@@ -148,6 +148,143 @@ def __init__(self, opencti):
148148 }
149149 }
150150 """
151+ self .properties_with_files = """
152+ id
153+ standard_id
154+ entity_type
155+ parent_types
156+ spec_version
157+ created_at
158+ updated_at
159+ createdBy {
160+ ... on Identity {
161+ id
162+ standard_id
163+ entity_type
164+ parent_types
165+ spec_version
166+ identity_class
167+ name
168+ description
169+ roles
170+ contact_information
171+ x_opencti_aliases
172+ created
173+ modified
174+ objectLabel {
175+ edges {
176+ node {
177+ id
178+ value
179+ color
180+ }
181+ }
182+ }
183+ }
184+ ... on Organization {
185+ x_opencti_organization_type
186+ x_opencti_reliability
187+ }
188+ ... on Individual {
189+ x_opencti_firstname
190+ x_opencti_lastname
191+ }
192+ }
193+ objectMarking {
194+ edges {
195+ node {
196+ id
197+ standard_id
198+ entity_type
199+ definition_type
200+ definition
201+ created
202+ modified
203+ x_opencti_order
204+ x_opencti_color
205+ }
206+ }
207+ }
208+ objectLabel {
209+ edges {
210+ node {
211+ id
212+ value
213+ color
214+ }
215+ }
216+ }
217+ externalReferences {
218+ edges {
219+ node {
220+ id
221+ standard_id
222+ entity_type
223+ source_name
224+ description
225+ url
226+ hash
227+ external_id
228+ created
229+ modified
230+ importFiles {
231+ edges {
232+ node {
233+ id
234+ name
235+ size
236+ metaData {
237+ mimetype
238+ version
239+ }
240+ }
241+ }
242+ }
243+ }
244+ }
245+ }
246+ revoked
247+ confidence
248+ created
249+ modified
250+ name
251+ description
252+ aliases
253+ malware_types
254+ is_family
255+ first_seen
256+ last_seen
257+ architecture_execution_envs
258+ implementation_languages
259+ capabilities
260+ killChainPhases {
261+ edges {
262+ node {
263+ id
264+ standard_id
265+ entity_type
266+ kill_chain_name
267+ phase_name
268+ x_opencti_order
269+ created
270+ modified
271+ }
272+ }
273+ }
274+ importFiles {
275+ edges {
276+ node {
277+ id
278+ name
279+ size
280+ metaData {
281+ mimetype
282+ version
283+ }
284+ }
285+ }
286+ }
287+ """
151288
152289 @staticmethod
153290 def generate_id (name ):
@@ -177,6 +314,7 @@ def list(self, **kwargs):
177314 custom_attributes = kwargs .get ("customAttributes" , None )
178315 get_all = kwargs .get ("getAll" , False )
179316 with_pagination = kwargs .get ("withPagination" , False )
317+ with_files = kwargs .get ("withFiles" , False )
180318 if get_all :
181319 first = 500
182320
@@ -188,7 +326,11 @@ def list(self, **kwargs):
188326 edges {
189327 node {
190328 """
191- + (custom_attributes if custom_attributes is not None else self .properties )
329+ + (
330+ custom_attributes
331+ if custom_attributes is not None
332+ else (self .properties_with_files if with_files else self .properties )
333+ )
192334 + """
193335 }
194336 }
@@ -253,6 +395,7 @@ def read(self, **kwargs):
253395 id = kwargs .get ("id" , None )
254396 filters = kwargs .get ("filters" , None )
255397 custom_attributes = kwargs .get ("customAttributes" , None )
398+ with_files = kwargs .get ("withFiles" , False )
256399 if id is not None :
257400 LOGGER .info ("Reading Malware {%s}." , id )
258401 query = (
@@ -263,7 +406,7 @@ def read(self, **kwargs):
263406 + (
264407 custom_attributes
265408 if custom_attributes is not None
266- else self .properties
409+ else ( self .properties_with_files if with_files else self . properties )
267410 )
268411 + """
269412 }
0 commit comments