Skip to content
This repository was archived by the owner on Dec 5, 2025. It is now read-only.

Commit 01fe564

Browse files
author
Samuel Hassine
committed
[client] Fix creating vulnerability, fix stix_observable_relation
1 parent 86a1bdb commit 01fe564

File tree

4 files changed

+111
-43
lines changed

4 files changed

+111
-43
lines changed

‎pycti/entities/opencti_stix_observable_relation.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -274,9 +274,9 @@ def create_raw(self, **kwargs):
274274
)
275275
query = (
276276
"""
277-
mutation StixObservableRelationAdd($input: StixObservableRelationAddInput!) {
278-
stixObservableRelationAdd(input: $input) {
279-
"""
277+
mutation StixObservableRelationAdd($input: StixObservableRelationAddInput!) {
278+
stixObservableRelationAdd(input: $input) {
279+
"""
280280
+ self.properties
281281
+ """
282282
}

‎pycti/entities/opencti_vulnerability.py‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -229,11 +229,11 @@ def create_raw(self, **kwargs):
229229
marking_definitions = kwargs.get("markingDefinitions", None)
230230

231231
if name is not None and description is not None:
232-
self.opencti.log("info", "Creating Tool {" + name + "}.")
232+
self.opencti.log("info", "Creating Vulnerability {" + name + "}.")
233233
query = (
234234
"""
235-
mutation ToolAdd($input: ToolAddInput) {
236-
toolAdd(input: $input) {
235+
mutation VulnerabilityAdd($input: VulnerabilityAddInput) {
236+
vulnerabilityAdd(input: $input) {
237237
"""
238238
+ self.properties
239239
+ """
@@ -257,10 +257,13 @@ def create_raw(self, **kwargs):
257257
}
258258
},
259259
)
260-
return self.opencti.process_multiple_fields(result["data"]["toolAdd"])
260+
return self.opencti.process_multiple_fields(
261+
result["data"]["vulnerabilityAdd"]
262+
)
261263
else:
262264
self.opencti.log(
263-
"error", "[opencti_tool] Missing parameters: name and description"
265+
"error",
266+
"[opencti_vulnerability] Missing parameters: name and description",
264267
)
265268

266269
"""

‎pycti/utils/constants.py‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,19 @@ def has_value(cls, value):
5454
return value in lower_attr
5555

5656

57+
class StixObservableRelationTypes(Enum):
58+
LINKED = "linked"
59+
RESOLVES = "resolves"
60+
BELONGS = "belongs"
61+
CONTAINS = "contains"
62+
CORRESPONDS = "corresponds"
63+
64+
@classmethod
65+
def has_value(cls, value):
66+
lower_attr = list(map(lambda x: x.lower(), cls._value2member_map_))
67+
return value in lower_attr
68+
69+
5770
class CustomProperties:
5871
"""These are the custom properies used by OpenCTI.
5972

‎pycti/utils/opencti_stix2.py‎

Lines changed: 87 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,12 @@
2020
EqualityComparisonExpression,
2121
HashConstant,
2222
)
23-
from pycti.utils.constants import ObservableTypes, IdentityTypes, CustomProperties
23+
from pycti.utils.constants import (
24+
ObservableTypes,
25+
IdentityTypes,
26+
CustomProperties,
27+
StixObservableRelationTypes,
28+
)
2429

2530
datefinder.ValueError = ValueError, OverflowError
2631
utc = pytz.UTC
@@ -542,7 +547,9 @@ def import_relationship(self, stix_relation, update=False, types=None):
542547
source_ref = stix_relation["source_ref"]
543548
if source_ref in self.mapping_cache:
544549
if (
545-
stix_relation["relationship_type"] in OBSERVABLE_RELATIONS
550+
StixObservableRelationTypes.has_value(
551+
stix_relation["relationship_type"]
552+
)
546553
and "observableRefs" in self.mapping_cache[source_ref]
547554
and self.mapping_cache[source_ref]["observableRefs"] is not None
548555
and len(self.mapping_cache[source_ref]["observableRefs"]) > 0
@@ -573,7 +580,9 @@ def import_relationship(self, stix_relation, update=False, types=None):
573580
target_ref = stix_relation["target_ref"]
574581
if target_ref in self.mapping_cache:
575582
if (
576-
stix_relation["relationship_type"] in OBSERVABLE_RELATIONS
583+
StixObservableRelationTypes.has_value(
584+
stix_relation["relationship_type"]
585+
)
577586
and "observableRefs" in self.mapping_cache[target_ref]
578587
and self.mapping_cache[target_ref]["observableRefs"] is not None
579588
and len(self.mapping_cache[target_ref]["observableRefs"]) > 0
@@ -622,38 +631,81 @@ def import_relationship(self, stix_relation, update=False, types=None):
622631
.isoformat()
623632
)
624633

