pycti 6.0.7__py3-none-any.whl → 6.0.9__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of pycti might be problematic. Click here for more details.
- pycti/__init__.py +1 -1
- pycti/connector/opencti_connector_helper.py +1 -1
- pycti/entities/opencti_malware.py +9 -0
- pycti/entities/opencti_stix_cyber_observable.py +9 -21
- pycti/entities/opencti_stix_domain_object.py +9 -21
- pycti/utils/opencti_stix2.py +13 -0
- {pycti-6.0.7.dist-info → pycti-6.0.9.dist-info}/METADATA +8 -8
- {pycti-6.0.7.dist-info → pycti-6.0.9.dist-info}/RECORD +11 -11
- {pycti-6.0.7.dist-info → pycti-6.0.9.dist-info}/LICENSE +0 -0
- {pycti-6.0.7.dist-info → pycti-6.0.9.dist-info}/WHEEL +0 -0
- {pycti-6.0.7.dist-info → pycti-6.0.9.dist-info}/top_level.txt +0 -0
pycti/__init__.py
CHANGED
|
@@ -424,7 +424,7 @@ class PingAlive(threading.Thread):
|
|
|
424
424
|
def __init__(
|
|
425
425
|
self, connector_logger, connector_id, api, get_state, set_state, metric
|
|
426
426
|
) -> None:
|
|
427
|
-
threading.Thread.__init__(self)
|
|
427
|
+
threading.Thread.__init__(self, daemon=True)
|
|
428
428
|
self.connector_logger = connector_logger
|
|
429
429
|
self.connector_id = connector_id
|
|
430
430
|
self.in_error = False
|
|
@@ -108,6 +108,9 @@ class Malware:
|
|
|
108
108
|
created
|
|
109
109
|
modified
|
|
110
110
|
}
|
|
111
|
+
samples {
|
|
112
|
+
id
|
|
113
|
+
}
|
|
111
114
|
"""
|
|
112
115
|
self.properties_with_files = """
|
|
113
116
|
id
|
|
@@ -221,6 +224,9 @@ class Malware:
|
|
|
221
224
|
created
|
|
222
225
|
modified
|
|
223
226
|
}
|
|
227
|
+
samples {
|
|
228
|
+
id
|
|
229
|
+
}
|
|
224
230
|
importFiles {
|
|
225
231
|
edges {
|
|
226
232
|
node {
|
|
@@ -411,6 +417,7 @@ class Malware:
|
|
|
411
417
|
x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None)
|
|
412
418
|
granted_refs = kwargs.get("objectOrganization", None)
|
|
413
419
|
x_opencti_workflow_id = kwargs.get("x_opencti_workflow_id", None)
|
|
420
|
+
samples = kwargs.get("samples", None)
|
|
414
421
|
update = kwargs.get("update", False)
|
|
415
422
|
|
|
416
423
|
if name is not None:
|
|
@@ -453,6 +460,7 @@ class Malware:
|
|
|
453
460
|
"killChainPhases": kill_chain_phases,
|
|
454
461
|
"x_opencti_stix_ids": x_opencti_stix_ids,
|
|
455
462
|
"x_opencti_workflow_id": x_opencti_workflow_id,
|
|
463
|
+
"samples": samples,
|
|
456
464
|
"update": update,
|
|
457
465
|
}
|
|
458
466
|
},
|
|
@@ -572,6 +580,7 @@ class Malware:
|
|
|
572
580
|
if "x_opencti_workflow_id" in stix_object
|
|
573
581
|
else None
|
|
574
582
|
),
|
|
583
|
+
samples=(extras["sample_ids"] if "sample_ids" in extras else None),
|
|
575
584
|
update=update,
|
|
576
585
|
)
|
|
577
586
|
else:
|
|
@@ -2349,13 +2349,9 @@ class StixCyberObservable:
|
|
|
2349
2349
|
created
|
|
2350
2350
|
modified
|
|
2351
2351
|
objectLabel {
|
|
2352
|
-
|
|
2353
|
-
|
|
2354
|
-
|
|
2355
|
-
value
|
|
2356
|
-
color
|
|
2357
|
-
}
|
|
2358
