pycti.entities.opencti_note
===========================

.. py:module:: pycti.entities.opencti_note


Classes
-------

.. autoapisummary::

   pycti.entities.opencti_note.Note


Module Contents
---------------

.. py:class:: Note(opencti)

   Main Note class for OpenCTI

   Manages notes and annotations in the OpenCTI platform.

   :param opencti: instance of :py:class:`~pycti.api.opencti_api_client.OpenCTIApiClient`
   :type opencti: OpenCTIApiClient

   Initialize the Note instance.

   :param opencti: OpenCTI API client instance
   :type opencti: OpenCTIApiClient


   .. py:attribute:: opencti


   .. py:attribute:: properties
      :value: Multiline-String

      .. raw:: html

         <details><summary>Show Value</summary>

      .. code-block:: python

         """
                     id
                     standard_id
                     entity_type
                     parent_types
                     spec_version
                     created_at
                     updated_at
                     status {
                         id
                         template {
                           id
                           name
                           color
                         }
                     }
                     createdBy {
                         ... on Identity {
                             id
                             standard_id
                             entity_type
                             parent_types
                             spec_version
                             identity_class
                             name
                             description
                             roles
                             contact_information
                             x_opencti_aliases
                             created
                             modified
                             objectLabel {
                                 id
                                 value
                                 color
                             }
                         }
                         ... on Organization {
                             x_opencti_organization_type
                             x_opencti_reliability
                         }
                         ... on Individual {
                             x_opencti_firstname
                             x_opencti_lastname
                         }
                     }
                     objectOrganization {
                         id
                         standard_id
                         name
                     }
                     objectMarking {
                         id
                         standard_id
                         entity_type
                         definition_type
                         definition
                         created
                         modified
                         x_opencti_order
                         x_opencti_color
                     }
                     objectLabel {
                         id
                         value
                         color
                     }
                     externalReferences {
                         edges {
                             node {
                                 id
                                 standard_id
                                 entity_type
                                 source_name
                                 description
                                 url
                                 hash
                                 external_id
                                 created
                                 modified
                             }
                         }
                     }
                     revoked
                     confidence
                     created
                     modified
                     attribute_abstract
                     content
                     authors
                     note_types
                     likelihood
                     objects(all: true) {
                         edges {
                             node {
                                 ... on BasicObject {
                                     id
                                     entity_type
                                     parent_types
                                 }
                                 ... on BasicRelationship {
                                     id
                                     entity_type
                                     parent_types
                                 }
                                 ... on StixObject {
                                     standard_id
                                     spec_version
                                     created_at
                                     updated_at
                                 }
                                 ... on AttackPattern {
                                     name
                                 }
                                 ... on Campaign {
                                     name
                                 }
                                 ... on CourseOfAction {
                                     name
                                 }
                                 ... on Individual {
                                     name
                                 }
                                 ... on Organization {
                                     name
                                 }
                                 ... on Sector {
                                     name
                                 }
                                 ... on System {
                                     name
                                 }
                                 ... on Indicator {
                                     name
                                 }
                                 ... on Infrastructure {
                                     name
                                 }
                                 ... on IntrusionSet {
                                     name
                                 }
                                 ... on Position {
                                     name
                                 }
                                 ... on City {
                                     name
                                 }
                                 ... on Country {
                                     name
                                 }
                                 ... on Region {
                                     name
                                 }
                                 ... on Malware {
                                     name
                                 }
                                 ... on ThreatActor {
                                     name
                                 }
                                 ... on Tool {
                                     name
                                 }
                                 ... on Vulnerability {
                                     name
                                 }
                                 ... on Incident {
                                     name
                                 }
                                 ... on Event {
                                     name
                                 }
                                 ... on Channel {
                                     name
                                 }
                                 ... on Narrative {
                                     name
                                 }
                                 ... on Language {
                                     name
                                 }
                                 ... on DataComponent {
                                     name
                                 }
                                 ... on DataSource {
                                     name
                                 }
                                 ... on Case {
                                     name
                                 }
                                 ... on StixCyberObservable {
                                     observable_value
                                 }
                                 ... on StixCoreRelationship {
                                     standard_id
                                     spec_version
                                     created_at
                                     updated_at
                                     relationship_type
                                 }
                                ... on StixSightingRelationship {
                                     standard_id
                                     spec_version
                                     created_at
                                     updated_at
                                 }
                             }
                         }
                     }
                 """

