pycti 6.5.11__py3-none-any.whl → 6.6.1__py3-none-any.whl

pycti/utils/opencti_stix2.py

@@ -40,6 +40,7 @@ SPEC_VERSION = "2.1"
 ERROR_TYPE_LOCK = "LOCK_ERROR"
 ERROR_TYPE_MISSING_REFERENCE = "MISSING_REFERENCE_ERROR"
 ERROR_TYPE_BAD_GATEWAY = "Bad Gateway"
+ERROR_TYPE_DRAFT_LOCK = "DRAFT_LOCKED"
 ERROR_TYPE_TIMEOUT = "Request timed out"
 
 # Extensions
@@ -2407,18 +2408,77 @@ class OpenCTIStix2:
 
         return bundle
 
+    def apply_patch_files(self, item):
+        field_patch = self.opencti.get_attribute_in_extension(
+            "opencti_field_patch", item
+        )
+        if field_patch is None:
+            field_patch = item["opencti_field_patch"]
+        field_patch_files = next(
+            (op for op in field_patch if op["key"] == "x_opencti_files"), None
+        )
+        do_add_file = self.opencti.stix_domain_object.add_file
+        if StixCyberObservableTypes.has_value(item["type"]):
+            do_add_file = self.opencti.stix_cyber_observable.add_file
+        elif item["type"] == "external-reference":
+            do_add_file = self.opencti.external_reference.add_file
+        if field_patch_files is not None:
+            for file in field_patch_files["value"]:
+                if "data" in file:
+                    do_add_file(
+                        id=item["id"],
+                        file_name=file["name"],
+                        version=file.get("version", None),
+                        data=base64.b64decode(file["data"]),
+                        fileMarkings=file.get("object_marking_refs", None),
+                        mime_type=file.get("mime_type", None),
+                        no_trigger_import=file.get("no_trigger_import", False),
+                    )
+
     def apply_patch(self, item):
-        input = item["opencti_field_patch"]
-        if item["type"] == "relationship":
-            self.opencti.stix_core_relationship.update_field(id=item["id"], input=input)
-        elif item["type"] == "sighting":
-            self.opencti.stix_sighting_relationship.update_field(
-                id=item["id"], input=input
-            )
-        elif StixCyberObservableTypes.has_value(item["type"]):
-            self.opencti.stix_cyber_observable.update_field(id=item["id"], input=input)
+        field_patch = self.opencti.get_attribute_in_extension(
+            "opencti_field_patch", item
+        )
+        if field_patch is None:
+            field_patch = item["opencti_field_patch"]
+        field_patch_without_files = [
+            op for op in field_patch if op["key"] != "x_opencti_files"
+        ]
+        if len(field_patch_without_files) > 0:
+            if item["type"] == "relationship":
+                self.opencti.stix_core_relationship.update_field(
+                    id=item["id"], input=field_patch_without_files
+                )
+            elif item["type"] == "sighting":
+                self.opencti.stix_sighting_relationship.update_field(
+                    id=item["id"], input=field_patch_without_files
+                )
+            elif StixCyberObservableTypes.has_value(item["type"]):
+                self.opencti.stix_cyber_observable.update_field(
+                    id=item["id"], input=field_patch_without_files
+                )
+            elif item["type"] == "external-reference":
+                self.opencti.external_reference.update_field(
+                    id=item["id"], input=field_patch_without_files
+                )
+            else:
+                self.opencti.stix_domain_object.update_field(
+                    id=item["id"], input=field_patch_without_files
+                )
+        self.apply_patch_files(item)
+
+    def apply_opencti_operation(self, item, operation):
+        if operation == "delete":
+            delete_id = item["id"]
+            self.opencti.stix.delete(id=delete_id)
+        elif operation == "merge":
+            target_id = item["merge_target_id"]
+            source_ids = item["merge_source_ids"]
+            self.opencti.stix.merge(id=target_id, object_ids=source_ids)
+        elif operation == "patch":
+            self.apply_patch(item=item)
         else:
-            self.opencti.stix_domain_object.update_field(id=item["id"], input=input)
+            raise ValueError("Not supported opencti_operation")
 
