diff --git a/.gitignore b/.gitignore index 8e72172..98ec82b 100644 --- a/.gitignore +++ b/.gitignore @@ -166,4 +166,5 @@ cython_debug/ .DS_Store .claude/ -.vscode \ No newline at end of file +.vscode +docs/opencti_schema.json \ No newline at end of file diff --git a/GRAPHQL_CONNECTOR_DESIGN.md b/GRAPHQL_CONNECTOR_DESIGN.md new file mode 100644 index 0000000..a19030c --- /dev/null +++ b/GRAPHQL_CONNECTOR_DESIGN.md @@ -0,0 +1,407 @@ +# GraphQL Connector — Design Sketch (proposal, not yet implemented) + +Status: **for discussion**. Nothing in `src/` is changed by this file. + +## Decisions locked + +1. **Return type:** `httpx.Response` everywhere — house law, no exceptions for request + methods. (See "The Response-law reconciliation" for how GraphQL semantics fit inside that.) +2. **Mutations:** left open. The engine runs any document; access is governed by the + permissions on the user's API token. To be documented in the README at implementation. +3. **Catalog:** ship what analysts actually do — *does X exist*, *what can I search*, + *fetch + paginate entities*, *traverse relationships* — across observables, indicators, + entities, threats, techniques, arsenal, locations. Bolt on more as needed. +4. **graphql-core:** yes — used to validate our shipped query catalog against a pinned + SDL snapshot in CI, and optionally to validate bespoke queries at runtime. +5. **Async parity:** every class ships sync + async. House law. +6. **Catalog shape:** unified `search_entities(types=[...])` over `stixCoreObjects`, not + named per-entity methods. `get_indicators` / `get_observables` stay dedicated only for + their type-specific fields. +7. **No `exists()`.** No connector in the library synthesizes a derived value — they all + return the underlying client's native object (`httpx.Response`, pymongo cursors/results, + ES hits). An `exists() -> bool` would be the first exception, so it's dropped. The + idiom is `search_entities(types=[...], filters=..., first=1)` then check `edges` + (documented in the README). +8. **Type-specific fields = schema-driven, not pydantic.** GraphQL has no `SELECT *`, so the + field list comes from the pinned SDL via `graphql-core` (emit all *leaf* scalar/enum + fields per type). Default selection is core STIX fields; full per-type selection is + opt-in. Same SDL artifact powers both query validation and field generation. + +## The boundary + +| Layer | Role | pyapiary analogy | Lives in | +|-------|------|------------------|----------| +| `GraphQLConnector` / `AsyncGraphQLConnector` | **Dumb executor.** Runs whatever query you give it. Knows nothing about OpenCTI. | DBMS connectors (`PostgresConnector.query`) | pyapiary `api_connectors/graphql.py` | +| `OpenCTIConnector` / `AsyncOpenCTIConnector` | **Thick, curated operations** with pre-composed queries. | REST connectors (`URLScanConnector.search`) | pyapiary `api_connectors/opencti.py` | +| Bespoke queries | One-off, app-specific. | hand-written SQL | the consuming app, via `execute()` | + +DBMS-style interface (one generic `execute`), REST-style transport (HTTP via `Broker`). + +--- + +## The Response-law reconciliation + +Returning `httpx.Response` everywhere collides with two GraphQL realities. Here's how each is resolved without breaking the law: + +- **Errors arrive as HTTP 200.** `execute()` still returns the `httpx.Response`. It *peeks* + at the body only to decide whether to raise `GraphQLError`; on success it hands back the + untouched Response. Cost: one internal `.json()` parse (the caller parses again — cheap, + and consistent). +- **Pagination.** The connector does **not** paginate — exactly like `URLScanConnector.search`, + which just passes `search_after` through `**kwargs` and returns the Response. We expose + `after` as a normal passthrough arg; the caller reads `pageInfo.endCursor` from the body + and calls again. Walking/accumulating pages is the caller's job, because doing it in the + connector would mean parsing bodies and breaking the Response law. + +With no `exists()` and no pagination helper, there are **zero** non-Response request methods. +Every method hands back the raw `httpx.Response`, matching every other API connector exactly. + +--- + +## Layer 1 — `api_connectors/graphql.py` (the engine) + +```python +import httpx +from typing import Dict, Any, Optional, List +from pyapiary.api_connectors.broker import ( + Broker, AsyncBroker, bubble_broker_init_signature, log_method_call, +) + + +class GraphQLError(Exception): + """Raised when a GraphQL response carries a top-level `errors` array. + Transport failures (4xx/5xx) still raise httpx.HTTPStatusError via Broker.""" + def __init__(self, errors: List[Dict[str, Any]]): + self.errors = errors + super().__init__("; ".join(e.get("message", str(e)) for e in errors)) + + +@bubble_broker_init_signature() +class GraphQLConnector(Broker): + """Generic, schema-agnostic GraphQL executor. Like the DBMS connectors, + it does not care what your query is — it just runs it.""" + + def __init__(self, base_url: str, endpoint: str = "/graphql", **kwargs): + super().__init__(base_url=base_url, **kwargs) + self.endpoint = endpoint + + @log_method_call + def execute( + self, + query: str, + variables: Optional[Dict[str, Any]] = None, + raise_on_errors: bool = True, + ) -> httpx.Response: + """POST a GraphQL document. Returns the httpx.Response (house law). + Raises GraphQLError if the 200 body contains `errors` (unless disabled).""" + resp = self.post(self.endpoint, json={"query": query, "variables": variables or {}}) + if raise_on_errors: + body = resp.json() + if body.get("errors"): + raise GraphQLError(body["errors"]) + return resp + + +@bubble_broker_init_signature() +class AsyncGraphQLConnector(AsyncBroker): + """Async twin of GraphQLConnector.""" + + def __init__(self, base_url: str, endpoint: str = "/graphql", **kwargs): + super().