|
-
}
|
|
2352
|
+
id
|
|
2353
|
+
value
|
|
2354
|
+
color
|
|
2359
2355
|
}
|
|
2360
2356
|
}
|
|
2361
2357
|
... on Organization {
|
|
@@ -2480,13 +2476,9 @@ class StixCyberObservable:
|
|
|
2480
2476
|
created
|
|
2481
2477
|
modified
|
|
2482
2478
|
objectLabel {
|
|
2483
|
-
|
|
2484
|
-
|
|
2485
|
-
|
|
2486
|
-
value
|
|
2487
|
-
color
|
|
2488
|
-
}
|
|
2489
|
-
}
|
|
2479
|
+
id
|
|
2480
|
+
value
|
|
2481
|
+
color
|
|
2490
2482
|
}
|
|
2491
2483
|
}
|
|
2492
2484
|
... on Organization {
|
|
@@ -2612,13 +2604,9 @@ class StixCyberObservable:
|
|
|
2612
2604
|
created
|
|
2613
2605
|
modified
|
|
2614
2606
|
objectLabel {
|
|
2615
|
-
|
|
2616
|
-
|
|
2617
|
-
|
|
2618
|
-
value
|
|
2619
|
-
color
|
|
2620
|
-
}
|
|
2621
|
-
}
|
|
2607
|
+
id
|
|
2608
|
+
value
|
|
2609
|
+
color
|
|
2622
2610
|
}
|
|
2623
2611
|
}
|
|
2624
2612
|
... on Organization {
|
|
@@ -1851,13 +1851,9 @@ class StixDomainObject:
|
|
|
1851
1851
|
created
|
|
1852
1852
|
modified
|
|
1853
1853
|
objectLabel {
|
|
1854
|
-
|
|
1855
|
-
|
|
1856
|
-
|
|
1857
|
-
value
|
|
1858
|
-
color
|
|
1859
|
-
}
|
|
1860
|
-
}
|
|
1854
|
+
id
|
|
1855
|
+
value
|
|
1856
|
+
color
|
|
1861
1857
|
}
|
|
1862
1858
|
}
|
|
1863
1859
|
... on Organization {
|
|
@@ -1982,13 +1978,9 @@ class StixDomainObject:
|
|
|
1982
1978
|
created
|
|
1983
1979
|
modified
|
|
1984
1980
|
objectLabel {
|
|
1985
|
-
|
|
1986
|
-
|
|
1987
|
-
|
|
1988
|
-
value
|
|
1989
|
-
color
|
|
1990
|
-
}
|
|
1991
|
-
}
|
|
1981
|
+
id
|
|
1982
|
+
value
|
|
1983
|
+
color
|
|
1992
1984
|
}
|
|
1993
1985
|
}
|
|
1994
1986
|
... on Organization {
|
|
@@ -2114,13 +2106,9 @@ class StixDomainObject:
|
|
|
2114
2106
|
created
|
|
2115
2107
|
modified
|
|
2116
2108
|
objectLabel {
|
|
2117
|
-
|
|
2118
|
-
|
|
2119
|
-
|
|
2120
|
-
value
|
|
2121
|
-
color
|
|
2122
|
-
}
|
|
2123
|
-
}
|
|
2109
|
+
id
|
|
2110
|
+
value
|
|
2111
|
+
color
|
|
2124
2112
|
}
|
|
2125
2113
|
}
|
|
2126
2114
|
... on Organization {
|
pycti/utils/opencti_stix2.py
CHANGED
|
@@ -770,6 +770,10 @@ class OpenCTIStix2:
|
|
|
770
770
|
)
|
|
771
771
|
elif "x_opencti_granted_refs" in stix_object:
|
|
772
772
|
granted_refs_ids = stix_object["x_opencti_granted_refs"]
|
|
773
|
+
# Sample refs
|
|
774
|
+
sample_refs_ids = (
|
|
775
|
+
stix_object["sample_refs"] if "sample_refs" in stix_object else []
|
|
776
|
+
)
|
|
773
777
|
|
|
774
778
|
return {
|
|
775
779
|
"created_by": created_by_id,
|
|
@@ -779,6 +783,7 @@ class OpenCTIStix2:
|
|
|
779
783
|
"kill_chain_phases": kill_chain_phases_ids,
|
|
780
784
|
"object_refs": object_refs_ids,
|
|
781
785
|
"granted_refs": granted_refs_ids,
|
|
786
|
+
"sample_refs": sample_refs_ids,
|
|
782
787
|
"external_references": external_references_ids,
|
|
783
788
|
"reports": reports,
|
|
784
789
|
}
|
|
@@ -863,6 +868,7 @@ class OpenCTIStix2:
|
|
|
863
868
|
object_refs_ids = embedded_relationships["object_refs"]
|
