feat(opencti): new OpenCTI threat-intelligence integration
Add a marketplace integration for the OpenCTI platform (GraphQL API, compatible with OpenCTI 5.x/6.x), built on the Python pycti client and run from a remote engine. 26 commands: observables (list/create/delete/field update/add/remove), indicators (list/create/update/field add/remove, types), incidents (list/create/delete, types) with an OCSF ingestion mapper, relationships (list/create/delete), and reference data (organizations, labels, marking definitions, external references). - Ingestion: get_incidents to an OCSF finding mapper + an OpenCTI Incident type. - Auth: user API key (Bearer) via pycti; requires pip install pycti on the engine host. - Scripts are self-contained (INTEGRATION_SECRETS/INTEGRATION_INPUTS in, JSON out) following the established marketplace pattern. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
@@ -0,0 +1,61 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
try:
|
||||
result = client().external_reference.create(
|
||||
source_name=I.get("source_name"),
|
||||
url=I.get("url"),
|
||||
)
|
||||
except Exception as e:
|
||||
fail("Failed to create external reference.", detail=str(e))
|
||||
|
||||
if not result:
|
||||
fail("Failed to create external reference.")
|
||||
|
||||
out({"id": result.get("id"), "message": f"External reference created. id: {result.get('id')}"})
|
||||
@@ -0,0 +1,120 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
def get_incidents(client, search="", created_by=None, creator=None, created_after=None,
|
||||
created_before=None, incident_types=None, label=None, limit=500,
|
||||
last_run_id=None, get_all=False):
|
||||
filters = {"mode": "and", "filters": [], "filterGroups": []}
|
||||
if label:
|
||||
filters["filters"].append({"key": "objectLabel", "values": [label], "operator": "eq", "mode": "or"})
|
||||
if created_by:
|
||||
filters["filters"].append({"key": "createdBy", "values": [created_by], "operator": "eq", "mode": "or"})
|
||||
if creator:
|
||||
filters["filters"].append({"key": "creator_id", "values": [creator], "operator": "eq"})
|
||||
if incident_types:
|
||||
filters["filters"].append({"key": "incident_types", "values": incident_types, "operator": "eq", "mode": "or"})
|
||||
if created_after:
|
||||
filters["filters"].append({"key": "created_at", "values": [created_after], "operator": "gt"})
|
||||
if created_before:
|
||||
filters["filters"].append({"key": "created_at", "values": [created_before], "operator": "lt"})
|
||||
return client.incident.list(
|
||||
after=last_run_id, first=limit, withPagination=True, getAll=get_all, filters=filters, search=search
|
||||
)
|
||||
|
||||
|
||||
search = I.get("search", "")
|
||||
created_by = I.get("created_by")
|
||||
creator = I.get("creator")
|
||||
created_after = I.get("created_after")
|
||||
created_before = I.get("created_before")
|
||||
incident_types = as_list(I.get("incident_types"))
|
||||
label = I.get("label_id")
|
||||
limit = as_int(I.get("limit", 500), 500)
|
||||
last_run_id = I.get("last_run_id")
|
||||
get_all = as_bool(I.get("all_results", "false"))
|
||||
|
||||
try:
|
||||
raw = get_incidents(
|
||||
client(),
|
||||
search=search,
|
||||
created_by=created_by,
|
||||
creator=creator,
|
||||
created_after=created_after,
|
||||
created_before=created_before,
|
||||
incident_types=incident_types,
|
||||
label=label,
|
||||
limit=limit,
|
||||
last_run_id=last_run_id,
|
||||
get_all=get_all,
|
||||
)
|
||||
except Exception as e:
|
||||
fail("Can't list incidents from OpenCTI.", detail=str(e))
|
||||
|
||||
last_run = None if get_all else raw.get("pagination", {}).get("endCursor")
|
||||
incidents_list = raw if get_all else raw.get("entities", [])
|
||||
|
||||
normalized = []
|
||||
for incident in incidents_list:
|
||||
normalized.append({
|
||||
"id": incident.get("id"),
|
||||
"name": incident.get("name"),
|
||||
"description": incident.get("description"),
|
||||
"source": incident.get("source"),
|
||||
"confidence": incident.get("confidence"),
|
||||
"severity": incident.get("severity"),
|
||||
"objective": incident.get("objective"),
|
||||
"createdBy": (incident.get("createdBy") or {}).get("name") or "",
|
||||
"creators": [c.get("name") for c in incident.get("creators", [])],
|
||||
"labels": [l.get("value") for l in incident.get("objectLabel", [])],
|
||||
