pycti.entities.opencti_course_of_action

class pycti.entities.opencti_course_of_action.CourseOfAction(opencti)

Main CourseOfAction class for OpenCTI

Manages courses of action (mitigations) in the OpenCTI platform.

Parameters:

opencti (OpenCTIApiClient) – instance of OpenCTIApiClient

__init__(opencti)

Initialize the CourseOfAction instance.

Parameters:

opencti (OpenCTIApiClient) – OpenCTI API client instance

create(**kwargs)

Create a Course of Action object.

Parameters:

• name (str) – the name of the Course of Action (required)

• stix_id (str) – (optional) the STIX ID

• createdBy (str) – (optional) the author ID

• objectMarking (list) – (optional) list of marking definition IDs

• objectLabel (list) – (optional) list of label IDs

• externalReferences (list) – (optional) list of external reference IDs

• revoked (bool) – (optional) whether the course of action is revoked

• confidence (int) – (optional) confidence level (0-100)

• lang (str) – (optional) language

• created (str) – (optional) creation date

• modified (str) – (optional) modification date

• description (str) – (optional) description

• x_opencti_aliases (list) – (optional) list of aliases

• x_mitre_id (str) – (optional) MITRE ATT&CK ID

• x_opencti_stix_ids (list) – (optional) list of additional STIX IDs

• objectOrganization (list) – (optional) list of organization IDs

• x_opencti_workflow_id (str) – (optional) workflow ID

• x_opencti_modified_at (str) – (optional) custom modification date

• update (bool) – (optional) whether to update if exists (default: False)

• files (list) – (optional) list of File objects to attach

• filesMarkings (list) – (optional) list of lists of marking definition IDs for each file

Returns:

Course of Action object

Return type:

dict or None

static generate_id(name, x_mitre_id=None)

Generate a STIX ID for a Course of Action.

Parameters:

• name (str) – The name of the course of action

• x_mitre_id (str or None) – Optional MITRE ATT&CK ID

Returns:

STIX ID for the course of action

Return type:

str

static generate_id_from_data(data)

Generate a STIX ID from course of action data.

Parameters:

data (dict) – Dictionary containing ‘name’ and optionally ‘x_mitre_id’ keys

Returns:

STIX ID for the course of action

Return type:

str

import_from_stix2(**kwargs)

Import a Course of Action object from a STIX2 object.

Parameters:

• stixObject (dict) – the STIX2 Course of Action object

• extras (dict) – extra parameters including created_by_id, object_marking_ids, etc.

• update (bool) – whether to update if the entity already exists

Returns:

Course of Action object

Return type:

dict or None

list(**kwargs)

List Course of Action objects.

Parameters:

• filters (dict) – the filters to apply

• search (str) – the search keyword

• first (int) – return the first n rows from the after ID (or the beginning if not set)

• after (str) – ID of the first row for pagination

• orderBy (str) – field to order results by

• orderMode (str) – ordering mode (asc/desc)

• customAttributes (str) – custom attributes to return

• getAll (bool) – whether to retrieve all results

• withPagination (bool) – whether to include pagination info

• withFiles (bool) – whether to include files

Returns:

List of Course of Action objects

Return type:

list

read(**kwargs)

Read a Course of Action object.

Parameters:

• id (str) – the id of the Course of Action

• filters (dict) – the filters to apply if no id provided

• customAttributes (str) – custom attributes to return

• withFiles (bool) – whether to include files

Returns:

Course of Action object

Return type:

dict or None