|
864
869
|
external_references_ids = embedded_relationships["external_references"]
|
|
865
870
|
reports = embedded_relationships["reports"]
|
|
871
|
+
sample_refs_ids = embedded_relationships["sample_refs"]
|
|
866
872
|
|
|
867
873
|
# Extra
|
|
868
874
|
extras = {
|
|
@@ -874,6 +880,7 @@ class OpenCTIStix2:
|
|
|
874
880
|
"object_ids": object_refs_ids,
|
|
875
881
|
"external_references_ids": external_references_ids,
|
|
876
882
|
"reports": reports,
|
|
883
|
+
"sample_ids": sample_refs_ids,
|
|
877
884
|
}
|
|
878
885
|
|
|
879
886
|
# Import
|
|
@@ -1000,6 +1007,7 @@ class OpenCTIStix2:
|
|
|
1000
1007
|
object_refs_ids = embedded_relationships["object_refs"]
|
|
1001
1008
|
external_references_ids = embedded_relationships["external_references"]
|
|
1002
1009
|
reports = embedded_relationships["reports"]
|
|
1010
|
+
sample_refs_ids = embedded_relationships["sample_refs"]
|
|
1003
1011
|
|
|
1004
1012
|
# Extra
|
|
1005
1013
|
extras = {
|
|
@@ -1012,6 +1020,7 @@ class OpenCTIStix2:
|
|
|
1012
1020
|
"object_ids": object_refs_ids,
|
|
1013
1021
|
"external_references_ids": external_references_ids,
|
|
1014
1022
|
"reports": reports,
|
|
1023
|
+
"sample_ids": sample_refs_ids,
|
|
1015
1024
|
}
|
|
1016
1025
|
if stix_object["type"] == "simple-observable":
|
|
1017
1026
|
stix_observable_result = self.opencti.stix_cyber_observable.create(
|
|
@@ -1176,6 +1185,7 @@ class OpenCTIStix2:
|
|
|
1176
1185
|
object_refs_ids = embedded_relationships["object_refs"]
|
|
1177
1186
|
external_references_ids = embedded_relationships["external_references"]
|
|
1178
1187
|
reports = embedded_relationships["reports"]
|
|
1188
|
+
sample_refs_ids = embedded_relationships["sample_refs"]
|
|
1179
1189
|
|
|
1180
1190
|
# Extra
|
|
1181
1191
|
extras = {
|
|
@@ -1188,6 +1198,7 @@ class OpenCTIStix2:
|
|
|
1188
1198
|
"object_ids": object_refs_ids,
|
|
1189
1199
|
"external_references_ids": external_references_ids,
|
|
1190
1200
|
"reports": reports,
|
|
1201
|
+
"sample_ids": sample_refs_ids,
|
|
1191
1202
|
}
|
|
1192
1203
|
|
|
1193
1204
|
# Create the relation
|
|
@@ -1271,6 +1282,7 @@ class OpenCTIStix2:
|
|
|
1271
1282
|
object_refs_ids = embedded_relationships["object_refs"]
|
|
1272
1283
|
external_references_ids = embedded_relationships["external_references"]
|
|
1273
1284
|
reports = embedded_relationships["reports"]
|
|
1285
|
+
sample_refs_ids = embedded_relationships["sample_refs"]
|
|
1274
1286
|
|
|
1275
1287
|
# Extra
|
|
1276
1288
|
extras = {
|
|
@@ -1283,6 +1295,7 @@ class OpenCTIStix2:
|
|
|
1283
1295
|
"object_ids": object_refs_ids,
|
|
1284
1296
|
"external_references_ids": external_references_ids,
|
|
1285
1297
|
"reports": reports,
|
|
1298
|
+
"sample_ids": sample_refs_ids,
|
|
1286
1299
|
}
|
|
1287
1300
|
|
|
1288
1301
|
# Create the sighting
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.1
|
|
2
2
|
Name: pycti
|
|
3
|
-
Version: 6.0.
