pycti 5.12.21__py3-none-any.whl → 5.12.23__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of pycti might be problematic. Click here for more details.
- pycti/__init__.py +1 -1
- pycti/connector/opencti_connector_helper.py +13 -11
- pycti/entities/opencti_attack_pattern.py +76 -58
- pycti/entities/opencti_campaign.py +49 -41
- pycti/entities/opencti_case_incident.py +62 -48
- pycti/entities/opencti_case_rfi.py +45 -35
- pycti/entities/opencti_case_rft.py +45 -35
- pycti/entities/opencti_channel.py +45 -35
- pycti/entities/opencti_course_of_action.py +43 -35
- pycti/entities/opencti_data_component.py +43 -35
- pycti/entities/opencti_data_source.py +48 -38
- pycti/entities/opencti_event.py +44 -38
- pycti/entities/opencti_external_reference.py +5 -3
- pycti/entities/opencti_feedback.py +40 -32
- pycti/entities/opencti_grouping.py +43 -35
- pycti/entities/opencti_identity.py +91 -73
- pycti/entities/opencti_incident.py +59 -47
- pycti/entities/opencti_indicator.py +110 -84
- pycti/entities/opencti_infrastructure.py +56 -44
- pycti/entities/opencti_intrusion_set.py +61 -47
- pycti/entities/opencti_language.py +30 -24
- pycti/entities/opencti_location.py +41 -35
- pycti/entities/opencti_malware.py +83 -63
- pycti/entities/opencti_malware_analysis.py +87 -63
- pycti/entities/opencti_marking_definition.py +24 -18
- pycti/entities/opencti_narrative.py +45 -35
- pycti/entities/opencti_note.py +51 -39
- pycti/entities/opencti_observed_data.py +70 -48
- pycti/entities/opencti_opinion.py +40 -32
- pycti/entities/opencti_report.py +74 -47
- pycti/entities/opencti_stix_core_object.py +10 -10
- pycti/entities/opencti_stix_core_relationship.py +55 -41
- pycti/entities/opencti_stix_cyber_observable.py +442 -318
- pycti/entities/opencti_stix_domain_object.py +15 -13
- pycti/entities/opencti_stix_object_or_stix_relationship.py +5 -5
- pycti/entities/opencti_task.py +44 -36
- pycti/entities/opencti_threat_actor_group.py +76 -56
- pycti/entities/opencti_threat_actor_individual.py +76 -56
- pycti/entities/opencti_tool.py +53 -41
- pycti/entities/opencti_vulnerability.py +151 -109
- pycti/utils/constants.py +1 -0
- pycti/utils/opencti_stix2.py +177 -139
- pycti/utils/opencti_stix2_update.py +20 -12
- pycti/utils/opencti_stix2_utils.py +5 -3
- {pycti-5.12.21.dist-info → pycti-5.12.23.dist-info}/METADATA +2 -2
- pycti-5.12.23.dist-info/RECORD +68 -0
- pycti-5.12.21.dist-info/RECORD +0 -68
- {pycti-5.12.21.dist-info → pycti-5.12.23.dist-info}/LICENSE +0 -0
- {pycti-5.12.21.dist-info → pycti-5.12.23.dist-info}/WHEEL +0 -0
- {pycti-5.12.21.dist-info → pycti-5.12.23.dist-info}/top_level.txt +0 -0
|
@@ -499,81 +499,101 @@ class Malware:
|
|
|
499
499
|
if stix_object is not None:
|
|
500
500
|
# Search in extensions
|
|
501
501
|
if "x_opencti_stix_ids" not in stix_object:
|
|
502
|
-
stix_object[
|
|
503
|
-
"
|
|
504
|
-
|
|
502
|
+
stix_object["x_opencti_stix_ids"] = (
|
|
503
|
+
self.opencti.get_attribute_in_extension("stix_ids", stix_object)
|
|
504
|
