[client] Implement missing granted_refs at creation

pycti/entities/opencti_attack_pattern.py

@@ -427,10 +427,10 @@ def import_from_stix2(self, **kwargs):
                 stix_object[
                     "x_opencti_stix_ids"
                 ] = self.opencti.get_attribute_in_extension("stix_ids", stix_object)
-            if "granted_refs" not in stix_object:
-                stix_object["granted_refs"] = self.opencti.get_attribute_in_extension(
-                    "granted_refs", stix_object
-                )
+            if "x_opencti_granted_refs" not in stix_object:
+                stix_object[
+                    "x_opencti_granted_refs"
+                ] = self.opencti.get_attribute_in_extension("granted_refs", stix_object)
 
             return self.create(
                 stix_id=stix_object["id"],
@@ -478,8 +478,8 @@ def import_from_stix2(self, **kwargs):
                 x_opencti_stix_ids=stix_object["x_opencti_stix_ids"]
                 if "x_opencti_stix_ids" in stix_object
                 else None,
-                objectOrganization=stix_object["granted_refs"]
-                if "granted_refs" in stix_object
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
                 else None,
                 update=update,
             )

pycti/entities/opencti_campaign.py

@@ -350,10 +350,10 @@ def import_from_stix2(self, **kwargs):
                 stix_object[
                     "x_opencti_stix_ids"
                 ] = self.opencti.get_attribute_in_extension("stix_ids", stix_object)
-            if "granted_refs" not in stix_object:
-                stix_object["granted_refs"] = self.opencti.get_attribute_in_extension(
-                    "granted_refs", stix_object
-                )
+            if "x_opencti_granted_refs" not in stix_object:
+                stix_object[
+                    "x_opencti_granted_refs"
+                ] = self.opencti.get_attribute_in_extension("granted_refs", stix_object)
 
             return self.create(
                 stix_id=stix_object["id"],
@@ -395,8 +395,8 @@ def import_from_stix2(self, **kwargs):
                 x_opencti_stix_ids=stix_object["x_opencti_stix_ids"]
                 if "x_opencti_stix_ids" in stix_object
                 else None,
-                objectOrganization=stix_object["granted_refs"]
-                if "granted_refs" in stix_object
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
                 else None,
                 update=update,
             )

pycti/entities/opencti_case_incident.py

@@ -634,10 +634,10 @@ def import_from_stix2(self, **kwargs):
                 stix_object[
                     "x_opencti_stix_ids"
                 ] = self.opencti.get_attribute_in_extension("stix_ids", stix_object)
-            if "granted_refs" not in stix_object:
-                stix_object["granted_refs"] = self.opencti.get_attribute_in_extension(
-                    "granted_refs", stix_object
-                )
+            if "x_opencti_granted_refs" not in stix_object:
+                stix_object[
+                    "x_opencti_granted_refs"
+                ] = self.opencti.get_attribute_in_extension("granted_refs", stix_object)
             if "x_opencti_workflow_id" not in stix_object:
                 stix_object[
                     "x_opencti_workflow_id"
@@ -681,8 +681,8 @@ def import_from_stix2(self, **kwargs):
                 x_opencti_stix_ids=stix_object["x_opencti_stix_ids"]
                 if "x_opencti_stix_ids" in stix_object
                 else None,
-                objectOrganization=stix_object["granted_refs"]
-                if "granted_refs" in stix_object
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
                 else None,
                 x_opencti_workflow_id=stix_object["x_opencti_workflow_id"]
                 if "x_opencti_workflow_id" in stix_object

pycti/entities/opencti_case_rfi.py

@@ -626,10 +626,10 @@ def import_from_stix2(self, **kwargs):
                 stix_object[
                     "x_opencti_stix_ids"
                 ] = self.opencti.get_attribute_in_extension("stix_ids", stix_object)
-            if "granted_refs" not in stix_object:
-                stix_object["granted_refs"] = self.opencti.get_attribute_in_extension(
-                    "granted_refs", stix_object
-                )
+            if "x_opencti_granted_refs" not in stix_object:
+                stix_object[
+                    "x_opencti_granted_refs"
+                ] = self.opencti.get_attribute_in_extension("granted_refs", stix_object)
 
