pycti.entities.opencti_vulnerability

class pycti.entities.opencti_vulnerability.Vulnerability(opencti)[source]

Main Vulnerability class for OpenCTI

Manages vulnerability information including CVE data in the OpenCTI platform.

Parameters:

opencti (OpenCTIApiClient) – instance of OpenCTIApiClient

__init__(opencti)[source]

Initialize the Vulnerability instance.

Parameters:

opencti (OpenCTIApiClient) – OpenCTI API client instance

create(**kwargs)[source]

Create a Vulnerability object.

Parameters:

  • name (str) – the name of the Vulnerability (required)

  • stix_id (str) – (optional) the STIX ID

  • createdBy (str) – (optional) the author ID

  • objectMarking (list) – (optional) list of marking definition IDs

  • objectLabel (list) – (optional) list of label IDs

  • externalReferences (list) – (optional) list of external reference IDs

  • revoked (bool) – (optional) whether the vulnerability is revoked

  • confidence (int) – (optional) confidence level (0-100)

  • lang (str) – (optional) language

  • created (str) – (optional) creation date

  • modified (str) – (optional) modification date

  • description (str) – (optional) description

  • x_opencti_aliases (list) – (optional) list of aliases

  • x_opencti_cvss_vector_string (str) – (optional) CVSS v3 vector string

  • x_opencti_cvss_base_score (float) – (optional) CVSS v3 base score

  • x_opencti_cvss_base_severity (str) – (optional) CVSS v3 base severity

  • x_opencti_cwe (str) – (optional) CWE ID

  • x_opencti_cisa_kev (bool) – (optional) CISA KEV flag

  • x_opencti_epss_score (float) – (optional) EPSS score

  • x_opencti_epss_percentile (float) – (optional) EPSS percentile

  • x_opencti_score (int) – (optional) OpenCTI score

  • x_opencti_first_seen_active (str) – (optional) first seen active date

  • x_opencti_stix_ids (list) – (optional) list of additional STIX IDs

  • objectOrganization (list) – (optional) list of organization IDs

  • x_opencti_workflow_id (str) – (optional) workflow ID

  • x_opencti_modified_at (str) – (optional) custom modification date

  • update (bool) – (optional) whether to update if exists (default: False)

  • files (list) – (optional) list of File objects to attach

  • filesMarkings (list) – (optional) list of lists of marking definition IDs for each file

Returns:

Vulnerability object

Return type:

dict or None

static generate_id(name)[source]

Generate a STIX ID for a Vulnerability.

Parameters:

name (str) – The name of the vulnerability (e.g., CVE ID)

Returns:

STIX ID for the vulnerability

Return type:

str

static generate_id_from_data(data)[source]

Generate a STIX ID from vulnerability data.

Parameters:

data (dict) – Dictionary containing ‘name’ key

Returns:

STIX ID for the vulnerability

Return type:

str

import_from_stix2(**kwargs)[source]

Import a Vulnerability object from a STIX2 object.

Parameters:

  • stixObject (dict) – the STIX2 Vulnerability object

  • extras (dict) – extra parameters including created_by_id, object_marking_ids, etc.

  • update (bool) – whether to update if the entity already exists

Returns:

Vulnerability object

Return type:

dict or None

list(**kwargs)[source]

List Vulnerability objects.

Parameters:

  • filters (dict) – the filters to apply

  • search (str) – the search keyword

  • first (int) – return the first n rows from the after ID (or the beginning if not set)

  • after (str) – ID of the first row for pagination

  • orderBy (str) – field to order results by

  • orderMode (str) – ordering mode (asc/desc)

  • customAttributes (str) – custom attributes to return

  • getAll (bool) – whether to retrieve all results

  • withPagination (bool) – whether to include pagination info

Returns:

List of Vulnerability objects

Return type:

list

read(**kwargs)[source]

Read a Vulnerability object.

Parameters:

  • id (str) – the id of the Vulnerability

  • filters (dict) – the filters to apply if no id provided

  • customAttributes (str) – custom attributes to return

Returns:

Vulnerability object

Return type:

dict or None