+
)
|
|
505
505
|
if "x_opencti_granted_refs" not in stix_object:
|
|
506
|
-
stix_object[
|
|
507
|
-
"
|
|
508
|
-
|
|
506
|
+
stix_object["x_opencti_granted_refs"] = (
|
|
507
|
+
self.opencti.get_attribute_in_extension("granted_refs", stix_object)
|
|
508
|
+
)
|
|
509
509
|
if "x_opencti_workflow_id" not in stix_object:
|
|
510
|
-
stix_object[
|
|
511
|
-
|
|
512
|
-
|
|
513
|
-
|
|
510
|
+
stix_object["x_opencti_workflow_id"] = (
|
|
511
|
+
self.opencti.get_attribute_in_extension(
|
|
512
|
+
"x_opencti_workflow_id", stix_object
|
|
513
|
+
)
|
|
514
514
|
)
|
|
515
515
|
|
|
516
516
|
return self.create(
|
|
517
517
|
stix_id=stix_object["id"],
|
|
518
|
-
createdBy=
|
|
519
|
-
|
|
520
|
-
|
|
521
|
-
objectMarking=
|
|
522
|
-
|
|
523
|
-
|
|
524
|
-
|
|
525
|
-
|
|
526
|
-
|
|
527
|
-
|
|
528
|
-
|
|
529
|
-
|
|
518
|
+
createdBy=(
|
|
519
|
+
extras["created_by_id"] if "created_by_id" in extras else None
|
|
520
|
+
),
|
|
521
|
+
objectMarking=(
|
|
522
|
+
extras["object_marking_ids"]
|
|
523
|
+
if "object_marking_ids" in extras
|
|
524
|
+
else None
|
|
525
|
+
),
|
|
526
|
+
objectLabel=(
|
|
527
|
+
extras["object_label_ids"] if "object_label_ids" in extras else None
|
|
528
|
+
),
|
|
529
|
+
externalReferences=(
|
|
530
|
+
extras["external_references_ids"]
|
|
531
|
+
if "external_references_ids" in extras
|
|
532
|
+
else None
|
|
533
|
+
),
|
|
530
534
|
revoked=stix_object["revoked"] if "revoked" in stix_object else None,
|
|
531
|
-
confidence=
|
|
532
|
-
|
|
533
|
-
|
|
535
|
+
confidence=(
|
|
536
|
+
stix_object["confidence"] if "confidence" in stix_object else None
|
|
537
|
+
),
|
|
534
538
|
lang=stix_object["lang"] if "lang" in stix_object else None,
|
|
535
539
|
created=stix_object["created"] if "created" in stix_object else None,
|
|
536
540
|
modified=stix_object["modified"] if "modified" in stix_object else None,
|
|
537
541
|
name=stix_object["name"],
|
|
538
|
-
description=
|
|
539
|
-
stix_object["description"]
|
|
540
|
-
|
|
541
|
-
|
|
542
|
-
|
|
542
|
+
description=(
|
|
543
|
+
self.opencti.stix2.convert_markdown(stix_object["description"])
|
|
544
|
+
if "description" in stix_object
|
|
545
|
+
else None
|
|
546
|
+
),
|
|
543
547
|
aliases=self.opencti.stix2.pick_aliases(stix_object),
|
|
544
|
-
malware_types=
|
|
545
|
-
|
|
546
|
-
|
|
547
|
-
|
|
548
|
-
|
|
549
|
-
|
|
550
|
-
|
|
551
|
-
|
|
552
|
-
|
|
553
|
-
|
|
554
|
-
|
|
555
|
-
|
|
556
|
-
|
|
557
|
-
|
|
558
|
-
|
|
559
|
-
|
|
560
|
-
|
|
561
|
-
|
|
562
|
-
|
|
563
|
-
|
|
564
|
-
|
|
565
|
-
|
|
566
|
-
|
|
567
|
-
|
|
568
|
-
|
|
569
|
-
|
|
570
|
-
|
|
571
|
-
|
|
572
|
-
|
|
573
|
-
|
|
574
|
-
|
|
575
|
-
|
|
576
|
-
|
|
548
|
+
malware_types=(
|
|
549
|
+
stix_object["malware_types"]
|
|
550
|
+
if "malware_types" in stix_object
|
|
551
|
+
else None
|
|
552
|
+
),
|
|
553
|
+
is_family=(
|
|
554
|
+
stix_object["is_family"] if "is_family" in stix_object else False
|
|
555
|
+
),
|
|
556
|
+
first_seen=(
|
|
