diff --git a/pycti/utils/opencti_stix2.py b/pycti/utils/opencti_stix2.py index 07235ac71..252a6eb4c 100644 --- a/pycti/utils/opencti_stix2.py +++ b/pycti/utils/opencti_stix2.py @@ -2407,6 +2407,19 @@ def export_selected( return bundle + def apply_patch(self, item): + input = item["opencti_field_patch"] + if item["type"] == "relationship": + self.opencti.stix_core_relationship.update_field(id=item["id"], input=input) + elif item["type"] == "sighting": + self.opencti.stix_sighting_relationship.update_field( + id=item["id"], input=input + ) + elif StixCyberObservableTypes.has_value(item["type"]): + self.opencti.stix_cyber_observable.update_field(id=item["id"], input=input) + else: + self.opencti.stix_domain_object.update_field(id=item["id"], input=input) + def import_item( self, item, @@ -2426,6 +2439,8 @@ def import_item( target_id = item["merge_target_id"] source_ids = item["merge_source_ids"] self.opencti.stix.merge(id=target_id, object_ids=source_ids) + elif item["opencti_operation"] == "patch": + self.apply_patch(item=item) else: raise ValueError("Not supported opencti_operation") elif item["type"] == "relationship":