pycti.entities.opencti_stix_sighting_relationship
=================================================

.. py:module:: pycti.entities.opencti_stix_sighting_relationship


Classes
-------

.. autoapisummary::

   pycti.entities.opencti_stix_sighting_relationship.StixSightingRelationship


Module Contents
---------------

.. py:class:: StixSightingRelationship(opencti)

   Main StixSightingRelationship class for OpenCTI

   Manages STIX sighting relationships in the OpenCTI platform.

   :param opencti: instance of :py:class:`~pycti.api.opencti_api_client.OpenCTIApiClient`
   :type opencti: OpenCTIApiClient

   Initialize the StixSightingRelationship instance.

   :param opencti: OpenCTI API client instance
   :type opencti: OpenCTIApiClient


   .. py:attribute:: opencti


   .. py:attribute:: properties
      :value: Multiline-String

      .. raw:: html

         <details><summary>Show Value</summary>

      .. code-block:: python

         """
                     id
                     entity_type
                     parent_types
                     spec_version
                     created_at
                     updated_at
                     standard_id
                     description
                     first_seen
                     last_seen
                     attribute_count
                     x_opencti_negative
                     created
                     modified
                     confidence
                     status {
                         id
                         template {
                           id
                           name
                           color
                         }
                     }
                     createdBy {
                         ... on Identity {
                             id
                             standard_id
                             entity_type
                             parent_types
                             identity_class
                             name
                             description
                             roles
                             contact_information
                             x_opencti_aliases
                             created
                             modified
                             objectLabel {
                                 id
                                 value
                                 color
                             }
                         }
                         ... on Organization {
                             x_opencti_organization_type
                             x_opencti_reliability
                         }
                         ... on Individual {
                             x_opencti_firstname
                             x_opencti_lastname
                         }
                     }
                     objectMarking {
                         id
                         standard_id
                         entity_type
                         definition_type
                         definition
                         created
                         modified
                         x_opencti_order
                         x_opencti_color
                     }
                     objectOrganization {
                         id
                         standard_id
                         name
                     }
                     objectLabel {
                         id
                         value
                         color
                     }
                     externalReferences {
                         edges {
                             node {
                                 id
                                 standard_id
                                 entity_type
                                 source_name
                                 description
                                 url
                                 hash
                                 external_id
                                 created
                                 modified
                             }
                         }
                     }
                     from {
                         ... on BasicObject {
                             id
                             entity_type
                             parent_types
                         }
                         ... on BasicRelationship {
                             id
                             entity_type
                             parent_types
                         }
                         ... on StixObject {
                             standard_id
                             spec_version
                             created_at
                             updated_at
                         }
                         ... on AttackPattern {
                             name
                         }
                         ... on Campaign {
                             name
                         }
                         ... on CourseOfAction {
                             name
                         }
                         ... on Individual {
                             name
                         }
                         ... on Organization {
                             name
                         }
                         ... on Sector {
                             name
                         }
                          ... on System {
                             name
                         }
                         ... on Indicator {
                             name
                         }
                         ... on Infrastructure {
                             name
                         }
                         ... on IntrusionSet {
                             name
                         }
                         ... on Position {
                             name
                         }
                         ... on City {
                             name
                         }
                         ... on Country {
                             name
                         }
                         ... on Region {
                             name
                         }
                         ... on Malware {
                             name
                         }
                         ... on ThreatActor {
                             name
                         }
                         ... on Tool {
                             name
                         }
                         ... on Vulnerability {
                             name
                         }
                         ... on Incident {
                             name
                         }
                         ... on StixCyberObservable {
                             observable_value
                         }
                         ... on StixCoreRelationship {
                             standard_id
                             spec_version
                             created_at
                             updated_at
                         }
                     }
                     to {
                         ... on BasicObject {
                             id
                             entity_type
                             parent_types
                         }
                         ... on BasicRelationship {
                             id
                             entity_type
                             parent_types
                         }
                         ... on StixObject {
                             standard_id
                             spec_version
                             created_at
                             updated_at
                         }
                         ... on AttackPattern {
                             name
                         }
                         ... on Campaign {
                             name
                         }
                         ... on CourseOfAction {
                             name
                         }
                         ... on Individual {
                             name
                         }
                         ... on Organization {
                             name
                         }
                         ... on Sector {
                             name
                         }
                         ... on System {
                             name
                         }
                         ... on Indicator {
                             name
                         }
                         ... on Infrastructure {
                             name
                         }
                         ... on IntrusionSet {
                             name
                         }
                         ... on Position {
                             name
                         }
                         ... on City {
                             name
                         }
                         ... on Country {
                             name
                         }
                         ... on Region {
                             name
                         }
                         ... on Malware {
                             name
                         }
                         ... on ThreatActor {
                             name
                         }
                         ... on Tool {
                             name
                         }
                         ... on Vulnerability {
                             name
                         }
                         ... on Incident {
                             name
                         }
                         ... on StixCyberObservable {
                             observable_value
                         }
                         ... on StixCoreRelationship {
                             standard_id
                             spec_version
                             created_at
                             updated_at
                         }
                     }
                 """

