pycti 5.12.21__tar.gz → 5.12.23__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of pycti might be problematic. Click here for more details.
- {pycti-5.12.21 → pycti-5.12.23}/PKG-INFO +2 -2
- {pycti-5.12.21 → pycti-5.12.23}/pycti/__init__.py +1 -1
- {pycti-5.12.21 → pycti-5.12.23}/pycti/connector/opencti_connector_helper.py +13 -11
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_attack_pattern.py +76 -58
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_campaign.py +49 -41
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_case_incident.py +62 -48
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_case_rfi.py +45 -35
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_case_rft.py +45 -35
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_channel.py +45 -35
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_course_of_action.py +43 -35
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_data_component.py +43 -35
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_data_source.py +48 -38
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_event.py +44 -38
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_external_reference.py +5 -3
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_feedback.py +40 -32
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_grouping.py +43 -35
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_identity.py +91 -73
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_incident.py +59 -47
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_indicator.py +110 -84
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_infrastructure.py +56 -44
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_intrusion_set.py +61 -47
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_language.py +30 -24
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_location.py +41 -35
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_malware.py +83 -63
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_malware_analysis.py +87 -63
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_marking_definition.py +24 -18
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_narrative.py +45 -35
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_note.py +51 -39
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_observed_data.py +70 -48
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_opinion.py +40 -32
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_report.py +74 -47
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_stix_core_object.py +10 -10
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_stix_core_relationship.py +55 -41
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_stix_cyber_observable.py +442 -318
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_stix_domain_object.py +15 -13
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_stix_object_or_stix_relationship.py +5 -5
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_task.py +44 -36
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_threat_actor_group.py +76 -56
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_threat_actor_individual.py +76 -56
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_tool.py +53 -41
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_vulnerability.py +151 -109
- {pycti-5.12.21 → pycti-5.12.23}/pycti/utils/constants.py +1 -0
- {pycti-5.12.21 → pycti-5.12.23}/pycti/utils/opencti_stix2.py +177 -139
- {pycti-5.12.21 → pycti-5.12.23}/pycti/utils/opencti_stix2_update.py +20 -12
- {pycti-5.12.21 → pycti-5.12.23}/pycti/utils/opencti_stix2_utils.py +5 -3
- {pycti-5.12.21 → pycti-5.12.23}/pycti.egg-info/PKG-INFO +2 -2
- {pycti-5.12.21 → pycti-5.12.23}/pycti.egg-info/requires.txt +1 -1
- {pycti-5.12.21 → pycti-5.12.23}/setup.cfg +1 -1
- {pycti-5.12.21 → pycti-5.12.23}/LICENSE +0 -0
- {pycti-5.12.21 → pycti-5.12.23}/README.md +0 -0
- {pycti-5.12.21 → pycti-5.12.23}/pycti/api/__init__.py +0 -0
- {pycti-5.12.21 → pycti-5.12.23}/pycti/api/opencti_api_client.py +0 -0
- {pycti-5.12.21 → pycti-5.12.23}/pycti/api/opencti_api_connector.py +0 -0
- {pycti-5.12.21 → pycti-5.12.23}/pycti/api/opencti_api_playbook.py +0 -0
- {pycti-5.12.21 → pycti-5.12.23}/pycti/api/opencti_api_work.py +0 -0
- {pycti-5.12.21 → pycti-5.12.23}/pycti/connector/__init__.py +0 -0
- {pycti-5.12.21 → pycti-5.12.23}/pycti/connector/opencti_connector.py +0 -0
- {pycti-5.12.21 → pycti-5.12.23}/pycti/connector/opencti_metric_handler.py +0 -0
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/__init__.py +0 -0
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_kill_chain_phase.py +0 -0
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_label.py +0 -0
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_stix.py +0 -0
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_stix_nested_ref_relationship.py +0 -0
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_stix_sighting_relationship.py +0 -0
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_threat_actor.py +0 -0
- {pycti-5.12.21 → pycti-5.12.23}/pycti/entities/opencti_vocabulary.py +0 -0
- {pycti-5.12.21 → pycti-5.12.23}/pycti/utils/__init__.py +0 -0
- {pycti-5.12.21 → pycti-5.12.23}/pycti/utils/opencti_logger.py +0 -0
- {pycti-5.12.21 → pycti-5.12.23}/pycti/utils/opencti_stix2_splitter.py +0 -0
- {pycti-5.12.21 → pycti-5.12.23}/pycti.egg-info/SOURCES.txt +0 -0
- {pycti-5.12.21 → pycti-5.12.23}/pycti.egg-info/dependency_links.txt +0 -0
- {pycti-5.12.21 → pycti-5.12.23}/pycti.egg-info/top_level.txt +0 -0
- {pycti-5.12.21 → pycti-5.12.23}/pyproject.toml +0 -0
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.1
|
|
2
2
|
Name: pycti
|
|
3
|
-
Version: 5.12.
