pycti 5.12.14__py3-none-any.whl → 5.12.15__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of pycti might be problematic. Click here for more details.
- pycti/__init__.py +1 -1
- pycti/api/__init__.py +0 -3
- pycti/api/opencti_api_client.py +10 -56
- pycti/api/opencti_api_connector.py +1 -2
- pycti/api/opencti_api_playbook.py +3 -4
- pycti/api/opencti_api_work.py +15 -12
- pycti/connector/__init__.py +0 -3
- pycti/connector/opencti_connector_helper.py +63 -58
- pycti/connector/opencti_metric_handler.py +8 -5
- pycti/entities/__init__.py +0 -3
- pycti/entities/opencti_attack_pattern.py +17 -11
- pycti/entities/opencti_campaign.py +15 -9
- pycti/entities/opencti_case_incident.py +39 -43
- pycti/entities/opencti_case_rfi.py +34 -46
- pycti/entities/opencti_case_rft.py +35 -44
- pycti/entities/opencti_channel.py +15 -9
- pycti/entities/opencti_course_of_action.py +15 -9
- pycti/entities/opencti_data_component.py +17 -14
- pycti/entities/opencti_data_source.py +12 -16
- pycti/entities/opencti_event.py +15 -9
- pycti/entities/opencti_external_reference.py +20 -15
- pycti/entities/opencti_feedback.py +36 -46
- pycti/entities/opencti_grouping.py +22 -20
- pycti/entities/opencti_identity.py +15 -8
- pycti/entities/opencti_incident.py +13 -9
- pycti/entities/opencti_indicator.py +18 -15
- pycti/entities/opencti_infrastructure.py +15 -9
- pycti/entities/opencti_intrusion_set.py +12 -8
- pycti/entities/opencti_kill_chain_phase.py +16 -12
- pycti/entities/opencti_label.py +16 -12
- pycti/entities/opencti_language.py +13 -9
- pycti/entities/opencti_location.py +13 -9
- pycti/entities/opencti_malware.py +15 -9
- pycti/entities/opencti_malware_analysis.py +17 -9
- pycti/entities/opencti_marking_definition.py +15 -11
- pycti/entities/opencti_narrative.py +15 -9
- pycti/entities/opencti_note.py +35 -20
- pycti/entities/opencti_observed_data.py +34 -19
- pycti/entities/opencti_opinion.py +37 -20
- pycti/entities/opencti_report.py +36 -20
- pycti/entities/opencti_stix.py +8 -19
- pycti/entities/opencti_stix_core_object.py +15 -9
- pycti/entities/opencti_stix_core_relationship.py +69 -52
- pycti/entities/opencti_stix_cyber_observable.py +78 -62
- pycti/entities/opencti_stix_domain_object.py +75 -55
- pycti/entities/opencti_stix_nested_ref_relationship.py +21 -14
- pycti/entities/opencti_stix_object_or_stix_relationship.py +4 -7
- pycti/entities/opencti_stix_sighting_relationship.py +34 -26
- pycti/entities/opencti_task.py +37 -44
- pycti/entities/opencti_threat_actor.py +7 -4
- pycti/entities/opencti_threat_actor_group.py +10 -8
- pycti/entities/opencti_threat_actor_individual.py +10 -9
- pycti/entities/opencti_tool.py +15 -9
- pycti/entities/opencti_vocabulary.py +11 -13
- pycti/entities/opencti_vulnerability.py +15 -9
- pycti/utils/opencti_logger.py +64 -0
- pycti/utils/opencti_stix2.py +30 -24
- pycti/utils/opencti_stix2_update.py +2 -6
- {pycti-5.12.14.dist-info → pycti-5.12.15.dist-info}/METADATA +1 -1
- pycti-5.12.15.dist-info/RECORD +68 -0
- pycti-5.12.14.dist-info/RECORD +0 -67
- {pycti-5.12.14.dist-info → pycti-5.12.15.dist-info}/LICENSE +0 -0
- {pycti-5.12.14.dist-info → pycti-5.12.15.dist-info}/WHEEL +0 -0
- {pycti-5.12.14.dist-info → pycti-5.12.15.dist-info}/top_level.txt +0 -0
|
@@ -5,8 +5,6 @@ import uuid
|
|
|
5
5
|
|
|
6
6
|
from stix2.canonicalization.Canonicalize import canonicalize
|
|
7
7
|
|
|
8
|
-
from pycti.entities import LOGGER
|
|
9
|
-
|
|
10
8
|
|
|
11
9
|
class MalwareAnalysis:
|
|
12
10
|
def __init__(self, opencti):
