pycti.entities.opencti_stix_sighting_relationship

Classes

StixSightingRelationship

Main StixSightingRelationship class for OpenCTI

Module Contents

class pycti.entities.opencti_stix_sighting_relationship.StixSightingRelationship(opencti)

Main StixSightingRelationship class for OpenCTI

Manages STIX sighting relationships in the OpenCTI platform.

Parameters:

opencti (OpenCTIApiClient) – instance of OpenCTIApiClient

Initialize the StixSightingRelationship instance.

Parameters:

opencti (OpenCTIApiClient) – OpenCTI API client instance

opencti

properties = Multiline-String

Show Value

"""
            id
            entity_type
            parent_types
            spec_version
            created_at
            updated_at
            standard_id
            description
            first_seen
            last_seen
            attribute_count
            x_opencti_negative
            created
            modified
            confidence
            status {
                id
                template {
                  id
                  name
                  color
                }
            }
            createdBy {
                ... on Identity {
                    id
                    standard_id
                    entity_type
                    parent_types
                    identity_class
                    name
                    description
                    roles
                    contact_information
                    x_opencti_aliases
                    created
                    modified
                    objectLabel {
                        id
                        value
                        color
                    }
                }
                ... on Organization {
                    x_opencti_organization_type
                    x_opencti_reliability
                }
                ... on Individual {
                    x_opencti_firstname
                    x_opencti_lastname
                }
            }
            objectMarking {
                id
                standard_id
                entity_type
                definition_type
                definition
                created
                modified
                x_opencti_order
                x_opencti_color
            }
            objectOrganization {
                id
                standard_id
                name
            }
            objectLabel {
                id
                value
                color
            }
            externalReferences {
                edges {
                    node {
                        id
                        standard_id
                        entity_type
                        source_name
                        description
                        url
                        hash
                        external_id
                        created
                        modified
                    }
                }
            }
            from {
                ... on BasicObject {
                    id
                    entity_type
                    parent_types
                }
                ... on BasicRelationship {
                    id
                    entity_type
                    parent_types
                }
                ... on StixObject {
                    standard_id
                    spec_version
                    created_at
                    updated_at
                }
                ... on AttackPattern {
                    name
                }
                ... on Campaign {
                    name
                }
                ... on CourseOfAction {
                    name
                }
                ... on Individual {
                    name
                }
                ... on Organization {
                    name
                }
                ... on Sector {
                    name
                }
                 ... on System {
                    name
                }
                ... on Indicator {
                    name
                }
                ... on Infrastructure {
                    name
                }
                ... on IntrusionSet {
                    name
                }
                ... on Position {
                    name
                }
                ... on City {
                    name
                }
                ... on Country {
                    name
                }
                ... on Region {
                    name
                }
                ... on Malware {
                    name
                }
                ... on ThreatActor {
                    name
                }
                ... on Tool {
                    name
                }
                ... on Vulnerability {
                    name
                }
                ... on Incident {
                    name
                }
                ... on StixCyberObservable {
                    observable_value
                }
                ... on StixCoreRelationship {
                    standard_id
                    spec_version
                    created_at
                    updated_at
                }
            }
            to {
                ... on BasicObject {
                    id
                    entity_type
                    parent_types
                }
                ... on BasicRelationship {
                    id
                    entity_type
                    parent_types
                }
                ... on StixObject {
                    standard_id
                    spec_version
                    created_at
                    updated_at
                }
                ... on AttackPattern {
                    name
                }
                ... on Campaign {
                    name
                }
                ... on CourseOfAction {
                    name
                }
                ... on Individual {
                    name
                }
                ... on Organization {
                    name
                }
                ... on Sector {
                    name
                }
                ... on System {
                    name
                }
                ... on Indicator {
                    name
                }
                ... on Infrastructure {
                    name
                }
                ... on IntrusionSet {
                    name
                }
                ... on Position {
                    name
                }
                ... on City {
                    name
                }
                ... on Country {
                    name
                }
                ... on Region {
                    name
                }
                ... on Malware {
                    name
                }
                ... on ThreatActor {
                    name
                }
                ... on Tool {
                    name
                }
                ... on Vulnerability {
                    name
                }
                ... on Incident {
                    name
                }
                ... on StixCyberObservable {
                    observable_value
                }
                ... on StixCoreRelationship {
                    standard_id
                    spec_version
                    created_at
                    updated_at
                }
            }
        """

static generate_id(sighting_of_ref, where_sighted_refs, first_seen=None, last_seen=None)

Generate a STIX ID for a Sighting relationship.

Parameters:

• sighting_of_ref (str) – The STIX ID of the entity being sighted

• where_sighted_refs (list) – The STIX IDs of where the sighting occurred

• first_seen (str or datetime.datetime or None) – (optional) The first seen date

• last_seen (str or datetime.datetime or None) – (optional) The last seen date

Returns:

STIX ID for the sighting

Return type:

str

static generate_id_from_data(data)

Generate a STIX ID from sighting data.

