[client] Upgrage client to support platform sync

Author: richard-julien

pycti/api/opencti_api_client.py

@@ -30,6 +30,8 @@
 from pycti.entities.opencti_observed_data import ObservedData
 from pycti.entities.opencti_opinion import Opinion
 from pycti.entities.opencti_report import Report
+from pycti.entities.opencti_stix import Stix
+from pycti.entities.opencti_stix_core_object import StixCoreObject
 from pycti.entities.opencti_stix_core_relationship import StixCoreRelationship
 from pycti.entities.opencti_stix_cyber_observable import StixCyberObservable
 from pycti.entities.opencti_stix_cyber_observable_relationship import (
@@ -113,7 +115,9 @@ def __init__(self, url, token, log_level="info", ssl_verify=False, proxies={}):
         self.opencti_stix_object_or_stix_relationship = StixObjectOrStixRelationship(
             self
         )
+        self.stix = Stix(self)
         self.stix_domain_object = StixDomainObject(self, File)
+        self.stix_core_object = StixCoreObject(self, File)
         self.stix_cyber_observable = StixCyberObservable(self, File)
         self.stix_core_relationship = StixCoreRelationship(self)
         self.stix_sighting_relationship = StixSightingRelationship(self)

pycti/entities/opencti_kill_chain_phase.py

@@ -168,3 +168,54 @@ def create(self, **kwargs):
                 "error",
                 "[opencti_kill_chain_phase] Missing parameters: kill_chain_name and phase_name",
             )
+
+    """
+        Update a Kill chain object field
+
+        :param id: the Kill chain id
+        :param key: the key of the field
+        :param value: the value of the field
+        :return The updated Kill chain object
+    """
+
+    def update_field(self, **kwargs):
+        id = kwargs.get("id", None)
+        key = kwargs.get("key", None)
+        value = kwargs.get("value", None)
+        operation = kwargs.get("operation", "replace")
+        if isinstance(value, list):
+            value = [str(v) for v in value]
+        else:
+            value = str(value)
+        if id is not None and key is not None and value is not None:
+            self.opencti.log(
+                "info", "Updating Kill chain {" + id + "} field {" + key + "}."
+            )
+            query = """
+                    mutation KillChainPhaseEdit($id: ID!, $input: EditInput!, $operation: EditOperation) {
+                        killChainPhaseEdit(id: $id) {
+                            fieldPatch(input: $input, operation: $operation) {
+                                id
+                                standard_id
+                                entity_type
+                            }
+                        }
+                    }
+                """
+            result = self.opencti.query(
+                query,
+                {
+                    "id": id,
+                    "input": {"key": key, "value": value},
+                    "operation": operation,
+                },
+            )
+            return self.opencti.process_multiple_fields(
+                result["data"]["killChainPhaseEdit"]["fieldPatch"]
+            )
+        else:
+            self.opencti.log(
+                "error",
+                "[opencti_kill_chain] Missing parameters: id and key and value",
+            )
+            return None

pycti/entities/opencti_label.py

@@ -150,3 +150,54 @@ def create(self, **kwargs):
                 "error",
                 "[opencti_label] Missing parameters: value",
             )
+
+    """
+        Update a Label object field
+
+        :param id: the Label id
+        :param key: the key of the field
+        :param value: the value of the field
+        :return The updated Label object
+    """
+
+    def update_field(self, **kwargs):
+        id = kwargs.get("id", None)
+        key = kwargs.get("key", None)
+        value = kwargs.get("value", None)
+        operation = kwargs.get("operation", "replace")
+        if isinstance(value, list):
+            value = [str(v) for v in value]
+        else:
+            value = str(value)
+        if id is not None and key is not None and value is not None:
+            self.opencti.log(
+                "info", "Updating Label {" + id + "} field {" + key + "}."
+            )
+            query = """
+                    mutation LabelEdit($id: ID!, $input: EditInput!, $operation: EditOperation) {
+                        labelEdit(id: $id) {
+                            fieldPatch(input: $input, operation: $operation) {
+                                id
+                                standard_id
+                                entity_type
+                            }
+                        }
+                    }
+                """
+            result = self.opencti.query(
+                query,
+                {
+                    "id": id,
+                    "input": {"key": key, "value": value},
+                    "operation": operation,
+                },
+            )
+            return self.opencti.process_multiple_fields(
+                result["data"]["labelEdit"]["fieldPatch"]
+            )
+        else:
+            self.opencti.log(
+                "error",
+                "[opencti_label] Missing parameters: id and key and value",
+            )
+            return None

pycti/entities/opencti_marking_definition.py

@@ -176,6 +176,57 @@ def create(self, **kwargs):
                 "[opencti_marking_definition] Missing parameters: definition and definition_type",
             )
 