|
|
@@ -266,7 +264,9 @@ class MalwareAnalysis:
|
|
|
266
264
|
if get_all:
|
|
267
265
|
first = 500
|
|
268
266
|
|
|
269
|
-
|
|
267
|
+
self.opencti.app_logger.info(
|
|
268
|
+
"Listing Malware analyses with filters", {"filters": json.dumps(filters)}
|
|
269
|
+
)
|
|
270
270
|
query = (
|
|
271
271
|
"""
|
|
272
272
|
query MalwareAnalyses($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: MalwareAnalysesOrdering, $orderMode: OrderingMode) {
|
|
@@ -311,7 +311,9 @@ class MalwareAnalysis:
|
|
|
311
311
|
final_data = final_data + data
|
|
312
312
|
while result["data"]["malwareAnalyses"]["pageInfo"]["hasNextPage"]:
|
|
313
313
|
after = result["data"]["malwareAnalyses"]["pageInfo"]["endCursor"]
|
|
314
|
-
|
|
314
|
+
self.opencti.app_logger.info(
|
|
315
|
+
"Listing Malware analyses", {"after": after}
|
|
316
|
+
)
|
|
315
317
|
result = self.opencti.query(
|
|
316
318
|
query,
|
|
317
319
|
{
|
|
@@ -345,7 +347,7 @@ class MalwareAnalysis:
|
|
|
345
347
|
custom_attributes = kwargs.get("customAttributes", None)
|
|
346
348
|
with_files = kwargs.get("withFiles", False)
|
|
347
349
|
if id is not None:
|
|
348
|
-
|
|
350
|
+
self.opencti.app_logger.info("Reading Malware analysis", {"id": id})
|
|
349
351
|
query = (
|
|
350
352
|
"""
|
|
351
353
|
query MalwareAnalysis($id: String!) {
|
|
@@ -372,7 +374,9 @@ class MalwareAnalysis:
|
|
|
372
374
|
else:
|
|
373
375
|
return None
|
|
374
376
|
else:
|
|
375
|
-
|
|
377
|
+
self.opencti.app_logger.error(
|
|
378
|
+
"[opencti_malwareAnalysis] Missing parameters: id or filters"
|
|
379
|
+
)
|
|
376
380
|
return None
|
|
377
381
|
|
|
378
382
|
"""
|
|
@@ -414,7 +418,9 @@ class MalwareAnalysis:
|
|
|
414
418
|
update = kwargs.get("update", False)
|
|
415
419
|
|
|
416
420
|
if product is not None and result_name is not None:
|
|
417
|
-
|
|
421
|
+
self.opencti.app_logger.info(
|
|
422
|
+
"Creating Malware analysis", {"product": product}
|
|
423
|
+
)
|
|
418
424
|
query = """
|
|
419
425
|
mutation MalwareAnalysisAdd($input: MalwareAnalysisAddInput!) {
|
|
420
426
|
malwareAnalysisAdd(input: $input) {
|
|
@@ -465,7 +471,7 @@ class MalwareAnalysis:
|
|
|
465
471
|
result["data"]["malwareAnalysisAdd"]
|
|
466
472
|
)
|
|
467
473
|
else:
|
|
468
|
-
|
|
474
|
+
self.opencti.app_logger.error(
|
|
469
475
|
"[opencti_malwareAnalysis] Missing parameters: product and result_name"
|
|
470
476
|
)
|
|
471
477
|
|
|
@@ -561,4 +567,6 @@ class MalwareAnalysis:
|
|
|
561
567
|
update=update,
|
|
562
568
|
)
|
|
563
569
|
else:
|
|
564
|
-
|
|
570
|
+
self.opencti.app_logger.error(
|
|
571
|
+
"[opencti_malware_analysis] Missing parameters: stixObject"
|
|
572
|
+
)
|
|
@@ -5,8 +5,6 @@ import uuid
|
|
|
5
5
|
|
|
6
6
|
from stix2.canonicalization.Canonicalize import canonicalize
|
|
7
7
|
|
|
8
|
-
from pycti.entities import LOGGER
|
|
9
|
-
|
|
10
8
|
|
|
11
9
|
class MarkingDefinition:
|
|
12
10
|
def __init__(self, opencti):
|
|
@@ -54,7 +52,9 @@ class MarkingDefinition:
|
|
|
54
52
|
if get_all:
|
|
55
53
|
first = 500
|
|
56
54
|
|
|
57
|
-
|
|
55
|
+
self.opencti.app_logger.info(
|
|
56
|
+
"Listing Marking-Definitions with filters", {"filters": json.dumps(filters)}
|
|
57
|
+
)
|
|
58
58
|
query = (
|
|
59
59
|
"""
|
|
60
60
|
query MarkingDefinitions($filters: FilterGroup, $first: Int, $after: ID, $orderBy: MarkingDefinitionsOrdering, $orderMode: OrderingMode) {
|
|
@@ -103,7 +103,7 @@ class MarkingDefinition:
|
|
|
103
103
|
id = kwargs.get("id", None)
|
|
104
104
|