__init__(base_url=base_url, **kwargs) + self.endpoint = endpoint + + @log_method_call + async def execute(self, query, variables=None, raise_on_errors=True) -> httpx.Response: + resp = await self.post(self.endpoint, json={"query": query, "variables": variables or {}}) + if raise_on_errors: + body = resp.json() + if body.get("errors"): + raise GraphQLError(body["errors"]) + return resp +``` + +`log_method_call` already special-cases a `query` arg, so `execute` logs the query for free. +`Broker._make_request` already calls `raise_for_status()`, so transport failures are handled +upstream; we only add the GraphQL-200-error check. + +--- + +## Layer 2 — OpenCTI catalog + +### Design choice that shrinks the catalog + +OpenCTI exposes a **universal root query, `stixCoreObjects`**, that returns *any* entity type, +filterable by `types: [String]`. That one query covers most of the analyst asks — threats, +arsenal, techniques, locations, entities — plus existence checks and pagination, uniformly. +So instead of ~25 near-duplicate methods (one per entity), the catalog is small: + +| Method | Backing root query | Covers | +|--------|--------------------|--------| +| `search_entities(types=None, search=None, filters=None, ...)` | `stixCoreObjects` | threats, arsenal, techniques, locations, entities; free-text search; existence; pagination | +| `get_indicators(...)` | `indicators` | indicators (type-specific fields: pattern, score…) | +| `get_observables(...)` | `stixCyberObservables` | observables (type-specific: observable_value…) | +| `get_relationships(from_id=, to_id=, relationship_type=, ...)` | `stixCoreRelationships` | traversing relationships of anything | +| `exists(types, key, value)` | `stixCoreObjects` (first:1) | "does this entity exist?" | +| `list_entity_types()` / `SEARCHABLE_TYPES` | curated constant (+ optional `subTypes`) | "what can I search against?" | + +`get_indicators` / `get_observables` exist as dedicated methods only because those two carry +heavily-used type-specific fields worth a tailored selection. Everything else rides +`search_entities`. Type-specific fields on `stixCoreObjects` come via inline fragments +(`... on Malware { is_family }`) added as analysts need them. + +> VERIFIED against `docs/opencti-6.9.6.graphql` (introspected from the live instance): +> `stixCoreObjects(first, after, types, orderBy, orderMode, filters, search)`, +> `indicators(... toStix)`, `stixCyberObservables(... toStix)` all exist with these args. +> Both `threatActors` *and* `threatActorsGroup` exist (the former is the legacy field). +> `stixCoreRelationships` takes **list** args: `fromId/toId/relationship_type: [String]`, +> plus `fromTypes`, `toTypes`, `elementWithTargetTypes`, date ranges, `confidences`, etc. + +### `api_connectors/opencti_queries.py` (the "shape" catalog) + +```python +SEARCHABLE_TYPES = ( + "Stix-Cyber-Observable", "Indicator", + "Threat-Actor", "Intrusion-Set", "Campaign", # threats + "Malware", "Tool", "Channel", "Vulnerability", # arsenal + "Attack-Pattern", "Narrative", "Course-Of-Action", # techniques + "Region", "Country", "City", "Position", # locations + "Individual", "Organization", "Sector", "System", # entities +) + +# VERIFIED 6.9.6: StixCoreObject is an INTERFACE whose only leaf fields are +# id, standard_id, entity_type, parent_types, created_at, updated_at, ... — there is +# NO `name` on the interface, so name/description MUST come via inline fragments per type. +SEARCH_ENTITIES_QUERY = """ +query SearchEntities($types: [String], $search: String, $filters: FilterGroup, + $first: Int, $after: ID) { + stixCoreObjects(types: $types, search: $search, filters: $filters, + first: $first, after: $after) { + edges { node { + id + standard_id + entity_type + created_at + updated_at + ... on AttackPattern { name x_mitre_id } # type-specific fragments + ... on Malware { name is_family } + ... on StixDomainObject { ... on Campaign { name } } + } } + pageInfo { endCursor hasNextPage globalCount } # globalCount = total matches + } +} +""" + +INDICATORS_QUERY = """ +query Indicators($filters: FilterGroup, $first: Int, $after: ID) { + indicators(filters: $filters, first: $first, after: $after) { + edges { node { id standard_id name pattern pattern_type + valid_from valid_until x_opencti_score confidence } } + pageInfo { endCursor hasNextPage } + } +} +""" +# OBSERVABLES_QUERY, RELATIONSHIPS_QUERY ... same shape. +``` + +### `api_connectors/opencti.py` (sync shown; async mirrors it, per house law) + +```python +from typing import Dict, Any, Optional, List +import httpx +from pyapiary.api_connectors.graphql import GraphQLConnector +from pyapiary.api_connectors.broker import bubble_broker_init_signature, log_method_call +from pyapiary.helpers import combine_env_configs +from pyapiary.api_connectors import opencti_queries as q + + +@bubble_broker_init_signature() +class OpenCTIConnector(GraphQLConnector): + """Curated operations for OpenCTI 6.9.x. Pinned to the schema snapshot + in docs/opencti-6.9.6.graphql.""" + + def __init__(self, url: Optional[str] = None, token: Optional[str] = None, **kwargs): + # OpenCTI instance URL is deployment-specific, so resolve url/token + # eagerly from env here (unlike urlscan's hard-coded base_url). + env = combine_env_configs() + url = url or env.get("OPENCTI_URL") + token = token or env.get("OPENCTI_TOKEN") + if not url or not token: + raise ValueError("OpenCTIConnector requires OPENCTI_URL and OPENCTI_TOKEN") + super().