pycti.entities.opencti_threat_actor =================================== .. py:module:: pycti.entities.opencti_threat_actor Classes ------- .. autoapisummary:: pycti.entities.opencti_threat_actor.ThreatActor Module Contents --------------- .. py:class:: ThreatActor(opencti) Main ThreatActor class for OpenCTI Manages threat actor entities (groups and individuals) in the OpenCTI platform. :param opencti: instance of :py:class:`~pycti.api.opencti_api_client.OpenCTIApiClient` :type opencti: OpenCTIApiClient Initialize the ThreatActor instance. :param opencti: OpenCTI API client instance :type opencti: OpenCTIApiClient .. py:attribute:: opencti .. py:attribute:: threat_actor_group .. py:attribute:: threat_actor_individual .. py:attribute:: properties :value: Multiline-String .. raw:: html
Show Value .. code-block:: python """ id standard_id entity_type parent_types spec_version created_at updated_at createdBy { ... on Identity { id standard_id entity_type parent_types spec_version identity_class name description roles contact_information x_opencti_aliases created modified objectLabel { id value color } } ... on Organization { x_opencti_organization_type x_opencti_reliability } ... on Individual { x_opencti_firstname x_opencti_lastname } } objectOrganization { id standard_id name } objectMarking { id standard_id entity_type definition_type definition created modified x_opencti_order x_opencti_color } objectLabel { id value color } externalReferences { edges { node { id standard_id entity_type source_name description url hash external_id created modified importFiles { edges { node { id name size metaData { mimetype version } } } } } } } revoked confidence created modified name description aliases threat_actor_types first_seen last_seen roles goals sophistication resource_level primary_motivation secondary_motivations importFiles { edges { node { id name size metaData { mimetype version } objectMarking { id standard_id entity_type definition_type definition created modified x_opencti_order x_opencti_color } } } } """ .. raw:: html
.. py:method:: generate_id(name, opencti_type) :staticmethod: Generate a STIX ID for a Threat Actor. :param name: the name of the Threat Actor :type name: str :param opencti_type: the type of the Threat Actor (e.g., 'Threat-Actor-Group') :type opencti_type: str :return: STIX ID for the Threat Actor :rtype: str .. py:method:: generate_id_from_data(data) Generate a STIX ID from Threat Actor data. :param data: Dictionary containing 'name' and optionally 'x_opencti_type' keys :type data: dict :return: STIX ID for the Threat Actor :rtype: str .. py:method:: list(**kwargs) -> dict List Threat-Actor objects. :param filters: the filters to apply :type filters: dict :param search: the search keyword :type search: str :param first: return the first n rows from the after ID (or the beginning if not set) :type first: int :param after: ID of the first row for pagination :type after: str :param orderBy: field to order results by :type orderBy: str :param orderMode: ordering mode (asc/desc) :type orderMode: str :param customAttributes: custom attributes to return :type customAttributes: str :param getAll: whether to retrieve all results :type getAll: bool :param withPagination: whether to include pagination info :type withPagination: bool :return: List of Threat-Actor objects :rtype: list .. py:method:: read(**kwargs) -> Union[dict, None] Read a Threat-Actor object. :param id: the id of the Threat-Actor :type id: str :param filters: the filters to apply if no id provided :type filters: dict :param customAttributes: custom attributes to return :type customAttributes: str :return: Threat-Actor object :rtype: dict or None .. py:method:: create(**kwargs) Create a Threat-Actor-Group object (deprecated). .. deprecated:: Use :meth:`threat_actor_group.create` or :meth:`threat_actor_individual.create` instead. .. py:method:: import_from_stix2(**kwargs) Import a Threat-Actor object from a STIX2 object. :param stixObject: the STIX2 Threat-Actor object :type stixObject: dict :return: Threat-Actor object :rtype: dict or None