[client] handle delete operation depending on type

Author: JeremyCloarec

pycti/utils/opencti_stix2.py

@@ -31,6 +31,8 @@
     OBSERVABLES_VALUE_INT,
     STIX_CYBER_OBSERVABLE_MAPPING,
     STIX_OBJECTS,
+    STIX_META_OBJECTS,
+    STIX_CORE_OBJECTS,
 )
 
 datefinder.ValueError = ValueError, OverflowError
@@ -2542,9 +2544,17 @@ def organization_unshare(self, item):
 
     def element_operation_delete(self, item, operation):
         # If data is stix, just use the generic stix function for deletion
-        if item["type"] in STIX_OBJECTS:
-            force_delete = operation == "delete_force"
+        force_delete = operation == "delete_force"
+        if item["type"] == "relationship":
+            self.opencti.stix_core_relationship.delete(id=item["id"])
+        elif item["type"] == "sighting":
+            self.opencti.stix_sighting_relationship.delete(id=item["id"])
+        elif item["type"] in STIX_META_OBJECTS:
             self.opencti.stix.delete(id=item["id"], force_delete=force_delete)
+        elif item["type"] in list(STIX_CYBER_OBSERVABLE_MAPPING.keys()):
+            self.opencti.stix_cyber_observable.delete(id=item["id"])
+        elif item["type"] in STIX_CORE_OBJECTS:
+            self.opencti.stix_core_object.delete(id=item["id"])
         else:
             # Element is not knowledge we need to use the right api
             stix_helper = self.get_internal_helper().get(item["type"])

pycti/utils/opencti_stix2_utils.py

@@ -17,6 +17,54 @@
     "publicdashboard",
 ]
 
+STIX_META_OBJECTS = [
+    "label",
+    "vocabulary",
+    "kill-chain-phase",
+]
+
+STIX_CORE_OBJECTS = [
+    "attack-pattern",
+    "campaign",
+    "case-incident",
+    "x-opencti-case-incident",
+    "case-rfi",
+    "x-opencti-case-rfi",
+    "case-rft",
+    "x-opencti-case-rft",
+    "channel",
+    "course-of-action",
+    "data-component",
+    "x-mitre-data-component",
+    "data-source",
+    "x-mitre-data-source",
+    "event",
+    "external-reference",
+    "feedback",
+    "x-opencti-feedback",
+    "grouping",
+    "identity",
+    "incident",
+    "indicator",
+    "infrastructure",
+    "intrusion-set",
+    "language",
+    "location",
+    "malware",
+    "malware-analysis",
+    "marking-definition",
+    "narrative",
+    "note",
+    "observed-data",
+    "opinion",
+    "report",
+    "task",
+    "x-opencti-task",
+    "threat-actor",
+    "tool",
+    "vulnerability",
+]
+
 SUPPORTED_STIX_ENTITY_OBJECTS = [
     "attack-pattern",
     "campaign",