__init__(base_url=url, endpoint="/graphql", **kwargs) + self.headers.update({ + "Authorization": f"Bearer {token}", + "Content-Type": "application/json", + }) + + @staticmethod + def filter_group(key: str, values, operator: str = "eq", mode: str = "or") -> Dict[str, Any]: + # VERIFIED against 6.9.6 schema: Filter.key is [String!]! and values is [Any!]!, + # so both are wrapped in lists. operator ∈ FilterOperator (eq, not_eq, match, + # wildcard, contains, starts_with, gt, lt, nil, search, ...); mode ∈ {and, or}. + if not isinstance(values, list): + values = [values] + return {"mode": "and", + "filters": [{"key": [key], "values": values, "operator": operator, "mode": mode}], + "filterGroups": []} + + def list_entity_types(self) -> tuple: + return q.SEARCHABLE_TYPES + + # --- request methods: return httpx.Response (house law) ------------------ + @log_method_call + def search_entities(self, types: Optional[List[str]] = None, search: Optional[str] = None, + filters: Optional[Dict] = None, first: int = 100, + after: Optional[str] = None) -> httpx.Response: + return self.execute(q.SEARCH_ENTITIES_QUERY, + {"types": types, "search": search, "filters": filters, + "first": first, "after": after}) + + @log_method_call + def get_indicators(self, filters=None, first=100, after=None) -> httpx.Response: + return self.execute(q.INDICATORS_QUERY, + {"filters": filters, "first": first, "after": after}) + + @log_method_call + def get_relationships(self, from_id=None, to_id=None, relationship_type=None, + first=100, after=None) -> httpx.Response: + return self.execute(q.RELATIONSHIPS_QUERY, + {"fromId": from_id, "toId": to_id, + "relationship_type": relationship_type, + "first": first, "after": after}) + + # --- NO pagination helper: callers advance `after` themselves, exactly + # like urlscan's manual `search_after` (keeps the Response law intact). + # --- NO exists(): use search_entities(..., first=1) and check edges. + # (No connector in the library returns a synthesized/derived value.) +``` + +Usage: + +```python +with OpenCTIConnector() as octi: # env: OPENCTI_URL / OPENCTI_TOKEN + + # "does it exist?" idiom (no exists() method) — just first=1 + check edges + flt = octi.filter_group("name", "Cobalt Strike") + found = octi.search_entities(types=["Malware"], filters=flt, first=1) \ + .json()["data"]["stixCoreObjects"]["edges"] + if found: + + # caller-driven pagination, same as urlscan's manual search_after loop + resp = octi.search_entities(types=["Malware"], first=50) + while True: + page = resp.json()["data"]["stixCoreObjects"] + for edge in page["edges"]: + print(edge["node"]["entity_type"], edge["node"].get("name")) + if not page["pageInfo"]["hasNextPage"]: + break + resp = octi.search_entities(types=["Malware"], first=50, + after=page["pageInfo"]["endCursor"]) + + octi.execute("query { me { name } }") # bespoke escape hatch +``` + +--- + +## graphql-core: validating the shipped catalog (decision 4) + +The point: catch schema drift in **our** query constants automatically, offline, in CI — +so when the OpenCTI version bumps, broken queries fail a test instead of a production call. + +### 1. Generate the pinned SDL snapshot (once per version, done manually/ad hoc) + +Run an introspection query against the instance (server must have +`APP__GRAPHQL__PLAYGROUND__FORCE_DISABLED_INTROSPECTION=false`), save the JSON to +`docs/opencti_schema.json` (gitignored), then convert it to committed SDL: + +```python +import json +from graphql import build_client_schema, print_schema + +data = json.load(open("docs/opencti_schema.json"))["data"] +schema = build_client_schema(data) +open("docs/opencti-6.9.6.graphql", "w").write(print_schema(schema)) # commit this +``` + +### 2. Validate every shipped query against the snapshot (CI test) + +```python +# tests/test_opencti_queries.py +from pathlib import Path +import pytest +from graphql import build_schema, parse, validate +from pyapiary.api_connectors import opencti_queries as q + +SCHEMA = build_schema(Path("docs/opencti-6.9.6.graphql").read_text()) +QUERIES = {n: v for n, v in vars(q).items() if n.endswith("_QUERY") and isinstance(v, str)} + +@pytest.mark.parametrize("name", QUERIES) +def test_shipped_query_matches_schema(name): + errors = validate(SCHEMA, parse(QUERIES[name])) + assert not errors, f"{name} drifted from schema: {[str(e) for e in errors]}" +``` + +`validate()` does full schema-aware checking — unknown fields, wrong arg types, bad +fragments — with **no live instance** needed in CI. Upgrade flow: re-run introspection +against the new version, regenerate the SDL (step 1), commit it, run the suite, fix +whatever turns red. + +### 3. (Optional) runtime validation of bespoke queries + +`GraphQLConnector(..., validate_against=)` could `validate()` a user's query before +sending, returning the GraphQL errors locally instead of round-tripping. Opt-in (requires +the user to supply an SDL), dev-dependency only. + +--- + +## Schema-driven field selection (decision 8) + +GraphQL has no `SELECT *`. To return type-specific fields without hand-maintaining fragments +or a pydantic model, generate the selection set from the pinned SDL with `graphql-core`: + +```python +from graphql import build_schema, GraphQLScalarType, GraphQLEnumType, GraphQLNonNull, GraphQLList + +def _unwrap(t): + while isinstance(t, (GraphQLNonNull, GraphQLList)): + t = t.of_type + return t + +def scalar_fields(schema, type_name: str) -> list[str]: + """All leaf (scalar/enum) fields of a type — straight from the schema.""" + t = schema.get_type(type_name) + return [name for name, f in t.fields.items() + if isinstance(_unwrap(f.type), (GraphQLScalarType, GraphQLEnumType))] + +def inline_fragment(schema, type_name: str) -> str: + return f"... on {type_name} {{ {' '.join(scalar_fields(schema, type_name))} }}" +``` + +- **Default selection:** core STIX fields (`id`, `standard_id`, `entity_type`, …) — cheap, + type-agnostic, covers most use cases. +- **Full per-type selection:** opt-in (e.g. a `fields="all"` mode), which expands the + requested `types` into generated `inline_fragment(...)