pycti 5.12.32__py3-none-any.whl → 6.0.0__py3-none-any.whl

pycti/__init__.py

@@ -1,5 +1,5 @@
 # -*- coding: utf-8 -*-
-__version__ = "5.12.32"
+__version__ = "6.0.0"
 
 from .api.opencti_api_client import OpenCTIApiClient
 from .api.opencti_api_connector import OpenCTIApiConnector

pycti/connector/opencti_connector_helper.py

@@ -177,7 +177,14 @@ class ListenQueue(threading.Thread):
     :type callback: callable
     """
 
-    def __init__(self, helper, config: Dict, connector_config: Dict, callback) -> None:
+    def __init__(
+        self,
+        helper,
+        config: Dict,
+        connector_config: Dict,
+        applicant_id,
+        callback,
+    ) -> None:
         threading.Thread.__init__(self)
         self.pika_credentials = None
         self.pika_parameters = None
@@ -186,6 +193,7 @@ class ListenQueue(threading.Thread):
         self.helper = helper
         self.callback = callback
         self.config = config
+        self.connector_applicant_id = applicant_id
         self.host = connector_config["connection"]["host"]
         self.vhost = connector_config["connection"]["vhost"]
         self.use_ssl = connector_config["connection"]["use_ssl"]
@@ -237,42 +245,114 @@ class ListenQueue(threading.Thread):
         )
 
