@@ -8,10 +8,6 @@ class StixCoreObject:
88 def __init__ (self , opencti , file ):
99 self .opencti = opencti
1010 self .file = file
11-
12- def __init__ (self , opencti ):
13- self .opencti = opencti
14-
1511 self .properties = """
1612 id
1713 standard_id
@@ -158,6 +154,22 @@ def __init__(self, opencti):
158154 name
159155 description
160156 context
157+ objects {
158+ edges {
159+ node {
160+ ... on BasicObject {
161+ id
162+ entity_type
163+ standard_id
164+ }
165+ ... on BasicRelationship {
166+ id
167+ entity_type
168+ standard_id
169+ }
170+ }
171+ }
172+ }
161173 }
162174 ... on CourseOfAction {
163175 name
@@ -371,22 +383,47 @@ def __init__(self, opencti):
371383 ... on Channel {
372384 name
373385 description
386+ aliases
387+ channel_types
374388 }
375389 ... on Narrative {
376390 name
377391 description
392+ aliases
393+ narrative_types
378394 }
379- ... on Language {
395+ ... on DataComponent {
380396 name
397+ description
381398 }
382- ... on DataComponent {
399+ ... on DataSource {
383400 name
384401 description
385402 }
386403 ... on DataSource {
387404 name
388405 description
389406 }
407+ ... on Case {
408+ name
409+ description
410+ objects {
411+ edges {
412+ node {
413+ ... on BasicObject {
414+ id
415+ entity_type
416+ standard_id
417+ }
418+ ... on BasicRelationship {
419+ id
420+ entity_type
421+ standard_id
422+ }
423+ }
424+ }
425+ }
426+ }
390427 ... on StixCyberObservable {
391428 observable_value
392429 }
@@ -589,7 +626,7 @@ def __init__(self, opencti):
589626 :param search: the search keyword
590627 :param first: return the first n rows from the after ID (or the beginning if not set)
591628 :param after: ID of the first row for pagination
592- :return List of Stix-Domain -Object objects
629+ :return List of Stix-Core -Object objects
593630 """
594631
595632 def list (self , ** kwargs ):
@@ -675,6 +712,53 @@ def list(self, **kwargs):
675712 result ["data" ]["stixCoreObjects" ], with_pagination
676713 )
677714
715+ """
716+ Read a Stix-Core-Object object
717+
718+ :param id: the id of the Stix-Core-Object
719+ :param types: list of Stix Core Entity types
720+ :param filters: the filters to apply if no id provided
721+ :return Stix-Core-Object object
722+ """
723+
724+ def read (self , ** kwargs ):
725+ id = kwargs .get ("id" , None )
726+ types = kwargs .get ("types" , None )
727+ filters = kwargs .get ("filters" , None )
728+ custom_attributes = kwargs .get ("customAttributes" , None )
729+ if id is not None :
730+ LOGGER .info ("Reading Stix-Core-Object {%s}." , id )
731+ query = (
732+ """
733+ query StixCoreObject($id: String!) {
734+ stixCoreObject(id: $id) {
735+ """
736+ + (
737+ custom_attributes
738+ if custom_attributes is not None
739+ else self .properties
740+ )
741+ + """
742+ }
743+ }
744+ """
745+ )
746+ result = self .opencti .query (query , {"id" : id })
747+ return self .opencti .process_multiple_fields (
748+ result ["data" ]["stixCoreObject" ]
749+ )
750+ elif filters is not None :
751+ result = self .list (
752+ types = types , filters = filters , customAttributes = custom_attributes
753+ )
754+ if len (result ) > 0 :
755+ return result [0 ]
756+ else :
757+ return None
758+ else :
759+ LOGGER .error ("[opencti_stix_core_object] Missing parameters: id or filters" )
760+ return None
761+
678762 def list_files (self , ** kwargs ):
679763 id = kwargs .get ("id" , None )
680764 LOGGER .info ("Listing files of Stix-Core-Object {%s}." , id )
0 commit comments