[client] Extract creators field from indicators and observables (#434)

OpenCTI-Platform · Aug 16, 2023 · 9737ba3 · 9737ba3
1 parent 983b605
commit 9737ba3
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 0 deletions.
diff --git a/pycti/entities/opencti_indicator.py b/pycti/entities/opencti_indicator.py
@@ -24,6 +24,10 @@ def __init__(self, opencti):
             spec_version
             created_at
             updated_at
+            creators {
+                id
+                name
+            }
             createdBy {
                 ... on Identity {
                     id

diff --git a/pycti/entities/opencti_stix_cyber_observable.py b/pycti/entities/opencti_stix_cyber_observable.py
@@ -20,6 +20,10 @@ def __init__(self, opencti, file):
             spec_version
             created_at
             updated_at
+            creators {
+                id
+                name
+            }
             createdBy {
                 ... on Identity {
                     id

diff --git a/tests/cases/entities.py b/tests/cases/entities.py
@@ -288,6 +288,10 @@ def data(self) -> Dict:
             # TODO killchain phase
         }
 
+    def get_compare_exception_keys(self) -> List[str]:
+        # indicator objects include extracted creators field
+        return ["type", "update", "createdBy", "modified", "creators"]
+
     def teardown(self):
         self.api_client.stix_domain_object.delete(id=self.organization["id"])
 
@@ -869,9 +873,11 @@ def get_compare_exception_keys(self) -> List[str]:
         # toId = to
         # simple_observable_key = entity_type
         # simple_observable_value = observable_value & value
+        # includes extracted creators field
         return [
             "type",
             "update",
+            "creators",
             "createdBy",
             "modified",
             "simple_observable_key",