|
|
3
|
+
Version: 5.12.23
|
|
4
4
|
Summary: Python API client for OpenCTI.
|
|
5
5
|
Home-page: https://github.com/OpenCTI-Platform/client-python
|
|
6
6
|
Author: Filigran
|
|
@@ -34,7 +34,7 @@ Requires-Dist: filigran-sseclient~=1.0.0
|
|
|
34
34
|
Requires-Dist: stix2~=3.0.1
|
|
35
35
|
Requires-Dist: cachetools~=5.3.0
|
|
36
36
|
Provides-Extra: dev
|
|
37
|
-
Requires-Dist: black~=
|
|
37
|
+
Requires-Dist: black~=24.1.0; extra == "dev"
|
|
38
38
|
Requires-Dist: build~=1.0.3; extra == "dev"
|
|
39
39
|
Requires-Dist: isort~=5.13.0; extra == "dev"
|
|
40
40
|
Requires-Dist: types-pytz~=2023.3.1.0; extra == "dev"
|
|
@@ -299,11 +299,11 @@ class ListenQueue(threading.Thread):
|
|
|
299
299
|
port=self.port,
|
|
300
300
|
virtual_host=self.vhost,
|
|
301
301
|
credentials=self.pika_credentials,
|
|
302
|
-
ssl_options=
|
|
303
|
-
create_mq_ssl_context(self.config), self.host
|
|
304
|
-
|
|
305
|
-
|
|
306
|
-
|
|
302
|
+
ssl_options=(
|
|
303
|
+
pika.SSLOptions(create_mq_ssl_context(self.config), self.host)
|
|
304
|
+
if self.use_ssl
|
|
305
|
+
else None
|
|
306
|
+
),
|
|
307
307
|
)
|
|
308
308
|
self.pika_connection = pika.BlockingConnection(self.pika_parameters)
|
|
309
309
|
self.channel = self.pika_connection.channel()
|
|
@@ -1035,12 +1035,14 @@ class OpenCTIConnectorHelper: # pylint: disable=too-many-public-methods
|
|
|
1035
1035
|
port=self.connector_config["connection"]["port"],
|
|
1036
1036
|
virtual_host=self.connector_config["connection"]["vhost"],
|
|
1037
1037
|
credentials=pika_credentials,
|
|
1038
|
-
ssl_options=
|
|
1039
|
-
|
|
1040
|
-
|
|
1041
|
-
|
|
1042
|
-
|
|
1043
|
-
|
|
1038
|
+
ssl_options=(
|
|
1039
|
+
pika.SSLOptions(
|
|
1040
|
+
create_mq_ssl_context(self.config),
|
|
1041
|
+
self.connector_config["connection"]["host"],
|
|
1042
|
+
)
|
|
1043
|
+
if self.connector_config["connection"]["use_ssl"]
|
|
1044
|
+
else None
|
|
1045
|
+
),
|
|
1044
1046
|
)
|
|
1045
1047
|
pika_connection = pika.BlockingConnection(pika_parameters)
|
|
1046
1048
|
channel = pika_connection.channel()
|
|
@@ -524,81 +524,99 @@ class AttackPattern:
|
|
|
524
524
|
else 0
|
|
525
525
|
)
|
|
526
526
|
if "x_mitre_platforms" not in stix_object:
|
|
527
|
-
stix_object[
|
|
528
|
-
|
|
529
|
-
|
|
530
|
-
|
|
527
|
+
stix_object["x_mitre_platforms"] = (
|
|
528
|
+
self.opencti.get_attribute_in_mitre_extension(
|
|
529
|
+
"platforms", stix_object
|
|
530
|
+
)
|
|
531
531
|
)
|
|
532
532
|
if "x_mitre_permissions_required" not in stix_object:
|
|
533
|
-
stix_object[
|
|
534
|
-
|
|
535
|
-
|
|
536
|
-
|
|
533
|
+
stix_object["x_mitre_permissions_required"] = (
|
|
534
|
+
self.opencti.get_attribute_in_mitre_extension(
|
|
535
|
+
"permissions_required", stix_object
|
|
536
|
+
)
|
|
537
537
|
)
|
|
538
538
|
if "x_mitre_detection" not in stix_object:
|
|
539
|
-
stix_object[
|
|
540
|
-
|
|
541
|
-
|
|
542
|
-
|
|
539
|
+
stix_object["x_mitre_detection"] = (