+    """
+        Update a Marking definition object field
+
+        :param id: the Marking definition id
+        :param key: the key of the field
+        :param value: the value of the field
+        :return The updated Marking definition object
+    """
+
+    def update_field(self, **kwargs):
+        id = kwargs.get("id", None)
+        key = kwargs.get("key", None)
+        value = kwargs.get("value", None)
+        operation = kwargs.get("operation", "replace")
+        if isinstance(value, list):
+            value = [str(v) for v in value]
+        else:
+            value = str(value)
+        if id is not None and key is not None and value is not None:
+            self.opencti.log(
+                "info", "Updating Marking Definition {" + id + "} field {" + key + "}."
+            )
+            query = """
+                    mutation MarkingDefinitionEdit($id: ID!, $input: EditInput!, $operation: EditOperation) {
+                        markingDefinitionEdit(id: $id) {
+                            fieldPatch(input: $input, operation: $operation) {
+                                id
+                                standard_id
+                                entity_type
+                            }
+                        }
+                    }
+                """
+            result = self.opencti.query(
+                query,
+                {
+                    "id": id,
+                    "input": {"key": key, "value": value},
+                    "operation": operation,
+                },
+            )
+            return self.opencti.process_multiple_fields(
+                result["data"]["markingDefinitionEdit"]["fieldPatch"]
+            )
+        else:
+            self.opencti.log(
+                "error",
+                "[opencti_marking_definition] Missing parameters: id and key and value",
+            )
+            return None
+
     """
         Import an Marking Definition object from a STIX2 object
 

pycti/entities/opencti_opinion.py

@@ -527,10 +527,10 @@ def import_from_stix2(self, **kwargs):
                 else None,
                 objectLabel=extras["object_label_ids"]
                 if "object_label_ids" in extras
-                else [],
+                else None,
                 externalReferences=extras["external_references_ids"]
                 if "external_references_ids" in extras
-                else [],
+                else None,
                 revoked=stix_object["revoked"] if "revoked" in stix_object else None,
                 confidence=stix_object["confidence"]
                 if "confidence" in stix_object
@@ -542,10 +542,10 @@ def import_from_stix2(self, **kwargs):
                     stix_object["explanation"]
                 )
                 if "explanation" in stix_object
-                else "",
+                else None,
                 authors=self.opencti.stix2.convert_markdown(stix_object["authors"])
                 if "authors" in stix_object
-                else "",
+                else None,
                 opinion=stix_object["opinion"] if "opinion" in stix_object else None,
                 update=update,
             )

pycti/entities/opencti_report.py

@@ -605,7 +605,7 @@ def import_from_stix2(self, **kwargs):
                 report_types=stix_object["report_types"]
                 if "report_types" in stix_object
                 else None,
-                published=stix_object["published"],
+                published=stix_object["published"] if "published" in stix_object else None,
                 x_opencti_graph_data=stix_object["x_opencti_graph_data"]
                 if "x_opencti_graph_data" in stix_object
                 else None,

pycti/entities/opencti_stix.py

@@ -0,0 +1,37 @@
+# coding: utf-8
+
+import json
+import os
+
+import magic
+
+
+class Stix:
+    def __init__(self, opencti):
+        self.opencti = opencti
+
+    """
+        Delete a Stix element
+
+        :param id: the Stix element id
+        :return void
+    """
+
+    def delete(self, **kwargs):
+        id = kwargs.get("id", None)
+        if id is not None:
+            self.opencti.log("info", "Deleting Stix element {" + id + "}.")
+            query = """
+                 mutation StixEdit($id: ID!) {
+                     stixEdit(id: $id) {
+                         delete
+                     }
+                 }
+             """
+            self.opencti.query(query, {"id": id})
+        else:
+            self.opencti.log(
+                "error", "[opencti_stix] Missing parameters: id"
+            )
+            return None
+

