
174
|
query = (
|
|
173
175
|
"""
|
|
174
176
|
query ExternalReference($id: String!) {
|
|
@@ -191,7 +193,7 @@ class ExternalReference:
|
|
|
191
193
|
else:
|
|
192
194
|
return None
|
|
193
195
|
else:
|
|
194
|
-
|
|
196
|
+
self.opencti.app_logger.error(
|
|
195
197
|
"[opencti_external_reference] Missing parameters: id or filters"
|
|
196
198
|
)
|
|
197
199
|
return None
|
|
@@ -215,7 +217,9 @@ class ExternalReference:
|
|
|
215
217
|
update = kwargs.get("update", False)
|
|
216
218
|
|
|
217
219
|
if source_name is not None or url is not None:
|
|
218
|
-
|
|
220
|
+
self.opencti.app_logger.info(
|
|
221
|
+
"Creating External Reference", {"source_name": source_name}
|
|
222
|
+
)
|
|
219
223
|
query = (
|
|
220
224
|
"""
|
|
221
225
|
mutation ExternalReferenceAdd($input: ExternalReferenceAddInput!) {
|
|
@@ -247,7 +251,7 @@ class ExternalReference:
|
|
|
247
251
|
result["data"]["externalReferenceAdd"]
|
|
248
252
|
)
|
|
249
253
|
else:
|
|
250
|
-
|
|
254
|
+
self.opencti.app_logger.error(
|
|
251
255
|
"[opencti_external_reference] Missing parameters: source_name and url"
|
|
252
256
|
)
|
|
253
257
|
|
|
@@ -284,8 +288,9 @@ class ExternalReference:
|
|
|
284
288
|
mime_type = "application/json"
|
|
285
289
|
else:
|
|
286
290
|
mime_type = magic.from_file(file_name, mime=True)
|
|
287
|
-
|
|
288
|
-
"Uploading a file
|
|
291
|
+
self.opencti.app_logger.info(
|
|
292
|
+
"Uploading a file in Stix-Domain-Object",
|
|
293
|
+
{"file": final_file_name, "id": id},
|
|
289
294
|
)
|
|
290
295
|
return self.opencti.query(
|
|
291
296
|
query,
|
|
@@ -298,7 +303,7 @@ class ExternalReference:
|
|
|
298
303
|
},
|
|
299
304
|
)
|
|
300
305
|
else:
|
|
301
|
-
|
|
306
|
+
self.opencti.app_logger.error(
|
|
302
307
|
"[opencti_stix_domain_object] Missing parameters: id or file_name"
|
|
303
308
|
)
|
|
304
309
|
return None
|
|
@@ -315,7 +320,7 @@ class ExternalReference:
|
|
|
315
320
|
id = kwargs.get("id", None)
|
|
316
321
|
input = kwargs.get("input", None)
|
|
317
322
|
if id is not None and input is not None:
|
|
318
|
-
|
|
323
|
+
self.opencti.app_logger.info("Updating External-Reference", {"id": id})
|
|
319
324
|
query = """
|
|
320
325
|
mutation ExternalReferenceEdit($id: ID!, $input: [EditInput]!) {
|
|
321
326
|
externalReferenceEdit(id: $id) {
|
|
@@ -330,13 +335,13 @@ class ExternalReference:
|
|
|
330
335
|
result["data"]["externalReferenceEdit"]["fieldPatch"]
|
|
331
336
|
)
|
|
332
337
|
else:
|
|
333
|
-
|
|
338
|
+
self.opencti.app_logger.error(
|
|
334
339
|
"[opencti_external_reference] Missing parameters: id and key and value"
|
|
335
340
|
)
|
|
336
341
|
return None
|
|
337
342
|
|
|
338
343
|
def delete(self, id):
|
|
339
|
-
|
|
344
|
+
self.opencti.app_logger.info("Deleting External-Reference", {"id": id})
|
|
340
345
|
query = """
|
|
341
346
|
mutation ExternalReferenceEdit($id: ID!) {
|
|
342
347
|
externalReferenceEdit(id: $id) {
|
|
@@ -348,7 +353,7 @@ class ExternalReference:
|
|
|
348
353
|
|
|
349
354
|
def list_files(self, **kwargs):
|
|
350
355
|
id = kwargs.get("id", None)
|
|
351
|
-
|
|
356
|
+
self.opencti.app_logger.info("Listing files of External-Reference", {"id": id})
|
|
352
357
|
query = """
|
|
353
358
|
query externalReference($id: String!) {
|
|
354
359
|
externalReference(id: $id) {
|
|
@@ -4,8 +4,6 @@ import uuid
|
|
|
4
4
|
from dateutil.parser import parse
|
|
5
5
|
from stix2.canonicalization.Canonicalize import canonicalize
|
|
6
6
|
|
|
7
|
-
from pycti.entities import LOGGER
|
|
8
|
-
|
|
9
7
|
|
|
10
8
|
class Feedback:
|
|
11
9
|
def __init__(self, opencti):
|
|
@@ -469,9 +467,8 @@ class Feedback:
|
|
|
469
467
|
if get_all:
|
|
470
468
|
first = 500
|
|
471
469
|
|
|
472
|
-
self.opencti.
