pycti 6.1.4__py3-none-any.whl → 6.1.5__py3-none-any.whl

pycti/__init__.py

@@ -1,5 +1,5 @@
 # -*- coding: utf-8 -*-
-__version__ = "6.1.4"
+__version__ = "6.1.5"
 
 from .api.opencti_api_client import OpenCTIApiClient
 from .api.opencti_api_connector import OpenCTIApiConnector

pycti/api/opencti_api_client.py

@@ -351,14 +351,16 @@ class OpenCTIApiClient:
                     if "name" in main_error
                     else main_error["message"]
                 )
-                if "data" in main_error and "reason" in main_error["data"]:
-                    raise ValueError(
-                        {"name": error_name, "message": main_error["data"]["reason"]}
-                    )
-                else:
-                    raise ValueError(
-                        {"name": error_name, "message": main_error["message"]}
-                    )
+                error_detail = {
+                    "name": error_name,
+                    "error_message": main_error["message"],
+                }
+                meta_data = main_error["data"] if "data" in main_error else {}
+                # Prevent logging of input as bundle is logged differently
+                if meta_data.get("input") is not None:
+                    del meta_data["input"]
+                value_error = {**error_detail, **meta_data}
+                raise ValueError(value_error)
             else:
                 return result
         else:

pycti/connector/opencti_connector_helper.py

@@ -1226,9 +1226,14 @@ class OpenCTIConnectorHelper:  # pylint: disable=too-many-public-methods
 
         if bypass_split:
             bundles = [bundle]
+            expectations_number = len(json.loads(bundle)["objects"])
         else:
             stix2_splitter = OpenCTIStix2Splitter()
-            bundles = stix2_splitter.split_bundle(bundle, True, event_version)
+            expectations_number, bundles = (
+                stix2_splitter.split_bundle_with_expectations(
+                    bundle, True, event_version
+                )
+            )
 
         if len(bundles) == 0:
             self.metric.inc("error_count")
@@ -1236,7 +1241,7 @@ class OpenCTIConnectorHelper:  # pylint: disable=too-many-public-methods
 
         if bundle_send_to_queue:
             if work_id:
-                self.api.work.add_expectations(work_id, len(bundles))
+                self.api.work.add_expectations(work_id, expectations_number)
             if entities_types is None:
                 entities_types = []
             pika_credentials = pika.PlainCredentials(

pycti/utils/opencti_stix2.py

@@ -4,6 +4,9 @@ import base64
 import datetime
 import json
 import os
+import random
+import time
+import traceback
 import uuid
 from typing import Any, Dict, List, Optional, Union
 
@@ -11,6 +14,8 @@ import datefinder
 import dateutil.parser
 import pytz
 from cachetools import LRUCache
+from opentelemetry import metrics
+from requests import RequestException, Timeout
 
 from pycti.entities.opencti_identity import Identity
 from pycti.utils.constants import (
@@ -32,11 +37,41 @@ utc = pytz.UTC
 
 # Spec version
 SPEC_VERSION = "2.1"
+ERROR_TYPE_LOCK = "LOCK_ERROR"
+ERROR_TYPE_MISSING_REFERENCE = "MISSING_REFERENCE_ERROR"
+ERROR_TYPE_BAD_GATEWAY = "Bad Gateway"
 
 # Extensions
 STIX_EXT_OCTI = "extension-definition--ea279b3e-5c71-4632-ac08-831c66a786ba"
 STIX_EXT_OCTI_SCO = "extension-definition--f93e2c80-4231-4f9a-af8b-95c9bd566a82"
 STIX_EXT_MITRE = "extension-definition--322b8f77-262a-4cb8-a915-1e441e00329b"
+PROCESSING_COUNT: int = 4
+
+meter = metrics.get_meter(__name__)
+bundles_timeout_error_counter = meter.create_counter(
+    name="opencti_bundles_timeout_error_counter",
+    description="number of bundles in timeout error",
+)
+bundles_lock_error_counter = meter.create_counter(
+    name="opencti_bundles_lock_error_counter",
+    description="number of bundles in lock error",
+)
+bundles_missing_reference_error_counter = meter.create_counter(
+    name="opencti_bundles_missing_reference_error_counter",
+    description="number of bundles in missing reference error",
+)
+bundles_bad_gateway_error_counter = meter.create_counter(
+    name="opencti_bundles_bad_gateway_error_counter",
+    description="number of bundles in bad gateway error",
+)
+bundles_technical_error_counter = meter.create_counter(
+    name="opencti_bundles_technical_error_counter",
+    description="number of bundles in technical error",
+)
+bundles_success_counter = meter.create_counter(
+    name="opencti_bundles_success_counter",
+    description="number of bundles successfully processed",
+)
 