625-
stix_relation_result = self.opencti.stix_relation.create(
626-
fromId=source_id,
627-
fromType=source_type,
628-
toId=target_id,
629-
toType=target_type,
630-
relationship_type=stix_relation["relationship_type"],
631-
description=self.convert_markdown(stix_relation["description"])
632-
if "description" in stix_relation
633-
else None,
634-
first_seen=stix_relation[CustomProperties.FIRST_SEEN]
635-
if CustomProperties.FIRST_SEEN in stix_relation
636-
else date,
637-
last_seen=stix_relation[CustomProperties.LAST_SEEN]
638-
if CustomProperties.LAST_SEEN in stix_relation
639-
else date,
640-
weight=stix_relation[CustomProperties.WEIGHT]
641-
if CustomProperties.WEIGHT in stix_relation
642-
else 1,
643-
role_played=stix_relation[CustomProperties.ROLE_PLAYED]
644-
if CustomProperties.ROLE_PLAYED in stix_relation
645-
else None,
646-
id=stix_relation[CustomProperties.ID]
647-
if CustomProperties.ID in stix_relation
648-
else None,
649-
stix_id_key=stix_relation["id"] if "id" in stix_relation else None,
650-
created=stix_relation["created"] if "created" in stix_relation else None,
651-
modified=stix_relation["modified"] if "modified" in stix_relation else None,
652-
update=update,
653-
ignore_dates=stix_relation[CustomProperties.IGNORE_DATES]
654-
if CustomProperties.IGNORE_DATES in stix_relation
655-
else None,
656-
)
634+
stix_relation_result = None
635+
if StixObservableRelationTypes.has_value(stix_relation["relationship_type"]):
636+
stix_relation_result = self.opencti.stix_observable_relation.create(
637+
fromId=source_id,
638+
fromType=source_type,
639+
toId=target_id,
640+
toType=target_type,
641+
relationship_type=stix_relation["relationship_type"],
642+
description=self.convert_markdown(stix_relation["description"])
643+
if "description" in stix_relation
644+
else None,
645+
first_seen=stix_relation[CustomProperties.FIRST_SEEN]
646+
if CustomProperties.FIRST_SEEN in stix_relation
647+
else date,
648+
last_seen=stix_relation[CustomProperties.LAST_SEEN]
649+
if CustomProperties.LAST_SEEN in stix_relation
650+
else date,
651+
weight=stix_relation[CustomProperties.WEIGHT]
652+
if CustomProperties.WEIGHT in stix_relation
653+
else 1,
654+
role_played=stix_relation[CustomProperties.ROLE_PLAYED]
655+
if CustomProperties.ROLE_PLAYED in stix_relation
656+
else None,
657+
id=stix_relation[CustomProperties.ID]
658+
if CustomProperties.ID in stix_relation
659+
else None,
660+
stix_id_key=stix_relation["id"] if "id" in stix_relation else None,
661+
created=stix_relation["created"]
662+
if "created" in stix_relation
663+
else None,
664+
modified=stix_relation["modified"]
665+
if "modified" in stix_relation
666+
else None,
667+
update=update,
668+
ignore_dates=stix_relation[CustomProperties.IGNORE_DATES]
669+
if CustomProperties.IGNORE_DATES in stix_relation
670+
else None,
671+
)
672+
else:
673+
stix_relation_result = self.opencti.stix_relation.create(
674+
fromId=source_id,
675+
fromType=source_type,
676+
toId=target_id,
677+
toType=target_type,
678+
relationship_type=stix_relation["relationship_type"],
679+
description=self.convert_markdown(stix_relation["description"])
680+
if "description" in stix_relation
681+
else None,
682+
first_seen=stix_relation[CustomProperties.FIRST_SEEN]
683+
if CustomProperties.FIRST_SEEN in stix_relation
684+
else date,
685+
last_seen=stix_relation[CustomProperties.LAST_SEEN]
686+
if CustomProperties.LAST_SEEN in stix_relation
687+
else date,
688+
weight=stix_relation[CustomProperties.WEIGHT]
689+
if CustomProperties.WEIGHT in stix_relation
690+
else 1,
691+
role_played=stix_relation[CustomProperties.ROLE_PLAYED]
692+
if CustomProperties.ROLE_PLAYED in stix_relation
693+
else None,
694+
id=stix_relation[CustomProperties.ID]
695+
if CustomProperties.ID in stix_relation
696+
else None,
697+
stix_id_key=stix_relation["id"] if "id" in stix_relation else None,
698+
created=stix_relation["created"]
699+
if "created" in stix_relation
700+
else None,
701+
modified=stix_relation["modified"]
702+
if "modified" in stix_relation
703+
else None,
704+
update=update,
705+
ignore_dates=stix_relation[CustomProperties.IGNORE_DATES]
706+
if CustomProperties.IGNORE_DATES in stix_relation
707+
else None,
708+
)
657709
if stix_relation_result is not None:
658710
self.mapping_cache[stix_relation["id"]] = {
659711
"id": stix_relation_result["id"],

0 commit comments

Comments
 (0)