pycti.entities.opencti_case_incident
====================================

.. py:module:: pycti.entities.opencti_case_incident


Classes
-------

.. autoapisummary::

   pycti.entities.opencti_case_incident.CaseIncident


Module Contents
---------------

.. py:class:: CaseIncident(opencti)

   Main CaseIncident class for OpenCTI

   Manages incident response cases in the OpenCTI platform.

   :param opencti: instance of :py:class:`~pycti.api.opencti_api_client.OpenCTIApiClient`
   :type opencti: OpenCTIApiClient

   Initialize the CaseIncident instance.

   :param opencti: OpenCTI API client instance
   :type opencti: OpenCTIApiClient


   .. py:attribute:: opencti


   .. py:attribute:: properties
      :value: Multiline-String

      .. raw:: html

         <details><summary>Show Value</summary>

      .. code-block:: python

         """
                     id
                     standard_id
                     entity_type
                     parent_types
                     spec_version
                     created_at
                     updated_at
                     status {
                         id
                         template {
                           id
                           name
                           color
                         }
                     }
                     createdBy {
                         ... on Identity {
                             id
                             standard_id
                             entity_type
                             parent_types
                             spec_version
                             identity_class
                             name
                             description
                             roles
                             contact_information
                             x_opencti_aliases
                             created
                             modified
                             objectLabel {
                                 id
                                 value
                                 color
                             }
                         }
                         ... on Organization {
                             x_opencti_organization_type
                             x_opencti_reliability
                         }
                         ... on Individual {
                             x_opencti_firstname
                             x_opencti_lastname
                         }
                     }
                     objectOrganization {
                         id
                         standard_id
                         name
                     }
                     objectMarking {
                         id
                         standard_id
                         entity_type
                         definition_type
                         definition
                         created
                         modified
                         x_opencti_order
                         x_opencti_color
                     }
                     objectLabel {
                         id
                         value
                         color
                     }
                     externalReferences {
                         edges {
                             node {
                                 id
                                 standard_id
                                 entity_type
                                 source_name
                                 description
                                 url
                                 hash
                                 external_id
                                 created
                                 modified
                             }
                         }
                     }
                     revoked
                     confidence
                     created
                     modified
                     name
                     description
                     rating
                     severity
                     priority
                     response_types
                     tasks {
                         edges {
                             node {
                                 name
                                 description
                                 due_date
                                 status {
                                   id
                                   template {
                                     id
                                     name
                                     color
                                   }
                                 }
                             }
                         }
                     }
                     objects(all: true) {
                         edges {
                             node {
                                 ... on BasicObject {
                                     id
                                     entity_type
                                     parent_types
                                 }
                                 ... on BasicRelationship {
                                     id
                                     entity_type
                                     parent_types
                                 }
                                 ... on StixObject {
                                     standard_id
                                     spec_version
                                     created_at
                                     updated_at
                                 }
                                 ... on AttackPattern {
                                     name
                                 }
                                 ... on Campaign {
                                     name
                                 }
                                 ... on CourseOfAction {
                                     name
                                 }
                                 ... on Individual {
                                     name
                                 }
                                 ... on Organization {
                                     name
                                 }
                                 ... on Sector {
                                     name
                                 }
                                 ... on System {
                                     name
                                 }
                                 ... on Indicator {
                                     name
                                 }
                                 ... on Infrastructure {
                                     name
                                 }
                                 ... on IntrusionSet {
                                     name
                                 }
                                 ... on Position {
                                     name
                                 }
                                 ... on City {
                                     name
                                 }
                                 ... on Country {
                                     name
                                 }
                                 ... on Region {
                                     name
                                 }
                                 ... on Malware {
                                     name
                                 }
                                 ... on ThreatActor {
                                     name
                                 }
                                 ... on Tool {
                                     name
                                 }
                                 ... on Vulnerability {
                                     name
                                 }
                                 ... on Incident {
                                     name
                                 }
                                 ... on Event {
                                     name
                                 }
                                 ... on Channel {
                                     name
                                 }
                                 ... on Narrative {
                                     name
                                 }
                                 ... on Language {
                                     name
                                 }
                                 ... on DataComponent {
                                     name
                                 }
                                 ... on DataSource {
                                     name
                                 }
                                 ... on StixCyberObservable {
                                     observable_value
                                 }
                                 ... on StixCoreRelationship {
                                     standard_id
                                     spec_version
                                     created_at
                                     updated_at
                                     relationship_type
                                 }
                                ... on StixSightingRelationship {
                                     standard_id
                                     spec_version
                                     created_at
                                     updated_at
                                 }
                             }
                         }
                     }
                 """