     def import_item(
         self,
@@ -2431,18 +2491,13 @@ class OpenCTIStix2:
         worker_logger = self.opencti.logger_class("worker")
         try:
             self.opencti.set_retry_number(processing_count)
-            if "opencti_operation" in item:
-                if item["opencti_operation"] == "delete":
-                    delete_id = item["id"]
-                    self.opencti.stix.delete(id=delete_id)
-                elif item["opencti_operation"] == "merge":
-                    target_id = item["merge_target_id"]
-                    source_ids = item["merge_source_ids"]
-                    self.opencti.stix.merge(id=target_id, object_ids=source_ids)
-                elif item["opencti_operation"] == "patch":
-                    self.apply_patch(item=item)
-                else:
-                    raise ValueError("Not supported opencti_operation")
+            opencti_operation = self.opencti.get_attribute_in_extension(
+                "opencti_operation", item
+            )
+            if opencti_operation is not None:
+                self.apply_opencti_operation(item, opencti_operation)
+            elif "opencti_operation" in item:
+                self.apply_opencti_operation(item, item["opencti_operation"])
             elif item["type"] == "relationship":
                 # Import relationship
                 self.import_relationship(item, update, types)
@@ -2621,6 +2676,19 @@ class OpenCTIStix2:
                 return self.import_item(
                     item, update, types, processing_count + 1, work_id
                 )
+            # A draft lock error occurs
+            elif ERROR_TYPE_DRAFT_LOCK in error_msg:
+                bundles_technical_error_counter.add(1)
+                if work_id is not None:
+                    self.opencti.work.api.set_draft_id("")
+                    self.opencti.work.report_expectation(
+                        work_id,
+                        {
+                            "error": error,
+                            "source": "Draft in read only",
+                        },
+                    )
+                return False
             # Platform does not know what to do and raises an error:
             # That also works for missing reference with too much execution
             else:

{pycti-6.5.11.dist-info → pycti-6.6.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pycti
-Version: 6.5.11
+Version: 6.6.1
 Summary: Python API client for OpenCTI.
 Home-page: https://github.com/OpenCTI-Platform/client-python
 Author: Filigran