|
|
473
|
-
"
|
|
474
|
-
"Listing Feedbacks with filters " + json.dumps(filters) + ".",
|
|
470
|
+
self.opencti.app_logger.info(
|
|
471
|
+
"Listing Feedbacks with filters", {"filters": json.dumps(filters)}
|
|
475
472
|
)
|
|
476
473
|
query = (
|
|
477
474
|
"""
|
|
@@ -516,7 +513,7 @@ class Feedback:
|
|
|
516
513
|
final_data = final_data + data
|
|
517
514
|
while result["data"]["feedbacks"]["pageInfo"]["hasNextPage"]:
|
|
518
515
|
after = result["date"]["feedbacks"]["pageInfo"]["endCursor"]
|
|
519
|
-
self.opencti.
|
|
516
|
+
self.opencti.app_logger.info("Listing Feedbacks", {"after": after})
|
|
520
517
|
result = self.opencti.query(
|
|
521
518
|
query,
|
|
522
519
|
{
|
|
@@ -550,7 +547,7 @@ class Feedback:
|
|
|
550
547
|
custom_attributes = kwargs.get("customAttributes", None)
|
|
551
548
|
with_files = kwargs.get("withFiles", False)
|
|
552
549
|
if id is not None:
|
|
553
|
-
self.opencti.
|
|
550
|
+
self.opencti.app_logger.info("Reading Feedback", {"id": id})
|
|
554
551
|
query = (
|
|
555
552
|
"""
|
|
556
553
|
query Feedback($id: String!) {
|
|
@@ -623,13 +620,12 @@ class Feedback:
|
|
|
623
620
|
"stixObjectOrStixRelationshipId", None
|
|
624
621
|
)
|
|
625
622
|
if id is not None and stix_object_or_stix_relationship_id is not None:
|
|
626
|
-
self.opencti.
|
|
627
|
-
"
|
|
628
|
-
|
|
629
|
-
|
|
630
|
-
|
|
631
|
-
|
|
632
|
-
+ "}",
|
|
623
|
+
self.opencti.app_logger.info(
|
|
624
|
+
"Checking StixObjectOrStixRelationship in Feedback",
|
|
625
|
+
{
|
|
626
|
+
"stix_object_or_stix_relationship_id": stix_object_or_stix_relationship_id,
|
|
627
|
+
"id": id,
|
|
628
|
+
},
|
|
633
629
|
)
|
|
634
630
|
query = """
|
|
635
631
|
query FeedbackContainsStixObjectOrStixRelationship($id: String!, $stixObjectOrStixRelationshipId: String!) {
|
|
@@ -645,9 +641,8 @@ class Feedback:
|
|
|
645
641
|
)
|
|
646
642
|
return result["data"]["feedbackContainsStixObjectOrStixRelationship"]
|
|
647
643
|
else:
|
|
648
|
-
self.opencti.
|
|
649
|
-
"
|
|
650
|
-
"[opencti_feedback] Missing parameters: id or stixObjectOrStixRelationshipId",
|
|
644
|
+
self.opencti.app_logger.error(
|
|
645
|
+
"[opencti_feedback] Missing parameters: id or stixObjectOrStixRelationshipId"
|
|
651
646
|
)
|
|
652
647
|
|
|
653
648
|
"""
|
|
@@ -677,7 +672,7 @@ class Feedback:
|
|
|
677
672
|
update = kwargs.get("update", False)
|
|
678
673
|
|
|
679
674
|
if name is not None:
|
|
680
|
-
self.opencti.
