pycti.entities.opencti_malware

class pycti.entities.opencti_malware.Malware(opencti)

Main Malware class for OpenCTI

Manages malware families and variants in the OpenCTI platform.

Parameters:

opencti (OpenCTIApiClient) – instance of OpenCTIApiClient

__init__(opencti)

Initialize the Malware instance.

Parameters:

opencti (OpenCTIApiClient) – OpenCTI API client instance

create(**kwargs)

Create a Malware object.

Parameters:

• stix_id (str) – (optional) the STIX ID

• name (str) – the name of the Malware (required)

• description (str) – description of the malware

• aliases (list) – list of aliases

• malware_types (list) – types of malware

• is_family (bool) – whether this is a malware family

• first_seen (str) – first seen date

• last_seen (str) – last seen date

• architecture_execution_envs (list) – execution environments

• implementation_languages (list) – implementation languages

• capabilities (list) – malware capabilities

• killChainPhases (list) – kill chain phases

• samples (list) – malware samples

• createdBy (str) – creator identity ID

• objectMarking (list) – marking definition IDs

• objectLabel (list) – label IDs

• externalReferences (list) – external reference IDs

• objectOrganization (list) – organization IDs

• revoked (bool) – whether the malware is revoked

• confidence (int) – confidence level (0-100)

• lang (str) – language

• created (str) – creation date

• modified (str) – modification date

• x_opencti_stix_ids (list) – additional STIX IDs

• x_opencti_workflow_id (str) – workflow ID

• x_opencti_modified_at (str) – custom modification date

• update (bool) – whether to update existing malware

• files (list) – (optional) list of File objects to attach

• filesMarkings (list) – (optional) list of lists of marking definition IDs for each file

Returns:

Malware object

Return type:

dict or None

static generate_id(name)

Generate a STIX ID for a Malware.

Parameters:

name (str) – The name of the malware

Returns:

STIX ID for the malware

Return type:

str

static generate_id_from_data(data)

Generate a STIX ID from malware data.

Parameters:

data (dict) – Dictionary containing ‘name’ key

Returns:

STIX ID for the malware

Return type:

str

import_from_stix2(**kwargs)

Import a Malware object from a STIX2 object.

Parameters:

• stixObject (dict) – the STIX2 Malware object

• extras (dict) – extra parameters including created_by_id, object_marking_ids, etc.

• update (bool) – whether to update if the entity already exists

Returns:

Malware object

Return type:

dict or None

list(**kwargs)

List Malware objects.

Parameters:

• filters (dict) – the filters to apply

• search (str) – the search keyword

• first (int) – return the first n rows from the after ID (or the beginning if not set)

• after (str) – ID of the first row for pagination

• orderBy (str) – field to order results by

• orderMode (str) – ordering mode (asc/desc)

• customAttributes (str) – custom attributes to return

• getAll (bool) – whether to retrieve all results

• withPagination (bool) – whether to include pagination info

• withFiles (bool) – whether to include files

Returns:

List of Malware objects

Return type:

list

read(**kwargs)

Read a Malware object.

Parameters:

• id (str) – the id of the Malware

• filters (dict) – the filters to apply if no id provided

• customAttributes (str) – custom attributes to return

• withFiles (bool) – whether to include files

Returns:

Malware object

Return type:

dict or None