      .. raw:: html

         </details>




   .. py:attribute:: properties_with_files
      :value: Multiline-String

      .. raw:: html

         <details><summary>Show Value</summary>

      .. code-block:: python

         """
                     id
                     standard_id
                     entity_type
                     parent_types
                     spec_version
                     created_at
                     updated_at
                     status {
                         id
                         template {
                           id
                           name
                           color
                         }
                     }
                     createdBy {
                         ... on Identity {
                             id
                             standard_id
                             entity_type
                             parent_types
                             spec_version
                             identity_class
                             name
                             description
                             roles
                             contact_information
                             x_opencti_aliases
                             created
                             modified
                             objectLabel {
                                 id
                                 value
                                 color
                             }
                         }
                         ... on Organization {
                             x_opencti_organization_type
                             x_opencti_reliability
                         }
                         ... on Individual {
                             x_opencti_firstname
                             x_opencti_lastname
                         }
                     }
                     objectOrganization {
                         id
                         standard_id
                         name
                     }
                     objectMarking {
                         id
                         standard_id
                         entity_type
                         definition_type
                         definition
                         created
                         modified
                         x_opencti_order
                         x_opencti_color
                     }
                     objectLabel {
                         id
                         value
                         color
                     }
                     externalReferences {
                         edges {
                             node {
                                 id
                                 standard_id
                                 entity_type
                                 source_name
                                 description
                                 url
                                 hash
                                 external_id
                                 created
                                 modified
                                 importFiles {
                                     edges {
                                         node {
                                             id
                                             name
                                             size
                                             metaData {
                                                 mimetype
                                                 version
                                             }
                                         }
                                     }
                                 }
                             }
                         }
                     }
                     revoked
                     confidence
                     created
                     modified
                     attribute_abstract
                     content
                     authors
                     note_types
                     likelihood
                     objects(all: true) {
                         edges {
                             node {
                                 ... on BasicObject {
                                     id
                                     entity_type
                                     parent_types
                                 }
                                 ... on BasicRelationship {
                                     id
                                     entity_type
                                     parent_types
                                 }
                                 ... on StixObject {
                                     standard_id
                                     spec_version
                                     created_at
                                     updated_at
                                 }
                                 ... on AttackPattern {
                                     name
                                 }
                                 ... on Campaign {
                                     name
                                 }
                                 ... on CourseOfAction {
                                     name
                                 }
                                 ... on Individual {
                                     name
                                 }
                                 ... on Organization {
                                     name
                                 }
                                 ... on Sector {
                                     name
                                 }
                                 ... on System {
                                     name
                                 }
                                 ... on Indicator {
                                     name
                                 }
                                 ... on Infrastructure {
                                     name
                                 }
                                 ... on IntrusionSet {
                                     name
                                 }
                                 ... on Position {
                                     name
                                 }
                                 ... on City {
                                     name
                                 }
                                 ... on Country {
                                     name
                                 }
                                 ... on Region {
                                     name
                                 }
                                 ... on Malware {
                                     name
                                 }
                                 ... on ThreatActor {
                                     name
                                 }
                                 ... on Tool {
                                     name
                                 }
                                 ... on Vulnerability {
                                     name
                                 }
                                 ... on Incident {
                                     name
                                 }
                                 ... on Event {
                                     name
                                 }
                                 ... on Channel {
                                     name
                                 }
                                 ... on Narrative {
                                     name
                                 }
                                 ... on Language {
                                     name
                                 }
                                 ... on DataComponent {
                                     name
                                 }
                                 ... on DataSource {
                                     name
                                 }
                                 ... on Case {
                                     name
                                 }
                                 ... on StixCyberObservable {
                                     observable_value
                                 }
                                 ... on StixCoreRelationship {
                                     standard_id
                                     spec_version
                                     created_at
                                     updated_at
                                     relationship_type
                                 }
                                ... on StixSightingRelationship {
                                     standard_id
                                     spec_version
                                     created_at
                                     updated_at
                                 }
                             }
                         }
                     }
                     importFiles {
                         edges {
                             node {
                                 id
                                 name
                                 size
                                 metaData {
                                     mimetype
                                     version
                                 }
                                 objectMarking {
                                     id
                                     standard_id
                                     entity_type
                                     definition_type
                                     definition
                                     created
                                     modified
                                     x_opencti_order
                                     x_opencti_color
                                 }
                             }
                         }
                     }
                 """

      .. raw:: html

         </details>




   .. py:method:: generate_id(created, content, abstract=None)
      :staticmethod:


      Generate a STIX ID for a Note.

      :param created: The creation date of the note
      :type created: datetime or str or None
      :param content: The content of the note (required)
      :type content: str
      :param abstract: A brief summary of the note content
      :type abstract: str or None
      :return: STIX ID for the note
      :rtype: str
      :raises ValueError: If content is None



   .. py:method:: generate_id_from_data(data)
      :staticmethod:


      Generate a STIX ID from note data.

