workbench¶
Functions and class wrappers for interacting with STIX data at a high level.
-
create
(self, *args, **kwargs)¶ Create a STIX object using object factory defaults.
Parameters: - cls – the python-stix2 class of the object to be created (eg. Indicator)
- **kwargs – The property/value pairs of the STIX object to be created
-
set_default_creator
(self, *args, **kwargs)¶ Set default value for the created_by_ref property.
-
set_default_created
(self, *args, **kwargs)¶ Set default value for the created property.
-
set_default_external_refs
(self, *args, **kwargs)¶ Set default external references.
-
set_default_object_marking_refs
(self, *args, **kwargs)¶ Set default object markings.
-
get
(self, *args, **kwargs)¶ Retrieve the most recent version of a single STIX object by ID.
Translate get() call to the appropriate DataSource call.
Parameters: stix_id (str) – the id of the STIX object to retrieve. Returns: stix_obj – - the single most recent version of the STIX
- object specified by the “id”.
-
all_versions
(self, *args, **kwargs)¶ Retrieve all versions of a single STIX object by ID.
Translate all_versions() call to the appropriate DataSource call.
Parameters: stix_id (str) – the id of the STIX object to retrieve. Returns: list – All versions of the specified STIX object.
-
query
(self, *args, **kwargs)¶ Retrieve STIX objects matching a set of filters.
Translate query() call to the appropriate DataSource call.
Parameters: query (list) – a list of filters (which collectively are the query) to conduct search on. Returns: list – The STIX objects matching the query.
-
creator_of
(self, *args, **kwargs)¶ Retrieve the Identity refered to by the object’s created_by_ref.
Translate creator_of() call to the appropriate DataSource call.
Parameters: obj – The STIX object whose created_by_ref property will be looked up. Returns: The STIX object’s creator, or None, if the object contains no created_by_ref property or the object’s creator cannot be found.
-
relationships
(self, *args, **kwargs)¶ Retrieve Relationships involving the given STIX object.
Translate relationships() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
Parameters: - obj (STIX object OR dict OR str) – The STIX object (or its ID) whose relationships will be looked up.
- relationship_type (str) – Only retrieve Relationships of this type. If None, all relationships will be returned, regardless of type.
- source_only (bool) – Only retrieve Relationships for which this object is the source_ref. Default: False.
- target_only (bool) – Only retrieve Relationships for which this object is the target_ref. Default: False.
Returns: list – The Relationship objects involving the given STIX object.
Retrieve STIX Objects that have a Relationship involving the given STIX object.
Translate related_to() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
Parameters: - obj (STIX object OR dict OR str) – The STIX object (or its ID) whose related objects will be looked up.
- relationship_type (str) – Only retrieve objects related by this Relationships type. If None, all related objects will be returned, regardless of type.
- source_only (bool) – Only examine Relationships for which this object is the source_ref. Default: False.
- target_only (bool) – Only examine Relationships for which this object is the target_ref. Default: False.
- filters (list) – list of additional filters the related objects must match.
Returns: list – The STIX objects related to the given STIX object.
-
save
(self, *args, **kwargs)¶ Method for storing STIX objects.
Defines custom behavior before storing STIX objects using the appropriate method call on the associated DataSink.
Parameters: stix_objs (list) – a list of STIX objects
-
add_filters
(self, *args, **kwargs)¶
-
add_filter
(self, *args, **kwargs)¶
-
parse
(self, *args, **kwargs)¶ Convert a string, dict or file-like object into a STIX object.
Parameters: - data (str, dict, file-like object) – The STIX 2 content to be parsed.
- allow_custom (bool) – Whether to allow custom properties as well unknown custom objects. Note that unknown custom objects cannot be parsed into STIX objects, and will be returned as is. Default: False.
- version (str) – Which STIX2 version to use. (e.g. “2.0”, “2.1”). If None, use latest version.
Returns: An instantiated Python STIX object.
- WARNING: ‘allow_custom=True’ will allow for the return of any supplied STIX
- dict(s) that cannot be found to map to any known STIX object types (both STIX2 domain objects or defined custom STIX2 objects); NO validation is done. This is done to allow the processing of possibly unknown custom STIX objects (example scenario: I need to query a third-party TAXII endpoint that could provide custom STIX objects that I dont know about ahead of time)
-
add_data_source
(self, data_source)¶ Attach a DataSource to CompositeDataSource instance
Parameters: data_source (DataSource) – a stix2.DataSource to attach to the CompositeDataSource
-
add_data_sources
(self, data_sources)¶ Attach list of DataSources to CompositeDataSource instance
Parameters: data_sources (list) – stix2.DataSources to attach to CompositeDataSource
-
class
AttackPattern
¶ Workbench wrapper around the AttackPattern object.