 
 class OpenCTIStix2:
@@ -161,7 +196,7 @@ class OpenCTIStix2:
         json_data: Union[str, bytes],
         update: bool = False,
         types: List = None,
-        retry_number: int = None,
+        work_id: str = None,
     ) -> List:
         """import a stix2 bundle from JSON data
 
@@ -171,16 +206,12 @@ class OpenCTIStix2:
         :type update: bool, optional
         :param types: list of stix2 types, defaults to None
         :type types: list, optional
+        :param work_id work_id: str, optional
         :return: list of imported stix2 objects
         :rtype: List
         """
         data = json.loads(json_data)
-        return self.import_bundle(
-            data,
-            update,
-            types,
-            retry_number,
-        )
+        return self.import_bundle(data, update, types, work_id)
 
     def resolve_author(self, title: str) -> Optional[Identity]:
         if "fireeye" in title.lower() or "mandiant" in title.lower():
@@ -1188,7 +1219,7 @@ class OpenCTIStix2:
 
         # Create the relation
 
-        ## Try to guess start_time / stop_time from external reference
+        # Try to guess start_time / stop_time from external reference
         date = None
         if "external_references" in stix_relation:
             for external_reference in stix_relation["external_references"]:
@@ -2362,12 +2393,235 @@ class OpenCTIStix2:
 