     def _data_handler(self, json_data) -> None:
-        # Set the API headers
-        work_id = json_data["internal"]["work_id"]
-        self.helper.work_id = work_id
-        self.helper.playbook = None
-        if "playbook" in json_data["internal"]:
-            execution_id = json_data["internal"]["playbook"]["execution_id"]
-            execution_start = self.helper.date_now()
-            playbook_id = json_data["internal"]["playbook"]["playbook_id"]
-            data_instance_id = json_data["internal"]["playbook"]["data_instance_id"]
-            previous_bundle = json.dumps((json_data["event"]["bundle"]))
-            step_id = json_data["internal"]["playbook"]["step_id"]
-            previous_step_id = json_data["internal"]["playbook"]["previous_step_id"]
-            playbook_data = {
-                "execution_id": execution_id,
-                "execution_start": execution_start,
-                "playbook_id": playbook_id,
-                "data_instance_id": data_instance_id,
-                "previous_step_id": previous_step_id,
-                "previous_bundle": previous_bundle,
-                "step_id": step_id,
-            }
-            self.helper.playbook = playbook_data
-
-        applicant_id = json_data["internal"]["applicant_id"]
-        if applicant_id is not None:
-            self.helper.applicant_id = applicant_id
-            self.helper.api_impersonate.set_applicant_id_header(applicant_id)
         # Execute the callback
         try:
+            event_data = json_data["event"]
+            entity_id = event_data.get("entity_id")
+            entity_type = event_data.get("entity_type")
+            # Set the API headers
+            work_id = json_data["internal"]["work_id"]
+            self.helper.work_id = work_id
+
+            self.helper.playbook = None
+            self.helper.enrichment_shared_organizations = None
+            if self.helper.connect_type == "INTERNAL_ENRICHMENT":
+                # For enrichment connectors only, pre resolve the information
+                if entity_id is None:
+                    raise ValueError(
+                        "Internal enrichment must be based on a specific id"
+                    )
+                default_reader_type = "Stix-Core-Object"
+                readers = self.helper.api.stix2.get_readers()
+                reader_type = (
+                    entity_type if entity_type is not None else default_reader_type
+                )
+                selected_reader = (
+                    readers[reader_type]
+                    if reader_type in readers
+                    else readers[default_reader_type]
+                )
+                opencti_entity = selected_reader(id=entity_id, withFiles=True)
+                if opencti_entity is None:
+                    raise ValueError(
+                        "Unable to read/access to the entity, please check that the connector permission"
+                    )
+                event_data["enrichment_entity"] = opencti_entity
+                # Handle action vs playbook behavior
+                is_playbook = "playbook" in json_data["internal"]
+                # If playbook, compute object on data bundle
+                if is_playbook:
+                    execution_id = json_data["internal"]["playbook"]["execution_id"]
+                    execution_start = self.helper.date_now()
+                    playbook_id = json_data["internal"]["playbook"]["playbook_id"]
+                    data_instance_id = json_data["internal"]["playbook"][
+                        "data_instance_id"
+                    ]
+                    previous_bundle = json.dumps((json_data["event"]["bundle"]))
+                    step_id = json_data["internal"]["playbook"]["step_id"]
+                    previous_step_id = json_data["internal"]["playbook"][
+                        "previous_step_id"
+                    ]
+                    playbook_data = {
+                        "execution_id": execution_id,
+                        "execution_start": execution_start,
+                        "playbook_id": playbook_id,
+                        "data_instance_id": data_instance_id,
+                        "previous_step_id": previous_step_id,
+                        "previous_bundle": previous_bundle,
+                        "step_id": step_id,
+                    }
+                    self.helper.playbook = playbook_data
+                    bundle = event_data["bundle"]
+                    stix_objects = bundle["objects"]
+                    event_data["stix_objects"] = stix_objects
+                    stix_entity = [e for e in stix_objects if e["id"] == entity_id][0]
+                    event_data["stix_entity"] = stix_entity
+                else:
+                    # If not playbook but enrichment, compute object on enrichment_entity
+                    opencti_entity = event_data["enrichment_entity"]
+                    stix_objects = self.helper.api.stix2.prepare_export(
+                        self.helper.api.stix2.generate_export(copy.copy(opencti_entity))
+                    )
+                    stix_entity = [
+                        e
+                        for e in stix_objects
+                        if e["id"] == opencti_entity["standard_id"]
+                    ][0]
+                    event_data["stix_objects"] = stix_objects
+                    event_data["stix_entity"] = stix_entity
+                # Handle organization propagation
+                # Keep the sharing to be re-apply automatically at send_stix_bundle stage
+                if "x_opencti_granted_refs" in event_data["stix_entity"]:
+                    self.helper.enrichment_shared_organizations = event_data[
+                        "stix_entity"
+                    ]["x_opencti_granted_refs"]
+                else:
+                    self.helper.enrichment_shared_organizations = (
+                        self.helper.get_attribute_in_extension(
+                            "granted_refs", event_data["stix_entity"]
+                        )
+                    )
+
+            # Handle applicant_id for in-personalization
+            self.helper.applicant_id = self.connector_applicant_id
+            self.helper.api_impersonate.set_applicant_id_header(
+                self.connector_applicant_id
+            )
+            applicant_id = json_data["internal"]["applicant_id"]
+            if applicant_id is not None:
+                self.helper.applicant_id = applicant_id
+                self.helper.api_impersonate.set_applicant_id_header(applicant_id)
+
             if work_id:
                 self.helper.api.work.to_received(
                     work_id, "Connector ready to process the operation"
                 )
-            message = self.callback(json_data["event"])
+            # Send the enriched to the callback
+            message = self.callback(event_data)
             if work_id:
                 self.helper.api.work.to_processed(work_id, message)
+
         except Exception as e:  # pylint: disable=broad-except
             self.helper.metric.inc("error_count")
             self.helper.connector_logger.error(
@@ -641,13 +721,7 @@ class OpenCTIConnectorHelper:  # pylint: disable=too-many-public-methods
         self.connect_name = get_config_variable(
             "CONNECTOR_NAME", ["connector", "name"], config
         )
-        self.connect_confidence_level = get_config_variable(
-            "CONNECTOR_CONFIDENCE_LEVEL",
-            ["connector", "confidence_level"],
-            config,
-            True,
-            50,
-        )
+        self.connect_confidence_level = None  # Deprecated since OpenCTI version >= 6.0
         self.connect_scope = get_config_variable(
             "CONNECTOR_SCOPE", ["connector", "scope"], config
         )
@@ -729,9 +803,10 @@ class OpenCTIConnectorHelper:  # pylint: disable=too-many-public-methods
         self.connector_logger.info(
             "Connector registered with ID", {"id": self.connect_id}
         )
-        self.connector_id = connector_configuration["id"]
         self.work_id = None
         self.playbook = None
+        self.enrichment_shared_organizations = None
+        self.connector_id = connector_configuration["id"]
         self.applicant_id = connector_configuration["connector_user_id"]
         self.connector_state = connector_configuration["connector_state"]
         self.connector_config = connector_configuration["config"]
@@ -842,7 +917,10 @@ class OpenCTIConnectorHelper:  # pylint: disable=too-many-public-methods
             self.metric.inc("error_count")
             self.connector_logger.error("Error pinging the API", {"reason": str(e)})
 