"incidentTypes": incident.get("incident_types"),
|
||||
"created": incident.get("created"),
|
||||
"updatedAt": incident.get("updated_at"),
|
||||
})
|
||||
|
||||
out({"entities": normalized, "pagination": {"endCursor": last_run}})
|
||||
@@ -0,0 +1,125 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
def get_indicators(client, search, created_by, creator, created_after, created_before,
|
||||
valid_until_after, valid_until_before, valid_from_after, valid_from_before,
|
||||
indicator_types, label, limit, last_run_id, get_all):
|
||||
filters = {"mode": "and", "filters": [], "filterGroups": []}
|
||||
if label:
|
||||
filters["filters"].append({"key": "objectLabel", "values": [label], "operator": "eq", "mode": "or"})
|
||||
if created_by:
|
||||
filters["filters"].append({"key": "createdBy", "values": [created_by], "operator": "eq", "mode": "or"})
|
||||
if creator:
|
||||
filters["filters"].append({"key": "creator_id", "values": [creator], "operator": "eq"})
|
||||
if indicator_types:
|
||||
filters["filters"].append({"key": "indicator_types", "values": indicator_types, "operator": "eq", "mode": "or"})
|
||||
if created_after:
|
||||
filters["filters"].append({"key": "created_at", "values": [created_after], "operator": "gt"})
|
||||
if created_before:
|
||||
filters["filters"].append({"key": "created_at", "values": [created_before], "operator": "lt"})
|
||||
if valid_from_after:
|
||||
filters["filters"].append({"key": "valid_from", "values": [valid_from_after], "operator": "gt"})
|
||||
if valid_from_before:
|
||||
filters["filters"].append({"key": "valid_from", "values": [valid_from_before], "operator": "lt"})
|
||||
if valid_until_after:
|
||||
filters["filters"].append({"key": "valid_until", "values": [valid_until_after], "operator": "gt"})
|
||||
if valid_until_before:
|
||||
filters["filters"].append({"key": "valid_until", "values": [valid_until_before], "operator": "lt"})
|
||||
return client.indicator.list(
|
||||
after=last_run_id, first=limit, withPagination=True, getAll=get_all, filters=filters, search=search
|
||||
)
|
||||
|
||||
|
||||
search = I.get("search")
|
||||
created_by = I.get("created_by")
|
||||
creator = I.get("creator")
|
||||
created_after = I.get("created_after")
|
||||
created_before = I.get("created_before")
|
||||
valid_until_after = I.get("valid_until_after")
|
||||
valid_until_before = I.get("valid_until_before")
|
||||
valid_from_after = I.get("valid_from_after")
|
||||
valid_from_before = I.get("valid_from_before")
|
||||
indicator_types = as_list(I.get("indicator_types"))
|
||||
label = I.get("label_id")
|
||||
limit = as_int(I.get("limit", 50), 50)
|
||||
last_run_id = I.get("last_run_id")
|
||||
get_all = as_bool(I.get("all_results", "false"))
|
||||
|
||||
try:
|
||||
raw = get_indicators(
|
||||
client(), search, created_by, creator, created_after, created_before,
|
||||
valid_until_after, valid_until_before, valid_from_after, valid_from_before,
|
||||
indicator_types, label, limit, last_run_id, get_all,
|
||||
)
|
||||
except Exception as e:
|
||||
fail("Can't list indicators from OpenCTI.", detail=str(e))
|
||||
|
||||
last_run = None if get_all else raw.get("pagination", {}).get("endCursor")
|
||||
indicators_list = raw if get_all else raw.get("entities", [])
|
||||
|
||||
normalized = []
|
||||
for ind in indicators_list:
|
||||
normalized.append({
|
||||
"id": ind.get("id"),
|
||||
"name": ind.get("name"),
|
||||
"description": ind.get("description"),
|
||||
"pattern": ind.get("pattern"),
|
||||
"validFrom": ind.get("valid_from"),
|
||||
"validUntil": ind.get("valid_until"),
|
||||
"score": ind.get("x_opencti_score"),
|
||||
"confidence": ind.get("confidence"),
|
||||
"createdBy": ind.get("createdBy").get("name") if ind.get("createdBy") else "",
|
||||
"creators": [c.get("name") for c in ind.get("creators", [])],
|
||||
"labels": [l.get("value") for l in ind.get("objectLabel", [])],
|
||||
"indicatorTypes": ind.get("indicator_types"),
|
||||
"created": ind.get("created"),
|
||||
"updatedAt": ind.get("updated_at"),
|
||||
})
|
||||
|
||||
out({"indicators": normalized, "lastRunID": last_run})
|
||||
@@ -0,0 +1,137 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
TYPES_TO_OPENCTI = {
|
||||
"account": "User-Account", "domain": "Domain-Name", "email": "Email-Addr",
|
||||
