Skip to content

Commit f230965

Browse files
author
Samuel Hassine
committed
[client] Try to get indicator by stix id
1 parent 9c664da commit f230965

File tree

2 files changed

+28
-3
lines changed

2 files changed

+28
-3
lines changed

examples/update_entity_attribute.py

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# coding: utf-8
2+
3+
import json
4+
from pycti import OpenCTIApiClient
5+
6+
# Variables
7+
api_url = "https://demo.opencti.io"
8+
api_token = "609caced-7610-4c84-80b4-f3a380d1939b"
9+
10+
# OpenCTI initialization
11+
opencti_api_client = OpenCTIApiClient(api_url, api_token)
12+
13+
# Get the intrusion set APT28
14+
intrusion_set = opencti_api_client.intrusion_set.read(
15+
filters=[{"key": "name", "values": ["APT28"]}]
16+
)
17+
18+
# Update the description
19+
opencti_api_client.stix_domain_entity.update_field(
20+
id=intrusion_set['id'],
21+
key='description',
22+
value='This is APT28!'
23+
)

pycti/entities/opencti_indicator.py

+5-3
Original file line numberDiff line numberDiff line change
@@ -336,9 +336,11 @@ def create(self, **kwargs):
336336
marking_definitions = kwargs.get("markingDefinitions", None)
337337
update = kwargs.get("update", False)
338338

339-
object_result = self.read(
340-
filters=[{"key": "indicator_pattern", "values": [indicator_pattern]}]
341-
)
339+
object_result = self.opencti.indicator.read(id=stix_id_key)
340+
if object_result is None:
341+
object_result = self.read(
342+
filters=[{"key": "indicator_pattern", "values": [indicator_pattern]}]
343+
)
342344
if object_result is not None:
343345
if update:
344346
# name

0 commit comments

Comments
 (0)