Skip to content
This repository was archived by the owner on Dec 5, 2025. It is now read-only.

Commit 6514335

Browse files
ParamConstructorone-L-of-a-girlrichard-julien
authored
[client] Add TrackingNumber and Credential observables (#609)
Co-authored-by: One 'L' of a Girl <[email protected]> Co-authored-by: Julien Richard <[email protected]>
1 parent 64dc30b commit 6514335

File tree

5 files changed

+205
-10
lines changed

5 files changed

+205
-10
lines changed

‎pycti/__init__.py‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,9 +53,14 @@
5353
from .utils.constants import (
5454
CustomObjectCaseIncident,
5555
CustomObjectTask,
56+
CustomObservableBankAccount,
57+
CustomObservableCredential,
5658
CustomObservableCryptocurrencyWallet,
5759
CustomObservableHostname,
60+
CustomObservablePaymentCard,
61+
CustomObservablePhoneNumber,
5862
CustomObservableText,
63+
CustomObservableTrackingNumber,
5964
CustomObservableUserAgent,
6065
MultipleRefRelationship,
6166
StixCyberObservableTypes,
@@ -128,9 +133,14 @@
128133
"CustomObjectCaseIncident",
129134
"CustomObjectTask",
130135
"StixCyberObservableTypes",
136+
"CustomObservableCredential",
131137
"CustomObservableHostname",
132138
"CustomObservableUserAgent",
139+
"CustomObservableBankAccount",
133140
"CustomObservableCryptocurrencyWallet",
141+
"CustomObservablePaymentCard",
142+
"CustomObservablePhoneNumber",
143+
"CustomObservableTrackingNumber",
134144
"CustomObservableText",
135145
"STIX_EXT_MITRE",
136146
"STIX_EXT_OCTI_SCO",

‎pycti/entities/opencti_stix_core_object.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -615,6 +615,12 @@ def __init__(self, opencti, file):
615615
... on PhoneNumber {
616616
value
617617
}
618+
... on TrackingNumber {
619+
value
620+
}
621+
... on Credential {
622+
value
623+
}
618624
... on PaymentCard {
619625
card_number
620626
expiration_date