-
created_by
(*args, **kwargs)¶ Retrieve the Identity refered to by the object’s created_by_ref.
Translate creator_of() call to the appropriate DataSource call.
- Args:
- obj: The STIX object whose created_by_ref property will be looked
- up.
- Returns:
- The STIX object’s creator, or None, if the object contains no created_by_ref property or the object’s creator cannot be found.
-
relationships
(*args, **kwargs)¶ Retrieve Relationships involving the given STIX object.
Translate relationships() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
- Args:
- obj (STIX object OR dict OR str): The STIX object (or its ID) whose
- relationships will be looked up.
- relationship_type (str): Only retrieve Relationships of this type.
- If None, all relationships will be returned, regardless of type.
- source_only (bool): Only retrieve Relationships for which this
- object is the source_ref. Default: False.
- target_only (bool): Only retrieve Relationships for which this
- object is the target_ref. Default: False.
- Returns:
- list: The Relationship objects involving the given STIX object.
Retrieve STIX Objects that have a Relationship involving the given STIX object.
Translate related_to() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
- Args:
- obj (STIX object OR dict OR str): The STIX object (or its ID) whose
- related objects will be looked up.
- relationship_type (str): Only retrieve objects related by this
- Relationships type. If None, all related objects will be returned, regardless of type.
- source_only (bool): Only examine Relationships for which this
- object is the source_ref. Default: False.
- target_only (bool): Only examine Relationships for which this
- object is the target_ref. Default: False.
- filters (list): list of additional filters the related objects must
- match.
- Returns:
- list: The STIX objects related to the given STIX object.
-
-
class
Campaign
¶ Workbench wrapper around the Campaign object.
-
created_by
(*args, **kwargs)¶ Retrieve the Identity refered to by the object’s created_by_ref.
Translate creator_of() call to the appropriate DataSource call.
- Args:
- obj: The STIX object whose created_by_ref property will be looked
- up.
- Returns:
- The STIX object’s creator, or None, if the object contains no created_by_ref property or the object’s creator cannot be found.
-
relationships
(*args, **kwargs)¶ Retrieve Relationships involving the given STIX object.
Translate relationships() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
- Args:
- obj (STIX object OR dict OR str): The STIX object (or its ID) whose
- relationships will be looked up.
- relationship_type (str): Only retrieve Relationships of this type.
- If None, all relationships will be returned, regardless of type.
- source_only (bool): Only retrieve Relationships for which this
- object is the source_ref. Default: False.
- target_only (bool): Only retrieve Relationships for which this
- object is the target_ref. Default: False.
- Returns:
- list: The Relationship objects involving the given STIX object.
Retrieve STIX Objects that have a Relationship involving the given STIX object.
Translate related_to() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
- Args:
- obj (STIX object OR dict OR str): The STIX object (or its ID) whose
- related objects will be looked up.
- relationship_type (str): Only retrieve objects related by this
- Relationships type. If None, all related objects will be returned, regardless of type.
- source_only (bool): Only examine Relationships for which this
- object is the source_ref. Default: False.
- target_only (bool): Only examine Relationships for which this
- object is the target_ref. Default: False.
- filters (list): list of additional filters the related objects must
- match.
- Returns:
- list: The STIX objects related to the given STIX object.
-
-
class
CourseOfAction
¶ Workbench wrapper around the CourseOfAction object.
-
created_by
(*args, **kwargs)¶ Retrieve the Identity refered to by the object’s created_by_ref.
Translate creator_of() call to the appropriate DataSource call.
- Args:
- obj: The STIX object whose created_by_ref property will be looked
- up.
- Returns:
- The STIX object’s creator, or None, if the object contains no created_by_ref property or the object’s creator cannot be found.
-
relationships
(*args, **kwargs)¶ Retrieve Relationships involving the given STIX object.
Translate relationships() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
- Args:
- obj (STIX object OR dict OR str): The STIX object (or its ID) whose
- relationships will be looked up.
- relationship_type (str): Only retrieve Relationships of this type.
- If None, all relationships will be returned, regardless of type.