"file-md5": "StixFile", "file-sha1": "StixFile", "file-sha256": "StixFile", "file": "StixFile",
|
||||
"host": "X-OpenCTI-Hostname", "ip": "IPv4-Addr", "ipv6": "IPv6-Addr",
|
||||
"registry key": "Windows-Registry-Key", "url": "Url",
|
||||
}
|
||||
OPENCTI_TO_TYPE = {
|
||||
"User-Account": "Account", "Domain-Name": "Domain", "Email-Addr": "Email", "StixFile": "File",
|
||||
"X-OpenCTI-Hostname": "Host", "IPv4-Addr": "IP", "IPv6-Addr": "IPv6",
|
||||
"Windows-Registry-Key": "Registry Key", "Url": "URL",
|
||||
}
|
||||
|
||||
|
||||
def build_observable_list(observable_list):
|
||||
result = []
|
||||
if "ALL" in observable_list:
|
||||
result = ["User-Account", "Domain-Name", "Email-Addr", "StixFile", "X-OpenCTI-Hostname",
|
||||
"IPv4-Addr", "IPv6-Addr", "Windows-Registry-Key", "Url"]
|
||||
else:
|
||||
result = [TYPES_TO_OPENCTI.get(o.lower(), o) for o in observable_list]
|
||||
return result
|
||||
|
||||
|
||||
def get_observables(client, observable_types, score=None, limit=500, last_run_id=None, search="", get_all=False):
|
||||
observable_type = build_observable_list(observable_types)
|
||||
filters = {
|
||||
"mode": "and",
|
||||
"filters": [{"key": "entity_type", "values": observable_type, "operator": "eq", "mode": "or"}],
|
||||
"filterGroups": [],
|
||||
}
|
||||
if score:
|
||||
filters["filters"].append({"key": "x_opencti_score", "values": score, "operator": "eq", "mode": "or"})
|
||||
return client.stix_cyber_observable.list(
|
||||
after=last_run_id, first=limit, withPagination=True, getAll=get_all, filters=filters, search=search
|
||||
)
|
||||
|
||||
|
||||
observable_types = as_list(I.get("observable_types", "ALL")) or ["ALL"]
|
||||
last_run_id = I.get("last_run_id")
|
||||
limit = as_int(I.get("limit", 50), 50)
|
||||
start = as_int(I.get("score_start", 0), 0)
|
||||
end = as_int(I.get("score_end", 100), 100)
|
||||
score = I.get("score")
|
||||
search = I.get("search", "")
|
||||
get_all = as_bool(I.get("all_results", "false"))
|
||||
|
||||
scores = None
|
||||
if score:
|
||||
if str(score).lower() == "unknown":
|
||||
scores = [None]
|
||||
elif str(score).isdigit():
|
||||
scores = [score]
|
||||
else:
|
||||
fail("Invalid score was provided.")
|
||||
elif start or end:
|
||||
scores = [str(n) for n in range(start, end + 1)]
|
||||
|
||||
try:
|
||||
raw = get_observables(
|
||||
client(),
|
||||
observable_types,
|
||||
score=scores,
|
||||
limit=limit,
|
||||
last_run_id=last_run_id,
|
||||
search=search,
|
||||
get_all=get_all,
|
||||
)
|
||||
except Exception as e:
|
||||
fail("Can't list observables from OpenCTI.", detail=str(e))
|
||||
|
||||
last_run = None if get_all else raw.get("pagination", {}).get("endCursor")
|
||||
observables_list = raw if get_all else raw.get("entities", [])
|
||||
|
||||
normalized = []
|
||||
for o in observables_list:
|
||||
normalized.append({
|
||||
"type": OPENCTI_TO_TYPE.get(o["entity_type"], o["entity_type"]),
|
||||
"value": o.get("observable_value"),
|
||||
"id": o.get("id"),
|
||||
"createdBy": o.get("createdBy").get("id") if o.get("createdBy") else None,
|
||||
"score": o.get("x_opencti_score"),
|
||||
"description": o.get("x_opencti_description"),
|
||||
"labels": [l.get("value") for l in o.get("objectLabel", [])],
|
||||
"marking": [m.get("definition") for m in o.get("objectMarking", [])],
|
||||
"externalReferences": o.get("externalReferences"),
|
||||
})
|
||||
|
||||
out({"observables": normalized, "lastRunID": last_run})
|
||||
@@ -0,0 +1,72 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
try:
|
||||
result = client().incident.create(
|
||||
name=I.get("name"),
|
||||
incident_type=I.get("incident_type"),
|
||||
confidence=as_int(I.get("confidence", 50), 50),
|
||||
severity=I.get("severity"),
|
||||
description=I.get("description"),
|
||||
source=I.get("source"),
|
||||
objective=I.get("objective"),
|
||||
createdBy=I.get("created_by"),
|
||||
first_seen=I.get("first_seen"),
|
||||
last_seen=I.get("last_seen"),
|
||||
objectLabel=I.get("label_id"),
|
||||
objectMarking=I.get("marking_id"),
|
||||
externalReferences=I.get("external_references_id"),
|
||||
)
|
||||
except Exception as e:
|
||||
fail("Can't create incident in OpenCTI.", detail=str(e))
|
||||
|
||||
if result.get("id"):
|
||||
out({"id": result.get("id"), "message": f"Incident created. id: {result.get('id')}"})
|
||||
else:
|
||||
fail("Incident creation failed.")