      .. raw:: html

         </details>




   .. py:attribute:: properties_with_files
      :value: Multiline-String

      .. raw:: html

         <details><summary>Show Value</summary>

      .. code-block:: python

         """
                     id
                     standard_id
                     entity_type
                     parent_types
                     spec_version
                     created_at
                     updated_at
                     status {
                         id
                         template {
                           id
                           name
                           color
                         }
                     }
                     createdBy {
                         ... on Identity {
                             id
                             standard_id
                             entity_type
                             parent_types
                             spec_version
                             identity_class
                             name
                             description
                             roles
                             contact_information
                             x_opencti_aliases
                             created
                             modified
                             objectLabel {
                                 id
                                 value
                                 color
                             }
                         }
                         ... on Organization {
                             x_opencti_organization_type
                             x_opencti_reliability
                         }
                         ... on Individual {
                             x_opencti_firstname
                             x_opencti_lastname
                         }
                     }
                     objectOrganization {
                         id
                         standard_id
                         name
                     }
                     objectMarking {
                         id
                         standard_id
                         entity_type
                         definition_type
                         definition
                         created
                         modified
                         x_opencti_order
                         x_opencti_color
                     }
                     objectLabel {
                         id
                         value
                         color
                     }
                     externalReferences {
                         edges {
                             node {
                                 id
                                 standard_id
                                 entity_type
                                 source_name
                                 description
                                 url
                                 hash
                                 external_id
                                 created
                                 modified
                                 importFiles {
                                     edges {
                                         node {
                                             id
                                             name
                                             size
                                             metaData {
                                                 mimetype
                                                 version
                                             }
                                         }
                                     }
                                 }
                             }
                         }
                     }
                     revoked
                     confidence
                     created
                     modified
                     name
                     description
                     rating
                     severity
                     priority
                     response_types
                     objects(all: true) {
                         edges {
                             node {
                                 ... on BasicObject {
                                     id
                                     entity_type
                                     parent_types
                                 }
                                 ... on BasicRelationship {
                                     id
                                     entity_type
                                     parent_types
                                 }
                                 ... on StixObject {
                                     standard_id
                                     spec_version
                                     created_at
                                     updated_at
                                 }
                                 ... on AttackPattern {
                                     name
                                 }
                                 ... on Campaign {
                                     name
                                 }
                                 ... on CourseOfAction {
                                     name
                                 }
                                 ... on Individual {
                                     name
                                 }
                                 ... on Organization {
                                     name
                                 }
                                 ... on Sector {
                                     name
                                 }
                                 ... on System {
                                     name
                                 }
                                 ... on Indicator {
                                     name
                                 }
                                 ... on Infrastructure {
                                     name
                                 }
                                 ... on IntrusionSet {
                                     name
                                 }
                                 ... on Position {
                                     name
                                 }
                                 ... on City {
                                     name
                                 }
                                 ... on Country {
                                     name
                                 }
                                 ... on Region {
                                     name
                                 }
                                 ... on Malware {
                                     name
                                 }
                                 ... on ThreatActor {
                                     name
                                 }
                                 ... on Tool {
                                     name
                                 }
                                 ... on Vulnerability {
                                     name
                                 }
                                 ... on Incident {
                                     name
                                 }
                                 ... on Event {
                                     name
                                 }
                                 ... on Channel {
                                     name
                                 }
                                 ... on Narrative {
                                     name
                                 }
                                 ... on Language {
                                     name
                                 }
                                 ... on DataComponent {
                                     name
                                 }
                                 ... on DataSource {
                                     name
                                 }
                                 ... on StixCyberObservable {
                                     observable_value
                                 }
                                 ... on StixCoreRelationship {
                                     standard_id
                                     spec_version
                                     created_at
                                     updated_at
                                     relationship_type
                                 }
                                ... on StixSightingRelationship {
                                     standard_id
                                     spec_version
                                     created_at
                                     updated_at
                                 }
                             }
                         }
                     }
                     importFiles {
                         edges {
                             node {
                                 id
                                 name
                                 size
                                 metaData {
                                     mimetype
                                     version
                                 }
                                 objectMarking {
                                     id
                                     standard_id
                                     entity_type
                                     definition_type
                                     definition
                                     created
                                     modified
                                     x_opencti_order
                                     x_opencti_color
                                 }
                             }
                         }
                     }
                 """

      .. raw:: html

         </details>




   .. py:method:: generate_id(name, created)
      :staticmethod:


      Generate a STIX ID for a Case Incident object.