{pycti-6.5.11.dist-info → pycti-6.6.1.dist-info}/RECORD

@@ -1,16 +1,17 @@
-pycti/__init__.py,sha256=JNwV6ItYqfE23jEOzRbt0Txjfcj286tCyATTf_1U9sE,5219
+pycti/__init__.py,sha256=0E2jc4ywYDuvV6jNy8PqYifMGETvsXhcGxt8DVDVZYw,5538
 pycti/api/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-pycti/api/opencti_api_client.py,sha256=3_opNMGfx90QNMw4_ULQEKazsblLYBtJLVaTHo2_I9A,32846
+pycti/api/opencti_api_client.py,sha256=Q9qiHyv-qXtA4z9Dut40nCNF32IzT6wQy9kqbBLbas0,33356
 pycti/api/opencti_api_connector.py,sha256=8xwHuLINP3ZCImzE9_K_iCR9QEA3K6aHpK4bJhcZf20,5582
 pycti/api/opencti_api_playbook.py,sha256=456We78vESukfSOi_CctfZ9dbBJEi76EHClRc2f21Js,1628
 pycti/api/opencti_api_work.py,sha256=qIRJMCfyC9odXf7LMRg9ImYizqF2WHUOU7Ty5IUFGg8,8351
 pycti/connector/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 pycti/connector/opencti_connector.py,sha256=8lCZFvcA9-S1x6vFl756hgWAlzKfrnq-C4AIdDJr-Kg,2715
-pycti/connector/opencti_connector_helper.py,sha256=GlWxo2npQjg2R3Ey2WRqLp3M2DtKPNL71we0tUap6P4,87795
+pycti/connector/opencti_connector_helper.py,sha256=O1HFLQVoJcN3vxhZ7bZ-50kVFst4FjR5sCFV6QnCuYA,88453
 pycti/connector/opencti_metric_handler.py,sha256=4jXHeJflomtHjuQ_YU0b36TG7o26vOWbY_jvU8Ezobs,3725
 pycti/entities/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 pycti/entities/opencti_attack_pattern.py,sha256=QXJaMMZlnVCxxHGZNGSKPLmHL3TgM08aUIS8SypmIek,22193
 pycti/entities/opencti_campaign.py,sha256=y2kk95eQxRyE3iu1FJ-RV_hEWCg_XDUgYuWbAyakRx0,17745
+pycti/entities/opencti_capability.py,sha256=mAR3AT__w6ULuAgc4T_QYxDwW9Jz8bsXQ8SDKF2BCL4,1515
 pycti/entities/opencti_case_incident.py,sha256=6duPTxOPkwRlygH_lF7f34cNe7oOn929w0f48lBu1ag,34397
 pycti/entities/opencti_case_rfi.py,sha256=v8n2iHFeTZE87tTWtrVyamlUGzZZxWym5upFyaxaFUM,34055
 pycti/entities/opencti_case_rft.py,sha256=yV9fqNa9juLocJtOtylLM_Nuj4dPSWkTjEmT_89szbY,34946
@@ -21,10 +22,11 @@ pycti/entities/opencti_data_source.py,sha256=abXeSHtBeaViuCqh5sZRZ6PZ_QchPBfUev0
 pycti/entities/opencti_event.py,sha256=owGBWodcYFfurAq1LxaTSj3JIMXbdvFG4cr-joy-nak,16765
 pycti/entities/opencti_external_reference.py,sha256=zSsGOUajrTgSG9T0MHUzq-16XalJ0BHHC54RvBaTD48,13524
 pycti/entities/opencti_feedback.py,sha256=Duu3oXiQcTbJ6Tyk7k8wWt0wTK0U1Dtow1Hhht7tZeo,32376
+pycti/entities/opencti_group.py,sha256=X7NfJ7-0Nwzggh9BqlA0GiKHc7v2PhmJnNQsffAeVA0,26172
 pycti/entities/opencti_grouping.py,sha256=WPLIt3dB4jMFkai4sDxaUq27VxjouOP1FT6LJQ8td2E,30235
 pycti/entities/opencti_identity.py,sha256=trQsvyzc2kIoZcZQn5GMQmutCNt7qRt39twg1EmWD2o,23759
 pycti/entities/opencti_incident.py,sha256=OFWUX1mtQ2lM2f15DU6FlriTZ9bXkb3Ql7oLCVLEmFk,18632
-pycti/entities/opencti_indicator.py,sha256=h_WW5OXTkvTJx_Iq8pXvkGZKSUH1ccti1q-WaZjKBCo,21180
+pycti/entities/opencti_indicator.py,sha256=BcfuS9zfdjDEtbW_nKGLU_nK9KCnObsLnQiEONqvTRM,21444
 pycti/entities/opencti_infrastructure.py,sha256=TXnofpQskioYSKAhVzH5bj17aWk2y7rsmlG57uhoxK4,19997
 pycti/entities/opencti_intrusion_set.py,sha256=2vIk2jfvrTL8H83UkpdpHwax_DYhO4lUAAlz_Ec1N3k,19023
 pycti/entities/opencti_kill_chain_phase.py,sha256=acNzuFdxhwI_8fvZOTEHhP8fC6EGY_r6jcKpA-nKa8Q,7991
@@ -39,6 +41,8 @@ pycti/entities/opencti_note.py,sha256=QHmA-067V1kXdgWpQD3m_GtSyv7Y5d-MqpQ-PIur7O
