pycti 5.12.21__py3-none-any.whl → 5.12.23__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of pycti might be problematic. Click here for more details.
- pycti/__init__.py +1 -1
- pycti/connector/opencti_connector_helper.py +13 -11
- pycti/entities/opencti_attack_pattern.py +76 -58
- pycti/entities/opencti_campaign.py +49 -41
- pycti/entities/opencti_case_incident.py +62 -48
- pycti/entities/opencti_case_rfi.py +45 -35
- pycti/entities/opencti_case_rft.py +45 -35
- pycti/entities/opencti_channel.py +45 -35
- pycti/entities/opencti_course_of_action.py +43 -35
- pycti/entities/opencti_data_component.py +43 -35
- pycti/entities/opencti_data_source.py +48 -38
- pycti/entities/opencti_event.py +44 -38
- pycti/entities/opencti_external_reference.py +5 -3
- pycti/entities/opencti_feedback.py +40 -32
- pycti/entities/opencti_grouping.py +43 -35
- pycti/entities/opencti_identity.py +91 -73
- pycti/entities/opencti_incident.py +59 -47
- pycti/entities/opencti_indicator.py +110 -84
- pycti/entities/opencti_infrastructure.py +56 -44
- pycti/entities/opencti_intrusion_set.py +61 -47
- pycti/entities/opencti_language.py +30 -24
- pycti/entities/opencti_location.py +41 -35
- pycti/entities/opencti_malware.py +83 -63
- pycti/entities/opencti_malware_analysis.py +87 -63
- pycti/entities/opencti_marking_definition.py +24 -18
- pycti/entities/opencti_narrative.py +45 -35
- pycti/entities/opencti_note.py +51 -39
- pycti/entities/opencti_observed_data.py +70 -48
- pycti/entities/opencti_opinion.py +40 -32
- pycti/entities/opencti_report.py +74 -47
- pycti/entities/opencti_stix_core_object.py +10 -10
- pycti/entities/opencti_stix_core_relationship.py +55 -41
- pycti/entities/opencti_stix_cyber_observable.py +442 -318
- pycti/entities/opencti_stix_domain_object.py +15 -13
- pycti/entities/opencti_stix_object_or_stix_relationship.py +5 -5
- pycti/entities/opencti_task.py +44 -36
- pycti/entities/opencti_threat_actor_group.py +76 -56
- pycti/entities/opencti_threat_actor_individual.py +76 -56
- pycti/entities/opencti_tool.py +53 -41
- pycti/entities/opencti_vulnerability.py +151 -109
- pycti/utils/constants.py +1 -0
- pycti/utils/opencti_stix2.py +177 -139
- pycti/utils/opencti_stix2_update.py +20 -12
- pycti/utils/opencti_stix2_utils.py +5 -3
- {pycti-5.12.21.dist-info → pycti-5.12.23.dist-info}/METADATA +2 -2
- pycti-5.12.23.dist-info/RECORD +68 -0
- pycti-5.12.21.dist-info/RECORD +0 -68
- {pycti-5.12.21.dist-info → pycti-5.12.23.dist-info}/LICENSE +0 -0
- {pycti-5.12.21.dist-info → pycti-5.12.23.dist-info}/WHEEL +0 -0
- {pycti-5.12.21.dist-info → pycti-5.12.23.dist-info}/top_level.txt +0 -0
|
@@ -840,51 +840,61 @@ class CaseRft:
|
|
|
840
840
|
if stix_object is not None:
|
