pycti 5.12.21__py3-none-any.whl → 5.12.23__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of pycti might be problematic. Click here for more details.
- pycti/__init__.py +1 -1
- pycti/connector/opencti_connector_helper.py +13 -11
- pycti/entities/opencti_attack_pattern.py +76 -58
- pycti/entities/opencti_campaign.py +49 -41
- pycti/entities/opencti_case_incident.py +62 -48
- pycti/entities/opencti_case_rfi.py +45 -35
- pycti/entities/opencti_case_rft.py +45 -35
- pycti/entities/opencti_channel.py +45 -35
- pycti/entities/opencti_course_of_action.py +43 -35
- pycti/entities/opencti_data_component.py +43 -35
- pycti/entities/opencti_data_source.py +48 -38
- pycti/entities/opencti_event.py +44 -38
- pycti/entities/opencti_external_reference.py +5 -3
- pycti/entities/opencti_feedback.py +40 -32
- pycti/entities/opencti_grouping.py +43 -35
- pycti/entities/opencti_identity.py +91 -73
- pycti/entities/opencti_incident.py +59 -47
- pycti/entities/opencti_indicator.py +110 -84
- pycti/entities/opencti_infrastructure.py +56 -44
- pycti/entities/opencti_intrusion_set.py +61 -47
- pycti/entities/opencti_language.py +30 -24
- pycti/entities/opencti_location.py +41 -35
- pycti/entities/opencti_malware.py +83 -63
- pycti/entities/opencti_malware_analysis.py +87 -63
- pycti/entities/opencti_marking_definition.py +24 -18
- pycti/entities/opencti_narrative.py +45 -35
- pycti/entities/opencti_note.py +51 -39
- pycti/entities/opencti_observed_data.py +70 -48
- pycti/entities/opencti_opinion.py +40 -32
- pycti/entities/opencti_report.py +74 -47
- pycti/entities/opencti_stix_core_object.py +10 -10
- pycti/entities/opencti_stix_core_relationship.py +55 -41
- pycti/entities/opencti_stix_cyber_observable.py +442 -318
- pycti/entities/opencti_stix_domain_object.py +15 -13
- pycti/entities/opencti_stix_object_or_stix_relationship.py +5 -5
- pycti/entities/opencti_task.py +44 -36
- pycti/entities/opencti_threat_actor_group.py +76 -56
- pycti/entities/opencti_threat_actor_individual.py +76 -56
- pycti/entities/opencti_tool.py +53 -41
- pycti/entities/opencti_vulnerability.py +151 -109
- pycti/utils/constants.py +1 -0
- pycti/utils/opencti_stix2.py +177 -139
- pycti/utils/opencti_stix2_update.py +20 -12
- pycti/utils/opencti_stix2_utils.py +5 -3
- {pycti-5.12.21.dist-info → pycti-5.12.23.dist-info}/METADATA +2 -2
- pycti-5.12.23.dist-info/RECORD +68 -0
- pycti-5.12.21.dist-info/RECORD +0 -68
- {pycti-5.12.21.dist-info → pycti-5.12.23.dist-info}/LICENSE +0 -0
- {pycti-5.12.21.dist-info → pycti-5.12.23.dist-info}/WHEEL +0 -0
- {pycti-5.12.21.dist-info → pycti-5.12.23.dist-info}/top_level.txt +0 -0
|
@@ -496,11 +496,11 @@ class StixDomainObject:
|
|
|
496
496
|
... on Vulnerability {
|
|
497
497
|
name
|
|
498
498
|
description
|
|
499
|
-
|
|
500
|
-
|
|
501
|
-
|
|
502
|
-
|
|
503
|
-
|
|
499
|
+
x_opencti_cvss_base_score
|
|
500
