pycti 6.1.12__py3-none-any.whl → 6.2.0__py3-none-any.whl

pycti/entities/opencti_indicator.py

@@ -5,6 +5,11 @@ import uuid
 
 from stix2.canonicalization.Canonicalize import canonicalize
 
+from .indicator.opencti_indicator_properties import (
+    INDICATOR_PROPERTIES,
+    INDICATOR_PROPERTIES_WITH_FILES,
+)
+
 
 class Indicator:
     """Main Indicator class for OpenCTI
@@ -14,262 +19,8 @@ class Indicator:
 
     def __init__(self, opencti):
         self.opencti = opencti
-        self.properties = """
-            id
-            standard_id
-            entity_type
-            parent_types
-            spec_version
-            created_at
-            updated_at
-            creators {
-                id
-                name
-            }
-            createdBy {
-                ... on Identity {
-                    id
-                    standard_id
-                    entity_type
-                    parent_types
-                    spec_version
-                    identity_class
-                    name
-                    description
-                    roles
-                    contact_information
-                    x_opencti_aliases
-                    created
-                    modified
-                    objectLabel {
-                        id
-                        value
-                        color
-                    }
-                }
-                ... on Organization {
-                    x_opencti_organization_type
-                    x_opencti_reliability
-                }
-                ... on Individual {
-                    x_opencti_firstname
-                    x_opencti_lastname
-                }
-            }
-            objectOrganization {
-                id
-                standard_id
-                name
-            }
-            objectMarking {
-                id
-                standard_id
-                entity_type
-                definition_type
-                definition
-                created
-                modified
-                x_opencti_order
-                x_opencti_color
-            }
-            objectLabel {
-                id
-                value
-                color
-            }
-            externalReferences {
-                edges {
-                    node {
-                        id
-                        standard_id
-                        entity_type
-                        source_name
-                        description
-                        url
-                        hash
-                        external_id
-                        created
-                        modified
-                    }
-                }
-            }
-            revoked
-            confidence
-            created
-            modified
-            pattern_type
-            pattern_version
-            pattern
-            name
-            description
-            indicator_types
-            valid_from
-            valid_until
-            x_opencti_score
-            x_opencti_detection
-            x_opencti_main_observable_type
-            x_mitre_platforms
-            observables {
-                edges {
-                    node {
-                        id
-                        entity_type
-                        observable_value
-                    }
-                }
-            }
-            killChainPhases {
-              id
-              standard_id
-              entity_type
-              kill_chain_name
-              phase_name
-              x_opencti_order
-              created
-              modified
-            }
-        """
-        self.properties_with_files = """
-            id
-            standard_id
-            entity_type
-            parent_types
-            spec_version
-            created_at
-            updated_at
-            creators {
-                id
-                name
-            }
-            createdBy {
-                ... on Identity {
-                    id
-                    standard_id
-                    entity_type
-                    parent_types
-                    spec_version
-                    identity_class
-                    name
-                    description
-                    roles
-                    contact_information
-                    x_opencti_aliases
-                    created
-                    modified
-                    objectLabel {
-                        id
-                        value
-                        color
-                    }
-                }
-                ... on Organization {
-                    x_opencti_organization_type
-                    x_opencti_reliability
-                }
-                ... on Individual {
-                    x_opencti_firstname
-                    x_opencti_lastname
-                }
-            }
-            objectOrganization {
-                id
-                standard_id
-                name
-            }
-            objectMarking {
-                id
-                standard_id
-                entity_type
-                definition_type
-                definition
-                created
-                modified
-                x_opencti_order
-                x_opencti_color
-            }
-            objectLabel {
-                id
-                value
-                color
-            }
-            externalReferences {
-                edges {
-                    node {
-                        id
-                        standard_id
-                        entity_type
-                        source_name
-                        description
-                        url
-                        hash
-                        external_id
-                        created
-                        modified
-                        importFiles {
-                            edges {
-                                node {
-                                    id
-                                    name
-                                    size
-                                    metaData {
-                                        mimetype
-                                        version
-                                    }
-                                }
-                            }
-                        }
-                    }
-                }
-            }
-            revoked
-            confidence
-            created
-            modified
-            pattern_type
-            pattern_version
-            pattern
-            name
-            description
-            indicator_types
-            valid_from
-            valid_until
-            x_opencti_score
-            x_opencti_detection
-            x_opencti_main_observable_type
-            x_mitre_platforms
-            observables {
-                edges {
-                    node {
-                        id
-                        entity_type
-                        observable_value
-                    }
-                }
-            }
-            killChainPhases {
-              id
-              standard_id
-              entity_type
-              kill_chain_name
-              phase_name
-              x_opencti_order
-              created
-              modified
-            }
-            importFiles {
-                edges {
-                    node {
-                        id
-                        name
-                        size
-                        metaData {
-                            mimetype
-                            version
-                        }
-                    }
-                }
-            }
-        """
+        self.properties = INDICATOR_PROPERTIES
+        self.properties_with_files = INDICATOR_PROPERTIES_WITH_FILES
 
