pycti.entities.opencti_case_rft
===============================

.. py:module:: pycti.entities.opencti_case_rft


Classes
-------

.. autoapisummary::

   pycti.entities.opencti_case_rft.CaseRft


Module Contents
---------------

.. py:class:: CaseRft(opencti)

   Main CaseRft (Request for Takedown) class for OpenCTI

   Manages RFT cases in the OpenCTI platform.

   :param opencti: instance of :py:class:`~pycti.api.opencti_api_client.OpenCTIApiClient`
   :type opencti: OpenCTIApiClient

   Initialize the CaseRft instance.

   :param opencti: OpenCTI API client instance
   :type opencti: OpenCTIApiClient


   .. py:attribute:: opencti


   .. py:attribute:: properties
      :value: Multiline-String

      .. raw:: html

         <details><summary>Show Value</summary>

      .. code-block:: python

         """
                     id
                     standard_id
                     entity_type
                     parent_types
                     spec_version
                     created_at
                     updated_at
                     status {
                         id
                         template {
                           id
                           name
                           color
                         }
                     }
                     createdBy {
                         ... on Identity {
                             id
                             standard_id
                             entity_type
                             parent_types
                             spec_version
                             identity_class
                             name
                             description
                             roles
                             contact_information
                             x_opencti_aliases
                             created
                             modified
                             objectLabel {
                                 id
                                 value
                                 color
                             }
                         }
                         ... on Organization {
                             x_opencti_organization_type
                             x_opencti_reliability
                         }
                         ... on Individual {
                             x_opencti_firstname
                             x_opencti_lastname
                         }
                     }
                     objectOrganization {
                         id
                         standard_id
                         name
                     }
                     objectMarking {
                         id
                         standard_id
                         entity_type
                         definition_type
                         definition
                         created
                         modified
                         x_opencti_order
                         x_opencti_color
                     }
                     objectLabel {
                         id
                         value
                         color
                     }
                     externalReferences {
                         edges {
                             node {
                                 id
                                 standard_id
                                 entity_type
                                 source_name
                                 description
                                 url
                                 hash
                                 external_id
                                 created
                                 modified
                             }
                         }
                     }
                     revoked
                     confidence
                     created
                     modified
                     name
                     description
                     takedown_types
                     severity
                     priority
                     tasks {
                         edges {
                             node {
                                 name
                                 description
                                 due_date
                                 status {
                                   id
                                   template {
                                     id
                                     name
                                     color
                                   }
                                 }
                             }
                         }
                     }
                     objects(all: true) {
                         edges {
                             node {
                                 ... on BasicObject {
                                     id
                                     entity_type
                                     parent_types
                                 }
                                 ... on BasicRelationship {
                                     id
                                     entity_type
                                     parent_types
                                 }
                                 ... on StixObject {
                                     standard_id
                                     spec_version
                                     created_at
                                     updated_at
                                 }
                                 ... on AttackPattern {
                                     name
                                 }
                                 ... on Campaign {
                                     name
                                 }
                                 ... on CourseOfAction {
                                     name
                                 }
                                 ... on Individual {
                                     name
                                 }
                                 ... on Organization {
                                     name
                                 }
                                 ... on Sector {
                                     name
                                 }
                                 ... on System {
                                     name
                                 }
                                 ... on Indicator {
                                     name
                                 }
                                 ... on Infrastructure {
                                     name
                                 }
                                 ... on IntrusionSet {
                                     name
                                 }
                                 ... on Position {
                                     name
                                 }
                                 ... on City {
                                     name
                                 }
                                 ... on Country {
                                     name
                                 }
                                 ... on Region {
                                     name
                                 }
                                 ... on Malware {
                                     name
                                 }
                                 ... on ThreatActor {
                                     name
                                 }
                                 ... on Tool {
                                     name
                                 }
                                 ... on Vulnerability {
                                     name
                                 }
                                 ... on Incident {
                                     name
                                 }
                                 ... on Event {
                                     name
                                 }
                                 ... on Channel {
                                     name
                                 }
                                 ... on Narrative {
                                     name
                                 }
                                 ... on Language {
                                     name
                                 }
                                 ... on DataComponent {
                                     name
                                 }
                                 ... on DataSource {
                                     name
                                 }
                                 ... on StixCyberObservable {
                                     observable_value
                                 }
                                 ... on StixCoreRelationship {
                                     standard_id
                                     spec_version
                                     created_at
                                     updated_at
                                     relationship_type
                                 }
                                ... on StixSightingRelationship {
                                     standard_id
                                     spec_version
                                     created_at
                                     updated_at
                                 }
                             }
                         }
                     }
                 """

