@@ -41,7 +41,7 @@ def __init__(self, opencti):
4141 color
4242 }
4343 }
44- }
44+ }
4545 }
4646 ... on Organization {
4747 x_opencti_organization_type
@@ -112,7 +112,7 @@ def __init__(self, opencti):
112112 edges {
113113 node {
114114 id
115- standard_id
115+ standard_id
116116 entity_type
117117 kill_chain_name
118118 phase_name
@@ -139,6 +139,9 @@ def list(self, **kwargs):
139139 :param list customAttributes: (optional) list of attributes keys to return
140140 :param bool getAll: (optional) switch to return all entries (be careful to use this without any other filters)
141141 :param bool withPagination: (optional) switch to use pagination
142+
143+ :return: List of Indicators
144+ :rtype: list
142145 """
143146
144147 filters = kwargs .get ("filters" , None )
@@ -228,6 +231,9 @@ def read(self, **kwargs):
228231
229232 :param str id: the id of the Threat-Actor
230233 :param list filters: the filters to apply if no id provided
234+
235+ :return: Indicator object
236+ :rtype: Indicator
231237 """
232238
233239 id = kwargs .get ("id" , None )
@@ -264,14 +270,17 @@ def read(self, **kwargs):
264270 )
265271 return None
266272
267- """
268- Create a Indicator object
273+ def create (self , ** kwargs ):
274+ """
275+ Create an Indicator object
269276
270- :param name: the name of the Indicator
271- :return Indicator object
272- """
277+ :param str name: the name of the Indicator
278+ :param str pattern: stix indicator pattern
279+ :param str x_opencti_main_observable_type: type of the observable
273280
274- def create (self , ** kwargs ):
281+ :return: Indicator object
282+ :rtype: Indicator
283+ """
275284 stix_id = kwargs .get ("stix_id" , None )
276285 created_by = kwargs .get ("createdBy" , None )
277286 object_marking = kwargs .get ("objectMarking" , None )
@@ -364,15 +373,16 @@ def create(self, **kwargs):
364373 "[opencti_indicator] Missing parameters: name or pattern or x_opencti_main_observable_type" ,
365374 )
366375
367- """
376+ def add_stix_observable (self , ** kwargs ):
377+ """
368378 Add a Stix-Observable object to Indicator object (based-on)
369379
370380 :param id: the id of the Indicator
371- :param entity_id: the id of the Stix-Observable
372- :return Boolean
373- """
381+ :param indicator: Indicator object
382+ :param stix_cyber_observable_id: the id of the Stix-Observable
374383
375- def add_stix_observable (self , ** kwargs ):
384+ :return: Boolean True if there has been no import error
385+ """
376386 id = kwargs .get ("id" , None )
377387 indicator = kwargs .get ("indicator" , None )
378388 stix_cyber_observable_id = kwargs .get ("stix_cyber_observable_id" , None )
@@ -423,14 +433,17 @@ def add_stix_observable(self, **kwargs):
423433 )
424434 return False
425435
426- """
436+ def import_from_stix2 (self , ** kwargs ):
437+ """
427438 Import an Indicator object from a STIX2 object
428439
429440 :param stixObject: the Stix-Object Indicator
430- :return Indicator object
431- """
441+ :param extras: extra dict
442+ :param bool update: set the update flag on import
432443
433- def import_from_stix2 (self , ** kwargs ):
444+ :return: Indicator object
445+ :rtype: Indicator
446+ """
434447 stix_object = kwargs .get ("stixObject" , None )
435448 extras = kwargs .get ("extras" , {})
436449 update = kwargs .get ("update" , False )
0 commit comments