             return self.create(
                 stix_id=stix_object["id"],
@@ -662,8 +662,8 @@ def import_from_stix2(self, **kwargs):
                 x_opencti_stix_ids=stix_object["x_opencti_stix_ids"]
                 if "x_opencti_stix_ids" in stix_object
                 else None,
-                objectOrganization=stix_object["granted_refs"]
-                if "granted_refs" in stix_object
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
                 else None,
                 update=update,
                 information_types=stix_object["information_types"]

pycti/entities/opencti_case_rft.py

@@ -622,10 +622,10 @@ def import_from_stix2(self, **kwargs):
                 stix_object[
                     "x_opencti_stix_ids"
                 ] = self.opencti.get_attribute_in_extension("stix_ids", stix_object)
-            if "granted_refs" not in stix_object:
-                stix_object["granted_refs"] = self.opencti.get_attribute_in_extension(
-                    "granted_refs", stix_object
-                )
+            if "x_opencti_granted_refs" not in stix_object:
+                stix_object[
+                    "x_opencti_granted_refs"
+                ] = self.opencti.get_attribute_in_extension("granted_refs", stix_object)
 
             return self.create(
                 stix_id=stix_object["id"],
@@ -661,8 +661,8 @@ def import_from_stix2(self, **kwargs):
                 x_opencti_stix_ids=stix_object["x_opencti_stix_ids"]
                 if "x_opencti_stix_ids" in stix_object
                 else None,
-                objectOrganization=stix_object["granted_refs"]
-                if "granted_refs" in stix_object
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
                 else None,
                 update=update,
             )

pycti/entities/opencti_channel.py

@@ -383,8 +383,8 @@ def import_from_stix2(self, **kwargs):
                 x_opencti_stix_ids=stix_object["x_opencti_stix_ids"]
                 if "x_opencti_stix_ids" in stix_object
                 else None,
-                objectOrganization=stix_object["granted_refs"]
-                if "granted_refs" in stix_object
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
                 else None,
                 update=update,
             )

pycti/entities/opencti_course_of_action.py

@@ -415,8 +415,8 @@ def import_from_stix2(self, **kwargs):
                 else None,
                 x_opencti_aliases=self.opencti.stix2.pick_aliases(stix_object),
                 x_mitre_id=x_mitre_id,
-                objectOrganization=stix_object["granted_refs"]
-                if "granted_refs" in stix_object
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
                 else None,
                 update=update,
             )

pycti/entities/opencti_data_component.py

@@ -421,8 +421,8 @@ def import_from_stix2(self, **kwargs):
                 x_opencti_stix_ids=stix_object["x_opencti_stix_ids"]
                 if "x_opencti_stix_ids" in stix_object
                 else None,
-                objectOrganization=stix_object["granted_refs"]
-                if "granted_refs" in stix_object
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
                 else None,
                 update=update,
             )

pycti/entities/opencti_data_source.py

@@ -413,8 +413,8 @@ def import_from_stix2(self, **kwargs):
                 x_opencti_stix_ids=stix_object["x_opencti_stix_ids"]
                 if "x_opencti_stix_ids" in stix_object
                 else None,
-                objectOrganization=stix_object["granted_refs"]
-                if "granted_refs" in stix_object
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
                 else None,
                 update=update,
             )

pycti/entities/opencti_feedback.py

@@ -685,8 +685,8 @@ def import_from_stix2(self, **kwargs):
                 x_opencti_stix_ids=stix_object["x_opencti_stix_ids"]
                 if "x_opencti_stix_ids" in stix_object
                 else None,
-                objectOrganization=stix_object["granted_refs"]
-                if "granted_refs" in stix_object
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
                 else None,
                 update=update,
             )