      .. raw:: html

         </details>




   .. py:method:: generate_id(sighting_of_ref, where_sighted_refs, first_seen=None, last_seen=None)
      :staticmethod:


      Generate a STIX ID for a Sighting relationship.

      :param sighting_of_ref: The STIX ID of the entity being sighted
      :type sighting_of_ref: str
      :param where_sighted_refs: The STIX IDs of where the sighting occurred
      :type where_sighted_refs: list
      :param first_seen: (optional) The first seen date
      :type first_seen: str or datetime.datetime or None
      :param last_seen: (optional) The last seen date
      :type last_seen: str or datetime.datetime or None
      :return: STIX ID for the sighting
      :rtype: str



   .. py:method:: generate_id_from_data(data)
      :staticmethod:


      Generate a STIX ID from sighting data.

      :param data: Dictionary containing sighting_of_ref, where_sighted_refs, and optionally first_seen/last_seen
      :type data: dict
      :return: STIX ID for the sighting
      :rtype: str



   .. py:method:: list(**kwargs)

      List stix_sighting_relationship objects.

      :param fromOrToId: the id of an entity (source or target)
      :type fromOrToId: str
      :param fromId: the id of the source entity of the relation
      :type fromId: str
      :param fromTypes: filter by source entity types
      :type fromTypes: list
      :param toId: the id of the target entity of the relation
      :type toId: str
      :param toTypes: filter by target entity types
      :type toTypes: list
      :param firstSeenStart: the first_seen date start filter
      :type firstSeenStart: str
      :param firstSeenStop: the first_seen date stop filter
      :type firstSeenStop: str
      :param lastSeenStart: the last_seen date start filter
      :type lastSeenStart: str
      :param lastSeenStop: the last_seen date stop filter
      :type lastSeenStop: str
      :param filters: additional filters to apply
      :type filters: dict
      :param first: return the first n rows from the after ID (or the beginning if not set)
      :type first: int
      :param after: ID of the first row for pagination
      :type after: str
      :param orderBy: field to order results by
      :type orderBy: str
      :param orderMode: ordering mode (asc/desc)
      :type orderMode: str
      :param customAttributes: custom attributes to return
      :type customAttributes: str
      :param getAll: whether to retrieve all results
      :type getAll: bool
      :param withPagination: whether to include pagination info
      :type withPagination: bool
      :param search: search keyword
      :type search: str
      :return: List of stix_sighting_relationship objects
      :rtype: list



   .. py:method:: read(**kwargs)

      Read a stix_sighting_relationship object.

      :param id: the id of the stix_sighting_relationship
      :type id: str
      :param fromOrToId: the id of an entity (source or target)
      :type fromOrToId: str
      :param fromId: the id of the source entity of the relation
      :type fromId: str
      :param toId: the id of the target entity of the relation
      :type toId: str
      :param firstSeenStart: the first_seen date start filter
      :type firstSeenStart: str
      :param firstSeenStop: the first_seen date stop filter
      :type firstSeenStop: str
      :param lastSeenStart: the last_seen date start filter
      :type lastSeenStart: str
      :param lastSeenStop: the last_seen date stop filter
      :type lastSeenStop: str
      :param customAttributes: custom attributes to return
      :type customAttributes: str
      :param filters: filters to apply
      :type filters: dict
      :return: stix_sighting_relationship object
      :rtype: dict or None



   .. py:method:: create(**kwargs)

      Create a stix_sighting_relationship object.