-    def listen(self, message_callback: Callable[[Dict], str]) -> None:
+    def listen(
+        self,
+        message_callback: Callable[[Dict], str],
+    ) -> None:
         """listen for messages and register callback function
 
         :param message_callback: callback function to process messages
@@ -850,7 +928,11 @@ class OpenCTIConnectorHelper:  # pylint: disable=too-many-public-methods
         """
 
         self.listen_queue = ListenQueue(
-            self, self.config, self.connector_config, message_callback
+            self,
+            self.config,
+            self.connector_config,
+            self.applicant_id,
+            message_callback,
         )
         self.listen_queue.start()
 
@@ -971,7 +1053,7 @@ class OpenCTIConnectorHelper:  # pylint: disable=too-many-public-methods
         )
 
     # Push Stix2 helper
-    def send_stix2_bundle(self, bundle, **kwargs) -> list:
+    def send_stix2_bundle(self, bundle: str, **kwargs) -> list:
         """send a stix2 bundle to the API
 
         :param work_id: a valid work id
@@ -994,6 +1076,44 @@ class OpenCTIConnectorHelper:  # pylint: disable=too-many-public-methods
         entity_id = kwargs.get("entity_id", None)
         file_name = kwargs.get("file_name", None)
 
+        # In case of enrichment ingestion, ensure the sharing if needed
+        if self.enrichment_shared_organizations is not None:
+            # Every element of the bundle must be enriched with the same organizations
+            bundle_data = json.loads(bundle)
+            for item in bundle_data["objects"]:
+                if (
+                    "extensions" in item
+                    and "extension-definition--ea279b3e-5c71-4632-ac08-831c66a786ba"
+                    in item["extensions"]
+                ):
+                    octi_extensions = item["extensions"][
+                        "extension-definition--ea279b3e-5c71-4632-ac08-831c66a786ba"
+                    ]
+                    if octi_extensions.get("granted_refs") is not None:
+                        octi_extensions["granted_refs"] = list(
+                            set(
+                                octi_extensions["granted_refs"]
+                                + self.enrichment_shared_organizations
+                            )
+                        )
+                    else:
+                        octi_extensions["granted_refs"] = (
+                            self.enrichment_shared_organizations
+                        )
+                else:
+                    if item.get("x_opencti_granted_refs") is not None:
+                        item["x_opencti_granted_refs"] = list(
+                            set(
+                                item["x_opencti_granted_refs"]
+                                + self.enrichment_shared_organizations
+                            )
+                        )
+                    else:
+                        item["x_opencti_granted_refs"] = (
+                            self.enrichment_shared_organizations
+                        )
+            bundle = json.dumps(bundle_data)
+
         if self.playbook is not None:
             self.api.playbook.playbook_step_execution(self.playbook, bundle)
             return [bundle]
@@ -1340,10 +1460,9 @@ class OpenCTIConnectorHelper:  # pylint: disable=too-many-public-methods
             ][key]
         return None
 
-    def get_data_from_enrichment(self, data, opencti_entity):
-        stix_id = opencti_entity["standard_id"]
+    def get_data_from_enrichment(self, data, standard_id, opencti_entity):
         bundle = data.get("bundle", None)
-        # Extract IPv4, IPv6 and Domain from entity data
+        # Extract main entity from bundle in case of playbook
         if bundle is None:
             # Generate bundle
             stix_objects = self.api.stix2.prepare_export(
@@ -1351,7 +1470,7 @@ class OpenCTIConnectorHelper:  # pylint: disable=too-many-public-methods
             )
         else:
             stix_objects = bundle["objects"]
-        stix_entity = [e for e in stix_objects if e["id"] == stix_id][0]
+        stix_entity = [e for e in stix_objects if e["id"] == standard_id][0]
         return {
             "stix_entity": stix_entity,
             "stix_objects": stix_objects,

pycti/entities/opencti_campaign.py

@@ -47,6 +47,11 @@ class Campaign:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id
@@ -128,6 +133,11 @@ class Campaign:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id