     @staticmethod
     def generate_id(pattern):

pycti/entities/opencti_infrastructure.py

@@ -416,6 +416,7 @@ class Infrastructure:
         kill_chain_phases = kwargs.get("killChainPhases", None)
         x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None)
         granted_refs = kwargs.get("objectOrganization", None)
+        x_opencti_workflow_id = kwargs.get("x_opencti_workflow_id", None)
         update = kwargs.get("update", False)
 
         if name is not None:
@@ -453,6 +454,7 @@ class Infrastructure:
                         "last_seen": last_seen,
                         "killChainPhases": kill_chain_phases,
                         "x_opencti_stix_ids": x_opencti_stix_ids,
+                        "x_opencti_workflow_id": x_opencti_workflow_id,
                         "update": update,
                     }
                 },
@@ -487,6 +489,10 @@ class Infrastructure:
                 stix_object["x_opencti_granted_refs"] = (
                     self.opencti.get_attribute_in_extension("granted_refs", stix_object)
                 )
+            if "x_opencti_workflow_id" not in stix_object:
+                stix_object["x_opencti_workflow_id"] = (
+                    self.opencti.get_attribute_in_extension("workflow_id", stix_object)
+                )
 
             return self.create(
                 stix_id=stix_object["id"],
@@ -546,6 +552,11 @@ class Infrastructure:
                     if "x_opencti_granted_refs" in stix_object
                     else None
                 ),
+                x_opencti_workflow_id=(
+                    stix_object["x_opencti_workflow_id"]
+                    if "x_opencti_workflow_id" in stix_object
+                    else None
+                ),
                 update=update,
             )
         else:

pycti/entities/opencti_location.py

@@ -350,6 +350,7 @@ class Location:
         precision = kwargs.get("precision", None)
         x_opencti_aliases = kwargs.get("x_opencti_aliases", None)
         x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None)
+        x_opencti_workflow_id = kwargs.get("x_opencti_workflow_id", None)
         update = kwargs.get("update", False)
 
         if name is not None:
@@ -386,6 +387,7 @@ class Location:
                         "precision": precision,
                         "x_opencti_aliases": x_opencti_aliases,
                         "x_opencti_stix_ids": x_opencti_stix_ids,
+                        "x_opencti_workflow_id": x_opencti_workflow_id,
                         "update": update,
                     }
                 },
@@ -439,6 +441,10 @@ class Location:
                 stix_object["x_opencti_stix_ids"] = (
                     self.opencti.get_attribute_in_extension("stix_ids", stix_object)
                 )
+            if "x_opencti_workflow_id" not in stix_object:
+                stix_object["x_opencti_workflow_id"] = (
+                    self.opencti.get_attribute_in_extension("workflow_id", stix_object)
+                )
 
             return self.create(
                 type=type,
@@ -485,6 +491,11 @@ class Location:
                     else None
                 ),
                 x_opencti_aliases=self.opencti.stix2.pick_aliases(stix_object),
+                x_opencti_workflow_id=(
+                    stix_object["x_opencti_workflow_id"]
+                    if "x_opencti_workflow_id" in stix_object
+                    else None
+                ),
                 update=update,
             )
         else:

pycti/entities/opencti_malware.py

@@ -494,9 +494,7 @@ class Malware:
                 )
             if "x_opencti_workflow_id" not in stix_object:
                 stix_object["x_opencti_workflow_id"] = (
-                    self.opencti.get_attribute_in_extension(
-                        "x_opencti_workflow_id", stix_object
-                    )
+                    self.opencti.get_attribute_in_extension("workflow_id", stix_object)
                 )
 
             return self.create(

pycti/entities/opencti_narrative.py

@@ -360,6 +360,7 @@ class Narrative:
         narrative_types = kwargs.get("narrative_types", None)
         x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None)
         granted_refs = kwargs.get("objectOrganization", None)
+        x_opencti_workflow_id = kwargs.get("x_opencti_workflow_id", None)
         update = kwargs.get("update", False)
 
         if name is not None:
@@ -394,6 +395,7 @@ class Narrative:
                         "aliases": aliases,
                         "narrative_types": narrative_types,
                         "x_opencti_stix_ids": x_opencti_stix_ids,
+                        "x_opencti_workflow_id": x_opencti_workflow_id,
                         "update": update,
                     }
                 },
@@ -425,6 +427,10 @@ class Narrative:
                 stix_object["x_opencti_granted_refs"] = (
                     self.opencti.get_attribute_in_extension("granted_refs", stix_object)
                 )
+            if "x_opencti_workflow_id" not in stix_object:
+                stix_object["x_opencti_workflow_id"] = (
+                    self.opencti.get_attribute_in_extension("workflow_id", stix_object)
+                )
 