` blocks. Only *leaf* fields are + emitted — object/relationship fields would recurse, so they're excluded (or nested as + `{ id }`). +- Generated queries are still CI-validated: generate per type, run `validate()` against the + SDL just like the static ones. + +## Status: design complete + schema captured + +All eight decisions locked, and the design is now verified against the live 6.9.6 schema. + +Schema artifacts already in the repo (introspection requires the server's +`APP__GRAPHQL__PLAYGROUND__FORCE_DISABLED_INTROSPECTION=false`, toggled on temporarily): +- `docs/opencti_schema.json` — raw introspection result (3.4 MB, 1041 types). +- `docs/opencti-6.9.6.graphql` — readable SDL (the authoring/validation reference). + +Implementation order when ready: + +1. `api_connectors/graphql.py` — `GraphQLConnector` + `AsyncGraphQLConnector` + `GraphQLError`. +2. ~~dump schema~~ — DONE (artifacts above). +3. `api_connectors/opencti_queries.py` — query constants + `scalar_fields`/`inline_fragment`, + generated from `docs/opencti-6.9.6.graphql`. +4. `api_connectors/opencti.py` — `OpenCTIConnector` + `AsyncOpenCTIConnector`. +5. Wire exports in `pyapiary/__init__.py`. +6. Tests: shipped-query validation (graphql-core, offline against the committed SDL) + + VCR cassettes for live calls. +7. README: auth/env vars, token-permission note (mutations), the `first=1` existence idiom. diff --git a/README.md b/README.md index c3849bb..df63d8d 100644 --- a/README.md +++ b/README.md @@ -19,6 +19,7 @@ New development and releases are published under the `pyapiary` package name. - [Customizing API Requests with `**kwargs`](#customizing-api-requests-with-kwargs) - [Proxy Awareness](#proxy-awareness) - [SSL Verification and Per-Request Options](#ssl-verification-and-per-request-options) + - [GraphQL & OpenCTI](#-graphql--opencti) - [DBMS Connectors](#-dbms-connectors) - [MongoDB](#mongodb) - [Elasticsearch](#elasticsearch) @@ -189,6 +190,51 @@ print(response.http_version) --- +### 🧬 GraphQL & OpenCTI + +`GraphQLConnector` is a generic, schema-agnostic GraphQL executor built on the same `Broker` (so it inherits retries, proxies, timeouts, logging). Like the DBMS connectors, it does not care what your query is — it just runs it. It returns the raw `httpx.Response` (house convention) and raises `GraphQLError` when a `200` response carries a top-level `errors` array (GraphQL reports query errors with HTTP 200, so `raise_for_status` never catches them). + +```python +from pyapiary.api_connectors.graphql import GraphQLConnector + +gql = GraphQLConnector(base_url="https://api.example.com", endpoint="/graphql") +resp = gql.execute("query($n: Int) { things(first: $n) { id } }", {"n": 5}) +data = resp.json()["data"] +# Pass raise_on_errors=False to inspect resp.json()["errors"] yourself. +``` + +`OpenCTIConnector` is a thick, curated connector (urlscan-style) layered on `GraphQLConnector`, with query field selections pinned to OpenCTI **6.9.x** (verified against `docs/opencti-6.9.6.graphql`). It reads `OPENCTI_URL` and `OPENCTI_TOKEN` from the environment (or accepts them explicitly). Access is governed entirely by the permissions on the token's user — so scope the token appropriately, including for mutations run via `execute`. + +```python +from pyapiary.api_connectors.opencti import OpenCTIConnector + +with OpenCTIConnector() as octi: # env: OPENCTI_URL / OPENCTI_TOKEN + # filter helper builds the 6.9.x FilterGroup for you + flt = octi.filter_group("name", "Cobalt Strike") + + # generic entity search (any type) — `representative.main` is a universal label + resp = octi.search_entities(types=["Malware"], filters=flt, first=50) + conn = resp.json()["data"]["stixCoreObjects"] + + # dedicated methods for type-specific fields + octi.get_indicators(search="1.2.3.4") + octi.get_observables(types=["IPv4-Addr"]) + octi.get_relationships(from_id="", relationship_type="uses") + + # anything outside the catalog: drop to the generic executor + octi.execute("query { me { name } }") +``` + +> **Existence check** — there is no `exists()` method (no connector returns a synthesized value). Use `search_entities(..., first=1)` and check whether the result's `edges` is empty. +> +> **Pagination** — connectors don't auto-paginate (same as `URLScanConnector`). Pass `after` with the previous page's `pageInfo.endCursor` and loop yourself; `pageInfo.globalCount` gives the total. +> +> **Async** — `AsyncGraphQLConnector` / `AsyncOpenCTIConnector` mirror the sync API. + +The query catalog (`opencti_queries.py`) is validated offline against the committed SDL in CI. To refresh the schema for a new OpenCTI version, run a GraphQL introspection query against the instance (requires the server's `APP__GRAPHQL__PLAYGROUND__FORCE_DISABLED_INTROSPECTION=false`), save the result as `docs/opencti_schema.json`, and convert it to SDL with `graphql-core`'s `build_client_schema` + `print_schema`. Then use `dev_env/opencti/gen_opencti_fields.py ` to author field selections from the SDL. + +--- + ## 🗃️ DBMS Connectors Each database connector follows a class-based pattern and supports reusable sessions, query helpers, and in some cases bulk helpers (e.g., `insert_many`, `bulk_insert`, etc.). diff --git a/dev_env/opencti/gen_opencti_fields.py b/dev_env/opencti/gen_opencti_fields.py new file mode 100644 index 0000000..c9e33f2 --- /dev/null +++ b/dev_env/opencti/gen_opencti_fields.py @@ -0,0 +1,79 @@ +#!