pycti 6.0.9__py3-none-any.whl → 6.1.0__py3-none-any.whl

pycti/entities/opencti_intrusion_set.py

@@ -286,9 +286,31 @@ class IntrusionSet:
                 "orderMode": order_mode,
             },
         )
-        return self.opencti.process_multiple(
-            result["data"]["intrusionSets"], with_pagination
-        )
+        if get_all:
+            final_data = []
+            data = self.opencti.process_multiple(result["data"]["intrusionSets"])
+            final_data = final_data + data
+            while result["data"]["intrusionSets"]["pageInfo"]["hasNextPage"]:
+                after = result["data"]["intrusionSets"]["pageInfo"]["endCursor"]
+                self.opencti.app_logger.info("Listing Intrusion-Sets", {"after": after})
+                result = self.opencti.query(
+                    query,
+                    {
+                        "filters": filters,
+                        "search": search,
+                        "first": first,
+                        "after": after,
+                        "orderBy": order_by,
+                        "orderMode": order_mode,
+                    },
+                )
+                data = self.opencti.process_multiple(result["data"]["intrusionSets"])
+                final_data = final_data + data
+            return final_data
+        else:
+            return self.opencti.process_multiple(
+                result["data"]["intrusionSets"], with_pagination
+            )
 
     """
         Read a Intrusion-Set object
@@ -363,6 +385,7 @@ class IntrusionSet:
         secondary_motivations = kwargs.get("secondary_motivations", None)
         x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None)
         granted_refs = kwargs.get("objectOrganization", None)
+        x_opencti_workflow_id = kwargs.get("x_opencti_workflow_id", None)
         update = kwargs.get("update", False)
 
         if name is not None:
@@ -402,6 +425,7 @@ class IntrusionSet:
                         "primary_motivation": primary_motivation,
                         "secondary_motivations": secondary_motivations,
                         "x_opencti_stix_ids": x_opencti_stix_ids,
+                        "x_opencti_workflow_id": x_opencti_workflow_id,
                         "update": update,
                     }
                 },
@@ -435,7 +459,11 @@ class IntrusionSet:
                 stix_object["x_opencti_granted_refs"] = (
                     self.opencti.get_attribute_in_extension("granted_refs", stix_object)
                 )
-
+            if "x_opencti_workflow_id" not in stix_object:
+                stix_object["x_opencti_workflow_id"] = (
+                    self.opencti.get_attribute_in_extension("workflow_id", stix_object)
+                )
+                7
             return self.create(
                 stix_id=stix_object["id"],
                 createdBy=(
@@ -500,6 +528,11 @@ class IntrusionSet:
                     if "x_opencti_granted_refs" in stix_object
                     else None
                 ),
+                x_opencti_workflow_id=(
+                    stix_object["x_opencti_workflow_id"]
+                    if "x_opencti_workflow_id" in stix_object
+                    else None
+                ),
                 update=update,
             )
         else:

pycti/entities/opencti_malware_analysis.py

@@ -401,6 +401,7 @@ class MalwareAnalysis:
         analysisSco = kwargs.get("analysisSco", None)
         x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None)
         granted_refs = kwargs.get("objectOrganization", None)
+        x_opencti_workflow_id = kwargs.get("x_opencti_workflow_id", None)
         update = kwargs.get("update", False)
 
         if product is not None and result_name is not None:
@@ -449,6 +450,7 @@ class MalwareAnalysis:
                         "analysisSample": sample,
                         "analysisSco": analysisSco,
                         "x_opencti_stix_ids": x_opencti_stix_ids,
+                        "x_opencti_workflow_id": x_opencti_workflow_id,
                         "update": update,
                     }
                 },
@@ -482,6 +484,10 @@ class MalwareAnalysis:
                 stix_object["x_opencti_granted_refs"] = (
                     self.opencti.get_attribute_in_extension("granted_refs", stix_object)
                 )
+            if "x_opencti_workflow_id" not in stix_object:
+                stix_object["x_opencti_workflow_id"] = (
+                    self.opencti.get_attribute_in_extension("workflow_id", stix_object)
+                )
 
