`pycti.entities.opencti_threat_actor`

class pycti.entities.opencti_threat_actor.ThreatActor(opencti)[source]

Main ThreatActor class for OpenCTI

Manages threat actor entities (groups and individuals) in the OpenCTI platform.

Parameters:: opencti (OpenCTIApiClient) – instance of OpenCTIApiClient

__init__(opencti)[source]

Initialize the ThreatActor instance.

create(**kwargs)[source]: Create a Threat-Actor-Group object (deprecated).

Deprecated since version Use: threat_actor_group.create() or threat_actor_individual.create() instead.

static generate_id(name, opencti_type)[source]

Generate a STIX ID for a Threat Actor.

Parameters:

name (str) – the name of the Threat Actor
opencti_type (str) – the type of the Threat Actor (e.g., ‘Threat-Actor-Group’)

Returns:

STIX ID for the Threat Actor

Return type:

str

generate_id_from_data(data)[source]

Generate a STIX ID from Threat Actor data.

Parameters:: data (dict) – Dictionary containing ‘name’ and optionally ‘x_opencti_type’ keys
Returns:: STIX ID for the Threat Actor
Return type:: str

import_from_stix2(**kwargs)[source]

Import a Threat-Actor object from a STIX2 object.

list(**kwargs)[source]

List Threat-Actor objects.

Parameters:

filters (dict) – the filters to apply
search (str) – the search keyword
first (int) – return the first n rows from the after ID (or the beginning if not set)
after (str) – ID of the first row for pagination
orderBy (str) – field to order results by
orderMode (str) – ordering mode (asc/desc)
customAttributes (str) – custom attributes to return
getAll (bool) – whether to retrieve all results
withPagination (bool) – whether to include pagination info

Returns:

List of Threat-Actor objects

Return type:

list

read(**kwargs)[source]

Read a Threat-Actor object.

Parameters:

Returns:

Threat-Actor object

Return type:

dict or None

pycti.entities.opencti_threat_actor