Skip to content
This repository was archived by the owner on Dec 5, 2025. It is now read-only.

[client] handle new patch operation in bundle import (opencti #6728) #808

Merged
JeremyCloarec merged 3 commits into from
Jan 13, 2025
Merged

[client] handle new patch operation in bundle import (opencti #6728) #808

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
47c9d05
[client] field patch WIP
JeremyCloarec Jan 8, 2025
bf31513
[client] handle field patch operation
JeremyCloarec Jan 9, 2025
1d4eecd
[client] handle patch operation
JeremyCloarec Jan 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions pycti/utils/opencti_stix2.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2407,6 +2407,19 @@ def export_selected(

return bundle

def apply_patch(self, item):
input = item["opencti_field_patch"]
if item["type"] == "relationship":
self.opencti.stix_core_relationship.update_field(id=item["id"], input=input)
elif item["type"] == "sighting":
self.opencti.stix_sighting_relationship.update_field(
id=item["id"], input=input
)
elif StixCyberObservableTypes.has_value(item["type"]):
self.opencti.stix_cyber_observable.update_field(id=item["id"], input=input)
else:
self.opencti.stix_domain_object.update_field(id=item["id"], input=input)

def import_item(
self,
item,
Expand All @@ -2426,6 +2439,8 @@ def import_item(
target_id = item["merge_target_id"]
source_ids = item["merge_source_ids"]
self.opencti.stix.merge(id=target_id, object_ids=source_ids)
elif item["opencti_operation"] == "patch":
self.apply_patch(item=item)
else:
raise ValueError("Not supported opencti_operation")
elif item["type"] == "relationship":
Expand Down