Parameters:

data (dict) – Dictionary containing sighting_of_ref, where_sighted_refs, and optionally first_seen/last_seen

Returns:

STIX ID for the sighting

Return type:

str

list(**kwargs)

List stix_sighting_relationship objects.

Parameters:

• fromOrToId (str) – the id of an entity (source or target)

• fromId (str) – the id of the source entity of the relation

• fromTypes (list) – filter by source entity types

• toId (str) – the id of the target entity of the relation

• toTypes (list) – filter by target entity types

• firstSeenStart (str) – the first_seen date start filter

• firstSeenStop (str) – the first_seen date stop filter

• lastSeenStart (str) – the last_seen date start filter

• lastSeenStop (str) – the last_seen date stop filter

• filters (dict) – additional filters to apply

• first (int) – return the first n rows from the after ID (or the beginning if not set)

• after (str) – ID of the first row for pagination

• orderBy (str) – field to order results by

• orderMode (str) – ordering mode (asc/desc)

• customAttributes (str) – custom attributes to return

• getAll (bool) – whether to retrieve all results

• withPagination (bool) – whether to include pagination info

• search (str) – search keyword

Returns:

List of stix_sighting_relationship objects

Return type:

list

read(**kwargs)

Read a stix_sighting_relationship object.

Parameters:

• id (str) – the id of the stix_sighting_relationship

• fromOrToId (str) – the id of an entity (source or target)

• fromId (str) – the id of the source entity of the relation

• toId (str) – the id of the target entity of the relation

• firstSeenStart (str) – the first_seen date start filter

• firstSeenStop (str) – the first_seen date stop filter

• lastSeenStart (str) – the last_seen date start filter

• lastSeenStop (str) – the last_seen date stop filter

• customAttributes (str) – custom attributes to return

• filters (dict) – filters to apply

Returns:

stix_sighting_relationship object

Return type:

dict or None

create(**kwargs)

Create a stix_sighting_relationship object.

Parameters:

• fromId (str) – the id of the source entity

• toId (str) – the id of the target entity

• stix_id (str) – (optional) the STIX ID

• description (str) – (optional) description

• first_seen (str) – (optional) first seen date

• last_seen (str) – (optional) last seen date

• count (int) – (optional) sighting count

• x_opencti_negative (bool) – (optional) whether this is a negative sighting

• created (str) – (optional) creation date

• modified (str) – (optional) modification date

• confidence (int) – (optional) confidence level (0-100)

• createdBy (str) – (optional) the author ID

• objectMarking (list) – (optional) list of marking definition IDs

• objectLabel (list) – (optional) list of label IDs

• externalReferences (list) – (optional) list of external reference IDs

• x_opencti_stix_ids (list) – (optional) list of additional STIX IDs

• x_opencti_workflow_id (str) – (optional) workflow ID

• x_opencti_modified_at (str) – (optional) custom modification date

• objectOrganization (list) – (optional) list of organization IDs

• update (bool) – (optional) whether to update if exists (default: False)

Returns:

stix_sighting_relationship object

Return type:

dict or None

update_field(**kwargs)

Update a stix_sighting_relationship object field.

Parameters:

• id (str) – the stix_sighting_relationship id

• input (list) – the input of the field

Returns:

The updated stix_sighting_relationship object

Return type:

dict or None

add_marking_definition(**kwargs)

Add a Marking-Definition object to stix_sighting_relationship object (object_marking_refs).

Parameters:

• id (str) – the id of the stix_sighting_relationship

• marking_definition_id (str) – the id of the Marking-Definition

Returns:

True if successful, False otherwise

Return type:

bool

remove_marking_definition(**kwargs)

Remove a Marking-Definition object from stix_sighting_relationship.

Parameters:

• id (str) – the id of the stix_sighting_relationship

• marking_definition_id (str) – the id of the Marking-Definition

Returns:

True if successful, False otherwise

Return type:

bool

update_created_by(**kwargs)

Update the Identity author of a stix_sighting_relationship object (created_by).

Parameters:

• id (str) – the id of the stix_sighting_relationship

• identity_id (str) – the id of the Identity

Returns:

True if successful, False otherwise

Return type:

bool

organization_share(entity_id, organization_ids, sharing_direct_container)

Share element to multiple organizations.

Parameters:

• entity_id (str) – the stix_sighting_relationship id

• organization_ids (list) – the organization IDs to share with

• sharing_direct_container (bool) – whether to share direct container

Returns:

None

organization_unshare(entity_id, organization_ids, sharing_direct_container)

Unshare element from multiple organizations.

Parameters:

• entity_id (str) – the stix_sighting_relationship id

• organization_ids (list) – the organization IDs to unshare from

• sharing_direct_container (bool) – whether to unshare direct container

Returns:

None

remove_from_draft(**kwargs)

Remove a stix_sighting_relationship object from draft (revert).

Parameters:

id (str) – the stix_sighting_relationship id

Returns:

None

delete(**kwargs)

Delete a stix_sighting_relationship.

Parameters:

id (str) – the stix_sighting_relationship id

Returns:

None