             return self.create(
                 stix_id=stix_object["id"],
@@ -574,6 +580,11 @@ class MalwareAnalysis:
                     if "x_opencti_granted_refs" in stix_object
                     else None
                 ),
+                x_opencti_workflow_id=(
+                    stix_object["x_opencti_workflow_id"]
+                    if "x_opencti_workflow_id" in stix_object
+                    else None
+                ),
                 update=update,
             )
         else:

pycti/entities/opencti_report.py

@@ -466,6 +466,19 @@ class Report:
         id = str(uuid.uuid5(uuid.UUID("00abedb4-aa42-466c-9c01-fed23315a9b7"), data))
         return "report--" + id
 
+    @staticmethod
+    def generate_fixed_fake_id(name, published=None):
+        name = name.lower().strip()
+        if isinstance(published, datetime.datetime):
+            published = published.isoformat()
+        if published is not None:
+            data = {"name": name, "published": published, "fake": "fake"}
+        else:
+            data = {"name": name, "fake": "fake"}
+        data = canonicalize(data, utf8=False)
+        id = str(uuid.uuid5(uuid.UUID("00abedb4-aa42-466c-9c01-fed23315a9b7"), data))
+        return "report--" + id
+
     """
         List Report objects
 

pycti/entities/opencti_stix_core_object.py

@@ -435,9 +435,18 @@ class StixCoreObject:
                         }
                     }
                 }
-            }      
+            }
             ... on StixCyberObservable {
                 observable_value
+                indicators {
+                    edges {
+                        node {
+                            id
+                            pattern
+                            pattern_type
+                        }
+                    }
+                }
             }
             ... on AutonomousSystem {
                 number
@@ -615,6 +624,12 @@ class StixCoreObject:
             ... on PhoneNumber {
                 value
             }
+            ... on TrackingNumber {
+                value
+            }
+            ... on Credential {
+                value
+            }
             ... on PaymentCard {
                 card_number
                 expiration_date
@@ -1084,9 +1099,18 @@ class StixCoreObject:
                         }
                     }
                 }
-            }      
+            }
             ... on StixCyberObservable {
                 observable_value
+                indicators {
+                    edges {
+                        node {
+                            id
+                            pattern
+                            pattern_type
+                        }
+                    }
+                }
             }
             ... on AutonomousSystem {
                 number
@@ -1453,13 +1477,21 @@ class StixCoreObject:
         return entity["importFiles"]
 
     def push_list_export(
-        self, entity_id, entity_type, file_name, data, list_filters="", mime_type=None
+        self,
+        entity_id,
+        entity_type,
+        file_name,
+        file_markings,
+        data,
+        list_filters="",
+        mime_type=None,
     ):
         query = """
-            mutation StixCoreObjectsExportPush($entity_id: String, $entity_type: String!, $file: Upload!, $listFilters: String) {
-                stixCoreObjectsExportPush(entity_id: $entity_id, entity_type: $entity_type, file: $file, listFilters: $listFilters)
+            mutation StixCoreObjectsExportPush($entity_id: String, $entity_type: String!, $file: Upload!, $file_markings: [String]!, $listFilters: String) {
+                stixCoreObjectsExportPush(entity_id: $entity_id, entity_type: $entity_type, file: $file, file_markings: $file_markings, listFilters: $listFilters)
             }
         """
+
         if mime_type is None:
             file = self.file(file_name, data)
         else:
@@ -1470,6 +1502,7 @@ class StixCoreObject:
                 "entity_id": entity_id,
                 "entity_type": entity_type,
                 "file": file,
+                "file_markings": file_markings,
                 "listFilters": list_filters,
             },
         )

