pycti 5.12.14__py3-none-any.whl → 5.12.15__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of pycti might be problematic. Click here for more details.
- pycti/__init__.py +1 -1
- pycti/api/__init__.py +0 -3
- pycti/api/opencti_api_client.py +10 -56
- pycti/api/opencti_api_connector.py +1 -2
- pycti/api/opencti_api_playbook.py +3 -4
- pycti/api/opencti_api_work.py +15 -12
- pycti/connector/__init__.py +0 -3
- pycti/connector/opencti_connector_helper.py +63 -58
- pycti/connector/opencti_metric_handler.py +8 -5
- pycti/entities/__init__.py +0 -3
- pycti/entities/opencti_attack_pattern.py +17 -11
- pycti/entities/opencti_campaign.py +15 -9
- pycti/entities/opencti_case_incident.py +39 -43
- pycti/entities/opencti_case_rfi.py +34 -46
- pycti/entities/opencti_case_rft.py +35 -44
- pycti/entities/opencti_channel.py +15 -9
- pycti/entities/opencti_course_of_action.py +15 -9
- pycti/entities/opencti_data_component.py +17 -14
- pycti/entities/opencti_data_source.py +12 -16
- pycti/entities/opencti_event.py +15 -9
- pycti/entities/opencti_external_reference.py +20 -15
- pycti/entities/opencti_feedback.py +36 -46
- pycti/entities/opencti_grouping.py +22 -20
- pycti/entities/opencti_identity.py +15 -8
- pycti/entities/opencti_incident.py +13 -9
- pycti/entities/opencti_indicator.py +18 -15
- pycti/entities/opencti_infrastructure.py +15 -9
- pycti/entities/opencti_intrusion_set.py +12 -8
- pycti/entities/opencti_kill_chain_phase.py +16 -12
- pycti/entities/opencti_label.py +16 -12
- pycti/entities/opencti_language.py +13 -9
- pycti/entities/opencti_location.py +13 -9
- pycti/entities/opencti_malware.py +15 -9
- pycti/entities/opencti_malware_analysis.py +17 -9
- pycti/entities/opencti_marking_definition.py +15 -11
- pycti/entities/opencti_narrative.py +15 -9
- pycti/entities/opencti_note.py +35 -20
- pycti/entities/opencti_observed_data.py +34 -19
- pycti/entities/opencti_opinion.py +37 -20
- pycti/entities/opencti_report.py +36 -20
- pycti/entities/opencti_stix.py +8 -19
- pycti/entities/opencti_stix_core_object.py +15 -9
- pycti/entities/opencti_stix_core_relationship.py +69 -52
- pycti/entities/opencti_stix_cyber_observable.py +78 -62
- pycti/entities/opencti_stix_domain_object.py +75 -55
- pycti/entities/opencti_stix_nested_ref_relationship.py +21 -14
- pycti/entities/opencti_stix_object_or_stix_relationship.py +4 -7
- pycti/entities/opencti_stix_sighting_relationship.py +34 -26
- pycti/entities/opencti_task.py +37 -44
- pycti/entities/opencti_threat_actor.py +7 -4
- pycti/entities/opencti_threat_actor_group.py +10 -8
- pycti/entities/opencti_threat_actor_individual.py +10 -9
- pycti/entities/opencti_tool.py +15 -9
- pycti/entities/opencti_vocabulary.py +11 -13
- pycti/entities/opencti_vulnerability.py +15 -9
- pycti/utils/opencti_logger.py +64 -0
- pycti/utils/opencti_stix2.py +30 -24
- pycti/utils/opencti_stix2_update.py +2 -6
- {pycti-5.12.14.dist-info → pycti-5.12.15.dist-info}/METADATA +1 -1
- pycti-5.12.15.dist-info/RECORD +68 -0
- pycti-5.12.14.dist-info/RECORD +0 -67
- {pycti-5.12.14.dist-info → pycti-5.12.15.dist-info}/LICENSE +0 -0
- {pycti-5.12.14.dist-info → pycti-5.12.15.dist-info}/WHEEL +0 -0
- {pycti-5.12.14.dist-info → pycti-5.12.15.dist-info}/top_level.txt +0 -0
|
@@ -5,8 +5,6 @@ import os
|
|
|
5
5
|
|
|
6
6
|
import magic
|
|
7
7
|
|
|
8
|
-
from pycti.entities import LOGGER
|
|
9
|
-
|
|
10
8
|
|
|
11
9
|
class StixDomainObject:
|
|
12
10
|
def __init__(self, opencti, file):
|
|
@@ -1069,7 +1067,9 @@ class StixDomainObject:
|
|
|
1069
1067
|
if get_all:
|
|
1070
1068
|