|
|
675
|
+
self.opencti.app_logger.info("Creating Feedback", {"name": name})
|
|
681
676
|
query = """
|
|
682
677
|
mutation FeedbackAdd($input: FeedbackAddInput!) {
|
|
683
678
|
feedbackAdd(input: $input) {
|
|
@@ -714,13 +709,10 @@ class Feedback:
|
|
|
714
709
|
)
|
|
715
710
|
return self.opencti.process_multiple_fields(result["data"]["feedbackAdd"])
|
|
716
711
|
else:
|
|
717
|
-
self.opencti.
|
|
718
|
-
"error",
|
|
719
|
-
"[opencti_feedback] Missing parameters: name",
|
|
720
|
-
)
|
|
712
|
+
self.opencti.app_logger.error("[opencti_feedback] Missing parameters: name")
|
|
721
713
|
|
|
722
714
|
def update_field(self, **kwargs):
|
|
723
|
-
|
|
715
|
+
self.opencti.app_logger.info("Updating Feedback", {"data": json.dumps(kwargs)})
|
|
724
716
|
id = kwargs.get("id", None)
|
|
725
717
|
input = kwargs.get("input", None)
|
|
726
718
|
if id is not None and input is not None:
|
|
@@ -742,7 +734,9 @@ class Feedback:
|
|
|
742
734
|
result["data"]["stixDomainObjectEdit"]["fieldPatch"]
|
|
743
735
|
)
|
|
744
736
|
else:
|
|
745
|
-
|
|
737
|
+
self.opencti.app_logger.error(
|
|
738
|
+
"[opencti_feedback] Missing parameters: id and key and value"
|
|
739
|
+
)
|
|
746
740
|
return None
|
|
747
741
|
|
|
748
742
|
"""
|
|
@@ -759,13 +753,12 @@ class Feedback:
|
|
|
759
753
|
"stixObjectOrStixRelationshipId", None
|
|
760
754
|
)
|
|
761
755
|
if id is not None and stix_object_or_stix_relationship_id is not None:
|
|
762
|
-
self.opencti.
|
|
763
|
-
"
|
|
764
|
-
|
|
765
|
-
|
|
766
|
-
|
|
767
|
-
|
|
768
|
-
+ "}",
|
|
756
|
+
self.opencti.app_logger.info(
|
|
757
|
+
"Adding StixObjectOrStixRelationship in Feedback",
|
|
758
|
+
{
|
|
759
|
+
"stix_object_or_stix_relationship_id": stix_object_or_stix_relationship_id,
|
|
760
|
+
"id": id,
|
|
761
|
+
},
|
|
769
762
|
)
|
|
770
763
|
query = """
|
|
771
764
|
mutation FeedbackEditRelationAdd($id: ID!, $input: StixRefRelationshipAddInput!) {
|
|
@@ -788,8 +781,7 @@ class Feedback:
|
|
|
788
781
|
)
|
|
789
782
|
return True
|
|
790
783
|
else:
|
|
791
|
-
self.opencti.
|
|
792
|
-
"error",
|
|
784
|
+
self.opencti.app_logger.error(
|
|
793
785
|
"[opencti_feedback] Missing parameters: id and stixObjectOrStixRelationshipId",
|
|
794
786
|
)
|
|
795
787
|
return False
|
|
@@ -808,13 +800,12 @@ class Feedback:
|
|
|
808
800
|
"stixObjectOrStixRelationshipId", None
|
|
809
801
|
)
|
|
810
802
|
if id is not None and stix_object_or_stix_relationship_id is not None:
|
|
811
|
-
self.opencti.
