pycti 6.1.12__py3-none-any.whl → 6.2.0__py3-none-any.whl

pycti/entities/opencti_stix_sighting_relationship.py

@@ -316,6 +316,7 @@ class StixSightingRelationship:
         custom_attributes = kwargs.get("customAttributes", None)
         get_all = kwargs.get("getAll", False)
         with_pagination = kwargs.get("withPagination", False)
+        search = kwargs.get("search", None)
         if get_all:
             first = 100
 
@@ -325,8 +326,8 @@ class StixSightingRelationship:
         )
         query = (
             """
-                query StixSightingRelationships($fromOrToId: String, $fromId: StixRef, $fromTypes: [String], $toId: StixRef, $toTypes: [String], $firstSeenStart: DateTime, $firstSeenStop: DateTime, $lastSeenStart: DateTime, $lastSeenStop: DateTime, $filters: FilterGroup, $first: Int, $after: ID, $orderBy: StixSightingRelationshipsOrdering, $orderMode: OrderingMode) {
-                    stixSightingRelationships(fromOrToId: $fromOrToId, fromId: $fromId, fromTypes: $fromTypes, toId: $toId, toTypes: $toTypes, firstSeenStart: $firstSeenStart, firstSeenStop: $firstSeenStop, lastSeenStart: $lastSeenStart, lastSeenStop: $lastSeenStop, filters: $filters, first: $first, after: $after, orderBy: $orderBy, orderMode: $orderMode) {
+                query StixSightingRelationships($fromOrToId: String, $fromId: StixRef, $fromTypes: [String], $toId: StixRef, $toTypes: [String], $firstSeenStart: DateTime, $firstSeenStop: DateTime, $lastSeenStart: DateTime, $lastSeenStop: DateTime, $filters: FilterGroup, $first: Int, $after: ID, $orderBy: StixSightingRelationshipsOrdering, $orderMode: OrderingMode, $search: String) {
+                    stixSightingRelationships(fromOrToId: $fromOrToId, fromId: $fromId, fromTypes: $fromTypes, toId: $toId, toTypes: $toTypes, firstSeenStart: $firstSeenStart, firstSeenStop: $firstSeenStop, lastSeenStart: $lastSeenStart, lastSeenStop: $lastSeenStop, filters: $filters, first: $first, after: $after, orderBy: $orderBy, orderMode: $orderMode, search: $search) {
                         edges {
                             node {
                                 """
@@ -362,6 +363,7 @@ class StixSightingRelationship:
                 "after": after,
                 "orderBy": order_by,
                 "orderMode": order_mode,
+                "search": search,
             },
         )
         if get_all:
@@ -501,6 +503,7 @@ class StixSightingRelationship:
         object_label = kwargs.get("objectLabel", None)
         external_references = kwargs.get("externalReferences", None)
         x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None)
+        x_opencti_workflow_id = kwargs.get("x_opencti_workflow_id", None)
         update = kwargs.get("update", False)
 
         self.opencti.app_logger.info(
@@ -536,6 +539,7 @@ class StixSightingRelationship:
                     "objectLabel": object_label,
                     "externalReferences": external_references,
                     "x_opencti_stix_ids": x_opencti_stix_ids,
+                    "x_opencti_workflow_id": x_opencti_workflow_id,
                     "update": update,
                 }
             },

pycti/entities/opencti_task.py

@@ -619,9 +619,7 @@ class Task:
                 )
             if "x_opencti_workflow_id" not in stix_object:
                 stix_object["x_opencti_workflow_id"] = (
-                    self.opencti.get_attribute_in_extension(
-                        "x_opencti_workflow_id", stix_object
-                    )
+                    self.opencti.get_attribute_in_extension("workflow_id", stix_object)
                 )
             if "x_opencti_assignee_ids" not in stix_object:
                 stix_object["x_opencti_assignee_ids"] = (

