pycti 6.6.18__py3-none-any.whl → 6.7.0__py3-none-any.whl

pycti/__init__.py

@@ -1,5 +1,5 @@
 # -*- coding: utf-8 -*-
-__version__ = "6.6.18"
+__version__ = "6.7.0"
 
 from .api.opencti_api_client import OpenCTIApiClient
 from .api.opencti_api_connector import OpenCTIApiConnector

pycti/api/opencti_api_client.py

@@ -10,8 +10,14 @@ import requests
 
 from pycti import __version__
 from pycti.api.opencti_api_connector import OpenCTIApiConnector
+from pycti.api.opencti_api_draft import OpenCTIApiDraft
+from pycti.api.opencti_api_notification import OpenCTIApiNotification
+from pycti.api.opencti_api_pir import OpenCTIApiPir
 from pycti.api.opencti_api_playbook import OpenCTIApiPlaybook
+from pycti.api.opencti_api_public_dashboard import OpenCTIApiPublicDashboard
+from pycti.api.opencti_api_trash import OpenCTIApiTrash
 from pycti.api.opencti_api_work import OpenCTIApiWork
+from pycti.api.opencti_api_workspace import OpenCTIApiWorkspace
 from pycti.entities.opencti_attack_pattern import AttackPattern
 from pycti.entities.opencti_campaign import Campaign
 from pycti.entities.opencti_capability import Capability
@@ -167,9 +173,15 @@ class OpenCTIApiClient:
         self.session = requests.session()
         # Define the dependencies
         self.work = OpenCTIApiWork(self)
+        self.notification = OpenCTIApiNotification(self)
+        self.trash = OpenCTIApiTrash(self)
+        self.draft = OpenCTIApiDraft(self)
+        self.workspace = OpenCTIApiWorkspace(self)
+        self.public_dashboard = OpenCTIApiPublicDashboard(self)
         self.playbook = OpenCTIApiPlaybook(self)
         self.connector = OpenCTIApiConnector(self)
         self.stix2 = OpenCTIStix2(self)
+        self.pir = OpenCTIApiPir(self)
 
         # Define the entities
         self.vocabulary = Vocabulary(self)

pycti/api/opencti_api_draft.py

@@ -0,0 +1,19 @@
+class OpenCTIApiDraft:
+    """OpenCTIApiDraft"""
+
+    def __init__(self, api):
+        self.api = api
+
+    def delete(self, **kwargs):
+        id = kwargs.get("id", None)
+        query = """
+            mutation DraftWorkspaceDelete($id: ID!) {
+                draftWorkspaceDelete(id: $id)
+            }
+           """
+        self.api.query(
+            query,
+            {
+                "id": id,
+            },
+        )

pycti/api/opencti_api_notification.py

@@ -0,0 +1,39 @@
+class OpenCTIApiNotification:
+    """OpenCTIApiJob"""
+
+    def __init__(self, api):
+        self.api = api
+
+    def delete(self, **kwargs):
+        notification_id = kwargs.get("id", None)
+        self.api.app_logger.info(
+            "Deleting notifcation", {"notification_id": notification_id}
+        )
+        query = """
+            mutation notificationDelete($id: ID!) {
+                notificationDelete(id: $id)
+            }
+           """
+        self.api.query(query, {"id": notification_id})
+
+    def update_field(self, **kwargs):
+        notification_id = kwargs.get("id", None)
+        input = kwargs.get("input", None)
+        for input_value in input:
+            if input_value["key"] == "is_read":
+                is_read_value = bool(input_value["value"][0])
+                self.mark_as_read(notification_id, is_read_value)
+
+    def mark_as_read(self, notification_id: str, read: bool):
+        self.api.app_logger.info(
+            "Marking notifcation as read",
+            {"notification_id": notification_id, "read": read},
+        )
+        query = """
+                mutation notificationMarkRead($id: ID!, $read: Boolean!) {
+                    notificationMarkRead(id: $id, read: $read) {
+                        id
+                    }
+                }
+               """
+        self.api.query(query, {"id": notification_id, "read": read})

