Skip to content
This repository was archived by the owner on Dec 5, 2025. It is now read-only.

Commit d2512c5

Browse files
committed
[client] Support workflow at identity /malware / incident creation (#433)
1 parent e4e8b73 commit d2512c5

File tree

4 files changed

+29
-2
lines changed

4 files changed

+29
-2
lines changed

pycti/entities/opencti_case_incident.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -470,9 +470,9 @@ def create(self, **kwargs):
470470
x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None)
471471
object_assignee = kwargs.get("objectAssignee", None)
472472
granted_refs = kwargs.get("objectOrganization", None)
473-
update = kwargs.get("update", False)
474473
response_types = kwargs.get("response_types", None)
475474
x_opencti_workflow_id = kwargs.get("x_opencti_workflow_id", None)
475+
update = kwargs.get("update", False)
476476

477477
if name is not None:
478478
self.opencti.log("info", "Creating Case Incident {" + name + "}.")
@@ -508,9 +508,9 @@ def create(self, **kwargs):
508508
"severity": severity,
509509
"priority": priority,
510510
"x_opencti_stix_ids": x_opencti_stix_ids,
511-
"update": update,
512511
"response_types": response_types,
513512
"x_opencti_workflow_id": x_opencti_workflow_id,
513+
"update": update,
514514
}
515515
},
516516
)

pycti/entities/opencti_identity.py

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -303,6 +303,7 @@ def create(self, **kwargs):
303303
x_opencti_firstname = kwargs.get("x_opencti_firstname", None)
304304
x_opencti_lastname = kwargs.get("x_opencti_lastname", None)
305305
x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None)
306+
x_opencti_workflow_id = kwargs.get("x_opencti_workflow_id", None)
306307
update = kwargs.get("update", False)
307308

308309
if type is not None and name is not None:
@@ -324,6 +325,7 @@ def create(self, **kwargs):
324325
"roles": roles,
325326
"x_opencti_aliases": x_opencti_aliases,
326327
"x_opencti_stix_ids": x_opencti_stix_ids,
328+
"x_opencti_workflow_id": x_opencti_workflow_id,
327329
"update": update,
328330
}
329331
if type == IdentityTypes.ORGANIZATION.value:
@@ -451,6 +453,12 @@ def import_from_stix2(self, **kwargs):
451453
stix_object[
452454
"x_opencti_stix_ids"
453455
] = self.opencti.get_attribute_in_extension("stix_ids", stix_object)
456+
if "x_opencti_workflow_id" not in stix_object:
457+
stix_object[
458+
"x_opencti_workflow_id"
459+
] = self.opencti.get_attribute_in_extension(
460+
"x_opencti_workflow_id", stix_object
461+
)
454462

455463
return self.create(
456464
type=type,
@@ -502,6 +510,9 @@ def import_from_stix2(self, **kwargs):
502510
x_opencti_stix_ids=stix_object["x_opencti_stix_ids"]
503511
if "x_opencti_stix_ids" in stix_object
504512
else None,
513+
x_opencti_workflow_id=stix_object["x_opencti_workflow_id"]
514+
if "x_opencti_workflow_id" in stix_object
515+
else None,
505516
update=update,
506517
)
507518
else:

pycti/entities/opencti_incident.py

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -298,6 +298,7 @@ def create(self, **kwargs):
298298
source = kwargs.get("source", None)
299299
x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None)
300300
granted_refs = kwargs.get("objectOrganization", None)
301+
x_opencti_workflow_id = kwargs.get("x_opencti_workflow_id", None)
301302
update = kwargs.get("update", False)
302303

303304
if name is not None:
@@ -337,6 +338,7 @@ def create(self, **kwargs):
337338
"severity": severity,
338339
"source": source,
339340
"x_opencti_stix_ids": x_opencti_stix_ids,
341+
"x_opencti_workflow_id": x_opencti_workflow_id,
340342
"update": update,
341343
}
342344
},
@@ -415,6 +417,9 @@ def import_from_stix2(self, **kwargs):
415417
objectOrganization=stix_object["x_opencti_granted_refs"]
416418
if "x_opencti_granted_refs" in stix_object
417419
else None,
420+
x_opencti_workflow_id=stix_object["x_opencti_workflow_id"]
421+
if "x_opencti_workflow_id" in stix_object
422+
else None,
418423
update=update,
419424
)
420425
else:

pycti/entities/opencti_malware.py

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -313,6 +313,7 @@ def create(self, **kwargs):
313313
kill_chain_phases = kwargs.get("killChainPhases", None)
314314
x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None)
315315
granted_refs = kwargs.get("objectOrganization", None)
316+
x_opencti_workflow_id = kwargs.get("x_opencti_workflow_id", None)
316317
update = kwargs.get("update", False)
317318

318319
if name is not None:
@@ -354,6 +355,7 @@ def create(self, **kwargs):
354355
"capabilities": capabilities,
355356
"killChainPhases": kill_chain_phases,
356357
"x_opencti_stix_ids": x_opencti_stix_ids,
358+
"x_opencti_workflow_id": x_opencti_workflow_id,
357359
"update": update,
358360
}
359361
},
@@ -383,6 +385,12 @@ def import_from_stix2(self, **kwargs):
383385
stix_object[
384386
"x_opencti_granted_refs"
385387
] = self.opencti.get_attribute_in_extension("granted_refs", stix_object)
388+
if "x_opencti_workflow_id" not in stix_object:
389+
stix_object[
390+
"x_opencti_workflow_id"
391+
] = self.opencti.get_attribute_in_extension(
392+
"x_opencti_workflow_id", stix_object
393+
)
386394

387395
return self.create(
388396
stix_id=stix_object["id"],
@@ -442,6 +450,9 @@ def import_from_stix2(self, **kwargs):
442450
objectOrganization=stix_object["x_opencti_granted_refs"]
443451
if "x_opencti_granted_refs" in stix_object
444452
else None,
453+
x_opencti_workflow_id=stix_object["x_opencti_workflow_id"]
454+
if "x_opencti_workflow_id" in stix_object
455+
else None,
445456
update=update,
446457
)
447458
else:

0 commit comments

Comments
 (0)