first = 100
|
|
1071
1069
|
|
|
1072
|
-
|
|
1070
|
+
self.opencti.app_logger.info(
|
|
1071
|
+
"Listing Stix-Domain-Objects with filters", {"filters": json.dumps(filters)}
|
|
1072
|
+
)
|
|
1073
1073
|
query = (
|
|
1074
1074
|
"""
|
|
1075
1075
|
query StixDomainObjects($types: [String], $filters: FilterGroup, $search: String, $relationship_type: [String], $elementId: String, $first: Int, $after: ID, $orderBy: StixDomainObjectsOrdering, $orderMode: OrderingMode) {
|
|
@@ -1117,7 +1117,9 @@ class StixDomainObject:
|
|
|
1117
1117
|
final_data = final_data + data
|
|
1118
1118
|
while result["data"]["stixDomainObjects"]["pageInfo"]["hasNextPage"]:
|
|
1119
1119
|
after = result["data"]["stixDomainObjects"]["pageInfo"]["endCursor"]
|
|
1120
|
-
|
|
1120
|
+
self.opencti.app_logger.info(
|
|
1121
|
+
"Listing Stix-Domain-Objects", {"after": after}
|
|
1122
|
+
)
|
|
1121
1123
|
result = self.opencti.query(
|
|
1122
1124
|
query,
|
|
1123
1125
|
{
|
|
@@ -1158,7 +1160,7 @@ class StixDomainObject:
|
|
|
1158
1160
|
custom_attributes = kwargs.get("customAttributes", None)
|
|
1159
1161
|
with_files = kwargs.get("withFiles", False)
|
|
1160
1162
|
if id is not None:
|
|
1161
|
-
|
|
1163
|
+
self.opencti.app_logger.info("Reading Stix-Domain-Object", {"id": id})
|
|
1162
1164
|
query = (
|
|
1163
1165
|
"""
|
|
1164
1166
|
query StixDomainObject($id: String!) {
|
|
@@ -1187,7 +1189,7 @@ class StixDomainObject:
|
|
|
1187
1189
|
else:
|
|
1188
1190
|
return None
|
|
1189
1191
|
else:
|
|
1190
|
-
|
|
1192
|
+
self.opencti.app_logger.error(
|
|
1191
1193
|
"[opencti_stix_domain_object] Missing parameters: id or filters"
|
|
1192
1194
|
)
|
|
1193
1195
|
return None
|
|
@@ -1256,7 +1258,7 @@ class StixDomainObject:
|
|
|
1256
1258
|
id = kwargs.get("id", None)
|
|
1257
1259
|
input = kwargs.get("input", None)
|
|
1258
1260
|
if id is not None and input is not None:
|
|
1259
|
-
|
|
1261
|
+
self.opencti.app_logger.info("Updating Stix-Domain-Object", {"id": id})
|
|
1260
1262
|
query = """
|
|
1261
1263
|
mutation StixDomainObjectEdit($id: ID!, $input: [EditInput]!) {
|
|
1262
1264
|
stixDomainObjectEdit(id: $id) {
|
|
@@ -1279,7 +1281,7 @@ class StixDomainObject:
|
|
|
1279
1281
|
result["data"]["stixDomainObjectEdit"]["fieldPatch"]
|
|
1280
1282
|
)
|
|
1281
1283
|
else:
|
|
1282
|
-
|
|
1284
|
+
self.opencti.app_logger.error(
|
|
1283
1285
|
"[opencti_stix_domain_object] Missing parameters: id and input"
|
|
1284
1286
|
)
|
|
1285
1287
|
return None
|
|
@@ -1294,7 +1296,7 @@ class StixDomainObject:
|
|
|
1294
1296
|
def delete(self, **kwargs):
|
|
1295
1297
|
id = kwargs.get("id", None)
|
|
1296
1298
|
if id is not None:
|
|
1297
|
-
|
|
1299
|
+
self.opencti.app_logger.info("Deleting Stix-Domain-Object", {"id": id})
|
|
1298
1300
|
query = """
|
|
1299
1301
|
mutation StixDomainObjectEdit($id: ID!) {
|
|
1300
1302
|
stixDomainObjectEdit(id: $id) {
|
|
@@ -1304,7 +1306,9 @@ class StixDomainObject:
|
|
|
1304
1306
|
"""
|
|
1305
1307
|
self.opencti.query(query, {"id": id})
|
|
1306
1308
|
else:
|
|
1307
|
-
|
|
1309
|
+
self.opencti.app_logger.error(
|
|
1310
|
+
"[opencti_stix_domain_object] Missing parameters: id"
|
|
1311
|
+
)
|
|
1308
1312
|
return None
|
|
1309
1313
|
|
|
1310
1314
|
"""
|
|
@@ -1340,8 +1344,9 @@ class StixDomainObject:
|
|
|
1340
1344
|
mime_type = "application/json"
|
|
1341
1345
|
else:
|
|
1342
1346
|
mime_type = magic.from_file(file_name, mime=True)
|
|
1343
|
-
|
|
1344
|
-
"Uploading a file
|
|
1347
|
+
self.opencti.app_logger.info(
|
|
1348
|
+
