pycti 6.6.0__py3-none-any.whl → 6.6.2__py3-none-any.whl

pycti/__init__.py

@@ -1,5 +1,5 @@
 # -*- coding: utf-8 -*-
-__version__ = "6.6.0"
+__version__ = "6.6.2"
 
 from .api.opencti_api_client import OpenCTIApiClient
 from .api.opencti_api_connector import OpenCTIApiConnector
@@ -12,6 +12,9 @@ from .connector.opencti_connector_helper import (
 from .connector.opencti_metric_handler import OpenCTIMetricHandler
 from .entities.opencti_attack_pattern import AttackPattern
 from .entities.opencti_campaign import Campaign
+
+# Administrative entities
+from .entities.opencti_capability import Capability
 from .entities.opencti_case_incident import CaseIncident
 from .entities.opencti_case_rfi import CaseRfi
 from .entities.opencti_case_rft import CaseRft
@@ -21,6 +24,7 @@ from .entities.opencti_data_component import DataComponent
 from .entities.opencti_data_source import DataSource
 from .entities.opencti_external_reference import ExternalReference
 from .entities.opencti_feedback import Feedback
+from .entities.opencti_group import Group
 from .entities.opencti_grouping import Grouping
 from .entities.opencti_identity import Identity
 from .entities.opencti_incident import Incident
@@ -37,6 +41,8 @@ from .entities.opencti_note import Note
 from .entities.opencti_observed_data import ObservedData
 from .entities.opencti_opinion import Opinion
 from .entities.opencti_report import Report
+from .entities.opencti_role import Role
+from .entities.opencti_settings import Settings
 from .entities.opencti_stix_core_relationship import StixCoreRelationship
 from .entities.opencti_stix_cyber_observable import StixCyberObservable
 from .entities.opencti_stix_domain_object import StixDomainObject
@@ -50,6 +56,7 @@ from .entities.opencti_threat_actor import ThreatActor
 from .entities.opencti_threat_actor_group import ThreatActorGroup
 from .entities.opencti_threat_actor_individual import ThreatActorIndividual
 from .entities.opencti_tool import Tool
+from .entities.opencti_user import User
 from .entities.opencti_vulnerability import Vulnerability
 from .utils.constants import (
     CustomObjectCaseIncident,
@@ -151,4 +158,9 @@ __all__ = [
     "STIX_EXT_MITRE",
     "STIX_EXT_OCTI_SCO",
     "STIX_EXT_OCTI",
+    "Capability",
+    "Role",
+    "Group",
+    "User",
+    "Settings",
 ]

pycti/api/opencti_api_client.py

@@ -14,6 +14,7 @@ from pycti.api.opencti_api_playbook import OpenCTIApiPlaybook
 from pycti.api.opencti_api_work import OpenCTIApiWork
 from pycti.entities.opencti_attack_pattern import AttackPattern
 from pycti.entities.opencti_campaign import Campaign
+from pycti.entities.opencti_capability import Capability
 from pycti.entities.opencti_case_incident import CaseIncident
 from pycti.entities.opencti_case_rfi import CaseRfi
 from pycti.entities.opencti_case_rft import CaseRft
@@ -24,6 +25,7 @@ from pycti.entities.opencti_data_source import DataSource
 from pycti.entities.opencti_event import Event
 from pycti.entities.opencti_external_reference import ExternalReference
 from pycti.entities.opencti_feedback import Feedback
+from pycti.entities.opencti_group import Group
 from pycti.entities.opencti_grouping import Grouping
 from pycti.entities.opencti_identity import Identity
 from pycti.entities.opencti_incident import Incident
@@ -42,6 +44,8 @@ from pycti.entities.opencti_note import Note
 from pycti.entities.opencti_observed_data import ObservedData
 from pycti.entities.opencti_opinion import Opinion
 from pycti.entities.opencti_report import Report
+from pycti.entities.opencti_role import Role
+from pycti.entities.opencti_settings import Settings
 from pycti.entities.opencti_stix import Stix
 from pycti.entities.opencti_stix_core_object import StixCoreObject
 from pycti.entities.opencti_stix_core_relationship import StixCoreRelationship
@@ -59,6 +63,7 @@ from pycti.entities.opencti_threat_actor import ThreatActor
 from pycti.entities.opencti_threat_actor_group import ThreatActorGroup
 from pycti.entities.opencti_threat_actor_individual import ThreatActorIndividual
 from pycti.entities.opencti_tool import Tool
+from pycti.entities.opencti_user import User
 from pycti.entities.opencti_vocabulary import Vocabulary
 from pycti.entities.opencti_vulnerability import Vulnerability
 from pycti.utils.opencti_logger import logger
@@ -128,6 +133,7 @@ class OpenCTIApiClient:
         # Configure logger
         self.logger_class = logger(log_level.upper(), json_logging)
         self.app_logger = self.logger_class("api")
+        self.admin_logger = self.logger_class("admin")
 
         # Define API
         self.api_token = token
@@ -198,6 +204,13 @@ class OpenCTIApiClient:
         self.grouping = Grouping(self)
         self.indicator = Indicator(self)
 
+        # Admin functionality
+        self.capability = Capability(self)
+        self.role = Role(self)
+        self.group = Group(self)
+        self.user = User(self)
+        self.settings = Settings(self)
+
         # Check if openCTI is available
         if perform_health_check and not self.health_check():
             raise ValueError(

pycti/connector/opencti_connector_helper.py

@@ -291,6 +291,11 @@ class ListenQueue(threading.Thread):
             {"tag": method.delivery_tag},
         )
 