         return bundle
 
+    def import_item(
+        self,
+        item,
+        update: bool = False,
+        types: List = None,
+        processing_count: int = 0,
+        work_id: str = None,
+    ):
+        worker_logger = self.opencti.logger_class("worker")
+        try:
+            self.opencti.set_retry_number(processing_count)
+            if "opencti_operation" in item:
+                if item["opencti_operation"] == "delete":
+                    delete_id = item["id"]
+                    self.opencti.stix.delete(id=delete_id)
+                if item["opencti_operation"] == "merge":
+                    target_id = item["merge_target_id"]
+                    source_ids = item["merge_source_ids"]
+                    self.opencti.stix.merge(id=target_id, object_ids=source_ids)
+                else:
+                    raise ValueError("Not supported opencti_operation")
+            elif item["type"] == "relationship":
+                # Import relationship
+                self.import_relationship(item, update, types)
+            elif item["type"] == "sighting":
+                # Resolve the to
+                to_ids = []
+                if "where_sighted_refs" in item:
+                    for where_sighted_ref in item["where_sighted_refs"]:
+                        to_ids.append(where_sighted_ref)
+                # Import sighting_of_ref
+                if "x_opencti_sighting_of_ref" in item:
+                    from_id = item["x_opencti_sighting_of_ref"]
+                    if len(to_ids) > 0:
+                        for to_id in to_ids:
+                            self.import_sighting(item, from_id, to_id, update)
+                if (
+                    self.opencti.get_attribute_in_extension("sighting_of_ref", item)
+                    is not None
+                ):
+                    from_id = self.opencti.get_attribute_in_extension(
+                        "sighting_of_ref", item
+                    )
+                    if len(to_ids) > 0:
+                        for to_id in to_ids:
+                            self.import_sighting(item, from_id, to_id, update)
+                from_id = item["sighting_of_ref"]
+                if len(to_ids) > 0:
+                    for to_id in to_ids:
+                        self.import_sighting(item, from_id, to_id, update)
+                # Import observed_data_refs
+                if "observed_data_refs" in item:
+                    for observed_data_ref in item["observed_data_refs"]:
+                        if len(to_ids) > 0:
+                            for to_id in to_ids:
+                                self.import_sighting(
+                                    item, observed_data_ref, to_id, update
+                                )
+            elif item["type"] == "label":
+                stix_ids = self.opencti.get_attribute_in_extension("stix_ids", item)
+                self.opencti.label.create(
+                    stix_id=item["id"],
+                    value=item["value"],
+                    color=item["color"],
+                    x_opencti_stix_ids=stix_ids,
+                    update=update,
+                )
+            elif item["type"] == "vocabulary":
+                stix_ids = self.opencti.get_attribute_in_extension("stix_ids", item)
+                self.opencti.vocabulary.create(
+                    stix_id=item["id"],
+                    name=item["name"],
+                    category=item["category"],
+                    description=(
+                        item["description"] if "description" in item else None
+                    ),
+                    aliases=item["aliases"] if "aliases" in item else None,
+                    x_opencti_stix_ids=stix_ids,
+                    update=update,
+                )
+            elif item["type"] == "external-reference":
+                stix_ids = self.opencti.get_attribute_in_extension("stix_ids", item)
+                self.opencti.external_reference.create(
+                    stix_id=item["id"],
+                    source_name=(
+                        item["source_name"] if "source_name" in item else None
+                    ),
+                    url=item["url"] if "url" in item else None,
+                    external_id=(
+                        item["external_id"] if "external_id" in item else None
+                    ),
+                    description=(
+                        item["description"] if "description" in item else None
+                    ),
+                    x_opencti_stix_ids=stix_ids,
+                    update=update,
+                )
+            elif item["type"] == "kill-chain-phase":
+                stix_ids = self.opencti.get_attribute_in_extension("stix_ids", item)
+                self.opencti.kill_chain_phase.create(
+                    stix_id=item["id"],
+                    kill_chain_name=item["kill_chain_name"],
+                    phase_name=item["phase_name"],
+                    x_opencti_order=item["order"] if "order" in item else 0,
+                    x_opencti_stix_ids=stix_ids,
+                    update=update,
+                )
+            elif StixCyberObservableTypes.has_value(item["type"]):
+                if types is None or len(types) == 0:
+                    self.import_observable(item, update, types)
+                elif item["type"] in types or "observable" in types:
+                    self.import_observable(item, update, types)
+            else:
+                # Check the scope
+                if (
+                    item["type"] == "marking-definition"
+                    or types is None
+                    or len(types) == 0
+                ):
+                    self.import_object(item, update, types)
+                # Handle identity & location if part of the scope
+                elif item["type"] in types:
+                    self.import_object(item, update, types)
+                else:
+                    # Specific OpenCTI scopes
+                    if item["type"] == "identity":
+                        if "identity_class" in item:
+                            if ("class" in types or "sector" in types) and item[
+                                "identity_class"
+                            ] == "class":
+                                self.import_object(item, update, types)
+                            elif item["identity_class"] in types:
+                                self.import_object(item, update, types)
+                    elif item["type"] == "location":
+                        if "x_opencti_location_type" in item:
+                            if item["x_opencti_location_type"].lower() in types:
+                                self.import_object(item, update, types)
+                        elif (
+                            self.opencti.get_attribute_in_extension(
+                                "location_type", item
+                            )
+                            is not None
+                        ):
+                            if (
+                                self.opencti.get_attribute_in_extension(
+                                    "location_type", item
+                                ).lower()
+                                in types
+                            ):
+                                self.import_object(item, update, types)
+            if work_id is not None:
+                self.opencti.work.report_expectation(work_id, None)
+            bundles_success_counter.add(1)
+            return True
+        except (RequestException, Timeout):
+            bundles_timeout_error_counter.add(1)
+            worker_logger.warning("A connection error or timeout occurred")
+            # Platform is under heavy load: wait for unlock & retry almost indefinitely.
+            sleep_jitter = round(random.uniform(10, 30), 2)
+            time.sleep(sleep_jitter)
+            return self.import_item(item, update, types, processing_count + 1, work_id)
+        except Exception as ex:  # pylint: disable=broad-except
+            error = str(ex)
+            error_msg = traceback.format_exc()
+            in_retry = processing_count < PROCESSING_COUNT
+            # Platform is under heavy load, wait for unlock & retry indefinitely.
+            if ERROR_TYPE_LOCK in error_msg:
+                worker_logger.info(
+                    "Message reprocess for lock rejection", {"count": processing_count}
+                )
+                bundles_lock_error_counter.add(1)
+                sleep_jitter = round(random.uniform(1, 3), 2)
+                time.sleep(sleep_jitter)
+                return self.import_item(
+                    item, update, types, processing_count + 1, work_id
+                )
+            # Platform detects a missing reference and have to retry
+            elif ERROR_TYPE_MISSING_REFERENCE in error_msg and in_retry:
+                worker_logger.info(
+                    "Message reprocess for missing reference",
+                    {"count": processing_count},
+                )
+                bundles_missing_reference_error_counter.add(1)
+                sleep_jitter = round(random.uniform(1, 3), 2)
+                time.sleep(sleep_jitter)
+                return self.import_item(
+                    item, update, types, processing_count + 1, work_id
+                )
+            # A bad gateway error occurs
+            elif ERROR_TYPE_BAD_GATEWAY in error_msg:
+                worker_logger.error("A connection error occurred")
+                worker_logger.info(
+                    "Message reprocess for bad gateway",
+                    {"count": processing_count},
+                )
+                bundles_bad_gateway_error_counter.add(1)
+                time.sleep(60)
+                return self.import_item(
+                    item, update, types, processing_count + 1, work_id
+                )
+            # Platform does not know what to do and raises an error:
+            # That also works for missing reference with too much execution
+            else:
+                bundles_technical_error_counter.add(1)
+                worker_logger.error(
+                    "Error executing import",
+                    {"count": processing_count, "reason": error},
+                )
+                if work_id is not None:
+                    item_str = json.dumps(item)
+                    self.opencti.work.report_expectation(
+                        work_id,
+                        {
+                            "error": error,
+                            "source": (
+                                item_str
+                                if len(item_str) < 50000
+                                else "Bundle too large"
+                            ),
+                        },
+                    )
+                return False
+
     def import_bundle(
         self,
         stix_bundle: Dict,
         update: bool = False,
         types: List = None,
-        retry_number: int = None,
+        work_id: str = None,
     ) -> List:
         # Check if the bundle is correctly formatted
         if "type" not in stix_bundle or stix_bundle["type"] != "bundle":
@@ -2379,152 +2633,16 @@ class OpenCTIStix2:
             if "x_opencti_event_version" in stix_bundle
             else None
         )
-        if retry_number is not None:
-            self.opencti.set_retry_number(retry_number)
         stix2_splitter = OpenCTIStix2Splitter()
         try:
             bundles = stix2_splitter.split_bundle(stix_bundle, False, event_version)
         except RecursionError:
             bundles = [stix_bundle]
-        # Import every elements in a specific order
+        # Import every element in a specific order
         imported_elements = []
-
-        # Marking definitions
         for bundle in bundles:
             for item in bundle["objects"]:
-                if "x_opencti_event_version" in bundle:
-                    if bundle["x_opencti_event_version"] == "3":
-                        if "x_opencti_patch" in item:
-                            self.stix2_update.process_update(item)
-                            continue
-                if item["type"] == "relationship":
-                    self.import_relationship(item, update, types)
-                elif item["type"] == "sighting":
-                    # Resolve the to
-                    to_ids = []
-                    if "where_sighted_refs" in item:
-                        for where_sighted_ref in item["where_sighted_refs"]:
-                            to_ids.append(where_sighted_ref)
-                    # Import sighting_of_ref
-                    if "x_opencti_sighting_of_ref" in item:
-                        from_id = item["x_opencti_sighting_of_ref"]
-                        if len(to_ids) > 0:
-                            for to_id in to_ids:
-                                self.import_sighting(item, from_id, to_id, update)
-                    if (
-                        self.opencti.get_attribute_in_extension("sighting_of_ref", item)
-                        is not None
-                    ):
-                        from_id = self.opencti.get_attribute_in_extension(
-                            "sighting_of_ref", item
-                        )
-                        if len(to_ids) > 0:
-                            for to_id in to_ids:
-                                self.import_sighting(item, from_id, to_id, update)
-                    from_id = item["sighting_of_ref"]
-                    if len(to_ids) > 0:
-                        for to_id in to_ids:
-                            self.import_sighting(item, from_id, to_id, update)
-                    # Import observed_data_refs
-                    if "observed_data_refs" in item:
-                        for observed_data_ref in item["observed_data_refs"]:
-                            if len(to_ids) > 0:
-                                for to_id in to_ids:
-                                    self.import_sighting(
-                                        item, observed_data_ref, to_id, update
-                                    )
-                elif item["type"] == "label":
-                    stix_ids = self.opencti.get_attribute_in_extension("stix_ids", item)
-                    self.opencti.label.create(
-                        stix_id=item["id"],
-                        value=item["value"],
-                        color=item["color"],
-                        x_opencti_stix_ids=stix_ids,
-                        update=update,
-                    )
-                elif item["type"] == "vocabulary":
-                    stix_ids = self.opencti.get_attribute_in_extension("stix_ids", item)
-                    self.opencti.vocabulary.create(
-                        stix_id=item["id"],
-                        name=item["name"],
-                        category=item["category"],
-                        description=(
-                            item["description"] if "description" in item else None
-                        ),
-                        aliases=item["aliases"] if "aliases" in item else None,
-                        x_opencti_stix_ids=stix_ids,
-                        update=update,
-                    )
-                elif item["type"] == "external-reference":
-                    stix_ids = self.opencti.get_attribute_in_extension("stix_ids", item)
-                    self.opencti.external_reference.create(
-                        stix_id=item["id"],
-                        source_name=(
-                            item["source_name"] if "source_name" in item else None
-                        ),
-                        url=item["url"] if "url" in item else None,
-                        external_id=(
-                            item["external_id"] if "external_id" in item else None
-                        ),
-                        description=(
-                            item["description"] if "description" in item else None
-                        ),
-                        x_opencti_stix_ids=stix_ids,
-                        update=update,
-                    )
-                elif item["type"] == "kill-chain-phase":
-                    stix_ids = self.opencti.get_attribute_in_extension("stix_ids", item)
-                    self.opencti.kill_chain_phase.create(
-                        stix_id=item["id"],
-                        kill_chain_name=item["kill_chain_name"],
-                        phase_name=item["phase_name"],
-                        x_opencti_order=item["order"] if "order" in item else 0,
-                        x_opencti_stix_ids=stix_ids,
-                        update=update,
-                    )
-                elif StixCyberObservableTypes.has_value(item["type"]):
-                    if types is None or len(types) == 0:
-                        self.import_observable(item, update, types)
-                    elif item["type"] in types or "observable" in types:
-                        self.import_observable(item, update, types)
-                else:
-                    # Check the scope
-                    if (
-                        item["type"] == "marking-definition"
-                        or types is None
-                        or len(types) == 0
-                    ):
-                        self.import_object(item, update, types)
-                    # Handle identity & location if part of the scope
-                    elif item["type"] in types:
-                        self.import_object(item, update, types)
-                    else:
-                        # Specific OpenCTI scopes
-                        if item["type"] == "identity":
-                            if "identity_class" in item:
-                                if ("class" in types or "sector" in types) and item[
-                                    "identity_class"
-                                ] == "class":
-                                    self.import_object(item, update, types)
-                                elif item["identity_class"] in types:
-                                    self.import_object(item, update, types)
-                        elif item["type"] == "location":
-                            if "x_opencti_location_type" in item:
-                                if item["x_opencti_location_type"].lower() in types:
-                                    self.import_object(item, update, types)
-                            elif (
-                                self.opencti.get_attribute_in_extension(
-                                    "location_type", item
-                                )
-                                is not None
-                            ):
-                                if (
-                                    self.opencti.get_attribute_in_extension(
-                                        "location_type", item
-                                    ).lower()
-                                    in types
-                                ):
-                                    self.import_object(item, update, types)
+                self.import_item(item, update, types, 0, work_id)
                 imported_elements.append({"id": item["id"], "type": item["type"]})
 