|
|
3
|
+
Version: 6.0.9
|
|
4
4
|
Summary: Python API client for OpenCTI.
|
|
5
5
|
Home-page: https://github.com/OpenCTI-Platform/client-python
|
|
6
6
|
Author: Filigran
|
|
@@ -27,23 +27,23 @@ Requires-Dist: prometheus-client ~=0.20.0
|
|
|
27
27
|
Requires-Dist: python-json-logger ~=2.0.4
|
|
28
28
|
Requires-Dist: pyyaml ~=6.0
|
|
29
29
|
Requires-Dist: requests ~=2.31.0
|
|
30
|
-
Requires-Dist: setuptools ~=69.
|
|
30
|
+
Requires-Dist: setuptools ~=69.2.0
|
|
31
31
|
Requires-Dist: filigran-sseclient ~=1.0.0
|
|
32
32
|
Requires-Dist: stix2 ~=3.0.1
|
|
33
33
|
Requires-Dist: cachetools ~=5.3.0
|
|
34
34
|
Requires-Dist: python-magic ~=0.4.27 ; sys_platform == "linux" or sys_platform == "darwin"
|
|
35
35
|
Requires-Dist: python-magic-bin ~=0.4.14 ; sys_platform == "win32"
|
|
36
36
|
Provides-Extra: dev
|
|
37
|
-
Requires-Dist: black ~=24.
|
|
38
|
-
Requires-Dist: build ~=1.
|
|
37
|
+
Requires-Dist: black ~=24.3.0 ; extra == 'dev'
|
|
38
|
+
Requires-Dist: build ~=1.2.1 ; extra == 'dev'
|
|
39
39
|
Requires-Dist: isort ~=5.13.0 ; extra == 'dev'
|
|
40
40
|
Requires-Dist: types-pytz ~=2024.1.0.20240203 ; extra == 'dev'
|
|
41
|
-
Requires-Dist: pre-commit ~=3.
|
|
41
|
+
Requires-Dist: pre-commit ~=3.7.0 ; extra == 'dev'
|
|
42
42
|
Requires-Dist: pytest-cases ~=3.8.0 ; extra == 'dev'
|
|
43
|
-
Requires-Dist: pytest-cov ~=
|
|
43
|
+
Requires-Dist: pytest-cov ~=5.0.0 ; extra == 'dev'
|
|
44
44
|
Requires-Dist: pytest-randomly ~=3.15.0 ; extra == 'dev'
|
|
45
|
-
Requires-Dist: pytest ~=
|
|
46
|
-
Requires-Dist: types-python-dateutil ~=2.