|
|
540
|
+
self.opencti.get_attribute_in_mitre_extension(
|
|
541
|
+
"detection", stix_object
|
|
542
|
+
)
|
|
543
543
|
)
|
|
544
544
|
if "x_opencti_stix_ids" not in stix_object:
|
|
545
|
-
stix_object[
|
|
546
|
-
"
|
|
547
|
-
|
|
545
|
+
stix_object["x_opencti_stix_ids"] = (
|
|
546
|
+
self.opencti.get_attribute_in_extension("stix_ids", stix_object)
|
|
547
|
+
)
|
|
548
548
|
if "x_opencti_granted_refs" not in stix_object:
|
|
549
|
-
stix_object[
|
|
550
|
-
"
|
|
551
|
-
|
|
549
|
+
stix_object["x_opencti_granted_refs"] = (
|
|
550
|
+
self.opencti.get_attribute_in_extension("granted_refs", stix_object)
|
|
551
|
+
)
|
|
552
552
|
|
|
553
553
|
return self.create(
|
|
554
554
|
stix_id=stix_object["id"],
|
|
555
|
-
createdBy=
|
|
556
|
-
|
|
557
|
-
|
|
558
|
-
objectMarking=
|
|
559
|
-
|
|
560
|
-
|
|
561
|
-
|
|
562
|
-
|
|
563
|
-
|
|
564
|
-
|
|
565
|
-
|
|
566
|
-
|
|
555
|
+
createdBy=(
|
|
556
|
+
extras["created_by_id"] if "created_by_id" in extras else None
|
|
557
|
+
),
|
|
558
|
+
objectMarking=(
|
|
559
|
+
extras["object_marking_ids"]
|
|
560
|
+
if "object_marking_ids" in extras
|
|
561
|
+
else None
|
|
562
|
+
),
|
|
563
|
+
objectLabel=(
|
|
564
|
+
extras["object_label_ids"] if "object_label_ids" in extras else None
|
|
565
|
+
),
|
|
566
|
+
externalReferences=(
|
|
567
|
+
extras["external_references_ids"]
|
|
568
|
+
if "external_references_ids" in extras
|
|
569
|
+
else None
|
|
570
|
+
),
|
|
567
571
|
revoked=stix_object["revoked"] if "revoked" in stix_object else None,
|
|
568
|
-
confidence=
|
|
569
|
-
|
|
570
|
-
|
|
572
|
+
confidence=(
|
|
573
|
+
stix_object["confidence"] if "confidence" in stix_object else None
|
|
574
|
+
),
|
|
571
575
|
lang=stix_object["lang"] if "lang" in stix_object else None,
|
|
572
576
|
created=stix_object["created"] if "created" in stix_object else None,
|
|
573
577
|
modified=stix_object["modified"] if "modified" in stix_object else None,
|
|
574
578
|
name=stix_object["name"],
|
|
575
|
-
description=
|
|
576
|
-
stix_object["description"]
|
|
577
|
-
|
|
578
|
-
|
|
579
|
-
|
|
579
|
+
description=(
|
|
580
|
+
self.opencti.stix2.convert_markdown(stix_object["description"])
|
|
581
|
+
if "description" in stix_object
|
|
582
|
+
else None
|
|
583
|
+
),
|
|
580
584
|
aliases=self.opencti.stix2.pick_aliases(stix_object),
|
|
581
|
-
x_mitre_platforms=
|
|
582
|
-
|
|
583
|
-
|
|
584
|
-
|
|
585
|
-
|
|
586
|
-
|
|
587
|
-
|
|
588
|
-
|
|
589
|
-
|
|
590
|
-
|
|
591
|
-
|
|
585
|
+
x_mitre_platforms=(
|
|
586
|
+
stix_object["x_mitre_platforms"]
|
|
587
|
+
if "x_mitre_platforms" in stix_object
|
|
588
|
+
else (
|
|
589
|
+
stix_object["x_amitt_platforms"]
|
|
590
|
+
if "x_amitt_platforms" in stix_object
|
|
591
|
+
else None
|
|
592
|
+
)
|
|
593
|
+
),
|
|
594
|
+
x_mitre_permissions_required=(
|
|
595
|
+
stix_object["x_mitre_permissions_required"]
|
|
596
|
+
