pycti 6.1.12__py3-none-any.whl → 6.2.0__py3-none-any.whl

pycti/entities/stix_cyber_observable/opencti_stix_cyber_observable_properties.py

@@ -0,0 +1,604 @@
+SCO_PROPERTIES = """
+    id
+    standard_id
+    entity_type
+    parent_types
+    spec_version
+    created_at
+    updated_at
+    objectOrganization {
+        id
+        standard_id
+        name
+    }
+    creators {
+        id
+        name
+    }
+    createdBy {
+        ... on Identity {
+            id
+            standard_id
+            entity_type
+            parent_types
+            spec_version
+            identity_class
+            name
+            description
+            roles
+            contact_information
+            x_opencti_aliases
+            created
+            modified
+            objectLabel {
+                id
+                value
+                color
+            }
+        }
+        ... on Organization {
+            x_opencti_organization_type
+            x_opencti_reliability
+        }
+        ... on Individual {
+            x_opencti_firstname
+            x_opencti_lastname
+        }
+    }
+    objectMarking {
+        id
+        standard_id
+        entity_type
+        definition_type
+        definition
+        created
+        modified
+        x_opencti_order
+        x_opencti_color
+    }
+    objectLabel {
+        id
+        value
+        color
+    }
+    externalReferences {
+        edges {
+            node {
+                id
+                standard_id
+                entity_type
+                source_name
+                description
+                url
+                hash
+                external_id
+                created
+                modified
+            }
+        }
+    }
+    observable_value
+    x_opencti_description
+    x_opencti_score
+    indicators {
+        edges {
+            node {
+                id
+                pattern
+                pattern_type
+            }
+        }
+    }
+    ... on AutonomousSystem {
+        number
+        name
+        rir
+    }
+    ... on Directory {
+        path
+        path_enc
+        ctime
+        mtime
+        atime
+    }
+    ... on DomainName {
+        value
+    }
+    ... on EmailAddr {
+        value
+        display_name
+    }
+    ... on EmailMessage {
+        is_multipart
+        attribute_date
+        content_type
+        message_id
+        subject
+        received_lines
+        body
+    }
+    ... on Artifact {
+        mime_type
+        payload_bin
+        url
+        encryption_algorithm
+        decryption_key
+        hashes {
+            algorithm
+            hash
+        }
+        importFiles {
+            edges {
+                node {
+                    id
+                    name
+                    size
+                    metaData {
+                        mimetype
+                        version
+                    }
+                }
+            }
+        }
+    }
+    ... on StixFile {
+        extensions
+        size
+        name
+        name_enc
+        magic_number_hex
+        mime_type
+        ctime
+        mtime
+        atime
+        x_opencti_additional_names
+        hashes {
+          algorithm
+          hash
+        }
+    }
+    ... on X509Certificate {
+        is_self_signed
+        version
+        serial_number
+        signature_algorithm
+        issuer
+        subject
+        subject_public_key_algorithm
+        subject_public_key_modulus
+        subject_public_key_exponent
+        validity_not_before
+        validity_not_after
+        hashes {
+          algorithm
+          hash
+        }
+    }
+    ... on IPv4Addr {
+        value
+    }
+    ... on IPv6Addr {
+        value
+    }
+    ... on MacAddr {
+        value
+    }
+    ... on Mutex {
+        name
+    }
+    ... on NetworkTraffic {
+        extensions
+        start
+        end
+        is_active
+        src_port
+        dst_port
+        protocols
+        src_byte_count
+        dst_byte_count
+        src_packets
+        dst_packets
+    }
+    ... on Process {
+        extensions
+        is_hidden
+        pid
+        created_time
+        cwd
+        command_line
+        environment_variables
+    }
+    ... on Software {
+        name
+        cpe
+        swid
+        languages
+        vendor
+        version
+    }
+    ... on Url {
+        value
+    }
+    ... on UserAccount {
+        extensions
+        user_id
+        credential
+        account_login
+        account_type
+        display_name
+        is_service_account
+        is_privileged
+        can_escalate_privs
+        is_disabled
+        account_created
+        account_expires
+        credential_last_changed
+        account_first_login
+        account_last_login
+    }
+    ... on WindowsRegistryKey {
+        attribute_key
+        modified_time
+        number_of_subkeys
+    }
+    ... on WindowsRegistryValueType {
+        name
+        data
+        data_type
+    }
+    ... on CryptographicKey {
+        value
+    }
+    ... on CryptocurrencyWallet {
+        value
+    }
+    ... on Hostname {
+        value
+    }
+    ... on Text {
+        value
+    }
+    ... on UserAgent {
+        value
+    }
+    ... on BankAccount {
+        iban
+        bic
+        account_number
+    }
+    ... on PhoneNumber {
+        value
+    }
+    ... on TrackingNumber {
+        value
+    }
+    ... on Credential {
+        value
+    }
+    ... on PaymentCard {
+        card_number
+        expiration_date
+        cvv
+        holder_name
+    }
+    ... on MediaContent {
+        title
+        content
+        media_category
+        url
+        publication_date
+    }
+"""
+SCO_PROPERTIES_WITH_FILES = """
+    id
+    standard_id
+    entity_type
+    parent_types
+    spec_version
+    created_at
+    updated_at
+    objectOrganization {