      .. raw:: html

         </details>




   .. py:attribute:: properties_with_files
      :value: Multiline-String

      .. raw:: html

         <details><summary>Show Value</summary>

      .. code-block:: python

         """
                         id
                         standard_id
                         entity_type
                         parent_types
                         spec_version
                         created_at
                         updated_at
                         status {
                             id
                             template {
                               id
                               name
                               color
                             }
                         }
                         createdBy {
                             ... on Identity {
                                 id
                                 standard_id
                                 entity_type
                                 parent_types
                                 spec_version
                                 identity_class
                                 name
                                 description
                                 roles
                                 contact_information
                                 x_opencti_aliases
                                 created
                                 modified
                                 objectLabel {
                                     id
                                     value
                                     color
                                 }
                             }
                             ... on Organization {
                                 x_opencti_organization_type
                                 x_opencti_reliability
                             }
                             ... on Individual {
                                 x_opencti_firstname
                                 x_opencti_lastname
                             }
                         }
                         objectOrganization {
                             id
                             standard_id
                             name
                         }
                         objectMarking {
                             id
                             standard_id
                             entity_type
                             definition_type
                             definition
                             created
                             modified
                             x_opencti_order
                             x_opencti_color
                         }
                         objectLabel {
                             id
                             value
                             color
                         }
                         externalReferences {
                             edges {
                                 node {
                                     id
                                     standard_id
                                     entity_type
                                     source_name
                                     description
                                     url
                                     hash
                                     external_id
                                     created
                                     modified
                                     importFiles {
                                         edges {
                                             node {
                                                 id
                                                 name
                                                 size
                                                 metaData {
                                                     mimetype
                                                     version
                                                 }
                                             }
                                         }
                                     }
                                 }
                             }
                         }
                         revoked
                         confidence
                         created
                         modified
                         name
                         description
                         severity
                         priority
                         takedown_types
                         objects(all: true) {
                             edges {
                                 node {
                                     ... on BasicObject {
                                         id
                                         entity_type
                                         parent_types
                                     }
                                     ... on BasicRelationship {
                                         id
                                         entity_type
                                         parent_types
                                     }
                                     ... on StixObject {
                                         standard_id
                                         spec_version
                                         created_at
                                         updated_at
                                     }
                                     ... on AttackPattern {
                                         name
                                     }
                                     ... on Campaign {
                                         name
                                     }
                                     ... on CourseOfAction {
                                         name
                                     }
                                     ... on Individual {
                                         name
                                     }
                                     ... on Organization {
                                         name
                                     }
                                     ... on Sector {
                                         name
                                     }
                                     ... on System {
                                         name
                                     }
                                     ... on Indicator {
                                         name
                                     }
                                     ... on Infrastructure {
                                         name
                                     }
                                     ... on IntrusionSet {
                                         name
                                     }
                                     ... on Position {
                                         name
                                     }
                                     ... on City {
                                         name
                                     }
                                     ... on Country {
                                         name
                                     }
                                     ... on Region {
                                         name
                                     }
                                     ... on Malware {
                                         name
                                     }
                                     ... on ThreatActor {
                                         name
                                     }
                                     ... on Tool {
                                         name
                                     }
                                     ... on Vulnerability {
                                         name
                                     }
                                     ... on Incident {
                                         name
                                     }
                                     ... on Event {
                                         name
                                     }
                                     ... on Channel {
                                         name
                                     }
                                     ... on Narrative {
                                         name
                                     }
                                     ... on Language {
                                         name
                                     }
                                     ... on DataComponent {
                                         name
                                     }
                                     ... on DataSource {
                                         name
                                     }
                                     ... on StixCyberObservable {
                                         observable_value
                                     }
                                     ... on StixCoreRelationship {
                                         standard_id
                                         spec_version
                                         created_at
                                         updated_at
                                         relationship_type
                                     }
                                    ... on StixSightingRelationship {
                                         standard_id
                                         spec_version
                                         created_at
                                         updated_at
                                     }
                                 }
                             }
                         }
                         importFiles {
                             edges {
                                 node {
                                     id
                                     name
                                     size
                                     metaData {
                                         mimetype
                                         version
                                     }
                                     objectMarking {
                                         id
                                         standard_id
                                         entity_type
                                         definition_type
                                         definition
                                         created
                                         modified
                                         x_opencti_order
                                         x_opencti_color
                                     }
                                 }
                             }
                         }
                     """

      .. raw:: html

         </details>




   .. py:method:: generate_id(name, created)
      :staticmethod:


      Generate a STIX ID for a Case RFT object.

      :param name: the name of the Case RFT
      :type name: str
      :param created: the creation date of the Case RFT
      :type created: str or datetime.datetime
      :return: STIX ID for the Case RFT
      :rtype: str



   .. py:method:: generate_id_from_data(data)
      :staticmethod:


      Generate a STIX ID from Case RFT data.

      :param data: Dictionary containing 'name' and 'created' keys
      :type data: dict
      :return: STIX ID for the Case RFT
      :rtype: str



   .. py:method:: list(**kwargs)

      List Case RFT objects.