557
|
+
stix_object["first_seen"] if "first_seen" in stix_object else None
|
|
558
|
+
),
|
|
559
|
+
last_seen=(
|
|
560
|
+
stix_object["last_seen"] if "last_seen" in stix_object else None
|
|
561
|
+
),
|
|
562
|
+
architecture_execution_envs=(
|
|
563
|
+
stix_object["architecture_execution_envs"]
|
|
564
|
+
if "architecture_execution_envs" in stix_object
|
|
565
|
+
else None
|
|
566
|
+
),
|
|
567
|
+
implementation_languages=(
|
|
568
|
+
stix_object["implementation_languages"]
|
|
569
|
+
if "implementation_languages" in stix_object
|
|
570
|
+
else None
|
|
571
|
+
),
|
|
572
|
+
capabilities=(
|
|
573
|
+
stix_object["capabilities"]
|
|
574
|
+
if "capabilities" in stix_object
|
|
575
|
+
else None
|
|
576
|
+
),
|
|
577
|
+
killChainPhases=(
|
|
578
|
+
extras["kill_chain_phases_ids"]
|
|
579
|
+
if "kill_chain_phases_ids" in extras
|
|
580
|
+
else None
|
|
581
|
+
),
|
|
582
|
+
x_opencti_stix_ids=(
|
|
583
|
+
stix_object["x_opencti_stix_ids"]
|
|
584
|
+
if "x_opencti_stix_ids" in stix_object
|
|
585
|
+
else None
|
|
586
|
+
),
|
|
587
|
+
objectOrganization=(
|
|
588
|
+
stix_object["x_opencti_granted_refs"]
|
|
589
|
+
if "x_opencti_granted_refs" in stix_object
|
|
590
|
+
else None
|
|
591
|
+
),
|
|
592
|
+
x_opencti_workflow_id=(
|
|
593
|
+
stix_object["x_opencti_workflow_id"]
|
|
594
|
+
if "x_opencti_workflow_id" in stix_object
|
|
595
|
+
else None
|
|
596
|
+
),
|
|
577
597
|
update=update,
|
|
578
598
|
)
|
|
579
599
|
else:
|
|
@@ -489,81 +489,105 @@ class MalwareAnalysis:
|
|
|
489
489
|
if stix_object is not None:
|
|
490
490
|
# Search in extensions
|
|
491
491
|
if "x_opencti_stix_ids" not in stix_object:
|
|
492
|
-
stix_object[
|
|
493
|
-
"
|
|
494
|
-
|
|
492
|
+
stix_object["x_opencti_stix_ids"] = (
|
|
493
|
+
self.opencti.get_attribute_in_extension("stix_ids", stix_object)
|
|
494
|
+
)
|
|
495
495
|
if "x_opencti_granted_refs" not in stix_object:
|
|
496
|
-
stix_object[
|
|
497
|
-
"
|
|
498
|
-
|
|
496
|
+
stix_object["x_opencti_granted_refs"] = (
|
|
497
|
+
self.opencti.get_attribute_in_extension("granted_refs", stix_object)
|
|
498
|
+
)
|
|
499
499
|
|
|
500
500
|
return self.create(
|
|
501
501
|
stix_id=stix_object["id"],
|
|
502
|
-
createdBy=
|
|
503
|
-
|
|
504
|
-
|
|
505
|
-
objectMarking=
|
|
506
|
-
|
|
507
|
-
|
|
508
|
-
|
|
509
|
-
|
|
510
|
-
|
|
511
|
-
|
|
512
|
-
|
|
513
|
-
|
|
502
|
+
createdBy=(
|
|
503
|
+
extras["created_by_id"] if "created_by_id" in extras else None
|
|
504
|
+
),
|
|
505
|
+
objectMarking=(
|
|
506
|
+
extras["object_marking_ids"]
|
|
507
|
+
if "object_marking_ids" in extras
|
|
508
|
+
else None
|
|
509
|
+
),
|
|
510
|
+
objectLabel=(
|
|
511
|
+
extras["object_label_ids"] if "object_label_ids" in extras else None
|
|
512
|
+
),
|
|
513
|
+
externalReferences=(
|
|
514
|
+
extras["external_references_ids"]
|
|
515
|
+
if "external_references_ids" in extras
|
|
516
|
+
else None
|
|
517
|
+
),
|
|
514
518
|
revoked=stix_object["revoked"] if "revoked" in stix_object else None,