pycti/entities/opencti_threat_actor_group.py

@@ -324,6 +324,7 @@ class ThreatActorGroup:
         personal_motivations = kwargs.get("personal_motivations", None)
         x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None)
         granted_refs = kwargs.get("objectOrganization", None)
+        x_opencti_workflow_id = kwargs.get("x_opencti_workflow_id", None)
         update = kwargs.get("update", False)
 
         if name is not None:
@@ -366,6 +367,7 @@ class ThreatActorGroup:
                         "secondary_motivations": secondary_motivations,
                         "personal_motivations": personal_motivations,
                         "x_opencti_stix_ids": x_opencti_stix_ids,
+                        "x_opencti_workflow_id": x_opencti_workflow_id,
                         "update": update,
                     }
                 },
@@ -399,6 +401,10 @@ class ThreatActorGroup:
                 stix_object["x_opencti_granted_refs"] = (
                     self.opencti.get_attribute_in_extension("granted_refs", stix_object)
                 )
+            if "x_opencti_workflow_id" not in stix_object:
+                stix_object["x_opencti_workflow_id"] = (
+                    self.opencti.get_attribute_in_extension("workflow_id", stix_object)
+                )
 
             return self.create(
                 stix_id=stix_object["id"],
@@ -479,6 +485,11 @@ class ThreatActorGroup:
                     if "x_opencti_granted_refs" in stix_object
                     else None
                 ),
+                x_opencti_workflow_id=(
+                    stix_object["x_opencti_workflow_id"]
+                    if "x_opencti_workflow_id" in stix_object
+                    else None
+                ),
                 update=update,
             )
         else:

pycti/entities/opencti_threat_actor_individual.py

@@ -325,6 +325,7 @@ class ThreatActorIndividual:
         personal_motivations = kwargs.get("personal_motivations", None)
         x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None)
         granted_refs = kwargs.get("objectOrganization", None)
+        x_opencti_workflow_id = kwargs.get("x_opencti_workflow_id", None)
         update = kwargs.get("update", False)
 
         if name is not None:
@@ -369,6 +370,7 @@ class ThreatActorIndividual:
                         "secondary_motivations": secondary_motivations,
                         "personal_motivations": personal_motivations,
                         "x_opencti_stix_ids": x_opencti_stix_ids,
+                        "x_opencti_workflow_id": x_opencti_workflow_id,
                         "update": update,
                     }
                 },
@@ -402,6 +404,10 @@ class ThreatActorIndividual:
                 stix_object["x_opencti_granted_refs"] = (
                     self.opencti.get_attribute_in_extension("granted_refs", stix_object)
                 )
+            if "x_opencti_workflow_id" not in stix_object:
+                stix_object["x_opencti_workflow_id"] = (
+                    self.opencti.get_attribute_in_extension("workflow_id", stix_object)
+                )
 
             return self.create(
                 stix_id=stix_object["id"],
@@ -482,6 +488,11 @@ class ThreatActorIndividual:
                     if "x_opencti_granted_refs" in stix_object
                     else None
                 ),
+                x_opencti_workflow_id=(
+                    stix_object["x_opencti_workflow_id"]
+                    if "x_opencti_workflow_id" in stix_object
+                    else None
+                ),
                 update=update,
             )
         else:

pycti/entities/opencti_tool.py

@@ -288,6 +288,7 @@ class Tool:
         kill_chain_phases = kwargs.get("killChainPhases", None)
         x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None)
         granted_refs = kwargs.get("objectOrganization", None)
+        x_opencti_workflow_id = kwargs.get("x_opencti_workflow_id", None)
         update = kwargs.get("update", False)
 
         if name is not None:
@@ -324,6 +325,7 @@ class Tool:
                         "tool_version": tool_version,
                         "killChainPhases": kill_chain_phases,
                         "x_opencti_stix_ids": x_opencti_stix_ids,
+                        "x_opencti_workflow_id": x_opencti_workflow_id,
                         "update": update,
                     }
                 },
@@ -355,6 +357,10 @@ class Tool:
                 stix_object["x_opencti_granted_refs"] = (
                     self.opencti.get_attribute_in_extension("granted_refs", stix_object)
                 )
+            if "x_opencti_workflow_id" not in stix_object:
+                stix_object["x_opencti_workflow_id"] = (
+                    self.opencti.get_attribute_in_extension("workflow_id", stix_object)
+                )
 
