[client] Migrate incident to native STIX

Author: Samuel Hassine

pycti/__init__.py

@@ -30,7 +30,7 @@
 from .entities.opencti_intrusion_set import IntrusionSet
 from .entities.opencti_infrastructure import Infrastructure
 from .entities.opencti_campaign import Campaign
-from .entities.opencti_x_opencti_incident import XOpenCTIIncident
+from .entities.opencti_incident import Incident
 from .entities.opencti_malware import Malware
 from .entities.opencti_tool import Tool
 from .entities.opencti_vulnerability import Vulnerability
@@ -48,7 +48,7 @@
 from .utils.opencti_stix2_utils import (
     OpenCTIStix2Utils,
     SimpleObservable,
-    StixXOpenCTIIncident,
+    StixIncident,
 )
 from .utils.constants import StixCyberObservableTypes
 
@@ -76,7 +76,7 @@
     "IntrusionSet",
     "Infrastructure",
     "Campaign",
-    "XOpenCTIIncident",
+    "Incident",
     "Malware",
     "Tool",
     "Vulnerability",
@@ -93,5 +93,5 @@
     "OpenCTIStix2Utils",
     "StixCyberObservableTypes",
     "SimpleObservable",
-    "StixXOpenCTIIncident",
+    "StixIncident",
 ]

pycti/api/opencti_api_client.py

@@ -34,7 +34,7 @@
 from pycti.entities.opencti_intrusion_set import IntrusionSet
 from pycti.entities.opencti_infrastructure import Infrastructure
 from pycti.entities.opencti_campaign import Campaign
-from pycti.entities.opencti_x_opencti_incident import XOpenCTIIncident
+from pycti.entities.opencti_incident import Incident
 from pycti.entities.opencti_malware import Malware
 from pycti.entities.opencti_tool import Tool
 from pycti.entities.opencti_vulnerability import Vulnerability
@@ -127,7 +127,7 @@ def __init__(self, url, token, log_level="info", ssl_verify=False, proxies={}):
         self.intrusion_set = IntrusionSet(self)
         self.infrastructure = Infrastructure(self)
         self.campaign = Campaign(self)
-        self.x_opencti_incident = XOpenCTIIncident(self)
+        self.incident = Incident(self)
         self.malware = Malware(self)
         self.tool = Tool(self)
         self.vulnerability = Vulnerability(self)

…i/entities/opencti_x_opencti_incident.py pycti/entities/opencti_incident.pypycti/entities/opencti_x_opencti_incident.py renamed to pycti/entities/opencti_incident.py pycti/entities/opencti_x_opencti_incident.py renamed to pycti/entities/opencti_incident.py

@@ -3,7 +3,7 @@
 import json
 
 
-class XOpenCTIIncident:
+class Incident:
     def __init__(self, opencti):
         self.opencti = opencti
         self.properties = """
@@ -127,8 +127,8 @@ def list(self, **kwargs):
         )
         query = (
             """
-            query XOpenCTIIncidents($filters: [XOpenCTIIncidentsFiltering], $search: String, $first: Int, $after: ID, $orderBy: XOpenCTIIncidentsOrdering, $orderMode: OrderingMode) {
-                xOpenCTIIncidents(filters: $filters, search: $search, first: $first, after: $after, orderBy: $orderBy, orderMode: $orderMode) {
+            query Incidents($filters: [IncidentsFiltering], $search: String, $first: Int, $after: ID, $orderBy: IncidentsOrdering, $orderMode: OrderingMode) {
+                incidents(filters: $filters, search: $search, first: $first, after: $after, orderBy: $orderBy, orderMode: $orderMode) {
                     edges {
                         node {
                             """
@@ -159,7 +159,7 @@ def list(self, **kwargs):
             },
         )
         return self.opencti.process_multiple(
-            result["data"]["xOpenCTIIncidents"], with_pagination
+            result["data"]["incidents"], with_pagination
         )
 
