Skip to content

Commit 689d902

Browse files
author
Samuel Hassine
committed
[client] Speed-up import by no fetching entity when already fetched
1 parent 98c851c commit 689d902

20 files changed

+350
-36
lines changed

‎examples/add_organization_to_sector.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
from pycti import OpenCTIApiClient
66

77
# Variables
8-
api_url = 'http://localhost:4000'
8+
api_url = 'https://demo.opencti.io'
99
api_token = '22566f94-9091-49ba-b583-efd76cf8b29c'
1010

1111
# OpenCTI initialization

‎examples/create_incident_with_ttps_and_observables.py

+17-13
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,20 @@
11
# coding: utf-8
22

33
import datetime
4+
from dateutil.parser import parse
45

56
from pycti import OpenCTIApiClient
67

78
# Variables
8-
api_url = 'http://localhost:4000'
9+
api_url = 'https://demo.opencti.io'
910
api_token = '22566f94-9091-49ba-b583-efd76cf8b29c'
1011

1112
# OpenCTI initialization
1213
opencti_api_client = OpenCTIApiClient(api_url, api_token)
1314

15+
# Define the date
16+
date = parse('2019-12-01').strftime('%Y-%m-%dT%H:%M:%SZ')
17+
1418
# Create the incident
1519
incident = opencti_api_client.incident.create(
1620
name="My new incident",
@@ -23,7 +27,7 @@
2327
report = opencti_api_client.report.create(
2428
name="Report about my new incident",
2529
description="Forensics and investigation report",
26-
published=datetime.datetime.today().strftime('%Y-%m-%dT%H:%M:%SZ'),
30+
published=date,
2731
report_class="Internal Report"
2832
)
2933
print(report)
@@ -43,8 +47,8 @@
4347
toId=ttp1['id'],
4448
relationship_type='uses',
4549
description='We saw the attacker use Spearphishing Attachment.',
46-
first_seen=datetime.datetime.today().strftime('%Y-%m-%dT%H:%M:%SZ'),
47-
last_seen=datetime.datetime.today().strftime('%Y-%m-%dT%H:%M:%SZ')
50+
first_seen=date,
51+
last_seen=date
4852
)
4953
# Add kill chain phases to the relation
5054
for kill_chain_phase_id in ttp1['killChainPhasesIds']:
@@ -64,8 +68,8 @@
6468
toId=ttp1_relation['id'],
6569
relationship_type='indicates',
6670
description='This email address is the sender of the spearphishing.',
67-
first_seen=datetime.datetime.today().strftime('%Y-%m-%dT%H:%M:%SZ'),
68-
last_seen=datetime.datetime.today().strftime('%Y-%m-%dT%H:%M:%SZ')
71+
first_seen=date,
72+
last_seen=date
6973
)
7074
# Elements for the report
7175
object_refs.extend([ttp1['id'], ttp1_relation['id'], observable_ttp1['id'], observable_ttp1_relation['id']])
@@ -81,8 +85,8 @@
8185
toId=ttp2['id'],
8286
relationship_type='uses',
8387
description='We saw the attacker use Registry Run Keys / Startup Folder.',
84-
first_seen=datetime.datetime.today().strftime('%Y-%m-%dT%H:%M:%SZ'),
85-
last_seen=datetime.datetime.today().strftime('%Y-%m-%dT%H:%M:%SZ')
88+
first_seen=date,
89+
last_seen=date
8690
)
8791
# Add kill chain phases to the relation
8892
for kill_chain_phase_id in ttp2['killChainPhasesIds']:
@@ -102,8 +106,8 @@
102106
toId=ttp2_relation['id'],
103107
relationship_type='indicates',
104108
description='This registry key is used for persistence of tools.',
105-
first_seen=datetime.datetime.today().strftime('%Y-%m-%dT%H:%M:%SZ'),
106-
last_seen=datetime.datetime.today().strftime('%Y-%m-%dT%H:%M:%SZ')
109+
first_seen=date,
110+
last_seen=date
107111
)
108112
# Elements for the report
109113
object_refs.extend([ttp2['id'], ttp2_relation['id'], observable_ttp2['id'], observable_ttp2_relation['id']])
@@ -118,8 +122,8 @@
118122
toId=ttp3['id'],
119123
relationship_type='uses',
120124
description='We saw the attacker use Data Encrypted.',
121-
first_seen=datetime.datetime.today().strftime('%Y-%m-%dT%H:%M:%SZ'),
122-
last_seen=datetime.datetime.today().strftime('%Y-%m-%dT%H:%M:%SZ')
125+
first_seen=date,
126+
last_seen=date
123127
)
124128
# Add kill chain phases to the relation
125129
for kill_chain_phase_id in ttp3['killChainPhasesIds']:
@@ -132,4 +136,4 @@
132136

133137
# Add all element to the report
134138
for object_ref in object_refs:
135-
opencti_api_client.report.add_stix_entity(id=report['id'], entity_id=object_ref)
139+
opencti_api_client.report.add_stix_entity(id=report['id'], report=report, entity_id=object_ref)

‎examples/import_stix2_file.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
from pycti import OpenCTIApiClient
44

