@@ -81,6 +81,34 @@ def analysis_match(self, observables):
81
81
json = {"observables" : observables }
82
82
return self ._make_post ("analysis/match" , json = json )
83
83
84
+ def link_add (self , link_src , link_dst , type_src = "observable" , type_dst = "observable" , description = None , source = "API" ):
85
+ """Add link between to entities to the dataset
86
+
87
+ Args:
88
+ link_src: The internal Yeti ID for the source entity to link
89
+ link_dst: The internal Yeti ID for the destination entity to link
90
+ type_src: Type of the entity (either "observable", "entity", or "indicator")
91
+ type_dst: Type of the entity (either "observable", "entity", or "indicator")
92
+ description: A string description of the link
93
+ source: A string representing the source of the data. Defaults to "API".
94
+
95
+ Returns:
96
+ JSON representation of the created link.
97
+ """
98
+
99
+ json = {
100
+ "link_src" : link_src ,
101
+ "link_dst" : link_dst ,
102
+ "type_src" : type_src ,
103
+ "type_dst" : type_dst ,
104
+ "source" : source ,
105
+ }
106
+
107
+ if description is not None :
108
+ json ["description" ] = description
109
+
110
+ return self ._make_post ('link/' , json = json )
111
+
84
112
def observable_search (self , count = 50 , offset = 1 , regex = False , ** kwargs ):
85
113
"""Search for observables.
86
114
@@ -214,11 +242,11 @@ def observable_file_contents(self, objectid=None, filehash=None):
214
242
else :
215
243
raise ValueError ("You need to pass an id or hash parameter." )
216
244
217
- def observable_bulk_add (self , observables , tags = None ):
245
+ def observable_bulk_add (self , observables , tags = None , context = None , source = "API" ):
218
246
"""Add an observable to the dataset
219
247
220
248
Args:
221
- value: the Observable value
249
+ observables: list of Observable value
222
250
tags: An array of strings representing tags
223
251
context: A dictionary object with context information
224
252
source: A string representing the source of the data. Defaults to
@@ -229,7 +257,9 @@ def observable_bulk_add(self, observables, tags=None):
229
257
"""
230
258
if tags is None :
231
259
tags = []
232
- json = {"observables" : [{"tags" : tags , "value" : o } for o in observables ]}
260
+ if context is None :
261
+ context = {}
262
+ json = {"observables" : [{"tags" : tags , "value" : o , "source" : source , "context" : context } for o in observables ]}
233
263
return self ._make_post ('observable/bulk' , json = json )
234
264
235
265
def analytics_oneshot_run (self , name_of_oneshot , value , type_obversable ):
0 commit comments