|
841
841
|
# Search in extensions
|
|
842
842
|
if "x_opencti_stix_ids" not in stix_object:
|
|
843
|
-
stix_object[
|
|
844
|
-
"
|
|
845
|
-
|
|
843
|
+
stix_object["x_opencti_stix_ids"] = (
|
|
844
|
+
self.opencti.get_attribute_in_extension("stix_ids", stix_object)
|
|
845
|
+
)
|
|
846
846
|
if "x_opencti_granted_refs" not in stix_object:
|
|
847
|
-
stix_object[
|
|
848
|
-
"
|
|
849
|
-
|
|
847
|
+
stix_object["x_opencti_granted_refs"] = (
|
|
848
|
+
self.opencti.get_attribute_in_extension("granted_refs", stix_object)
|
|
849
|
+
)
|
|
850
850
|
|
|
851
851
|
return self.create(
|
|
852
852
|
stix_id=stix_object["id"],
|
|
853
|
-
createdBy=
|
|
854
|
-
|
|
855
|
-
|
|
856
|
-
objectMarking=
|
|
857
|
-
|
|
858
|
-
|
|
859
|
-
|
|
860
|
-
|
|
861
|
-
|
|
853
|
+
createdBy=(
|
|
854
|
+
extras["created_by_id"] if "created_by_id" in extras else None
|
|
855
|
+
),
|
|
856
|
+
objectMarking=(
|
|
857
|
+
extras["object_marking_ids"]
|
|
858
|
+
if "object_marking_ids" in extras
|
|
859
|
+
else None
|
|
860
|
+
),
|
|
861
|
+
objectLabel=(
|
|
862
|
+
extras["object_label_ids"] if "object_label_ids" in extras else None
|
|
863
|
+
),
|
|
862
864
|
objects=extras["object_ids"] if "object_ids" in extras else [],
|
|
863
|
-
externalReferences=
|
|
864
|
-
|
|
865
|
-
|
|
865
|
+
externalReferences=(
|
|
866
|
+
extras["external_references_ids"]
|
|
867
|
+
if "external_references_ids" in extras
|
|
868
|
+
else None
|
|
869
|
+
),
|
|
866
870
|
revoked=stix_object["revoked"] if "revoked" in stix_object else None,
|
|
867
|
-
confidence=
|
|
868
|
-
|
|
869
|
-
|
|
871
|
+
confidence=(
|
|
872
|
+
stix_object["confidence"] if "confidence" in stix_object else None
|
|
873
|
+
),
|
|
870
874
|
lang=stix_object["lang"] if "lang" in stix_object else None,
|
|
871
875
|
created=stix_object["created"] if "created" in stix_object else None,
|
|
872
876
|
modified=stix_object["modified"] if "modified" in stix_object else None,
|
|
873
877
|
name=stix_object["name"],
|
|
874
|
-
description=
|
|
875
|
-
stix_object["description"]
|
|
876
|
-
|
|
877
|
-
|
|
878
|
-
|
|
879
|
-
takedown_types=
|
|
880
|
-
|
|
881
|
-
|
|
882
|
-
|
|
883
|
-
|
|
884
|
-
|
|
885
|
-
|
|
886
|
-
|
|
887
|
-
|
|
878
|
+
description=(
|
|
879
|
+
self.opencti.stix2.convert_markdown(stix_object["description"])
|
|
880
|
+
if "description" in stix_object
|
|
881
|
+
else None
|
|
882
|
+
),
|
|
883
|
+
takedown_types=(
|
|
884
|
+
stix_object["takedown_types"]
|
|
885
|
+
if "takedown_types" in stix_object
|
|
886
|
+
else None
|
|
887
|
+
),
|
|
888
|
+
x_opencti_stix_ids=(
|
|
889
|
+
stix_object["x_opencti_stix_ids"]
|
|
890
|
+
if "x_opencti_stix_ids" in stix_object
|
|
891
|
+
else None
