diff --git a/pycti/api/opencti_api_client.py b/pycti/api/opencti_api_client.py index bbde7d68..ee0b2a44 100644 --- a/pycti/api/opencti_api_client.py +++ b/pycti/api/opencti_api_client.py @@ -10,6 +10,7 @@ from pycti import __version__ from pycti.api.opencti_api_connector import OpenCTIApiConnector +from pycti.api.opencti_api_pir import OpenCTIApiPir from pycti.api.opencti_api_playbook import OpenCTIApiPlaybook from pycti.api.opencti_api_work import OpenCTIApiWork from pycti.entities.opencti_attack_pattern import AttackPattern @@ -170,6 +171,7 @@ def __init__( self.playbook = OpenCTIApiPlaybook(self) self.connector = OpenCTIApiConnector(self) self.stix2 = OpenCTIStix2(self) + self.pir = OpenCTIApiPir(self) # Define the entities self.vocabulary = Vocabulary(self) diff --git a/pycti/api/opencti_api_pir.py b/pycti/api/opencti_api_pir.py new file mode 100644 index 00000000..1c6b9fab --- /dev/null +++ b/pycti/api/opencti_api_pir.py @@ -0,0 +1,37 @@ +class OpenCTIApiPir: + """OpenCTIApiPir""" + + def __init__(self, api): + self.api = api + + def add_pir_dependency(self, **kwargs): + id = kwargs.get("id", None) + input = kwargs.get("input", None) + query = """ + mutation PirAddDependency($id: ID!, $input: PIRDependencyAddInput!) { + pirAddDependency(id: $id, input: $input) + } + """ + self.api.query( + query, + { + "id": id, + "input": input, + }, + ) + + def delete_pir_dependency(self, **kwargs): + id = kwargs.get("id", None) + input = kwargs.get("input", None) + query = """ + mutation PirDeleteDependency($id: ID!, $input: PirDeleteDependencyInput!) { + pirDeleteDependency(id: $id, input: $input) + } + """ + self.api.query( + query, + { + "id": id, + "input": input, + }, + ) diff --git a/pycti/utils/opencti_stix2.py b/pycti/utils/opencti_stix2.py index a303844c..f4d1d82a 100644 --- a/pycti/utils/opencti_stix2.py +++ b/pycti/utils/opencti_stix2.py @@ -2484,6 +2484,14 @@ def apply_opencti_operation(self, item, operation): self.opencti.stix.merge(id=target_id, object_ids=source_ids) elif operation == "patch": self.apply_patch(item=item) + elif operation == "add_pir_dependency": + id = item["id"] + input = item["input"] + self.opencti.pir.add_pir_dependency(id=id, input=input) + elif operation == "delete_pir_dependency": + id = item["id"] + input = item["input"] + self.opencti.pir.delete_pir_dependency(id=id, input=input) else: raise ValueError("Not supported opencti_operation") diff --git a/pycti/utils/opencti_stix2_splitter.py b/pycti/utils/opencti_stix2_splitter.py index 10a65590..5cc074c7 100644 --- a/pycti/utils/opencti_stix2_splitter.py +++ b/pycti/utils/opencti_stix2_splitter.py @@ -19,6 +19,7 @@ SUPPORTED_STIX_ENTITY_OBJECTS # entities + list(STIX_CYBER_OBSERVABLE_MAPPING.keys()) # observables + ["relationship", "sighting"] # relationships + + ["pir"] )