"Uploading a file in Stix-Domain-Object",
|
|
1349
|
+
{"file": final_file_name, "id": id},
|
|
1345
1350
|
)
|
|
1346
1351
|
return self.opencti.query(
|
|
1347
1352
|
query,
|
|
@@ -1354,7 +1359,7 @@ class StixDomainObject:
|
|
|
1354
1359
|
},
|
|
1355
1360
|
)
|
|
1356
1361
|
else:
|
|
1357
|
-
|
|
1362
|
+
self.opencti.app_logger.error(
|
|
1358
1363
|
"[opencti_stix_domain_object] Missing parameters: id or file_name"
|
|
1359
1364
|
)
|
|
1360
1365
|
return None
|
|
@@ -1406,10 +1411,9 @@ class StixDomainObject:
|
|
|
1406
1411
|
id = kwargs.get("id", None)
|
|
1407
1412
|
identity_id = kwargs.get("identity_id", None)
|
|
1408
1413
|
if id is not None:
|
|
1409
|
-
|
|
1410
|
-
"Updating author of Stix-Domain-Object
|
|
1411
|
-
id,
|
|
1412
|
-
identity_id,
|
|
1414
|
+
self.opencti.app_logger.info(
|
|
1415
|
+
"Updating author of Stix-Domain-Object with Identity",
|
|
1416
|
+
{"id": id, "identity_id": identity_id},
|
|
1413
1417
|
)
|
|
1414
1418
|
custom_attributes = """
|
|
1415
1419
|
id
|
|
@@ -1474,7 +1478,7 @@ class StixDomainObject:
|
|
|
1474
1478
|
}
|
|
1475
1479
|
self.opencti.query(query, variables)
|
|
1476
1480
|
else:
|
|
1477
|
-
|
|
1481
|
+
self.opencti.app_logger.error("Missing parameters: id")
|
|
1478
1482
|
return False
|
|
1479
1483
|
|
|
1480
1484
|
"""
|
|
@@ -1509,14 +1513,16 @@ class StixDomainObject:
|
|
|
1509
1513
|
"""
|
|
1510
1514
|
stix_domain_object = self.read(id=id, customAttributes=custom_attributes)
|
|
1511
1515
|
if stix_domain_object is None:
|
|
1512
|
-
|
|
1516
|
+
self.opencti.app_logger.error(
|
|
1517
|
+
"Cannot add Marking-Definition, entity not found"
|
|
1518
|
+
)
|
|
1513
1519
|
return False
|
|
1514
1520
|
if marking_definition_id in stix_domain_object["objectMarkingIds"]:
|
|
1515
1521
|
return True
|
|
1516
1522
|
else:
|
|
1517
|
-
|
|
1518
|
-
"Adding Marking-Definition
|
|
1519
|
-
|
|
1523
|
+
self.opencti.app_logger.info(
|
|
1524
|
+
"Adding Marking-Definition to Stix-Domain-Object",
|
|
1525
|
+
{"marking_definition_id": marking_definition_id, "id": id},
|
|
1520
1526
|
)
|
|
1521
1527
|
query = """
|
|
1522
1528
|
mutation StixDomainObjectAddRelation($id: ID!, $input: StixRefRelationshipAddInput!) {
|
|
@@ -1539,7 +1545,9 @@ class StixDomainObject:
|
|
|
1539
1545
|
)
|
|
1540
1546
|
return True
|
|
1541
1547
|
else:
|
|
1542
|
-
|
|
1548
|
+
self.opencti.app_logger.error(
|
|
1549
|
+
"Missing parameters: id and marking_definition_id"
|
|
1550
|
+
)
|
|
1543
1551
|
return False
|
|
1544
1552
|
|
|
1545
1553
|
"""
|
|
@@ -1554,9 +1562,9 @@ class StixDomainObject:
|
|
|
1554
1562
|
id = kwargs.get("id", None)
|
|
1555
1563
|
marking_definition_id = kwargs.get("marking_definition_id", None)
|
|
1556
1564
|
if id is not None and marking_definition_id is not None:
|
|
1557
|
-
|
|
1558
|
-
"Removing Marking-Definition
|
|
1559
|
-
|
|
1565
|
+
self.opencti.app_logger.info(
|
|
1566
|
+
"Removing Marking-Definition from Stix-Domain-Object",
|
|
1567
|
+
{"marking_definition_id": marking_definition_id, "id": id},
|
|
1560
1568
|
)
|
|
1561
1569
|
query = """
|
|
1562
1570
|
mutation StixDomainObjectRemoveRelation($id: ID!, $toId: StixRef!, $relationship_type: String!) {
|
|
@@ -1577,7 +1585,7 @@ class StixDomainObject:
|
|
|
1577
1585
|
)
|
|
1578
1586
|
return True
|
|
1579
1587
|
else:
|
|
1580
|
-
|
|
1588
|
+
self.opencti.app_logger.error("Missing parameters: id and label_id")
|
|
1581
1589
|
return False
|
|
1582
1590
|
|
|
1583
1591
|
"""
|
|
@@ -1606,7 +1614,9 @@ class StixDomainObject:
|
|
|
1606
1614
|