|
+
x_opencti_cvss_base_severity
|
|
501
|
+
x_opencti_cvss_attack_vector
|
|
502
|
+
x_opencti_cvss_integrity_impact
|
|
503
|
+
x_opencti_cvss_availability_impact
|
|
504
504
|
}
|
|
505
505
|
... on Incident {
|
|
506
506
|
name
|
|
@@ -1010,11 +1010,11 @@ class StixDomainObject:
|
|
|
1010
1010
|
... on Vulnerability {
|
|
1011
1011
|
name
|
|
1012
1012
|
description
|
|
1013
|
-
|
|
1014
|
-
|
|
1015
|
-
|
|
1016
|
-
|
|
1017
|
-
|
|
1013
|
+
x_opencti_cvss_base_score
|
|
1014
|
+
x_opencti_cvss_base_severity
|
|
1015
|
+
x_opencti_cvss_attack_vector
|
|
1016
|
+
x_opencti_cvss_integrity_impact
|
|
1017
|
+
x_opencti_cvss_availability_impact
|
|
1018
1018
|
}
|
|
1019
1019
|
... on Incident {
|
|
1020
1020
|
name
|
|
@@ -1347,9 +1347,11 @@ class StixDomainObject:
|
|
|
1347
1347
|
{
|
|
1348
1348
|
"id": id,
|
|
1349
1349
|
"file": (self.file(final_file_name, data, mime_type)),
|
|
1350
|
-
"noTriggerImport":
|
|
1351
|
-
|
|
1352
|
-
|
|
1350
|
+
"noTriggerImport": (
|
|
1351
|
+
no_trigger_import
|
|
1352
|
+
if isinstance(no_trigger_import, bool)
|
|
1353
|
+
else no_trigger_import == "True"
|
|
1354
|
+
),
|
|
1353
1355
|
},
|
|
1354
1356
|
)
|
|
1355
1357
|
else:
|
|
@@ -309,11 +309,11 @@ class StixObjectOrStixRelationship:
|
|
|
309
309
|
... on Vulnerability {
|
|
310
310
|
name
|
|
311
311
|
description
|
|
312
|
-
|
|
313
|
-
|
|
314
|
-
|
|
315
|
-
|
|
316
|
-
|
|
312
|
+
x_opencti_cvss_base_score
|
|
313
|
+
x_opencti_cvss_base_severity
|
|
314
|
+
x_opencti_cvss_attack_vector
|
|
315
|
+
x_opencti_cvss_integrity_impact
|
|
316
|
+
x_opencti_cvss_availability_impact
|
|
317
317
|
}
|
|
318
318
|
... on Incident {
|
|
319
319
|
name
|
pycti/entities/opencti_task.py
CHANGED
|
@@ -622,53 +622,61 @@ class Task:
|
|
|
622
622
|
if stix_object is not None:
|
|
623
623
|
# Search in extensions
|
|
624
624
|
if "x_opencti_stix_ids" not in stix_object:
|
|
625
|
-
stix_object[
|
|
626
|
-
"
|
|
627
|
-
|
|
625
|
+
stix_object["x_opencti_stix_ids"] = (
|
|
626
|
+
self.opencti.get_attribute_in_extension("stix_ids", stix_object)
|
|
627
|
+
)
|
|
628
628
|
if "x_opencti_granted_refs" not in stix_object:
|
|
629
|
-
stix_object[
|
|
630
|
-
"
|
|
631
|
-
|
|
629
|
+
stix_object["x_opencti_granted_refs"] = (
|
|
630
|
+
self.opencti.get_attribute_in_extension("granted_refs", stix_object)
|
|
631
|
+
)
|
|
632
632
|
if "x_opencti_workflow_id" not in stix_object:
|
|
633
|
-
stix_object[
|
|
634
|
-
|
|
635
|
-
|
|
636
|
-
|
|
633
|
+
stix_object["x_opencti_workflow_id"] = (
|
|
634
|
+
self.opencti.get_attribute_in_extension(
|
|
635
|
+
"x_opencti_workflow_id", stix_object
|
|
636
|
+
)
|
|
637
637
|
)
|
|
638
638
|
if "x_opencti_assignee_ids" not in stix_object:
|
|
639
|
-
stix_object[
|
|
640
|
-
"
|
|
641
|
-
|
|
639
|
+
stix_object["x_opencti_assignee_ids"] = (
|
|
640
|
+