|
|
892
|
+
),
|
|
893
|
+
objectOrganization=(
|
|
894
|
+
stix_object["x_opencti_granted_refs"]
|
|
895
|
+
if "x_opencti_granted_refs" in stix_object
|
|
896
|
+
else None
|
|
897
|
+
),
|
|
888
898
|
update=update,
|
|
889
899
|
)
|
|
890
900
|
else:
|
|
@@ -442,51 +442,61 @@ class Channel:
|
|
|
442
442
|
if stix_object is not None:
|
|
443
443
|
# Search in extensions
|
|
444
444
|
if "x_opencti_stix_ids" not in stix_object:
|
|
445
|
-
stix_object[
|
|
446
|
-
"
|
|
447
|
-
|
|
445
|
+
stix_object["x_opencti_stix_ids"] = (
|
|
446
|
+
self.opencti.get_attribute_in_extension("stix_ids", stix_object)
|
|
447
|
+
)
|
|
448
448
|
if "x_opencti_granted_refs" not in stix_object:
|
|
449
|
-
stix_object[
|
|
450
|
-
"
|
|
451
|
-
|
|
449
|
+
stix_object["x_opencti_granted_refs"] = (
|
|
450
|
+
self.opencti.get_attribute_in_extension("granted_refs", stix_object)
|
|
451
|
+
)
|
|
452
452
|
|
|
453
453
|
return self.opencti.channel.create(
|
|
454
454
|
stix_id=stix_object["id"],
|
|
455
|
-
createdBy=
|
|
456
|
-
|
|
457
|
-
|
|
458
|
-
objectMarking=
|
|
459
|
-
|
|
460
|
-
|
|
461
|
-
|
|
462
|
-
|
|
463
|
-
|
|
464
|
-
|
|
465
|
-
|
|
466
|
-
|
|
455
|
+
createdBy=(
|
|
456
|
+
extras["created_by_id"] if "created_by_id" in extras else None
|
|
457
|
+
),
|
|
458
|
+
objectMarking=(
|
|
459
|
+
extras["object_marking_ids"]
|
|
460
|
+
if "object_marking_ids" in extras
|
|
461
|
+
else None
|
|
462
|
+
),
|
|
463
|
+
objectLabel=(
|
|
464
|
+
extras["object_label_ids"] if "object_label_ids" in extras else None
|
|
465
|
+
),
|
|
466
|
+
externalReferences=(
|
|
467
|
+
extras["external_references_ids"]
|
|
468
|
+
if "external_references_ids" in extras
|
|
469
|
+
else None
|
|
470
|
+
),
|
|
467
471
|
revoked=stix_object["revoked"] if "revoked" in stix_object else None,
|
|
468
|
-
confidence=
|
|
469
|
-
|
|
470
|
-
|
|
472
|
+
confidence=(
|
|
473
|
+
stix_object["confidence"] if "confidence" in stix_object else None
|
|
474
|
+
),
|
|
471
475
|
lang=stix_object["lang"] if "lang" in stix_object else None,
|
|
472
476
|
created=stix_object["created"] if "created" in stix_object else None,
|
|
473
477
|
modified=stix_object["modified"] if "modified" in stix_object else None,
|
|
474
478
|
name=stix_object["name"],
|
|
475
|
-
description=
|
|
476
|
-
stix_object["description"]
|
|
477
|
-
|
|
478
|
-
|
|
479
|
-
|
|
479
|
+
description=(
|
|
480
|
+
self.opencti.stix2.convert_markdown(stix_object["description"])
|
|
481
|
+
if "description" in stix_object
|
|
482
|
+
else None
|
|
483
|
+
),
|
|
480
484
|
aliases=self.opencti.stix2.pick_aliases(stix_object),
|
|
481
|
-
channel_types=
|
|
482
|
-
|
|
483
|
-
|
|
484
|
-
|
|
485
|
-
|
|
486
|
-
|
|
487
