Skip to content
This repository was archived by the owner on Dec 5, 2025. It is now read-only.

Commit 3eb0c0c

Browse files
author
Samuel Hassine
authored
[client] Use the proper function to update Stix Observables (#30)
1 parent dc32dda commit 3eb0c0c

File tree

1 file changed

+22
-1
lines changed

1 file changed

+22
-1
lines changed

pycti/api/opencti_api_client.py

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -351,6 +351,27 @@ def update_stix_domain_entity_field(self, id, key, value):
351351
}
352352
})
353353

354+
def update_stix_observable_field(self, id, key, value):
355+
logging.info('Updating field ' + key + ' of ' + id + '...')
356+
query = """
357+
mutation StixObservableEdit($id: ID!, $input: EditInput!) {
358+
stixObservableEdit(id: $id) {
359+
fieldPatch(input: $input) {
360+
id
361+
observable_value
362+
entity_type
363+
}
364+
}
365+
}
366+
"""
367+
self.query(query, {
368+
'id': id,
369+
'input': {
370+
'key': key,
371+
'value': value
372+
}
373+
})
374+
354375
def update_stix_relation_field(self, id, key, value):
355376
logging.info('Updating field ' + key + ' of ' + id + '...')
356377
query = """
@@ -3234,7 +3255,7 @@ def create_stix_observable_if_not_exists(self,
32343255
object_result = self.get_stix_observable_by_value(observable_value)
32353256
if object_result is not None:
32363257
if update:
3237-
self.update_stix_domain_entity_field(object_result['id'], 'description', description)
3258+
self.update_stix_observable_field(object_result['id'], 'description', description)
32383259
object_result['description'] = description
32393260
return object_result
32403261
else:

0 commit comments

Comments
 (0)