/usr/bin/env python3 +"""Dev helper: generate GraphQL field selections from the pinned OpenCTI SDL. + +This is a *development-time* tool, NOT imported by the library at runtime (so +the runtime stays dependency-free apart from httpx). Use it to author or expand +the static query field lists in ``pyapiary.api_connectors.opencti_queries`` +without hand-maintaining them or marrying to a pydantic model -- the SDL is the +source of truth. + +GraphQL has no ``SELECT *``; this emits all *leaf* (scalar/enum) fields of a +type. Object/relationship fields are skipped (they would recurse); add those by +hand where you need them. + +Usage: + pip install graphql-core + python dev_env/opencti/gen_opencti_fields.py Indicator + python dev_env/opencti/gen_opencti_fields.py Malware --fragment +""" +from __future__ import annotations + +import argparse +import sys +from pathlib import Path + +from graphql import build_schema +from graphql.type import GraphQLEnumType, GraphQLScalarType + + +def _find_sdl() -> Path | None: + """Walk up from this file to find docs/opencti-6.9.6.graphql.""" + for parent in Path(__file__).resolve().parents: + candidate = parent / "docs" / "opencti-6.9.6.graphql" + if candidate.exists(): + return candidate + return None + + +def _unwrap(t): + while hasattr(t, "of_type"): + t = t.of_type + return t + + +def scalar_fields(schema, type_name: str) -> list[str]: + """All leaf (scalar/enum) field names of a type, straight from the schema.""" + t = schema.type_map.get(type_name) + if t is None or not hasattr(t, "fields"): + raise SystemExit(f"Type not found or has no fields: {type_name}") + return [ + name + for name, f in t.fields.items() + if isinstance(_unwrap(f.type), (GraphQLScalarType, GraphQLEnumType)) + ] + + +def main() -> int: + ap = argparse.ArgumentParser(description=__doc__) + ap.add_argument("type_name", help="GraphQL type name, e.g. Indicator") + ap.add_argument("--fragment", action="store_true", + help="wrap as an inline fragment: '... on Type { ... }'") + ap.add_argument("--sdl", default=None, help="path to SDL file (auto-detected by default)") + args = ap.parse_args() + + sdl_path = Path(args.sdl) if args.sdl else _find_sdl() + if sdl_path is None or not sdl_path.exists(): + raise SystemExit("Could not find docs/opencti-6.9.6.graphql; pass --sdl explicitly.") + + schema = build_schema(sdl_path.read_text()) + fields = scalar_fields(schema, args.type_name) + body = " ".join(fields) + if args.fragment: + print(f"... on {args.type_name} {{ {body} }}") + else: + print(body) + return 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/docs/opencti-6.9.6.graphql b/docs/opencti-6.9.6.graphql new file mode 100644 index 0000000..c853adf --- /dev/null +++ b/docs/opencti-6.9.6.graphql @@ -0,0 +1,14892 @@ +directive @auth(for: [Capabilities] = [], and: Boolean = false) on OBJECT | FIELD_DEFINITION + +directive @public on OBJECT | FIELD_DEFINITION + +directive @allowUnprotectedOTP on OBJECT | FIELD_DEFINITION + +directive @allowUnlicensedLTS on OBJECT | FIELD_DEFINITION + +directive @constraint(minLength: Int, maxLength: Int, startsWith: String, endsWith: String, notContains: String, pattern: String, format: String, min: Int, max: Int, exclusiveMin: Int, exclusiveMax: Int, multipleOf: Int) on INPUT_FIELD_DEFINITION + +"""Controls the rate of traffic.""" +directive @rateLimit( + """Number of occurrences allowed over duration.""" + limit: Int! = 60 + + """Number of seconds before limit is reset.""" + duration: Int! = 60 +) on OBJECT | FIELD_DEFINITION + +""" +A date-time string at UTC, such as 2007-12-03T10:15:30Z, compliant with the `date-time` format outlined in section 5.6 of the RFC 3339 profile of the ISO 8601 standard for representation of dates and times using the Gregorian calendar. +""" +scalar DateTime + +scalar ConstraintString + +scalar ConstraintNumber + +"""The `Upload` scalar type represents a file upload.""" +scalar Upload + +"""STIX ID Scalar Type""" +scalar StixId + +"""STIX Reference Scalar Type""" +scalar StixRef + +"""Arbitrary object""" +scalar Any + +scalar JSON + +enum State { + wait + progress + complete + timeout +} + +enum Capabilities { + BYPASS + CONNECTORAPI + KNOWLEDGE + KNOWLEDGE_KNUPDATE + KNOWLEDGE_KNPARTICIPATE + KNOWLEDGE_KNUPDATE_KNDELETE + KNOWLEDGE_KNUPDATE_KNMERGE + KNOWLEDGE_KNUPDATE_KNORGARESTRICT + KNOWLEDGE_KNUPDATE_KNMANAGEAUTHMEMBERS + KNOWLEDGE_KNUPLOAD + KNOWLEDGE_KNASKIMPORT + KNOWLEDGE_KNGETEXPORT + KNOWLEDGE_KNGETEXPORT_KNASKEXPORT + KNOWLEDGE_KNENRICHMENT + KNOWLEDGE_KNDISSEMINATION + EXPLORE + EXPLORE_EXUPDATE + EXPLORE_EXUPDATE_EXDELETE + EXPLORE_EXUPDATE_PUBLISH + INVESTIGATION + INVESTIGATION_INUPDATE + INVESTIGATION_INUPDATE_INDELETE + MODULES + MODULES_MODMANAGE + PIRAPI + PIRAPI_PIRUPDATE + AUTOMATION + AUTOMATION_AUTMANAGE + SETTINGS + SETTINGS_SETMANAGEXTMHUB + SETTINGS_SETPARAMETERS + SETTINGS_SETACCESSES + SETTINGS_SETMARKINGS + SETTINGS_SETDISSEMINATION + SETTINGS_SETLABELS + SETTINGS_SETVOCABULARIES + SETTINGS_SETCASETEMPLATES + SETTINGS_SETSTATUSTEMPLATES + SETTINGS_SETKILLCHAINPHASES + SETTINGS_SETCUSTOMIZATION + SETTINGS_SECURITYACTIVITY + SETTINGS_FILEINDEXING + SETTINGS_SUPPORT + TAXIIAPI + TAXIIAPI_SETCOLLECTIONS + INGESTION + INGESTION_SETINGESTIONS + CSVMAPPERS + VIRTUAL_ORGANIZATION_ADMIN +} + +enum MemberType { + User + Group + Organization +} + +type PageInfo { + startCursor: String! + endCursor: String! + hasNextPage: Boolean! + hasPreviousPage: Boolean! + globalCount: Int! +} + +enum OrderingMode { + asc + desc +} + +enum FilterMode { + and + or +} + +enum FilterOperator { + eq + not_eq + lt + lte + gt + gte + match + wildcard + contains + not_contains + ends_with + not_ends_with + starts_with + not_starts_with + script + nil + not_nil + search + within +} + +enum XTMHubRegistrationStatus { + registered + unregistered + lost_connectivity +} + +input FilterGroup { + mode: FilterMode! + filters: [Filter!]