‎pycti/entities/opencti_stix_cyber_observable.py‎

Lines changed: 67 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -282,6 +282,12 @@ def __init__(self, opencti, file):
282282
... on PhoneNumber {
283283
value
284284
}
285+
... on TrackingNumber {
286+
value
287+
}
288+
... on Credential {
289+
value
290+
}
285291
... on PaymentCard {
286292
card_number
287293
expiration_date
@@ -576,6 +582,12 @@ def __init__(self, opencti, file):
576582
... on PhoneNumber {
577583
value
578584
}
585+
... on TrackingNumber {
586+
value
587+
}
588+
... on Credential {
589+
value
590+
}
579591
... on PaymentCard {
580592
card_number
581593
expiration_date
@@ -857,6 +869,15 @@ def create(self, **kwargs):
857869
type = "IPv6-Addr"
858870
elif type.lower() == "hostname" or type.lower() == "x-opencti-hostname":
859871
type = "Hostname"
872+
elif type.lower() == "payment-card" or type.lower() == "x-opencti-payment-card":
873+
type = "Payment-Card"
874+
elif type.lower() == "credential" or type.lower() == "x-opencti-credential":
875+
type = "Credential"
876+
elif (
877+
type.lower() == "tracking-number"
878+
or type.lower() == "x-opencti-tracking-number"
879+
):
880+
type = "Tracking-Number"
860881
elif (
861882
type.lower() == "cryptocurrency-wallet"
862883
or type.lower() == "x-opencti-cryptocurrency-wallet"
@@ -974,6 +995,8 @@ def create(self, **kwargs):
974995
$UserAgent: UserAgentAddInput
975996
$BankAccount: BankAccountAddInput
976997
$PhoneNumber: PhoneNumberAddInput
998+
$Credential: CredentialAddInput
999+
$TrackingNumber: TrackingNumberAddInput
9771000
$PaymentCard: PaymentCardAddInput
9781001
$MediaContent: MediaContentAddInput
9791002
) {
@@ -1016,6 +1039,8 @@ def create(self, **kwargs):
10161039
UserAgent: $UserAgent
10171040
BankAccount: $BankAccount
10181041
PhoneNumber: $PhoneNumber
1042+
Credential: $Credential
1043+
TrackingNumber: $TrackingNumber
10191044
PaymentCard: $PaymentCard
10201045
MediaContent: $MediaContent
10211046
) {
@@ -1508,15 +1533,6 @@ def create(self, **kwargs):
15081533
observable_data["value"] if "value" in observable_data else None
15091534
),
15101535
}
1511-
elif (
1512-
type == "Cryptocurrency-Wallet"
1513-
or type == "X-OpenCTI-Cryptocurrency-Wallet"
1514-
):
1515-
input_variables["CryptocurrencyWallet"] = {
1516-
"value": (
1517-
observable_data["value"] if "value" in observable_data else None
1518-
),
1519-
}
15201536
elif type == "Hostname":
15211537
input_variables["Hostname"] = {
15221538
"value": (
@@ -1588,6 +1604,48 @@ def create(self, **kwargs):
15881604
else None
15891605
),
15901606
}
1607+
elif type == "Payment-Card" or type.lower() == "x-opencti-payment-card":
1608+
input_variables["PaymentCard"] = {
1609+
"card_number": (
1610+
observable_data["card_number"]
1611+
if "card_number" in observable_data
1612+
else None
1613+
),
1614+
"expiration_date": (
1615+
observable_data["expiration_date"]
1616+
if "expiration_date" in observable_data
1617+
else None
1618+
),
1619+
"cvv": observable_data["cvv"] if "cvv" in observable_data else None,
1620+
"holder_name": (
1621+
observable_data["holder_name"]
1622+
if "holder_name" in observable_data
1623+
else None
1624+
),
1625+
}
1626+
elif (
1627+
type == "Cryptocurrency-Wallet"
1628+
or type.lower() == "x-opencti-cryptocurrency-wallet"
1629+
):
1630+
input_variables["CryptocurrencyWallet"] = {
1631+
"value": (
1632+
observable_data["value"] if "value" in observable_data else None
1633+
),
1634+
}
1635+
elif type == "Credential" or type.lower() == "x-opencti-credential":
1636+
input_variables["Credential"] = {
1637+
"value": (
1638+
observable_data["value"] if "value" in observable_data else None
1639+
),
1640+
}
1641+
elif (
1642+
type == "Tracking-Number" or type.lower() == "x-opencti-tracking-number"
1643+
):
1644+
input_variables["TrackingNumber"] = {
1645+
"value": (
1646+
observable_data["value"] if "value" in observable_data else None
1647+
),
1648+
}
15911649
result = self.opencti.query(query, input_variables)
15921650
if "payload_bin" in observable_data and "mime/type" in observable_data:
15931651
self.add_file(

‎pycti/utils/constants.py‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ class StixCyberObservableTypes(Enum):
4242
USER_AGENT = "User-Agent"
4343
BANK_ACCOUNT = "Bank-Account"
4444
PHONE_NUMBER = "Phone-Number"
45+
CREDENTIAL = "Credential"
46+
TRACKING_NUMBER = "Tracking-Number"
4547
PAYMENT_CARD = "Payment-Card"
4648
MEDIA_CONTENT = "Media-Content"
4749
SIMPLE_OBSERVABLE = "Simple-Observable"
@@ -66,6 +68,7 @@ def has_value(cls, value):
6668

6769
class ThreatActorTypes(Enum):
6870
THREAT_ACTOR_GROUP = "Threat-Actor-Group"
71+
THREAT_ACTOR_INDIVIDUAL = "Threat-Actor-Individual"
6972

7073
@classmethod
7174
def has_value(cls, value):
@@ -263,6 +266,73 @@ class CustomObservableText:
263266
pass
264267

