Skip to content

Commit c99eea9

Browse files
ArchidoitArchidoit
authored
[client-python] Adapt client python to support new filters format (OpenCTI-Platform#499)
Related to OpenCTI-Platform/opencti#2686
1 parent 21c1b1e commit c99eea9

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

58 files changed

+390
-157
lines changed

‎examples/cmd_line_tag_latest_indicators_of_threat.py

+15-6
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,12 @@ def main():
6363

6464
# Resolve the entity
6565
threat = opencti_api_client.stix_domain_object.read(
66-
types=[entity_type], filters=[{"key": "name", "values": [name]}]
66+
types=[entity_type],
67+
filters={
68+
"mode": "and",
69+
"filters": [{"key": "name", "values": [name]}],
70+
"filterGroups": [],
71+
},
6772
)
6873

6974
if not threat:
@@ -87,11 +92,15 @@ def main():
8792
first=50,
8893
after=after,
8994
customAttributes=custom_attributes,
90-
filters=[
91-
{"key": "indicates", "values": [threat["id"]]},
92-
{"key": "created_at", "values": [created_after], "operator": "gt"},
93-
{"key": "created_at", "values": [created_before], "operator": "lt"},
94-
],
95+
filters={
96+
"mode": "and",
97+
"filters": [
98+
{"key": "indicates", "values": [threat["id"]]},
99+
{"key": "created_at", "values": [created_after], "operator": "gt"},
100+
{"key": "created_at", "values": [created_before], "operator": "lt"},
101+
],
102+
"filterGroups": [],
103+
},
95104
orderBy="created_at",
96105
orderMode="asc",
97106
withPagination=True,

‎examples/delete_intrusion_set.py

+5-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,11 @@
2020

2121
# Get the intrusion set APT28
2222
intrusion_set = opencti_api_client.intrusion_set.read(
23-
filters=[{"key": "name", "values": ["EvilSET123"]}]
23+
filters={
24+
"mode": "and",
25+
"filters": [{"key": "name", "values": ["EvilSET123"]}],
26+
"filterGroups": [],
27+
}
2428
)
2529

2630
# Delete the intrusion set

‎examples/export_incident_stix2.py

+5-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,11 @@
1515

1616
# Get the incident created in the create_incident_with_ttps_and_indicators.py
1717
incident = opencti_api_client.incident.read(
18-
filters=[{"key": "name", "values": ["My new incident"]}]
18+
filters={
19+
"mode": "and",
20+
"filters": [{"key": "name", "values": ["My new incident"]}],
21+
"filterGroups": [],
22+
}
1923
)
2024

2125
# Create the bundle

‎examples/get_attack_pattern_by_mitre_id.py

+5-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,11 @@
1111

1212
# Get the Attack-Pattern T1514
1313
attack_pattern = opencti_api_client.attack_pattern.read(
14-
filters=[{"key": "x_mitre_id", "values": ["T1514"]}]
14+
filters={
15+
"mode": "and",
16+
"filters": [{"key": "x_mitre_id", "values": ["T1514"]}],
17+
"filterGroups": [],
18+
}
1519
)
1620

1721
# Print

‎examples/get_malwares_of_intrusion_set.py

+5-1
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,11 @@
2121

2222
# Get the intrusion set APT28
2323
intrusion_set = opencti_api_client.intrusion_set.read(
24-
filters=[{"key": "name", "values": ["APT28"]}]
24+
filters={
25+
"mode": "and",
26+
"filters": [{"key": "name", "values": ["APT28"]}],
27+
"filterGroups": [],
28+
}
2529
)
2630

2731
# Get the relations from APT28 to malwares

‎examples/get_observable_exact_match.py

+17-3
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,11 @@
1515
)
1616
print("IP ADDRESS")
1717
observable = opencti_api_client.stix_cyber_observable.read(
18-
filters=[{"key": "value", "values": ["110.172.180.180"]}]
18+
filters={
19+
"mode": "and",
20+
"filters": [{"key": "value", "values": ["110.172.180.180"]}],
21+
"filterGroups": [],
22+
}
1923
)
2024
print(observable)
2125