|
|
812
|
-
"
|
|
813
|
-
|
|
814
|
-
|
|
815
|
-
|
|
816
|
-
|
|
817
|
-
+ "}",
|
|
803
|
+
self.opencti.app_logger.info(
|
|
804
|
+
"Removing StixObjectOrStixRelationship in Feedback",
|
|
805
|
+
{
|
|
806
|
+
"stix_object_or_stix_relationship_id": stix_object_or_stix_relationship_id,
|
|
807
|
+
"id": id,
|
|
808
|
+
},
|
|
818
809
|
)
|
|
819
810
|
query = """
|
|
820
811
|
mutation FeedbackEditRelationDelete($id: ID!, $toId: StixRef!, $relationship_type: String!) {
|
|
@@ -835,8 +826,7 @@ class Feedback:
|
|
|
835
826
|
)
|
|
836
827
|
return True
|
|
837
828
|
else:
|
|
838
|
-
self.opencti.
|
|
839
|
-
"error",
|
|
829
|
+
self.opencti.app_logger.error(
|
|
840
830
|
"[opencti_feedback] Missing parameters: id and stixObjectOrStixRelationshipId",
|
|
841
831
|
)
|
|
842
832
|
return False
|
|
@@ -901,14 +891,14 @@ class Feedback:
|
|
|
901
891
|
update=update,
|
|
902
892
|
)
|
|
903
893
|
else:
|
|
904
|
-
self.opencti.
|
|
905
|
-
"
|
|
894
|
+
self.opencti.app_logger.error(
|
|
895
|
+
"[opencti_feedback] Missing parameters: stixObject"
|
|
906
896
|
)
|
|
907
897
|
|
|
908
898
|
def delete(self, **kwargs):
|
|
909
899
|
id = kwargs.get("id", None)
|
|
910
900
|
if id is not None:
|
|
911
|
-
|
|
901
|
+
self.opencti.app_logger.info("Deleting Feedback", {"id": id})
|
|
912
902
|
query = """
|
|
913
903
|
mutation FeedbackDelete($id: ID!) {
|
|
914
904
|
stixDomainObjectEdit(id: $id) {
|
|
@@ -918,5 +908,5 @@ class Feedback:
|
|
|
918
908
|
"""
|
|
919
909
|
self.opencti.query(query, {"id": id})
|
|
920
910
|
else:
|
|
921
|
-
|
|
911
|
+
self.opencti.app_logger.error("[opencti_feedback] Missing parameters: id")
|
|
922
912
|
return None
|
|
@@ -5,8 +5,6 @@ import uuid
|
|
|
5
5
|
|
|
6
6
|
from stix2.canonicalization.Canonicalize import canonicalize
|
|
7
7
|
|
|
8
|
-
from pycti.entities import LOGGER
|
|
9
|
-
|
|
10
8
|
|
|
11
9
|
class Grouping:
|
|
12
10
|
def __init__(self, opencti):
|
|
@@ -443,7 +441,9 @@ class Grouping:
|
|
|
443
441
|
if get_all:
|
|
444
442
|
first = 100
|
|
445
443
|
|
|
446
|
-
|
|
444
|
+
self.opencti.app_logger.info(
|
|
445
|
+
"Listing Groupings with filters", {"filters": json.dumps(filters)}
|
|
446
|
+
)
|
|
447
447
|
query = (
|
|
448
448
|
"""
|
|
449
449
|
query Groupings($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: GroupingsOrdering, $orderMode: OrderingMode) {
|
|
@@ -487,7 +487,7 @@ class Grouping:
|
|
|
487
487
|
final_data = final_data + data
|
|
488
488
|
while result["data"]["groupings"]["pageInfo"]["hasNextPage"]:
|
|
489
489
|
after = result["data"]["groupings"]["pageInfo"]["endCursor"]
|
|
490
|
-
|
|
490
|
+
self.opencti.app_logger.info("Listing Groupings", {"after": after})
|
|
491
491
|
result = self.opencti.query(
|
|
492
492
|
query,
|
|
493
493
|
{
|
|
@@ -521,7 +521,7 @@ class Grouping:
|
|
|
521
521
|
custom_attributes = kwargs.get("customAttributes", None)
|
|
522
522
|
with_files = kwargs.get("withFiles", False)
|
|
523
523
|
if id is not None:
|
|
524
|
-
|
|
524
|
+
self.opencti.app_logger.info("Reading Grouping", {"id": id})
|
|
525
525
|
query = (