      :param name: the name of the Case Incident
      :type name: str
      :param created: the creation date of the Case Incident
      :type created: str or datetime.datetime
      :return: STIX ID for the Case Incident
      :rtype: str



   .. py:method:: generate_id_from_data(data)
      :staticmethod:


      Generate a STIX ID from Case Incident data.

      :param data: Dictionary containing 'name' and 'created' keys
      :type data: dict
      :return: STIX ID for the Case Incident
      :rtype: str



   .. py:method:: list(**kwargs)

      List Case Incident objects.

      :param filters: the filters to apply
      :type filters: dict
      :param search: the search keyword
      :type search: str
      :param first: return the first n rows from the after ID (or the beginning if not set)
      :type first: int
      :param after: ID of the first row for pagination
      :type after: str
      :return: List of Case Incident objects
      :rtype: list



   .. py:method:: read(**kwargs)

      Read a Case Incident object.

      :param id: the id of the Case Incident
      :type id: str
      :param filters: the filters to apply if no id provided
      :type filters: dict
      :return: Case Incident object
      :rtype: dict or None



   .. py:method:: get_by_stix_id_or_name(**kwargs)

      Read a Case Incident object by stix_id or name.

      :param stix_id: the STIX ID of the Case Incident
      :type stix_id: str
      :param name: the name of the Case Incident
      :type name: str
      :param created: the creation date of the Case Incident
      :type created: str
      :return: Case Incident object
      :rtype: dict or None



   .. py:method:: contains_stix_object_or_stix_relationship(**kwargs)

      Check if a case incident already contains a thing (Stix Object or Stix Relationship).

      :param id: the id of the Case Incident
      :type id: str
      :param stixObjectOrStixRelationshipId: the id of the Stix-Entity
      :type stixObjectOrStixRelationshipId: str
      :return: True if contained, False otherwise
      :rtype: bool or None



   .. py:method:: create(**kwargs)

      Create a Case Incident object

      :param stix_id: (optional) the STIX ID
      :param createdBy: (optional) the author ID
      :param objects: (optional) list of STIX object IDs contained in the case
      :param objectMarking: (optional) list of marking definition IDs
      :param objectLabel: (optional) list of label IDs
      :param externalReferences: (optional) list of external reference IDs
      :param revoked: (optional) whether the case is revoked
      :param confidence: (optional) confidence level (0-100)
      :param lang: (optional) language
      :param created: (optional) creation date
      :param modified: (optional) modification date
      :param name: the name of the Case Incident (required)
      :param description: (optional) description
      :param content: (optional) content
      :param severity: (optional) severity level
      :param priority: (optional) priority level
      :param x_opencti_stix_ids: (optional) list of additional STIX IDs
      :param objectAssignee: (optional) list of assignee IDs
      :param objectParticipant: (optional) list of participant IDs
      :param objectOrganization: (optional) list of organization IDs
      :param response_types: (optional) list of response types
      :param x_opencti_workflow_id: (optional) workflow ID
      :param x_opencti_modified_at: (optional) custom modification date
      :param update: (optional) whether to update if exists (default: False)
      :type update: bool
      :param files: (optional) list of File objects to attach
      :type files: list
      :param filesMarkings: (optional) list of lists of marking definition IDs for each file
      :type filesMarkings: list
      :return: Case Incident object
      :rtype: dict or None



   .. py:method:: add_stix_object_or_stix_relationship(**kwargs)

      Add a Stix-Entity object to Case Incident object (object_refs).

      :param id: the id of the Case Incident
      :type id: str
      :param stixObjectOrStixRelationshipId: the id of the Stix-Entity
      :type stixObjectOrStixRelationshipId: str
      :return: True if successful, False otherwise
      :rtype: bool



   .. py:method:: remove_stix_object_or_stix_relationship(**kwargs)

      Remove a Stix-Entity object from Case Incident object (object_refs).

      :param id: the id of the Case Incident
      :type id: str
      :param stixObjectOrStixRelationshipId: the id of the Stix-Entity
      :type stixObjectOrStixRelationshipId: str
      :return: True if successful, False otherwise
      :rtype: bool



   .. py:method:: import_from_stix2(**kwargs)

      Import a Case Incident object from a STIX2 object.

      :param stixObject: the Stix-Object Case Incident
      :type stixObject: dict
      :param extras: additional parameters like created_by_id, object_marking_ids
      :type extras: dict
      :param update: whether to update existing object
      :type update: bool
      :return: Case Incident object
      :rtype: dict or None



   .. py:method:: delete(**kwargs)

      Delete a Case Incident object.

      :param id: the id of the Case Incident to delete
      :type id: str
      :return: None