             return self.opencti.narrative.create(
                 stix_id=stix_object["id"],
@@ -473,6 +479,11 @@ class Narrative:
                     if "x_opencti_granted_refs" in stix_object
                     else None
                 ),
+                x_opencti_workflow_id=(
+                    stix_object["x_opencti_workflow_id"]
+                    if "x_opencti_workflow_id" in stix_object
+                    else None
+                ),
                 update=update,
             )
         else:

pycti/entities/opencti_note.py

@@ -636,6 +636,7 @@ class Note:
         likelihood = kwargs.get("likelihood", None)
         x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None)
         granted_refs = kwargs.get("objectOrganization", None)
+        x_opencti_workflow_id = kwargs.get("x_opencti_workflow_id", None)
         update = kwargs.get("update", False)
 
         if content is not None:
@@ -672,6 +673,7 @@ class Note:
                         "note_types": note_types,
                         "likelihood": likelihood,
                         "x_opencti_stix_ids": x_opencti_stix_ids,
+                        "x_opencti_workflow_id": x_opencti_workflow_id,
                         "update": update,
                     }
                 },
@@ -798,6 +800,10 @@ class Note:
                 stix_object["x_opencti_granted_refs"] = (
                     self.opencti.get_attribute_in_extension("granted_refs", stix_object)
                 )
+            if "x_opencti_workflow_id" not in stix_object:
+                stix_object["x_opencti_workflow_id"] = (
+                    self.opencti.get_attribute_in_extension("workflow_id", stix_object)
+                )
 
             return self.create(
                 stix_id=stix_object["id"],
@@ -852,6 +858,11 @@ class Note:
                     if "x_opencti_granted_refs" in stix_object
                     else None
                 ),
+                x_opencti_workflow_id=(
+                    stix_object["x_opencti_workflow_id"]
+                    if "x_opencti_workflow_id" in stix_object
+                    else None
+                ),
                 update=update,
             )
         else:

pycti/entities/opencti_observed_data.py

@@ -607,6 +607,7 @@ class ObservedData:
         number_observed = kwargs.get("number_observed", None)
         x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None)
         granted_refs = kwargs.get("objectOrganization", None)
+        x_opencti_workflow_id = kwargs.get("x_opencti_workflow_id", None)
         update = kwargs.get("update", False)
 
         if (
@@ -645,6 +646,7 @@ class ObservedData:
                         "last_observed": last_observed,
                         "number_observed": number_observed,
                         "x_opencti_stix_ids": x_opencti_stix_ids,
+                        "x_opencti_workflow_id": x_opencti_workflow_id,
                         "update": update,
                     }
                 },
@@ -810,6 +812,10 @@ class ObservedData:
                 stix_object["x_opencti_granted_refs"] = (
                     self.opencti.get_attribute_in_extension("granted_refs", stix_object)
                 )
+            if "x_opencti_workflow_id" not in stix_object:
+                stix_object["x_opencti_workflow_id"] = (
+                    self.opencti.get_attribute_in_extension("workflow_id", stix_object)
+                )
 
             observed_data_result = self.create(
                 stix_id=stix_object["id"],
@@ -862,6 +868,11 @@ class ObservedData:
                     if "x_opencti_granted_refs" in stix_object
                     else None
                 ),
+                x_opencti_workflow_id=(
+                    stix_object["x_opencti_workflow_id"]
+                    if "x_opencti_workflow_id" in stix_object
+                    else None
+                ),
                 update=update,
             )
 

pycti/entities/opencti_report.py

@@ -504,7 +504,8 @@ class Report:
             first = 100
 
         self.opencti.app_logger.info(
-            "Listing Reports with filters", {"filters": json.dumps(filters)}
+            "Listing Reports with filters",
+            {"filters": json.dumps(filters), "with_files:": with_files},
         )
         query = (
             """
@@ -583,7 +584,9 @@ class Report:
         custom_attributes = kwargs.get("customAttributes", None)
         with_files = kwargs.get("withFiles", False)
         if id is not None:
-            self.opencti.app_logger.info("Reading Report", {"id": id})
+            self.opencti.app_logger.info(
+                "Reading Report", {"id": id, "with_files": with_files}
+            )
             query = (
                 """
                 query Report($id: String!) {
@@ -602,7 +605,7 @@ class Report:
             result = self.opencti.query(query, {"id": id})
             return self.opencti.process_multiple_fields(result["data"]["report"])
         elif filters is not None:
-            result = self.list(filters=filters)
+            result = self.list(filters=filters, withFiles=with_files)
             if len(result) > 0:
                 return result[0]
             else:

pycti/entities/opencti_stix_core_object.py

@@ -1507,6 +1507,40 @@ class StixCoreObject:
             },
         )
 