|
-
|
|
488
|
-
|
|
489
|
-
|
|
485
|
+
channel_types=(
|
|
486
|
+
stix_object["channel_types"]
|
|
487
|
+
if "channel_types" in stix_object
|
|
488
|
+
else None
|
|
489
|
+
),
|
|
490
|
+
x_opencti_stix_ids=(
|
|
491
|
+
stix_object["x_opencti_stix_ids"]
|
|
492
|
+
if "x_opencti_stix_ids" in stix_object
|
|
493
|
+
else None
|
|
494
|
+
),
|
|
495
|
+
objectOrganization=(
|
|
496
|
+
stix_object["x_opencti_granted_refs"]
|
|
497
|
+
if "x_opencti_granted_refs" in stix_object
|
|
498
|
+
else None
|
|
499
|
+
),
|
|
490
500
|
update=update,
|
|
491
501
|
)
|
|
492
502
|
else:
|
|
@@ -472,53 +472,61 @@ class CourseOfAction:
|
|
|
472
472
|
|
|
473
473
|
# Search in extensions
|
|
474
474
|
if "x_opencti_aliases" not in stix_object:
|
|
475
|
-
stix_object[
|
|
476
|
-
"
|
|
477
|
-
|
|
475
|
+
stix_object["x_opencti_aliases"] = (
|
|
476
|
+
self.opencti.get_attribute_in_extension("aliases", stix_object)
|
|
477
|
+
)
|
|
478
478
|
if "x_opencti_stix_ids" not in stix_object:
|
|
479
|
-
stix_object[
|
|
480
|
-
"
|
|
481
|
-
|
|
479
|
+
stix_object["x_opencti_stix_ids"] = (
|
|
480
|
+
self.opencti.get_attribute_in_extension("stix_ids", stix_object)
|
|
481
|
+
)
|
|
482
482
|
if "x_opencti_granted_refs" not in stix_object:
|
|
483
|
-
stix_object[
|
|
484
|
-
"
|
|
485
|
-
|
|
483
|
+
stix_object["x_opencti_granted_refs"] = (
|
|
484
|
+
self.opencti.get_attribute_in_extension("granted_refs", stix_object)
|
|
485
|
+
)
|
|
486
486
|
|
|
487
487
|
return self.create(
|
|
488
488
|
stix_id=stix_object["id"],
|
|
489
|
-
createdBy=
|
|
490
|
-
|
|
491
|
-
|
|
492
|
-
objectMarking=
|
|
493
|
-
|
|
494
|
-
|
|
495
|
-
|
|
496
|
-
|
|
497
|
-
|
|
498
|
-
|
|
499
|
-
|
|
500
|
-
|
|
489
|
+
createdBy=(
|
|
490
|
+
extras["created_by_id"] if "created_by_id" in extras else None
|
|
491
|
+
),
|
|
492
|
+
objectMarking=(
|
|
493
|
+
extras["object_marking_ids"]
|
|
494
|
+
if "object_marking_ids" in extras
|
|
495
|
+
else None
|
|
496
|
+
),
|
|
497
|
+
objectLabel=(
|
|
498
|
+
extras["object_label_ids"] if "object_label_ids" in extras else None
|
|
499
|
+
),
|
|
500
|
+
externalReferences=(
|
|
501
|
+
extras["external_references_ids"]
|
|
502
|
+
if "external_references_ids" in extras
|
|
503
|
+
else None
|
|
504
|
+
),
|
|
501
505
|
revoked=stix_object["revoked"] if "revoked" in stix_object else None,
|
|
502
|
-
confidence=
|
|
503
|
-
|
|
504
|
-
|
|
506
|
+
confidence=(
|
|
507
|
+
stix_object["confidence"] if "confidence" in stix_object else None
|
|
508
|
+
),
|
|
505
509
|
lang=stix_object["lang"] if "lang" in stix_object else None,
|
|
506
510
|
created=stix_object["created"] if "created" in stix_object else None,
|
|
507
511
|