pycti/entities/opencti_grouping.py

@@ -627,8 +627,8 @@ def import_from_stix2(self, **kwargs):
                 x_opencti_stix_ids=stix_object["x_opencti_stix_ids"]
                 if "x_opencti_stix_ids" in stix_object
                 else None,
-                objectOrganization=stix_object["granted_refs"]
-                if "granted_refs" in stix_object
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
                 else None,
                 x_opencti_aliases=self.opencti.stix2.pick_aliases(stix_object),
                 update=update,

pycti/entities/opencti_incident.py

@@ -412,8 +412,8 @@ def import_from_stix2(self, **kwargs):
                 x_opencti_stix_ids=stix_object["x_opencti_stix_ids"]
                 if "x_opencti_stix_ids" in stix_object
                 else None,
-                objectOrganization=stix_object["granted_refs"]
-                if "granted_refs" in stix_object
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
                 else None,
                 update=update,
             )

pycti/entities/opencti_indicator.py

@@ -596,8 +596,8 @@ def import_from_stix2(self, **kwargs):
                 x_opencti_create_observables=stix_object["x_opencti_create_observables"]
                 if "x_opencti_create_observables" in stix_object
                 else False,
-                objectOrganization=stix_object["granted_refs"]
-                if "granted_refs" in stix_object
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
                 else None,
                 update=update,
             )

pycti/entities/opencti_infrastructure.py

@@ -321,6 +321,7 @@ def create(self, **kwargs):
         last_seen = kwargs.get("last_seen", None)
         kill_chain_phases = kwargs.get("killChainPhases", None)
         x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None)
+        granted_refs = kwargs.get("objectOrganization", None)
         update = kwargs.get("update", False)
 
         if name is not None:
@@ -343,6 +344,7 @@ def create(self, **kwargs):
                         "createdBy": created_by,
                         "objectMarking": object_marking,
                         "objectLabel": object_label,
+                        "objectOrganization": granted_refs,
                         "externalReferences": external_references,
                         "revoked": revoked,
                         "confidence": confidence,
@@ -381,14 +383,16 @@ def import_from_stix2(self, **kwargs):
         stix_object = kwargs.get("stixObject", None)
         extras = kwargs.get("extras", {})
         update = kwargs.get("update", False)
-
-        # Search in extensions
-        if "x_opencti_stix_ids" not in stix_object:
-            stix_object["x_opencti_stix_ids"] = self.opencti.get_attribute_in_extension(
-                "stix_ids", stix_object
-            )
-
         if stix_object is not None:
+            # Search in extensions
+            if "x_opencti_stix_ids" not in stix_object:
+                stix_object[
+                    "x_opencti_stix_ids"
+                ] = self.opencti.get_attribute_in_extension("stix_ids", stix_object)
+            if "x_opencti_granted_refs" not in stix_object:
+                stix_object[
+                    "x_opencti_granted_refs"
+                ] = self.opencti.get_attribute_in_extension("granted_refs", stix_object)
             return self.create(
                 stix_id=stix_object["id"],
                 createdBy=extras["created_by_id"]
@@ -432,6 +436,9 @@ def import_from_stix2(self, **kwargs):
                 x_opencti_stix_ids=stix_object["x_opencti_stix_ids"]
                 if "x_opencti_stix_ids" in stix_object
                 else None,
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
+                else None,
                 update=update,
             )
         else:

pycti/entities/opencti_intrusion_set.py

@@ -393,8 +393,8 @@ def import_from_stix2(self, **kwargs):
                 x_opencti_stix_ids=stix_object["x_opencti_stix_ids"]
                 if "x_opencti_stix_ids" in stix_object
                 else None,
-                objectOrganization=stix_object["granted_refs"]
-                if "granted_refs" in stix_object
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
                 else None,
                 update=update,
             )

pycti/entities/opencti_malware.py

@@ -439,8 +439,8 @@ def import_from_stix2(self, **kwargs):
                 x_opencti_stix_ids=stix_object["x_opencti_stix_ids"]
                 if "x_opencti_stix_ids" in stix_object
                 else None,
-                objectOrganization=stix_object["granted_refs"]
-                if "granted_refs" in stix_object
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
                 else None,
                 update=update,
             )

