create_incident_with_ttps_and_indicators.py

# coding: utf-8

from dateutil.parser import parse

from pycti import OpenCTIApiClient

# Variables
api_url = "https://demo.opencti.io"
api_token = "2b4f29e3-5ea8-4890-8cf5-a76f61f1e2b2"

# OpenCTI initialization
opencti_api_client = OpenCTIApiClient(api_url, api_token)

# Define the date
date = parse("2019-12-01").strftime("%Y-%m-%dT%H:%M:%SZ")

# Prepare all the elements of the report
object_refs = []
observable_refs = []

# Create the incident
incident = opencti_api_client.x_opencti_incident.create(
    name="My new incident",
    description="We have been compromised",
    objective="Espionage",
)
object_refs.append(incident["id"])
# Create the associated report
report = opencti_api_client.report.create(
    name="Report about my new incident",
    description="Forensics and investigation report",
    published=date,
    report_class="Internal Report",
)

# Associate the TTPs to the incident

# Spearphishing Attachment
ttp1 = opencti_api_client.attack_pattern.read(
    filters=[{"key": "external_id", "values": ["T1193"]}]
)
ttp1_relation = opencti_api_client.stix_domain_object.create(
    fromType="Incident",
    fromId=incident["id"],
    toType="Attack-Pattern",
    toId=ttp1["id"],
    relationship_type="uses",
    description="We saw the attacker use Spearphishing Attachment.",
    first_seen=date,
    last_seen=date,
)
# Add kill chain phases to the relation
for kill_chain_phase_id in ttp1["killChainPhasesIds"]:
    opencti_api_client.stix_core_relationship.add_kill_chain_phase(
        id=ttp1_relation["id"], kill_chain_phase_id=kill_chain_phase_id
    )

# Create the observable and indicator and indicates to the relation
# Create the observable
observable_ttp1 = opencti_api_client.stix_cyber_observable.create(
    type="Email-Address", observable_value="phishing@mail.com", createIndicator=True
)
# Get the indicator
indicator_ttp1 = observable_ttp1["indicators"][0]
# Indicates the relation Incident => uses => TTP
indicator_ttp1_relation = opencti_api_client.stix_core_relationship.create(
    fromType="Indicator",
    fromId=indicator_ttp1["id"],
    toType="stix_relation",
    toId=ttp1_relation["id"],
    relationship_type="indicates",
    description="This email address is the sender of the spearphishing.",
    first_seen=date,
    last_seen=date,
)

# Prepare elements for the report
object_refs.extend(
    [
        ttp1["id"],
        ttp1_relation["id"],
        indicator_ttp1["id"],
        indicator_ttp1_relation["id"],
    ]
)
observable_refs.append(observable_ttp1["id"])

# Registry Run Keys / Startup Folder
ttp2 = opencti_api_client.attack_pattern.read(
    filters=[{"key": "external_id", "values": ["T1060"]}]
)
# Create the relation
ttp2_relation = opencti_api_client.stix_core_relationship.create(
    fromType="Incident",
    fromId=incident["id"],
    toType="Attack-Pattern",
    toId=ttp2["id"],
    relationship_type="uses",
    description="We saw the attacker use Registry Run Keys / Startup Folder.",
    first_seen=date,
    last_seen=date,
)
# Add kill chain phases to the relation
for kill_chain_phase_id in ttp2["killChainPhasesIds"]:
    opencti_api_client.stix_core_relationship.add_kill_chain_phase(
        id=ttp2_relation["id"], kill_chain_phase_id=kill_chain_phase_id
    )

# Create the observable and indicator and indicates to the relation
# Create the observable
observable_ttp2 = opencti_api_client.stix_cyber_observable.create(
    type="Registry-Key", observable_value="Disk security", createIndicator=True
)
# Get the indicator
indicator_ttp2 = observable_ttp2["indicators"][0]
# Indicates the relation Incident => uses => TTP
indicator_ttp2_relation = opencti_api_client.stix_core_relationship.create(
    fromType="Indicator",
    fromId=indicator_ttp2["id"],
    toType="stix_relation",
    toId=ttp2_relation["id"],
    relationship_type="indicates",
    description="This registry key is used for persistence of tools.",
    first_seen=date,
    last_seen=date,
)
# Elements for the report
object_refs.extend(
    [
        ttp2["id"],
        ttp2_relation["id"],
        indicator_ttp2["id"],
        indicator_ttp2_relation["id"],
    ]
)
observable_refs.append(observable_ttp2["id"])

# Data Encrypted
ttp3 = opencti_api_client.attack_pattern.read(
    filters=[{"key": "external_id", "values": ["T1022"]}]
)
ttp3_relation = opencti_api_client.stix_core_relationship.create(
    fromType="Incident",
    fromId=incident["id"],
    toType="Attack-Pattern",
    toId=ttp3["id"],
    relationship_type="uses",
    description="We saw the attacker use Data Encrypted.",
    first_seen=date,
    last_seen=date,
)
# Add kill chain phases to the relation
for kill_chain_phase_id in ttp3["killChainPhasesIds"]:
    opencti_api_client.stix_core_relationship.add_kill_chain_phase(
        id=ttp3_relation["id"], kill_chain_phase_id=kill_chain_phase_id
    )
# Elements for the report
object_refs.extend([ttp3["id"], ttp3_relation["id"]])

# Add all element to the report
for object_ref in object_refs:
    opencti_api_client.report.add_opencti_stix_object_or_stix_relationship(
        id=report["id"], report=report, entity_id=object_ref
    )
for observable_ref in observable_refs:
    opencti_api_client.report.add_stix_observable(
        id=report["id"], report=report, stix_observable_id=observable_ref
    )
    opencti_api_client.stix_core_relationship.create(
        fromType="Stix-Observable",
        fromId=observable_ref,
        toType="Incident",
        toId=incident["id"],
        relationship_type="related-to",
        description="This observable is related to the incident.",
        first_seen=date,
        last_seen=date,
    )