filters = kwargs.get("filters", None)
|
|
105
105
|
if id is not None:
|
|
106
|
-
|
|
106
|
+
self.opencti.app_logger.info("Reading Marking-Definition", {"id": id})
|
|
107
107
|
query = (
|
|
108
108
|
"""
|
|
109
109
|
query MarkingDefinition($id: String!) {
|
|
@@ -126,7 +126,7 @@ class MarkingDefinition:
|
|
|
126
126
|
else:
|
|
127
127
|
return None
|
|
128
128
|
else:
|
|
129
|
-
|
|
129
|
+
self.opencti.app_logger.error(
|
|
130
130
|
"[opencti_marking_definition] Missing parameters: id or filters"
|
|
131
131
|
)
|
|
132
132
|
return None
|
|
@@ -182,7 +182,7 @@ class MarkingDefinition:
|
|
|
182
182
|
result["data"]["markingDefinitionAdd"]
|
|
183
183
|
)
|
|
184
184
|
else:
|
|
185
|
-
|
|
185
|
+
self.opencti.app_logger.error(
|
|
186
186
|
"[opencti_marking_definition] Missing parameters: definition and definition_type",
|
|
187
187
|
)
|
|
188
188
|
|
|
@@ -198,7 +198,7 @@ class MarkingDefinition:
|
|
|
198
198
|
id = kwargs.get("id", None)
|
|
199
199
|
input = kwargs.get("input", None)
|
|
200
200
|
if id is not None and input is not None:
|
|
201
|
-
|
|
201
|
+
self.opencti.app_logger.info("Updating Marking Definition", {"id": id})
|
|
202
202
|
query = """
|
|
203
203
|
mutation MarkingDefinitionEdit($id: ID!, $input: [EditInput]!) {
|
|
204
204
|
markingDefinitionEdit(id: $id) {
|
|
@@ -221,7 +221,7 @@ class MarkingDefinition:
|
|
|
221
221
|
result["data"]["markingDefinitionEdit"]["fieldPatch"]
|
|
222
222
|
)
|
|
223
223
|
else:
|
|
224
|
-
|
|
224
|
+
self.opencti.app_logger.error(
|
|
225
225
|
"[opencti_marking_definition] Missing parameters: id and key and value"
|
|
226
226
|
)
|
|
227
227
|
return None
|
|
@@ -321,12 +321,14 @@ class MarkingDefinition:
|
|
|
321
321
|
update=update,
|
|
322
322
|
)
|
|
323
323
|
else:
|
|
324
|
-
|
|
324
|
+
self.opencti.app_logger.error(
|
|
325
|
+
"[opencti_marking_definition] Missing parameters: stixObject"
|
|
326
|
+
)
|
|
325
327
|
|
|
326
328
|
def delete(self, **kwargs):
|
|
327
329
|
id = kwargs.get("id", None)
|
|
328
330
|
if id is not None:
|
|
329
|
-
|
|
331
|
+
self.opencti.app_logger.info("Deleting Marking-Definition", {"id": id})
|
|
330
332
|
query = """
|
|
331
333
|
mutation MarkingDefinitionEdit($id: ID!) {
|
|
332
334
|
markingDefinitionEdit(id: $id) {
|
|
@@ -336,5 +338,7 @@ class MarkingDefinition:
|
|
|
336
338
|
"""
|
|
337
339
|
self.opencti.query(query, {"id": id})
|
|
338
340
|
else:
|
|
339
|
-
|
|
341
|
+
self.opencti.app_logger.error(
|
|
342
|
+
"[opencti_marking_definition] Missing parameters: id"
|
|
343
|
+
)
|
|
340
344
|
return None
|
|
@@ -5,8 +5,6 @@ import uuid
|
|
|
5
5
|
|
|
6
6
|
from stix2.canonicalization.Canonicalize import canonicalize
|
|
7
7
|
|
|
8
|
-
from pycti.entities import LOGGER
|
|
9
|
-
|
|
10
8
|
|
|
11
9
|
class Narrative:
|
|
12
10
|
def __init__(self, opencti):
|
|
@@ -252,7 +250,9 @@ class Narrative:
|
|
|
252
250
|
if get_all:
|
|
253
251
|
first = 100
|
|
254
252
|
|
|
255
|
-
|
|
253
|
+
self.opencti.app_logger.info(
|
|
254
|
+
"Listing Narratives with filters", {"filters": json.dumps(filters)}
|
|
255
|
+
)
|
|
256
256
|
query = (
|
|
257
257
|
"""
|
|
258
258
|
query Narratives($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: NarrativesOrdering, $orderMode: OrderingMode) {
|
|
@@ -296,7 +296,7 @@ class Narrative:
|
|
|
296
296
|
final_data = final_data + data
|
|
297
297
|
while result["data"]["narratives"]["pageInfo"]["hasNextPage"]:
|
|
298
298
|
after = result["data"]["narratives"]["pageInfo"]["endCursor"]