modified=stix_object["modified"] if "modified" in stix_object else None,
|
|
508
512
|
name=stix_object["name"],
|
|
509
|
-
description=
|
|
510
|
-
stix_object["description"]
|
|
511
|
-
|
|
512
|
-
|
|
513
|
-
|
|
514
|
-
x_opencti_stix_ids=
|
|
515
|
-
|
|
516
|
-
|
|
513
|
+
description=(
|
|
514
|
+
self.opencti.stix2.convert_markdown(stix_object["description"])
|
|
515
|
+
if "description" in stix_object
|
|
516
|
+
else None
|
|
517
|
+
),
|
|
518
|
+
x_opencti_stix_ids=(
|
|
519
|
+
stix_object["x_opencti_stix_ids"]
|
|
520
|
+
if "x_opencti_stix_ids" in stix_object
|
|
521
|
+
else None
|
|
522
|
+
),
|
|
517
523
|
x_opencti_aliases=self.opencti.stix2.pick_aliases(stix_object),
|
|
518
524
|
x_mitre_id=x_mitre_id,
|
|
519
|
-
objectOrganization=
|
|
520
|
-
|
|
521
|
-
|
|
525
|
+
objectOrganization=(
|
|
526
|
+
stix_object["x_opencti_granted_refs"]
|
|
527
|
+
if "x_opencti_granted_refs" in stix_object
|
|
528
|
+
else None
|
|
529
|
+
),
|
|
522
530
|
update=update,
|
|
523
531
|
)
|
|
524
532
|
else:
|
|
@@ -496,51 +496,59 @@ class DataComponent:
|
|
|
496
496
|
|
|
497
497
|
# Search in extensions
|
|
498
498
|
if "x_opencti_stix_ids" not in stix_object:
|
|
499
|
-
stix_object[
|
|
500
|
-
"
|
|
501
|
-
|
|
499
|
+
stix_object["x_opencti_stix_ids"] = (
|
|
500
|
+
self.opencti.get_attribute_in_extension("stix_ids", stix_object)
|
|
501
|
+
)
|
|
502
502
|
if "x_opencti_granted_refs" not in stix_object:
|
|
503
|
-
stix_object[
|
|
504
|
-
"
|
|
505
|
-
|
|
503
|
+
stix_object["x_opencti_granted_refs"] = (
|
|
504
|
+
self.opencti.get_attribute_in_extension("granted_refs", stix_object)
|
|
505
|
+
)
|
|
506
506
|
|
|
507
507
|
return self.opencti.data_component.create(
|
|
508
508
|
stix_id=stix_object["id"],
|
|
509
|
-
createdBy=
|
|
510
|
-
|
|
511
|
-
|
|
512
|
-
objectMarking=
|
|
513
|
-
|
|
514
|
-
|
|
515
|
-
|
|
516
|
-
|
|
517
|
-
|
|
518
|
-
|
|
519
|
-
|
|
520
|
-
|
|
509
|
+
createdBy=(
|
|
510
|
+
extras["created_by_id"] if "created_by_id" in extras else None
|
|
511
|
+
),
|
|
512
|
+
objectMarking=(
|
|
513
|
+
extras["object_marking_ids"]
|
|
514
|
+
if "object_marking_ids" in extras
|
|
515
|
+
else None
|
|
516
|
+
),
|
|
517
|
+
objectLabel=(
|
|
518
|
+
extras["object_label_ids"] if "object_label_ids" in extras else None
|
|
519
|
+
),
|
|
520
|
+
externalReferences=(
|
|
521
|
+
extras["external_references_ids"]
|
|
522
|
+
if "external_references_ids" in extras
|
|
523
|
+
else None
|
|
524
|
+
),
|
|
521
525
|
revoked=stix_object["revoked"] if "revoked" in stix_object else None,
|
|
522
|
-
confidence=
|
|
523
|
-
|
|
524
|
-
|
|
526
|
+
confidence=(
|
|
527
|
+
stix_object["confidence"] if "confidence" in stix_object else None
|
|
528
|
+