if "x_mitre_permissions_required" in stix_object
|
|
597
|
+
else None
|
|
598
|
+
),
|
|
599
|
+
x_mitre_detection=(
|
|
600
|
+
stix_object["x_mitre_detection"]
|
|
601
|
+
if "x_mitre_detection" in stix_object
|
|
602
|
+
else None
|
|
603
|
+
),
|
|
592
604
|
x_mitre_id=x_mitre_id,
|
|
593
|
-
killChainPhases=
|
|
594
|
-
|
|
595
|
-
|
|
596
|
-
|
|
597
|
-
|
|
598
|
-
|
|
599
|
-
|
|
600
|
-
|
|
601
|
-
|
|
605
|
+
killChainPhases=(
|
|
606
|
+
extras["kill_chain_phases_ids"]
|
|
607
|
+
if "kill_chain_phases_ids" in extras
|
|
608
|
+
else None
|
|
609
|
+
),
|
|
610
|
+
x_opencti_stix_ids=(
|
|
611
|
+
stix_object["x_opencti_stix_ids"]
|
|
612
|
+
if "x_opencti_stix_ids" in stix_object
|
|
613
|
+
else None
|
|
614
|
+
),
|
|
615
|
+
objectOrganization=(
|
|
616
|
+
stix_object["x_opencti_granted_refs"]
|
|
617
|
+
if "x_opencti_granted_refs" in stix_object
|
|
618
|
+
else None
|
|
619
|
+
),
|
|
602
620
|
update=update,
|
|
603
621
|
)
|
|
604
622
|
else:
|
|
@@ -450,57 +450,65 @@ class Campaign:
|
|
|
450
450
|
if stix_object is not None:
|
|
451
451
|
# Search in extensions
|
|
452
452
|
if "x_opencti_stix_ids" not in stix_object:
|
|
453
|
-
stix_object[
|
|
454
|
-
"
|
|
455
|
-
|
|
453
|
+
stix_object["x_opencti_stix_ids"] = (
|
|
454
|
+
self.opencti.get_attribute_in_extension("stix_ids", stix_object)
|
|
455
|
+
)
|
|
456
456
|
if "x_opencti_granted_refs" not in stix_object:
|
|
457
|
-
stix_object[
|
|
458
|
-
"
|
|
459
|
-
|
|
457
|
+
stix_object["x_opencti_granted_refs"] = (
|
|
458
|
+
self.opencti.get_attribute_in_extension("granted_refs", stix_object)
|
|
459
|
+
)
|
|
460
460
|
|
|
461
461
|
return self.create(
|
|
462
462
|
stix_id=stix_object["id"],
|
|
463
|
-
createdBy=
|
|
464
|
-
|
|
465
|
-
|
|
466
|
-
objectMarking=
|
|
467
|
-
|
|
468
|
-
|
|
469
|
-
|
|
470
|
-
|
|
471
|
-
|
|
472
|
-
|
|
473
|
-
|
|
474
|
-
|
|
463
|
+
createdBy=(
|
|
464
|
+
extras["created_by_id"] if "created_by_id" in extras else None
|
|
465
|
+
),
|
|
466
|
+
objectMarking=(
|
|
467
|
+
extras["object_marking_ids"]
|
|
468
|
+
if "object_marking_ids" in extras
|
|
469
|
+
else None
|
|
470
|
+
),
|
|
471
|
+
objectLabel=(
|
|
472
|
+
extras["object_label_ids"] if "object_label_ids" in extras else None
|
|
473
|
+
),
|
|
474
|
+
externalReferences=(
|
|
475
|
+
extras["external_references_ids"]
|
|
476
|
+
if "external_references_ids" in extras
|
|
477
|
+
else None
|
|
478
|
+
),
|
|
475
479
|
revoked=stix_object["revoked"] if "revoked" in stix_object else None,
|
|
476
|
-
confidence=
|
|
477
|
-
|
|
478
|
-
|
|
480
|
+
confidence=(
|
|
481
|
+
stix_object["confidence"] if "confidence" in stix_object else None
|
|
482
|
+
),
|
|
479
483
|
lang=stix_object["lang"] if "lang" in stix_object else None,
|
|
480
484
|
created=stix_object["created"] if "created" in stix_object else None,
|
|
481
485
|
modified=stix_object["modified"] if "modified" in stix_object else None,