55
# Variables
6-
api_url = 'https://demo.opencti.io'
6+
api_url = 'http://localhost:4000'
77
api_token = '22566f94-9091-49ba-b583-efd76cf8b29c'
88

99
# OpenCTI initialization

‎pycti/entities/opencti_attack_pattern.py

+20-1
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,26 @@ def __init__(self, opencti):
8686
id
8787
}
8888
}
89-
}
89+
}
90+
externalReferences {
91+
edges {
92+
node {
93+
id
94+
entity_type
95+
stix_id_key
96+
source_name
97+
description
98+
url
99+
hash
100+
external_id
101+
created
102+
modified
103+
}
104+
relation {
105+
id
106+
}
107+
}
108+
}
90109
"""
91110

92111
"""

‎pycti/entities/opencti_campaign.py

+20-1
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,26 @@ def __init__(self, opencti):
7070
id
7171
}
7272
}
73-
}
73+
}
74+
externalReferences {
75+
edges {
76+
node {
77+
id
78+
entity_type
79+
stix_id_key
80+
source_name
81+
description
82+
url
83+
hash
84+
external_id
85+
created
86+
modified
87+
}
88+
relation {
89+
id
90+
}
91+
}
92+
}
7493
"""
7594

7695
"""

‎pycti/entities/opencti_course_of_action.py

+20-1
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,26 @@ def __init__(self, opencti):
6767
id
6868
}
6969
}
70-
}
70+
}
71+
externalReferences {
72+
edges {
73+
node {
74+
id
75+
entity_type
76+
stix_id_key
77+
source_name
78+
description
79+
url
80+
hash
81+
external_id
82+
created
83+
modified
84+
}
85+
relation {
86+
id
87+
}
88+
}
89+
}
7190
"""
7291

7392
"""

‎pycti/entities/opencti_identity.py

+19
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,25 @@ def __init__(self, opencti):
6767
}
6868
}
6969
}
70+
externalReferences {
71+
edges {
72+
node {
73+
id
74+
entity_type
75+
stix_id_key
76+
source_name
77+
description
78+
url
79+
hash
80+
external_id
81+
created
82+
modified
83+
}
84+
relation {
85+
id
86+
}
87+
}
88+
}
7089
"""
7190

7291
"""

‎pycti/entities/opencti_incident.py

+20-1
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,26 @@ def __init__(self, opencti):
7070
id
7171
}
7272
}
73-
}
73+
}
74+
externalReferences {
75+
edges {
76+
node {
77+
id
78+
entity_type
79+
stix_id_key
80+
source_name
81+
description
82+
url
83+
hash
84+
external_id
85+
created
86+
modified
87+
}
88+
relation {
89+
id
90+
}
91+
}
92+
}
7493
"""
7594

7695
"""

‎pycti/entities/opencti_intrusion_set.py

+20-1
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,26 @@ def __init__(self, opencti):
7575
id
7676
}
7777
}
78-
}
78+
}
79+
externalReferences {
80+
edges {
81+
node {
82+
id
83+
entity_type
84+
stix_id_key
85+
source_name
86+
description
87+
url
88+
hash
89+
external_id
90+
created
91+
modified
92+
}
93+
relation {
94+
id
95+
}
96+
}
97+
}
7998
"""
8099

81100
"""

‎pycti/entities/opencti_malware.py

+20-1
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,26 @@ def __init__(self, opencti):
8484
id
8585
}
8686
}
87-
}
87+
}
88+
externalReferences {
89+
edges {
90+
node {
91+
id
92+
entity_type
93+
stix_id_key
94+
source_name
95+
description
96+
url
97+
hash
98+
external_id
99+
created
100+
modified
101+
}
102+
relation {
103+
id
104+
}
105+
}
106+
}
88107
"""
89108

90109
"""

‎pycti/entities/opencti_report.py

+6-1
Original file line numberDiff line numberDiff line change
@@ -373,11 +373,16 @@ def create(self, **kwargs):
373373

374374
def add_stix_entity(self, **kwargs):
375375
id = kwargs.get('id', None)
376+
report = kwargs.get('report', None)
376377
entity_id = kwargs.get('entity_id', None)
377378
if id is not None and entity_id is not None:
378379
self.opencti.log('info',
379380
'Adding Stix-Entity {' + entity_id + '} to Report {' + id + '}')
380-
report = self.read(id=id)
381+
if report is None:
382+
report = self.read(id=id)
383+
if report is None:
384+
self.opencti.log('error', 'Cannot add Object Ref, report not found')
385+
return False
381386
refs_ids = []
382387
for ref in report['objectRefs']:
383388
refs_ids.append(ref['id'])

‎pycti/entities/opencti_stix_domain_entity.py

+20-1
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,26 @@ def __init__(self, opencti):
6363
id
6464
}
6565
}
66-
}
66+
}
67+
externalReferences {
68+
edges {
69+
node {
70+
id
71+
entity_type
72+
stix_id_key
73+
source_name
74+
description
75+
url
76+
hash
77+
external_id
78+
created
79+
modified
80+
}
81+
relation {
82+
id
83+
}
84+
}
85+
}
6786
"""
6887

6988
"""

0 commit comments

Comments
 (0)