! + filterGroups: [FilterGroup!]! +} + +input Filter { + key: [String!]! + values: [Any!]! + operator: FilterOperator + mode: FilterMode +} + +type RepresentativeWithId { + id: String! + value: String + entity_type: String + color: String +} + +type FilterKeysSchema { + entity_type: String! + filters_schema: [FilterDefinitionSchema!]! +} + +type FilterDefinitionSchema { + filterKey: String! + filterDefinition: FilterDefinition! +} + +type FilterDefinition { + filterKey: String! + label: String! + type: String! + multiple: Boolean! + subEntityTypes: [String!]! + elementsForFilterValuesSearch: [String!]! + subFilters: [FilterDefinition!] +} + +enum EditOperation { + add + replace + remove +} + +input EditInput { + key: String! + object_path: String + value: [Any]! + operation: EditOperation +} + +input EditContext { + focusOn: String +} + +type EditUserContext { + name: String! + focusOn: String +} + +input DictionaryInput { + key: String! + value: String! +} + +type Dictionary { + key: String! + value: String! +} + +"""Dependency information containing the name and the deployed version.""" +type DependencyVersion { + name: String! + version: String! +} + +""" +NodeJs memory. +https://nodejs.org/api/process.html#process_process_memoryusage +https://nodejs.org/docs/latest-v11.x/api/v8.html#v8_v8_getheapstatistics +""" +type AppMemory { + rss: Float + heapTotal: Float + heapUsed: Float + external: Float + arrayBuffers: Float + total_heap_size: Float + total_heap_size_executable: Float + total_physical_size: Float + total_available_size: Float + used_heap_size: Float + heap_size_limit: Float + malloced_memory: Float + peak_malloced_memory: Float + does_zap_garbage: Float +} + +input ExportContext { + entity_id: String + entity_type: String! +} + +type AppDebugDistribution { + label: String! + value: Int +} + +type AppDebugStatistics { + objects: [AppDebugDistribution] + relationships: [AppDebugDistribution] +} + +"""Retrieve the application information version add dependencies""" +type AppInfo { + """The OpenCTI application version""" + version: String! + + """The OpenCTI api current memory usage""" + memory: AppMemory + + """The list of OpenCTI software dependencies""" + dependencies: [DependencyVersion!]! + + """The objects statistics""" + debugStats: AppDebugStatistics +} + +type AckDetails { + rate: Float +} + +type MessagesStats { + ack: String + ack_details: AckDetails +} + +type QueueArguments { + config: String +} + +type QueueMetrics { + name: String! + arguments: QueueArguments + messages: String + messages_ready: String + messages_unacknowledged: String + consumers: String + idle_since: DateTime + message_stats: MessagesStats +} + +type QueueTotals { + messages: String + messages_ready: String + messages_unacknowledged: String +} + +type ObjectTotals { + channels: String + consumers: String + queues: String +} + +type OverviewMetrics { + object_totals: ObjectTotals + queue_totals: QueueTotals + message_stats: MessagesStats +} + +type RabbitMQMetrics { + consumers: String + queues: [QueueMetrics] + overview: OverviewMetrics +} + +type SearchMetrics { + query_total: String + fetch_total: String +} + +type IndexingMetrics { + index_total: String + delete_total: String +} + +type GetMetrics { + total: String +} + +type DocsMetrics { + count: String +} + +type ElasticSearchMetrics { + docs: DocsMetrics + search: SearchMetrics + get: GetMetrics + indexing: IndexingMetrics +} + +enum StatsOperation { + count + sum +} + +type TimeSeries { + date: DateTime! + value: Int! +} + +type MultiTimeSeries { + data: [TimeSeries] +} + +input AuditsTimeSeriesParameters { + field: String! + types: [String] + filters: FilterGroup + search: String +} + +input StixCoreObjectsTimeSeriesParameters { + field: String! + types: [String] + filters: FilterGroup + search: String +} + +input StixRelationshipsTimeSeriesParameters { + field: String! + fromOrToId: [String] + elementWithTargetTypes: [String] + fromId: [String] + fromRole: String + fromTypes: [String] + toId: [String] + toRole: String + toTypes: [String] + relationship_type: [String] + confidences: [Int] + search: String + filters: FilterGroup + dynamicFrom: FilterGroup + dynamicTo: FilterGroup +} + +input StixCoreRelationshipsTimeSeriesParameters { + field: String! + fromOrToId: [String] + elementWithTargetTypes: [String] + fromId: [String] + fromRole: String + fromTypes: [String] + toId: [String] + toRole: String + toTypes: [String] + relationship_type: [String] + confidences: [Int] + search: String + filters: FilterGroup + dynamicFrom: FilterGroup + dynamicTo: FilterGroup +} + +type Distribution { + label: String! + entity: StixObjectOrStixRelationshipOrCreator + value: Int +} + +type MultiDistribution { + data: [Distribution] +} + +input StixCoreObjectsDistributionParameters { + objectId: String + relationship_type: [String] + toTypes: [String] + types: [String] + filters: FilterGroup + search: String +} + +input StixCoreRelationshipsDistributionParameters { + field: String! + fromOrToId: [String] + elementWithTargetTypes: [String] + fromId: [String] + fromRole: String + fromTypes: [String] + toId: [String] + toRole: String + toTypes: [String] + relationship_type: [String] + confidences: [Int] + search: String + filters: FilterGroup +} + +type Number { + total: Int! + count: Int! +} + +input StixCoreObjectsNumberParameters { + types: [String] + filters: FilterGroup + search: String +} + +type