 pycti/entities/opencti_observed_data.py,sha256=va8frxFZfHVGR6vgmcZpB8blATmQ-zXhy4bQEsfwAp8,31043
 pycti/entities/opencti_opinion.py,sha256=SHD6oepJYF7dS5yorbaEilRdnasWmjDGcnAxHZnGdfk,22459
 pycti/entities/opencti_report.py,sha256=LY2wB6zcdchBD8URYoNqGWENMqnalOrmxoNKz306EDM,35303
+pycti/entities/opencti_role.py,sha256=ryfPmZ_ch2sRGgqEr6_qxChTcGoeqvHW0MvlGHkLgdw,14039
+pycti/entities/opencti_settings.py,sha256=3dArFaPPdcFTV44uGRffjHpnDE-MKIXgd496QZcH6Bw,13547
 pycti/entities/opencti_stix.py,sha256=uMheSg8i1f2Ozx2Mk0iShWzHHjj6MMWDtV5nDjVxKEE,2275
 pycti/entities/opencti_stix_core_object.py,sha256=eyhsNAWaQO5X55Wn91b21j_d6bydBxfN29s2eQHrXkI,51639
 pycti/entities/opencti_stix_core_relationship.py,sha256=Ab3jJhhpmGFSTA4GaC11XoAsuUnujDCc8zSvwRUEwiQ,44742
@@ -52,6 +56,7 @@ pycti/entities/opencti_threat_actor.py,sha256=vFPeo0pOYSqHBKVlWc4o8RjuP2PP0A09KW
 pycti/entities/opencti_threat_actor_group.py,sha256=ANvs1C_ugpYv_jNwW9mOwn4jXKTmkV7tL5wdPgt3PXA,20661
 pycti/entities/opencti_threat_actor_individual.py,sha256=i41YIdC7Mc5qMzdYmzItI1qVdDqngqsA1kMWGngRDGo,21011
 pycti/entities/opencti_tool.py,sha256=YbOp0Ur5Do7ToLzfIKGX-MtlBQf-Dt9Qtgk1lI9Q7aU,15295
+pycti/entities/opencti_user.py,sha256=zJKhJCvC2N5-3E92uFad2CwiQhCWVAHYrgomzqBwD-s,29735
 pycti/entities/opencti_vocabulary.py,sha256=xupdHJ6TznCmvI3sVYU261SnfblSNc1nwg19MG9yrao,6499
 pycti/entities/opencti_vulnerability.py,sha256=ssMH7EB7WC--Nv2bq-D-_wLBGXMgP3ZLK-X8SslpVJQ,22614
 pycti/entities/indicator/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -62,13 +67,13 @@ pycti/entities/stix_cyber_observable/opencti_stix_cyber_observable_properties.py
 pycti/utils/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 pycti/utils/constants.py,sha256=zlt4nPytB-PIVd91X0RGh3bY6qWcCOn3hnuM9TuDWEw,11829
 pycti/utils/opencti_logger.py,sha256=BHNy9fJuTUTn_JEYSCmyvVwd6y-9ZJKxO40mY4iZ0bc,2226
-pycti/utils/opencti_stix2.py,sha256=pUx1Oglb1EnREheMzmJBrmRS17vGnZzF8PCmB-pjNM0,117680
+pycti/utils/opencti_stix2.py,sha256=pVzQpDNe3A0ZTBJjVa5oBKAh9j6hyJG7GdpB0Rj5KWg,120589
 pycti/utils/opencti_stix2_identifier.py,sha256=k8L1z4q1xdCBfxqUba4YS_kT-MmbJFxYh0RvfGOmrOs,837
 pycti/utils/opencti_stix2_splitter.py,sha256=etnAWMDzNi2JCovSUJ5Td-XLVdzgKRdsV1XfpXOGols,11070
 pycti/utils/opencti_stix2_update.py,sha256=CnMyqkeVA0jgyxEcgqna8sABU4YPMjkEJ228GVurIn4,14658
 pycti/utils/opencti_stix2_utils.py,sha256=xgBZzm7HC76rLQYwTKkaUd_w9jJnVMoryHx7KDDIB_g,5065
-pycti-6.5.11.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
-pycti-6.5.11.dist-info/METADATA,sha256=BzaGtd1tfiCVUSo2K1bwFgZ_EHedIeI0AmhgFKizWdk,5565
-pycti-6.5.11.dist-info/WHEEL,sha256=CmyFI0kx5cdEMTLiONQRbGQwjIoR1aIYB7eCAQ4KPJ0,91
-pycti-6.5.11.dist-info/top_level.txt,sha256=cqEpxitAhHP4VgSA6xmrak6Yk9MeBkwoMTB6k7d2ZnE,6
-pycti-6.5.11.dist-info/RECORD,,
+pycti-6.6.1.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+pycti-6.6.1.dist-info/METADATA,sha256=fknOiej3wY0piWNg4chO_2IcZhmZxOMzM2HFAPpjnfs,5564
+pycti-6.6.1.dist-info/WHEEL,sha256=CmyFI0kx5cdEMTLiONQRbGQwjIoR1aIYB7eCAQ4KPJ0,91
+pycti-6.6.1.dist-info/top_level.txt,sha256=cqEpxitAhHP4VgSA6xmrak6Yk9MeBkwoMTB6k7d2ZnE,6
+pycti-6.6.1.dist-info/RECORD,,