+        id
+        standard_id
+        name
+    }
+    creators {
+        id
+        name
+    }
+    createdBy {
+        ... on Identity {
+            id
+            standard_id
+            entity_type
+            parent_types
+            spec_version
+            identity_class
+            name
+            description
+            roles
+            contact_information
+            x_opencti_aliases
+            created
+            modified
+            objectLabel {
+                id
+                value
+                color
+            }
+        }
+        ... on Organization {
+            x_opencti_organization_type
+            x_opencti_reliability
+        }
+        ... on Individual {
+            x_opencti_firstname
+            x_opencti_lastname
+        }
+    }
+    objectMarking {
+        id
+        standard_id
+        entity_type
+        definition_type
+        definition
+        created
+        modified
+        x_opencti_order
+        x_opencti_color
+    }
+    objectLabel {
+        id
+        value
+        color
+    }
+    externalReferences {
+        edges {
+            node {
+                id
+                standard_id
+                entity_type
+                source_name
+                description
+                url
+                hash
+                external_id
+                created
+                modified
+                importFiles {
+                    edges {
+                        node {
+                            id
+                            name
+                            size
+                            metaData {
+                                mimetype
+                                version
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+    observable_value
+    x_opencti_description
+    x_opencti_score
+    indicators {
+        edges {
+            node {
+                id
+                pattern
+                pattern_type
+            }
+        }
+    }
+    ... on AutonomousSystem {
+        number
+        name
+        rir
+    }
+    ... on Directory {
+        path
+        path_enc
+        ctime
+        mtime
+        atime
+    }
+    ... on DomainName {
+        value
+    }
+    ... on EmailAddr {
+        value
+        display_name
+    }
+    ... on EmailMessage {
+        is_multipart
+        attribute_date
+        content_type
+        message_id
+        subject
+        received_lines
+        body
+    }
+    ... on Artifact {
+        mime_type
+        payload_bin
+        url
+        encryption_algorithm
+        decryption_key
+        hashes {
+            algorithm
+            hash
+        }
+        importFiles {
+            edges {
+                node {
+                    id
+                    name
+                    size
+                }
+            }
+        }
+    }
+    ... on StixFile {
+        extensions
+        size
+        name
+        name_enc
+        magic_number_hex
+        mime_type
+        ctime
+        mtime
+        atime
+        x_opencti_additional_names
+        hashes {
+          algorithm
+          hash
+        }
+    }
+    ... on X509Certificate {
+        is_self_signed
+        version
+        serial_number
+        signature_algorithm
+        issuer
+        subject
+        subject_public_key_algorithm
+        subject_public_key_modulus
+        subject_public_key_exponent
+        validity_not_before
+        validity_not_after
+        hashes {
+          algorithm
+          hash
+        }
+    }
+    ... on IPv4Addr {
+        value
+    }
+    ... on IPv6Addr {
+        value
+    }
+    ... on MacAddr {
+        value
+    }
+    ... on Mutex {
+        name
+    }
+    ... on NetworkTraffic {
+        extensions
+        start
+        end
+        is_active
+        src_port
+        dst_port
+        protocols
+        src_byte_count
+        dst_byte_count
+        src_packets
+        dst_packets
+    }
+    ... on Process {
+        extensions
+        is_hidden
+        pid
+        created_time
+        cwd
+        command_line
+        environment_variables
+    }
+    ... on Software {
+        name
+        cpe
+        swid
+        languages
+        vendor
+        version
+    }
+    ... on Url {
+        value
+    }
+    ... on UserAccount {
+        extensions
+        user_id
+        credential
+        account_login
+        account_type
+        display_name
+        is_service_account
+        is_privileged
+        can_escalate_privs
+        is_disabled
+        account_created
+        account_expires
+        credential_last_changed
+        account_first_login
+        account_last_login
+    }
+    ... on WindowsRegistryKey {
+        attribute_key
+        modified_time
+        number_of_subkeys
+    }
+    ... on WindowsRegistryValueType {
+        name
+        data
+        data_type
+    }
+    ... on CryptographicKey {
+        value
+    }
+    ... on CryptocurrencyWallet {
+        value
+    }
+    ... on Hostname {
+        value
+    }
+    ... on Text {
+        value
+    }
+    ... on UserAgent {
+        value
+    }
+    ... on BankAccount {
+        iban
+        bic
+        account_number
+    }
+    ... on PhoneNumber {
+        value
+    }
+    ... on TrackingNumber {
+        value
+    }
+    ... on Credential {
+        value
+    }
+    ... on PaymentCard {
+        card_number
+        expiration_date
+        cvv
+        holder_name
+    }
+    ... on MediaContent {
+        title
+        content
+        media_category
+        url
+        publication_date
+    }
+    importFiles {
+        edges {
+            node {
+                id
+                name
+                size
+                metaData {
+                    mimetype
+                    version
+                }
+            }
+        }
+    }
+"""