|
|
482
486
|
name=stix_object["name"],
|
|
483
|
-
description=
|
|
484
|
-
stix_object["description"]
|
|
485
|
-
|
|
486
|
-
|
|
487
|
-
|
|
487
|
+
description=(
|
|
488
|
+
self.opencti.stix2.convert_markdown(stix_object["description"])
|
|
489
|
+
if "description" in stix_object
|
|
490
|
+
else None
|
|
491
|
+
),
|
|
488
492
|
aliases=self.opencti.stix2.pick_aliases(stix_object),
|
|
489
|
-
objective=
|
|
490
|
-
|
|
491
|
-
|
|
492
|
-
first_seen=
|
|
493
|
-
|
|
494
|
-
|
|
495
|
-
last_seen=
|
|
496
|
-
|
|
497
|
-
|
|
498
|
-
x_opencti_stix_ids=
|
|
499
|
-
|
|
500
|
-
|
|
501
|
-
|
|
502
|
-
|
|
503
|
-
|
|
493
|
+
objective=(
|
|
494
|
+
stix_object["objective"] if "objective" in stix_object else None
|
|
495
|
+
),
|
|
496
|
+
first_seen=(
|
|
497
|
+
stix_object["first_seen"] if "first_seen" in stix_object else None
|
|
498
|
+
),
|
|
499
|
+
last_seen=(
|
|
500
|
+
stix_object["last_seen"] if "last_seen" in stix_object else None
|
|
501
|
+
),
|
|
502
|
+
x_opencti_stix_ids=(
|
|
503
|
+
stix_object["x_opencti_stix_ids"]
|
|
504
|
+
if "x_opencti_stix_ids" in stix_object
|
|
505
|
+
else None
|
|
506
|
+
),
|
|
507
|
+
objectOrganization=(
|
|
508
|
+
stix_object["x_opencti_granted_refs"]
|
|
509
|
+
if "x_opencti_granted_refs" in stix_object
|
|
510
|
+
else None
|
|
511
|
+
),
|
|
504
512
|
update=update,
|
|
505
513
|
)
|
|
506
514
|
else:
|
|
@@ -858,69 +858,83 @@ class CaseIncident:
|
|
|
858
858
|
if stix_object is not None:
|
|
859
859
|
# Search in extensions
|
|
860
860
|
if "x_opencti_stix_ids" not in stix_object:
|
|
861
|
-
stix_object[
|
|
862
|
-
"
|
|
863
|
-
|
|
861
|
+
stix_object["x_opencti_stix_ids"] = (
|
|
862
|
+
self.opencti.get_attribute_in_extension("stix_ids", stix_object)
|
|
863
|
+
)
|
|
864
864
|
if "x_opencti_granted_refs" not in stix_object:
|
|
865
|
-
stix_object[
|
|
866
|
-
"
|
|
867
|
-
|
|
865
|
+
stix_object["x_opencti_granted_refs"] = (
|
|
866
|
+
self.opencti.get_attribute_in_extension("granted_refs", stix_object)
|
|
867
|
+
)
|
|
868
868
|
if "x_opencti_workflow_id" not in stix_object:
|
|
869
|
-
stix_object[
|
|
870
|
-
|
|
871
|
-
|
|
872
|
-
|
|
869
|
+
stix_object["x_opencti_workflow_id"] = (
|
|
870
|
+
self.opencti.get_attribute_in_extension(
|
|
871
|
+
"x_opencti_workflow_id", stix_object
|
|
872
|
+
)
|
|
873
873
|
)
|
|
874
874
|
if "x_opencti_assignee_ids" not in stix_object:
|
|
875
|
-
stix_object[
|
|
876
|
-
"
|
|
877
|
-
|
|
875
|
+
stix_object["x_opencti_assignee_ids"] = (
|
|
876
|
+
self.opencti.get_attribute_in_extension("assignee_ids", stix_object)
|
|
877
|
+
)
|
|
878
878
|
|
|
879
879
|
return self.create(
|
|
880
880
|
stix_id=stix_object["id"],
|
|
881
|
-
createdBy=
|
|
882
|
-
|
|
883
|
-
|
|
884
|
-
objectMarking=
|
|
885
|
-
|
|
886
|
-
|
|
887
|
-
|
|
888
|
-
|
|
889
|
-
|
|
881
|
+
createdBy=(
|
|
882
|
+
extras["created_by_id"] if "created_by_id" in extras else None
