Skip to content
This repository was archived by the owner on Dec 5, 2025. It is now read-only.

Commit d2ce9cb

Browse files
JeremyCloarecJeremyCloarec
committed
[client] add remove from draft/share/unshare methods for sightings and relationships
1 parent fac1505 commit d2ce9cb

File tree

3 files changed

+207
-7
lines changed

3 files changed

+207
-7
lines changed

‎pycti/entities/opencti_stix_core_relationship.py‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1247,3 +1247,88 @@ def import_from_stix2(self, **kwargs):
12471247
self.opencti.app_logger.error(
12481248
"[opencti_stix_core_relationship] Missing parameters: stixObject"
12491249
)
1250+
1251+
1252+
"""
1253+
Share element to multiple organizations
1254+
1255+
:param entity_id: the stix_core_relationship id
1256+
:param organization_id:s the organization to share with
1257+
:return void
1258+
"""
1259+
1260+
1261+
def organization_share(self, entity_id, organization_ids, sharing_direct_container):
1262+
query = """
1263+
mutation StixCoreRelationshipEdit($id: ID!, $organizationId: [ID!]!, $directContainerSharing: Boolean) {
1264+
stixCoreRelationshipEdit(id: $id) {
1265+
restrictionOrganizationAdd(organizationId: $organizationId, directContainerSharing: $directContainerSharing) {
1266+
id
1267+
}
1268+
}
1269+
}
1270+
"""
1271+
self.opencti.query(
1272+
query,
1273+
{
1274+
"id": entity_id,
1275+
"organizationId": organization_ids,
1276+
"directContainerSharing": sharing_direct_container,
1277+
},
1278+
)
1279+
1280+
1281+
"""
1282+
Unshare element from multiple organizations
1283+
1284+
:param entity_id: the stix_core_relationship id
1285+
:param organization_id:s the organization to share with
1286+
:return void
1287+
"""
1288+
1289+
1290+
def organization_unshare(self, entity_id, organization_ids, sharing_direct_container):
1291+
query = """
1292+
mutation StixCoreRelationshipEdit($id: ID!, $organizationId: [ID!]!, $directContainerSharing: Boolean) {
1293+
stixCoreRelationshipEdit(id: $id) {
1294+
restrictionOrganizationDelete(organizationId: $organizationId, directContainerSharing: $directContainerSharing) {
1295+
id
1296+
}
1297+
}
1298+
}
1299+
"""
1300+
self.opencti.query(
1301+
query,
1302+
{
1303+
"id": entity_id,
1304+
"organizationId": organization_ids,
1305+
"directContainerSharing": sharing_direct_container,
1306+
},
1307+
)
1308+
1309+
1310+
"""
1311+
Remove a stix_core_relationship object from draft (revert)
1312+
1313+
:param id: the stix_core_relationship id
1314+
:return void
1315+
"""
1316+
1317+
1318+
def remove_from_draft(self, **kwargs):
1319+
id = kwargs.get("id", None)
1320+
if id is not None:
1321+
self.opencti.app_logger.info("Draft remove stix_core_relationship", {"id": id})
1322+
query = """
1323+
mutation StixCoreRelationshipEditDraftRemove($id: ID!) {
1324+
stixCoreRelationshipEdit(id: $id) {
1325+
removeFromDraft
1326+
}
1327+
}
1328+
"""
1329+
self.opencti.query(query, {"id": id})
1330+
else:
1331+
self.opencti.app_logger.error(
1332+
"[stix_core_relationship] Cant remove from draft, missing parameters: id"
1333+
)
1334+
return None

‎pycti/entities/opencti_stix_sighting_relationship.py‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -802,6 +802,91 @@ def update_created_by(self, **kwargs):
802802
self.opencti.app_logger.error("Missing parameters: id")
803803
return False
804804