self.opencti.get_attribute_in_extension("assignee_ids", stix_object)
|
|
641
|
+
)
|
|
642
642
|
|
|
643
643
|
return self.create(
|
|
644
644
|
stix_id=stix_object["id"],
|
|
645
|
-
createdBy=
|
|
646
|
-
|
|
647
|
-
|
|
648
|
-
objectMarking=
|
|
649
|
-
|
|
650
|
-
|
|
651
|
-
|
|
652
|
-
|
|
653
|
-
|
|
645
|
+
createdBy=(
|
|
646
|
+
extras["created_by_id"] if "created_by_id" in extras else None
|
|
647
|
+
),
|
|
648
|
+
objectMarking=(
|
|
649
|
+
extras["object_marking_ids"]
|
|
650
|
+
if "object_marking_ids" in extras
|
|
651
|
+
else None
|
|
652
|
+
),
|
|
653
|
+
objectLabel=(
|
|
654
|
+
extras["object_label_ids"] if "object_label_ids" in extras else None
|
|
655
|
+
),
|
|
654
656
|
objects=extras["object_ids"] if "object_ids" in extras else [],
|
|
655
657
|
created=stix_object["created"] if "created" in stix_object else None,
|
|
656
658
|
name=stix_object["name"],
|
|
657
|
-
description=
|
|
658
|
-
stix_object["description"]
|
|
659
|
-
|
|
660
|
-
|
|
661
|
-
|
|
659
|
+
description=(
|
|
660
|
+
self.opencti.stix2.convert_markdown(stix_object["description"])
|
|
661
|
+
if "description" in stix_object
|
|
662
|
+
else None
|
|
663
|
+
),
|
|
662
664
|
due_date=stix_object["due_date"] if "due_date" in stix_object else None,
|
|
663
|
-
objectOrganization=
|
|
664
|
-
|
|
665
|
-
|
|
666
|
-
|
|
667
|
-
|
|
668
|
-
|
|
669
|
-
|
|
670
|
-
|
|
671
|
-
|
|
665
|
+
objectOrganization=(
|
|
666
|
+
stix_object["x_opencti_granted_refs"]
|
|
667
|
+
if "x_opencti_granted_refs" in stix_object
|
|
668
|
+
else None
|
|
669
|
+
),
|
|
670
|
+
objectAssignee=(
|
|
671
|
+
stix_object["x_opencti_assignee_ids"]
|
|
672
|
+
if "x_opencti_assignee_ids" in stix_object
|
|
673
|
+
else None
|
|
674
|
+
),
|
|
675
|
+
x_opencti_workflow_id=(
|
|
676
|
+
stix_object["x_opencti_workflow_id"]
|
|
677
|
+
if "x_opencti_workflow_id" in stix_object
|
|
678
|
+
else None
|
|
679
|
+
),
|
|
672
680
|
update=update,
|
|
673
681
|
)
|
|
674
682
|
else:
|
|
@@ -399,73 +399,93 @@ class ThreatActorGroup:
|
|
|
399
399
|
if stix_object is not None:
|
|
400
400
|
# Search in extensions
|
|
401
401
|
if "x_opencti_stix_ids" not in stix_object:
|
|
402
|
-
stix_object[
|
|
403
|
-
"
|
|
404
|
-
|
|
402
|
+
stix_object["x_opencti_stix_ids"] = (
|
|
403
|
+
self.opencti.get_attribute_in_extension("stix_ids", stix_object)
|
|
404
|
+
)
|
|
405
405
|
if "x_opencti_granted_refs" not in stix_object:
|
|
406
|
-
stix_object[
|
|
407
|
-
"
|
|
408
|
-
|
|
406
|
+
stix_object["x_opencti_granted_refs"] = (
|
|
407
|
+
self.opencti.get_attribute_in_extension("granted_refs", stix_object)
|
|
408
|
+
)
|
|
409
409
|
|
|
410
410
|
return self.create(
|
|
411
411
|
stix_id=stix_object["id"],
|
|
412
|
-
createdBy=
|
|
413
|
-
|
|
414
|
-
|
|
415
|
-
objectMarking=
|
|
416
|
-
|
|
417
|
-
|
|
418
|
-
|
|
419
|
-
|
|
420
|
-
|
|
421
|
-
|
|
422
|
-
|
|
423
|
-
|
|