             return self.opencti.tool.create(
                 stix_id=stix_object["id"],
@@ -411,6 +417,11 @@ class Tool:
                     if "x_opencti_granted_refs" in stix_object
                     else None
                 ),
+                x_opencti_workflow_id=(
+                    stix_object["x_opencti_workflow_id"]
+                    if "x_opencti_workflow_id" in stix_object
+                    else None
+                ),
                 update=update,
             )
         else:

pycti/entities/opencti_vulnerability.py

@@ -294,6 +294,7 @@ class Vulnerability:
         )
         x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None)
         granted_refs = kwargs.get("objectOrganization", None)
+        x_opencti_workflow_id = kwargs.get("x_opencti_workflow_id", None)
         update = kwargs.get("update", False)
 
         if name is not None:
@@ -333,6 +334,7 @@ class Vulnerability:
                         "x_opencti_cvss_availability_impact": x_opencti_cvss_availability_impact,
                         "x_opencti_cvss_confidentiality_impact": x_opencti_cvss_confidentiality_impact,
                         "x_opencti_stix_ids": x_opencti_stix_ids,
+                        "x_opencti_workflow_id": x_opencti_workflow_id,
                         "update": update,
                     }
                 },
@@ -431,6 +433,10 @@ class Vulnerability:
                 stix_object["x_opencti_granted_refs"] = (
                     self.opencti.get_attribute_in_extension("granted_refs", stix_object)
                 )
+            if "x_opencti_workflow_id" not in stix_object:
+                stix_object["x_opencti_workflow_id"] = (
+                    self.opencti.get_attribute_in_extension("workflow_id", stix_object)
+                )
             return self.create(
                 stix_id=stix_object["id"],
                 createdBy=(
@@ -507,6 +513,11 @@ class Vulnerability:
                     if "x_opencti_granted_refs" in stix_object
                     else None
                 ),
+                x_opencti_workflow_id=(
+                    stix_object["x_opencti_workflow_id"]
+                    if "x_opencti_workflow_id" in stix_object
+                    else None
+                ),
                 update=update,
             )
         else:

pycti/entities/stix_cyber_observable/opencti_stix_cyber_observable_deprecated.py

@@ -0,0 +1,56 @@
+import deprecation
+
+
+class StixCyberObservableDeprecatedMixin:
+    """
+    deprecated [>=6.2 & <6.5]`
+    Promote a Stix-Observable to an Indicator
+
+    :param id: the Stix-Observable id
+    :return the observable
+    """
+
+    @deprecation.deprecated(
+        deprecated_in="6.2",
+        removed_in="6.5",
+        details="Use promote_to_indicator_v2 instead.",
+    )
+    def promote_to_indicator(self, **kwargs):
+        id = kwargs.get("id", None)
+        custom_attributes = kwargs.get("customAttributes", None)
+        with_files = kwargs.get("withFiles", False)
+        if id is not None:
+            self.opencti.app_logger.info(
+                "Promoting Stix-Observable",
+                {
+                    "id": id,
+                    "withFiles": with_files,
+                    "customAttributes": custom_attributes,
+                },
+            )
+            query = (
+                """
+                        mutation StixCyberObservableEdit($id: ID!) {
+                            stixCyberObservableEdit(id: $id) {
+                                promote {
+                                    """
+                + (
+                    custom_attributes
+                    if custom_attributes is not None
+                    else (self.properties_with_files if with_files else self.properties)
+                )
+                + """
+                            }
+                        }
+                    }
+             """
+            )
+            result = self.opencti.query(query, {"id": id})
+            return self.opencti.process_multiple_fields(
+                result["data"]["stixCyberObservableEdit"]["promote"]
+            )
+        else:
+            self.opencti.app_logger.error(
+                "[opencti_stix_cyber_observable_promote] Missing parameters: id"
+            )
+            return None