Merge branch 'release/6.5.0'

Author: labo-flg

docs/conf.py

@@ -19,7 +19,7 @@
 # -- Project information -----------------------------------------------------
 
 project = "OpenCTI client for Python"
-copyright = "2024, Filigran"
+copyright = "2025, Filigran"
 author = "OpenCTI Project"
 
 # The full version, including alpha/beta/rc tags

pycti/api/opencti_api_work.py

@@ -82,6 +82,24 @@ def add_expectations(self, work_id: str, expectations: int):
             except:
                 self.api.app_logger.error("Cannot report expectation")
 
+    def add_draft_context(self, work_id: str, draft_context: str):
+        if self.api.bundle_send_to_queue:
+            self.api.app_logger.info(
+                "Update draft context",
+                {"work_id": work_id, "draft_context": draft_context},
+            )
+            query = """
+                mutation addDraftContext($id: ID!, $draftContext: String) {
+                    workEdit(id: $id) {
+                        addDraftContext(draftContext: $draftContext)
+                    }
+                }
+               """
+            try:
+                self.api.query(query, {"id": work_id, "draftContext": draft_context})
+            except:
+                self.api.app_logger.error("Cannot report draft context")
+
     def initiate_work(self, connector_id: str, friendly_name: str) -> str:
         if self.api.bundle_send_to_queue:
             self.api.app_logger.info("Initiate work", {"connector_id": connector_id})

pycti/connector/opencti_connector_helper.py

@@ -1732,6 +1732,8 @@ def send_stix2_bundle(self, bundle: str, **kwargs) -> list:
         if bundle_send_to_queue:
             if work_id:
                 self.api.work.add_expectations(work_id, expectations_number)
+                if draft_id:
+                    self.api.work.add_draft_context(work_id, draft_id)
             if entities_types is None:
                 entities_types = []
             if self.queue_protocol == "amqp":

pycti/entities/stix_cyber_observable/opencti_stix_cyber_observable_deprecated.py

@@ -3,7 +3,7 @@
 
 class StixCyberObservableDeprecatedMixin:
     """
-    deprecated [>=6.2 & <6.5]`
+    deprecated [>=6.2 & <6.8]`
     Promote a Stix-Observable to an Indicator
 
     :param id: the Stix-Observable id

pycti/utils/opencti_stix2.py

@@ -2407,6 +2407,19 @@ def export_selected(
 
         return bundle
 
+    def apply_patch(self, item):
+        input = item["opencti_field_patch"]
+        if item["type"] == "relationship":
+            self.opencti.stix_core_relationship.update_field(id=item["id"], input=input)
+        elif item["type"] == "sighting":
+            self.opencti.stix_sighting_relationship.update_field(
+                id=item["id"], input=input
+            )
+        elif StixCyberObservableTypes.has_value(item["type"]):
+            self.opencti.stix_cyber_observable.update_field(id=item["id"], input=input)
+        else:
+            self.opencti.stix_domain_object.update_field(id=item["id"], input=input)
+
     def import_item(
         self,
         item,
@@ -2426,6 +2439,8 @@ def import_item(
                     target_id = item["merge_target_id"]
                     source_ids = item["merge_source_ids"]
                     self.opencti.stix.merge(id=target_id, object_ids=source_ids)
+                elif item["opencti_operation"] == "patch":
+                    self.apply_patch(item=item)
                 else:
                     raise ValueError("Not supported opencti_operation")
             elif item["type"] == "relationship":

tests/02-integration/entities/test_observables.py

@@ -2,7 +2,7 @@
 
 
 def test_promote_observable_to_indicator_deprecated(api_client):
-    # deprecated [>=6.2 & <6.5]
+    # deprecated [>=6.2 & <6.8]
     obs1 = api_client.stix_cyber_observable.create(
         simple_observable_key="IPv4-Addr.value", simple_observable_value="55.55.55.55"
     )