|
|
299
|
-
|
|
299
|
+
self.opencti.app_logger.info("Listing Narratives", {"after": after})
|
|
300
300
|
result = self.opencti.query(
|
|
301
301
|
query,
|
|
302
302
|
{
|
|
@@ -330,7 +330,7 @@ class Narrative:
|
|
|
330
330
|
custom_attributes = kwargs.get("customAttributes", None)
|
|
331
331
|
with_files = kwargs.get("withFiles", False)
|
|
332
332
|
if id is not None:
|
|
333
|
-
|
|
333
|
+
self.opencti.app_logger.info("Reading Narrative", {"id": id})
|
|
334
334
|
query = (
|
|
335
335
|
"""
|
|
336
336
|
query Narrative($id: String!) {
|
|
@@ -355,7 +355,9 @@ class Narrative:
|
|
|
355
355
|
else:
|
|
356
356
|
return None
|
|
357
357
|
else:
|
|
358
|
-
|
|
358
|
+
self.opencti.app_logger.error(
|
|
359
|
+
"[opencti_narrative] Missing parameters: id or filters"
|
|
360
|
+
)
|
|
359
361
|
return None
|
|
360
362
|
|
|
361
363
|
"""
|
|
@@ -385,7 +387,7 @@ class Narrative:
|
|
|
385
387
|
update = kwargs.get("update", False)
|
|
386
388
|
|
|
387
389
|
if name is not None:
|
|
388
|
-
|
|
390
|
+
self.opencti.app_logger.info("Creating Narrative", {"name": name})
|
|
389
391
|
query = """
|
|
390
392
|
mutation NarrativeAdd($input: NarrativeAddInput!) {
|
|
391
393
|
narrativeAdd(input: $input) {
|
|
@@ -422,7 +424,9 @@ class Narrative:
|
|
|
422
424
|
)
|
|
423
425
|
return self.opencti.process_multiple_fields(result["data"]["narrativeAdd"])
|
|
424
426
|
else:
|
|
425
|
-
|
|
427
|
+
self.opencti.app_logger.error(
|
|
428
|
+
"[opencti_narrative] Missing parameters: name and description"
|
|
429
|
+
)
|
|
426
430
|
|
|
427
431
|
"""
|
|
428
432
|
Import an Narrative object from a STIX2 object
|
|
@@ -486,4 +490,6 @@ class Narrative:
|
|
|
486
490
|
update=update,
|
|
487
491
|
)
|
|
488
492
|
else:
|
|
489
|
-
|
|
493
|
+
self.opencti.app_logger.error(
|
|
494
|
+
"[opencti_narrative] Missing parameters: stixObject"
|
|
495
|
+
)
|
pycti/entities/opencti_note.py
CHANGED
|
@@ -6,8 +6,6 @@ import uuid
|
|
|
6
6
|
|
|
7
7
|
from stix2.canonicalization.Canonicalize import canonicalize
|
|
8
8
|
|
|
9
|
-
from pycti.entities import LOGGER
|
|
10
|
-
|
|
11
9
|
|
|
12
10
|
class Note:
|
|
13
11
|
def __init__(self, opencti):
|
|
@@ -489,7 +487,9 @@ class Note:
|
|
|
489
487
|
if get_all:
|
|
490
488
|
first = 100
|
|
491
489
|
|
|
492
|
-
|
|
490
|
+
self.opencti.app_logger.info(
|
|
491
|
+
"Listing Notes with filters", {"filters": json.dumps(filters)}
|
|
492
|
+
)
|
|
493
493
|
query = (
|
|
494
494
|
"""
|
|
495
495
|
query Notes($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: NotesOrdering, $orderMode: OrderingMode) {
|
|
@@ -533,7 +533,7 @@ class Note:
|
|
|
533
533
|
final_data = final_data + data
|
|
534
534
|
while result["data"]["notes"]["pageInfo"]["hasNextPage"]:
|
|
535
535
|
after = result["data"]["notes"]["pageInfo"]["endCursor"]
|
|
536
|
-
|
|
536
|
+
self.opencti.app_logger.info("Listing Notes", {"after": after})
|
|
537
537
|
result = self.opencti.query(
|
|
538
538
|
query,
|
|
539
539
|
{
|
|
@@ -567,7 +567,7 @@ class Note:
|
|
|
567
567
|
custom_attributes = kwargs.get("customAttributes", None)
|
|
568
568
|
with_files = kwargs.get("withFiles", False)
|
|
569
569
|
if id is not None:
|
|
570
|
-
|
|
570
|
+
self.opencti.app_logger.info("Reading Note", {"id": id})
|
|
571
571
|
query = (
|
|
572
572
|
"""
|
|
573
573
|
query Note($id: String!) {
|
|
@@ -604,9 +604,12 @@ class Note:
|
|
|
604
604
|
"stixObjectOrStixRelationshipId", None
|
|
605
605
|
)
|
|
606
606
|