label = self.opencti.label.create(value=label_name)
|
|
1607
1615
|
label_id = label["id"]
|
|
1608
1616
|
if id is not None and label_id is not None:
|
|
1609
|
-
|
|
1617
|
+
self.opencti.app_logger.info(
|
|
1618
|
+
"Adding label to Stix-Domain-Object", {"label_id": label_id, "id": id}
|
|
1619
|
+
)
|
|
1610
1620
|
query = """
|
|
1611
1621
|
mutation StixDomainObjectAddRelation($id: ID!, $input: StixRefRelationshipAddInput!) {
|
|
1612
1622
|
stixDomainObjectEdit(id: $id) {
|
|
@@ -1628,7 +1638,7 @@ class StixDomainObject:
|
|
|
1628
1638
|
)
|
|
1629
1639
|
return True
|
|
1630
1640
|
else:
|
|
1631
|
-
|
|
1641
|
+
self.opencti.app_logger.error("Missing parameters: id and label_id")
|
|
1632
1642
|
return False
|
|
1633
1643
|
|
|
1634
1644
|
"""
|
|
@@ -1654,8 +1664,9 @@ class StixDomainObject:
|
|
|
1654
1664
|
if label:
|
|
1655
1665
|
label_id = label["id"]
|
|
1656
1666
|
if id is not None and label_id is not None:
|
|
1657
|
-
|
|
1658
|
-
"Removing label
|
|
1667
|
+
self.opencti.app_logger.info(
|
|
1668
|
+
"Removing label from Stix-Domain-Object",
|
|
1669
|
+
{"label_id": label_id, "id": id},
|
|
1659
1670
|
)
|
|
1660
1671
|
query = """
|
|
1661
1672
|
mutation StixDomainObjectRemoveRelation($id: ID!, $toId: StixRef!, $relationship_type: String!) {
|
|
@@ -1676,7 +1687,7 @@ class StixDomainObject:
|
|
|
1676
1687
|
)
|
|
1677
1688
|
return True
|
|
1678
1689
|
else:
|
|
1679
|
-
|
|
1690
|
+
self.opencti.app_logger.error("Missing parameters: id and label_id")
|
|
1680
1691
|
return False
|
|
1681
1692
|
|
|
1682
1693
|
"""
|
|
@@ -1691,9 +1702,9 @@ class StixDomainObject:
|
|
|
1691
1702
|
id = kwargs.get("id", None)
|
|
1692
1703
|
external_reference_id = kwargs.get("external_reference_id", None)
|
|
1693
1704
|
if id is not None and external_reference_id is not None:
|
|
1694
|
-
|
|
1695
|
-
"Adding External-Reference
|
|
1696
|
-
|
|
1705
|
+
self.opencti.app_logger.info(
|
|
1706
|
+
"Adding External-Reference to Stix-Domain-Object",
|
|
1707
|
+
{"external_reference_id": external_reference_id, "id": id},
|
|
1697
1708
|
)
|
|
1698
1709
|
query = """
|
|
1699
1710
|
mutation StixDomainObjectEditRelationAdd($id: ID!, $input: StixRefRelationshipAddInput!) {
|
|
@@ -1716,7 +1727,9 @@ class StixDomainObject:
|
|
|
1716
1727
|
)
|
|
1717
1728
|
return True
|
|
1718
1729
|
else:
|
|
1719
|
-
|
|
1730
|
+
self.opencti.app_logger.error(
|
|
1731
|
+
"Missing parameters: id and external_reference_id"
|
|
1732
|
+
)
|
|
1720
1733
|
return False
|
|
1721
1734
|
|
|
1722
1735
|
"""
|
|
@@ -1731,9 +1744,9 @@ class StixDomainObject:
|
|
|
1731
1744
|
id = kwargs.get("id", None)
|
|
1732
1745
|
external_reference_id = kwargs.get("external_reference_id", None)
|
|
1733
1746
|
if id is not None and external_reference_id is not None:
|
|
1734
|
-
|
|
1735
|
-
"Removing External-Reference
|
|
1736
|
-
|
|
1747
|
+
self.opencti.app_logger.info(
|
|
1748
|
+
"Removing External-Reference from Stix-Domain-Object",
|
|
1749
|
+
{"external_reference_id": external_reference_id, "id": id},
|
|
1737
1750
|
)
|
|
1738
1751
|
query = """
|
|
1739
1752
|
mutation StixDomainObjectRemoveRelation($id: ID!, $toId: StixRef!, $relationship_type: String!) {
|
|
@@ -1754,7 +1767,7 @@ class StixDomainObject:
|
|
|
1754
1767
|
)
|
|
1755
1768
|
return True
|
|
1756
1769
|
else:
|
|
1757
|
-
|
|
1770
|
+
self.opencti.app_logger.error("Missing parameters: id and label_id")
|
|
1758
1771
|
return False
|
|
1759
1772
|
|
|
1760
1773
|
"""
|
|
@@ -1769,10 +1782,9 @@ class StixDomainObject:
|
|
|
1769
1782
|
id = kwargs.get("id", None)