412
|
+
createdBy=(
|
|
413
|
+
extras["created_by_id"] if "created_by_id" in extras else None
|
|
414
|
+
),
|
|
415
|
+
objectMarking=(
|
|
416
|
+
extras["object_marking_ids"]
|
|
417
|
+
if "object_marking_ids" in extras
|
|
418
|
+
else None
|
|
419
|
+
),
|
|
420
|
+
objectLabel=(
|
|
421
|
+
extras["object_label_ids"] if "object_label_ids" in extras else None
|
|
422
|
+
),
|
|
423
|
+
externalReferences=(
|
|
424
|
+
extras["external_references_ids"]
|
|
425
|
+
if "external_references_ids" in extras
|
|
426
|
+
else None
|
|
427
|
+
),
|
|
424
428
|
revoked=stix_object["revoked"] if "revoked" in stix_object else None,
|
|
425
|
-
confidence=
|
|
426
|
-
|
|
427
|
-
|
|
429
|
+
confidence=(
|
|
430
|
+
stix_object["confidence"] if "confidence" in stix_object else None
|
|
431
|
+
),
|
|
428
432
|
lang=stix_object["lang"] if "lang" in stix_object else None,
|
|
429
433
|
created=stix_object["created"] if "created" in stix_object else None,
|
|
430
434
|
modified=stix_object["modified"] if "modified" in stix_object else None,
|
|
431
435
|
name=stix_object["name"],
|
|
432
|
-
description=
|
|
433
|
-
stix_object["description"]
|
|
434
|
-
|
|
435
|
-
|
|
436
|
-
|
|
436
|
+
description=(
|
|
437
|
+
self.opencti.stix2.convert_markdown(stix_object["description"])
|
|
438
|
+
if "description" in stix_object
|
|
439
|
+
else None
|
|
440
|
+
),
|
|
437
441
|
aliases=self.opencti.stix2.pick_aliases(stix_object),
|
|
438
|
-
threat_actor_types=
|
|
439
|
-
|
|
440
|
-
|
|
441
|
-
|
|
442
|
-
|
|
443
|
-
|
|
444
|
-
|
|
445
|
-
|
|
446
|
-
|
|
442
|
+
threat_actor_types=(
|
|
443
|
+
stix_object["threat_actor_types"]
|
|
444
|
+
if "threat_actor_types" in stix_object
|
|
445
|
+
else None
|
|
446
|
+
),
|
|
447
|
+
first_seen=(
|
|
448
|
+
stix_object["first_seen"] if "first_seen" in stix_object else None
|
|
449
|
+
),
|
|
450
|
+
last_seen=(
|
|
451
|
+
stix_object["last_seen"] if "last_seen" in stix_object else None
|
|
452
|
+
),
|
|
447
453
|
goals=stix_object["goals"] if "goals" in stix_object else None,
|
|
448
|
-
sophistication=
|
|
449
|
-
|
|
450
|
-
|
|
451
|
-
|
|
452
|
-
|
|
453
|
-
|
|
454
|
-
|
|
455
|
-
|
|
456
|
-
|
|
457
|
-
|
|
458
|
-
|
|
459
|
-
|
|
460
|
-
|
|
461
|
-
|
|
462
|
-
|
|
463
|
-
|
|
464
|
-
|
|
465
|
-
|
|
466
|
-
|
|
467
|
-
|
|
468
|
-
|
|
454
|
+
sophistication=(
|
|
455
|
+
stix_object["sophistication"]
|
|
456
|
+
if "sophistication" in stix_object
|
|
457
|
+
else None
|
|
458
|
+
),
|
|
459
|
+
resource_level=(
|
|
460
|
+
stix_object["resource_level"]
|
|
461
|
+
if "resource_level" in stix_object
|
|
462
|
+
else None
|
|
463
|
+
),
|
|
464
|
+
primary_motivation=(
|
|
465
|
+
stix_object["primary_motivation"]
|
|
466
|
+
if "primary_motivation" in stix_object
|
|
467
|
+
else None
|
|
468
|
+
),
|
|
469
|
+
secondary_motivations=(
|
|
470
|
+
