pycti.utils.opencti_stix2_update ================================ .. py:module:: pycti.utils.opencti_stix2_update Classes ------- .. autoapisummary:: pycti.utils.opencti_stix2_update.OpenCTIStix2Update Module Contents --------------- .. py:class:: OpenCTIStix2Update(opencti) Python API for Stix2 Update in OpenCTI. Provides methods to update STIX2 objects in OpenCTI, including adding/removing marking definitions, labels, external references, kill chain phases, and object references. :param opencti: OpenCTI API client instance :type opencti: OpenCTIApiClient Initialize the OpenCTIStix2Update helper. :param opencti: OpenCTI API client instance :type opencti: OpenCTIApiClient .. py:attribute:: opencti .. py:method:: add_object_marking_refs(entity_type, entity_id, object_marking_refs, version=2) Add marking definition references to an entity. :param entity_type: Type of the entity :type entity_type: str :param entity_id: ID of the entity :type entity_id: str :param object_marking_refs: List of marking definition references :type object_marking_refs: list :param version: Version of the patch format (default: 2) :type version: int .. py:method:: remove_object_marking_refs(entity_type, entity_id, object_marking_refs, version=2) Remove marking definition references from an entity. :param entity_type: Type of the entity :type entity_type: str :param entity_id: ID of the entity :type entity_id: str :param object_marking_refs: List of marking definition references :type object_marking_refs: list :param version: Version of the patch format (default: 2) :type version: int .. py:method:: add_external_references(entity_type, entity_id, external_references, version=2) Add external references to an entity. :param entity_type: Type of the entity :type entity_type: str :param entity_id: ID of the entity :type entity_id: str :param external_references: List of external references :type external_references: list :param version: Version of the patch format (default: 2) :type version: int .. py:method:: remove_external_references(entity_type, entity_id, external_references) Remove external references from an entity. :param entity_type: Type of the entity :type entity_type: str :param entity_id: ID of the entity :type entity_id: str :param external_references: List of external references :type external_references: list .. py:method:: add_kill_chain_phases(entity_type, entity_id, kill_chain_phases, version=2) Add kill chain phases to an entity. :param entity_type: Type of the entity :type entity_type: str :param entity_id: ID of the entity :type entity_id: str :param kill_chain_phases: List of kill chain phases :type kill_chain_phases: list :param version: Version of the patch format (default: 2) :type version: int .. py:method:: remove_kill_chain_phases(entity_type, entity_id, kill_chain_phases) Remove kill chain phases from an entity. :param entity_type: Type of the entity :type entity_type: str :param entity_id: ID of the entity :type entity_id: str :param kill_chain_phases: List of kill chain phases :type kill_chain_phases: list .. py:method:: add_object_refs(entity_type, entity_id, object_refs, version=2) Add object references to a container entity. :param entity_type: Type of the container entity (report, note, etc.) :type entity_type: str :param entity_id: ID of the container entity :type entity_id: str :param object_refs: List of object references to add :type object_refs: list :param version: Version of the patch format (default: 2) :type version: int .. py:method:: remove_object_refs(entity_type, entity_id, object_refs, version=2) Remove object references from a container entity. :param entity_type: Type of the container entity (report, note, etc.) :type entity_type: str :param entity_id: ID of the container entity :type entity_id: str :param object_refs: List of object references to remove :type object_refs: list :param version: Version of the patch format (default: 2) :type version: int .. py:method:: add_labels(entity_type, entity_id, labels, version=2) Add labels to an entity. :param entity_type: Type of the entity :type entity_type: str :param entity_id: ID of the entity :type entity_id: str :param labels: List of labels to add :type labels: list :param version: Version of the patch format (default: 2) :type version: int .. py:method:: remove_labels(entity_type, entity_id, labels, version=2) Remove labels from an entity. :param entity_type: Type of the entity :type entity_type: str :param entity_id: ID of the entity :type entity_id: str :param labels: List of labels to remove :type labels: list :param version: Version of the patch format (default: 2) :type version: int .. py:method:: replace_created_by_ref(entity_type, entity_id, created_by_ref, version=2) Replace the created_by reference of an entity. :param entity_type: Type of the entity :type entity_type: str :param entity_id: ID of the entity :type entity_id: str :param created_by_ref: New created_by reference :type created_by_ref: str or list :param version: Version of the patch format (default: 2) :type version: int .. py:method:: update_attribute(entity_type, entity_id, field_input) Update an attribute of an entity. :param entity_type: Type of the entity :type entity_type: str :param entity_id: ID of the entity :type entity_id: str :param field_input: Input containing the attribute update :type field_input: list .. py:method:: process_update(data) Process a STIX2 patch/update operation. :param data: Data containing x_opencti_patch operations :type data: dict