@@ -25,7 +29,11 @@
2529
)
2630
print("FILE NAME")
2731
observable = opencti_api_client.stix_cyber_observable.read(
28-
filters=[{"key": "name", "values": ["activeds.dll"]}]
32+
filters={
33+
"mode": "and",
34+
"filters": [{"key": "name", "values": ["activeds.dll"]}],
35+
"filterGroups": [],
36+
}
2937
)
3038
print(observable)
3139

@@ -36,6 +44,12 @@
3644
)
3745
print("FILE MD5")
3846
observable = opencti_api_client.stix_cyber_observable.read(
39-
filters=[{"key": "hashes_MD5", "values": ["3aad33e025303dbae12c12b4ec5258c1"]}]
47+
filters={
48+
"mode": "and",
49+
"filters": [
50+
{"key": "hashes.MD5", "values": ["3aad33e025303dbae12c12b4ec5258c1"]}
51+
],
52+
"filterGroups": [],
53+
}
4054
)
4155
print(observable)

‎examples/get_reports_about_intrusion_set.py

+10-2
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,20 @@
2222

2323
# Get the intrusion set Sandworm
2424
intrusion_set = opencti_api_client.intrusion_set.read(
25-
filters=[{"key": "name", "values": ["Sandworm Team"]}]
25+
filters={
26+
"mode": "and",
27+
"filters": [{"key": "name", "values": ["Sandworm Team"]}],
28+
"filterGroups": [],
29+
}
2630
)
2731

2832
# Get all reports
2933
reports = opencti_api_client.report.list(
30-
filters=[{"key": "objectContains", "values": [intrusion_set["id"]]}],
34+
filters={
35+
"mode": "and",
36+
"filters": [{"key": "contains", "values": [intrusion_set["id"]]}],
37+
"filterGroups": [],
38+
},
3139
orderBy="published",
3240
orderMode="asc",
3341
)

‎examples/update_entity_attribute.py

+5-1
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,11 @@
2121

2222
# Get the intrusion set APT28
2323
intrusion_set = opencti_api_client.intrusion_set.read(
24-
filters=[{"key": "name", "values": ["APT28"]}]
24+
filters={
25+
"mode": "and",
26+
"filters": [{"key": "name", "values": ["APT28"]}],
27+
"filterGroups": [],
28+
}
2529
)
2630

2731
# Update the description

‎pycti/api/opencti_api_work.py

+6-4
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,7 @@ def get_connector_works(self, connector_id: str) -> List[Dict]:
161161
$count: Int
162162
$orderBy: WorksOrdering
163163
$orderMode: OrderingMode
164-
$filters: [WorksFiltering]
164+
$filters: FilterGroup
165165
) {
166166
works(
167167
first: $count
@@ -207,9 +207,11 @@ def get_connector_works(self, connector_id: str) -> List[Dict]:
207207
query,
208208
{
209209
"count": 50,
210-
"filters": [
211-
{"key": "connector_id", "values": [connector_id]},
212-
],
210+
"filters": {
211+
"mode": "and",
212+
"filters": [{"key": "connector_id", "values": [connector_id]}],
213+
"filterGroups": [],
214+
},
213215
},
214216
)
215217
result = result["data"]["works"]["edges"]

‎pycti/entities/opencti_attack_pattern.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -292,7 +292,7 @@ def list(self, **kwargs):
292292
LOGGER.info("Listing Attack-Patterns with filters %s.", json.dumps(filters))
293293
query = (
294294
"""
295-
query AttackPatterns($filters: [AttackPatternsFiltering], $search: String, $first: Int, $after: ID, $orderBy: AttackPatternsOrdering, $orderMode: OrderingMode) {
295+
query AttackPatterns($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: AttackPatternsOrdering, $orderMode: OrderingMode) {
296296
attackPatterns(filters: $filters, search: $search, first: $first, after: $after, orderBy: $orderBy, orderMode: $orderMode) {
297297
edges {
298298
node {