- source_only (bool): Only retrieve Relationships for which this
- object is the source_ref. Default: False.
- target_only (bool): Only retrieve Relationships for which this
- object is the target_ref. Default: False.
- Returns:
- list: The Relationship objects involving the given STIX object.
Retrieve STIX Objects that have a Relationship involving the given STIX object.
Translate related_to() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
- Args:
- obj (STIX object OR dict OR str): The STIX object (or its ID) whose
- related objects will be looked up.
- relationship_type (str): Only retrieve objects related by this
- Relationships type. If None, all related objects will be returned, regardless of type.
- source_only (bool): Only examine Relationships for which this
- object is the source_ref. Default: False.
- target_only (bool): Only examine Relationships for which this
- object is the target_ref. Default: False.
- filters (list): list of additional filters the related objects must
- match.
- Returns:
- list: The STIX objects related to the given STIX object.
-
-
class
Identity
¶ Workbench wrapper around the Identity object.
-
created_by
(*args, **kwargs)¶ Retrieve the Identity refered to by the object’s created_by_ref.
Translate creator_of() call to the appropriate DataSource call.
- Args:
- obj: The STIX object whose created_by_ref property will be looked
- up.
- Returns:
- The STIX object’s creator, or None, if the object contains no created_by_ref property or the object’s creator cannot be found.
-
relationships
(*args, **kwargs)¶ Retrieve Relationships involving the given STIX object.
Translate relationships() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
- Args:
- obj (STIX object OR dict OR str): The STIX object (or its ID) whose
- relationships will be looked up.
- relationship_type (str): Only retrieve Relationships of this type.
- If None, all relationships will be returned, regardless of type.
- source_only (bool): Only retrieve Relationships for which this
- object is the source_ref. Default: False.
- target_only (bool): Only retrieve Relationships for which this
- object is the target_ref. Default: False.
- Returns:
- list: The Relationship objects involving the given STIX object.
Retrieve STIX Objects that have a Relationship involving the given STIX object.
Translate related_to() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
- Args:
- obj (STIX object OR dict OR str): The STIX object (or its ID) whose
- related objects will be looked up.
- relationship_type (str): Only retrieve objects related by this
- Relationships type. If None, all related objects will be returned, regardless of type.
- source_only (bool): Only examine Relationships for which this
- object is the source_ref. Default: False.
- target_only (bool): Only examine Relationships for which this
- object is the target_ref. Default: False.
- filters (list): list of additional filters the related objects must
- match.
- Returns:
- list: The STIX objects related to the given STIX object.
-
-
class
Indicator
¶ Workbench wrapper around the Indicator object.
-
created_by
(*args, **kwargs)¶ Retrieve the Identity refered to by the object’s created_by_ref.
Translate creator_of() call to the appropriate DataSource call.
- Args:
- obj: The STIX object whose created_by_ref property will be looked
- up.
- Returns:
- The STIX object’s creator, or None, if the object contains no created_by_ref property or the object’s creator cannot be found.
-
relationships
(*args, **kwargs)¶ Retrieve Relationships involving the given STIX object.
Translate relationships() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
- Args:
- obj (STIX object OR dict OR str): The STIX object (or its ID) whose
- relationships will be looked up.
- relationship_type (str): Only retrieve Relationships of this type.
- If None, all relationships will be returned, regardless of type.
- source_only (bool): Only retrieve Relationships for which this
- object is the source_ref. Default: False.
- target_only (bool): Only retrieve Relationships for which this
- object is the target_ref. Default: False.
- Returns:
- list: The Relationship objects involving the given STIX object.
Retrieve STIX Objects that have a Relationship involving the given STIX object.
Translate related_to() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
- Args:
- obj (STIX object OR dict OR str): The STIX object (or its ID) whose
- related objects will be looked up.
- relationship_type (str): Only retrieve objects related by this
- Relationships type. If None, all related objects will be returned, regardless of type.
- source_only (bool): Only examine Relationships for which this
- object is the source_ref. Default: False.
- target_only (bool): Only examine Relationships for which this
- object is the target_ref. Default: False.
- filters (list): list of additional filters the related objects must
- match.
- Returns:
- list: The STIX objects related to the given STIX object.
-
-
class
IntrusionSet
¶ Workbench wrapper around the IntrusionSet object.
-
created_by
(*args, **kwargs)¶ Retrieve the Identity refered to by the object’s created_by_ref.
Translate creator_of() call to the appropriate DataSource call.