|
|
515
|
-
confidence=
|
|
516
|
-
|
|
517
|
-
|
|
519
|
+
confidence=(
|
|
520
|
+
stix_object["confidence"] if "confidence" in stix_object else None
|
|
521
|
+
),
|
|
518
522
|
lang=stix_object["lang"] if "lang" in stix_object else None,
|
|
519
523
|
created=stix_object["created"] if "created" in stix_object else None,
|
|
520
524
|
modified=stix_object["modified"] if "modified" in stix_object else None,
|
|
521
525
|
product=stix_object["product"] if "product" in stix_object else None,
|
|
522
|
-
result_name=
|
|
523
|
-
|
|
524
|
-
|
|
526
|
+
result_name=(
|
|
527
|
+
stix_object["result_name"] if "result_name" in stix_object else None
|
|
528
|
+
),
|
|
525
529
|
result=stix_object["result"] if "result" in stix_object else None,
|
|
526
|
-
submitted=
|
|
527
|
-
|
|
528
|
-
|
|
529
|
-
analysis_started=
|
|
530
|
-
|
|
531
|
-
|
|
532
|
-
|
|
533
|
-
|
|
534
|
-
|
|
530
|
+
submitted=(
|
|
531
|
+
stix_object["submitted"] if "submitted" in stix_object else None
|
|
532
|
+
),
|
|
533
|
+
analysis_started=(
|
|
534
|
+
stix_object["analysis_started"]
|
|
535
|
+
if "analysis_started" in stix_object
|
|
536
|
+
else None
|
|
537
|
+
),
|
|
538
|
+
analysis_ended=(
|
|
539
|
+
stix_object["analysis_ended"]
|
|
540
|
+
if "analysis_ended" in stix_object
|
|
541
|
+
else None
|
|
542
|
+
),
|
|
535
543
|
version=stix_object["version"] if "version" in stix_object else None,
|
|
536
|
-
configuration_version=
|
|
537
|
-
|
|
538
|
-
|
|
539
|
-
|
|
540
|
-
|
|
541
|
-
|
|
542
|
-
|
|
543
|
-
|
|
544
|
-
|
|
545
|
-
|
|
546
|
-
|
|
547
|
-
|
|
548
|
-
|
|
549
|
-
|
|
550
|
-
|
|
551
|
-
|
|
552
|
-
|
|
553
|
-
|
|
554
|
-
|
|
555
|
-
|
|
556
|
-
|
|
557
|
-
|
|
558
|
-
|
|
559
|
-
|
|
544
|
+
configuration_version=(
|
|
545
|
+
stix_object["configuration_version"]
|
|
546
|
+
if "configuration_version" in stix_object
|
|
547
|
+
else None
|
|
548
|
+
),
|
|
549
|
+
analysis_engine_version=(
|
|
550
|
+
stix_object["analysis_engine_version"]
|
|
551
|
+
if "analysis_engine_version" in stix_object
|
|
552
|
+
else None
|
|
553
|
+
),
|
|
554
|
+
analysis_definition_version=(
|
|
555
|
+
stix_object["analysis_definition_version"]
|
|
556
|
+
if "analysis_definition_version" in stix_object
|
|
557
|
+
else None
|
|
558
|
+
),
|
|
559
|
+
operatingSystem=(
|
|
560
|
+
stix_object["operating_system_ref"]
|
|
561
|
+
if "operating_system_ref" in stix_object
|
|
562
|
+
else None
|
|
563
|
+
),
|
|
564
|
+
analysisSco=(
|
|
565
|
+
stix_object["analysis_sco_refs"]
|
|
566
|
+
if "analysis_sco_refs" in stix_object
|
|
567
|
+
else None
|
|
568
|
+
),
|
|
569
|
+
hostVm=(
|
|
570
|
+
stix_object["host_vm_ref"] if "host_vm_ref" in stix_object else None
|
|
571
|
+
),
|
|
572
|
+
installedSoftware=(
|
|
573
|
+
stix_object["installed_software_refs"]
|
|
574
|
+
if "installed_software_refs" in stix_object
|
|
575
|
+
else None
|
|
576
|
+
),
|
|
577
|
+
sample=(
|
|
578
|
+
stix_object["sample_ref"] if "sample_ref" in stix_object else None