‎pycti/entities/opencti_campaign.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -259,7 +259,7 @@ def list(self, **kwargs):
259259
LOGGER.info("Listing Campaigns with filters %s.", json.dumps(filters))
260260
query = (
261261
"""
262-
query Campaigns($filters: [CampaignsFiltering], $search: String, $first: Int, $after: ID, $orderBy: CampaignsOrdering, $orderMode: OrderingMode) {
262+
query Campaigns($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: CampaignsOrdering, $orderMode: OrderingMode) {
263263
campaigns(filters: $filters, search: $search, first: $first, after: $after, orderBy: $orderBy, orderMode: $orderMode) {
264264
edges {
265265
node {

‎pycti/entities/opencti_case_incident.py

+9-5
Original file line numberDiff line numberDiff line change
@@ -502,7 +502,7 @@ def list(self, **kwargs):
502502
LOGGER.info("Listing Case Incidents with filters " + json.dumps(filters) + ".")
503503
query = (
504504
"""
505-
query CaseIncidents($filters: [CaseIncidentsFiltering!], $search: String, $first: Int, $after: ID, $orderBy: CaseIncidentsOrdering, $orderMode: OrderingMode) {
505+
query CaseIncidents($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: CaseIncidentsOrdering, $orderMode: OrderingMode) {
506506
caseIncidents(filters: $filters, search: $search, first: $first, after: $after, orderBy: $orderBy, orderMode: $orderMode) {
507507
edges {
508508
node {
@@ -622,10 +622,14 @@ def get_by_stix_id_or_name(self, **kwargs):
622622
if object_result is None and name is not None and created is not None:
623623
created_final = parse(created).strftime("%Y-%m-%d")
624624
object_result = self.read(
625-
filters=[
626-
{"key": "name", "values": [name]},
627-
{"key": "created_day", "values": [created_final]},
628-
],
625+
filters={
626+
"mode": "and",
627+
"filters": [
628+
{"key": "name", "values": [name]},
629+
{"key": "created_day", "values": [created_final]},
630+
],
631+
"filterGroups": [],
632+
},
629633
customAttributes=custom_attributes,
630634
)
631635
return object_result

‎pycti/entities/opencti_case_rfi.py

+9-5
Original file line numberDiff line numberDiff line change
@@ -501,7 +501,7 @@ def list(self, **kwargs):
501501
)
502502
query = (
503503
"""
504-
query CaseRfis($filters: [CaseRfisFiltering!], $search: String, $first: Int, $after: ID, $orderBy: CaseRfisOrdering, $orderMode: OrderingMode) {
504+
query CaseRfis($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: CaseRfisOrdering, $orderMode: OrderingMode) {
505505
caseRfis(filters: $filters, search: $search, first: $first, after: $after, orderBy: $orderBy, orderMode: $orderMode) {
506506
edges {
507507
node {
@@ -621,10 +621,14 @@ def get_by_stix_id_or_name(self, **kwargs):
621621
if object_result is None and name is not None and created is not None:
622622
created_final = parse(created).strftime("%Y-%m-%d")
623623
object_result = self.read(
624-
filters=[
625-
{"key": "name", "values": [name]},
626-
{"key": "created_day", "values": [created_final]},
627-
],
624+
filters={
625+
"mode": "and",
626+
"filters": [
627+
{"key": "name", "values": [name]},
628+
{"key": "created_day", "values": [created_final]},
629+
],
630+
"filterGroups": [],
631+
},
628632
customAttributes=custom_attributes,
629633
)
630634
return object_result

