[client] Adjust new report API

Author: Samuel Hassine

pycti/api/opencti_api_client.py

@@ -110,7 +110,7 @@ def __init__(self, url, token, log_level="info", ssl_verify=False, proxies={}):
         # Define the entities
         self.label = Label(self)
         self.marking_definition = MarkingDefinition(self)
-        self.external_reference = ExternalReference(self)
+        self.external_reference = ExternalReference(self, File)
         self.kill_chain_phase = KillChainPhase(self)
         self.opencti_stix_object_or_stix_relationship = StixObjectOrStixRelationship(
             self

pycti/entities/opencti_external_reference.py

@@ -1,11 +1,14 @@
 # coding: utf-8
 
 import json
+import os
+import magic
 
 
 class ExternalReference:
-    def __init__(self, opencti):
+    def __init__(self, opencti, file):
         self.opencti = opencti
+        self.file = file
         self.properties = """
             id
             standard_id
@@ -20,6 +23,15 @@ def __init__(self, opencti):
             url
             hash
             external_id
+            importFiles {
+                edges {
+                    node {
+                        id
+                        name
+                        size
+                    }
+                }
+            }
         """
 
     """
@@ -181,6 +193,63 @@ def create(self, **kwargs):
                 "[opencti_external_reference] Missing parameters: source_name and url",
             )
 
+    """
+        Upload a file in this External-Reference
+
+        :param id: the Stix-Domain-Object id
+        :param file_name
+        :param data
+        :return void
+    """
+
+    def add_file(self, **kwargs):
+        id = kwargs.get("id", None)
+        file_name = kwargs.get("file_name", None)
+        data = kwargs.get("data", None)
+        mime_type = kwargs.get("mime_type", "text/plain")
+        if id is not None and file_name is not None:
+            external_reference = self.read(id=id)
+            if external_reference is None:
+                self.opencti.log("error", "Cannot add File, entity not found")
+                return False
+            final_file_name = os.path.basename(file_name)
+            current_files = {}
+            for file in external_reference["importFiles"]:
+                current_files[file["name"]] = file
+            if final_file_name in current_files:
+                return current_files[final_file_name]
+            else:
+                self.opencti.log(
+                    "info", "Uploading a file in Stix-Domain-Object {" + id + "}."
+                )
+                query = """
+                    mutation ExternalReferenceEdit($id: ID!, $file: Upload!) {
+                        externalReferenceEdit(id: $id) {
+                            importPush(file: $file) {
+                                id
+                                name
+                            }
+                        }
+                    }
+                 """
+                if data is None:
+                    data = open(file_name, "rb")
+                    if file_name.endswith(".json"):
+                        mime_type = "application/json"
+                    else:
+                        mime_type = magic.from_file(file_name, mime=True)
+
+                return self.opencti.query(
+                    query,
+                    {"id": id, "file": (self.file(final_file_name, data, mime_type))},
+                )
+        else:
+            self.opencti.log(
+                "error",
+                "[opencti_stix_domain_object] Missing parameters: id or file_name",
+            )
+            return None
+
     """
         Update a External Reference object field
 

pycti/entities/opencti_report.py

@@ -99,7 +99,6 @@ def __init__(self, opencti):
             report_types
             published
             x_opencti_graph_data
-            x_opencti_report_status
             objects {
                 edges {
                     node {
@@ -399,7 +398,6 @@ def create(self, **kwargs):
         description = kwargs.get("description", "")
         report_types = kwargs.get("report_types", None)
         published = kwargs.get("published", None)
-        x_opencti_report_status = kwargs.get("x_opencti_report_status", None)
         x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None)
         update = kwargs.get("update", False)
 
@@ -433,7 +431,6 @@ def create(self, **kwargs):
                         "description": description,
                         "report_types": report_types,
                         "published": published,
-                        "x_opencti_report_status": x_opencti_report_status,
                         "x_opencti_stix_ids": x_opencti_stix_ids,
                         "update": update,
                     }
@@ -568,12 +565,6 @@ def import_from_stix2(self, **kwargs):
                     if "x_opencti_source_confidence_level" in stix_object
                     else 0
                 )
-            if "x_opencti_report_status" not in stix_object:
-                stix_object["x_opencti_report_status"] = (
-                    stix_object["x_opencti_object_status"]
-                    if "x_opencti_object_status" in stix_object
-                    else 0
-                )
 
             return self.create(
                 stix_id=stix_object["id"],
@@ -608,9 +599,6 @@ def import_from_stix2(self, **kwargs):
                 published=stix_object["published"]
                 if "published" in stix_object
                 else None,
-                x_opencti_report_status=stix_object["x_opencti_report_status"]
-                if "x_opencti_report_status" in stix_object
-                else None,
                 x_opencti_stix_ids=stix_object["x_opencti_stix_ids"]
                 if "x_opencti_stix_ids" in stix_object
                 else None,

pycti/entities/opencti_stix_domain_object.py

@@ -2,7 +2,6 @@
 
 import json
 import os
-
 import magic
 
 
@@ -183,7 +182,6 @@ def __init__(self, opencti, file):
                 description
                 report_types
                 published
-                x_opencti_report_status
                 objects {
                     edges {
                         node {

pycti/entities/opencti_stix_object_or_stix_relationship.py

@@ -145,7 +145,6 @@ def __init__(self, opencti):
                 description
                 report_types
                 published
-                x_opencti_report_status
             }
             ... on CourseOfAction {
                 name

pycti/utils/opencti_stix2.py

@@ -455,7 +455,6 @@ def extract_embedded_relationships(
                         else "",
                         report_types="threat-report",
                         published=published,
-                        x_opencti_report_status=2,
                         update=True,
                     )
                     reports[external_reference_id] = report