      :param data: Dictionary containing 'content' and optionally 'created'
          and 'attribute_abstract' keys
      :type data: dict
      :return: STIX ID for the note
      :rtype: str



   .. py:method:: list(**kwargs)

      List Note objects.

      :param filters: the filters to apply
      :type filters: dict
      :param search: the search keyword
      :type search: str
      :param first: return the first n rows from the after ID (or the beginning if not set)
      :type first: int
      :param after: ID of the first row for pagination
      :type after: str
      :param orderBy: field to order results by
      :type orderBy: str
      :param orderMode: ordering mode (asc/desc)
      :type orderMode: str
      :param customAttributes: custom attributes to return
      :type customAttributes: list
      :param getAll: whether to retrieve all results
      :type getAll: bool
      :param withPagination: whether to include pagination info
      :type withPagination: bool
      :param withFiles: whether to include files
      :type withFiles: bool
      :return: List of Note objects
      :rtype: list



   .. py:method:: read(**kwargs)

      Read a Note object.

      :param id: the id of the Note
      :type id: str
      :param filters: the filters to apply if no id provided
      :type filters: dict
      :param customAttributes: custom attributes to return
      :type customAttributes: list
      :param withFiles: whether to include files
      :type withFiles: bool
      :return: Note object
      :rtype: dict or None



   .. py:method:: contains_stix_object_or_stix_relationship(**kwargs)

      Check if a note already contains a STIX entity.

      :param id: the id of the Note
      :type id: str
      :param stixObjectOrStixRelationshipId: the id of the Stix-Entity
      :type stixObjectOrStixRelationshipId: str
      :return: Boolean
      :rtype: bool



   .. py:method:: create(**kwargs)

      Create a Note object.

      :param stix_id: (optional) the STIX ID
      :type stix_id: str
      :param createdBy: (optional) the author ID
      :type createdBy: str
      :param objects: (optional) list of STIX object IDs
      :type objects: list
      :param objectMarking: (optional) list of marking definition IDs
      :type objectMarking: list
      :param objectLabel: (optional) list of label IDs
      :type objectLabel: list
      :param externalReferences: (optional) list of external reference IDs
      :type externalReferences: list
      :param revoked: (optional) whether the note is revoked
      :type revoked: bool
      :param confidence: (optional) confidence level (0-100)
      :type confidence: int
      :param lang: (optional) language
      :type lang: str
      :param created: (optional) creation date
      :type created: datetime
      :param modified: (optional) modification date
      :type modified: datetime
      :param abstract: (optional) abstract summary
      :type abstract: str
      :param content: the content of the Note (required)
      :type content: str
      :param authors: (optional) list of authors
      :type authors: list
      :param note_types: (optional) list of note types
      :type note_types: list
      :param likelihood: (optional) likelihood value
      :type likelihood: int
      :param x_opencti_stix_ids: (optional) list of additional STIX IDs
      :type x_opencti_stix_ids: list
      :param objectOrganization: (optional) list of organization IDs
      :type objectOrganization: list
      :param x_opencti_workflow_id: (optional) workflow ID
      :type x_opencti_workflow_id: str
      :param x_opencti_modified_at: (optional) custom modification date
      :type x_opencti_modified_at: datetime
      :param update: (optional) whether to update if exists (default: False)
      :type update: bool
      :param files: (optional) list of File objects to attach
      :type files: list
      :param filesMarkings: (optional) list of lists of marking definition IDs for each file
      :type filesMarkings: list
      :return: Note object
      :rtype: dict or None



   .. py:method:: add_stix_object_or_stix_relationship(**kwargs)

      Add a Stix-Entity object to Note object (object_refs).

      :param id: the id of the Note
      :type id: str
      :param stixObjectOrStixRelationshipId: the id of the Stix-Entity
      :type stixObjectOrStixRelationshipId: str
      :return: Boolean
      :rtype: bool



   .. py:method:: remove_stix_object_or_stix_relationship(**kwargs)

      Remove a Stix-Entity object from Note object (object_refs).

      :param id: the id of the Note
      :type id: str
      :param stixObjectOrStixRelationshipId: the id of the Stix-Entity
      :type stixObjectOrStixRelationshipId: str
      :return: Boolean
      :rtype: bool



   .. py:method:: import_from_stix2(**kwargs)

      Import a Note object from a STIX2 object.

      :param stixObject: the Stix-Object Note
      :type stixObject: dict
      :param extras: extra dict
      :type extras: dict
      :param update: set the update flag on import
      :type update: bool
      :return: Note object
      :rtype: dict or None