|
|
45
|
+
Requires-Dist: pytest ~=8.1.1 ; extra == 'dev'
|
|
46
|
+
Requires-Dist: types-python-dateutil ~=2.9.0 ; extra == 'dev'
|
|
47
47
|
Requires-Dist: wheel ~=0.43.0 ; extra == 'dev'
|
|
48
48
|
Provides-Extra: doc
|
|
49
49
|
Requires-Dist: autoapi ~=2.0.1 ; extra == 'doc'
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
pycti/__init__.py,sha256=
|
|
1
|
+
pycti/__init__.py,sha256=GdlQYeIZIUhUWOCEzAePIhesbjizdBVR4rEuIkWUvyo,4691
|
|
2
2
|
pycti/api/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
3
3
|
pycti/api/opencti_api_client.py,sha256=Jhzsl17JL78IphkbkM1ujLP4Pa8PfIGtUNkEcNRjHxM,28980
|
|
4
4
|
pycti/api/opencti_api_connector.py,sha256=fYF0Jy9KIMFNt1RC_A1rpWomVJ-oj5HiSsBem4W0J5U,3549
|
|
@@ -6,7 +6,7 @@ pycti/api/opencti_api_playbook.py,sha256=Wcf-G__IHmR7LwtUFVUVx4Skg9e2mcb89n_HyfW
|
|
|
6
6
|
pycti/api/opencti_api_work.py,sha256=ow30gswv4k5zLlZGlvLAn47ZM07RLsYvEV-KwtwedQg,7109
|
|
7
7
|
pycti/connector/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
8
8
|
pycti/connector/opencti_connector.py,sha256=0vrZ8Y8ecbxegAP1YhpX6ybOZahYjjOkcId51D1oBi4,2449
|
|
9
|
-
pycti/connector/opencti_connector_helper.py,sha256=
|
|
9
|
+
pycti/connector/opencti_connector_helper.py,sha256=hWoh3NKJvCo2kVEiZby3pt67zlz0guJ23zwErUZbah4,55835
|
|
10
10
|
pycti/connector/opencti_metric_handler.py,sha256=4jXHeJflomtHjuQ_YU0b36TG7o26vOWbY_jvU8Ezobs,3725
|
|
11
11
|
pycti/entities/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
12
12
|
pycti/entities/opencti_attack_pattern.py,sha256=ycAR0cReJ1dd_edQPAL6qBrFvvTx10GJFMTezyK91cg,21471
|
|
@@ -31,7 +31,7 @@ pycti/entities/opencti_kill_chain_phase.py,sha256=a509rFeIchPRlO5rMHPVxrxfUuTbV4
|
|
|
31
31
|
pycti/entities/opencti_label.py,sha256=6RZJPIa_dXf_YNNU4xXKghfBnpNjhU5YXOaSIcB4YrM,8800
|
|
32
32
|
pycti/entities/opencti_language.py,sha256=eHB7qzf_l2Mno_Wy9kF0QUdcBktWgr4kRHhb9AxT0c0,16176
|
|
33
33
|
pycti/entities/opencti_location.py,sha256=uet-YxkvTvcD2rh2VbQM2hS7F9Uj-dwmXixSJOKN5zs,16970
|
|
34
|
-
pycti/entities/opencti_malware.py,sha256=
|
|
34
|
+
pycti/entities/opencti_malware.py,sha256=TNz-HDbvcBxyPn9GwSnNVlVljg274HkxgJw62-OoyKc,20411
|
|
35
35
|
pycti/entities/opencti_malware_analysis.py,sha256=grOJTiuZfCU464AgnF-VDO97geFfKNCR-SW40SiewNQ,20904
|
|
36
36
|
pycti/entities/opencti_marking_definition.py,sha256=2HkU58XWOZHuEFXrscshQIHW-KVyZSr02JRzBQYZirI,12862
|
|
37
37
|
pycti/entities/opencti_narrative.py,sha256=qiuFQub04pvArYf5hHJEgZtneR7p-VQq5YywiN-rlRM,16468
|
|
@@ -42,8 +42,8 @@ pycti/entities/opencti_report.py,sha256=tSMSCsAGgZny94EjFtidEws7Uf0gBI-nPHwkqPg2