stix_object["secondary_motivations"]
|
|
471
|
+
if "secondary_motivations" in stix_object
|
|
472
|
+
else None
|
|
473
|
+
),
|
|
474
|
+
personal_motivations=(
|
|
475
|
+
stix_object["personal_motivations"]
|
|
476
|
+
if "personal_motivations" in stix_object
|
|
477
|
+
else None
|
|
478
|
+
),
|
|
479
|
+
x_opencti_stix_ids=(
|
|
480
|
+
stix_object["x_opencti_stix_ids"]
|
|
481
|
+
if "x_opencti_stix_ids" in stix_object
|
|
482
|
+
else None
|
|
483
|
+
),
|
|
484
|
+
objectOrganization=(
|
|
485
|
+
stix_object["x_opencti_granted_refs"]
|
|
486
|
+
if "x_opencti_granted_refs" in stix_object
|
|
487
|
+
else None
|
|
488
|
+
),
|
|
469
489
|
update=update,
|
|
470
490
|
)
|
|
471
491
|
else:
|
|
@@ -402,73 +402,93 @@ class ThreatActorIndividual:
|
|
|
402
402
|
if stix_object is not None:
|
|
403
403
|
# Search in extensions
|
|
404
404
|
if "x_opencti_stix_ids" not in stix_object:
|
|
405
|
-
stix_object[
|
|
406
|
-
"
|
|
407
|
-
|
|
405
|
+
stix_object["x_opencti_stix_ids"] = (
|
|
406
|
+
self.opencti.get_attribute_in_extension("stix_ids", stix_object)
|
|
407
|
+
)
|
|
408
408
|
if "x_opencti_granted_refs" not in stix_object:
|
|
409
|
-
stix_object[
|
|
410
|
-
"
|
|
411
|
-
|
|
409
|
+
stix_object["x_opencti_granted_refs"] = (
|
|
410
|
+
self.opencti.get_attribute_in_extension("granted_refs", stix_object)
|
|
411
|
+
)
|
|
412
412
|
|
|
413
413
|
return self.create(
|
|
414
414
|
stix_id=stix_object["id"],
|
|
415
|
-
createdBy=
|
|
416
|
-
|
|
417
|
-
|
|
418
|
-
objectMarking=
|
|
419
|
-
|
|
420
|
-
|
|
421
|
-
|
|
422
|
-
|
|
423
|
-
|
|
424
|
-
|
|
425
|
-
|
|
426
|
-
|
|
415
|
+
createdBy=(
|
|
416
|
+
extras["created_by_id"] if "created_by_id" in extras else None
|
|
417
|
+
),
|
|
418
|
+
objectMarking=(
|
|
419
|
+
extras["object_marking_ids"]
|
|
420
|
+
if "object_marking_ids" in extras
|
|
421
|
+
else None
|
|
422
|
+
),
|
|
423
|
+
objectLabel=(
|
|
424
|
+
extras["object_label_ids"] if "object_label_ids" in extras else None
|
|
425
|
+
),
|
|
426
|
+
externalReferences=(
|
|
427
|
+
extras["external_references_ids"]
|
|
428
|
+
if "external_references_ids" in extras
|
|
429
|
+
else None
|
|
430
|
+
),
|
|
427
431
|
revoked=stix_object["revoked"] if "revoked" in stix_object else None,
|
|
428
|
-
confidence=
|
|
429
|
-
|
|
430
|
-
|
|
432
|
+
confidence=(
|
|
433
|
+
stix_object["confidence"] if "confidence" in stix_object else None
|
|
434
|
+
),
|
|
431
435
|
lang=stix_object["lang"] if "lang" in stix_object else None,
|
|
432
436
|
created=stix_object["created"] if "created" in stix_object else None,
|
|
433
437
|
modified=stix_object["modified"] if "modified" in stix_object else None,
|
|
434
438
|
name=stix_object["name"],
|
|
435
|
-
description=
|
|
436
|
-
stix_object["description"]
|
|
437
|
-
|
|
438
|
-
|
|
439
|
-
|
|
439
|
+
description=(
|
|
440
|
+