pycti/entities/opencti_stix_core_object.py

@@ -0,0 +1,56 @@
+# coding: utf-8
+
+import json
+import os
+
+import magic
+
+
+class StixCoreObject:
+    def __init__(self, opencti, file):
+        self.opencti = opencti
+        self.file = file
+
+    """
+        Update a Stix-Domain-Object object field
+
+        :param id: the Stix-Domain-Object id
+        :param key: the key of the field
+        :param value: the value of the field
+        :return The updated Stix-Domain-Object object
+    """
+
+    def merge(self, **kwargs):
+        id = kwargs.get("id", None)
+        stix_core_objects_ids = kwargs.get("object_ids", None)
+        if id is not None and stix_core_objects_ids is not None:
+            self.opencti.log(
+                "info", "Merging Core object {" + id + "} with {" + ','.join(stix_core_objects_ids) + "}."
+            )
+            query = """
+                    mutation StixCoreObjectEdit($id: ID!, $stixCoreObjectsIds: [String]!) {
+                        stixCoreObjectEdit(id: $id) {
+                            merge(stixCoreObjectsIds: $stixCoreObjectsIds) {
+                                id
+                                standard_id
+                                entity_type
+                            }
+                        }
+                    }
+                """
+            result = self.opencti.query(
+                query,
+                {
+                    "id": id,
+                    "stixCoreObjectsIds": stix_core_objects_ids,
+                },
+            )
+            return self.opencti.process_multiple_fields(
+                result["data"]["stixCoreObjectEdit"]["merge"]
+            )
+        else:
+            self.opencti.log(
+                "error",
+                "[opencti_stix_core_object] Missing parameters: id and object_ids",
+            )
+            return None

pycti/entities/opencti_stix_core_relationship.py

@@ -536,6 +536,7 @@ def update_field(self, **kwargs):
         id = kwargs.get("id", None)
         key = kwargs.get("key", None)
         value = kwargs.get("value", None)
+        operation = kwargs.get("operation", "replace")
         if isinstance(value, list):
             value = [str(v) for v in value]
         else:
@@ -546,9 +547,9 @@ def update_field(self, **kwargs):
                 "Updating stix_core_relationship {" + id + "} field {" + key + "}.",
             )
             query = """
-                    mutation StixCoreRelationshipEdit($id: ID!, $input: EditInput!) {
+                    mutation StixCoreRelationshipEdit($id: ID!, $input: EditInput!, $operation: EditOperation) {
                         stixCoreRelationshipEdit(id: $id) {
-                            fieldPatch(input: $input) {
+                            fieldPatch(input: $input, operation: $operation) {
                                 id
                                 standard_id
                                 entity_type
@@ -557,7 +558,11 @@ def update_field(self, **kwargs):
                     }
                 """
             result = self.opencti.query(
-                query, {"id": id, "input": {"key": key, "value": value}}
+                query, {
+                    "id": id,
+                    "input": {"key": key, "value": value},
+                    "operation": operation
+                }
             )
             return self.opencti.process_multiple_fields(
                 result["data"]["stixCoreRelationshipEdit"]["fieldPatch"]
@@ -1068,16 +1073,8 @@ def import_from_stix2(self, **kwargs):
                 stix_relation["relationship_type"] = "part-of"
             elif stix_relation["relationship_type"] == "localization":
                 stix_relation["relationship_type"] = "located-at"
-            source_ref = (
-                stix_relation["x_opencti_source_ref"]
-                if "x_opencti_source_ref" in stix_relation
-                else stix_relation["source_ref"]
-            )
-            target_ref = (
-                stix_relation["x_opencti_target_ref"]
-                if "x_opencti_target_ref" in stix_relation
-                else stix_relation["target_ref"]
-            )
+            source_ref = stix_relation["source_ref"]
+            target_ref = stix_relation["target_ref"]
             return self.create(
                 fromId=source_ref,
                 toId=target_ref,