pycti/entities/opencti_malware_analysis.py

@@ -451,8 +451,8 @@ def import_from_stix2(self, **kwargs):
                 x_opencti_stix_ids=stix_object["x_opencti_stix_ids"]
                 if "x_opencti_stix_ids" in stix_object
                 else None,
-                objectOrganization=stix_object["granted_refs"]
-                if "granted_refs" in stix_object
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
                 else None,
                 update=update,
             )

pycti/entities/opencti_narrative.py

@@ -383,8 +383,8 @@ def import_from_stix2(self, **kwargs):
                 x_opencti_stix_ids=stix_object["x_opencti_stix_ids"]
                 if "x_opencti_stix_ids" in stix_object
                 else None,
-                objectOrganization=stix_object["granted_refs"]
-                if "granted_refs" in stix_object
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
                 else None,
                 update=update,
             )

pycti/entities/opencti_note.py

@@ -629,8 +629,8 @@ def import_from_stix2(self, **kwargs):
                 likelihood=stix_object["likelihood"]
                 if "likelihood" in stix_object
                 else None,
-                objectOrganization=stix_object["granted_refs"]
-                if "granted_refs" in stix_object
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
                 else None,
                 update=update,
             )

pycti/entities/opencti_observed_data.py

@@ -627,8 +627,8 @@ def import_from_stix2(self, **kwargs):
                 x_opencti_stix_ids=stix_object["x_opencti_stix_ids"]
                 if "x_opencti_stix_ids" in stix_object
                 else None,
-                objectOrganization=stix_object["granted_refs"]
-                if "granted_refs" in stix_object
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
                 else None,
                 update=update,
             )

pycti/entities/opencti_opinion.py

@@ -590,8 +590,8 @@ def import_from_stix2(self, **kwargs):
                 if "x_opencti_stix_ids" in stix_object
                 else None,
                 opinion=stix_object["opinion"] if "opinion" in stix_object else None,
-                objectOrganization=stix_object["granted_refs"]
-                if "granted_refs" in stix_object
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
                 else None,
                 update=update,
             )

pycti/entities/opencti_report.py

@@ -658,8 +658,8 @@ def import_from_stix2(self, **kwargs):
                 x_opencti_stix_ids=stix_object["x_opencti_stix_ids"]
                 if "x_opencti_stix_ids" in stix_object
                 else None,
-                objectOrganization=stix_object["granted_refs"]
-                if "granted_refs" in stix_object
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
                 else None,
                 update=update,
             )

pycti/entities/opencti_task.py

@@ -651,8 +651,8 @@ def import_from_stix2(self, **kwargs):
                 if "description" in stix_object
                 else None,
                 due_date=stix_object["due_date"] if "due_date" in stix_object else None,
-                objectOrganization=stix_object["granted_refs"]
-                if "granted_refs" in stix_object
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
                 else None,
                 update=update,
             )

pycti/entities/opencti_threat_actor_group.py

@@ -463,8 +463,8 @@ def import_from_stix2(self, **kwargs):
                 x_opencti_stix_ids=stix_object["x_opencti_stix_ids"]
                 if "x_opencti_stix_ids" in stix_object
                 else None,
-                objectOrganization=stix_object["granted_refs"]
-                if "granted_refs" in stix_object
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
                 else None,
                 update=update,
             )

pycti/entities/opencti_threat_actor_individual.py

@@ -465,8 +465,8 @@ def import_from_stix2(self, **kwargs):
                 x_opencti_stix_ids=stix_object["x_opencti_stix_ids"]
                 if "x_opencti_stix_ids" in stix_object
                 else None,
-                objectOrganization=stix_object["granted_refs"]
-                if "granted_refs" in stix_object
+                objectOrganization=stix_object["x_opencti_granted_refs"]
+                if "x_opencti_granted_refs" in stix_object
                 else None,
                 update=update,
             )