pycti/entities/opencti_stix_cyber_observable.py

@@ -282,6 +282,12 @@ class StixCyberObservable:
             ... on PhoneNumber {
                 value
             }
+            ... on TrackingNumber {
+                value
+            }
+            ... on Credential {
+                value
+            }
             ... on PaymentCard {
                 card_number
                 expiration_date
@@ -576,6 +582,12 @@ class StixCyberObservable:
             ... on PhoneNumber {
                 value
             }
+            ... on TrackingNumber {
+                value
+            }
+            ... on Credential {
+                value
+            }
             ... on PaymentCard {
                 card_number
                 expiration_date
@@ -857,6 +869,15 @@ class StixCyberObservable:
             type = "IPv6-Addr"
         elif type.lower() == "hostname" or type.lower() == "x-opencti-hostname":
             type = "Hostname"
+        elif type.lower() == "payment-card" or type.lower() == "x-opencti-payment-card":
+            type = "Payment-Card"
+        elif type.lower() == "credential" or type.lower() == "x-opencti-credential":
+            type = "Credential"
+        elif (
+            type.lower() == "tracking-number"
+            or type.lower() == "x-opencti-tracking-number"
+        ):
+            type = "Tracking-Number"
         elif (
             type.lower() == "cryptocurrency-wallet"
             or type.lower() == "x-opencti-cryptocurrency-wallet"
@@ -974,6 +995,8 @@ class StixCyberObservable:
                     $UserAgent: UserAgentAddInput
                     $BankAccount: BankAccountAddInput
                     $PhoneNumber: PhoneNumberAddInput
+                    $Credential: CredentialAddInput
+                    $TrackingNumber: TrackingNumberAddInput
                     $PaymentCard: PaymentCardAddInput
                     $MediaContent: MediaContentAddInput
                 ) {
@@ -1016,6 +1039,8 @@ class StixCyberObservable:
                         UserAgent: $UserAgent
                         BankAccount: $BankAccount
                         PhoneNumber: $PhoneNumber
+                        Credential: $Credential
+                        TrackingNumber: $TrackingNumber
                         PaymentCard: $PaymentCard
                         MediaContent: $MediaContent
                     ) {
@@ -1508,15 +1533,6 @@ class StixCyberObservable:
                         observable_data["value"] if "value" in observable_data else None
                     ),
                 }
-            elif (
-                type == "Cryptocurrency-Wallet"
-                or type == "X-OpenCTI-Cryptocurrency-Wallet"
-            ):
-                input_variables["CryptocurrencyWallet"] = {
-                    "value": (
-                        observable_data["value"] if "value" in observable_data else None
-                    ),
-                }
             elif type == "Hostname":
                 input_variables["Hostname"] = {
                     "value": (
@@ -1588,8 +1604,50 @@ class StixCyberObservable:
                         else None
                     ),
                 }
+            elif type == "Payment-Card" or type.lower() == "x-opencti-payment-card":
+                input_variables["PaymentCard"] = {
+                    "card_number": (
+                        observable_data["card_number"]
+                        if "card_number" in observable_data
+                        else None
+                    ),
+                    "expiration_date": (
+                        observable_data["expiration_date"]
+                        if "expiration_date" in observable_data
+                        else None
+                    ),
+                    "cvv": observable_data["cvv"] if "cvv" in observable_data else None,
+                    "holder_name": (
+                        observable_data["holder_name"]
+                        if "holder_name" in observable_data
+                        else None
+                    ),
+                }
+            elif (
+                type == "Cryptocurrency-Wallet"
+                or type.lower() == "x-opencti-cryptocurrency-wallet"
+            ):
+                input_variables["CryptocurrencyWallet"] = {
+                    "value": (
+                        observable_data["value"] if "value" in observable_data else None
+                    ),
+                }
+            elif type == "Credential" or type.lower() == "x-opencti-credential":
+                input_variables["Credential"] = {
+                    "value": (
+                        observable_data["value"] if "value" in observable_data else None
+                    ),
+                }
+            elif (
+                type == "Tracking-Number" or type.lower() == "x-opencti-tracking-number"
+            ):
+                input_variables["TrackingNumber"] = {
+                    "value": (
+                        observable_data["value"] if "value" in observable_data else None
+                    ),
+                }
             result = self.opencti.query(query, input_variables)
-            if "payload_bin" in observable_data and "mime/type" in observable_data:
+            if "payload_bin" in observable_data and "mime_type" in observable_data:
                 self.add_file(
                     id=result["data"]["stixCyberObservableAdd"]["id"],
                     file_name=(
@@ -2258,11 +2316,30 @@ class StixCyberObservable:
             return False
 