pycti/entities/opencti_case_incident.py

@@ -47,6 +47,11 @@ class CaseIncident:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id
@@ -96,7 +101,9 @@ class CaseIncident:
                         description
                         due_date
                         status {
+                          id
                           template {
+                            id
                             name
                             color
                           }
@@ -256,6 +263,11 @@ class CaseIncident:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id
@@ -843,9 +855,7 @@ class CaseIncident:
                 )
             if "x_opencti_workflow_id" not in stix_object:
                 stix_object["x_opencti_workflow_id"] = (
-                    self.opencti.get_attribute_in_extension(
-                        "x_opencti_workflow_id", stix_object
-                    )
+                    self.opencti.get_attribute_in_extension("workflow_id", stix_object)
                 )
             if "x_opencti_assignee_ids" not in stix_object:
                 stix_object["x_opencti_assignee_ids"] = (

pycti/entities/opencti_case_rfi.py

@@ -47,6 +47,11 @@ class CaseRfi:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id
@@ -95,7 +100,9 @@ class CaseRfi:
                         description
                         due_date
                         status {
+                          id
                           template {
+                            id
                             name
                             color
                           }
@@ -255,6 +262,11 @@ class CaseRfi:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id

pycti/entities/opencti_case_rft.py

@@ -47,6 +47,11 @@ class CaseRft:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id
@@ -95,7 +100,9 @@ class CaseRft:
                         description
                         due_date
                         status {
+                          id
                           template {
+                            id
                             name
                             color
                           }
@@ -255,6 +262,11 @@ class CaseRft:
                         x_opencti_lastname
                     }
                 }
+                objectOrganization {
+                    id
+                    standard_id
+                    name
+                }
                 objectMarking {
                     id
                     standard_id

pycti/entities/opencti_channel.py

@@ -47,6 +47,11 @@ class Channel:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id
@@ -126,6 +131,11 @@ class Channel:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id

pycti/entities/opencti_data_component.py

@@ -47,6 +47,11 @@ class DataComponent:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id
@@ -143,6 +148,11 @@ class DataComponent:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id

pycti/entities/opencti_event.py

@@ -47,6 +47,11 @@ class Event:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id
@@ -128,6 +133,11 @@ class Event:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id

pycti/entities/opencti_external_reference.py

@@ -268,14 +268,15 @@ class ExternalReference:
         id = kwargs.get("id", None)
         file_name = kwargs.get("file_name", None)
         data = kwargs.get("data", None)
+        version = kwargs.get("version")
         mime_type = kwargs.get("mime_type", "text/plain")
         no_trigger_import = kwargs.get("no_trigger_import", False)
         if id is not None and file_name is not None:
             final_file_name = os.path.basename(file_name)
             query = """
-                mutation ExternalReferenceEdit($id: ID!, $file: Upload!, $noTriggerImport: Boolean) {
+                mutation ExternalReferenceEdit($id: ID!, $file: Upload!, $version: String, $noTriggerImport: Boolean) {
                     externalReferenceEdit(id: $id) {
-                        importPush(file: $file, noTriggerImport: $noTriggerImport) {
+                        importPush(file: $file, version: $version, noTriggerImport: $noTriggerImport) {
                             id
                             name
                         }
@@ -297,6 +298,7 @@ class ExternalReference:
                 {
                     "id": id,
                     "file": (self.file(final_file_name, data, mime_type)),
+                    "version": version,
                     "noTriggerImport": (
                         no_trigger_import
                         if isinstance(no_trigger_import, bool)

pycti/entities/opencti_grouping.py

@@ -47,6 +47,11 @@ class Grouping:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id
@@ -221,6 +226,11 @@ class Grouping:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id

pycti/entities/opencti_incident.py

@@ -48,6 +48,11 @@ class Incident:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id
@@ -132,6 +137,11 @@ class Incident:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id

pycti/entities/opencti_indicator.py

@@ -56,6 +56,11 @@ class Indicator:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id
@@ -166,6 +171,11 @@ class Indicator:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id

pycti/entities/opencti_infrastructure.py

@@ -52,6 +52,11 @@ class Infrastructure:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id
@@ -142,6 +147,11 @@ class Infrastructure:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id

pycti/entities/opencti_intrusion_set.py

@@ -47,6 +47,11 @@ class IntrusionSet:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id
@@ -131,6 +136,11 @@ class IntrusionSet:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id

pycti/entities/opencti_malware.py

@@ -47,6 +47,11 @@ class Malware:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id
@@ -142,6 +147,11 @@ class Malware:
                     x_opencti_lastname
                 }
             }
+            objectOrganization {
+                id
+                standard_id
+                name
+            }
             objectMarking {
                 id
                 standard_id