      :param fromId: the id of the source entity
      :type fromId: str
      :param toId: the id of the target entity
      :type toId: str
      :param stix_id: (optional) the STIX ID
      :type stix_id: str
      :param description: (optional) description
      :type description: str
      :param first_seen: (optional) first seen date
      :type first_seen: str
      :param last_seen: (optional) last seen date
      :type last_seen: str
      :param count: (optional) sighting count
      :type count: int
      :param x_opencti_negative: (optional) whether this is a negative sighting
      :type x_opencti_negative: bool
      :param created: (optional) creation date
      :type created: str
      :param modified: (optional) modification date
      :type modified: str
      :param confidence: (optional) confidence level (0-100)
      :type confidence: int
      :param createdBy: (optional) the author ID
      :type createdBy: str
      :param objectMarking: (optional) list of marking definition IDs
      :type objectMarking: list
      :param objectLabel: (optional) list of label IDs
      :type objectLabel: list
      :param externalReferences: (optional) list of external reference IDs
      :type externalReferences: list
      :param x_opencti_stix_ids: (optional) list of additional STIX IDs
      :type x_opencti_stix_ids: list
      :param x_opencti_workflow_id: (optional) workflow ID
      :type x_opencti_workflow_id: str
      :param x_opencti_modified_at: (optional) custom modification date
      :type x_opencti_modified_at: str
      :param objectOrganization: (optional) list of organization IDs
      :type objectOrganization: list
      :param update: (optional) whether to update if exists (default: False)
      :type update: bool
      :return: stix_sighting_relationship object
      :rtype: dict or None



   .. py:method:: update_field(**kwargs)

      Update a stix_sighting_relationship object field.

      :param id: the stix_sighting_relationship id
      :type id: str
      :param input: the input of the field
      :type input: list
      :return: The updated stix_sighting_relationship object
      :rtype: dict or None



   .. py:method:: add_marking_definition(**kwargs)

      Add a Marking-Definition object to stix_sighting_relationship object (object_marking_refs).

      :param id: the id of the stix_sighting_relationship
      :type id: str
      :param marking_definition_id: the id of the Marking-Definition
      :type marking_definition_id: str
      :return: True if successful, False otherwise
      :rtype: bool



   .. py:method:: remove_marking_definition(**kwargs)

      Remove a Marking-Definition object from stix_sighting_relationship.

      :param id: the id of the stix_sighting_relationship
      :type id: str
      :param marking_definition_id: the id of the Marking-Definition
      :type marking_definition_id: str
      :return: True if successful, False otherwise
      :rtype: bool



   .. py:method:: update_created_by(**kwargs)

      Update the Identity author of a stix_sighting_relationship object (created_by).

      :param id: the id of the stix_sighting_relationship
      :type id: str
      :param identity_id: the id of the Identity
      :type identity_id: str
      :return: True if successful, False otherwise
      :rtype: bool



   .. py:method:: organization_share(entity_id, organization_ids, sharing_direct_container)

      Share element to multiple organizations.

      :param entity_id: the stix_sighting_relationship id
      :type entity_id: str
      :param organization_ids: the organization IDs to share with
      :type organization_ids: list
      :param sharing_direct_container: whether to share direct container
      :type sharing_direct_container: bool
      :return: None



   .. py:method:: organization_unshare(entity_id, organization_ids, sharing_direct_container)

      Unshare element from multiple organizations.

      :param entity_id: the stix_sighting_relationship id
      :type entity_id: str
      :param organization_ids: the organization IDs to unshare from
      :type organization_ids: list
      :param sharing_direct_container: whether to unshare direct container
      :type sharing_direct_container: bool
      :return: None



   .. py:method:: remove_from_draft(**kwargs)

      Remove a stix_sighting_relationship object from draft (revert).

      :param id: the stix_sighting_relationship id
      :type id: str
      :return: None



   .. py:method:: delete(**kwargs)

      Delete a stix_sighting_relationship.

      :param id: the stix_sighting_relationship id
      :type id: str
      :return: None