|
||||
@@ -0,0 +1,55 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
try:
|
||||
client().stix_domain_object.delete(id=I.get("id"))
|
||||
except Exception as e:
|
||||
fail("Can't delete incident in OpenCTI.", detail=str(e))
|
||||
|
||||
out({"success": True, "message": "Incident deleted."})
|
||||
@@ -0,0 +1,64 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
query = """
|
||||
query OpenVocabFieldQuery($category: VocabularyCategory!, $orderBy: VocabularyOrdering, $orderMode: OrderingMode) {
|
||||
vocabularies(category: $category, orderBy: $orderBy, orderMode: $orderMode) {
|
||||
edges { node { id name description } }
|
||||
}
|
||||
}
|
||||
"""
|
||||
|
||||
try:
|
||||
result = client().query(query, {"category": "incident_type_ov"})
|
||||
edges = result["data"]["vocabularies"]["edges"]
|
||||
except Exception as e:
|
||||
fail("Can't list incident types from OpenCTI.", detail=str(e))
|
||||
|
||||
out({"incidentTypes": [edge["node"] for edge in edges]})
|
||||
@@ -0,0 +1,109 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
TYPES_TO_OPENCTI = {
|
||||
"account": "User-Account", "domain": "Domain-Name", "email": "Email-Addr",
|
||||
"file-md5": "StixFile", "file-sha1": "StixFile", "file-sha256": "StixFile", "file": "StixFile",
|
||||
"host": "X-OpenCTI-Hostname", "ip": "IPv4-Addr", "ipv6": "IPv6-Addr",
|
||||
"registry key": "Windows-Registry-Key", "url": "Url",
|
||||
}
|
||||
OBSERVABLE_TYPE_TO_STIX_PATTERN = {
|
||||
"IPv4-Addr": "[ipv4-addr:value = '{{indicator}}']",
|
||||
"IPv6-Addr": "[ipv6-addr:value = '{{indicator}}']",
|
||||
"Domain-Name": "[domain-name:value = '{{indicator}}']",
|
||||
"Url": "[url:value = '{{indicator}}']",
|
||||
"Email-Addr": "[email-addr:value = '{{indicator}}']",
|
||||
"StixFile": "[file:hashes.'SHA-256' = '{{indicator}}']",
|
||||
"Process": "[process:pid = '{{indicator}}']",
|
||||
"User-Account": "[user-account:user_id = '{{indicator}}']",
|
||||
"Windows-Registry-Key": "[windows-registry-key:key = '{{indicator}}']",
|
||||
}
|
||||
|
||||
|
||||
def build_stix_pattern(indicator, observable_type):
|
||||
if observable_type not in OBSERVABLE_TYPE_TO_STIX_PATTERN:
|
||||
fail(f"Invalid observable type: {observable_type}")
|
||||
return OBSERVABLE_TYPE_TO_STIX_PATTERN[observable_type].replace("{{indicator}}", indicator)
|
||||
|
||||
|
||||
name = I.get("name")
|
||||
indicator = I.get("indicator")
|
||||
main_observable_type = TYPES_TO_OPENCTI.get(str(I.get("main_observable_type", "")).lower(), I.get("main_observable_type"))
|
||||
description = I.get("description")
|
||||
valid_from = I.get("valid_from")
|
||||
valid_until = I.get("valid_until")
|
||||
created_by = I.get("created_by")
|
||||
label_id = I.get("label_id")
|
||||
marking_id = I.get("marking_id")
|
||||
external_references_id = I.get("external_references_id")
|
||||
|
||||
pattern = build_stix_pattern(indicator, main_observable_type)
|
||||
|
||||
try:
|
||||
result = client().indicator.create(
|
||||
name=name,
|
||||
description=description,
|
||||
pattern=pattern,
|
||||
pattern_type="stix",
|
||||
x_opencti_main_observable_type=main_observable_type,
|
||||
indicator_types=as_list(I.get("indicator_types")),
|
||||
confidence=as_int(I.get("confidence"), 50),
|
||||
x_opencti_score=as_int(I.get("score"), 50),
|
||||
valid_from=valid_from,
|
||||
valid_until=valid_until,
|
||||
createdBy=created_by,
|
||||
objectLabel=label_id,
|
||||
objectMarking=marking_id,
|
||||
externalReferences=external_references_id,
|
||||
x_opencti_create_observables=as_bool(I.get("create_observables")),
|
||||
)
|
||||
except Exception as e:
|
||||
fail("Can't create indicator in OpenCTI.", detail=str(e))
|
||||
|
||||
out({"id": result.get("id")})
|
||||