|
|
579
|
+
),
|
|
560
580
|
modules=stix_object["modules"] if "modules" in stix_object else None,
|
|
561
|
-
x_opencti_stix_ids=
|
|
562
|
-
|
|
563
|
-
|
|
564
|
-
|
|
565
|
-
|
|
566
|
-
|
|
581
|
+
x_opencti_stix_ids=(
|
|
582
|
+
stix_object["x_opencti_stix_ids"]
|
|
583
|
+
if "x_opencti_stix_ids" in stix_object
|
|
584
|
+
else None
|
|
585
|
+
),
|
|
586
|
+
objectOrganization=(
|
|
587
|
+
stix_object["x_opencti_granted_refs"]
|
|
588
|
+
if "x_opencti_granted_refs" in stix_object
|
|
589
|
+
else None
|
|
590
|
+
),
|
|
567
591
|
update=update,
|
|
568
592
|
)
|
|
569
593
|
else:
|
|
@@ -291,17 +291,17 @@ class MarkingDefinition:
|
|
|
291
291
|
and self.opencti.get_attribute_in_extension("order", stix_object)
|
|
292
292
|
is not None
|
|
293
293
|
):
|
|
294
|
-
stix_object[
|
|
295
|
-
"
|
|
296
|
-
|
|
294
|
+
stix_object["x_opencti_order"] = (
|
|
295
|
+
self.opencti.get_attribute_in_extension("order", stix_object)
|
|
296
|
+
)
|
|
297
297
|
if "x_opencti_color" not in stix_object:
|
|
298
|
-
stix_object[
|
|
299
|
-
"
|
|
300
|
-
|
|
298
|
+
stix_object["x_opencti_color"] = (
|
|
299
|
+
self.opencti.get_attribute_in_extension("color", stix_object)
|
|
300
|
+
)
|
|
301
301
|
if "x_opencti_stix_ids" not in stix_object:
|
|
302
|
-
stix_object[
|
|
303
|
-
"
|
|
304
|
-
|
|
302
|
+
stix_object["x_opencti_stix_ids"] = (
|
|
303
|
+
self.opencti.get_attribute_in_extension("stix_ids", stix_object)
|
|
304
|
+
)
|
|
305
305
|
|
|
306
306
|
return self.opencti.marking_definition.create(
|
|
307
307
|
stix_id=stix_object["id"],
|
|
@@ -309,15 +309,21 @@ class MarkingDefinition:
|
|
|
309
309
|
modified=stix_object["modified"] if "modified" in stix_object else None,
|
|
310
310
|
definition_type=definition_type,
|
|
311
311
|
definition=definition,
|
|
312
|
-
x_opencti_order=
|
|
313
|
-
|
|
314
|
-
|
|
315
|
-
|
|
316
|
-
|
|
317
|
-
|
|
318
|
-
|
|
319
|
-
|
|
320
|
-
|
|
312
|
+
x_opencti_order=(
|
|
313
|
+
stix_object["x_opencti_order"]
|
|
314
|
+
if "x_opencti_order" in stix_object
|
|
315
|
+
else 0
|
|
316
|
+
),
|
|
317
|
+
x_opencti_color=(
|
|
318
|
+
stix_object["x_opencti_color"]
|
|
319
|
+
if "x_opencti_color" in stix_object
|
|
320
|
+
else None
|
|
321
|
+
),
|
|
322
|
+
x_opencti_stix_ids=(
|
|
323
|
+
stix_object["x_opencti_stix_ids"]
|
|
324
|
+
if "x_opencti_stix_ids" in stix_object
|
|
325
|
+
else None
|
|
326
|
+
),
|
|
321
327
|
update=update,
|
|
322
328
|
)
|
|
323
329
|
else:
|
|
@@ -442,51 +442,61 @@ class Narrative:
|
|
|
442
442
|
if stix_object is not None:
|
|
443
443
|
# Search in extensions
|
|
444
444
|
if "x_opencti_stix_ids" not in stix_object:
|
|
445
|
-
stix_object[
|
|
446
|
-
"
|
|
447
|
-
|
|
445
|
+
stix_object["x_opencti_stix_ids"] = (
|
|
446
|
+
self.opencti.get_attribute_in_extension("stix_ids", stix_object)
|
|
447
|
+
)
|
|
448
448
|
if "x_opencti_granted_refs" not in stix_object:
|
|
449
|
-
stix_object[
|
|
450
|
-
"
|
|
451
|
-
|
|
449
|