     def push_list_export(
-        self, entity_id, entity_type, file_name, data, list_filters="", mime_type=None
+        self,
+        entity_id,
+        entity_type,
+        file_name,
+        file_markings,
+        data,
+        list_filters="",
+        mime_type=None,
     ):
         query = """
-            mutation StixCyberObservablesExportPush($entity_id: String, $entity_type: String!, $file: Upload!, $listFilters: String) {
-                stixCyberObservablesExportPush(entity_id: $entity_id, entity_type: $entity_type, file: $file, listFilters: $listFilters)
+            mutation StixCyberObservablesExportPush(
+                $entity_id: String,
+                $entity_type: String!,
+                $file: Upload!,
+                $file_markings: [String]!,
+                $listFilters: String
+            ) {
+                stixCyberObservablesExportPush(
+                    entity_id: $entity_id,
+                    entity_type: $entity_type,
+                    file: $file,
+                    file_markings: $file_markings,
+                    listFilters: $listFilters
+                )
             }
         """
         if mime_type is None:
@@ -2275,6 +2352,7 @@ class StixCyberObservable:
                 "entity_id": entity_id,
                 "entity_type": entity_type,
                 "file": file,
+                "file_markings": file_markings,
                 "listFilters": list_filters,
             },
         )

pycti/entities/opencti_stix_domain_object.py

@@ -1325,11 +1325,18 @@ class StixDomainObject:
             return None
 
     def push_list_export(
-        self, entity_id, entity_type, file_name, data, list_filters="", mime_type=None
+        self,
+        entity_id,
+        entity_type,
+        file_name,
+        file_markings,
+        data,
+        list_filters="",
+        mime_type=None,
     ):
         query = """
-            mutation StixDomainObjectsExportPush($entity_id: String, $entity_type: String!, $file: Upload!, $listFilters: String) {
-                stixDomainObjectsExportPush(entity_id: $entity_id, entity_type: $entity_type, file: $file, listFilters: $listFilters)
+            mutation StixDomainObjectsExportPush($entity_id: String, $entity_type: String!, $file: Upload!, $file_markings: [String]!, $listFilters: String) {
+                stixDomainObjectsExportPush(entity_id: $entity_id, entity_type: $entity_type, file: $file,  file_markings: $file_markings, listFilters: $listFilters)
             }
         """
         if mime_type is None:
@@ -1342,15 +1349,24 @@ class StixDomainObject:
                 "entity_id": entity_id,
                 "entity_type": entity_type,
                 "file": file,
+                "file_markings": file_markings,
                 "listFilters": list_filters,
             },
         )
 
-    def push_entity_export(self, entity_id, file_name, data, mime_type=None):
+    def push_entity_export(
+        self, entity_id, file_name, data, file_markings, mime_type=None
+    ):
         query = """
-            mutation StixDomainObjectEdit($id: ID!, $file: Upload!) {
+            mutation StixDomainObjectEdit(
+                $id: ID!, $file: Upload!,
+                $file_markings: [String]!
+            ) {
                 stixDomainObjectEdit(id: $id) {
-                    exportPush(file: $file)
+                    exportPush(
+                        file: $file,
+                        file_markings: $file_markings
+                    )
                 }
             }
         """
@@ -1358,7 +1374,9 @@ class StixDomainObject:
             file = self.file(file_name, data)
         else:
             file = self.file(file_name, data, mime_type)
-        self.opencti.query(query, {"id": entity_id, "file": file})
+        self.opencti.query(
+            query, {"id": entity_id, "file": file, "file_markings": file_markings}
+        )
 