         return imported_elements

pycti/utils/opencti_stix2_splitter.py

@@ -1,6 +1,9 @@
 import json
 import re
 import uuid
+from typing import Tuple
+
+from typing_extensions import deprecated
 
 MITRE_X_CAPEC = (
     "x_capec_*"  # https://github.com/mitre-attack/attack-stix-data/issues/34
@@ -58,16 +61,10 @@ class OpenCTIStix2Splitter:
         self.cache_index[item_id] = item  # Put in cache
         return nb_deps
 
-    def split_bundle(self, bundle, use_json=True, event_version=None) -> list:
-        """splits a valid stix2 bundle into a list of bundles
-        :param bundle: valid stix2 bundle
-        :type bundle:
-        :param use_json: is JSON?
-        :type use_json:
-        :raises Exception: if data is not valid JSON
-        :return: returns a list of bundles
-        :rtype: list
-        """
+    def split_bundle_with_expectations(
+        self, bundle, use_json=True, event_version=None
+    ) -> Tuple[int, list]:
+        """splits a valid stix2 bundle into a list of bundles"""
         if use_json:
             try:
                 bundle_data = json.loads(bundle)
@@ -96,16 +93,31 @@ class OpenCTIStix2Splitter:
             return elem["nb_deps"]
 
         self.elements.sort(key=by_dep_size)
-        for entity in self.elements:
+
+        elements_with_deps = list(
+            map(lambda e: {"nb_deps": e["nb_deps"], "elements": [e]}, self.elements)
+        )
+
+        number_expectations = 0
+        for entity in elements_with_deps:
+            number_expectations += len(entity["elements"])
             bundles.append(
                 self.stix2_create_bundle(
                     bundle_data["id"],
                     entity["nb_deps"],
-                    [entity],
+                    entity["elements"],
                     use_json,
                     event_version,
                 )
             )
+
+        return number_expectations, bundles
+
+    @deprecated("Use split_bundle_with_expectations instead")
+    def split_bundle(self, bundle, use_json=True, event_version=None) -> list:
+        expectations, bundles = self.split_bundle_with_expectations(
+            bundle, use_json, event_version
+        )
         return bundles
 
     @staticmethod

{pycti-6.1.4.dist-info → pycti-6.1.5.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pycti
-Version: 6.1.4
+Version: 6.1.5
 Summary: Python API client for OpenCTI.
 Home-page: https://github.com/OpenCTI-Platform/client-python
 Author: Filigran
@@ -22,15 +22,17 @@ Requires-Python: >=3.7
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: datefinder ~=0.7.3
-Requires-Dist: pika ~=1.3.1
-Requires-Dist: prometheus-client ~=0.20.0
+Requires-Dist: pika ~=1.3.0
 Requires-Dist: python-json-logger ~=2.0.4
-Requires-Dist: pyyaml ~=6.0
-Requires-Dist: requests ~=2.31.0
-Requires-Dist: setuptools ~=69.5.1
+Requires-Dist: PyYAML ~=6.0
+Requires-Dist: requests ~=2.32.2
+Requires-Dist: setuptools ~=70.0.0
+Requires-Dist: cachetools ~=5.3.0
+Requires-Dist: prometheus-client ~=0.20.0
+Requires-Dist: opentelemetry-api ~=1.22.0
+Requires-Dist: opentelemetry-sdk ~=1.22.0
 Requires-Dist: filigran-sseclient ~=1.0.0
 Requires-Dist: stix2 ~=3.0.1
-Requires-Dist: cachetools ~=5.3.0
 Requires-Dist: python-magic ~=0.4.27 ; sys_platform == "linux" or sys_platform == "darwin"
 Requires-Dist: python-magic-bin ~=0.4.14 ; sys_platform == "win32"
 Provides-Extra: dev