|
|
883
|
+
),
|
|
884
|
+
objectMarking=(
|
|
885
|
+
extras["object_marking_ids"]
|
|
886
|
+
if "object_marking_ids" in extras
|
|
887
|
+
else None
|
|
888
|
+
),
|
|
889
|
+
objectLabel=(
|
|
890
|
+
extras["object_label_ids"] if "object_label_ids" in extras else None
|
|
891
|
+
),
|
|
890
892
|
objects=extras["object_ids"] if "object_ids" in extras else [],
|
|
891
|
-
externalReferences=
|
|
892
|
-
|
|
893
|
-
|
|
893
|
+
externalReferences=(
|
|
894
|
+
extras["external_references_ids"]
|
|
895
|
+
if "external_references_ids" in extras
|
|
896
|
+
else None
|
|
897
|
+
),
|
|
894
898
|
revoked=stix_object["revoked"] if "revoked" in stix_object else None,
|
|
895
|
-
confidence=
|
|
896
|
-
|
|
897
|
-
|
|
899
|
+
confidence=(
|
|
900
|
+
stix_object["confidence"] if "confidence" in stix_object else None
|
|
901
|
+
),
|
|
898
902
|
lang=stix_object["lang"] if "lang" in stix_object else None,
|
|
899
903
|
created=stix_object["created"] if "created" in stix_object else None,
|
|
900
904
|
modified=stix_object["modified"] if "modified" in stix_object else None,
|
|
901
905
|
name=stix_object["name"],
|
|
902
|
-
description=
|
|
903
|
-
stix_object["description"]
|
|
904
|
-
|
|
905
|
-
|
|
906
|
-
|
|
906
|
+
description=(
|
|
907
|
+
self.opencti.stix2.convert_markdown(stix_object["description"])
|
|
908
|
+
if "description" in stix_object
|
|
909
|
+
else None
|
|
910
|
+
),
|
|
907
911
|
severity=stix_object["severity"] if "severity" in stix_object else None,
|
|
908
912
|
priority=stix_object["priority"] if "priority" in stix_object else None,
|
|
909
|
-
response_types=
|
|
910
|
-
|
|
911
|
-
|
|
912
|
-
|
|
913
|
-
|
|
914
|
-
|
|
915
|
-
|
|
916
|
-
|
|
917
|
-
|
|
918
|
-
|
|
919
|
-
|
|
920
|
-
|
|
921
|
-
|
|
922
|
-
|
|
923
|
-
|
|
913
|
+
response_types=(
|
|
914
|
+
stix_object["response_types"]
|
|
915
|
+
if "response_types" in stix_object
|
|
916
|
+
else None
|
|
917
|
+
),
|
|
918
|
+
x_opencti_stix_ids=(
|
|
919
|
+
stix_object["x_opencti_stix_ids"]
|
|
920
|
+
if "x_opencti_stix_ids" in stix_object
|
|
921
|
+
else None
|
|
922
|
+
),
|
|
923
|
+
objectOrganization=(
|
|
924
|
+
stix_object["x_opencti_granted_refs"]
|
|
925
|
+
if "x_opencti_granted_refs" in stix_object
|
|
926
|
+
else None
|
|
927
|
+
),
|
|
928
|
+
objectAssignee=(
|
|
929
|
+
stix_object["x_opencti_assignee_ids"]
|
|
930
|
+
if "x_opencti_assignee_ids" in stix_object
|
|
931
|
+
else None
|
|
932
|
+
),
|
|
933
|
+
x_opencti_workflow_id=(
|
|
934
|
+
stix_object["x_opencti_workflow_id"]
|
|
935
|
+
if "x_opencti_workflow_id" in stix_object
|
|
936
|
+
else None
|
|
937
|
+
),
|
|
924
938
|
update=update,
|
|
925
939
|
)
|
|
926
940
|
else:
|
|
@@ -841,52 +841,62 @@ class CaseRfi:
|
|
|
841
841
|
if stix_object is not None:
|
|
842
842
|
# Search in extensions
|
|
843
843
|
if "x_opencti_stix_ids" not in stix_object:
|
|
844
|
-
stix_object[
|
|
845
|
-
