pycti.entities.opencti_tool

Classes

Tool	Main Tool class for OpenCTI

Module Contents

class pycti.entities.opencti_tool.Tool(opencti)

Main Tool class for OpenCTI

Manages tools used by threat actors in the OpenCTI platform.

Parameters:

opencti (OpenCTIApiClient) – instance of OpenCTIApiClient

Initialize the Tool instance.

Parameters:

opencti (OpenCTIApiClient) – OpenCTI API client instance

opencti

properties = Multiline-String

Show Value

"""
            id
            standard_id
            entity_type
            parent_types
            spec_version
            created_at
            updated_at
            status {
                id
                template {
                  id
                  name
                  color
                }
            }
            createdBy {
                ... on Identity {
                    id
                    standard_id
                    entity_type
                    parent_types
                    spec_version
                    identity_class
                    name
                    description
                    roles
                    contact_information
                    x_opencti_aliases
                    created
                    modified
                    objectLabel {
                        id
                        value
                        color
                    }
                }
                ... on Organization {
                    x_opencti_organization_type
                    x_opencti_reliability
                }
                ... on Individual {
                    x_opencti_firstname
                    x_opencti_lastname
                }
            }
            objectOrganization {
                id
                standard_id
                name
            }
            objectMarking {
                id
                standard_id
                entity_type
                definition_type
                definition
                created
                modified
                x_opencti_order
                x_opencti_color
            }
            objectLabel {
                id
                value
                color
            }
            externalReferences {
                edges {
                    node {
                        id
                        standard_id
                        entity_type
                        source_name
                        description
                        url
                        hash
                        external_id
                        created
                        modified
                        importFiles {
                            edges {
                                node {
                                    id
                                    name
                                    size
                                    metaData {
                                        mimetype
                                        version
                                    }
                                }
                            }
                        }
                    }
                }
            }
            revoked
            confidence
            created
            modified
            name
            description
            aliases
            tool_types
            tool_version
            killChainPhases {
              id
              standard_id
              entity_type
              kill_chain_name
              phase_name
              x_opencti_order
              created
              modified
            }
            importFiles {
                edges {
                    node {
                        id
                        name
                        size
                        metaData {
                            mimetype
                            version
                        }
                        objectMarking {
                            id
                            standard_id
                            entity_type
                            definition_type
                            definition
                            created
                            modified
                            x_opencti_order
                            x_opencti_color
                        }
                    }
                }
            }
        """

static generate_id(name)

Generate a STIX ID for a Tool.

Parameters:

name (str) – The name of the tool

Returns:

STIX ID for the tool

Return type:

str

static generate_id_from_data(data)

Generate a STIX ID from tool data.

Parameters:

data (dict) – Dictionary containing ‘name’ key

Returns:

STIX ID for the tool

Return type:

str

list(**kwargs)

List Tool objects.

Parameters:

• filters (dict) – the filters to apply

• search (str) – the search keyword

• first (int) – return the first n rows from the after ID (or the beginning if not set)

• after (str) – ID of the first row for pagination

• orderBy (str) – field to order results by

• orderMode (str) – ordering mode (asc/desc)

• customAttributes (str) – custom attributes to return

• getAll (bool) – whether to retrieve all results

• withPagination (bool) – whether to include pagination info

Returns:

List of Tool objects

Return type:

list

read(**kwargs)

Read a Tool object.

Parameters:

• id (str) – the id of the Tool

• filters (dict) – the filters to apply if no id provided

• customAttributes (str) – custom attributes to return

Returns:

Tool object

Return type:

dict or None

create(**kwargs)

Create a Tool object.

Parameters:

• stix_id (str) – (optional) the STIX ID

• name (str) – the name of the Tool (required)

• description (str) – description of the tool

• aliases (list) – list of aliases

• tool_types (list) – types of tool

• tool_version (str) – version of the tool

• killChainPhases (list) – kill chain phases

• createdBy (str) – creator identity ID

• objectMarking (list) – marking definition IDs

• objectLabel (list) – label IDs

• externalReferences (list) – external reference IDs

• objectOrganization (list) – organization IDs

• revoked (bool) – whether the tool is revoked

• confidence (int) – confidence level (0-100)

• lang (str) – language

• created (str) – creation date

• modified (str) – modification date

• x_opencti_stix_ids (list) – additional STIX IDs

• x_opencti_workflow_id (str) – workflow ID

• x_opencti_modified_at (str) – custom modification date

• update (bool) – whether to update existing tool

• files (list) – (optional) list of File objects to attach

• filesMarkings (list) – (optional) list of lists of marking definition IDs for each file

Returns:

Tool object

Return type:

dict or None

import_from_stix2(**kwargs)

Import a Tool object from a STIX2 object.

Parameters:

• stixObject (dict) – the STIX2 Tool object

• extras (dict) – extra parameters including created_by_id, object_marking_ids, etc.

• update (bool) – whether to update if the entity already exists

Returns:

Tool object

Return type:

dict or None