|
|
1770
1783
|
kill_chain_phase_id = kwargs.get("kill_chain_phase_id", None)
|
|
1771
1784
|
if id is not None and kill_chain_phase_id is not None:
|
|
1772
|
-
|
|
1773
|
-
"Adding Kill-Chain-Phase
|
|
1774
|
-
kill_chain_phase_id,
|
|
1775
|
-
id,
|
|
1785
|
+
self.opencti.app_logger.info(
|
|
1786
|
+
"Adding Kill-Chain-Phase to Stix-Domain-Object",
|
|
1787
|
+
{"kill_chain_phase_id": kill_chain_phase_id, "id": id},
|
|
1776
1788
|
)
|
|
1777
1789
|
query = """
|
|
1778
1790
|
mutation StixDomainObjectAddRelation($id: ID!, $input: StixRefRelationshipAddInput!) {
|
|
@@ -1795,7 +1807,9 @@ class StixDomainObject:
|
|
|
1795
1807
|
)
|
|
1796
1808
|
return True
|
|
1797
1809
|
else:
|
|
1798
|
-
|
|
1810
|
+
self.opencti.app_logger.error(
|
|
1811
|
+
"Missing parameters: id and kill_chain_phase_id"
|
|
1812
|
+
)
|
|
1799
1813
|
return False
|
|
1800
1814
|
|
|
1801
1815
|
"""
|
|
@@ -1810,9 +1824,9 @@ class StixDomainObject:
|
|
|
1810
1824
|
id = kwargs.get("id", None)
|
|
1811
1825
|
kill_chain_phase_id = kwargs.get("kill_chain_phase_id", None)
|
|
1812
1826
|
if id is not None and kill_chain_phase_id is not None:
|
|
1813
|
-
|
|
1814
|
-
"Removing Kill-Chain-Phase
|
|
1815
|
-
|
|
1827
|
+
self.opencti.app_logger.info(
|
|
1828
|
+
"Removing Kill-Chain-Phase from Stix-Domain-Object",
|
|
1829
|
+
{"kill_chain_phase_id": kill_chain_phase_id, "id": id},
|
|
1816
1830
|
)
|
|
1817
1831
|
query = """
|
|
1818
1832
|
mutation StixDomainObjectRemoveRelation($id: ID!, $toId: StixRef!, $relationship_type: String!) {
|
|
@@ -1833,7 +1847,7 @@ class StixDomainObject:
|
|
|
1833
1847
|
)
|
|
1834
1848
|
return True
|
|
1835
1849
|
else:
|
|
1836
|
-
|
|
1850
|
+
self.opencti.app_logger.error(
|
|
1837
1851
|
"[stix_domain_object] Missing parameters: id and kill_chain_phase_id"
|
|
1838
1852
|
)
|
|
1839
1853
|
return False
|
|
@@ -1848,7 +1862,9 @@ class StixDomainObject:
|
|
|
1848
1862
|
def reports(self, **kwargs):
|
|
1849
1863
|
id = kwargs.get("id", None)
|
|
1850
1864
|
if id is not None:
|
|
1851
|
-
|
|
1865
|
+
self.opencti.app_logger.info(
|
|
1866
|
+
"Getting reports of the Stix-Domain-Object", {"id": id}
|
|
1867
|
+
)
|
|
1852
1868
|
query = """
|
|
1853
1869
|
query StixDomainObject($id: String!) {
|
|
1854
1870
|
stixDomainObject(id: $id) {
|
|
@@ -1972,7 +1988,7 @@ class StixDomainObject:
|
|
|
1972
1988
|
else:
|
|
1973
1989
|
return []
|
|
1974
1990
|
else:
|
|
1975
|
-
|
|
1991
|
+
self.opencti.app_logger.error("Missing parameters: id")
|
|
1976
1992
|
return None
|
|
1977
1993
|
|
|
1978
1994
|
"""
|
|
@@ -1985,7 +2001,9 @@ class StixDomainObject:
|
|
|
1985
2001
|
def notes(self, **kwargs):
|
|
1986
2002
|
id = kwargs.get("id", None)
|
|
1987
2003
|
if id is not None:
|
|
1988
|
-
|
|
2004
|
+
self.opencti.app_logger.info(
|
|
2005
|
+
"Getting notes of the Stix-Domain-Object", {"id": id}
|
|
2006
|
+
)
|
|
1989
2007
|
query = """
|
|
1990
2008
|
query StixDomainObject($id: String!) {
|
|
1991
2009
|
stixDomainObject(id: $id) {
|
|
@@ -2110,7 +2128,7 @@ class StixDomainObject:
|
|
|
2110
2128
|
else:
|
|
2111
2129
|
return []
|
|
2112
2130
|
else:
|
|
2113
|
-
|
|
2131
|
+
self.opencti.app_logger.error("Missing parameters: id")
|
|
2114
2132
|
return None
|
|
2115
2133
|
|
|
2116
2134
|
"""
|
|
@@ -2123,7 +2141,9 @@ class StixDomainObject:
|
|
|
2123
2141
|
def observed_data(self, **kwargs):
|
|
2124
2142
|
id = kwargs.get("id", None)
|
|
2125
2143
|
if id is not None:
|
|
2126
|
-
|
|
2144
|
+
self.opencti.app_logger.info(
|
|
2145
|
+