if id is not None and stix_object_or_stix_relationship_id is not None:
|
|
607
|
-
|
|
608
|
-
"Checking StixObjectOrStixRelationship
|
|
609
|
-
|
|
607
|
+
self.opencti.app_logger.info(
|
|
608
|
+
"Checking StixObjectOrStixRelationship in Note",
|
|
609
|
+
{
|
|
610
|
+
"id": id,
|
|
611
|
+
"stixObjectOrStixRelationshipId": stix_object_or_stix_relationship_id,
|
|
612
|
+
},
|
|
610
613
|
)
|
|
611
614
|
query = """
|
|
612
615
|
query NoteContainsStixObjectOrStixRelationship($id: String!, $stixObjectOrStixRelationshipId: String!) {
|
|
@@ -622,7 +625,9 @@ class Note:
|
|
|
622
625
|
)
|
|
623
626
|
return result["data"]["noteContainsStixObjectOrStixRelationship"]
|
|
624
627
|
else:
|
|
625
|
-
|
|
628
|
+
self.opencti.app_logger.error(
|
|
629
|
+
"[opencti_note] Missing parameters: id or entity_id"
|
|
630
|
+
)
|
|
626
631
|
|
|
627
632
|
"""
|
|
628
633
|
Create a Note object
|
|
@@ -653,7 +658,7 @@ class Note:
|
|
|
653
658
|
update = kwargs.get("update", False)
|
|
654
659
|
|
|
655
660
|
if content is not None:
|
|
656
|
-
|
|
661
|
+
self.opencti.app_logger.info("Creating Note", {"content": content})
|
|
657
662
|
query = """
|
|
658
663
|
mutation NoteAdd($input: NoteAddInput!) {
|
|
659
664
|
noteAdd(input: $input) {
|
|
@@ -692,7 +697,7 @@ class Note:
|
|
|
692
697
|
)
|
|
693
698
|
return self.opencti.process_multiple_fields(result["data"]["noteAdd"])
|
|
694
699
|
else:
|
|
695
|
-
|
|
700
|
+
self.opencti.app_logger.error("[opencti_note] Missing parameters: content")
|
|
696
701
|
|
|
697
702
|
"""
|
|
698
703
|
Add a Stix-Entity object to Note object (object_refs)
|
|
@@ -713,9 +718,12 @@ class Note:
|
|
|
713
718
|
stixObjectOrStixRelationshipId=stix_object_or_stix_relationship_id,
|
|
714
719
|
):
|
|
715
720
|
return True
|
|
716
|
-
|
|
717
|
-
"Adding StixObjectOrStixRelationship
|
|
718
|
-
|
|
721
|
+
self.opencti.app_logger.info(
|
|
722
|
+
"Adding StixObjectOrStixRelationship to Note",
|
|
723
|
+
{
|
|
724
|
+
"id": id,
|
|
725
|
+
"stixObjectOrStixRelationshipId": stix_object_or_stix_relationship_id,
|
|
726
|
+
},
|
|
719
727
|
)
|
|
720
728
|
query = """
|
|
721
729
|
mutation NoteEdit($id: ID!, $input: StixRefRelationshipAddInput!) {
|
|
@@ -738,7 +746,7 @@ class Note:
|
|
|
738
746
|
)
|
|
739
747
|
return True
|
|
740
748
|
else:
|
|
741
|
-
|
|
749
|
+
self.opencti.app_logger.error(
|
|
742
750
|
"[opencti_note] Missing parameters: id and stix_object_or_stix_relationship_id",
|
|
743
751
|
)
|
|
744
752
|
return False
|
|
@@ -757,9 +765,12 @@ class Note:
|
|
|
757
765
|
"stixObjectOrStixRelationshipId", None
|
|
758
766
|
)
|
|
759
767
|
if id is not None and stix_object_or_stix_relationship_id is not None:
|
|
760
|
-
|
|
761
|
-
"Removing StixObjectOrStixRelationship
|
|
762
|
-
|
|
768
|
+
self.opencti.app_logger.info(
|
|
769
|
+
"Removing StixObjectOrStixRelationship in Note",
|
|
770
|
+
{
|
|
771
|
+
"id": id,
|
|
772
|
+
"stixObjectOrStixRelationshipId": stix_object_or_stix_relationship_id,
|
|
773
|
+
},
|
|
763
774
|
)
|
|
764
775
|
query = """
|
|
765
776
|
mutation NotetEditRelationDelete($id: ID!, $toId: StixRef!, $relationship_type: String!) {
|
|
@@ -780,7 +791,9 @@ class Note:
|
|
|
780
791
|
)
|
|
781
792
|
return True
|
|
782
793
|
else:
|
|
783
|
-
|
|
794
|
+
self.opencti.app_logger.error(
|
|
795
|
+
"[opencti_note] Missing parameters: id and entity_id"
|
|
796
|
+
)
|
|
784
797
|
return False
|
|
785
798
|
|
|
786
799
|
"""
|
|
@@ -849,4 +862,6 @@ class Note:
|
|
|
849
862
|
update=update,
|
|
850
863
|