‎pycti/entities/opencti_case_rft.py

+9-5
Original file line numberDiff line numberDiff line change
@@ -497,7 +497,7 @@ def list(self, **kwargs):
497497
LOGGER.info("Listing Case Rfts with filters " + json.dumps(filters) + ".")
498498
query = (
499499
"""
500-
query CaseRfts($filters: [CaseRftsFiltering!], $search: String, $first: Int, $after: ID, $orderBy: CaseRftsOrdering, $orderMode: OrderingMode) {
500+
query CaseRfts($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: CaseRftsOrdering, $orderMode: OrderingMode) {
501501
caseRfts(filters: $filters, search: $search, first: $first, after: $after, orderBy: $orderBy, orderMode: $orderMode) {
502502
edges {
503503
node {
@@ -617,10 +617,14 @@ def get_by_stix_id_or_name(self, **kwargs):
617617
if object_result is None and name is not None and created is not None:
618618
created_final = parse(created).strftime("%Y-%m-%d")
619619
object_result = self.read(
620-
filters=[
621-
{"key": "name", "values": [name]},
622-
{"key": "created_day", "values": [created_final]},
623-
],
620+
filters={
621+
"mode": "and",
622+
"filters": [
623+
{"key": "name", "values": [name]},
624+
{"key": "created_day", "values": [created_final]},
625+
],
626+
"filterGroups": [],
627+
},
624628
customAttributes=custom_attributes,
625629
)
626630
return object_result

‎pycti/entities/opencti_channel.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -255,7 +255,7 @@ def list(self, **kwargs):
255255
LOGGER.info("Listing Channels with filters %s.", json.dumps(filters))
256256
query = (
257257
"""
258-
query Channels($filters: [ChannelsFiltering!], $search: String, $first: Int, $after: ID, $orderBy: ChannelsOrdering, $orderMode: OrderingMode) {
258+
query Channels($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: ChannelsOrdering, $orderMode: OrderingMode) {
259259
channels(filters: $filters, search: $search, first: $first, after: $after, orderBy: $orderBy, orderMode: $orderMode) {
260260
edges {
261261
node {

‎pycti/entities/opencti_course_of_action.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -258,7 +258,7 @@ def list(self, **kwargs):
258258
LOGGER.info("Listing Courses-Of-Action with filters %s.", json.dumps(filters))
259259
query = (
260260
"""
261-
query CoursesOfAction($filters: [CoursesOfActionFiltering], $search: String, $first: Int, $after: ID, $orderBy: CoursesOfActionOrdering, $orderMode: OrderingMode) {
261+
query CoursesOfAction($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: CoursesOfActionOrdering, $orderMode: OrderingMode) {
262262
coursesOfAction(filters: $filters, search: $search, first: $first, after: $after, orderBy: $orderBy, orderMode: $orderMode) {
263263
edges {
264264
node {

‎pycti/entities/opencti_data_component.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -289,7 +289,7 @@ def list(self, **kwargs):
289289
LOGGER.info("Listing Data-Components with filters " + json.dumps(filters) + ".")
290290
query = (
291291
"""
292-
query DataComponents($filters: [DataComponentsFiltering!], $search: String, $first: Int, $after: ID, $orderBy: DataComponentsOrdering, $orderMode: OrderingMode) {
292+
query DataComponents($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: DataComponentsOrdering, $orderMode: OrderingMode) {
293293
dataComponents(filters: $filters, search: $search, first: $first, after: $after, orderBy: $orderBy, orderMode: $orderMode) {
294294
edges {
295295
node {

‎pycti/entities/opencti_data_source.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -260,7 +260,7 @@ def list(self, **kwargs):
260260
)
261261
query = (
262262
"""
263-
query DataSources($filters: [DataSourcesFiltering!], $search: String, $first: Int, $after: ID, $orderBy: DataSourcesOrdering, $orderMode: OrderingMode) {
263+
query DataSources($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: DataSourcesOrdering, $orderMode: OrderingMode) {
264264
dataSources(filters: $filters, search: $search, first: $first, after: $after, orderBy: $orderBy, orderMode: $orderMode) {
265265
edges {
266266
node {