- Args:
- obj: The STIX object whose created_by_ref property will be looked
- up.
- Returns:
- The STIX object’s creator, or None, if the object contains no created_by_ref property or the object’s creator cannot be found.
-
relationships
(*args, **kwargs)¶ Retrieve Relationships involving the given STIX object.
Translate relationships() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
- Args:
- obj (STIX object OR dict OR str): The STIX object (or its ID) whose
- relationships will be looked up.
- relationship_type (str): Only retrieve Relationships of this type.
- If None, all relationships will be returned, regardless of type.
- source_only (bool): Only retrieve Relationships for which this
- object is the source_ref. Default: False.
- target_only (bool): Only retrieve Relationships for which this
- object is the target_ref. Default: False.
- Returns:
- list: The Relationship objects involving the given STIX object.
Retrieve STIX Objects that have a Relationship involving the given STIX object.
Translate related_to() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
- Args:
- obj (STIX object OR dict OR str): The STIX object (or its ID) whose
- related objects will be looked up.
- relationship_type (str): Only retrieve objects related by this
- Relationships type. If None, all related objects will be returned, regardless of type.
- source_only (bool): Only examine Relationships for which this
- object is the source_ref. Default: False.
- target_only (bool): Only examine Relationships for which this
- object is the target_ref. Default: False.
- filters (list): list of additional filters the related objects must
- match.
- Returns:
- list: The STIX objects related to the given STIX object.
-
-
class
Malware
¶ Workbench wrapper around the Malware object.
-
created_by
(*args, **kwargs)¶ Retrieve the Identity refered to by the object’s created_by_ref.
Translate creator_of() call to the appropriate DataSource call.
- Args:
- obj: The STIX object whose created_by_ref property will be looked
- up.
- Returns:
- The STIX object’s creator, or None, if the object contains no created_by_ref property or the object’s creator cannot be found.
-
relationships
(*args, **kwargs)¶ Retrieve Relationships involving the given STIX object.
Translate relationships() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
- Args:
- obj (STIX object OR dict OR str): The STIX object (or its ID) whose
- relationships will be looked up.
- relationship_type (str): Only retrieve Relationships of this type.
- If None, all relationships will be returned, regardless of type.
- source_only (bool): Only retrieve Relationships for which this
- object is the source_ref. Default: False.
- target_only (bool): Only retrieve Relationships for which this
- object is the target_ref. Default: False.
- Returns:
- list: The Relationship objects involving the given STIX object.
Retrieve STIX Objects that have a Relationship involving the given STIX object.
Translate related_to() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
- Args:
- obj (STIX object OR dict OR str): The STIX object (or its ID) whose
- related objects will be looked up.
- relationship_type (str): Only retrieve objects related by this
- Relationships type. If None, all related objects will be returned, regardless of type.
- source_only (bool): Only examine Relationships for which this
- object is the source_ref. Default: False.
- target_only (bool): Only examine Relationships for which this
- object is the target_ref. Default: False.
- filters (list): list of additional filters the related objects must
- match.
- Returns:
- list: The STIX objects related to the given STIX object.
-
-
class
ObservedData
¶ Workbench wrapper around the ObservedData object.
-
created_by
(*args, **kwargs)¶ Retrieve the Identity refered to by the object’s created_by_ref.
Translate creator_of() call to the appropriate DataSource call.
- Args:
- obj: The STIX object whose created_by_ref property will be looked
- up.
- Returns:
- The STIX object’s creator, or None, if the object contains no created_by_ref property or the object’s creator cannot be found.
-
relationships
(*args, **kwargs)¶ Retrieve Relationships involving the given STIX object.
Translate relationships() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
- Args:
- obj (STIX object OR dict OR str): The STIX object (or its ID) whose
- relationships will be looked up.
- relationship_type (str): Only retrieve Relationships of this type.
- If None, all relationships will be returned, regardless of type.
- source_only (bool): Only retrieve Relationships for which this
- object is the source_ref. Default: False.
- target_only (bool): Only retrieve Relationships for which this
- object is the target_ref. Default: False.
- Returns:
- list: The Relationship objects involving the given STIX object.
Retrieve STIX Objects that have a Relationship involving the given STIX object.
Translate related_to() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
- Args:
- obj (STIX object OR dict OR str): The STIX object (or its ID) whose
- related objects will be looked up.
- relationship_type (str): Only retrieve objects related by this
- Relationships type. If None, all related objects will be returned, regardless of type.