self.opencti.stix2.convert_markdown(stix_object["description"])
|
|
441
|
+
if "description" in stix_object
|
|
442
|
+
else None
|
|
443
|
+
),
|
|
440
444
|
aliases=self.opencti.stix2.pick_aliases(stix_object),
|
|
441
|
-
threat_actor_types=
|
|
442
|
-
|
|
443
|
-
|
|
444
|
-
|
|
445
|
-
|
|
446
|
-
|
|
447
|
-
|
|
448
|
-
|
|
449
|
-
|
|
445
|
+
threat_actor_types=(
|
|
446
|
+
stix_object["threat_actor_types"]
|
|
447
|
+
if "threat_actor_types" in stix_object
|
|
448
|
+
else None
|
|
449
|
+
),
|
|
450
|
+
first_seen=(
|
|
451
|
+
stix_object["first_seen"] if "first_seen" in stix_object else None
|
|
452
|
+
),
|
|
453
|
+
last_seen=(
|
|
454
|
+
stix_object["last_seen"] if "last_seen" in stix_object else None
|
|
455
|
+
),
|
|
450
456
|
goals=stix_object["goals"] if "goals" in stix_object else None,
|
|
451
|
-
sophistication=
|
|
452
|
-
|
|
453
|
-
|
|
454
|
-
|
|
455
|
-
|
|
456
|
-
|
|
457
|
-
|
|
458
|
-
|
|
459
|
-
|
|
460
|
-
|
|
461
|
-
|
|
462
|
-
|
|
463
|
-
|
|
464
|
-
|
|
465
|
-
|
|
466
|
-
|
|
467
|
-
|
|
468
|
-
|
|
469
|
-
|
|
470
|
-
|
|
471
|
-
|
|
457
|
+
sophistication=(
|
|
458
|
+
stix_object["sophistication"]
|
|
459
|
+
if "sophistication" in stix_object
|
|
460
|
+
else None
|
|
461
|
+
),
|
|
462
|
+
resource_level=(
|
|
463
|
+
stix_object["resource_level"]
|
|
464
|
+
if "resource_level" in stix_object
|
|
465
|
+
else None
|
|
466
|
+
),
|
|
467
|
+
primary_motivation=(
|
|
468
|
+
stix_object["primary_motivation"]
|
|
469
|
+
if "primary_motivation" in stix_object
|
|
470
|
+
else None
|
|
471
|
+
),
|
|
472
|
+
secondary_motivations=(
|
|
473
|
+
stix_object["secondary_motivations"]
|
|
474
|
+
if "secondary_motivations" in stix_object
|
|
475
|
+
else None
|
|
476
|
+
),
|
|
477
|
+
personal_motivations=(
|
|
478
|
+
stix_object["personal_motivations"]
|
|
479
|
+
if "personal_motivations" in stix_object
|
|
480
|
+
else None
|
|
481
|
+
),
|
|
482
|
+
x_opencti_stix_ids=(
|
|
483
|
+
stix_object["x_opencti_stix_ids"]
|
|
484
|
+
if "x_opencti_stix_ids" in stix_object
|
|
485
|
+
else None
|
|
486
|
+
),
|
|
487
|
+
objectOrganization=(
|
|
488
|
+
stix_object["x_opencti_granted_refs"]
|
|
489
|
+
if "x_opencti_granted_refs" in stix_object
|
|
490
|
+
else None
|
|
491
|
+
),
|
|
472
492
|
update=update,
|
|
473
493
|
)
|
|
474
494
|
else:
|
pycti/entities/opencti_tool.py
CHANGED
|
@@ -364,57 +364,69 @@ class Tool:
|
|
|
364
364
|
if stix_object is not None:
|
|
365
365
|
# Search in extensions
|
|
366
366
|
if "x_opencti_stix_ids" not in stix_object:
|
|
367
|
-
stix_object[
|
|
368
|
-
"
|
|
369
|
-
|
|
367
|
+
stix_object["x_opencti_stix_ids"] = (
|
|
368
|
+
self.opencti.get_attribute_in_extension("stix_ids", stix_object)
|
|
369
|
+
)
|
|
370
370
|
if "x_opencti_granted_refs" not in stix_object:
|
|
371
|
-
stix_object[
|
|
372
|
-
"
|
|
373
|
-
|
|
371
|
+
stix_object["x_opencti_granted_refs"] = (
