pycti.entities.opencti_external_reference

class pycti.entities.opencti_external_reference.ExternalReference(opencti)

Main ExternalReference class for OpenCTI

Manages external references and citations in the OpenCTI platform.

Parameters:

opencti (OpenCTIApiClient) – instance of OpenCTIApiClient

__init__(opencti)

Initialize the ExternalReference instance.

Parameters:

opencti (OpenCTIApiClient) – OpenCTI API client instance

add_file(**kwargs)

Upload a file in this External-Reference.

Parameters:

• id (str) – the External-Reference id

• file_name (str) – the name of the file to upload

• data (bytes or None) – the file data (if None, reads from file_name path)

• version (datetime) – (optional) the file version date

• fileMarkings (list) – (optional) list of marking definition IDs for the file

• mime_type (str) – (optional) MIME type (default: text/plain)

• no_trigger_import (bool) – (optional) don’t trigger import (default: False)

• embedded (bool) – (optional) embed the file (default: False)

Returns:

File upload result

Return type:

dict or None

create(**kwargs)

Create an External Reference object.

Parameters:

• stix_id (str) – (optional) the STIX ID

• created (datetime) – (optional) creation date

• modified (datetime) – (optional) modification date

• source_name (str) – the source name of the External Reference (required if no url)

• url (str) – (optional) the URL of the external reference (required if no source_name)

• external_id (str) – (optional) the external ID

• description (str) – (optional) description

• x_opencti_stix_ids (list) – (optional) list of additional STIX IDs

• update (bool) – (optional) whether to update if exists (default: False)

• files (list) – (optional) list of File objects to attach

• filesMarkings (list) – (optional) list of lists of marking definition IDs for each file

Returns:

External Reference object

Return type:

dict or None

delete(id)

Delete an External-Reference object.

Parameters:

id (str) – the id of the External-Reference to delete

Returns:

None

static generate_id(url=None, source_name=None, external_id=None)

Generate a STIX ID for an External Reference.

Parameters:

• url (str or None) – The URL of the external reference

• source_name (str or None) – The source name

• external_id (str or None) – The external ID

Returns:

STIX ID for the external reference, or None if insufficient parameters

Return type:

str or None

static generate_id_from_data(data)

Generate a STIX ID from external reference data.

Parameters:

data (dict) – Dictionary containing ‘url’, ‘source_name’, or ‘external_id’ keys

Returns:

STIX ID for the external reference

Return type:

str or None

list(**kwargs)

List External-Reference objects.

Parameters:

• filters (dict) – the filters to apply

• first (int) – return the first n rows from the after ID (or the beginning if not set)

• after (str) – ID of the first row for pagination

• orderBy (str) – field to order results by

• orderMode (str) – ordering mode (asc/desc)

• customAttributes (list) – custom attributes to return

• getAll (bool) – whether to retrieve all results

• withPagination (bool) – whether to include pagination info

• withFiles (bool) – whether to include files

Returns:

List of External-Reference objects

Return type:

list

list_files(**kwargs)

List files attached to an External-Reference.

Parameters:

id (str) – the id of the External-Reference

Returns:

List of files

Return type:

list

read(**kwargs)

Read an External-Reference object.

Parameters:

• id (str) – the id of the External-Reference

• filters (dict) – the filters to apply if no id provided

Returns:

External-Reference object

Return type:

dict or None

update_field(**kwargs)

Update an External Reference object field.

Parameters:

• id (str) – the External Reference id

• input (list) – the input of the field

Returns:

The updated External Reference object

Return type:

dict or None