- source_only (bool): Only examine Relationships for which this
- object is the source_ref. Default: False.
- target_only (bool): Only examine Relationships for which this
- object is the target_ref. Default: False.
- filters (list): list of additional filters the related objects must
- match.
- Returns:
- list: The STIX objects related to the given STIX object.
-
-
class
Report
¶ Workbench wrapper around the Report object.
-
created_by
(*args, **kwargs)¶ Retrieve the Identity refered to by the object’s created_by_ref.
Translate creator_of() call to the appropriate DataSource call.
- Args:
- obj: The STIX object whose created_by_ref property will be looked
- up.
- Returns:
- The STIX object’s creator, or None, if the object contains no created_by_ref property or the object’s creator cannot be found.
-
relationships
(*args, **kwargs)¶ Retrieve Relationships involving the given STIX object.
Translate relationships() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
- Args:
- obj (STIX object OR dict OR str): The STIX object (or its ID) whose
- relationships will be looked up.
- relationship_type (str): Only retrieve Relationships of this type.
- If None, all relationships will be returned, regardless of type.
- source_only (bool): Only retrieve Relationships for which this
- object is the source_ref. Default: False.
- target_only (bool): Only retrieve Relationships for which this
- object is the target_ref. Default: False.
- Returns:
- list: The Relationship objects involving the given STIX object.
Retrieve STIX Objects that have a Relationship involving the given STIX object.
Translate related_to() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
- Args:
- obj (STIX object OR dict OR str): The STIX object (or its ID) whose
- related objects will be looked up.
- relationship_type (str): Only retrieve objects related by this
- Relationships type. If None, all related objects will be returned, regardless of type.
- source_only (bool): Only examine Relationships for which this
- object is the source_ref. Default: False.
- target_only (bool): Only examine Relationships for which this
- object is the target_ref. Default: False.
- filters (list): list of additional filters the related objects must
- match.
- Returns:
- list: The STIX objects related to the given STIX object.
-
-
class
ThreatActor
¶ Workbench wrapper around the ThreatActor object.
-
created_by
(*args, **kwargs)¶ Retrieve the Identity refered to by the object’s created_by_ref.
Translate creator_of() call to the appropriate DataSource call.
- Args:
- obj: The STIX object whose created_by_ref property will be looked
- up.
- Returns:
- The STIX object’s creator, or None, if the object contains no created_by_ref property or the object’s creator cannot be found.
-
relationships
(*args, **kwargs)¶ Retrieve Relationships involving the given STIX object.
Translate relationships() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
- Args:
- obj (STIX object OR dict OR str): The STIX object (or its ID) whose
- relationships will be looked up.
- relationship_type (str): Only retrieve Relationships of this type.
- If None, all relationships will be returned, regardless of type.
- source_only (bool): Only retrieve Relationships for which this
- object is the source_ref. Default: False.
- target_only (bool): Only retrieve Relationships for which this
- object is the target_ref. Default: False.
- Returns:
- list: The Relationship objects involving the given STIX object.
Retrieve STIX Objects that have a Relationship involving the given STIX object.
Translate related_to() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
- Args:
- obj (STIX object OR dict OR str): The STIX object (or its ID) whose
- related objects will be looked up.
- relationship_type (str): Only retrieve objects related by this
- Relationships type. If None, all related objects will be returned, regardless of type.
- source_only (bool): Only examine Relationships for which this
- object is the source_ref. Default: False.
- target_only (bool): Only examine Relationships for which this
- object is the target_ref. Default: False.
- filters (list): list of additional filters the related objects must
- match.
- Returns:
- list: The STIX objects related to the given STIX object.
-
-
class
Tool
¶ Workbench wrapper around the Tool object.
-
created_by
(*args, **kwargs)¶ Retrieve the Identity refered to by the object’s created_by_ref.
Translate creator_of() call to the appropriate DataSource call.
- Args:
- obj: The STIX object whose created_by_ref property will be looked
- up.
- Returns:
- The STIX object’s creator, or None, if the object contains no created_by_ref property or the object’s creator cannot be found.
-
relationships
(*args, **kwargs)¶ Retrieve Relationships involving the given STIX object.
Translate relationships() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
- Args:
- obj (STIX object OR dict OR str): The STIX object (or its ID) whose
- relationships will be looked up.
- relationship_type (str): Only retrieve Relationships of this type.
- If None, all relationships will be returned, regardless of type.
