|
1 | | -# coding: utf-8 |
2 | | - |
3 | | -from pycti import OpenCTIApiClient |
4 | | - |
5 | | -# Variables |
6 | | -api_url = "http://opencti:4000" |
7 | | -api_token = "bfa014e0-e02e-4aa6-a42b-603b19dcf159" |
8 | | -malware = "Emotet" |
9 | | - |
10 | | -# OpenCTI initialization |
11 | | -opencti_api_client = OpenCTIApiClient(api_url, api_token) |
12 | | - |
13 | | -# Get the malware set in variable |
14 | | -malware = opencti_api_client.malware.read( |
15 | | - filters={ |
16 | | - "mode": "and", |
17 | | - "filters": [{"key": "name", "values": [malware]}], |
18 | | - "filterGroups": [], |
19 | | - } |
20 | | -) |
21 | | - |
22 | | -# Get the relations from the malware to indicators |
23 | | -stix_relations = opencti_api_client.stix_core_relationship.list( |
24 | | - fromTypes=["Indicator"], toId=malware["id"] |
25 | | -) |
26 | | - |
27 | | -# Print |
28 | | -for stix_relation in stix_relations: |
29 | | - print( |
30 | | - "[" |
31 | | - + stix_relation["from"]["standard_id"] |
32 | | - + "] " |
33 | | - + stix_relation["from"]["name"] |
34 | | - ) |
| 1 | +# coding: utf-8 |
| 2 | + |
| 3 | +from pycti import OpenCTIApiClient |
| 4 | + |
| 5 | +# Variables |
| 6 | +api_url = "http://opencti:4000" |
| 7 | +api_token = "bfa014e0-e02e-4aa6-a42b-603b19dcf159" |
| 8 | +malwareName = "Emotet" |
| 9 | + |
| 10 | +# OpenCTI initialization |
| 11 | +opencti_api_client = OpenCTIApiClient(api_url, api_token) |
| 12 | + |
| 13 | +# Get the malware set in variable |
| 14 | +malwareEntity = opencti_api_client.malware.read( |
| 15 | + filters={ |
| 16 | + "mode": "and", |
| 17 | + "filters": [{"key": "name", "values": [malwareName]}], |
| 18 | + "filterGroups": [], |
| 19 | + } |
| 20 | +) |
| 21 | +print("Malware found") |
| 22 | +print(malwareEntity) |
| 23 | + |
| 24 | +# Get the relations from the malware to indicators |
| 25 | +stix_relations = opencti_api_client.stix_core_relationship.list( |
| 26 | + fromTypes=["Indicator"], toId=malwareEntity["id"] |
| 27 | +) |
| 28 | + |
| 29 | +# Print |
| 30 | +for stix_relation in stix_relations: |
| 31 | + print( |
| 32 | + "[" |
| 33 | + + stix_relation["from"]["standard_id"] |
| 34 | + + "] " |
| 35 | + + stix_relation["from"]["name"] |
| 36 | + ) |
0 commit comments