@@ -0,0 +1,64 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
field = I.get("field")
|
||||
|
||||
try:
|
||||
if field == "marking":
|
||||
client().stix_domain_object.add_marking_definition(id=I["id"], marking_definition_id=I["value"])
|
||||
elif field == "label":
|
||||
client().stix_domain_object.add_label(id=I["id"], label_id=I["value"])
|
||||
else:
|
||||
fail(f"Invalid field: {field}.")
|
||||
except SystemExit:
|
||||
raise
|
||||
except Exception as e:
|
||||
fail(f"Can't add {field} to indicator in OpenCTI.", detail=str(e))
|
||||
|
||||
out({"success": True, "message": f"Added {field}."})
|
||||
@@ -0,0 +1,64 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
field = I.get("field")
|
||||
|
||||
try:
|
||||
if field == "marking":
|
||||
client().stix_domain_object.remove_marking_definition(id=I["id"], marking_definition_id=I["value"])
|
||||
elif field == "label":
|
||||
client().stix_domain_object.remove_label(id=I["id"], label_id=I["value"])
|
||||
else:
|
||||
fail(f"Invalid field: {field}.")
|
||||
except SystemExit:
|
||||
raise
|
||||
except Exception as e:
|
||||
fail(f"Can't remove {field} from indicator in OpenCTI.", detail=str(e))
|
||||
|
||||
out({"success": True, "message": f"Removed {field}."})
|
||||
@@ -0,0 +1,64 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
query = """
|
||||
query OpenVocabFieldQuery($category: VocabularyCategory!, $orderBy: VocabularyOrdering, $orderMode: OrderingMode) {
|
||||
vocabularies(category: $category, orderBy: $orderBy, orderMode: $orderMode) {
|
||||
edges { node { id name description } }
|
||||
}
|
||||
}
|
||||
"""
|
||||
|
||||
try:
|
||||
result = client().query(query, {"category": "indicator_type_ov"})
|
||||
except Exception as e:
|
||||
fail("Can't list indicator types from OpenCTI.", detail=str(e))
|
||||
|
||||
edges = result["data"]["vocabularies"]["edges"]
|
||||
out({"indicatorTypes": [edge["node"] for edge in edges]})
|
||||
@@ -0,0 +1,114 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
indicator_id = I.get("id")
|
||||
name = I.get("name")
|
||||
description = I.get("description")
|
||||
confidence = I.get("confidence")
|
||||
score = I.get("score")
|
||||
valid_from = I.get("valid_from")
|
||||
valid_until = I.get("valid_until")
|
||||
indicator_types = I.get("indicator_types")
|
||||
label_id = I.get("label_id")
|
||||
marking_id = I.get("marking_id")
|
||||
external_references_id = I.get("external_references_id")
|
||||
|
||||
update_fields = []
|
||||
if name:
|
||||
update_fields.append({"key": "name", "value": name})
|
||||
if description:
|
||||
update_fields.append({"key": "description", "value": description})
|
||||
if confidence:
|
||||
update_fields.append({"key": "confidence", "value": as_int(confidence)})
|
||||
if score:
|
||||
update_fields.append({"key": "x_opencti_score", "value": as_int(score)})
|
||||
if valid_from:
|
||||
update_fields.append({"key": "valid_from", "value": valid_from})
|
||||
if valid_until:
|
||||
update_fields.append({"key": "valid_until", "value": valid_until})
|
||||
if indicator_types:
|
||||
update_fields.append({"key": "indicator_types", "value": indicator_types.split(",")})
|
||||
if label_id:
|
||||
update_fields.append({"key": "objectLabel", "value": label_id.split(",")})
|
||||
if marking_id:
|
||||
update_fields.append({"key": "objectMarking", "value": marking_id.split(",")})
|
||||
if external_references_id:
|
||||
update_fields.append({"key": "externalReferences", "value": external_references_id.split(",")})
|
||||
|
||||
mutation = """
|
||||
mutation IndicatorEditionOverviewFieldPatchMutation($id: ID!, $input: [EditInput!]!, $commitMessage: String, $references: [String]) {
|
||||
