Skip to content
This repository was archived by the owner on Dec 5, 2025. It is now read-only.

Commit 59ac9bf

Browse files
committed
[client] Implement read on stix core object
1 parent 67f9458 commit 59ac9bf

File tree

2 files changed

+107
-7
lines changed

2 files changed

+107
-7
lines changed

pycti/entities/opencti_stix_core_object.py

Lines changed: 91 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,6 @@ class StixCoreObject:
88
def __init__(self, opencti, file):
99
self.opencti = opencti
1010
self.file = file
11-
12-
def __init__(self, opencti):
13-
self.opencti = opencti
14-
1511
self.properties = """
1612
id
1713
standard_id
@@ -158,6 +154,22 @@ def __init__(self, opencti):
158154
name
159155
description
160156
context
157+
objects {
158+
edges {
159+
node {
160+
... on BasicObject {
161+
id
162+
entity_type
163+
standard_id
164+
}
165+
... on BasicRelationship {
166+
id
167+
entity_type
168+
standard_id
169+
}
170+
}
171+
}
172+
}
161173
}
162174
... on CourseOfAction {
163175
name
@@ -371,22 +383,47 @@ def __init__(self, opencti):
371383
... on Channel {
372384
name
373385
description
386+
aliases
387+
channel_types
374388
}
375389
... on Narrative {
376390
name
377391
description
392+
aliases
393+
narrative_types
378394
}
379-
... on Language {
395+
... on DataComponent {
380396
name
397+
description
381398
}
382-
... on DataComponent {
399+
... on DataSource {
383400
name
384401
description
385402
}
386403
... on DataSource {
387404
name
388405
description
389406
}
407+
... on Case {
408+
name
409+
description
410+
objects {
411+
edges {
412+
node {
413+
... on BasicObject {
414+
id
415+
entity_type
416+
standard_id
417+
}
418+
... on BasicRelationship {
419+
id
420+
entity_type
421+
standard_id
422+
}
423+
}
424+
}
425+
}
426+
}
390427
... on StixCyberObservable {
391428
observable_value
392429
}
@@ -589,7 +626,7 @@ def __init__(self, opencti):
589626
:param search: the search keyword
590627
:param first: return the first n rows from the after ID (or the beginning if not set)
591628
:param after: ID of the first row for pagination
592-
:return List of Stix-Domain-Object objects
629+
:return List of Stix-Core-Object objects
593630
"""
594631

595632
def list(self, **kwargs):
@@ -675,6 +712,53 @@ def list(self, **kwargs):
675712
result["data"]["stixCoreObjects"], with_pagination
676713
)
677714

715+
"""
716+
Read a Stix-Core-Object object
717+
718+
:param id: the id of the Stix-Core-Object
719+
:param types: list of Stix Core Entity types
720+
:param filters: the filters to apply if no id provided
721+
:return Stix-Core-Object object
722+
"""
723+
724+
def read(self, **kwargs):
725+
id = kwargs.get("id", None)
726+
types = kwargs.get("types", None)
727+
filters = kwargs.get("filters", None)
728+
custom_attributes = kwargs.get("customAttributes", None)
729+
if id is not None:
730+
LOGGER.info("Reading Stix-Core-Object {%s}.", id)
731+
query = (
732+
"""
733+
query StixCoreObject($id: String!) {
734+
stixCoreObject(id: $id) {
735+
"""
736+
+ (
737+
custom_attributes
738+
if custom_attributes is not None
739+
else self.properties
740+
)
741+
+ """
742+
}
743+
}
744+
"""
745+
)
746+
result = self.opencti.query(query, {"id": id})
747+
return self.opencti.process_multiple_fields(
748+
result["data"]["stixCoreObject"]
749+
)
750+
elif filters is not None:
751+
result = self.list(
752+
types=types, filters=filters, customAttributes=custom_attributes
753+
)
754+
if len(result) > 0:
755+
return result[0]
756+
else:
757+
return None
758+
else:
759+
LOGGER.error("[opencti_stix_core_object] Missing parameters: id or filters")
760+
return None
761+
678762
def list_files(self, **kwargs):
679763
id = kwargs.get("id", None)
680764
LOGGER.info("Listing files of Stix-Core-Object {%s}.", id)

pycti/entities/opencti_stix_domain_object.py

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -466,6 +466,22 @@ def __init__(self, opencti, file):
466466
... on Case {
467467
name
468468
description
469+
objects {
470+
edges {
471+
node {
472+
... on BasicObject {
473+
id
474+
entity_type
475+
standard_id
476+
}
477+
... on BasicRelationship {
478+
id
479+
entity_type
480+
standard_id
481+
}
482+
}
483+
}
484+
}
469485
}
470486
... on Vulnerability {
471487
name

0 commit comments

Comments
 (0)