‎pycti/entities/opencti_event.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -259,7 +259,7 @@ def list(self, **kwargs):
259259
LOGGER.info("Listing Events with filters %s", json.dumps(filters))
260260
query = (
261261
"""
262-
query Events($filters: [EventsFiltering!], $search: String, $first: Int, $after: ID, $orderBy: EventsOrdering, $orderMode: OrderingMode) {
262+
query Events($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: EventsOrdering, $orderMode: OrderingMode) {
263263
events(filters: $filters, search: $search, first: $first, after: $after, orderBy: $orderBy, orderMode: $orderMode) {
264264
edges {
265265
node {

‎pycti/entities/opencti_external_reference.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ def list(self, **kwargs):
9595
LOGGER.info("Listing External-Reference with filters %s.", json.dumps(filters))
9696
query = (
9797
"""
98-
query ExternalReferences($filters: [ExternalReferencesFiltering], $first: Int, $after: ID, $orderBy: ExternalReferencesOrdering, $orderMode: OrderingMode) {
98+
query ExternalReferences($filters: FilterGroup, $first: Int, $after: ID, $orderBy: ExternalReferencesOrdering, $orderMode: OrderingMode) {
9999
externalReferences(filters: $filters, first: $first, after: $after, orderBy: $orderBy, orderMode: $orderMode) {
100100
edges {
101101
node {

‎pycti/entities/opencti_feedback.py

+9-5
Original file line numberDiff line numberDiff line change
@@ -475,7 +475,7 @@ def list(self, **kwargs):
475475
)
476476
query = (
477477
"""
478-
query Feedbacks($filters: [FeedbacksFiltering!], $search: String, $first: Int, $after: ID, $orderBy: FeedbacksOrdering, $orderMode: OrderingMode) {
478+
query Feedbacks($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: FeedbacksOrdering, $orderMode: OrderingMode) {
479479
feedbacks(filters: $filters, search: $search, first: $first, after: $after, orderBy: $orderBy, orderMode: $orderMode) {
480480
edges {
481481
node {
@@ -597,10 +597,14 @@ def get_by_stix_id_or_name(self, **kwargs):
597597
if object_result is None and name is not None and created is not None:
598598
created_final = parse(created).strftime("%Y-%m-%d")
599599
object_result = self.read(
600-
filters=[
601-
{"key": "name", "values": [name]},
602-
{"key": "created_day", "values": [created_final]},
603-
],
600+
filters={
601+
"mode": "and",
602+
"filters": [
603+
{"key": "name", "values": [name]},
604+
{"key": "created_day", "values": [created_final]},
605+
],
606+
"filterGroups": [],
607+
},
604608
customAttributes=custom_attributes,
605609
)
606610
return object_result

‎pycti/entities/opencti_grouping.py

+9-5
Original file line numberDiff line numberDiff line change
@@ -446,7 +446,7 @@ def list(self, **kwargs):
446446
LOGGER.info("Listing Groupings with filters %s.", json.dumps(filters))
447447
query = (
448448
"""
449-
query Groupings($filters: [GroupingsFiltering!], $search: String, $first: Int, $after: ID, $orderBy: GroupingsOrdering, $orderMode: OrderingMode) {
449+
query Groupings($filters: FilterGroup, $search: String, $first: Int, $after: ID, $orderBy: GroupingsOrdering, $orderMode: OrderingMode) {
450450
groupings(filters: $filters, search: $search, first: $first, after: $after, orderBy: $orderBy, orderMode: $orderMode) {
451451
edges {
452452
node {
@@ -565,10 +565,14 @@ def get_by_stix_id_or_name(self, **kwargs):
565565
object_result = self.read(id=stix_id, customAttributes=custom_attributes)
566566
if object_result is None and name is not None and context is not None:
567567
object_result = self.read(
568-
filters=[
569-
{"key": "name", "values": [name]},
570-
{"key": "context", "values": [context]},
571-
],
568+
filters={
569+
"mode": "and",
570+
"filters": [
571+
{"key": "name", "values": [name]},
572+
{"key": "context", "values": [context]},
573+
],
574+
"filterGroups": [],
575+
},
572576
customAttributes=custom_attributes,
573577
)
574578
return object_result

0 commit comments

Comments
 (0)