),
|
|
525
529
|
lang=stix_object["lang"] if "lang" in stix_object else None,
|
|
526
530
|
created=stix_object["created"] if "created" in stix_object else None,
|
|
527
531
|
modified=stix_object["modified"] if "modified" in stix_object else None,
|
|
528
532
|
name=stix_object["name"],
|
|
529
|
-
description=
|
|
530
|
-
stix_object["description"]
|
|
531
|
-
|
|
532
|
-
|
|
533
|
-
|
|
533
|
+
description=(
|
|
534
|
+
self.opencti.stix2.convert_markdown(stix_object["description"])
|
|
535
|
+
if "description" in stix_object
|
|
536
|
+
else None
|
|
537
|
+
),
|
|
534
538
|
aliases=self.opencti.stix2.pick_aliases(stix_object),
|
|
535
|
-
dataSource=
|
|
536
|
-
|
|
537
|
-
|
|
538
|
-
x_opencti_stix_ids=
|
|
539
|
-
|
|
540
|
-
|
|
541
|
-
|
|
542
|
-
|
|
543
|
-
|
|
539
|
+
dataSource=(
|
|
540
|
+
stix_object["dataSource"] if "dataSource" in stix_object else None
|
|
541
|
+
),
|
|
542
|
+
x_opencti_stix_ids=(
|
|
543
|
+
stix_object["x_opencti_stix_ids"]
|
|
544
|
+
if "x_opencti_stix_ids" in stix_object
|
|
545
|
+
else None
|
|
546
|
+
),
|
|
547
|
+
objectOrganization=(
|
|
548
|
+
stix_object["x_opencti_granted_refs"]
|
|
549
|
+
if "x_opencti_granted_refs" in stix_object
|
|
550
|
+
else None
|
|
551
|
+
),
|
|
544
552
|
update=update,
|
|
545
553
|
)
|
|
546
554
|
else:
|
|
@@ -462,54 +462,64 @@ class DataSource:
|
|
|
462
462
|
|
|
463
463
|
# Search in extensions
|
|
464
464
|
if "x_opencti_stix_ids" not in stix_object:
|
|
465
|
-
stix_object[
|
|
466
|
-
"
|
|
467
|
-
|
|
465
|
+
stix_object["x_opencti_stix_ids"] = (
|
|
466
|
+
self.opencti.get_attribute_in_extension("stix_ids", stix_object)
|
|
467
|
+
)
|
|
468
468
|
if "x_opencti_granted_refs" not in stix_object:
|
|
469
|
-
stix_object[
|
|
470
|
-
"
|
|
471
|
-
|
|
469
|
+
stix_object["x_opencti_granted_refs"] = (
|
|
470
|
+
self.opencti.get_attribute_in_extension("granted_refs", stix_object)
|
|
471
|
+
)
|
|
472
472
|
|
|
473
473
|
return self.opencti.data_source.create(
|
|
474
474
|
stix_id=stix_object["id"],
|
|
475
|
-
createdBy=
|
|
476
|
-
|
|
477
|
-
|
|
478
|
-
objectMarking=
|
|
479
|
-
|
|
480
|
-
|
|
481
|
-
|
|
482
|
-
|
|
483
|
-
|
|
484
|
-
|
|
485
|
-
|
|
486
|
-
|
|
475
|
+
createdBy=(
|
|
476
|
+
extras["created_by_id"] if "created_by_id" in extras else None
|
|
477
|
+
),
|
|
478
|
+
objectMarking=(
|
|
479
|
+
extras["object_marking_ids"]
|
|
480
|
+
if "object_marking_ids" in extras
|
|
481
|
+
else None
|
|
482
|
+
),
|
|
483
|
+
objectLabel=(
|
|
484
|
+
extras["object_label_ids"] if "object_label_ids" in extras else None
|
|
485
|
+
),
|
|
486
|
+
externalReferences=(
|
|
487
|
+
extras["external_references_ids"]
|
|
488
|
+
if "external_references_ids" in extras