pycti/utils/opencti_stix2.py

@@ -1355,6 +1355,10 @@ class OpenCTIStix2:
             stix_sighting["x_opencti_negative"] = (
                 self.opencti.get_attribute_in_extension("negative", stix_sighting)
             )
+        if "x_opencti_workflow_id" not in stix_sighting:
+            stix_sighting["x_opencti_workflow_id"] = (
+                self.opencti.get_attribute_in_extension("workflow_id", stix_sighting)
+            )
         stix_sighting_result = self.opencti.stix_sighting_relationship.create(
             fromId=final_from_id,
             toId=final_to_id,
@@ -1396,6 +1400,11 @@ class OpenCTIStix2:
             objectOrganization=(
                 extras["granted_refs_ids"] if "granted_refs_ids" in extras else []
             ),
+            x_opencti_workflow_id=(
+                stix_sighting["x_opencti_workflow_id"]
+                if "x_opencti_workflow_id" in stix_sighting
+                else None
+            ),
             update=update,
             ignore_dates=(
                 stix_sighting["x_opencti_ignore_dates"]
@@ -1507,7 +1516,16 @@ class OpenCTIStix2:
             and "valid_until" in entity
             and entity["valid_from"] == entity["valid_until"]
         ):
-            del entity["valid_from"]
+            valid_until_converted_datetime = datetime.datetime.strptime(
+                entity["valid_until"], "%Y-%m-%dT%H:%M:%S.%fZ"
+            )
+            new_valid_until = valid_until_converted_datetime + datetime.timedelta(
+                seconds=1
+            )
+            valid_until_converted_string = new_valid_until.strftime(
+                "%Y-%m-%dT%H:%M:%S.%fZ"
+            )
+            entity["valid_until"] = valid_until_converted_string
 
         # Flatten
         if "tasks" in entity:
@@ -2188,7 +2206,7 @@ class OpenCTIStix2:
             "objects": [],
         }
         do_read = self.get_reader(entity_type)
-        entity = do_read(id=entity_id)
+        entity = do_read(id=entity_id, withFiles=(mode == "full"))
         if entity is None:
             self.opencti.app_logger.error(
                 "Cannot export entity (not found)", {"id": entity_id}
@@ -2237,6 +2255,7 @@ class OpenCTIStix2:
         orderBy: str = None,
         orderMode: str = None,
         getAll: bool = True,
+        withFiles: bool = False,
     ) -> [Dict]:
         if IdentityTypes.has_value(entity_type):
             entity_type = "Identity"
@@ -2300,6 +2319,7 @@ class OpenCTIStix2:
             orderBy=orderBy,
             orderMode=orderMode,
             getAll=getAll,
+            withFiles=withFiles,
         )
 
     def export_list(
@@ -2334,6 +2354,7 @@ class OpenCTIStix2:
             orderBy=order_by,
             orderMode=order_mode,
             getAll=True,
+            withFiles=(mode == "full"),
         )
         if entities_list is not None:
             uuids = []

{pycti-6.1.12.dist-info → pycti-6.2.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pycti
-Version: 6.1.12
+Version: 6.2.0
 Summary: Python API client for OpenCTI.
 Home-page: https://github.com/OpenCTI-Platform/client-python
 Author: Filigran
@@ -26,11 +26,12 @@ Requires-Dist: pika ~=1.3.0
 Requires-Dist: python-json-logger ~=2.0.4
 Requires-Dist: PyYAML ~=6.0
 Requires-Dist: requests ~=2.32.2
-Requires-Dist: setuptools ~=70.0.0
+Requires-Dist: setuptools ~=70.1.0
 Requires-Dist: cachetools ~=5.3.0
 Requires-Dist: prometheus-client ~=0.20.0
 Requires-Dist: opentelemetry-api ~=1.22.0
 Requires-Dist: opentelemetry-sdk ~=1.22.0
+Requires-Dist: deprecation ~=2.1.0
 Requires-Dist: filigran-sseclient ~=1.0.0
 Requires-Dist: stix2 ~=3.0.1
 Requires-Dist: python-magic ~=0.4.27 ; sys_platform == "linux" or sys_platform == "darwin"
@@ -49,7 +50,7 @@ Requires-Dist: types-python-dateutil ~=2.9.0 ; extra == 'dev'
 Requires-Dist: wheel ~=0.43.0 ; extra == 'dev'
 Provides-Extra: doc
 Requires-Dist: autoapi ~=2.0.1 ; extra == 'doc'
-Requires-Dist: sphinx-autodoc-typehints ~=2.1.0 ; extra == 'doc'
+Requires-Dist: sphinx-autodoc-typehints ~=2.2.2 ; extra == 'doc'
 Requires-Dist: sphinx-rtd-theme ~=2.0.0 ; extra == 'doc'
 
 # OpenCTI client for Python