pycti/api/opencti_api_pir.py

@@ -0,0 +1,37 @@
+class OpenCTIApiPir:
+    """OpenCTIApiPir"""
+
+    def __init__(self, api):
+        self.api = api
+
+    def pir_flag_element(self, **kwargs):
+        id = kwargs.get("id", None)
+        input = kwargs.get("input", None)
+        query = """
+            mutation PirFlagElement($id: ID!, $input: PirFlagElementInput!) {
+                pirFlagElement(id: $id, input: $input)
+            }
+           """
+        self.api.query(
+            query,
+            {
+                "id": id,
+                "input": input,
+            },
+        )
+
+    def pir_unflag_element(self, **kwargs):
+        id = kwargs.get("id", None)
+        input = kwargs.get("input", None)
+        query = """
+            mutation PirUnflagElement($id: ID!, $input: PirUnflagElementInput!) {
+                pirUnflagElement(id: $id, input: $input)
+            }
+           """
+        self.api.query(
+            query,
+            {
+                "id": id,
+                "input": input,
+            },
+        )

pycti/api/opencti_api_playbook.py

@@ -32,3 +32,23 @@ class OpenCTIApiPlaybook:
                 "bundle": bundle,
             },
         )
+
+    def delete(self, **kwargs):
+        id = kwargs.get("id", None)
+        if id is not None:
+            query = """
+                mutation PlaybookDelete($id: ID!) {
+                    playbookDelete(id: $id)
+                }
+               """
+            self.api.query(
+                query,
+                {
+                    "id": id,
+                },
+            )
+        else:
+            self.opencti.app_logger.error(
+                "[stix_playbook] Cant delete playbook, missing parameters: id"
+            )
+            return None

pycti/api/opencti_api_public_dashboard.py

@@ -0,0 +1,25 @@
+class OpenCTIApiPublicDashboard:
+    """OpenCTIApiPublicDashboard"""
+
+    def __init__(self, api):
+        self.api = api
+
+    def delete(self, **kwargs):
+        id = kwargs.get("id", None)
+        if id is not None:
+            query = """
+                mutation PublicDashboardDelete($id: ID!) {
+                    publicDashboardDelete(id: $id)
+                }
+               """
+            self.api.query(
+                query,
+                {
+                    "id": id,
+                },
+            )
+        else:
+            self.opencti.app_logger.error(
+                "[stix_public_dashboard] Cant delete public dashboard, missing parameters: id"
+            )
+            return None

pycti/api/opencti_api_trash.py

@@ -0,0 +1,42 @@
+class OpenCTIApiTrash:
+    """OpenCTIApiTrash"""
+
+    def __init__(self, api):
+        self.api = api
+
+    def restore(self, operation_id: str):
+        query = """
+            mutation DeleteOperationRestore($id: ID!) {
+                deleteOperationRestore(id: $id)
+            }
+           """
+        self.api.query(
+            query,
+            {
+                "id": operation_id,
+            },
+        )
+
+    def delete(self, **kwargs):
+        """Delete a trash item given its ID
+
+        :param id: ID for the delete operation on the platform.
+        :type id: str
+        """
+        id = kwargs.get("id", None)
+        if id is None:
+            self.api.admin_logger.error(
+                "[opencti_trash] Cant confirm delete, missing parameter: id"
+            )
+            return None
+        query = """
+            mutation DeleteOperationConfirm($id: ID!) {
+                deleteOperationConfirm(id: $id)
+            }
+        """
+        self.api.query(
+            query,
+            {
+                "id": id,
+            },
+        )

pycti/api/opencti_api_work.py

@@ -131,6 +131,25 @@ class OpenCTIApiWork:
         work = self.api.query(query, {"workId": work_id}, True)
         return work["data"]
 
+    def delete(self, **kwargs):
+        id = kwargs.get("id", None)
+        if id is None:
+            self.opencti.admin_logger.error(
+                "[opencti_work] Cant delete work, missing parameter: id"
+            )
+            return None
+        query = """
+        mutation ConnectorWorksMutation($workId: ID!) {
+            workEdit(id: $workId) {
+                delete
+            }
+        }"""
+        work = self.api.query(
+            query,
+            {"workId": id},
+        )
+        return work["data"]
+
     def wait_for_work_to_finish(self, work_id: str):
         status = ""
         cnt = 0