|
|
|
42
42
|
pycti/entities/opencti_stix.py,sha256=uMheSg8i1f2Ozx2Mk0iShWzHHjj6MMWDtV5nDjVxKEE,2275
|
|
43
43
|
pycti/entities/opencti_stix_core_object.py,sha256=QRiAk5_loi4JLJN4aXSq8DTwFFzOLhbA7Y-2R3aO8kw,48728
|
|
44
44
|
pycti/entities/opencti_stix_core_relationship.py,sha256=cD825areOn2quv06M28YGE7A3bTQ8_Pxx1QW6JyoQBs,42895
|
|
45
|
-
pycti/entities/opencti_stix_cyber_observable.py,sha256=
|
|
46
|
-
pycti/entities/opencti_stix_domain_object.py,sha256=
|
|
45
|
+
pycti/entities/opencti_stix_cyber_observable.py,sha256=IcHNnRKjJxQ_7adlIzYzUV3XUvvcac0w9fe_hQp5eic,103971
|
|
46
|
+
pycti/entities/opencti_stix_domain_object.py,sha256=04q7gQZ-hgpsjsyvXh6VOYmRJOPwOrdAPlzUmzlM5mc,77998
|
|
47
47
|
pycti/entities/opencti_stix_nested_ref_relationship.py,sha256=2r1i7cUl-WWictlnC_MJrm9sTIt_yJe2uqTpQm-yo6o,12330
|
|
48
48
|
pycti/entities/opencti_stix_object_or_stix_relationship.py,sha256=NOJdUU9cm_gMBne13EZPb8cfxOhTfgVVmv8A0yasQeI,14610
|
|
49
49
|
pycti/entities/opencti_stix_sighting_relationship.py,sha256=AmX1LBS8cW5a_dlik_sx-nBDvUcqb193gs4m3pB9C5U,27584
|
|
@@ -57,12 +57,12 @@ pycti/entities/opencti_vulnerability.py,sha256=dzJ0fZB2XrkPwT-cANr6atzYOWXF5nk0a
|
|
|
57
57
|
pycti/utils/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
58
58
|
pycti/utils/constants.py,sha256=mAAeNGXyHU89yp8lihXBKF9fKncQCKwyxD2PVz5D2wI,7915
|
|
59
59
|
pycti/utils/opencti_logger.py,sha256=0dvB75V0SuPFGxL539dAQrxTt1N5Acx0A3Ogwl5WMJ8,2199
|
|
60
|
-
pycti/utils/opencti_stix2.py,sha256=
|
|
60
|
+
pycti/utils/opencti_stix2.py,sha256=UtTLdX88lGqoQClwZC9z2wNjje3X8BSk2Pe5HsNTyEc,112190
|
|
61
61
|
pycti/utils/opencti_stix2_splitter.py,sha256=Ht9Mp-W3gbwxIKEr7i_5NYpcDr3TA2gYdC4TzOz0G4c,4496
|
|
62
62
|
pycti/utils/opencti_stix2_update.py,sha256=CnMyqkeVA0jgyxEcgqna8sABU4YPMjkEJ228GVurIn4,14658
|
|
63
63
|
pycti/utils/opencti_stix2_utils.py,sha256=_ijIz6SRP2OeIaWJcXJt8go510MUEGfWE3KY-I_9QZc,3725
|
|
64
|
-
pycti-6.0.
|
|
65
|
-
pycti-6.0.
|
|
66
|
-
pycti-6.0.
|
|
67
|
-
pycti-6.0.
|
|
68
|
-
pycti-6.0.
|
|
64
|
+
pycti-6.0.9.dist-info/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
|
|
65
|
+
pycti-6.0.9.dist-info/METADATA,sha256=98nnsJbWJUYzZNQZqU-K1uIafVcirHpS3skSAC-TN70,5313
|
|
66
|
+
pycti-6.0.9.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
|
|
67
|
+
pycti-6.0.9.dist-info/top_level.txt,sha256=cqEpxitAhHP4VgSA6xmrak6Yk9MeBkwoMTB6k7d2ZnE,6
|
|
68
|
+
pycti-6.0.9.dist-info/RECORD,,
|
|
File without changes
|
|
File without changes
|
|
File without changes
|