     """
         Update the Identity author of a Stix-Domain-Object object (created_by)

pycti/entities/opencti_stix_object_or_stix_relationship.py

@@ -1,3 +1,6 @@
+import json
+
+
 class StixObjectOrStixRelationship:
     def __init__(self, opencti):
         self.opencti = opencti
@@ -329,11 +332,15 @@ class StixObjectOrStixRelationship:
             }
             ... on Case {
                 name
-            }            
+            }
             ... on StixCyberObservable {
                 observable_value
             }
             ... on StixCoreRelationship {
+                id
+                standard_id
+                entity_type
+                parent_types
                 createdBy {
                     ... on Identity {
                         id
@@ -396,6 +403,10 @@ class StixObjectOrStixRelationship:
                 stop_time
             }
             ... on StixSightingRelationship {
+                id
+                standard_id
+                entity_type
+                parent_types
                 createdBy {
                     ... on Identity {
                         id
@@ -476,9 +487,9 @@ class StixObjectOrStixRelationship:
             )
             query = (
                 """
-                query StixObjectOrStixRelationship($id: String!) {
-                    stixObjectOrStixRelationship(id: $id) {
-                        """
+                    query StixObjectOrStixRelationship($id: String!) {
+                        stixObjectOrStixRelationship(id: $id) {
+                            """
                 + (
                     custom_attributes
                     if custom_attributes is not None
@@ -496,3 +507,51 @@ class StixObjectOrStixRelationship:
         else:
             self.opencti.app_logger.error("Missing parameters: id")
             return None
+
+    def list(self, **kwargs):
+        filters = kwargs.get("filters", None)
+        search = kwargs.get("search", None)
+        first = kwargs.get("first", 100)
+        after = kwargs.get("after", None)
+        with_pagination = kwargs.get("with_pagination", False)
+        custom_attributes = kwargs.get("customAttributes", None)
+
+        self.opencti.app_logger.info(
+            "Listing StixObjectOrStixRelationships with filters",
+            {"filters": json.dumps(filters)},
+        )
+        query = (
+            """
+                        query StixObjectOrStixRelationships($filters: FilterGroup, $search: String, $first: Int, $after: ID) {
+                            stixObjectOrStixRelationships(filters: $filters, search: $search, first: $first, after: $after) {
+                                edges {
+                                    node {
+                                        """
+            + (custom_attributes if custom_attributes is not None else self.properties)
+            + """
+                                }
+                            }
+                            pageInfo {
+                                startCursor
+                                endCursor
+                                hasNextPage
+                                hasPreviousPage
+                                globalCount
+                            }
+                        }
+                    }
+                """
+        )
+        result = self.opencti.query(
+            query,
+            {
+                "filters": filters,
+                "search": search,
+                "first": first,
+                "after": after,
+            },
+        )
+
+        return self.opencti.process_multiple(
+            result["data"]["stixObjectOrStixRelationships"], with_pagination
+        )

pycti/utils/constants.py

@@ -42,6 +42,8 @@ class StixCyberObservableTypes(Enum):
     USER_AGENT = "User-Agent"
     BANK_ACCOUNT = "Bank-Account"
     PHONE_NUMBER = "Phone-Number"
+    CREDENTIAL = "Credential"
+    TRACKING_NUMBER = "Tracking-Number"
     PAYMENT_CARD = "Payment-Card"
     MEDIA_CONTENT = "Media-Content"
     SIMPLE_OBSERVABLE = "Simple-Observable"
@@ -66,6 +68,7 @@ class IdentityTypes(Enum):
 
 class ThreatActorTypes(Enum):
     THREAT_ACTOR_GROUP = "Threat-Actor-Group"
+    THREAT_ACTOR_INDIVIDUAL = "Threat-Actor-Individual"
 