+
stix_object["x_opencti_granted_refs"] = (
|
|
450
|
+
self.opencti.get_attribute_in_extension("granted_refs", stix_object)
|
|
451
|
+
)
|
|
452
452
|
|
|
453
453
|
return self.opencti.narrative.create(
|
|
454
454
|
stix_id=stix_object["id"],
|
|
455
|
-
createdBy=
|
|
456
|
-
|
|
457
|
-
|
|
458
|
-
objectMarking=
|
|
459
|
-
|
|
460
|
-
|
|
461
|
-
|
|
462
|
-
|
|
463
|
-
|
|
464
|
-
|
|
465
|
-
|
|
466
|
-
|
|
455
|
+
createdBy=(
|
|
456
|
+
extras["created_by_id"] if "created_by_id" in extras else None
|
|
457
|
+
),
|
|
458
|
+
objectMarking=(
|
|
459
|
+
extras["object_marking_ids"]
|
|
460
|
+
if "object_marking_ids" in extras
|
|
461
|
+
else None
|
|
462
|
+
),
|
|
463
|
+
objectLabel=(
|
|
464
|
+
extras["object_label_ids"] if "object_label_ids" in extras else None
|
|
465
|
+
),
|
|
466
|
+
externalReferences=(
|
|
467
|
+
extras["external_references_ids"]
|
|
468
|
+
if "external_references_ids" in extras
|
|
469
|
+
else None
|
|
470
|
+
),
|
|
467
471
|
revoked=stix_object["revoked"] if "revoked" in stix_object else None,
|
|
468
|
-
confidence=
|
|
469
|
-
|
|
470
|
-
|
|
472
|
+
confidence=(
|
|
473
|
+
stix_object["confidence"] if "confidence" in stix_object else None
|
|
474
|
+
),
|
|
471
475
|
lang=stix_object["lang"] if "lang" in stix_object else None,
|
|
472
476
|
created=stix_object["created"] if "created" in stix_object else None,
|
|
473
477
|
modified=stix_object["modified"] if "modified" in stix_object else None,
|
|
474
478
|
name=stix_object["name"],
|
|
475
|
-
description=
|
|
476
|
-
stix_object["description"]
|
|
477
|
-
|
|
478
|
-
|
|
479
|
-
|
|
479
|
+
description=(
|
|
480
|
+
self.opencti.stix2.convert_markdown(stix_object["description"])
|
|
481
|
+
if "description" in stix_object
|
|
482
|
+
else None
|
|
483
|
+
),
|
|
480
484
|
aliases=self.opencti.stix2.pick_aliases(stix_object),
|
|
481
|
-
narrative_types=
|
|
482
|
-
|
|
483
|
-
|
|
484
|
-
|
|
485
|
-
|
|
486
|
-
|
|
487
|
-
|
|
488
|
-
|
|
489
|
-
|
|
485
|
+
narrative_types=(
|
|
486
|
+
stix_object["narrative_types"]
|
|
487
|
+
if "narrative_types" in stix_object
|
|
488
|
+
else None
|
|
489
|
+
),
|
|
490
|
+
x_opencti_stix_ids=(
|
|
491
|
+
stix_object["x_opencti_stix_ids"]
|
|
492
|
+
if "x_opencti_stix_ids" in stix_object
|
|
493
|
+
else None
|
|
494
|
+
),
|
|
495
|
+
objectOrganization=(
|
|
496
|
+
stix_object["x_opencti_granted_refs"]
|
|
497
|
+
if "x_opencti_granted_refs" in stix_object
|
|
498
|
+
else None
|
|
499
|
+
),
|
|
490
500
|
update=update,
|
|
491
501
|
)
|
|
492
502
|
else:
|
pycti/entities/opencti_note.py
CHANGED
|
@@ -810,55 +810,67 @@ class Note:
|
|
|
810
810
|
if stix_object is not None:
|
|
811
811
|
# Search in extensions
|
|
812
812
|
if "x_opencti_stix_ids" not in stix_object:
|
|
813
|
-
stix_object[
|
|
814
|
-
"
|
|
815
|
-
|
|
813
|
+
stix_object["x_opencti_stix_ids"] = (
|
|
814
|
+
self.opencti.get_attribute_in_extension("stix_ids", stix_object)
|
|
815
|
+
)
|
|
816
816
|
