pycti.entities.opencti_security_coverage

Classes

SecurityCoverage

Main SecurityCoverage class for OpenCTI

Module Contents

class pycti.entities.opencti_security_coverage.SecurityCoverage(opencti)

Main SecurityCoverage class for OpenCTI

Manages security coverage entities in the OpenCTI platform.

Parameters:

opencti (OpenCTIApiClient) – instance of OpenCTIApiClient

Initialize the SecurityCoverage instance.

Parameters:

opencti (OpenCTIApiClient) – OpenCTI API client instance

opencti

properties = Multiline-String

Show Value

"""
            id
            standard_id
            entity_type
            parent_types
            spec_version
            created_at
            updated_at
            external_uri
            objectCovered {
                __typename
                ... on StixCoreObject {
                  id
                }
            }
            objectMarking {
                id
                standard_id
                entity_type
                definition_type
                definition
                created
                modified
                x_opencti_order
                x_opencti_color
            }
        """

static generate_id(covered_ref)

Generate a STIX ID for a Security Coverage.

Parameters:

covered_ref (str) – The reference to the covered object

Returns:

STIX ID for the security coverage

Return type:

str

static generate_id_from_data(data)

Generate a STIX ID from security coverage data.

Parameters:

data (dict) – Dictionary containing ‘covered_ref’ key

Returns:

STIX ID for the security coverage

Return type:

str

list(**kwargs)

List SecurityCoverage objects.

Parameters:

• filters – the filters to apply

• search – the search keyword

• first – return the first n rows from the after ID (or the beginning if not set)

• after – ID of the first row for pagination

Returns:

List of SecurityCoverage objects

Return type:

list

read(**kwargs)

Read a SecurityCoverage object.

Parameters:

• id (str) – the id of the SecurityCoverage

• filters (dict) – the filters to apply if no id provided

• customAttributes (str) – custom attributes to return

Returns:

SecurityCoverage object

Return type:

dict or None

create(**kwargs)

Create a Security coverage object.

Parameters:

• name (str) – the name of the Security Coverage (required)

• objectCovered (str) – the covered object ID (required)

• stix_id (str) – (optional) the STIX ID

• description (str) – (optional) description

• createdBy (str) – (optional) the author ID

• objectMarking (list) – (optional) list of marking definition IDs

• objectLabel (list) – (optional) list of label IDs

• externalReferences (list) – (optional) list of external reference IDs

• external_uri (str) – (optional) external URI

• coverage_last_result (str) – (optional) last result date

• coverage_valid_from (str) – (optional) valid from date

• coverage_valid_to (str) – (optional) valid to date

• coverage_information (list) – (optional) coverage information

• auto_enrichment_disable (bool) – (optional) disable auto enrichment

• periodicity (str) – (optional) periodicity

• duration (str) – (optional) duration

• type_affinity (str) – (optional) type affinity

• platforms_affinity (list) – (optional) platforms affinity

• files (list) – (optional) list of File objects to attach

• filesMarkings (list) – (optional) list of lists of marking definition IDs for each file

Returns:

Security Coverage object

Return type:

dict or None

import_from_stix2(**kwargs)

Import a Security coverage from a STIX2 object.

Parameters:

• stixObject (dict) – the STIX2 Security coverage object

• extras (dict) – extra parameters including created_by_id, object_marking_ids, etc.

• update (bool) – whether to update if the entity already exists

Returns:

Security coverage object

Return type:

dict or None