"Getting Observed-Data of the Stix-Domain-Object", {"id": id}
|
|
2146
|
+
)
|
|
2127
2147
|
query = """
|
|
2128
2148
|
query StixDomainObject($id: String!) {
|
|
2129
2149
|
stixDomainObject(id: $id) {
|
|
@@ -2259,5 +2279,5 @@ class StixDomainObject:
|
|
|
2259
2279
|
else:
|
|
2260
2280
|
return []
|
|
2261
2281
|
else:
|
|
2262
|
-
|
|
2282
|
+
self.opencti.app_logger.error("Missing parameters: id")
|
|
2263
2283
|
return None
|
|
@@ -1,8 +1,3 @@
|
|
|
1
|
-
# coding: utf-8
|
|
2
|
-
|
|
3
|
-
from pycti.entities import LOGGER
|
|
4
|
-
|
|
5
|
-
|
|
6
1
|
class StixNestedRefRelationship:
|
|
7
2
|
def __init__(self, opencti):
|
|
8
3
|
self.opencti = opencti
|
|
@@ -102,9 +97,13 @@ class StixNestedRefRelationship:
|
|
|
102
97
|
if get_all:
|
|
103
98
|
first = 500
|
|
104
99
|
|
|
105
|
-
|
|
106
|
-
"Listing stix_nested_ref_relationships
|
|
107
|
-
|
|
100
|
+
self.opencti.app_logger.info(
|
|
101
|
+
"Listing stix_nested_ref_relationships",
|
|
102
|
+
{
|
|
103
|
+
"relationship_type": relationship_type,
|
|
104
|
+
"from_id": from_id,
|
|
105
|
+
"to_id": to_id,
|
|
106
|
+
},
|
|
108
107
|
)
|
|
109
108
|
query = (
|
|
110
109
|
"""
|
|
@@ -180,7 +179,9 @@ class StixNestedRefRelationship:
|
|
|
180
179
|
stop_time_stop = kwargs.get("stopTimeStop", None)
|
|
181
180
|
custom_attributes = kwargs.get("customAttributes", None)
|
|
182
181
|
if id is not None:
|
|
183
|
-
|
|
182
|
+
self.opencti.app_logger.info(
|
|
183
|
+
"Reading stix_observable_relationship", {"id": id}
|
|
184
|
+
)
|
|
184
185
|
query = (
|
|
185
186
|
"""
|
|
186
187
|
query StixRefRelationship($id: String!) {
|
|
@@ -244,9 +245,13 @@ class StixNestedRefRelationship:
|
|
|
244
245
|
elif relationship_type == "content":
|
|
245
246
|
relationship_type = "obs_content"
|
|
246
247
|
|
|
247
|
-
|
|
248
|
-
"Creating stix_observable_relationship
|
|
249
|
-
|
|
248
|
+
self.opencti.app_logger.info(
|
|
249
|
+
"Creating stix_observable_relationship",
|
|
250
|
+
{
|
|
251
|
+
"relationship_type": relationship_type,
|
|
252
|
+
"from_id": from_id,
|
|
253
|
+
"to_id": to_id,
|
|
254
|
+
},
|
|
250
255
|
)
|
|
251
256
|
query = """
|
|
252
257
|
mutation StixRefRelationshipAdd($input: StixRefRelationshipAddInput!) {
|
|
@@ -293,7 +298,9 @@ class StixNestedRefRelationship:
|
|
|
293
298
|
id = kwargs.get("id", None)
|
|
294
299
|
input = kwargs.get("input", None)
|
|
295
300
|
if id is not None and input is not None:
|
|
296
|
-
|
|
301
|
+
self.opencti.app_logger.info(
|
|
302
|
+
"Updating stix_observable_relationship", {"id": id}
|
|
303
|
+
)
|
|
297
304
|
query = (
|
|
298
305
|
"""
|
|
299
306
|
mutation StixRefRelationshipEdit($id: ID!, $input: [EditInput]!) {
|
|
@@ -312,5 +319,5 @@ class StixNestedRefRelationship:
|
|
|
312
319
|
result["data"]["stixRefRelationshipEdit"]["fieldPatch"]
|
|
313
320
|
)
|
|
314
321
|
else:
|
|
315
|
-
|
|
322
|
+
self.opencti.app_logger.error("Missing parameters: id and key and value")
|
|
316
323
|
return None
|
|
@@ -1,8 +1,3 @@
|
|
|
1
|
-
# coding: utf-8
|
|
2
|
-
|
|
3
|
-
from pycti.entities import LOGGER
|
|
4
|
-
|
|
5
|
-
|
|
6
1
|
class StixObjectOrStixRelationship:
|
|
7
2
|
def __init__(self, opencti):
|
|
8
3
|
self.opencti = opencti
|
|
@@ -511,7 +506,9 @@ class StixObjectOrStixRelationship:
|
|
|
511
506
|
id = kwargs.get("id", None)
|
|
512
507
|
custom_attributes = kwargs.get("customAttributes", None)
|
|
513
508
|
if id is not None:
|
|
514
|
-
|
|
509
|
+
self.opencti.app_logger.info(
|
|
510
|
+
"Reading StixObjectOrStixRelationship", {"id": id}
|
|
511
|
+
)
|
|
515
512