OpinionsMetrics { + mean: Float + min: Int + max: Int + total: Int +} + +type AiActivity { + result: String + trend: String + updated_at: DateTime + refreshed_at: DateTime +} + +type AiSummary { + result: String + topics: [String] + updated_at: DateTime + refreshed_at: DateTime +} + +type AiForecast { + result: String + confidence: Int + updated_at: DateTime + refreshed_at: DateTime +} + +type AiHistory { + result: String + updated_at: DateTime + refreshed_at: DateTime +} + +type LogsWorkerConfig { + elasticsearch_url: [String]! + elasticsearch_proxy: String + elasticsearch_index: String! + elasticsearch_username: String + elasticsearch_password: String + elasticsearch_api_key: String + elasticsearch_ssl_reject_unauthorized: Boolean +} + +enum LogsOrdering { + event + timestamp + created_at + event_type + event_scope + _score +} + +type LogConnection { + pageInfo: PageInfo! + edges: [LogEdge!]! +} + +type LogEdge { + cursor: String! + node: Log! +} + +type Change { + field: String! + previous: [String!] + new: [String!] + added: [String!] + removed: [String!] +} + +type ContextData { + entity_id: String + entity_name: String + entity_type: String + from_id: String + to_id: String + message: String! + commit: String + external_references: [ExternalReference!] + workspace_type: String + pir_ids: [String!] + pir_score: Int + pir_match_from: Boolean + changes: [Change] +} + +type Log { + id: ID! + entity_type: String + event_type: String! + event_scope: String + event_status: String! + timestamp: DateTime! + user_id: String! + user: Creator + raw_data: String + context_uri: String + context_data: ContextData + user_metadata: JSON +} + +type AttributesMap { + type: String! + attributes: [TypeAttribute!]! +} + +enum AttributesOrdering { + value + _score +} + +type AttributeConnection { + pageInfo: PageInfo! + edges: [AttributeEdge!]! +} + +type AttributeEdge { + cursor: String! + node: Attribute! +} + +type Attribute { + id: ID! + key: String! + value: String! +} + +input WorkErrorInput { + error: String + source: String +} + +type TaxiiCollection { + id: ID! + name: String + description: String + filters: String + include_inferences: Boolean + score_to_confidence: Boolean + taxii_public: Boolean + authorized_members: [MemberAccess!] +} + +type TaxiiCollectionConnection { + pageInfo: PageInfo! + edges: [TaxiiCollectionEdge]! +} + +type TaxiiCollectionEdge { + cursor: String! + node: TaxiiCollection! +} + +input TaxiiCollectionAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + filters: String + taxii_public: Boolean + authorized_members: [MemberAccessInput!] + include_inferences: Boolean + score_to_confidence: Boolean +} + +enum TaxiiCollectionOrdering { + name + id + _score +} + +type FeedMapping { + type: String! + attribute: String! +} + +type FeedAttribute { + attribute: String! + mappings: [FeedMapping!]! +} + +type Feed { + id: ID! + standard_id: ID! + name: String! + description: String + filters: String + separator: String! + rolling_time: Int! + feed_date_attribute: String + include_header: Boolean! + feed_types: [String!]! + feed_attributes: [FeedAttribute!]! + feed_public: Boolean + authorized_members: [MemberAccess!] +} + +input FeedMappingInput { + type: String! + attribute: String! +} + +input FeedAttributeMappingInput { + attribute: String! + mappings: [FeedMappingInput!]! +} + +input FeedAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + filters: String + separator: String! + feed_date_attribute: String! + rolling_time: Int! + include_header: Boolean! + feed_types: [String!]! + feed_public: Boolean + feed_attributes: [FeedAttributeMappingInput!]! + authorized_members: [MemberAccessInput!] +} + +enum FeedOrdering { + name + rolling_time + feed_types + _score +} + +type FeedEdge { + cursor: String! + node: Feed! +} + +type FeedConnection { + pageInfo: PageInfo! + edges: [FeedEdge]! +} + +type RemoteStreamCollection { + id: ID! + name: String + description: String + filters: String +} + +type StreamCollection { + id: ID! + name: String + description: String + filters: String + stream_live: Boolean + stream_public: Boolean + authorized_members: [MemberAccess!] +} + +type StreamCollectionConnection { + pageInfo: PageInfo! + edges: [StreamCollectionEdge!]! +} + +type StreamCollectionEdge { + cursor: String! + node: StreamCollection! +} + +input StreamCollectionAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + filters: String + stream_live: Boolean + stream_public: Boolean + authorized_members: [MemberAccessInput!] +} + +enum StreamCollectionOrdering { + name + stream_public + id + stream_live + _score +} + +type RedisStreamInfo { + lastEventId: String! + firstEventId: String! + firstEventDate: String! + lastEventDate: String! + streamSize: Int! +} + +enum SubTypesOrdering { + label + _score +} + +type SubTypeConnection { + pageInfo: PageInfo! + edges: [SubTypeEdge!]! +} + +type SubTypeEdge { + cursor: String! + node: SubType! +} + +type SubType { + id: ID! + label: String! + statuses: [Status!]! + statusesRequestAccess: [Status!]! + workflowEnabled: Boolean + settings: EntitySetting +} + +enum StatusTemplateOrdering { + name + _score +} + +type StatusTemplate { + id: ID! + name: String! + color: String! + editContext: [EditUserContext!] + usages: Int +} + +type StatusTemplateConnection { + pageInfo: PageInfo! + edges: [StatusTemplateEdge] +} + +type StatusTemplateEdge { + cursor: String! + node: StatusTemplate! +} + +enum StatusOrdering { + type + order + _score +} + +enum StatusScope { + GLOBAL + REQUEST_ACCESS +} + +type Status { + id: ID! + template_id: String! + template: StatusTemplate + type: String! + order: Int! + disabled: Boolean + scope: StatusScope +} + +type StatusConnection { + pageInfo: PageInfo! + edges: [StatusEdge!]