+    def push_analysis(
+        self,
+        entity_id,
+        file_name,
+        data,
+        content_source,
+        content_type,
+        analysis_type,
+    ):
+        query = """
+            mutation StixCoreObjectEdit(
+                $id: ID!, $file: Upload!, $contentSource: String!, $contentType: AnalysisContentType!, $analysisType: String!
+            ) {
+                stixCoreObjectEdit(id: $id) {
+                    analysisPush(file: $file,contentSource: $contentSource,contentType: $contentType,analysisType: $analysisType){
+                        id
+                        name
+                    }
+                }
+            }
+        """
+
+        file = self.file(file_name, data)
+        self.opencti.query(
+            query,
+            {
+                "id": entity_id,
+                "file": file,
+                "contentSource": content_source,
+                "contentType": content_type,
+                "analysisType": analysis_type,
+            },
+        )
+
     """
         Get the reports about a Stix-Core-Object object
 

pycti/entities/opencti_stix_core_relationship.py

@@ -396,6 +396,7 @@ class StixCoreRelationship:
         custom_attributes = kwargs.get("customAttributes", None)
         get_all = kwargs.get("getAll", False)
         with_pagination = kwargs.get("withPagination", False)
+        search = kwargs.get("search", None)
         if get_all:
             first = 100
 
@@ -409,12 +410,13 @@ class StixCoreRelationship:
                 "element_with_target_types": element_with_target_types,
                 "from_types": from_types,
                 "to_types": to_types,
+                "search": search,
             },
         )
         query = (
             """
-                query StixCoreRelationships($fromOrToId: [String], $elementWithTargetTypes: [String], $fromId: [String], $fromTypes: [String], $toId: [String], $toTypes: [String], $relationship_type: [String], $startTimeStart: DateTime, $startTimeStop: DateTime, $stopTimeStart: DateTime, $stopTimeStop: DateTime, $filters: FilterGroup, $first: Int, $after: ID, $orderBy: StixCoreRelationshipsOrdering, $orderMode: OrderingMode) {
-                    stixCoreRelationships(fromOrToId: $fromOrToId, elementWithTargetTypes: $elementWithTargetTypes, fromId: $fromId, fromTypes: $fromTypes, toId: $toId, toTypes: $toTypes, relationship_type: $relationship_type, startTimeStart: $startTimeStart, startTimeStop: $startTimeStop, stopTimeStart: $stopTimeStart, stopTimeStop: $stopTimeStop, filters: $filters, first: $first, after: $after, orderBy: $orderBy, orderMode: $orderMode) {
+                query StixCoreRelationships($fromOrToId: [String], $elementWithTargetTypes: [String], $fromId: [String], $fromTypes: [String], $toId: [String], $toTypes: [String], $relationship_type: [String], $startTimeStart: DateTime, $startTimeStop: DateTime, $stopTimeStart: DateTime, $stopTimeStop: DateTime, $filters: FilterGroup, $first: Int, $after: ID, $orderBy: StixCoreRelationshipsOrdering, $orderMode: OrderingMode, $search: String) {
+                    stixCoreRelationships(fromOrToId: $fromOrToId, elementWithTargetTypes: $elementWithTargetTypes, fromId: $fromId, fromTypes: $fromTypes, toId: $toId, toTypes: $toTypes, relationship_type: $relationship_type, startTimeStart: $startTimeStart, startTimeStop: $startTimeStop, stopTimeStart: $stopTimeStart, stopTimeStop: $stopTimeStop, filters: $filters, first: $first, after: $after, orderBy: $orderBy, orderMode: $orderMode, search: $search) {
                         edges {
                             node {
                                 """
@@ -452,6 +454,7 @@ class StixCoreRelationship:
                 "after": after,
                 "orderBy": order_by,
                 "orderMode": order_mode,
+                "search": search,
             },
         )
         if get_all:
@@ -1135,6 +1138,12 @@ class StixCoreRelationship:
                         "granted_refs", stix_relation
                     )
                 )
+            if "x_opencti_workflow_id" not in stix_relation:
+                stix_relation["x_opencti_workflow_id"] = (
+                    self.opencti.get_attribute_in_extension(
+                        "workflow_id", stix_relation
+                    )
+                )
 
             source_ref = stix_relation["source_ref"]
             target_ref = stix_relation["target_ref"]