From 7325226c6e6323e5c933b467d2456f5aac0370c1 Mon Sep 17 00:00:00 2001 From: BocognanoSarah Date: Thu, 4 Sep 2025 14:08:06 +0200 Subject: [PATCH] [client] Grouping content is erased when approving Draft (#11874) --- pycti/entities/opencti_case_rfi.py | 14 ++++++++++++++ pycti/entities/opencti_case_rft.py | 14 ++++++++++++++ pycti/entities/opencti_grouping.py | 14 ++++++++++++++ 3 files changed, 42 insertions(+) diff --git a/pycti/entities/opencti_case_rfi.py b/pycti/entities/opencti_case_rfi.py index fab9cc6aa..9b7e6cffb 100644 --- a/pycti/entities/opencti_case_rfi.py +++ b/pycti/entities/opencti_case_rfi.py @@ -701,6 +701,7 @@ def create(self, **kwargs): created = kwargs.get("created", None) modified = kwargs.get("modified", None) name = kwargs.get("name", None) + content = kwargs.get("content", None) description = kwargs.get("description", None) x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None) granted_refs = kwargs.get("objectOrganization", None) @@ -742,6 +743,7 @@ def create(self, **kwargs): "modified": modified, "name": name, "description": description, + "content": content, "x_opencti_stix_ids": x_opencti_stix_ids, "x_opencti_workflow_id": x_opencti_workflow_id, "update": update, @@ -874,6 +876,13 @@ def import_from_stix2(self, **kwargs): stix_object["x_opencti_assignee_ids"] = ( self.opencti.get_attribute_in_extension("assignee_ids", stix_object) ) + if "x_opencti_content" not in stix_object or "content" not in stix_object: + stix_object["content"] = self.opencti.get_attribute_in_extension( + "content", stix_object + ) + if "x_opencti_content" in stix_object: + stix_object["content"] = stix_object["x_opencti_content"] + if "x_opencti_participant_ids" not in stix_object: stix_object["x_opencti_participant_ids"] = ( self.opencti.get_attribute_in_extension( @@ -900,6 +909,11 @@ def import_from_stix2(self, **kwargs): if "external_references_ids" in extras else None ), + content=( + self.opencti.stix2.convert_markdown(stix_object["content"]) + if "content" in stix_object + else None + ), revoked=stix_object["revoked"] if "revoked" in stix_object else None, severity=stix_object["severity"] if "severity" in stix_object else None, priority=stix_object["priority"] if "priority" in stix_object else None, diff --git a/pycti/entities/opencti_case_rft.py b/pycti/entities/opencti_case_rft.py index 764aed3dc..5c57a02d8 100644 --- a/pycti/entities/opencti_case_rft.py +++ b/pycti/entities/opencti_case_rft.py @@ -697,6 +697,7 @@ def create(self, **kwargs): priority = kwargs.get("priority", None) confidence = kwargs.get("confidence", None) lang = kwargs.get("lang", None) + content = kwargs.get("content", None) created = kwargs.get("created", None) modified = kwargs.get("modified", None) name = kwargs.get("name", None) @@ -735,6 +736,7 @@ def create(self, **kwargs): "revoked": revoked, "severity": severity, "priority": priority, + "content": content, "confidence": confidence, "lang": lang, "created": created, @@ -865,6 +867,13 @@ def import_from_stix2(self, **kwargs): stix_object["x_opencti_granted_refs"] = ( self.opencti.get_attribute_in_extension("granted_refs", stix_object) ) + if "x_opencti_content" not in stix_object or "content" not in stix_object: + stix_object["content"] = self.opencti.get_attribute_in_extension( + "content", stix_object + ) + if "x_opencti_content" in stix_object: + stix_object["content"] = stix_object["x_opencti_content"] + if "x_opencti_workflow_id" not in stix_object: stix_object["x_opencti_workflow_id"] = ( self.opencti.get_attribute_in_extension("workflow_id", stix_object) @@ -904,6 +913,11 @@ def import_from_stix2(self, **kwargs): confidence=( stix_object["confidence"] if "confidence" in stix_object else None ), + content=( + self.opencti.stix2.convert_markdown(stix_object["content"]) + if "content" in stix_object + else None + ), lang=stix_object["lang"] if "lang" in stix_object else None, created=stix_object["created"] if "created" in stix_object else None, modified=stix_object["modified"] if "modified" in stix_object else None, diff --git a/pycti/entities/opencti_grouping.py b/pycti/entities/opencti_grouping.py index d8b74f732..b998707ab 100644 --- a/pycti/entities/opencti_grouping.py +++ b/pycti/entities/opencti_grouping.py @@ -644,6 +644,7 @@ def create(self, **kwargs): modified = kwargs.get("modified", None) name = kwargs.get("name", None) context = kwargs.get("context", None) + content = kwargs.get("content", None) description = kwargs.get("description", None) x_opencti_aliases = kwargs.get("x_opencti_aliases", None) x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None) @@ -681,6 +682,7 @@ def create(self, **kwargs): "modified": modified, "name": name, "context": context, + "content": content, "description": description, "x_opencti_aliases": x_opencti_aliases, "x_opencti_stix_ids": x_opencti_stix_ids, @@ -802,6 +804,13 @@ def import_from_stix2(self, **kwargs): stix_object["x_opencti_granted_refs"] = ( self.opencti.get_attribute_in_extension("granted_refs", stix_object) ) + if "x_opencti_content" not in stix_object or "content" not in stix_object: + stix_object["content"] = self.opencti.get_attribute_in_extension( + "content", stix_object + ) + if "x_opencti_content" in stix_object: + stix_object["content"] = stix_object["x_opencti_content"] + if "x_opencti_workflow_id" not in stix_object: stix_object["x_opencti_workflow_id"] = ( self.opencti.get_attribute_in_extension("workflow_id", stix_object) @@ -826,6 +835,11 @@ def import_from_stix2(self, **kwargs): if "external_references_ids" in extras else None ), + content=( + self.opencti.stix2.convert_markdown(stix_object["content"]) + if "content" in stix_object + else None + ), revoked=stix_object["revoked"] if "revoked" in stix_object else None, confidence=( stix_object["confidence"] if "confidence" in stix_object else None