pycti/api/opencti_api_workspace.py

@@ -0,0 +1,24 @@
+class OpenCTIApiWorkspace:
+    """OpenCTIApiWorkspace"""
+
+    def __init__(self, api):
+        self.api = api
+
+    def delete(self, **kwargs):
+        id = kwargs.get("id", None)
+        if id is None:
+            self.api.admin_logger.error(
+                "[opencti_workspace] Cant delete workspace, missing parameter: id"
+            )
+            return None
+        query = """
+            mutation WorkspaceDelete($id: ID!) {
+                workspaceDelete(id: $id)
+            }
+           """
+        self.api.query(
+            query,
+            {
+                "id": id,
+            },
+        )

pycti/entities/opencti_group.py

@@ -315,12 +315,18 @@ class Group:
         )
         return self.opencti.process_multiple_fields(result["data"]["groupAdd"])
 
-    def delete(self, id: str):
+    def delete(self, **kwargs):
         """Delete a given group from OpenCTI
 
         :param id: ID of the group to delete.
         :type id: str
         """
+        id = kwargs.get("id", None)
+        if id is None:
+            self.opencti.admin_logger.error(
+                "[opencti_group] Cant delete group, missing parameter: id"
+            )
+            return None
         self.opencti.admin_logger.info("Deleting group", {"id": id})
         query = """
             mutation GroupDelete($id: ID!) {

pycti/entities/opencti_identity.py

@@ -51,11 +51,15 @@ class Identity:
                 }
                 ... on Organization {
                     x_opencti_organization_type
+                    x_opencti_score
                 }
                 ... on Individual {
                     x_opencti_firstname
                     x_opencti_lastname
                 }
+                ... on SecurityPlatform {
+                    security_platform_type
+                }
             }
             objectMarking {
                 id
@@ -110,6 +114,10 @@ class Identity:
             }
             ... on Organization {
                 x_opencti_organization_type
+                x_opencti_score
+            }
+            ... on SecurityPlatform {
+                security_platform_type
             }
         """
         self.properties_with_files = """
@@ -152,11 +160,15 @@ class Identity:
                 }
                 ... on Organization {
                     x_opencti_organization_type
+                    x_opencti_score
                 }
                 ... on Individual {
                     x_opencti_firstname
                     x_opencti_lastname
                 }
+                ... on SecurityPlatform {
+                    security_platform_type
+                }
             }
             objectMarking {
                 id
@@ -224,6 +236,10 @@ class Identity:
             }
             ... on Organization {
                 x_opencti_organization_type
+                x_opencti_score
+            }
+            ... on SecurityPlatform {
+                security_platform_type
             }
             importFiles {
                 edges {
@@ -410,8 +426,10 @@ class Identity:
         contact_information = kwargs.get("contact_information", None)
         roles = kwargs.get("roles", None)
         x_opencti_aliases = kwargs.get("x_opencti_aliases", None)
+        security_platform_type = kwargs.get("security_platform_type", None)
         x_opencti_organization_type = kwargs.get("x_opencti_organization_type", None)
         x_opencti_reliability = kwargs.get("x_opencti_reliability", None)
+        x_opencti_score = kwargs.get("x_opencti_score", None)
         x_opencti_firstname = kwargs.get("x_opencti_firstname", None)
         x_opencti_lastname = kwargs.get("x_opencti_lastname", None)
         x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None)
@@ -456,7 +474,26 @@ class Identity:
                     x_opencti_organization_type
                 )
                 input_variables["x_opencti_reliability"] = x_opencti_reliability
+                input_variables["x_opencti_score"] = x_opencti_score
                 result_data_field = "organizationAdd"
+            elif type == IdentityTypes.SECURITYPLATFORM.value:
+                query = """
+                    mutation SecurityPlatformAdd($input: SecurityPlatformAddInput!) {
+                        securityPlatformAdd(input: $input) {
+                            id
+                            standard_id
+                            entity_type
+                            parent_types
+                        }
+                    }
+                """
+                input_variables["security_platform_type"] = security_platform_type
+                # no need for these attributes for security platform
+                del input_variables["contact_information"]
+                del input_variables["lang"]
+                del input_variables["roles"]
+                del input_variables["x_opencti_aliases"]
+                result_data_field = "securityPlatformAdd"
             elif type == IdentityTypes.INDIVIDUAL.value:
                 query = """
                     mutation IndividualAdd($input: IndividualAddInput!) {
@@ -536,6 +573,8 @@ class Identity:
                     type = "Sector"
                 elif stix_object["identity_class"] == "system":
                     type = "System"
+                elif stix_object["identity_class"] == "securityplatform":
+                    type = "SecurityPlatform"
 