265268

269+
@CustomObservable(
270+
"payment-card",
271+
[
272+
("value", StringProperty(required=True)),
273+
("card_number", StringProperty(required=True)),
274+
("expiration_date", StringProperty(required=False)),
275+
("cvv", StringProperty(required=False)),
276+
("holder_name", StringProperty(required=False)),
277+
("spec_version", StringProperty(fixed="2.1")),
278+
(
279+
"object_marking_refs",
280+
ListProperty(
281+
ReferenceProperty(valid_types="marking-definition", spec_version="2.1")
282+
),
283+
),
284+
],
285+
["card_number"],
286+
)
287+
class CustomObservablePaymentCard:
288+
"""Payment card observable."""
289+
290+
pass
291+
292+
293+
@CustomObservable(
294+
"bank-account",
295+
[
296+
("value", StringProperty(required=True)),
297+
("iban", StringProperty(required=True)),
298+
("bic", StringProperty(required=False)),
299+
("account_number", StringProperty(required=False)),
300+
("spec_version", StringProperty(fixed="2.1")),
301+
(
302+
"object_marking_refs",
303+
ListProperty(
304+
ReferenceProperty(valid_types="marking-definition", spec_version="2.1")
305+
),
306+
),
307+
],
308+
["iban"],
309+
)
310+
class CustomObservableBankAccount:
311+
"""Bank Account observable."""
312+
313+
pass
314+
315+
316+
@CustomObservable(
317+
"credential",
318+
[
319+
("value", StringProperty(required=True)),
320+
("spec_version", StringProperty(fixed="2.1")),
321+
(
322+
"object_marking_refs",
323+
ListProperty(
324+
ReferenceProperty(valid_types="marking-definition", spec_version="2.1")
325+
),
326+
),
327+
],
328+
["value"],
329+
)
330+
class CustomObservableCredential:
331+
"""Credential observable."""
332+
333+
pass
334+
335+
266336
@CustomObservable(
267337
"cryptocurrency-wallet",
268338
[
@@ -283,6 +353,46 @@ class CustomObservableCryptocurrencyWallet:
283353
pass
284354

285355

356+
@CustomObservable(
357+
"phone-number",
358+
[
359+
("value", StringProperty(required=True)),
360+
("spec_version", StringProperty(fixed="2.1")),
361+
(
362+
"object_marking_refs",
363+
ListProperty(
364+
ReferenceProperty(valid_types="marking-definition", spec_version="2.1")
365+
),
366+
),
367+
],
368+
["value"],
369+
)
370+
class CustomObservablePhoneNumber:
371+
"""Phone number observable."""
372+
373+
pass
374+
375+
376+
@CustomObservable(
377+
"tracking-number",
378+
[
379+
("value", StringProperty(required=True)),
380+
("spec_version", StringProperty(fixed="2.1")),
381+
(
382+
"object_marking_refs",
383+
ListProperty(
384+
ReferenceProperty(valid_types="marking-definition", spec_version="2.1")
385+
),
386+
),
387+
],
388+
["value"],
389+
)
390+
class CustomObservableTrackingNumber:
391+
"""Tracking number observable."""
392+
393+
pass
394+
395+
286396
@CustomObservable(
287397
"user-agent",
288398
[

‎pycti/utils/opencti_stix2_utils.py‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,11 @@
77
"directory": "Directory",
88
"domain-name": "Domain-Name",
99
"email-addr": "Email-Addr",
10-
"file": "StixFile",
1110
"email-message": "Email-Message",
11+
"email-mime-part-type": "Email-Mime-Part-Type",
12+
"artifact": "Artifact",
13+
"file": "StixFile",
14+
"x509-certificate": "X509-Certificate",
1215
"ipv4-addr": "IPv4-Addr",
1316
"ipv6-addr": "IPv6-Addr",
1417
"mac-addr": "Mac-Addr",
@@ -21,8 +24,14 @@
2124
"windows-registry-key": "Windows-Registry-Key",
2225
"windows-registry-value-type": "Windows-Registry-Value-Type",
2326
"hostname": "Hostname",
27+
"cryptographic-key": "Cryptographic-Key",
28+
"cryptocurrency-wallet": "Cryptocurrency-Wallet",
29+
"text": "Text",
30+
"user-agent": "User-Agent",
2431
"bank-account": "Bank-Account",
2532
"phone-number": "Phone-Number",
33+
"credential": "Credential",
34+
"tracking-number": "Tracking-Number",
2635
"payment-card": "Payment-Card",
2736
"media-content": "Media-Content",
2837
}
@@ -54,6 +63,8 @@
5463
"Bank-Account": ["iban"],
5564
"Phone-Number": ["value"],
5665
"Payment-Card": ["card_number"],
66+
"Tracking-Number": ["value"],
67+
"Credential": ["value"],
5768
"Media-Content": ["url"],
5869
}
5970

0 commit comments

Comments
 (0)