Skip to content
This repository was archived by the owner on Dec 5, 2025. It is now read-only.

Commit 11f9371

Browse files
author
Samuel Hassine
committed
[client] Fix association of observables to indicators
1 parent 7d6ab58 commit 11f9371

File tree

2 files changed

+18
-11
lines changed

2 files changed

+18
-11
lines changed

pycti/entities/opencti_indicator.py

Lines changed: 17 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,14 @@ def __init__(self, opencti):
108108
x_opencti_detection
109109
x_opencti_main_observable_type
110110
x_mitre_platforms
111+
observables {
112+
edges {
113+
node {
114+
id
115+
observable_value
116+
}
117+
}
118+
}
111119
killChainPhases {
112120
edges {
113121
node {
@@ -372,9 +380,9 @@ def create(self, **kwargs):
372380
"[opencti_indicator] Missing parameters: name or pattern or x_opencti_main_observable_type",
373381
)
374382

375-
def add_stix_observable(self, **kwargs):
383+
def add_stix_cyber_observable(self, **kwargs):
376384
"""
377-
Add a Stix-Observable object to Indicator object (based-on)
385+
Add a Stix-Cyber-Observable object to Indicator object (based-on)
378386
379387
:param id: the id of the Indicator
380388
:param indicator: Indicator object
@@ -406,21 +414,20 @@ def add_stix_observable(self, **kwargs):
406414
+ "}",
407415
)
408416
query = """
409-
mutation IndicatorEdit($id: ID!, $input: StixMetaRelationshipAddInput) {
410-
indicatorEdit(id: $id) {
411-
relationAdd(input: $input) {
412-
id
413-
}
414-
}
415-
}
417+
mutation StixCoreRelationshipAdd($input: StixCoreRelationshipAddInput!) {
418+
stixCoreRelationshipAdd(input: $input) {
419+
id
420+
}
421+
}
416422
"""
417423
self.opencti.query(
418424
query,
419425
{
420426
"id": id,
421427
"input": {
428+
"fromId": id,
422429
"toId": stix_cyber_observable_id,
423-
"through": "based-on",
430+
"relationship_type": "based-on",
424431
},
425432
},
426433
)

setup.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ def run(self):
5959
"pika==1.2.0",
6060
"sseclient==0.0.27",
6161
"python-magic==0.4.18;sys.platform=='linux' or sys.platform=='darwin'",
62-
"python-magic-bin==0.4.14;sys.platform=='win32'",
62+
"python-magic-bin==0.4.14;sys.platform=='win32/'",
6363
],
6464
cmdclass={"verify": VerifyVersionCommand},
6565
extras_require={

0 commit comments

Comments
 (0)