             # Search in extensions
             if "x_opencti_aliases" not in stix_object:
@@ -548,10 +587,20 @@ class Identity:
                         "organization_type", stix_object
                     )
                 )
+            if "security_platform_type" not in stix_object:
+                stix_object["security_platform_type"] = (
+                    self.opencti.get_attribute_in_extension(
+                        "security_platform_type", stix_object
+                    )
+                )
             if "x_opencti_reliability" not in stix_object:
                 stix_object["x_opencti_reliability"] = (
                     self.opencti.get_attribute_in_extension("reliability", stix_object)
                 )
+            if "x_opencti_score" not in stix_object:
+                stix_object["x_opencti_score"] = (
+                    self.opencti.get_attribute_in_extension("score", stix_object)
+                )
             if "x_opencti_organization_type" not in stix_object:
                 stix_object["x_opencti_organization_type"] = (
                     self.opencti.get_attribute_in_extension(
@@ -625,11 +674,21 @@ class Identity:
                     if "x_opencti_organization_type" in stix_object
                     else None
                 ),
+                security_platform_type=(
+                    stix_object["security_platform_type"]
+                    if "security_platform_type" in stix_object
+                    else None
+                ),
                 x_opencti_reliability=(
                     stix_object["x_opencti_reliability"]
                     if "x_opencti_reliability" in stix_object
                     else None
                 ),
+                x_opencti_score=(
+                    stix_object["x_opencti_score"]
+                    if "x_opencti_score" in stix_object
+                    else None
+                ),
                 x_opencti_firstname=(
                     stix_object["x_opencti_firstname"]
                     if "x_opencti_firstname" in stix_object

pycti/entities/opencti_indicator.py

@@ -301,6 +301,43 @@ class Indicator:
                 "name or pattern or pattern_type or x_opencti_main_observable_type"
             )
 
+    """
+        Update an Indicator object field
+
+        :param id: the Indicator id
+        :param input: the input of the field
+    """
+
+    def update_field(self, **kwargs):
+        id = kwargs.get("id", None)
+        input = kwargs.get("input", None)
+        if id is not None and input is not None:
+            self.opencti.app_logger.info("Updating Indicator", {"id": id})
+            query = """
+                        mutation IndicatorFieldPatch($id: ID!, $input: [EditInput!]!) {
+                            indicatorFieldPatch(id: $id, input: $input) {
+                                id
+                                standard_id
+                                entity_type
+                            }
+                        }
+                    """
+            result = self.opencti.query(
+                query,
+                {
+                    "id": id,
+                    "input": input,
+                },
+            )
+            return self.opencti.process_multiple_fields(
+                result["data"]["indicatorFieldPatch"]
+            )
+        else:
+            self.opencti.app_logger.error(
+                "[opencti_stix_domain_object] Cant update indicator field, missing parameters: id and input"
+            )
+            return None
+
     def add_stix_cyber_observable(self, **kwargs):
         """
         Add a Stix-Cyber-Observable object to Indicator object (based-on)

pycti/entities/opencti_stix.py

@@ -11,16 +11,17 @@ class Stix:
 
     def delete(self, **kwargs):
         id = kwargs.get("id", None)
+        force_delete = kwargs.get("force_delete", True)
         if id is not None:
             self.opencti.app_logger.info("Deleting Stix element", {"id": id})
             query = """
-                 mutation StixEdit($id: ID!) {
+                 mutation StixEdit($id: ID!, $forceDelete: Boolean) {
                      stixEdit(id: $id) {
-                         delete
+                         delete(forceDelete: $forceDelete)
                      }
                  }
              """
-            self.opencti.query(query, {"id": id})
+            self.opencti.query(query, {"id": id, "forceDelete": force_delete})
         else:
             self.opencti.app_logger.error("[opencti_stix] Missing parameters: id")
             return None