|
|
526
526
|
"""
|
|
527
527
|
query Grouping($id: String!) {
|
|
@@ -591,9 +591,9 @@ class Grouping:
|
|
|
591
591
|
"stixObjectOrStixRelationshipId", None
|
|
592
592
|
)
|
|
593
593
|
if id is not None and stix_object_or_stix_relationship_id is not None:
|
|
594
|
-
|
|
595
|
-
"Checking StixObjectOrStixRelationship
|
|
596
|
-
|
|
594
|
+
self.opencti.app_logger.info(
|
|
595
|
+
"Checking StixObjectOrStixRelationship in Grouping",
|
|
596
|
+
{"id": stix_object_or_stix_relationship_id, "grouping": id},
|
|
597
597
|
)
|
|
598
598
|
query = """
|
|
599
599
|
query GroupingContainsStixObjectOrStixRelationship($id: String!, $stixObjectOrStixRelationshipId: String!) {
|
|
@@ -609,7 +609,7 @@ class Grouping:
|
|
|
609
609
|
)
|
|
610
610
|
return result["data"]["groupingContainsStixObjectOrStixRelationship"]
|
|
611
611
|
else:
|
|
612
|
-
|
|
612
|
+
self.opencti.app_logger.error(
|
|
613
613
|
"[opencti_grouping] Missing parameters: id or stixObjectOrStixRelationshipId"
|
|
614
614
|
)
|
|
615
615
|
|
|
@@ -641,7 +641,7 @@ class Grouping:
|
|
|
641
641
|
update = kwargs.get("update", False)
|
|
642
642
|
|
|
643
643
|
if name is not None and context is not None:
|
|
644
|
-
|
|
644
|
+
self.opencti.app_logger.info("Creating Grouping", {"name": name})
|
|
645
645
|
query = """
|
|
646
646
|
mutation GroupingAdd($input: GroupingAddInput!) {
|
|
647
647
|
groupingAdd(input: $input) {
|
|
@@ -679,7 +679,7 @@ class Grouping:
|
|
|
679
679
|
)
|
|
680
680
|
return self.opencti.process_multiple_fields(result["data"]["groupingAdd"])
|
|
681
681
|
else:
|
|
682
|
-
|
|
682
|
+
self.opencti.app_logger.error(
|
|
683
683
|
"[opencti_grouping] Missing parameters: name and description and context"
|
|
684
684
|
)
|
|
685
685
|
|
|
@@ -697,9 +697,9 @@ class Grouping:
|
|
|
697
697
|
"stixObjectOrStixRelationshipId", None
|
|
698
698
|
)
|
|
699
699
|
if id is not None and stix_object_or_stix_relationship_id is not None:
|
|
700
|
-
|
|
701
|
-
"Adding StixObjectOrStixRelationship
|
|
702
|
-
|
|
700
|
+
self.opencti.app_logger.info(
|
|
701
|
+
"Adding StixObjectOrStixRelationship to Grouping",
|
|
702
|
+
{"id": stix_object_or_stix_relationship_id, "grouping": id},
|
|
703
703
|
)
|
|
704
704
|
query = """
|
|
705
705
|
mutation GroupingEditRelationAdd($id: ID!, $input: StixRefRelationshipAddInput!) {
|
|
@@ -720,7 +720,7 @@ class Grouping:
|
|
|
720
720
|
)
|
|
721
721
|
return True
|
|
722
722
|
else:
|
|
723
|
-
|
|
723
|
+
self.opencti.app_logger.error(
|
|
724
724
|
"[opencti_grouping] Missing parameters: id and stixObjectOrStixRelationshipId",
|
|
725
725
|
)
|
|
726
726
|
return False
|
|
@@ -739,9 +739,9 @@ class Grouping:
|
|
|
739
739
|
"stixObjectOrStixRelationshipId", None
|
|
740
740
|
)
|
|
741
741
|
if id is not None and stix_object_or_stix_relationship_id is not None:
|
|
742
|
-
|
|
743
|
-
"Removing StixObjectOrStixRelationship
|
|
744
|
-
|
|
742
|
+
self.opencti.app_logger.info(
|
|
743
|
+
"Removing StixObjectOrStixRelationship to Grouping",
|
|
744
|
+
{"id": stix_object_or_stix_relationship_id, "grouping": id},