|
query = (
|
|
516
513
|
"""
|
|
517
514
|
query StixObjectOrStixRelationship($id: String!) {
|
|
@@ -532,5 +529,5 @@ class StixObjectOrStixRelationship:
|
|
|
532
529
|
result["data"]["stixObjectOrStixRelationship"]
|
|
533
530
|
)
|
|
534
531
|
else:
|
|
535
|
-
|
|
532
|
+
self.opencti.app_logger.error("Missing parameters: id")
|
|
536
533
|
return None
|
|
@@ -5,8 +5,6 @@ import uuid
|
|
|
5
5
|
|
|
6
6
|
from stix2.canonicalization.Canonicalize import canonicalize
|
|
7
7
|
|
|
8
|
-
from pycti.entities import LOGGER
|
|
9
|
-
|
|
10
8
|
|
|
11
9
|
class StixSightingRelationship:
|
|
12
10
|
def __init__(self, opencti):
|
|
@@ -328,9 +326,9 @@ class StixSightingRelationship:
|
|
|
328
326
|
if get_all:
|
|
329
327
|
first = 100
|
|
330
328
|
|
|
331
|
-
|
|
332
|
-
"Listing stix_sighting with {type: stix_sighting
|
|
333
|
-
|
|
329
|
+
self.opencti.app_logger.info(
|
|
330
|
+
"Listing stix_sighting with {type: stix_sighting}",
|
|
331
|
+
{"from_id": from_id, "to_id": to_id},
|
|
334
332
|
)
|
|
335
333
|
query = (
|
|
336
334
|
"""
|
|
@@ -385,7 +383,9 @@ class StixSightingRelationship:
|
|
|
385
383
|
after = result["data"]["stixSightingRelationships"]["pageInfo"][
|
|
386
384
|
"endCursor"
|
|
387
385
|
]
|
|
388
|
-
|
|
386
|
+
self.opencti.app_logger.info(
|
|
387
|
+
"Listing StixSightingRelationships", {"after": after}
|
|
388
|
+
)
|
|
389
389
|
result = self.opencti.query(
|
|
390
390
|
query,
|
|
391
391
|
{
|
|
@@ -439,7 +439,7 @@ class StixSightingRelationship:
|
|
|
439
439
|
last_seen_stop = kwargs.get("lastSeenStop", None)
|
|
440
440
|
custom_attributes = kwargs.get("customAttributes", None)
|
|
441
441
|
if id is not None:
|
|
442
|
-
|
|
442
|
+
self.opencti.app_logger.info("Reading stix_sighting", {"id": id})
|
|
443
443
|
query = (
|
|
444
444
|
"""
|
|
445
445
|
query StixSightingRelationship($id: String!) {
|
|
@@ -474,7 +474,7 @@ class StixSightingRelationship:
|
|
|
474
474
|
else:
|
|
475
475
|
return None
|
|
476
476
|
else:
|
|
477
|
-
|
|
477
|
+
self.opencti.app_logger.error("Missing parameters: id or from_id and to_id")
|
|
478
478
|
return None
|
|
479
479
|
|
|
480
480
|
"""
|
|
@@ -503,7 +503,9 @@ class StixSightingRelationship:
|
|
|
503
503
|
x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None)
|
|
504
504
|
update = kwargs.get("update", False)
|
|
505
505
|
|
|
506
|
-
|
|
506
|
+
self.opencti.app_logger.info(
|
|
507
|
+
"Creating stix_sighting", {"from_id": from_id, "to_id": to_id}
|
|
508
|
+
)
|
|
507
509
|
query = """
|
|
508
510
|
mutation StixSightingRelationshipAdd($input: StixSightingRelationshipAddInput!) {
|
|
509
511
|
stixSightingRelationshipAdd(input: $input) {
|
|
@@ -554,7 +556,7 @@ class StixSightingRelationship:
|
|
|
554
556
|
id = kwargs.get("id", None)
|
|
555
557
|
input = kwargs.get("input", None)
|
|
556
558
|
if id is not None and input is not None:
|
|
557
|
-
|
|
559
|
+
self.opencti.app_logger.info("Updating stix_sighting", {"id": id})
|
|
558
560
|
query = """
|
|
559
561
|
mutation StixSightingRelationshipEdit($id: ID!, $input: [EditInput]!) {
|
|
560
562
|
stixSightingRelationshipEdit(id: $id) {
|
|
@@ -575,7 +577,7 @@ class StixSightingRelationship:
|
|
|
575
577
|
result["data"]["stixSightingRelationshipEdit"]["fieldPatch"]
|
|
576
578
|
)
|
|
577
579
|
else:
|
|
578
|
-
|
|
580
|
+
self.opencti.app_logger.error(
|
|
579
581
|
"[opencti_stix_sighting] Missing parameters: id and key and value"
|
|
580
582
|
)
|
|
581
583
|
return None
|
|
@@ -614,14 +616,16 @@ class StixSightingRelationship:
|
|
|
614