|
|
372
|
+
self.opencti.get_attribute_in_extension("granted_refs", stix_object)
|
|
373
|
+
)
|
|
374
374
|
|
|
375
375
|
return self.opencti.tool.create(
|
|
376
376
|
stix_id=stix_object["id"],
|
|
377
|
-
createdBy=
|
|
378
|
-
|
|
379
|
-
|
|
380
|
-
objectMarking=
|
|
381
|
-
|
|
382
|
-
|
|
383
|
-
|
|
384
|
-
|
|
385
|
-
|
|
386
|
-
|
|
387
|
-
|
|
388
|
-
|
|
377
|
+
createdBy=(
|
|
378
|
+
extras["created_by_id"] if "created_by_id" in extras else None
|
|
379
|
+
),
|
|
380
|
+
objectMarking=(
|
|
381
|
+
extras["object_marking_ids"]
|
|
382
|
+
if "object_marking_ids" in extras
|
|
383
|
+
else None
|
|
384
|
+
),
|
|
385
|
+
objectLabel=(
|
|
386
|
+
extras["object_label_ids"] if "object_label_ids" in extras else None
|
|
387
|
+
),
|
|
388
|
+
externalReferences=(
|
|
389
|
+
extras["external_references_ids"]
|
|
390
|
+
if "external_references_ids" in extras
|
|
391
|
+
else None
|
|
392
|
+
),
|
|
389
393
|
revoked=stix_object["revoked"] if "revoked" in stix_object else None,
|
|
390
|
-
confidence=
|
|
391
|
-
|
|
392
|
-
|
|
394
|
+
confidence=(
|
|
395
|
+
stix_object["confidence"] if "confidence" in stix_object else None
|
|
396
|
+
),
|
|
393
397
|
lang=stix_object["lang"] if "lang" in stix_object else None,
|
|
394
398
|
created=stix_object["created"] if "created" in stix_object else None,
|
|
395
399
|
modified=stix_object["modified"] if "modified" in stix_object else None,
|
|
396
400
|
name=stix_object["name"],
|
|
397
|
-
description=
|
|
398
|
-
stix_object["description"]
|
|
399
|
-
|
|
400
|
-
|
|
401
|
-
|
|
401
|
+
description=(
|
|
402
|
+
self.opencti.stix2.convert_markdown(stix_object["description"])
|
|
403
|
+
if "description" in stix_object
|
|
404
|
+
else None
|
|
405
|
+
),
|
|
402
406
|
aliases=self.opencti.stix2.pick_aliases(stix_object),
|
|
403
|
-
tool_types=
|
|
404
|
-
|
|
405
|
-
|
|
406
|
-
tool_version=
|
|
407
|
-
|
|
408
|
-
|
|
409
|
-
|
|
410
|
-
|
|
411
|
-
|
|
412
|
-
|
|
413
|
-
|
|
414
|
-
|
|
415
|
-
|
|
416
|
-
|
|
417
|
-
|
|
407
|
+
tool_types=(
|
|
408
|
+
stix_object["tool_types"] if "tool_types" in stix_object else None
|
|
409
|
+
),
|
|
410
|
+
tool_version=(
|
|
411
|
+
stix_object["tool_version"]
|
|
412
|
+
if "tool_version" in stix_object
|
|
413
|
+
else None
|
|
414
|
+
),
|
|
415
|
+
killChainPhases=(
|
|
416
|
+
extras["kill_chain_phases_ids"]
|
|
417
|
+
if "kill_chain_phases_ids" in extras
|
|
418
|
+
else None
|
|
419
|
+
),
|
|
420
|
+
x_opencti_stix_ids=(
|
|
421
|
+
stix_object["x_opencti_stix_ids"]
|
|
422
|
+
if "x_opencti_stix_ids" in stix_object
|
|
423
|
+
else None
|
|
424
|
+
),
|
|
425
|
+
objectOrganization=(
|
|
426
|
+
stix_object["x_opencti_granted_refs"]
|
|
427
|
+
if "x_opencti_granted_refs" in stix_object
|
|
428
|
+
else None
|
|
429
|
+
),
|
|
418
430
|
update=update,
|
|
419
431
|
)
|
|
420
432
|
else:
|