     @classmethod
     def has_value(cls, value):
@@ -126,7 +129,6 @@ class MultipleRefRelationship(Enum):
     CHILD = "child"
     BODY_MULTIPART = "body-multipart"
     VALUES = "values"
-    LINKED = "x_opencti_linked-to"
     SERVICE_DDL = "service-dll"
     INSTALLED_SOFTWARE = "installed-software"
     RELATION_ANALYSIS_SCO = "analysis-sco"
@@ -263,6 +265,73 @@ class CustomObservableText:
     pass
 
 
+@CustomObservable(
+    "payment-card",
+    [
+        ("value", StringProperty(required=True)),
+        ("card_number", StringProperty(required=True)),
+        ("expiration_date", StringProperty(required=False)),
+        ("cvv", StringProperty(required=False)),
+        ("holder_name", StringProperty(required=False)),
+        ("spec_version", StringProperty(fixed="2.1")),
+        (
+            "object_marking_refs",
+            ListProperty(
+                ReferenceProperty(valid_types="marking-definition", spec_version="2.1")
+            ),
+        ),
+    ],
+    ["card_number"],
+)
+class CustomObservablePaymentCard:
+    """Payment card observable."""
+
+    pass
+
+
+@CustomObservable(
+    "bank-account",
+    [
+        ("value", StringProperty(required=True)),
+        ("iban", StringProperty(required=True)),
+        ("bic", StringProperty(required=False)),
+        ("account_number", StringProperty(required=False)),
+        ("spec_version", StringProperty(fixed="2.1")),
+        (
+            "object_marking_refs",
+            ListProperty(
+                ReferenceProperty(valid_types="marking-definition", spec_version="2.1")
+            ),
+        ),
+    ],
+    ["iban"],
+)
+class CustomObservableBankAccount:
+    """Bank Account observable."""
+
+    pass
+
+
+@CustomObservable(
+    "credential",
+    [
+        ("value", StringProperty(required=True)),
+        ("spec_version", StringProperty(fixed="2.1")),
+        (
+            "object_marking_refs",
+            ListProperty(
+                ReferenceProperty(valid_types="marking-definition", spec_version="2.1")
+            ),
+        ),
+    ],
+    ["value"],
+)
+class CustomObservableCredential:
+    """Credential observable."""
+
+    pass
+
+
 @CustomObservable(
     "cryptocurrency-wallet",
     [
@@ -283,6 +352,46 @@ class CustomObservableCryptocurrencyWallet:
     pass
 
 
+@CustomObservable(
+    "phone-number",
+    [
+        ("value", StringProperty(required=True)),
+        ("spec_version", StringProperty(fixed="2.1")),
+        (
+            "object_marking_refs",
+            ListProperty(
+                ReferenceProperty(valid_types="marking-definition", spec_version="2.1")
+            ),
+        ),
+    ],
+    ["value"],
+)
+class CustomObservablePhoneNumber:
+    """Phone number observable."""
+
+    pass
+
+
+@CustomObservable(
+    "tracking-number",
+    [
+        ("value", StringProperty(required=True)),
+        ("spec_version", StringProperty(fixed="2.1")),
+        (
+            "object_marking_refs",
+            ListProperty(
+                ReferenceProperty(valid_types="marking-definition", spec_version="2.1")
+            ),
+        ),
+    ],
+    ["value"],
+)
+class CustomObservableTrackingNumber:
+    """Tracking number observable."""
+
+    pass
+
+
 @CustomObservable(
     "user-agent",
     [