)
|
|
851
864
|
else:
|
|
852
|
-
|
|
865
|
+
self.opencti.app_logger.error(
|
|
866
|
+
"[opencti_note] Missing parameters: stixObject"
|
|
867
|
+
)
|
|
@@ -5,8 +5,6 @@ import uuid
|
|
|
5
5
|
|
|
6
6
|
from stix2.canonicalization.Canonicalize import canonicalize
|
|
7
7
|
|
|
8
|
-
from pycti.entities import LOGGER
|
|
9
|
-
|
|
10
8
|
|
|
11
9
|
class ObservedData:
|
|
12
10
|
def __init__(self, opencti):
|
|
@@ -479,7 +477,9 @@ class ObservedData:
|
|
|
479
477
|
if get_all:
|
|
480
478
|
first = 500
|
|
481
479
|
|
|
482
|
-
|
|
480
|
+
self.opencti.app_logger.info(
|
|
481
|
+
"Listing ObservedDatas with filters", {"filters": json.dumps(filters)}
|
|
482
|
+
)
|
|
483
483
|
query = (
|
|
484
484
|
"""
|
|
485
485
|
query ObservedDatas($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: ObservedDatasOrdering, $orderMode: OrderingMode) {
|
|
@@ -535,7 +535,7 @@ class ObservedData:
|
|
|
535
535
|
custom_attributes = kwargs.get("customAttributes", None)
|
|
536
536
|
with_files = kwargs.get("withFiles", False)
|
|
537
537
|
if id is not None:
|
|
538
|
-
|
|
538
|
+
self.opencti.app_logger.info("Reading ObservedData", {"id": id})
|
|
539
539
|
query = (
|
|
540
540
|
"""
|
|
541
541
|
query ObservedData($id: String!) {
|
|
@@ -572,9 +572,12 @@ class ObservedData:
|
|
|
572
572
|
"stixObjectOrStixRelationshipId", None
|
|
573
573
|
)
|
|
574
574
|
if id is not None and stix_object_or_stix_relationship_id is not None:
|
|
575
|
-
|
|
576
|
-
"Checking StixObjectOrStixRelationship
|
|
577
|
-
|
|
575
|
+
self.opencti.app_logger.info(
|
|
576
|
+
"Checking StixObjectOrStixRelationship in ObservedData",
|
|
577
|
+
{
|
|
578
|
+
"id": id,
|
|
579
|
+
"stixObjectOrStixRelationshipId": stix_object_or_stix_relationship_id,
|
|
580
|
+
},
|
|
578
581
|
)
|
|
579
582
|
query = """
|
|
580
583
|
query ObservedDataContainsStixObjectOrStixRelationship($id: String!, $stixObjectOrStixRelationshipId: String!) {
|
|
@@ -590,7 +593,9 @@ class ObservedData:
|
|
|
590
593
|
)
|
|
591
594
|
return result["data"]["observedDataContainsStixObjectOrStixRelationship"]
|
|
592
595
|
else:
|
|
593
|
-
|
|
596
|
+
self.opencti.app_logger.error(
|
|
597
|
+
"[opencti_observedData] Missing parameters: id or entity_id"
|
|
598
|
+
)
|
|
594
599
|
|
|
595
600
|
"""
|
|
596
601
|
Create a ObservedData object
|
|
@@ -623,7 +628,7 @@ class ObservedData:
|
|
|
623
628
|
and last_observed is not None
|
|
624
629
|
and objects is not None
|
|
625
630
|
):
|
|
626
|
-
|
|
631
|
+
self.opencti.app_logger.info("Creating ObservedData")
|
|
627
632
|
query = """
|
|
628
633
|
mutation ObservedDataAdd($input: ObservedDataAddInput!) {
|
|
629
634
|
observedDataAdd(input: $input) {
|
|
@@ -662,7 +667,7 @@ class ObservedData:
|
|
|
662
667
|
result["data"]["observedDataAdd"]
|
|
663
668
|
)
|
|
664
669
|
else:
|
|
665
|
-
|
|
670
|
+
self.opencti.app_logger.error(
|
|
666
671
|
"[opencti_observedData] Missing parameters: "
|
|
667
672
|
"first_observed, last_observed or objects"
|
|
668
673
|
)
|
|
@@ -686,9 +691,12 @@ class ObservedData:
|
|
|
686
691
|
stixObjectOrStixRelationshipId=stix_object_or_stix_relationship_id,
|
|
687
692
|
):
|
|
688
693
|
return True
|
|
689
|
-
|
|
690
|
-
"Adding StixObjectOrStixRelationship
|
|
691
|
-
|
|
694
|
+
self.opencti.app_logger.info(
|
|
695
|
+
"Adding StixObjectOrStixRelationship to ObservedData",
|
|
696
|
+
{
|
|
697
|
+
"id": id,
|
|
698
|
+
"stixObjectOrStixRelationshipId": stix_object_or_stix_relationship_id,
|
|
699
|
+
},
