pycti.entities.opencti_malware ============================== .. py:module:: pycti.entities.opencti_malware Classes ------- .. autoapisummary:: pycti.entities.opencti_malware.Malware Module Contents --------------- .. py:class:: Malware(opencti) Main Malware class for OpenCTI Manages malware families and variants in the OpenCTI platform. :param opencti: instance of :py:class:`~pycti.api.opencti_api_client.OpenCTIApiClient` :type opencti: OpenCTIApiClient Initialize the Malware instance. :param opencti: OpenCTI API client instance :type opencti: OpenCTIApiClient .. py:attribute:: opencti .. py:attribute:: properties :value: Multiline-String .. raw:: html
Show Value .. code-block:: python """ id standard_id entity_type parent_types spec_version created_at updated_at status { id template { id name color } } createdBy { ... on Identity { id standard_id entity_type parent_types spec_version identity_class name description roles contact_information x_opencti_aliases created modified objectLabel { id value color } } ... on Organization { x_opencti_organization_type x_opencti_reliability } ... on Individual { x_opencti_firstname x_opencti_lastname } } objectOrganization { id standard_id name } objectMarking { id standard_id entity_type definition_type definition created modified x_opencti_order x_opencti_color } objectLabel { id value color } externalReferences { edges { node { id standard_id entity_type source_name description url hash external_id created modified } } } revoked confidence created modified name description aliases malware_types is_family first_seen last_seen architecture_execution_envs implementation_languages capabilities killChainPhases { id standard_id entity_type kill_chain_name phase_name x_opencti_order created modified } samples { id } """ .. raw:: html
.. py:attribute:: properties_with_files :value: Multiline-String .. raw:: html
Show Value .. code-block:: python """ id standard_id entity_type parent_types spec_version created_at updated_at status { id template { id name color } } createdBy { ... on Identity { id standard_id entity_type parent_types spec_version identity_class name description roles contact_information x_opencti_aliases created modified objectLabel { id value color } } ... on Organization { x_opencti_organization_type x_opencti_reliability } ... on Individual { x_opencti_firstname x_opencti_lastname } } objectOrganization { id standard_id name } objectMarking { id standard_id entity_type definition_type definition created modified x_opencti_order x_opencti_color } objectLabel { id value color } externalReferences { edges { node { id standard_id entity_type source_name description url hash external_id created modified importFiles { edges { node { id name size metaData { mimetype version } } } } } } } revoked confidence created modified name description aliases malware_types is_family first_seen last_seen architecture_execution_envs implementation_languages capabilities killChainPhases { id standard_id entity_type kill_chain_name phase_name x_opencti_order created modified } samples { id } importFiles { edges { node { id name size metaData { mimetype version } objectMarking { id standard_id entity_type definition_type definition created modified x_opencti_order x_opencti_color } } } } """ .. raw:: html
.. py:method:: generate_id(name) :staticmethod: Generate a STIX ID for a Malware. :param name: The name of the malware :type name: str :return: STIX ID for the malware :rtype: str .. py:method:: generate_id_from_data(data) :staticmethod: Generate a STIX ID from malware data. :param data: Dictionary containing 'name' key :type data: dict :return: STIX ID for the malware :rtype: str .. py:method:: list(**kwargs) List Malware objects. :param filters: the filters to apply :type filters: dict :param search: the search keyword :type search: str :param first: return the first n rows from the after ID (or the beginning if not set) :type first: int :param after: ID of the first row for pagination :type after: str :param orderBy: field to order results by :type orderBy: str :param orderMode: ordering mode (asc/desc) :type orderMode: str :param customAttributes: custom attributes to return :type customAttributes: str :param getAll: whether to retrieve all results :type getAll: bool :param withPagination: whether to include pagination info :type withPagination: bool :param withFiles: whether to include files :type withFiles: bool :return: List of Malware objects :rtype: list .. py:method:: read(**kwargs) Read a Malware object. :param id: the id of the Malware :type id: str :param filters: the filters to apply if no id provided :type filters: dict :param customAttributes: custom attributes to return :type customAttributes: str :param withFiles: whether to include files :type withFiles: bool :return: Malware object :rtype: dict or None .. py:method:: create(**kwargs) Create a Malware object. :param stix_id: (optional) the STIX ID :type stix_id: str :param name: the name of the Malware (required) :type name: str :param description: description of the malware :type description: str :param aliases: list of aliases :type aliases: list :param malware_types: types of malware :type malware_types: list :param is_family: whether this is a malware family :type is_family: bool :param first_seen: first seen date :type first_seen: str :param last_seen: last seen date :type last_seen: str :param architecture_execution_envs: execution environments :type architecture_execution_envs: list :param implementation_languages: implementation languages :type implementation_languages: list :param capabilities: malware capabilities :type capabilities: list :param killChainPhases: kill chain phases :type killChainPhases: list :param samples: malware samples :type samples: list :param createdBy: creator identity ID :type createdBy: str :param objectMarking: marking definition IDs :type objectMarking: list :param objectLabel: label IDs :type objectLabel: list :param externalReferences: external reference IDs :type externalReferences: list :param objectOrganization: organization IDs :type objectOrganization: list :param revoked: whether the malware is revoked :type revoked: bool :param confidence: confidence level (0-100) :type confidence: int :param lang: language :type lang: str :param created: creation date :type created: str :param modified: modification date :type modified: str :param x_opencti_stix_ids: additional STIX IDs :type x_opencti_stix_ids: list :param x_opencti_workflow_id: workflow ID :type x_opencti_workflow_id: str :param x_opencti_modified_at: custom modification date :type x_opencti_modified_at: str :param update: whether to update existing malware :type update: bool :param files: (optional) list of File objects to attach :type files: list :param filesMarkings: (optional) list of lists of marking definition IDs for each file :type filesMarkings: list :return: Malware object :rtype: dict or None .. py:method:: import_from_stix2(**kwargs) Import a Malware object from a STIX2 object. :param stixObject: the STIX2 Malware object :type stixObject: dict :param extras: extra parameters including created_by_id, object_marking_ids, etc. :type extras: dict :param update: whether to update if the entity already exists :type update: bool :return: Malware object :rtype: dict or None