indicatorFieldPatch(id: $id, input: $input, commitMessage: $commitMessage, references: $references) {
|
||||
id name confidence description valid_from valid_until x_opencti_score indicator_types
|
||||
}
|
||||
}
|
||||
"""
|
||||
|
||||
variables = {
|
||||
"id": indicator_id,
|
||||
"input": update_fields,
|
||||
"commitMessage": None,
|
||||
"references": None,
|
||||
}
|
||||
|
||||
try:
|
||||
result = client().query(mutation, variables)
|
||||
except Exception as e:
|
||||
fail("Can't update indicator in OpenCTI.", detail=str(e))
|
||||
|
||||
patched = result.get("data", {}).get("indicatorFieldPatch")
|
||||
if patched:
|
||||
out({
|
||||
"id": patched.get("id"),
|
||||
"name": patched.get("name"),
|
||||
"validFrom": valid_from,
|
||||
"validUntil": valid_until,
|
||||
"message": "Indicator updated.",
|
||||
})
|
||||
else:
|
||||
fail("Can't update indicator in OpenCTI.")
|
||||
@@ -0,0 +1,58 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
try:
|
||||
result = client().label.create(value=I.get("name"))
|
||||
except Exception as e:
|
||||
fail("Failed to create label.", detail=str(e))
|
||||
|
||||
if not result:
|
||||
fail("Failed to create label.")
|
||||
|
||||
out({"id": result.get("id"), "message": f"Label created. id: {result.get('id')}"})
|
||||
@@ -0,0 +1,62 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
try:
|
||||
labels = client().label.list(
|
||||
first=as_int(I.get("limit", 50), 50),
|
||||
after=I.get("last_run_id"),
|
||||
withPagination=True,
|
||||
)
|
||||
except Exception as e:
|
||||
fail("Failed to list labels.", detail=str(e))
|
||||
|
||||
out({
|
||||
"labels": [{"value": l.get("value"), "id": l.get("id")} for l in labels.get("entities", [])],
|
||||
"labelsLastRun": labels.get("pagination", {}).get("endCursor"),
|
||||
})
|
||||
@@ -0,0 +1,62 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
try:
|
||||
marks = client().marking_definition.list(
|
||||
first=as_int(I.get("limit", 50), 50),
|
||||
after=I.get("last_run_id"),
|
||||
withPagination=True,
|
||||
)
|
||||
except Exception as e:
|
||||
fail("Failed to list marking definitions.", detail=str(e))
|
||||
|
||||
out({
|
||||
"markingDefinitions": [{"value": m.get("definition"), "id": m.get("id")} for m in marks.get("entities", [])],
|
||||
"markingsLastRun": marks.get("pagination", {}).get("endCursor"),
|
||||
})
|
||||
@@ -0,0 +1,97 @@
|
||||
import json, os, sys
|
||||
import io
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
TYPES_TO_OPENCTI = {
|
||||
"account": "User-Account", "domain": "Domain-Name", "email": "Email-Addr",
|
||||
"file-md5": "StixFile", "file-sha1": "StixFile", "file-sha256": "StixFile", "file": "StixFile",
|
||||
"host": "X-OpenCTI-Hostname", "ip": "IPv4-Addr", "ipv6": "IPv6-Addr",
|
||||
"registry key": "Windows-Registry-Key", "url": "Url",
|
||||
}
|
||||
FILE_TYPES = {
|
||||
"file-md5": "file.hashes.md5", "file-sha1": "file.hashes.sha-1", "file-sha256": "file.hashes.sha-256",
|
||||
}
|
||||
|
||||
|
||||
observable_type = I.get("type")
|
||||
data = {"type": TYPES_TO_OPENCTI.get(observable_type.lower(), observable_type), "value": I.get("value")}
|
||||
if observable_type == "Registry Key":
|
||||
data["key"] = I.get("value")
|
||||
if observable_type == "Account":
|
||||
data["account_login"] = I.get("value")
|
||||
|
||||
simple_observable_key = None
|
||||
simple_observable_value = None
|
||||
if "file" in observable_type.lower():
|
||||
simple_observable_key = FILE_TYPES.get(observable_type.lower(), observable_type)
|
||||
simple_observable_value = I.get("value")
|
||||
|
||||
try:
|
||||
sys.stdout = io.StringIO()
|
||||
try:
|
||||
result = client().stix_cyber_observable.create(
|
||||
simple_observable_key=simple_observable_key,
|
||||
