pycti.entities.opencti_audit

Classes

Audit

Main Audit class for OpenCTI

Module Contents

class pycti.entities.opencti_audit.Audit(opencti)

Main Audit class for OpenCTI

Reads audits in the OpenCTI platform.

Parameters:

opencti (OpenCTIApiClient) – instance of OpenCTIApiClient

Initialize the Audit instance.

Parameters:

opencti (OpenCTIApiClient) – OpenCTI API client instance

opencti

properties = Multiline-String

Show Value

"""
            id
            entity_type
            event_type
            event_scope
            event_status
            timestamp
            user_id
            context_uri
            user_metadata
        """

list(**kwargs) → List[Dict]

List Audit objects.

Parameters:

• filters (dict) – the filters to apply

• search (str) – the search keyword

• first (int) – return the first n rows from the after ID (or the beginning if not set)

• after (str) – ID of the first row for pagination

• orderBy (str) – field to order results by

• orderMode (str) – ordering mode (asc/desc)

• customAttributes (str) – custom attributes to return

• getAll (bool) – whether to retrieve all results

• withPagination (bool) – whether to include pagination info

Returns:

List of Task objects

Return type:

list

read(**kwargs) → Dict | None

Reads audit details from the platform.

Parameters:

• id (str, optional) – ID of the audit to fetch

• customAttributes – Custom attributes to include instead of the defaults

• filters (dict, optional) – Filters to apply to find a single user

• search (str, optional) – Search term to use to find a single user

Returns:

Representation of the audit as a Python dictionary.

Return type:

Optional[Dict]