"
|
|
846
|
-
|
|
844
|
+
stix_object["x_opencti_stix_ids"] = (
|
|
845
|
+
self.opencti.get_attribute_in_extension("stix_ids", stix_object)
|
|
846
|
+
)
|
|
847
847
|
if "x_opencti_granted_refs" not in stix_object:
|
|
848
|
-
stix_object[
|
|
849
|
-
"
|
|
850
|
-
|
|
848
|
+
stix_object["x_opencti_granted_refs"] = (
|
|
849
|
+
self.opencti.get_attribute_in_extension("granted_refs", stix_object)
|
|
850
|
+
)
|
|
851
851
|
|
|
852
852
|
return self.create(
|
|
853
853
|
stix_id=stix_object["id"],
|
|
854
|
-
createdBy=
|
|
855
|
-
|
|
856
|
-
|
|
857
|
-
objectMarking=
|
|
858
|
-
|
|
859
|
-
|
|
860
|
-
|
|
861
|
-
|
|
862
|
-
|
|
854
|
+
createdBy=(
|
|
855
|
+
extras["created_by_id"] if "created_by_id" in extras else None
|
|
856
|
+
),
|
|
857
|
+
objectMarking=(
|
|
858
|
+
extras["object_marking_ids"]
|
|
859
|
+
if "object_marking_ids" in extras
|
|
860
|
+
else None
|
|
861
|
+
),
|
|
862
|
+
objectLabel=(
|
|
863
|
+
extras["object_label_ids"] if "object_label_ids" in extras else None
|
|
864
|
+
),
|
|
863
865
|
objects=extras["object_ids"] if "object_ids" in extras else [],
|
|
864
|
-
externalReferences=
|
|
865
|
-
|
|
866
|
-
|
|
866
|
+
externalReferences=(
|
|
867
|
+
extras["external_references_ids"]
|
|
868
|
+
if "external_references_ids" in extras
|
|
869
|
+
else None
|
|
870
|
+
),
|
|
867
871
|
revoked=stix_object["revoked"] if "revoked" in stix_object else None,
|
|
868
|
-
confidence=
|
|
869
|
-
|
|
870
|
-
|
|
872
|
+
confidence=(
|
|
873
|
+
stix_object["confidence"] if "confidence" in stix_object else None
|
|
874
|
+
),
|
|
871
875
|
lang=stix_object["lang"] if "lang" in stix_object else None,
|
|
872
876
|
created=stix_object["created"] if "created" in stix_object else None,
|
|
873
877
|
modified=stix_object["modified"] if "modified" in stix_object else None,
|
|
874
878
|
name=stix_object["name"],
|
|
875
|
-
description=
|
|
876
|
-
stix_object["description"]
|
|
877
|
-
|
|
878
|
-
|
|
879
|
-
|
|
880
|
-
x_opencti_stix_ids=
|
|
881
|
-
|
|
882
|
-
|
|
883
|
-
|
|
884
|
-
|
|
885
|
-
|
|
879
|
+
description=(
|
|
880
|
+
self.opencti.stix2.convert_markdown(stix_object["description"])
|
|
881
|
+
if "description" in stix_object
|
|
882
|
+
else None
|
|
883
|
+
),
|
|
884
|
+
x_opencti_stix_ids=(
|
|
885
|
+
stix_object["x_opencti_stix_ids"]
|
|
886
|
+
if "x_opencti_stix_ids" in stix_object
|
|
887
|
+
else None
|
|
888
|
+
),
|
|
889
|
+
objectOrganization=(
|
|
890
|
+
stix_object["x_opencti_granted_refs"]
|
|
891
|
+
if "x_opencti_granted_refs" in stix_object
|
|
892
|
+
else None
|
|
893
|
+
),
|
|
886
894
|
update=update,
|
|
887
|
-
information_types=
|
|
888
|
-
|
|
889
|
-
|
|
895
|
+
information_types=(
|
|
896
|
+
stix_object["information_types"]
|
|
897
|
+
if "information_types" in stix_object
|
|
898
|
+
else None
|
|
899
|
+
),
|
|
890
900
|
)
|
|
891
901
|
else:
|
|
892
902
|
self.opencti.app_logger.error(
|