|
|
489
|
+
else None
|
|
490
|
+
),
|
|
487
491
|
revoked=stix_object["revoked"] if "revoked" in stix_object else None,
|
|
488
|
-
confidence=
|
|
489
|
-
|
|
490
|
-
|
|
492
|
+
confidence=(
|
|
493
|
+
stix_object["confidence"] if "confidence" in stix_object else None
|
|
494
|
+
),
|
|
491
495
|
lang=stix_object["lang"] if "lang" in stix_object else None,
|
|
492
496
|
created=stix_object["created"] if "created" in stix_object else None,
|
|
493
497
|
modified=stix_object["modified"] if "modified" in stix_object else None,
|
|
494
498
|
name=stix_object["name"],
|
|
495
|
-
description=
|
|
496
|
-
stix_object["description"]
|
|
497
|
-
|
|
498
|
-
|
|
499
|
-
|
|
499
|
+
description=(
|
|
500
|
+
self.opencti.stix2.convert_markdown(stix_object["description"])
|
|
501
|
+
if "description" in stix_object
|
|
502
|
+
else None
|
|
503
|
+
),
|
|
500
504
|
aliases=self.opencti.stix2.pick_aliases(stix_object),
|
|
501
|
-
platforms=
|
|
502
|
-
|
|
503
|
-
|
|
504
|
-
collection_layers=
|
|
505
|
-
|
|
506
|
-
|
|
507
|
-
|
|
508
|
-
|
|
509
|
-
|
|
510
|
-
|
|
511
|
-
|
|
512
|
-
|
|
505
|
+
platforms=(
|
|
506
|
+
stix_object["platforms"] if "platforms" in stix_object else None
|
|
507
|
+
),
|
|
508
|
+
collection_layers=(
|
|
509
|
+
stix_object["collection_layers"]
|
|
510
|
+
if "collection_layers" in stix_object
|
|
511
|
+
else None
|
|
512
|
+
),
|
|
513
|
+
x_opencti_stix_ids=(
|
|
514
|
+
stix_object["x_opencti_stix_ids"]
|
|
515
|
+
if "x_opencti_stix_ids" in stix_object
|
|
516
|
+
else None
|
|
517
|
+
),
|
|
518
|
+
objectOrganization=(
|
|
519
|
+
stix_object["x_opencti_granted_refs"]
|
|
520
|
+
if "x_opencti_granted_refs" in stix_object
|
|
521
|
+
else None
|
|
522
|
+
),
|
|
513
523
|
update=update,
|
|
514
524
|
)
|
|
515
525
|
else:
|
pycti/entities/opencti_event.py
CHANGED
|
@@ -448,54 +448,60 @@ class Event:
|
|
|
448
448
|
if stix_object is not None:
|
|
449
449
|
# Search in extensions
|
|
450
450
|
if "x_opencti_stix_ids" not in stix_object:
|
|
451
|
-
stix_object[
|
|
452
|
-
"
|
|
453
|
-
|
|
451
|
+
stix_object["x_opencti_stix_ids"] = (
|
|
452
|
+
self.opencti.get_attribute_in_extension("stix_ids", stix_object)
|
|
453
|
+
)
|
|
454
454
|
if "x_opencti_granted_refs" not in stix_object:
|
|
455
|
-
stix_object[
|
|
456
|
-
"
|
|
457
|
-
|
|
455
|
+
stix_object["x_opencti_granted_refs"] = (
|
|
456
|
+
self.opencti.get_attribute_in_extension("granted_refs", stix_object)
|
|
457
|
+
)
|
|
458
458
|
|
|
459
459
|
return self.opencti.event.create(
|
|
460
460
|
stix_id=stix_object["id"],
|
|
461
|
-
createdBy=
|
|
462
|
-
|
|
463
|
-
|
|
464
|
-
objectMarking=
|
|
465
|
-
|
|
466
|
-
|
|
467
|
-
|
|
468
|
-
|
|
469
|
-
|
|
