pycti.entities.opencti_threat_actor

Classes

ThreatActor

Main ThreatActor class for OpenCTI

Module Contents

class pycti.entities.opencti_threat_actor.ThreatActor(opencti)

Main ThreatActor class for OpenCTI

Manages threat actor entities (groups and individuals) in the OpenCTI platform.

Parameters:

opencti (OpenCTIApiClient) – instance of OpenCTIApiClient

Initialize the ThreatActor instance.

Parameters:

opencti (OpenCTIApiClient) – OpenCTI API client instance

opencti

threat_actor_group

threat_actor_individual

properties = Multiline-String

Show Value

"""
            id
            standard_id
            entity_type
            parent_types
            spec_version
            created_at
            updated_at
            createdBy {
                ... on Identity {
                    id
                    standard_id
                    entity_type
                    parent_types
                    spec_version
                    identity_class
                    name
                    description
                    roles
                    contact_information
                    x_opencti_aliases
                    created
                    modified
                    objectLabel {
                        id
                        value
                        color
                    }
                }
                ... on Organization {
                    x_opencti_organization_type
                    x_opencti_reliability
                }
                ... on Individual {
                    x_opencti_firstname
                    x_opencti_lastname
                }
            }
            objectOrganization {
                id
                standard_id
                name
            }
            objectMarking {
                id
                standard_id
                entity_type
                definition_type
                definition
                created
                modified
                x_opencti_order
                x_opencti_color
            }
            objectLabel {
                id
                value
                color
            }
            externalReferences {
                edges {
                    node {
                        id
                        standard_id
                        entity_type
                        source_name
                        description
                        url
                        hash
                        external_id
                        created
                        modified
                        importFiles {
                            edges {
                                node {
                                    id
                                    name
                                    size
                                    metaData {
                                        mimetype
                                        version
                                    }
                                }
                            }
                        }
                    }
                }
            }
            revoked
            confidence
            created
            modified
            name
            description
            aliases
            threat_actor_types
            first_seen
            last_seen
            roles
            goals
            sophistication
            resource_level
            primary_motivation
            secondary_motivations
            importFiles {
                edges {
                    node {
                        id
                        name
                        size
                        metaData {
                            mimetype
                            version
                        }
                        objectMarking {
                            id
                            standard_id
                            entity_type
                            definition_type
                            definition
                            created
                            modified
                            x_opencti_order
                            x_opencti_color
                        }
                    }
                }
            }
        """

static generate_id(name, opencti_type)

Generate a STIX ID for a Threat Actor.

Parameters:

• name (str) – the name of the Threat Actor

• opencti_type (str) – the type of the Threat Actor (e.g., ‘Threat-Actor-Group’)

Returns:

STIX ID for the Threat Actor

Return type:

str

generate_id_from_data(data)

Generate a STIX ID from Threat Actor data.

Parameters:

data (dict) – Dictionary containing ‘name’ and optionally ‘x_opencti_type’ keys

Returns:

STIX ID for the Threat Actor

Return type:

str

list(**kwargs) → dict

List Threat-Actor objects.

Parameters:

• filters (dict) – the filters to apply

• search (str) – the search keyword

• first (int) – return the first n rows from the after ID (or the beginning if not set)

• after (str) – ID of the first row for pagination

• orderBy (str) – field to order results by

• orderMode (str) – ordering mode (asc/desc)

• customAttributes (str) – custom attributes to return

• getAll (bool) – whether to retrieve all results

• withPagination (bool) – whether to include pagination info

Returns:

List of Threat-Actor objects

Return type:

list

read(**kwargs) → dict | None

Read a Threat-Actor object.

Parameters:

• id (str) – the id of the Threat-Actor

• filters (dict) – the filters to apply if no id provided

• customAttributes (str) – custom attributes to return

Returns:

Threat-Actor object

Return type:

dict or None

create(**kwargs)

Create a Threat-Actor-Group object (deprecated).

Deprecated since version Use: threat_actor_group.create() or threat_actor_individual.create() instead.

import_from_stix2(**kwargs)

Import a Threat-Actor object from a STIX2 object.

Parameters:

stixObject (dict) – the STIX2 Threat-Actor object

Returns:

Threat-Actor object

Return type:

dict or None