- source_only (bool): Only retrieve Relationships for which this
- object is the source_ref. Default: False.
- target_only (bool): Only retrieve Relationships for which this
- object is the target_ref. Default: False.
- Returns:
- list: The Relationship objects involving the given STIX object.
Retrieve STIX Objects that have a Relationship involving the given STIX object.
Translate related_to() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
- Args:
- obj (STIX object OR dict OR str): The STIX object (or its ID) whose
- related objects will be looked up.
- relationship_type (str): Only retrieve objects related by this
- Relationships type. If None, all related objects will be returned, regardless of type.
- source_only (bool): Only examine Relationships for which this
- object is the source_ref. Default: False.
- target_only (bool): Only examine Relationships for which this
- object is the target_ref. Default: False.
- filters (list): list of additional filters the related objects must
- match.
- Returns:
- list: The STIX objects related to the given STIX object.
-
-
class
Vulnerability
¶ Workbench wrapper around the Vulnerability object.
-
created_by
(*args, **kwargs)¶ Retrieve the Identity refered to by the object’s created_by_ref.
Translate creator_of() call to the appropriate DataSource call.
- Args:
- obj: The STIX object whose created_by_ref property will be looked
- up.
- Returns:
- The STIX object’s creator, or None, if the object contains no created_by_ref property or the object’s creator cannot be found.
-
relationships
(*args, **kwargs)¶ Retrieve Relationships involving the given STIX object.
Translate relationships() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
- Args:
- obj (STIX object OR dict OR str): The STIX object (or its ID) whose
- relationships will be looked up.
- relationship_type (str): Only retrieve Relationships of this type.
- If None, all relationships will be returned, regardless of type.
- source_only (bool): Only retrieve Relationships for which this
- object is the source_ref. Default: False.
- target_only (bool): Only retrieve Relationships for which this
- object is the target_ref. Default: False.
- Returns:
- list: The Relationship objects involving the given STIX object.
Retrieve STIX Objects that have a Relationship involving the given STIX object.
Translate related_to() call to the appropriate DataSource call.
Only one of source_only and target_only may be True.
- Args:
- obj (STIX object OR dict OR str): The STIX object (or its ID) whose
- related objects will be looked up.
- relationship_type (str): Only retrieve objects related by this
- Relationships type. If None, all related objects will be returned, regardless of type.
- source_only (bool): Only examine Relationships for which this
- object is the source_ref. Default: False.
- target_only (bool): Only examine Relationships for which this
- object is the target_ref. Default: False.
- filters (list): list of additional filters the related objects must
- match.
- Returns:
- list: The STIX objects related to the given STIX object.
-
-
attack_patterns
(filters=None)¶ Retrieve all Attack Pattern objects.
Parameters: filters (list, optional) – A list of additional filters to apply to the query.
-
campaigns
(filters=None)¶ Retrieve all Campaign objects.
Parameters: filters (list, optional) – A list of additional filters to apply to the query.
-
courses_of_action
(filters=None)¶ Retrieve all Course of Action objects.
Parameters: filters (list, optional) – A list of additional filters to apply to the query.
-
identities
(filters=None)¶ Retrieve all Identity objects.
Parameters: filters (list, optional) – A list of additional filters to apply to the query.
-
indicators
(filters=None)¶ Retrieve all Indicator objects.
Parameters: filters (list, optional) – A list of additional filters to apply to the query.
-
intrusion_sets
(filters=None)¶ Retrieve all Intrusion Set objects.
Parameters: filters (list, optional) – A list of additional filters to apply to the query.
-
malware
(filters=None)¶ Retrieve all Malware objects.
Parameters: filters (list, optional) – A list of additional filters to apply to the query.
-
observed_data
(filters=None)¶ Retrieve all Observed Data objects.
Parameters: filters (list, optional) – A list of additional filters to apply to the query.
-
reports
(filters=None)¶ Retrieve all Report objects.
Parameters: filters (list, optional) – A list of additional filters to apply to the query.
-
threat_actors
(filters=None)¶ Retrieve all Threat Actor objects.
Parameters: filters (list, optional) – A list of additional filters to apply to the query.
-
tools
(filters=None)¶ Retrieve all Tool objects.
Parameters: filters (list, optional) – A list of additional filters to apply to the query.
-
vulnerabilities
(filters=None)¶ Retrieve all Vulnerability objects.
Parameters: filters (list, optional) – A list of additional filters to apply to the query.