simple_observable_value=simple_observable_value,
|
||||
type=observable_type,
|
||||
createdBy=I.get("created_by"),
|
||||
objectMarking=I.get("marking_id"),
|
||||
objectLabel=I.get("label_id"),
|
||||
externalReferences=I.get("external_references_id"),
|
||||
simple_observable_description=I.get("description"),
|
||||
x_opencti_score=as_int(I.get("score", "50"), 50),
|
||||
observableData=data,
|
||||
createIndicator=as_bool(I.get("create_indicator", "false")),
|
||||
)
|
||||
finally:
|
||||
sys.stdout = sys.__stdout__
|
||||
except Exception as e:
|
||||
sys.stdout = sys.__stdout__
|
||||
fail("Can't create observable in OpenCTI.", detail=str(e))
|
||||
|
||||
out({"id": result.get("id"), "value": I.get("value"), "type": observable_type})
|
||||
@@ -0,0 +1,55 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
try:
|
||||
client().stix_cyber_observable.delete(id=I.get("id"))
|
||||
except Exception as e:
|
||||
fail("Can't delete observable in OpenCTI.", detail=str(e))
|
||||
|
||||
out({"success": True, "message": "Observable deleted."})
|
||||
@@ -0,0 +1,69 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
field = I.get("field")
|
||||
observable_id = I.get("id")
|
||||
value = I.get("value")
|
||||
|
||||
try:
|
||||
if field == "marking":
|
||||
result = client().stix_cyber_observable.add_marking_definition(
|
||||
id=observable_id, marking_definition_id=value
|
||||
)
|
||||
elif field == "label":
|
||||
result = client().stix_cyber_observable.add_label(id=observable_id, label_id=value)
|
||||
else:
|
||||
fail("Invalid field was provided.")
|
||||
except Exception as e:
|
||||
fail("Can't add field to observable in OpenCTI.", detail=str(e))
|
||||
|
||||
if result:
|
||||
out({"success": True, "message": "Added {0}.".format(field)})
|
||||
else:
|
||||
fail("Can't add {0} to observable in OpenCTI.".format(field))
|
||||
@@ -0,0 +1,66 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
field = I.get("field")
|
||||
observable_id = I.get("id")
|
||||
value = I.get("value")
|
||||
|
||||
try:
|
||||
if field == "marking":
|
||||
result = client().stix_cyber_observable.remove_marking_definition(
|
||||
id=observable_id, marking_definition_id=value
|
||||
)
|
||||
elif field == "label":
|
||||
result = client().stix_cyber_observable.remove_label(id=observable_id, label_id=value)
|
||||
else:
|
||||
fail("Invalid field was provided.")
|
||||
except Exception as e:
|
||||
fail("Can't remove field from observable in OpenCTI.", detail=str(e))
|
||||
|
||||
out({"success": True, "message": "Removed {0}.".format(field)})
|
||||
@@ -0,0 +1,63 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
KEY_TO_CTI_NAME = {"description": "x_opencti_description", "score": "x_opencti_score"}
|
||||
|
||||
|
||||
field = I.get("field")
|
||||
if field not in KEY_TO_CTI_NAME:
|
||||
fail("Invalid field was provided.")
|
||||
key = KEY_TO_CTI_NAME[field]
|
||||
|
||||
try:
|
||||
result = client().stix_cyber_observable.update_field(id=I.get("id"), key=key, value=I.get("value"))
|
||||
except Exception as e:
|
||||
fail("Can't update observable field in OpenCTI.", detail=str(e))
|
||||
|
||||
out({"id": result.get("id"), "message": "Observable updated."})
|
||||
@@ -0,0 +1,64 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient, Identity
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
try:
|
||||
identity = Identity(client())
|
||||
result = identity.create(
|
||||
name=I.get("name"),
|
||||
type="Organization",
|
||||
x_opencti_reliability=I.get("reliability"),
|
||||
description=I.get("description"),
|
||||
)
|
||||
except Exception as e:
|
||||
fail("Failed to create organization.", detail=str(e))
|
||||
|
||||
if not result:
|
||||
fail("Failed to create organization.")
