pycti.entities.opencti_feedback
===============================
.. py:module:: pycti.entities.opencti_feedback
Classes
-------
.. autoapisummary::
pycti.entities.opencti_feedback.Feedback
Module Contents
---------------
.. py:class:: Feedback(opencti)
Main Feedback class for OpenCTI
Manages feedback and analyst assessments in the OpenCTI platform.
:param opencti: instance of :py:class:`~pycti.api.opencti_api_client.OpenCTIApiClient`
:type opencti: OpenCTIApiClient
Initialize the Feedback instance.
:param opencti: OpenCTI API client instance
:type opencti: OpenCTIApiClient
.. py:attribute:: opencti
.. py:attribute:: properties
:value: Multiline-String
.. raw:: html
Show Value
.. code-block:: python
"""
id
standard_id
entity_type
parent_types
spec_version
created_at
updated_at
status {
id
template {
id
name
color
}
}
createdBy {
... on Identity {
id
standard_id
entity_type
parent_types
spec_version
identity_class
name
description
roles
contact_information
x_opencti_aliases
created
modified
objectLabel {
id
value
color
}
}
... on Organization {
x_opencti_organization_type
x_opencti_reliability
}
... on Individual {
x_opencti_firstname
x_opencti_lastname
}
}
objectMarking {
id
standard_id
entity_type
definition_type
definition
created
modified
x_opencti_order
x_opencti_color
}
objectLabel {
id
value
color
}
externalReferences {
edges {
node {
id
standard_id
entity_type
source_name
description
url
hash
external_id
created
modified
}
}
}
revoked
confidence
created
modified
name
description
rating
objects {
edges {
node {
... on BasicObject {
id
entity_type
parent_types
}
... on BasicRelationship {
id
entity_type
parent_types
}
... on StixObject {
standard_id
spec_version
created_at
updated_at
}
... on AttackPattern {
name
}
... on Campaign {
name
}
... on CourseOfAction {
name
}
... on Individual {
name
}
... on Organization {
name
}
... on Sector {
name
}
... on System {
name
}
... on Indicator {
name
}
... on Infrastructure {
name
}
... on IntrusionSet {
name
}
... on Position {
name
}
... on City {
name
}
... on Country {
name
}
... on Region {
name
}
... on Malware {
name
}
... on ThreatActor {
name
}
... on Tool {
name
}
... on Vulnerability {
name
}
... on Incident {
name
}
... on Event {
name
}
... on Channel {
name
}
... on Narrative {
name
}
... on Language {
name
}
... on DataComponent {
name
}
... on DataSource {
name
}
... on StixCoreRelationship {
standard_id
spec_version
created_at
updated_at
relationship_type
}
... on StixSightingRelationship {
standard_id
spec_version
created_at
updated_at
}
}
}
}
"""
.. raw:: html
.. py:attribute:: properties_with_files
:value: Multiline-String
.. raw:: html
Show Value
.. code-block:: python
"""
id
standard_id
entity_type
parent_types
spec_version
created_at
updated_at
status {
id
template {
id
name
color
}
}
createdBy {
... on Identity {
id
standard_id
entity_type
parent_types
spec_version
identity_class
name
description
roles
contact_information
x_opencti_aliases
created
modified
objectLabel {
id
value
color
}
}
... on Organization {
x_opencti_organization_type
x_opencti_reliability
}
... on Individual {
x_opencti_firstname
x_opencti_lastname
}
}
objectMarking {
id
standard_id
entity_type
definition_type
definition
created
modified
x_opencti_order
x_opencti_color
}
objectLabel {
id
value
color
}
externalReferences {
edges {
node {
id
standard_id
entity_type
source_name
description
url
hash
external_id
created
modified
importFiles {
edges {
node {
id
name
size
metaData {
mimetype
version
}
}
}
}
}
}
}
revoked
confidence
created
modified
name
description
rating
objects {
edges {
node {
... on BasicObject {
id
entity_type
parent_types
}
... on BasicRelationship {
id
entity_type
parent_types
}
... on StixObject {
standard_id
spec_version
created_at
updated_at
}
... on AttackPattern {
name
}
... on Campaign {
name
}
... on CourseOfAction {
name
}
... on Individual {
name
}
... on Organization {
name
}
... on Sector {
name
}
... on System {
name
}
... on Indicator {
name
}
... on Infrastructure {
name
}
... on IntrusionSet {
name
}
... on Position {
name
}
... on City {
name
}
... on Country {
name
}
... on Region {
name
}
... on Malware {
name
}
... on ThreatActor {
name
}
... on Tool {
name
}
... on Vulnerability {
name
}
... on Incident {
name
}
... on Event {
name
}
... on Channel {
name
}
... on Narrative {
name
}
... on Language {
name
}
... on DataComponent {
name
}
... on DataSource {
name
}
... on StixCoreRelationship {
standard_id
spec_version
created_at
updated_at
relationship_type
}
... on StixSightingRelationship {
standard_id
spec_version
created_at
updated_at
}
}
}
}
importFiles {
edges {
node {
id
name
size
metaData {
mimetype
version
}
objectMarking {
id
standard_id
entity_type
definition_type
definition
created
modified
x_opencti_order
x_opencti_color
}
}
}
}
"""
.. raw:: html
.. py:method:: generate_id(name)
:staticmethod:
Generate a STIX ID for a Feedback object.