     """
@@ -178,8 +178,8 @@ def read(self, **kwargs):
             self.opencti.log("info", "Reading Incident {" + id + "}.")
             query = (
                 """
-                query XOpenCTIIncident($id: String!) {
-                    xOpenCTIIncident(id: $id) {
+                query Incident($id: String!) {
+                    incident(id: $id) {
                         """
                 + (
                     custom_attributes
@@ -192,9 +192,7 @@ def read(self, **kwargs):
              """
             )
             result = self.opencti.query(query, {"id": id})
-            return self.opencti.process_multiple_fields(
-                result["data"]["xOpenCTIIncident"]
-            )
+            return self.opencti.process_multiple_fields(result["data"]["incident"])
         elif filters is not None:
             result = self.list(filters=filters)
             if len(result) > 0:
@@ -236,8 +234,8 @@ def create(self, **kwargs):
         if name is not None and description is not None:
             self.opencti.log("info", "Creating Incident {" + name + "}.")
             query = """
-                mutation XOpenCTIIncidentAdd($input: XOpenCTIIncidentAddInput) {
-                    xOpenCTIIncidentAdd(input: $input) {
+                mutation IncidentAdd($input: IncidentAddInput) {
+                    incidentAdd(input: $input) {
                         id
                         standard_id
                         entity_type
@@ -269,9 +267,7 @@ def create(self, **kwargs):
                     }
                 },
             )
-            return self.opencti.process_multiple_fields(
-                result["data"]["xOpenCTIIncidentAdd"]
-            )
+            return self.opencti.process_multiple_fields(result["data"]["incidentAdd"])
         else:
             self.opencti.log("error", "Missing parameters: name and description")
 

pycti/entities/opencti_note.py

@@ -164,7 +164,7 @@ def __init__(self, opencti):
                         ... on Vulnerability {
                             name
                         }
-                        ... on XOpenCTIIncident {
+                        ... on Incident {
                             name
                         }                
                         ... on StixCoreRelationship {

pycti/entities/opencti_observed_data.py

@@ -164,7 +164,7 @@ def __init__(self, opencti):
                         ... on Vulnerability {
                             name
                         }
-                        ... on XOpenCTIIncident {
+                        ... on Incident {
                             name
                         }                
                         ... on StixCoreRelationship {

pycti/entities/opencti_opinion.py

@@ -164,7 +164,7 @@ def __init__(self, opencti):
                         ... on Vulnerability {
                             name
                         }
-                        ... on XOpenCTIIncident {
+                        ... on Incident {
                             name
                         }                
                         ... on StixCoreRelationship {

pycti/entities/opencti_report.py

@@ -169,7 +169,7 @@ def __init__(self, opencti):
                         ... on Vulnerability {
                             name
                         }
-                        ... on XOpenCTIIncident {
+                        ... on Incident {
                             name
                         }                
                         ... on StixCoreRelationship {

pycti/entities/opencti_stix_core_relationship.py

@@ -162,7 +162,7 @@ def __init__(self, opencti):
                 ... on Vulnerability {
                     name
                 }
-                ... on XOpenCTIIncident {
+                ... on Incident {
                     name
                 }         
                 ... on StixCyberObservable {
@@ -243,7 +243,7 @@ def __init__(self, opencti):
                 ... on Vulnerability {
                     name
                 }
-                ... on XOpenCTIIncident {
+                ... on Incident {
                     name
                 }
                 ... on StixCyberObservable {

pycti/entities/opencti_stix_domain_object.py

@@ -359,7 +359,7 @@ def __init__(self, opencti, file):
                 x_opencti_integrity_impact
                 x_opencti_availability_impact
             }
-            ... on XOpenCTIIncident {
+            ... on Incident {
                 name
                 description
                 aliases

pycti/entities/opencti_stix_object_or_stix_relationship.py

@@ -310,7 +310,7 @@ def __init__(self, opencti):
                 x_opencti_integrity_impact
                 x_opencti_availability_impact
             }
-            ... on XOpenCTIIncident {
+            ... on Incident {
                 name
                 description
                 aliases