|
|
745
745
|
)
|
|
746
746
|
query = """
|
|
747
747
|
mutation GroupingEditRelationDelete($id: ID!, $toId: StixRef!, $relationship_type: String!) {
|
|
@@ -760,7 +760,7 @@ class Grouping:
|
|
|
760
760
|
)
|
|
761
761
|
return True
|
|
762
762
|
else:
|
|
763
|
-
|
|
763
|
+
self.opencti.app_logger.error(
|
|
764
764
|
"[opencti_grouping] Missing parameters: id and stixObjectOrStixRelationshipId",
|
|
765
765
|
)
|
|
766
766
|
return False
|
|
@@ -830,4 +830,6 @@ class Grouping:
|
|
|
830
830
|
update=update,
|
|
831
831
|
)
|
|
832
832
|
else:
|
|
833
|
-
|
|
833
|
+
self.opencti.app_logger.error(
|
|
834
|
+
"[opencti_grouping] Missing parameters: stixObject"
|
|
835
|
+
)
|
|
@@ -5,7 +5,6 @@ import uuid
|
|
|
5
5
|
|
|
6
6
|
from stix2.canonicalization.Canonicalize import canonicalize
|
|
7
7
|
|
|
8
|
-
from pycti.entities import LOGGER
|
|
9
8
|
from pycti.utils.constants import IdentityTypes
|
|
10
9
|
|
|
11
10
|
|
|
@@ -273,7 +272,9 @@ class Identity:
|
|
|
273
272
|
if get_all:
|
|
274
273
|
first = 500
|
|
275
274
|
|
|
276
|
-
|
|
275
|
+
self.opencti.app_logger.info(
|
|
276
|
+
"Listing Identities with filters", {"filters": json.dumps(filters)}
|
|
277
|
+
)
|
|
277
278
|
query = (
|
|
278
279
|
"""
|
|
279
280
|
query Identities($types: [String], $filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: IdentitiesOrdering, $orderMode: OrderingMode) {
|
|
@@ -318,7 +319,7 @@ class Identity:
|
|
|
318
319
|
final_data = final_data + data
|
|
319
320
|
while result["data"]["identities"]["pageInfo"]["hasNextPage"]:
|
|
320
321
|
after = result["data"]["identities"]["pageInfo"]["endCursor"]
|
|
321
|
-
|
|
322
|
+
self.opencti.app_logger.info("Listing Identities", {"after": after})
|
|
322
323
|
result = self.opencti.query(
|
|
323
324
|
query,
|
|
324
325
|
{
|
|
@@ -352,7 +353,7 @@ class Identity:
|
|
|
352
353
|
custom_attributes = kwargs.get("customAttributes", None)
|
|
353
354
|
with_files = kwargs.get("withFiles", False)
|
|
354
355
|
if id is not None:
|
|
355
|
-
|
|
356
|
+
self.opencti.app_logger.info("Reading Identity", {"id": id})
|
|
356
357
|
query = (
|
|
357
358
|
"""
|
|
358
359
|
query Identity($id: String!) {
|
|
@@ -377,7 +378,9 @@ class Identity:
|
|
|
377
378
|
else:
|
|
378
379
|
return None
|
|
379
380
|
else:
|
|
380
|
-
|
|
381
|
+
self.opencti.app_logger.error(
|
|
382
|
+
"[opencti_identity] Missing parameters: id or filters"
|
|
383
|
+
)
|
|
381
384
|
return None
|
|
382
385
|
|
|
383
386
|
"""
|
|
@@ -413,7 +416,7 @@ class Identity:
|
|
|
413
416
|
update = kwargs.get("update", False)
|
|
414
417
|
|
|
415
418
|
if type is not None and name is not None:
|
|
416
|
-
|
|
419
|
+
self.opencti.app_logger.info("Creating Identity", {"name": name})
|
|
417
420
|
input_variables = {
|
|
418
421
|
"stix_id": stix_id,
|
|
419
422
|
"createdBy": created_by,
|
|
@@ -503,7 +506,9 @@ class Identity:
|
|
|
503
506
|
result["data"][result_data_field]
|
|
504
507
|
)
|
|
505
508
|
else:
|
|
506
|
-
|
|
509
|
+
self.opencti.app_logger.error(
|
|
510
|
+
"Missing parameters: type, name and description"
|