+    def _set_draft_id(self, draft_id):
+        self.helper.draft_id = draft_id
+        self.helper.api.set_draft_id(draft_id)
+        self.helper.api_impersonate.set_draft_id(draft_id)
+
     def _data_handler(self, json_data) -> None:
         # Execute the callback
         try:
@@ -298,6 +303,7 @@ class ListenQueue(threading.Thread):
             entity_id = event_data.get("entity_id")
             entity_type = event_data.get("entity_type")
             validation_mode = event_data.get("validation_mode", "workbench")
+            force_validation = event_data.get("force_validation", False)
             # Set the API headers
             internal_data = json_data["internal"]
             work_id = internal_data["work_id"]
@@ -305,9 +311,9 @@ class ListenQueue(threading.Thread):
             self.helper.work_id = work_id
 
             self.helper.validation_mode = validation_mode
-            self.helper.draft_id = draft_id
-            self.helper.api.set_draft_id(draft_id)
-            self.helper.api_impersonate.set_draft_id(draft_id)
+            self.helper.force_validation = force_validation
+
+            self._set_draft_id(draft_id)
 
             self.helper.playbook = None
             self.helper.enrichment_shared_organizations = None
@@ -404,12 +410,14 @@ class ListenQueue(threading.Thread):
             message = self.callback(event_data)
             if work_id:
                 self.helper.api.work.to_processed(work_id, message)
+            self._set_draft_id("")
 
         except Exception as e:  # pylint: disable=broad-except
             self.helper.metric.inc("error_count")
             self.helper.connector_logger.error(
                 "Error in message processing, reporting error to API"
             )
+            self._set_draft_id("")
             if work_id:
                 try:
                     self.helper.api.work.to_processed(work_id, str(e), True)
@@ -1114,6 +1122,7 @@ class OpenCTIConnectorHelper:  # pylint: disable=too-many-public-methods
         )
         self.work_id = None
         self.validation_mode = "workbench"
+        self.force_validation = False
         self.draft_id = None
         self.playbook = None
         self.enrichment_shared_organizations = None
@@ -1764,6 +1773,7 @@ class OpenCTIConnectorHelper:  # pylint: disable=too-many-public-methods
         update = kwargs.get("update", False)
         event_version = kwargs.get("event_version", None)
         bypass_validation = kwargs.get("bypass_validation", False)
+        force_validation = kwargs.get("force_validation", self.force_validation)
         entity_id = kwargs.get("entity_id", None)
         file_markings = kwargs.get("file_markings", None)
         file_name = kwargs.get("file_name", None)
@@ -1826,7 +1836,11 @@ class OpenCTIConnectorHelper:  # pylint: disable=too-many-public-methods
         if not file_name and work_id:
             file_name = f"{work_id}.json"
 
-        if self.connect_validate_before_import and not bypass_validation and file_name:
+        if (
+            (self.connect_validate_before_import or force_validation)
+            and not bypass_validation
+            and file_name
+        ):
             if validation_mode == "workbench":
                 self.api.upload_pending_file(
                     file_name=file_name,
@@ -1843,6 +1857,8 @@ class OpenCTIConnectorHelper:  # pylint: disable=too-many-public-methods
                 if not draft_id:
                     self.connector_logger.error("Draft couldn't be created")
                     return []
+                if work_id:
+                    self.api.work.add_draft_context(work_id, draft_id)
 
         # If directory setup, write the bundle to the target directory
         if bundle_send_to_directory and bundle_send_to_directory_path is not None:
@@ -1916,8 +1932,10 @@ class OpenCTIConnectorHelper:  # pylint: disable=too-many-public-methods
             raise ValueError("Nothing to import")
 
         if bundle_send_to_queue:
-            if work_id and draft_id:
-                self.api.work.add_draft_context(work_id, draft_id)
+            if work_id:
+                self.api.work.add_expectations(work_id, expectations_number)
+                if draft_id:
+                    self.api.work.add_draft_context(work_id, draft_id)
             if entities_types is None:
                 entities_types = []
             if self.queue_protocol == "amqp":

pycti/entities/opencti_capability.py

@@ -0,0 +1,52 @@
+from typing import Dict, List
+
+
+class Capability:
+    """Represents a role capability on the OpenCTI platform
+
+    See the properties attribute to understand which properties are fetched by
+    default from the graphql queries.
+    """
+
+    def __init__(self, opencti):
+        self.opencti = opencti
+        self.properties = """
+            id
+            standard_id
+            entity_type
+            parent_types
+            name
+            description
+            attribute_order
+            created_at
+            updated_at
+        """
+
+    def list(self, **kwargs) -> List[Dict]:
+        """Lists all capabilities available on the platform
+
+        :param customAttributes: Custom attributes to retrieve from the GraphQL
+            query.
+        :type customAttributes: str, optional
+        :return: List of capabilities
+        :rtype: List[Dict]
+        """
+        custom_attributes = kwargs.get("customAttributes")
+        self.opencti.admin_logger.info("Listing capabilities")
+        query = (
+            """
+            query CapabilityList {
+                capabilities {
+                    edges {
+                        node {
+                            """
+            + (self.properties if custom_attributes is None else custom_attributes)
+            + """
+                        }
+                    }
+                }
+            }
+            """
+        )
+        result = self.opencti.query(query)
+        return self.opencti.process_multiple(result["data"]["capabilities"])