      :param filters: the filters to apply
      :type filters: dict
      :param search: the search keyword
      :type search: str
      :param first: return the first n rows from the after ID (or the beginning if not set)
      :type first: int
      :param after: ID of the first row for pagination
      :type after: str
      :param orderBy: field to order results by
      :type orderBy: str
      :param orderMode: ordering mode (asc/desc)
      :type orderMode: str
      :param customAttributes: custom attributes to return
      :type customAttributes: str
      :param getAll: whether to retrieve all results
      :type getAll: bool
      :param withPagination: whether to include pagination info
      :type withPagination: bool
      :param withFiles: whether to include files
      :type withFiles: bool
      :return: List of Case RFT objects
      :rtype: list



   .. py:method:: read(**kwargs)

      Read a Case RFT object.

      :param id: the id of the Case RFT
      :type id: str
      :param filters: the filters to apply if no id provided
      :type filters: dict
      :param customAttributes: custom attributes to return
      :type customAttributes: str
      :param withFiles: whether to include files
      :type withFiles: bool
      :return: Case RFT object
      :rtype: dict or None



   .. py:method:: get_by_stix_id_or_name(**kwargs)

      Read a Case RFT object by stix_id or name.

      :param stix_id: the STIX ID of the Case RFT
      :type stix_id: str
      :param name: the name of the Case RFT
      :type name: str
      :param created: the creation date
      :type created: str
      :param customAttributes: custom attributes to return
      :type customAttributes: str
      :return: Case RFT object
      :rtype: dict or None



   .. py:method:: contains_stix_object_or_stix_relationship(**kwargs)

      Check if a Case RFT already contains a STIX Object or Relationship.

      :param id: the id of the Case RFT
      :type id: str
      :param stixObjectOrStixRelationshipId: the id of the Stix-Entity
      :type stixObjectOrStixRelationshipId: str
      :return: Boolean indicating if the entity is contained
      :rtype: bool or None



   .. py:method:: create(**kwargs)

      Create a Case RFT (Request for Takedown) object.

      :param stix_id: (optional) the STIX ID
      :type stix_id: str
      :param createdBy: (optional) the author ID
      :type createdBy: str
      :param objects: (optional) list of STIX object IDs contained in the case
      :type objects: list
      :param objectMarking: (optional) list of marking definition IDs
      :type objectMarking: list
      :param objectLabel: (optional) list of label IDs
      :type objectLabel: list
      :param objectAssignee: (optional) list of assignee IDs
      :type objectAssignee: list
      :param objectParticipant: (optional) list of participant IDs
      :type objectParticipant: list
      :param externalReferences: (optional) list of external reference IDs
      :type externalReferences: list
      :param revoked: (optional) whether the case is revoked
      :type revoked: bool
      :param severity: (optional) severity level
      :type severity: str
      :param priority: (optional) priority level
      :type priority: str
      :param confidence: (optional) confidence level (0-100)
      :type confidence: int
      :param lang: (optional) language
      :type lang: str
      :param content: (optional) content
      :type content: str
      :param created: (optional) creation date
      :type created: str
      :param modified: (optional) modification date
      :type modified: str
      :param name: the name of the Case RFT (required)
      :type name: str
      :param description: (optional) description
      :type description: str
      :param x_opencti_stix_ids: (optional) list of additional STIX IDs
      :type x_opencti_stix_ids: list
      :param objectOrganization: (optional) list of organization IDs
      :type objectOrganization: list
      :param x_opencti_workflow_id: (optional) workflow ID
      :type x_opencti_workflow_id: str
      :param x_opencti_modified_at: (optional) custom modification date
      :type x_opencti_modified_at: str
      :param update: (optional) whether to update if exists (default: False)
      :type update: bool
      :param takedown_types: (optional) list of takedown types
      :type takedown_types: list
      :param files: (optional) list of File objects to attach
      :type files: list
      :param filesMarkings: (optional) list of lists of marking definition IDs for each file
      :type filesMarkings: list
      :return: Case RFT object
      :rtype: dict or None



   .. py:method:: add_stix_object_or_stix_relationship(**kwargs)

      Add a Stix-Entity object to Case RFT object (object_refs).

      :param id: the id of the Case RFT
      :type id: str
      :param stixObjectOrStixRelationshipId: the id of the Stix-Entity
      :type stixObjectOrStixRelationshipId: str
      :return: Boolean indicating success
      :rtype: bool



   .. py:method:: remove_stix_object_or_stix_relationship(**kwargs)

      Remove a Stix-Entity object from Case RFT object (object_refs).

      :param id: the id of the Case RFT
      :type id: str
      :param stixObjectOrStixRelationshipId: the id of the Stix-Entity
      :type stixObjectOrStixRelationshipId: str
      :return: Boolean indicating success
      :rtype: bool



   .. py:method:: import_from_stix2(**kwargs)

      Import a Case RFT object from a STIX2 object.

      :param stixObject: the STIX2 Case RFT object
      :type stixObject: dict
      :param extras: extra parameters including created_by_id, object_marking_ids, etc.
      :type extras: dict
      :param update: whether to update if the entity already exists
      :type update: bool
      :return: Case RFT object
      :rtype: dict or None



   .. py:method:: delete(**kwargs)

      Delete a Case RFT object.

      :param id: the id of the Case RFT to delete
      :type id: str
      :return: None