616
|
id=id, customAttributes=custom_attributes
|
|
615
617
|
)
|
|
616
618
|
if stix_core_relationship is None:
|
|
617
|
-
|
|
619
|
+
self.opencti.app_logger.error(
|
|
620
|
+
"Cannot add Marking-Definition, entity not found"
|
|
621
|
+
)
|
|
618
622
|
return False
|
|
619
623
|
if marking_definition_id in stix_core_relationship["objectMarkingIds"]:
|
|
620
624
|
return True
|
|
621
625
|
else:
|
|
622
|
-
|
|
623
|
-
"Adding Marking-Definition
|
|
624
|
-
|
|
626
|
+
self.opencti.app_logger.info(
|
|
627
|
+
"Adding Marking-Definition to stix_sighting_relationship",
|
|
628
|
+
{"marking_definition_id": marking_definition_id, "id": id},
|
|
625
629
|
)
|
|
626
630
|
query = """
|
|
627
631
|
mutation StixSightingRelationshipEdit($id: ID!, $input: StixRefRelationshipAddInput!) {
|
|
@@ -644,7 +648,9 @@ class StixSightingRelationship:
|
|
|
644
648
|
)
|
|
645
649
|
return True
|
|
646
650
|
else:
|
|
647
|
-
|
|
651
|
+
self.opencti.app_logger.error(
|
|
652
|
+
"Missing parameters: id and marking_definition_id"
|
|
653
|
+
)
|
|
648
654
|
return False
|
|
649
655
|
|
|
650
656
|
"""
|
|
@@ -659,9 +665,9 @@ class StixSightingRelationship:
|
|
|
659
665
|
id = kwargs.get("id", None)
|
|
660
666
|
marking_definition_id = kwargs.get("marking_definition_id", None)
|
|
661
667
|
if id is not None and marking_definition_id is not None:
|
|
662
|
-
|
|
663
|
-
"Removing Marking-Definition
|
|
664
|
-
|
|
668
|
+
self.opencti.app_logger.info(
|
|
669
|
+
"Removing Marking-Definition from stix_sighting_relationship",
|
|
670
|
+
{"marking_definition_id": marking_definition_id, "id": id},
|
|
665
671
|
)
|
|
666
672
|
query = """
|
|
667
673
|
mutation StixSightingRelationshipEdit($id: ID!, $toId: StixRef!, $relationship_type: String!) {
|
|
@@ -682,7 +688,7 @@ class StixSightingRelationship:
|
|
|
682
688
|
)
|
|
683
689
|
return True
|
|
684
690
|
else:
|
|
685
|
-
|
|
691
|
+
self.opencti.app_logger.error("Missing parameters: id and label_id")
|
|
686
692
|
return False
|
|
687
693
|
|
|
688
694
|
"""
|
|
@@ -697,9 +703,9 @@ class StixSightingRelationship:
|
|
|
697
703
|
id = kwargs.get("id", None)
|
|
698
704
|
identity_id = kwargs.get("identity_id", None)
|
|
699
705
|
if id is not None:
|
|
700
|
-
|
|
701
|
-
"Updating author of stix_sighting_relationship
|
|
702
|
-
|
|
706
|
+
self.opencti.app_logger.info(
|
|
707
|
+
"Updating author of stix_sighting_relationship with Identity",
|
|
708
|
+
{"id": id, "identity_id": identity_id},
|
|
703
709
|
)
|
|
704
710
|
custom_attributes = """
|
|
705
711
|
id
|
|
@@ -764,7 +770,7 @@ class StixSightingRelationship:
|
|
|
764
770
|
}
|
|
765
771
|
self.opencti.query(query, variables)
|
|
766
772
|
else:
|
|
767
|
-
|
|
773
|
+
self.opencti.app_logger.error("Missing parameters: id")
|
|
768
774
|
return False
|
|
769
775
|
|
|
770
776
|
"""
|
|
@@ -777,7 +783,7 @@ class StixSightingRelationship:
|
|
|
777
783
|
def delete(self, **kwargs):
|
|
778
784
|
id = kwargs.get("id", None)
|
|
779
785
|
if id is not None:
|
|
780
|
-
|
|
786
|
+
self.opencti.app_logger.info("Deleting stix_sighting", {"id": id})
|
|
781
787
|
query = """
|
|
782
788
|
mutation StixSightingRelationshipEdit($id: ID!) {
|
|
783
789
|
stixSightingRelationshipEdit(id: $id) {
|
|
@@ -787,5 +793,7 @@ class StixSightingRelationship:
|
|
|
787
793
|
"""
|
|
788
794
|
self.opencti.query(query, {"id": id})
|
|
789
795
|
else:
|
|
790
|
-
|
|
796
|
+
self.opencti.app_logger.error(
|
|
797
|
+
"[opencti_stix_sighting] Missing parameters: id"
|
|
798
|
+
)
|
|
791
799
|
return None
|