[client] Add support for trash restore

Author: richard-julien

pycti/api/opencti_api_client.py

@@ -11,6 +11,7 @@
 from pycti import __version__
 from pycti.api.opencti_api_connector import OpenCTIApiConnector
 from pycti.api.opencti_api_playbook import OpenCTIApiPlaybook
+from pycti.api.opencti_api_trash import OpenCTIApiTrash
 from pycti.api.opencti_api_work import OpenCTIApiWork
 from pycti.entities.opencti_attack_pattern import AttackPattern
 from pycti.entities.opencti_campaign import Campaign
@@ -167,6 +168,7 @@ def __init__(
         self.session = requests.session()
         # Define the dependencies
         self.work = OpenCTIApiWork(self)
+        self.trash = OpenCTIApiTrash(self)
         self.playbook = OpenCTIApiPlaybook(self)
         self.connector = OpenCTIApiConnector(self)
         self.stix2 = OpenCTIStix2(self)

pycti/api/opencti_api_trash.py

@@ -0,0 +1,18 @@
+class OpenCTIApiTrash:
+    """OpenCTIApiTrash"""
+
+    def __init__(self, api):
+        self.api = api
+
+    def delete_operation_restore(self, operation_id: str):
+        query = """
+            mutation DeleteOperationRestore($id: ID!) {
+                deleteOperationRestore(id: $id)
+            }
+           """
+        self.api.query(
+            query,
+            {
+                "id": operation_id,
+            },
+        )

pycti/utils/opencti_stix2.py

@@ -2497,7 +2497,9 @@ def apply_opencti_operation(self, item, operation):
             delete_id = item["id"]
             force_delete = operation == "delete-force"
             self.opencti.stix.delete(id=delete_id)
-        elif operation == "merge":
+        elif operation == "restore":
+                    self.opencti.trash.delete_operation_restore(item["id"])
+                elif item["opencti_operation"] == "merge":
             target_id = item["merge_target_id"]
             source_ids = item["merge_source_ids"]
             self.opencti.stix.merge(id=target_id, object_ids=source_ids)

pycti/utils/opencti_stix2_splitter.py

@@ -19,6 +19,7 @@
     SUPPORTED_STIX_ENTITY_OBJECTS  # entities
     + list(STIX_CYBER_OBSERVABLE_MAPPING.keys())  # observables
     + ["relationship", "sighting"]  # relationships
+    + ["deleteoperation"]  # OpenCTI specific type for operation
 )