|
||||
|
||||
out({"id": result.get("id"), "message": f"Organization created. id: {result.get('id')}"})
|
||||
@@ -0,0 +1,63 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
try:
|
||||
orgs = client().identity.list(
|
||||
types="Organization",
|
||||
first=as_int(I.get("limit", 50), 50),
|
||||
after=I.get("last_run_id"),
|
||||
withPagination=True,
|
||||
)
|
||||
except Exception as e:
|
||||
fail("Failed to list organizations.", detail=str(e))
|
||||
|
||||
out({
|
||||
"organizations": [{"name": o.get("name"), "id": o.get("id")} for o in orgs.get("entities", [])],
|
||||
"organizationsLastRun": orgs.get("pagination", {}).get("endCursor"),
|
||||
})
|
||||
@@ -0,0 +1,64 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
try:
|
||||
result = client().stix_core_relationship.create(
|
||||
fromId=I.get("from_id"),
|
||||
toId=I.get("to_id"),
|
||||
relationship_type=I.get("relationship_type") or "related-to",
|
||||
description=I.get("description"),
|
||||
confidence=as_int(I.get("confidence")) or None,
|
||||
)
|
||||
except Exception as e:
|
||||
fail("Failed to create relationship.", detail=str(e))
|
||||
|
||||
if not result:
|
||||
fail("Failed to create relationship.")
|
||||
|
||||
out({"id": result.get("id"), "relationshipType": result.get("relationship_type")})
|
||||
@@ -0,0 +1,55 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
try:
|
||||
client().stix_core_relationship.delete(id=I.get("id"))
|
||||
except Exception as e:
|
||||
fail("Failed to delete relationship.", detail=str(e))
|
||||
|
||||
out({"success": True, "message": "Relationship deleted."})
|
||||
@@ -0,0 +1,72 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
try:
|
||||
rels = client().stix_core_relationship.list(
|
||||
fromOrToId=I.get("from_id"),
|
||||
first=as_int(I.get("limit", 50), 50),
|
||||
after=I.get("last_run_id"),
|
||||
withPagination=True,
|
||||
)
|
||||
except Exception as e:
|
||||
fail("Failed to list relationships.", detail=str(e))
|
||||
|
||||
cursor = rels.get("pagination", {}).get("endCursor")
|
||||
|
||||
relationships = []
|
||||
for rel in rels.get("entities", []):
|
||||
relationships.append({
|
||||
"id": rel.get("id"),
|
||||
"relationshipType": rel.get("relationship_type"),
|
||||
"fromId": rel["from"]["id"],
|
||||
"toId": rel["to"]["id"],
|
||||
"toEntityType": rel["to"]["entity_type"],
|
||||
})
|
||||
|
||||
out({"relationships": relationships, "relationshipsLastRun": cursor})
|
||||
@@ -0,0 +1,55 @@
|
||||
import json, os, sys
|
||||
|
||||
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def out(value):
|
||||
print(json.dumps(value, default=str))
|
||||
|
||||
|
||||
def fail(message, **extra):
|
||||
payload = {"error": message}
|
||||
payload.update(extra)
|
||||
print(json.dumps(payload, default=str))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def as_bool(v):
|
||||
return v if isinstance(v, bool) else str(v).lower() in ("1", "true", "yes")
|
||||
|
||||
|
||||
def as_int(v, default=None):
|
||||
try:
|
||||
return int(v)
|
||||
except (TypeError, ValueError):
|
||||
return default
|
||||
|
||||
|
||||
def as_list(v):
|
||||
if isinstance(v, list):
|
||||
return v
|
||||
if v in (None, ""):
|
||||
return []
|
||||
return [x.strip() for x in str(v).split(",") if x.strip()]
|
||||
|
||||
|
||||
try:
|
||||
from pycti import OpenCTIApiClient
|
||||
except ImportError as e:
|
||||
fail("The 'pycti' Python library is required for the OpenCTI integration. "
|
||||
"Install it on the execution host (engine): pip install pycti", detail=str(e))
|
||||
|
||||
|
||||
def client():
|
||||
base = str(S.get("base_url", "")).strip().rstrip("/")
|
||||
api_key = S.get("api_key") or (S.get("credentials") or {}).get("password")
|
||||
return OpenCTIApiClient(base, api_key, ssl_verify=not as_bool(S.get("insecure")), log_level="error")
|
||||
|
||||
|
||||
try:
|
||||
client().label.list(first=1, withPagination=True)
|
||||
except Exception as e:
|
||||
fail("Connection failed.", detail=str(e))
|
||||
|
||||
out({"status": "ok"})
|
||||
Reference in New Issue
Block a user