pycti.entities.opencti_threat_actor_individual ============================================== .. py:module:: pycti.entities.opencti_threat_actor_individual Classes ------- .. autoapisummary:: pycti.entities.opencti_threat_actor_individual.ThreatActorIndividual Module Contents --------------- .. py:class:: ThreatActorIndividual(opencti) Main ThreatActorIndividual class for OpenCTI Manages individual threat actor entities in the OpenCTI platform. :param opencti: instance of :py:class:`~pycti.api.opencti_api_client.OpenCTIApiClient` :type opencti: OpenCTIApiClient Initialize the ThreatActorIndividual instance. :param opencti: OpenCTI API client instance :type opencti: OpenCTIApiClient .. py:attribute:: opencti .. py:attribute:: properties :value: Multiline-String .. raw:: html
Show Value .. code-block:: python """ id standard_id entity_type parent_types spec_version created_at updated_at status { id template { id name color } } createdBy { ... on Identity { id standard_id entity_type parent_types spec_version identity_class name description roles contact_information x_opencti_aliases created modified objectLabel { id value color } } ... on Organization { x_opencti_organization_type x_opencti_reliability } ... on Individual { x_opencti_firstname x_opencti_lastname } } objectOrganization { id standard_id name } objectMarking { id standard_id entity_type definition_type definition created modified x_opencti_order x_opencti_color } objectLabel { id value color } externalReferences { edges { node { id standard_id entity_type source_name description url hash external_id created modified importFiles { edges { node { id name size metaData { mimetype version } } } } } } } revoked confidence created modified name description aliases threat_actor_types first_seen last_seen roles goals sophistication resource_level primary_motivation secondary_motivations personal_motivations importFiles { edges { node { id name size metaData { mimetype version } objectMarking { id standard_id entity_type definition_type definition created modified x_opencti_order x_opencti_color } } } } """ .. raw:: html
.. py:method:: generate_id(name) :staticmethod: Generate a STIX ID for a Threat Actor Individual. :param name: The name of the threat actor individual :type name: str :return: STIX ID for the threat actor individual :rtype: str .. py:method:: generate_id_from_data(data) :staticmethod: Generate a STIX ID from threat actor individual data. :param data: Dictionary containing 'name' key :type data: dict :return: STIX ID for the threat actor individual :rtype: str .. py:method:: list(**kwargs) -> dict List Threat-Actor-Individual objects The list method accepts the following kwargs: :param filters: (optional) the filters to apply :type filters: list :param search: (optional) a search keyword to apply for the listing :type search: str :param first: (optional) return the first n rows from the `after` ID or the beginning if not set :type first: int :param after: (optional) OpenCTI object ID of the first row for pagination :type after: str :param orderBy: (optional) the field to order the response on :type orderBy: str :param orderMode: (optional) either "`asc`" or "`desc`" :type orderMode: str :param withPagination: (optional) switch to use pagination :type withPagination: bool :return: List of Threat-Actor-Individual objects :rtype: list .. py:method:: read(**kwargs) -> Union[dict, None] Read a Threat-Actor-Individual object read can be either used with a known OpenCTI entity `id` or by using a valid filter to search and return a single Threat-Actor-Individual entity or None. Note: either `id` or `filters` is required. :param id: the id of the Threat-Actor-Individual :type id: str :param filters: the filters to apply if no id provided :type filters: list :return: Threat-Actor-Individual object :rtype: dict or None .. py:method:: create(**kwargs) Create a Threat-Actor-Individual object The Threat-Actor-Individual entity will only be created if it doesn't exists By setting `update` to `True` it acts like an upsert and updates fields of an existing Threat-Actor-Individual entity. Note: `name` and `description` or `stix_id` is required. :param stix_id: stix2 id reference for the Threat-Actor-Individual entity :type stix_id: str :param createdBy: (optional) id of the organization that created the knowledge :type createdBy: str :param objectMarking: (optional) list of OpenCTI marking definition ids :type objectMarking: list :param objectLabel: (optional) list of OpenCTI label ids :type objectLabel: list :param externalReferences: (optional) list of OpenCTI external references ids :type externalReferences: list :param revoked: is this entity revoked :type revoked: bool :param confidence: confidence level :type confidence: int :param lang: language :type lang: str :param created: (optional) date in OpenCTI date format :type created: str :param modified: (optional) date in OpenCTI date format :type modified: str :param name: name of the threat actor individual :type name: str :param description: description of the threat actor individual :type description: str :param aliases: (optional) list of alias names for the Threat-Actor-Individual :type aliases: list :param threat_actor_types: (optional) list of threat actor types :type threat_actor_types: list :param first_seen: (optional) date in OpenCTI date format :type first_seen: str :param last_seen: (optional) date in OpenCTI date format :type last_seen: str :param roles: (optional) list of roles :type roles: list :param goals: (optional) list of goals :type goals: list :param sophistication: (optional) describe the actors sophistication in text :type sophistication: str :param resource_level: (optional) describe the actors resource_level in text :type resource_level: str :param primary_motivation: (optional) describe the actors primary_motivation in text :type primary_motivation: str :param secondary_motivations: (optional) describe the actors secondary_motivations in list of string :type secondary_motivations: list :param personal_motivations: (optional) describe the actors personal_motivations in list of strings :type personal_motivations: list :param update: (optional) choose to updated an existing Threat-Actor-Individual entity, default `False` :type update: bool :param files: (optional) list of File objects to attach :type files: list :param filesMarkings: (optional) list of lists of marking definition IDs for each file :type filesMarkings: list :return: Threat-Actor-Individual object :rtype: dict or None .. py:method:: import_from_stix2(**kwargs) Import a Threat-Actor-Individual object from a STIX2 object. :param stixObject: the STIX2 Threat-Actor-Individual object :param extras: extra parameters including created_by_id, object_marking_ids, files, filesMarkings, etc. :param update: whether to update if the entity already exists :return: Threat-Actor-Individual object :rtype: dict or None