:param name: the name of the Feedback
:type name: str
:return: STIX ID for the Feedback
:rtype: str
.. py:method:: generate_id_from_data(data)
:staticmethod:
Generate a STIX ID from Feedback data.
:param data: Dictionary containing a 'name' key
:type data: dict
:return: STIX ID for the Feedback
:rtype: str
.. py:method:: list(**kwargs)
List Feedback objects.
:param filters: the filters to apply
:type filters: dict
:param search: the search keyword
:type search: str
:param first: return the first n rows from the after ID (or the beginning if not set)
:type first: int
:param after: ID of the first row for pagination
:type after: str
:return: List of Feedback objects
:rtype: list
.. py:method:: read(**kwargs)
Read a Feedback object.
:param id: the id of the Feedback
:type id: str
:param filters: the filters to apply if no id provided
:type filters: dict
:return: Feedback object
:rtype: dict or None
.. py:method:: get_by_stix_id_or_name(**kwargs)
Read a Feedback object by stix_id or name.
:param stix_id: the STIX ID of the Feedback
:type stix_id: str
:param name: the name of the Feedback
:type name: str
:param created: the creation date of the Feedback
:type created: str
:return: Feedback object
:rtype: dict or None
.. py:method:: contains_stix_object_or_stix_relationship(**kwargs)
Check if a feedback already contains a thing (Stix Object or Stix Relationship).
:param id: the id of the Feedback
:type id: str
:param stixObjectOrStixRelationshipId: the id of the Stix-Entity
:type stixObjectOrStixRelationshipId: str
:return: True if contained, False otherwise
:rtype: bool or None
.. py:method:: create(**kwargs)
Create a Feedback object.
:param stix_id: the STIX ID (optional)
:type stix_id: str
:param createdBy: the author ID (optional)
:type createdBy: str
:param objects: list of STIX object IDs (optional)
:type objects: list
:param objectMarking: list of marking definition IDs (optional)
:type objectMarking: list
:param objectLabel: list of label IDs (optional)
:type objectLabel: list
:param externalReferences: list of external reference IDs (optional)
:type externalReferences: list
:param revoked: whether the feedback is revoked (optional)
:type revoked: bool
:param confidence: confidence level 0-100 (optional)
:type confidence: int
:param lang: language (optional)
:type lang: str
:param created: creation date (optional)
:type created: str
:param modified: modification date (optional)
:type modified: str
:param name: the name of the Feedback (required)
:type name: str
:param description: description (optional)
:type description: str
:param rating: rating value (optional)
:type rating: int
:param x_opencti_stix_ids: list of additional STIX IDs (optional)
:type x_opencti_stix_ids: list
:param objectOrganization: list of organization IDs (optional)
:type objectOrganization: list
:param x_opencti_workflow_id: workflow ID (optional)
:type x_opencti_workflow_id: str
:param x_opencti_modified_at: custom modification date (optional)
:type x_opencti_modified_at: str
:param update: whether to update if exists (default: False)
:type update: bool
:param files: (optional) list of File objects to attach
:type files: list
:param filesMarkings: (optional) list of lists of marking definition IDs for each file
:type filesMarkings: list
:return: Feedback object
:rtype: dict or None
.. py:method:: update_field(**kwargs)
Update a field of a Feedback object.
:param id: the id of the Feedback
:type id: str
:param input: the input containing field(s) to update
:type input: list
:return: Feedback object
:rtype: dict or None
.. py:method:: add_stix_object_or_stix_relationship(**kwargs)
Add a Stix-Entity object to Feedback object (object_refs).
:param id: the id of the Feedback
:type id: str
:param stixObjectOrStixRelationshipId: the id of the Stix-Entity
:type stixObjectOrStixRelationshipId: str
:return: True if successful, False otherwise
:rtype: bool
.. py:method:: remove_stix_object_or_stix_relationship(**kwargs)
Remove a Stix-Entity object from Feedback object (object_refs).
:param id: the id of the Feedback
:type id: str
:param stixObjectOrStixRelationshipId: the id of the Stix-Entity
:type stixObjectOrStixRelationshipId: str
:return: True if successful, False otherwise
:rtype: bool
.. py:method:: import_from_stix2(**kwargs)
Import a Feedback object from a STIX2 object.
:param stixObject: the STIX2 Feedback object
:type stixObject: dict
:param extras: extra parameters including created_by_id, object_marking_ids, etc.
:type extras: dict
:param update: whether to update if the entity already exists
:type update: bool
:return: Feedback object
:rtype: dict or None
.. py:method:: delete(**kwargs)
Delete a Feedback object.
:param id: the id of the Feedback to delete
:type id: str
:return: None