|
|
692
700
|
)
|
|
693
701
|
query = """
|
|
694
702
|
mutation ObservedDataEdit($id: ID!, $input: StixRefRelationshipAddInput!) {
|
|
@@ -711,7 +719,7 @@ class ObservedData:
|
|
|
711
719
|
)
|
|
712
720
|
return True
|
|
713
721
|
else:
|
|
714
|
-
|
|
722
|
+
self.opencti.app_logger.error(
|
|
715
723
|
"[opencti_observedData] Missing parameters: "
|
|
716
724
|
"id and stix_object_or_stix_relationship_id"
|
|
717
725
|
)
|
|
@@ -731,9 +739,12 @@ class ObservedData:
|
|
|
731
739
|
"stixObjectOrStixRelationshipId", None
|
|
732
740
|
)
|
|
733
741
|
if id is not None and stix_object_or_stix_relationship_id is not None:
|
|
734
|
-
|
|
735
|
-
"Removing StixObjectOrStixRelationship
|
|
736
|
-
|
|
742
|
+
self.opencti.app_logger.info(
|
|
743
|
+
"Removing StixObjectOrStixRelationship to Observed-Data",
|
|
744
|
+
{
|
|
745
|
+
"id": id,
|
|
746
|
+
"stixObjectOrStixRelationshipId": stix_object_or_stix_relationship_id,
|
|
747
|
+
},
|
|
737
748
|
)
|
|
738
749
|
query = """
|
|
739
750
|
mutation ObservedDataEditRelationDelete($id: ID!, $toId: StixRef!, $relationship_type: String!) {
|
|
@@ -754,7 +765,9 @@ class ObservedData:
|
|
|
754
765
|
)
|
|
755
766
|
return True
|
|
756
767
|
else:
|
|
757
|
-
|
|
768
|
+
self.opencti.app_logger.error(
|
|
769
|
+
"[opencti_observed_data] Missing parameters: id and entity_id"
|
|
770
|
+
)
|
|
758
771
|
return False
|
|
759
772
|
|
|
760
773
|
"""
|
|
@@ -846,4 +859,6 @@ class ObservedData:
|
|
|
846
859
|
|
|
847
860
|
return observed_data_result
|
|
848
861
|
else:
|
|
849
|
-
|
|
862
|
+
self.opencti.app_logger.error(
|
|
863
|
+
"[opencti_observed_data] Missing parameters: stixObject"
|
|
864
|
+
)
|
|
@@ -3,8 +3,6 @@
|
|
|
3
3
|
import json
|
|
4
4
|
import uuid
|
|
5
5
|
|
|
6
|
-
from pycti.entities import LOGGER
|
|
7
|
-
|
|
8
6
|
|
|
9
7
|
class Opinion:
|
|
10
8
|
def __init__(self, opencti):
|
|
@@ -251,7 +249,9 @@ class Opinion:
|
|
|
251
249
|
if get_all:
|
|
252
250
|
first = 100
|
|
253
251
|
|
|
254
|
-
|
|
252
|
+
self.opencti.app_logger.info(
|
|
253
|
+
"Listing Opinions with filters", {"filters": json.dumps(filters)}
|
|
254
|
+
)
|
|
255
255
|
query = (
|
|
256
256
|
"""
|
|
257
257
|
query Opinions($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: OpinionsOrdering, $orderMode: OrderingMode) {
|
|
@@ -291,7 +291,7 @@ class Opinion:
|
|
|
291
291
|
final_data = final_data + data
|
|
292
292
|
while result["data"]["opinions"]["pageInfo"]["hasNextPage"]:
|
|
293
293
|
after = result["data"]["opinions"]["pageInfo"]["endCursor"]
|
|
294
|
-
|
|
294
|
+
self.opencti.app_logger.info("Listing Opinions", {"after": after})
|
|
295
295
|
result = self.opencti.query(
|
|
296
296
|
query,
|
|
297
297
|
{
|
|
@@ -324,7 +324,7 @@ class Opinion:
|
|
|
324
324
|
filters = kwargs.get("filters", None)
|
|
325
325
|
custom_attributes = kwargs.get("customAttributes", None)
|
|
326
326
|
if id is not None:
|
|
327
|
-
|
|
327
|
+
self.opencti.app_logger.info("Reading Opinion", {"id": id})
|
|
328
328
|
query = (
|
|
329
329
|
"""
|
|
330
330
|
query Opinion($id: String!) {
|
|
@@ -361,9 +361,12 @@ class Opinion:
|
|
|
361
361
|
"stixObjectOrStixRelationshipId", None
|
|
362
362
|
)
|
|
363
363
|
if id is not None and stix_object_or_stix_relationship_id is not None:
|
|
364
|
-
|
|
365
|
-
"Checking StixObjectOrStixRelationship
|
|
366
|
-
|
|
364
|
+
self.opencti.app_logger.info(
|
|
365
|
+
"Checking StixObjectOrStixRelationship in Opinion",
|
|
366
|
+
{
|
|
367
|
+
"id": id,
|
