diff --git a/examples/get_indicators_of_malware.py b/examples/get_indicators_of_malware.py new file mode 100644 index 00000000..84cc2e1e --- /dev/null +++ b/examples/get_indicators_of_malware.py @@ -0,0 +1,30 @@ +# coding: utf-8 +import datetime + +from pycti import OpenCTIApiClient + +# Variables +api_url = "http://opencti:4000" +api_token = "bfa014e0-e02e-4aa6-a42b-603b19dcf159" +malware = "Emotet" + +# OpenCTI initialization +opencti_api_client = OpenCTIApiClient(api_url, api_token) + +# Get the malware set in variable +malware = opencti_api_client.malware.read( + filters={ + "mode": "and", + "filters": [{"key": "name", "values": [malware]}], + "filterGroups": [], + } +) + +# Get the relations from the malware to indicators +stix_relations = opencti_api_client.stix_core_relationship.list( + fromTypes=["Indicator"], toId=malware["id"] +) + +# Print +for stix_relation in stix_relations: + print("[" + stix_relation["from"]["standard_id"] + "] " + stix_relation["from"]["name"]) \ No newline at end of file diff --git a/examples/get_malwares_of_intrusion_set.py b/examples/get_malwares_of_intrusion_set.py index edce20eb..57432735 100644 --- a/examples/get_malwares_of_intrusion_set.py +++ b/examples/get_malwares_of_intrusion_set.py @@ -35,4 +35,4 @@ # Print for stix_relation in stix_relations: - print("[" + stix_relation["to"]["stix_id"] + "] " + stix_relation["to"]["name"]) + print("[" + stix_relation["to"]["standard_id"] + "] " + stix_relation["to"]["name"])