|
511
|
+
)
|
|
507
512
|
|
|
508
513
|
"""
|
|
509
514
|
Import an Identity object from a STIX2 object
|
|
@@ -622,4 +627,6 @@ class Identity:
|
|
|
622
627
|
update=update,
|
|
623
628
|
)
|
|
624
629
|
else:
|
|
625
|
-
|
|
630
|
+
self.opencti.app_logger.error(
|
|
631
|
+
"[opencti_identity] Missing parameters: stixObject"
|
|
632
|
+
)
|
|
@@ -6,8 +6,6 @@ import uuid
|
|
|
6
6
|
|
|
7
7
|
from stix2.canonicalization.Canonicalize import canonicalize
|
|
8
8
|
|
|
9
|
-
from pycti.entities import LOGGER
|
|
10
|
-
|
|
11
9
|
|
|
12
10
|
class Incident:
|
|
13
11
|
def __init__(self, opencti):
|
|
@@ -265,7 +263,9 @@ class Incident:
|
|
|
265
263
|
if get_all:
|
|
266
264
|
first = 100
|
|
267
265
|
|
|
268
|
-
|
|
266
|
+
self.opencti.app_logger.info(
|
|
267
|
+
"Listing Incidents with filters", {"filters": json.dumps(filters)}
|
|
268
|
+
)
|
|
269
269
|
query = (
|
|
270
270
|
"""
|
|
271
271
|
query Incidents($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: IncidentsOrdering, $orderMode: OrderingMode) {
|
|
@@ -309,7 +309,7 @@ class Incident:
|
|
|
309
309
|
final_data = final_data + data
|
|
310
310
|
while result["data"]["incidents"]["pageInfo"]["hasNextPage"]:
|
|
311
311
|
after = result["data"]["incidents"]["pageInfo"]["endCursor"]
|
|
312
|
-
|
|
312
|
+
self.opencti.app_logger.info("Listing Incidents", {"after": after})
|
|
313
313
|
result = self.opencti.query(
|
|
314
314
|
query,
|
|
315
315
|
{
|
|
@@ -343,7 +343,7 @@ class Incident:
|
|
|
343
343
|
custom_attributes = kwargs.get("customAttributes", None)
|
|
344
344
|
with_files = kwargs.get("withFiles", False)
|
|
345
345
|
if id is not None:
|
|
346
|
-
|
|
346
|
+
self.opencti.app_logger.info("Reading Incident", {"id": id})
|
|
347
347
|
query = (
|
|
348
348
|
"""
|
|
349
349
|
query Incident($id: String!) {
|
|
@@ -368,7 +368,9 @@ class Incident:
|
|
|
368
368
|
else:
|
|
369
369
|
return None
|
|
370
370
|
else:
|
|
371
|
-
|
|
371
|
+
self.opencti.app_logger.error(
|
|
372
|
+
"[opencti_incident] Missing parameters: id or filters"
|
|
373
|
+
)
|
|
372
374
|
return None
|
|
373
375
|
|
|
374
376
|
"""
|
|
@@ -404,7 +406,7 @@ class Incident:
|
|
|
404
406
|
update = kwargs.get("update", False)
|
|
405
407
|
|
|
406
408
|
if name is not None:
|
|
407
|
-
|
|
409
|
+
self.opencti.app_logger.info("Creating Incident", {"name": name})
|
|
408
410
|
query = """
|
|
409
411
|
mutation IncidentAdd($input: IncidentAddInput!) {
|
|
410
412
|
incidentAdd(input: $input) {
|
|
@@ -447,7 +449,7 @@ class Incident:
|
|
|
447
449
|
)
|
|
448
450
|
return self.opencti.process_multiple_fields(result["data"]["incidentAdd"])
|
|
449
451
|
else:
|
|
450
|
-
|
|
452
|
+
self.opencti.app_logger.error("Missing parameters: name and description")
|
|
451
453
|
|
|
452
454
|
"""
|
|
453
455
|
Import a Incident object from a STIX2 object
|
|
@@ -525,4 +527,6 @@ class Incident:
|
|
|
525
527
|
update=update,
|
|
526
528
|
)
|
|
527
529
|
else:
|
|
528
|
-
|
|
530
|
+
self.opencti.app_logger.error(
|
|
531
|
+
"[opencti_incident] Missing parameters: stixObject"
|
|
532
|
+
)
|