470
|
-
|
|
471
|
-
|
|
472
|
-
|
|
461
|
+
createdBy=(
|
|
462
|
+
extras["created_by_id"] if "created_by_id" in extras else None
|
|
463
|
+
),
|
|
464
|
+
objectMarking=(
|
|
465
|
+
extras["object_marking_ids"]
|
|
466
|
+
if "object_marking_ids" in extras
|
|
467
|
+
else None
|
|
468
|
+
),
|
|
469
|
+
objectLabel=(
|
|
470
|
+
extras["object_label_ids"] if "object_label_ids" in extras else None
|
|
471
|
+
),
|
|
472
|
+
externalReferences=(
|
|
473
|
+
extras["external_references_ids"]
|
|
474
|
+
if "external_references_ids" in extras
|
|
475
|
+
else None
|
|
476
|
+
),
|
|
473
477
|
revoked=stix_object["revoked"] if "revoked" in stix_object else None,
|
|
474
|
-
confidence=
|
|
475
|
-
|
|
476
|
-
|
|
478
|
+
confidence=(
|
|
479
|
+
stix_object["confidence"] if "confidence" in stix_object else None
|
|
480
|
+
),
|
|
477
481
|
lang=stix_object["lang"] if "lang" in stix_object else None,
|
|
478
482
|
created=stix_object["created"] if "created" in stix_object else None,
|
|
479
483
|
modified=stix_object["modified"] if "modified" in stix_object else None,
|
|
480
484
|
name=stix_object["name"],
|
|
481
|
-
description=
|
|
482
|
-
stix_object["description"]
|
|
483
|
-
|
|
484
|
-
|
|
485
|
-
|
|
485
|
+
description=(
|
|
486
|
+
self.opencti.stix2.convert_markdown(stix_object["description"])
|
|
487
|
+
if "description" in stix_object
|
|
488
|
+
else None
|
|
489
|
+
),
|
|
486
490
|
aliases=self.opencti.stix2.pick_aliases(stix_object),
|
|
487
|
-
event_types=
|
|
488
|
-
|
|
489
|
-
|
|
490
|
-
start_time=
|
|
491
|
-
|
|
492
|
-
|
|
493
|
-
stop_time=
|
|
494
|
-
|
|
495
|
-
|
|
496
|
-
x_opencti_stix_ids=
|
|
497
|
-
|
|
498
|
-
|
|
491
|
+
event_types=(
|
|
492
|
+
stix_object["event_types"] if "event_types" in stix_object else None
|
|
493
|
+
),
|
|
494
|
+
start_time=(
|
|
495
|
+
stix_object["start_time"] if "start_time" in stix_object else None
|
|
496
|
+
),
|
|
497
|
+
stop_time=(
|
|
498
|
+
stix_object["stop_time"] if "stop_time" in stix_object else None
|
|
499
|
+
),
|
|
500
|
+
x_opencti_stix_ids=(
|
|
501
|
+
stix_object["x_opencti_stix_ids"]
|
|
502
|
+
if "x_opencti_stix_ids" in stix_object
|
|
503
|
+
else None
|
|
504
|
+
),
|
|
499
505
|
update=update,
|
|
500
506
|
)
|
|
501
507
|
else:
|
|
@@ -297,9 +297,11 @@ class ExternalReference:
|
|
|
297
297
|
{
|
|
298
298
|
"id": id,
|
|
299
299
|
"file": (self.file(final_file_name, data, mime_type)),
|
|
300
|
-
"noTriggerImport":
|
|
301
|
-
|
|
302
|
-
|
|
300
|
+
"noTriggerImport": (
|
|
301
|
+
no_trigger_import
|
|
302
|
+
if isinstance(no_trigger_import, bool)
|
|
303
|
+
else no_trigger_import == "True"
|
|
304
|
+
),
|
|
303
305
|
},
|
|
304
306
|
)
|
|
305
307
|
else:
|