|
368
|
+
"stixObjectOrStixRelationshipId": stix_object_or_stix_relationship_id,
|
|
369
|
+
},
|
|
367
370
|
)
|
|
368
371
|
query = """
|
|
369
372
|
query OpinionContainsStixObjectOrStixRelationship($id: String!, $stixObjectOrStixRelationshipId: String!) {
|
|
@@ -379,7 +382,9 @@ class Opinion:
|
|
|
379
382
|
)
|
|
380
383
|
return result["data"]["opinionContainsStixObjectOrStixRelationship"]
|
|
381
384
|
else:
|
|
382
|
-
|
|
385
|
+
self.opencti.app_logger.error(
|
|
386
|
+
"[opencti_opinion] Missing parameters: id or entity_id"
|
|
387
|
+
)
|
|
383
388
|
|
|
384
389
|
"""
|
|
385
390
|
Create a Opinion object
|
|
@@ -408,7 +413,7 @@ class Opinion:
|
|
|
408
413
|
update = kwargs.get("update", False)
|
|
409
414
|
|
|
410
415
|
if opinion is not None:
|
|
411
|
-
|
|
416
|
+
self.opencti.app_logger.info("Creating Opinion", {"opinion": opinion})
|
|
412
417
|
query = """
|
|
413
418
|
mutation OpinionAdd($input: OpinionAddInput!) {
|
|
414
419
|
opinionAdd(input: $input) {
|
|
@@ -445,7 +450,9 @@ class Opinion:
|
|
|
445
450
|
)
|
|
446
451
|
return self.opencti.process_multiple_fields(result["data"]["opinionAdd"])
|
|
447
452
|
else:
|
|
448
|
-
|
|
453
|
+
self.opencti.app_logger.error(
|
|
454
|
+
"[opencti_opinion] Missing parameters: content"
|
|
455
|
+
)
|
|
449
456
|
|
|
450
457
|
"""
|
|
451
458
|
Add a Stix-Entity object to Opinion object (object_refs)
|
|
@@ -466,9 +473,12 @@ class Opinion:
|
|
|
466
473
|
stixObjectOrStixRelationshipId=stix_object_or_stix_relationship_id,
|
|
467
474
|
):
|
|
468
475
|
return True
|
|
469
|
-
|
|
470
|
-
"Adding StixObjectOrStixRelationship
|
|
471
|
-
|
|
476
|
+
self.opencti.app_logger.info(
|
|
477
|
+
"Adding StixObjectOrStixRelationship to Opinion",
|
|
478
|
+
{
|
|
479
|
+
"id": id,
|
|
480
|
+
"stixObjectOrStixRelationshipId": stix_object_or_stix_relationship_id,
|
|
481
|
+
},
|
|
472
482
|
)
|
|
473
483
|
query = """
|
|
474
484
|
mutation OpinionEdit($id: ID!, $input: StixRefRelationshipAddInput!) {
|
|
@@ -491,7 +501,7 @@ class Opinion:
|
|
|
491
501
|
)
|
|
492
502
|
return True
|
|
493
503
|
else:
|
|
494
|
-
|
|
504
|
+
self.opencti.app_logger.error(
|
|
495
505
|
"[opencti_opinion] Missing parameters: id and stix_object_or_stix_relationship_id",
|
|
496
506
|
)
|
|
497
507
|
return False
|
|
@@ -510,9 +520,12 @@ class Opinion:
|
|
|
510
520
|
"stixObjectOrStixRelationshipId", None
|
|
511
521
|
)
|
|
512
522
|
if id is not None and stix_object_or_stix_relationship_id is not None:
|
|
513
|
-
|
|
514
|
-
"Removing StixObjectOrStixRelationship
|
|
515
|
-
|
|
523
|
+
self.opencti.app_logger.info(
|
|
524
|
+
"Removing StixObjectOrStixRelationship to Opinion",
|
|
525
|
+
{
|
|
526
|
+
"id": id,
|
|
527
|
+
"stixObjectOrStixRelationshipId": stix_object_or_stix_relationship_id,
|
|
528
|
+
},
|
|
516
529
|
)
|
|
517
530
|
query = """
|
|
518
531
|
mutation OpinionEditRelationDelete($id: ID!, $toId: StixRef!, $relationship_type: String!) {
|
|
@@ -533,7 +546,9 @@ class Opinion:
|
|
|
533
546
|
)
|
|
534
547
|
return True
|
|
535
548
|
else:
|
|
536
|
-
|
|
549
|
+
self.opencti.app_logger.error(
|
|
550
|
+
"[opencti_opinion] Missing parameters: id and entity_id"
|
|
551
|
+
)
|
|
537
552
|
return False
|
|
538
553
|
|
|
539
554
|
"""
|
|
@@ -596,4 +611,6 @@ class Opinion:
|
|
|
596
611
|
update=update,
|
|
597
612
|
)
|
|
598
613
|
else:
|
|
599
|
-
|
|
614
|
+
self.opencti.app_logger.error(
|
|
615
|
+
"[opencti_opinion] Missing parameters: stixObject"
|
|
616
|
+
)
|