{pycti-6.1.4.dist-info → pycti-6.1.5.dist-info}/RECORD

@@ -1,12 +1,12 @@
-pycti/__init__.py,sha256=wZBeVfDfWr21plXv-SmfxEqF3S574PQgFfuvn0yq-ns,5035
+pycti/__init__.py,sha256=b5FShCuxuJX-8qUHy2fW2-JhkP-G6wnMEjS7d683cNQ,5035
 pycti/api/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-pycti/api/opencti_api_client.py,sha256=fDeVJjExlsrTNYRf28LYhifz901JkdOZueCdvvko36Y,29575
+pycti/api/opencti_api_client.py,sha256=oTPEdzbSTtN1NMMDFqv_DIOXuUwNz8cN7oXu3saSXyA,29701
 pycti/api/opencti_api_connector.py,sha256=fYF0Jy9KIMFNt1RC_A1rpWomVJ-oj5HiSsBem4W0J5U,3549
 pycti/api/opencti_api_playbook.py,sha256=OkqDawpnMYIHz5sD4djlJ_KgORkfvQ7YbJwttxE-ea8,1470
 pycti/api/opencti_api_work.py,sha256=JLfl7oy6Cq9IrYW_kUrqwzN46FoVzyIn1JJQKyK0h_w,7615
 pycti/connector/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 pycti/connector/opencti_connector.py,sha256=0vrZ8Y8ecbxegAP1YhpX6ybOZahYjjOkcId51D1oBi4,2449
-pycti/connector/opencti_connector_helper.py,sha256=MUo8Eq53qn0MDIfyWj-mEV1jUJVrFCH8ENtAS8j0s-Q,60311
+pycti/connector/opencti_connector_helper.py,sha256=mOlakQ077mZorpR7McXNLq4UXxsM2_00ES87M-HfQY8,60496
 pycti/connector/opencti_metric_handler.py,sha256=4jXHeJflomtHjuQ_YU0b36TG7o26vOWbY_jvU8Ezobs,3725
 pycti/entities/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 pycti/entities/opencti_attack_pattern.py,sha256=ycAR0cReJ1dd_edQPAL6qBrFvvTx10GJFMTezyK91cg,21471
@@ -57,12 +57,12 @@ pycti/entities/opencti_vulnerability.py,sha256=dzJ0fZB2XrkPwT-cANr6atzYOWXF5nk0a
 pycti/utils/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 pycti/utils/constants.py,sha256=Gj0fz94p0ApjCUCUqBQpFTfNslT021HS2w6M8azqXBY,10601
 pycti/utils/opencti_logger.py,sha256=0dvB75V0SuPFGxL539dAQrxTt1N5Acx0A3Ogwl5WMJ8,2199
-pycti/utils/opencti_stix2.py,sha256=7-AhzCrt0j28acGFbgTvXIAlUBI05zcYD5zmOAf-caY,112457
-pycti/utils/opencti_stix2_splitter.py,sha256=Ht9Mp-W3gbwxIKEr7i_5NYpcDr3TA2gYdC4TzOz0G4c,4496
+pycti/utils/opencti_stix2.py,sha256=Ovv8mS7Df0FTNZwO2Vful8XNWY5PwNuyrrLC3bhiOqI,117232
+pycti/utils/opencti_stix2_splitter.py,sha256=A2GqoiFzEga8hslgA3mm4FDoObFsWgx4zK4DdcWTguc,4907
 pycti/utils/opencti_stix2_update.py,sha256=CnMyqkeVA0jgyxEcgqna8sABU4YPMjkEJ228GVurIn4,14658
 pycti/utils/opencti_stix2_utils.py,sha256=4r9qglN3AIN8JH1B9Ts2o20Qn3K203M4c5-lIPzRpZ4,4138
-pycti-6.1.4.dist-info/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
-pycti-6.1.4.dist-info/METADATA,sha256=M2QbuEG6qBPN6MmV195krKAjx_boL3XUD1bCHm0PriE,5313
-pycti-6.1.4.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
-pycti-6.1.4.dist-info/top_level.txt,sha256=cqEpxitAhHP4VgSA6xmrak6Yk9MeBkwoMTB6k7d2ZnE,6
-pycti-6.1.4.dist-info/RECORD,,
+pycti-6.1.5.dist-info/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+pycti-6.1.5.dist-info/METADATA,sha256=1_z_bdOGl8Ro1xuyV5Dw9nBP335Y1QaCGQaSBX3n0tI,5397
+pycti-6.1.5.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
+pycti-6.1.5.dist-info/top_level.txt,sha256=cqEpxitAhHP4VgSA6xmrak6Yk9MeBkwoMTB6k7d2ZnE,6
+pycti-6.1.5.dist-info/RECORD,,