pycti.api.opencti_api_playbook

Classes

OpenCTIApiPlaybook

OpenCTI Playbook API class.

Module Contents

class pycti.api.opencti_api_playbook.OpenCTIApiPlaybook(api)

OpenCTI Playbook API class.

Manages playbook operations.

Parameters:

api (OpenCTIApiClient) – instance of OpenCTIApiClient

Initialize the OpenCTIApiPlaybook instance.

Parameters:

api (OpenCTIApiClient) – OpenCTI API client instance

api

playbook_step_execution(playbook: dict, bundle: str)

Execute a playbook step.

Parameters:

• playbook (dict) – the playbook configuration dict containing execution_id, event_id, execution_start, playbook_id, data_instance_id, step_id, previous_step_id, and previous_bundle

• bundle (str) – the STIX bundle to process

Returns:

None

Return type:

None

delete(**kwargs)

Delete a playbook.

Parameters:

id (str) – the playbook id

Returns:

None

Return type:

None

playbook_execute(playbook_id: str, entity_id: str)

Enroll a playbook on an entity.

Parameters:

• playbook_id (str) – the playbook id

• entity_id (str) – the entity id to enroll the playbook on

Returns:

None

Return type:

None