OpenCTI-Platform#3 Fix STIX2 export and keep stix_id in all circonstances

Author: Samuel Hassine

examples/stix2/export.py

@@ -10,13 +10,13 @@
 config = yaml.load(open(os.path.dirname(__file__) + '/../config.yml'))
 
 # Export file
-export_file = './exports/IntrusionSets.json'
+export_file = './exports/report.json'
 
 # OpenCTI initialization
 opencti = OpenCTI(config['opencti']['api_url'], config['opencti']['api_key'], config['opencti']['log_file'], config['opencti']['verbose'])
 
 # Import the bundle
-bundle = opencti.stix2_export_entity('report', '{ENTITY_ID}', 'full')
+bundle = opencti.stix2_export_entity('report', '{REPORT_ID}', 'full')
 
 with open(export_file, 'w') as file:
     json.dump(bundle, file, indent=4)

pycti/opencti.py

@@ -334,6 +334,7 @@ def get_stix_relation_by_stix_id(self, stix_id):
                     edges {
                         node {
                             id
+                            entity_type
                         }
                     }
                 }
@@ -377,7 +378,8 @@ def get_stix_relation_by_id(self, id):
         result = self.query(query, {'id': id})
         return result['data']['stixRelation']
 
-    def get_stix_relations(self, from_id=None, to_id=None, type='stix_relation', first_seen=None, last_seen=None):
+    def get_stix_relations(self, from_id=None, to_id=None, type='stix_relation', first_seen=None, last_seen=None, inferred=False):
+        self.log('Getting relations, from: ' + from_id + ', to: ' + to_id + '...')
         if type == 'revoked-by':
             return []
 
@@ -395,8 +397,8 @@ def get_stix_relations(self, from_id=None, to_id=None, type='stix_relation', fir
             last_seen_stop = None
 
         query = """
-            query StixRelations($fromId: String, $toId: String, $relationType: String, $firstSeenStart: DateTime, $firstSeenStop: DateTime, $lastSeenStart: DateTime, $lastSeenStop: DateTime) {
-                stixRelations(fromId: $fromId, toId: $toId, relationType: $relationType, firstSeenStart: $firstSeenStart, firstSeenStop: $firstSeenStop, lastSeenStart: $lastSeenStart, lastSeenStop: $lastSeenStop) {
+            query StixRelations($fromId: String, $toId: String, $relationType: String, $firstSeenStart: DateTime, $firstSeenStop: DateTime, $lastSeenStart: DateTime, $lastSeenStop: DateTime, $inferred: Boolean) {
+                stixRelations(fromId: $fromId, toId: $toId, relationType: $relationType, firstSeenStart: $firstSeenStart, firstSeenStop: $firstSeenStop, lastSeenStart: $lastSeenStart, lastSeenStop: $lastSeenStop, inferred: $inferred) {
                     edges {
                         node {
                             id
@@ -432,7 +434,8 @@ def get_stix_relations(self, from_id=None, to_id=None, type='stix_relation', fir
             'firstSeenStart': first_seen_start,
             'firstSeenStop': first_seen_stop,
             'lastSeenStart': last_seen_start,
-            'lastSeenStop': last_seen_stop
+            'lastSeenStop': last_seen_stop,
+            'inferred': inferred
         })
         return self.parse_multiple(result['data']['stixRelations'])
 
@@ -587,6 +590,7 @@ def get_marking_definition_by_stix_id(self, stix_id):
                      edges {
                          node {
                              id
+                             entity_type
                          }
                      }
                  }
@@ -605,6 +609,7 @@ def get_marking_definition_by_definition(self, definition_type, definition):
                      edges {
                          node {
                              id
+                             entity_type
                          }
                      }
                  }
@@ -631,6 +636,7 @@ def create_marking_definition(self,
             mutation MarkingDefinitionAdd($input: MarkingDefinitionAddInput) {
                 markingDefinitionAdd(input: $input) {
                     id
+                    entity_type
                 }
             }
         """
@@ -3474,7 +3480,12 @@ def resolve_role(self, relation_type, from_type, to_type):
                 },
                 'city': {
                     'country': {'from_role': 'localized', 'to_role': 'location'}
-                }
+                },
+                'organization': {
+                    'region': {'from_role': 'localized', 'to_role': 'location'},
+                    'country': {'from_role': 'localized', 'to_role': 'location'},
+                    'city': {'from_role': 'localized', 'to_role': 'location'}
+                },
             },
             'indicates': {
                 'observable': {