if "x_opencti_granted_refs" not in stix_object:
|
|
817
|
-
stix_object[
|
|
818
|
-
"
|
|
819
|
-
|
|
817
|
+
stix_object["x_opencti_granted_refs"] = (
|
|
818
|
+
self.opencti.get_attribute_in_extension("granted_refs", stix_object)
|
|
819
|
+
)
|
|
820
820
|
|
|
821
821
|
return self.create(
|
|
822
822
|
stix_id=stix_object["id"],
|
|
823
|
-
createdBy=
|
|
824
|
-
|
|
825
|
-
|
|
826
|
-
objectMarking=
|
|
827
|
-
|
|
828
|
-
|
|
829
|
-
|
|
830
|
-
|
|
831
|
-
|
|
823
|
+
createdBy=(
|
|
824
|
+
extras["created_by_id"] if "created_by_id" in extras else None
|
|
825
|
+
),
|
|
826
|
+
objectMarking=(
|
|
827
|
+
extras["object_marking_ids"]
|
|
828
|
+
if "object_marking_ids" in extras
|
|
829
|
+
else None
|
|
830
|
+
),
|
|
831
|
+
objectLabel=(
|
|
832
|
+
extras["object_label_ids"] if "object_label_ids" in extras else None
|
|
833
|
+
),
|
|
832
834
|
objects=extras["object_ids"] if "object_ids" in extras else [],
|
|
833
|
-
externalReferences=
|
|
834
|
-
|
|
835
|
-
|
|
835
|
+
externalReferences=(
|
|
836
|
+
extras["external_references_ids"]
|
|
837
|
+
if "external_references_ids" in extras
|
|
838
|
+
else None
|
|
839
|
+
),
|
|
836
840
|
revoked=stix_object["revoked"] if "revoked" in stix_object else None,
|
|
837
|
-
confidence=
|
|
838
|
-
|
|
839
|
-
|
|
841
|
+
confidence=(
|
|
842
|
+
stix_object["confidence"] if "confidence" in stix_object else None
|
|
843
|
+
),
|
|
840
844
|
lang=stix_object["lang"] if "lang" in stix_object else None,
|
|
841
845
|
created=stix_object["created"] if "created" in stix_object else None,
|
|
842
846
|
modified=stix_object["modified"] if "modified" in stix_object else None,
|
|
843
|
-
abstract=
|
|
844
|
-
|
|
845
|
-
|
|
846
|
-
|
|
847
|
-
|
|
848
|
-
|
|
849
|
-
|
|
850
|
-
|
|
851
|
-
|
|
847
|
+
abstract=(
|
|
848
|
+
self.opencti.stix2.convert_markdown(stix_object["abstract"])
|
|
849
|
+
if "abstract" in stix_object
|
|
850
|
+
else None
|
|
851
|
+
),
|
|
852
|
+
content=(
|
|
853
|
+
self.opencti.stix2.convert_markdown(stix_object["content"])
|
|
854
|
+
if "content" in stix_object
|
|
855
|
+
else None
|
|
856
|
+
),
|
|
857
|
+
x_opencti_stix_ids=(
|
|
858
|
+
stix_object["x_opencti_stix_ids"]
|
|
859
|
+
if "x_opencti_stix_ids" in stix_object
|
|
860
|
+
else None
|
|
861
|
+
),
|
|
852
862
|
authors=stix_object["authors"] if "authors" in stix_object else None,
|
|
853
|
-
note_types=
|
|
854
|
-
|
|
855
|
-
|
|
856
|
-
likelihood=
|
|
857
|
-
|
|
858
|
-
|
|
859
|
-
objectOrganization=
|
|
860
|
-
|
|
861
|
-
|
|
863
|
+
note_types=(
|
|
864
|
+
stix_object["note_types"] if "note_types" in stix_object else None
|
|
865
|
+
),
|
|
866
|
+
likelihood=(
|
|
867
|
+
stix_object["likelihood"] if "likelihood" in stix_object else None
|
|
868
|
+
),
|
|
869
|
+
objectOrganization=(
|
|
870
|
+
stix_object["x_opencti_granted_refs"]
|
|
871
|
+
if "x_opencti_granted_refs" in stix_object
|
|
872
|
+
else None
|
|
873
|
+
),
|
|
862
874
|
update=update,
|
|
863
875
|
)
|
|
864
876
|
else:
|