805+
806+
"""
807+
Share element to multiple organizations
808+
809+
:param entity_id: the stix_sighting id
810+
:param organization_id:s the organization to share with
811+
:return void
812+
"""
813+
814+
815+
def organization_share(self, entity_id, organization_ids, sharing_direct_container):
816+
query = """
817+
mutation StixSightingRelationshipEdit($id: ID!, $organizationId: [ID!]!, $directContainerSharing: Boolean) {
818+
stixSightingRelationshipEdit(id: $id) {
819+
restrictionOrganizationAdd(organizationId: $organizationId, directContainerSharing: $directContainerSharing) {
820+
id
821+
}
822+
}
823+
}
824+
"""
825+
self.opencti.query(
826+
query,
827+
{
828+
"id": entity_id,
829+
"organizationId": organization_ids,
830+
"directContainerSharing": sharing_direct_container,
831+
},
832+
)
833+
834+
835+
"""
836+
Unshare element from multiple organizations
837+
838+
:param entity_id: the stix_sighting id
839+
:param organization_id:s the organization to share with
840+
:return void
841+
"""
842+
843+
844+
def organization_unshare(self, entity_id, organization_ids, sharing_direct_container):
845+
query = """
846+
mutation StixSightingRelationshipEdit($id: ID!, $organizationId: [ID!]!, $directContainerSharing: Boolean) {
847+
stixSightingRelationshipEdit(id: $id) {
848+
restrictionOrganizationDelete(organizationId: $organizationId, directContainerSharing: $directContainerSharing) {
849+
id
850+
}
851+
}
852+
}
853+
"""
854+
self.opencti.query(
855+
query,
856+
{
857+
"id": entity_id,
858+
"organizationId": organization_ids,
859+
"directContainerSharing": sharing_direct_container,
860+
},
861+
)
862+
863+
864+
"""
865+
Remove a stix_sighting object from draft (revert)
866+
867+
:param id: the stix_sighting id
868+
:return void
869+
"""
870+
871+
872+
def remove_from_draft(self, **kwargs):
873+
id = kwargs.get("id", None)
874+
if id is not None:
875+
self.opencti.app_logger.info("Draft remove stix_sighting", {"id": id})
876+
query = """
877+
mutation StixSightingRelationshipEditDraftRemove($id: ID!) {
878+
stixSightingRelationshipEdit(id: $id) {
879+
removeFromDraft
880+
}
881+
}
882+
"""
883+
self.opencti.query(query, {"id": id})
884+
else:
885+
self.opencti.app_logger.error(
886+
"[stix_sighting] Cant remove from draft, missing parameters: id"
887+
)
888+
return None
889+
805890
"""
806891
Delete a stix_sighting
807892

‎pycti/utils/opencti_stix2.py‎

Lines changed: 37 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2522,9 +2522,20 @@ def organization_share(self, item):
25222522
)
25232523
if sharing_direct_container is None:
25242524
sharing_direct_container = item["sharing_direct_container"]
2525-
self.opencti.stix_core_object.organization_share(
2526-
item["id"], organization_ids, sharing_direct_container
2527-
)
2525+
2526+
if item["type"] == "relationship":
2527+
self.opencti.stix_core_relationship.organization_share(
2528+
item["id"], organization_ids, sharing_direct_container
2529+
)
2530+
elif item["type"] == "sighting":
2531+
self.opencti.stix_sighting_relationship.organization_share(
2532+
item["id"], organization_ids, sharing_direct_container
2533+
)
2534+
else:
2535+
# Element is considered stix core object
2536+
self.opencti.stix_core_object.organization_share(
2537+
item["id"], organization_ids, sharing_direct_container
2538+
)
25282539

25292540
def organization_unshare(self, item):
25302541
organization_ids = self.opencti.get_attribute_in_extension(
@@ -2537,9 +2548,19 @@ def organization_unshare(self, item):
25372548
)
25382549
if sharing_direct_container is None:
25392550
sharing_direct_container = item["sharing_direct_container"]
2540-
self.opencti.stix_core_object.organization_unshare(
2541-
item["id"], organization_ids, sharing_direct_container
2542-
)
2551+
if item["type"] == "relationship":
2552+
self.opencti.stix_core_relationship.organization_unshare(
2553+
item["id"], organization_ids, sharing_direct_container
2554+
)
2555+
elif item["type"] == "sighting":
2556+
self.opencti.stix_sighting_relationship.organization_unshare(
2557+
item["id"], organization_ids, sharing_direct_container
2558+
)
2559+
else:
2560+
# Element is considered stix core object
2561+
self.opencti.stix_core_object.organization_unshare(
2562+
item["id"], organization_ids, sharing_direct_container
2563+
)
25432564

25442565
def element_operation_delete(self, item, operation):
25452566
# If data is stix, just use the generic stix function for deletion
@@ -2564,11 +2585,20 @@ def element_operation_delete(self, item, operation):
25642585
"Delete operation or not found stix helper", {"type": item["type"]}
25652586
)
25662587

2588+
def element_remove_from_draft(self, item):
2589+
if item["type"] == "relationship":
2590+
self.opencti.stix_core_relationship.remove_from_draft(id=item["id"])
2591+
elif item["type"] == "sighting":
2592+
self.opencti.stix_sighting_relationship.remove_from_draft(id=item["id"])
2593+
else:
2594+
# Element is considered stix core object
2595+
self.opencti.stix_core_object.remove_from_draft(id=item["id"])
2596+
25672597
def apply_opencti_operation(self, item, operation):
25682598
if operation == "delete" or operation == "delete_force":
25692599
self.element_operation_delete(item=item, operation=operation)
25702600
elif operation == "revert_draft":
2571-
self.opencti.stix_core_object.remove_from_draft(id=item["id"])
2601+
self.element_remove_from_draft(item=item)
25722602
elif operation == "restore":
25732603
self.opencti.trash.restore(item["id"])
25742604
elif operation == "merge":

0 commit comments

Comments
 (0)