Skip to content
This repository was archived by the owner on Dec 5, 2025. It is now read-only.

Commit 9737ba3

Browse files
authored
[client] Extract creators field from indicators and observables (#434)
1 parent 983b605 commit 9737ba3

File tree

3 files changed

+14
-0
lines changed

3 files changed

+14
-0
lines changed

pycti/entities/opencti_indicator.py

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,10 @@ def __init__(self, opencti):
2424
spec_version
2525
created_at
2626
updated_at
27+
creators {
28+
id
29+
name
30+
}
2731
createdBy {
2832
... on Identity {
2933
id

pycti/entities/opencti_stix_cyber_observable.py

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,10 @@ def __init__(self, opencti, file):
2020
spec_version
2121
created_at
2222
updated_at
23+
creators {
24+
id
25+
name
26+
}
2327
createdBy {
2428
... on Identity {
2529
id

tests/cases/entities.py

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -288,6 +288,10 @@ def data(self) -> Dict:
288288
# TODO killchain phase
289289
}
290290

291+
def get_compare_exception_keys(self) -> List[str]:
292+
# indicator objects include extracted creators field
293+
return ["type", "update", "createdBy", "modified", "creators"]
294+
291295
def teardown(self):
292296
self.api_client.stix_domain_object.delete(id=self.organization["id"])
293297

@@ -869,9 +873,11 @@ def get_compare_exception_keys(self) -> List[str]:
869873
# toId = to
870874
# simple_observable_key = entity_type
871875
# simple_observable_value = observable_value & value
876+
# includes extracted creators field
872877
return [
873878
"type",
874879
"update",
880+
"creators",
875881
"createdBy",
876882
"modified",
877883
"simple_observable_key",

0 commit comments

Comments
 (0)