! +} + +type StatusEdge { + cursor: String! + node: Status! +} + +input StatusAddInput { + template_id: String! + order: Int! + scope: StatusScope! +} + +input StatusTemplateAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + color: String! +} + +enum SynchronizersOrdering { + id + name + current_state_date + running + uri + stream_id + _score +} + +type Synchronizer { + id: ID! + name: String! + uri: String! + token: String + stream_id: String! + user: Creator + running: Boolean! + current_state_date: DateTime + listen_deletion: Boolean! + no_dependencies: Boolean! + ssl_verify: Boolean + synchronized: Boolean + queue_messages: Int! +} + +type SynchronizerEdge { + cursor: String! + node: Synchronizer! +} + +type SynchronizerConnection { + pageInfo: PageInfo! + edges: [SynchronizerEdge] +} + +input SynchronizerAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + + "*Constraints:*\n* Minimal length: `2`\n" + uri: String! + token: String + + "*Constraints:*\n* Minimal length: `2`\n" + stream_id: String! + user_id: String + recover: DateTime + current_state_date: DateTime + listen_deletion: Boolean! + no_dependencies: Boolean! + ssl_verify: Boolean + synchronized: Boolean +} + +input SynchronizerFetchInput { + uri: String! + token: String + ssl_verify: Boolean +} + +enum WorksOrdering { + status + created_at + timestamp + _score +} + +type WorkMessage { + timestamp: DateTime + message: String + sequence: Int + source: String +} + +type WorkTracking { + import_expected_number: Int + import_last_processed: DateTime + import_processed_number: Int +} + +type Work { + id: ID! + name: String + user: Creator + connector: Connector + timestamp: DateTime! + status: State! + event_source_id: String + received_time: DateTime + processed_time: DateTime + completed_time: DateTime + completed_number: Int + messages: [WorkMessage] + errors: [WorkMessage] + tracking: WorkTracking + draft_context: String +} + +type WorkEdge { + cursor: String! + node: Work! +} + +type WorkConnection { + pageInfo: PageInfo! + edges: [WorkEdge] +} + +type FileMetadata { + encoding: String + mimetype: String + version: String + messages: [WorkMessage] + errors: [WorkMessage] + list_filters: String + entity_id: String + entity: StixObject + labels_text: String + labels: [String] + file_markings: [String] + creator_id: String + external_reference_id: String + creator: Creator + description: String + order: Int + inCarousel: Boolean + analysis_content_source: String + analysis_content_type: String + analysis_type: String +} + +enum FileOrdering { + _score + name + lastModified + objectMarking +} + +type File { + id: ID! + entity_type: String! + draftVersion: DraftVersion + name: String! + size: Int + lastModified: DateTime + lastModifiedSinceMin: Int + metaData: FileMetadata + objectMarking: [MarkingDefinition!]! + uploadStatus: State! + works: [Work] +} + +type FileEdge { + cursor: String! + node: File! +} + +type FileConnection { + pageInfo: PageInfo! + edges: [FileEdge!]! +} + +enum WidgetPerspective { + entities + relationships + audits +} + +type WidgetColumn { + attribute: String! + displayStyle: String + label: String + variableName: String +} + +type WidgetDataSelection { + label: String + number: Int + attribute: String + date_attribute: String + centerLat: Float + centerLng: Float + zoom: Float + isTo: Boolean + perspective: WidgetPerspective + filters: String + dynamicFrom: String + dynamicTo: String + columns: [WidgetColumn!] + instance_id: String + sort_by: String + sort_mode: String +} + +type WidgetParameters { + title: String + description: String + interval: String + stacked: Boolean + legend: Boolean + distributed: Boolean +} + +type WidgetLayout { + w: Float + h: Float + x: Float + y: Float + i: Float + moved: Boolean + static: Boolean +} + +type Widget { + id: ID! + type: String! + perspective: WidgetPerspective + dataSelection: [WidgetDataSelection!]! + parameters: WidgetParameters + layout: WidgetLayout +} + +type IndexedFile { + id: ID! + name: String! + file_id: String! + uploaded_at: DateTime! + entity: StixObject + searchOccurrences: Int +} + +type IndexedFileEdge { + cursor: String! + node: IndexedFile! +} + +type IndexedFileConnection { + pageInfo: PageInfo! + edges: [IndexedFileEdge] +} + +type MetricsByMimeType { + mimeType: String! + count: Int! + size: Float! +} + +type FilesMetrics { + globalCount: Int! + globalSize: Float! + metricsByMimeType: [MetricsByMimeType!] +} + +type OpenCtiFile { + id: ID! + name: String! + mime_type: String! + description: String + order: Int + inCarousel: Boolean +} + +enum BackgroundTaskType { + QUERY + LIST + RULE +} + +type BackgroundTaskError { + id: ID! + timestamp: DateTime + message: String +} + +enum BackgroundTaskScope { + KNOWLEDGE + USER + USER_NOTIFICATION + SETTINGS + IMPORT + DASHBOARD + PUBLIC_DASHBOARD + INVESTIGATION + PLAYBOOK +} + +enum BackgroundTaskActionType { + DELETE + COMPLETE_DELETE + RESTORE + ADD + REMOVE + REPLACE + MERGE + ENRICHMENT + PROMOTE + RULE_ELEMENT_RESCAN + SHARE + UNSHARE + SHARE_MULTIPLE + UNSHARE_MULTIPLE + REMOVE_AUTH_MEMBERS + REMOVE_FROM_DRAFT + ADD_ORGANIZATIONS + REMOVE_ORGANIZATIONS + ADD_GROUPS + REMOVE_GROUPS + SEND_EMAIL +} + +enum BackgroundTaskContextType { + ATTRIBUTE + RELATION + REVERSED_RELATION +} + +enum BackgroundTasksOrdering { + id + type + completed + created_at + last_execution_date + _score +} + +type BackgroundTaskContext { + field: String + type: BackgroundTaskContextType + values: [String]! +} + +type BackgroundTaskAction { + type: BackgroundTaskActionType + context: BackgroundTaskContext +} + +interface BackgroundTask { + id: ID! + type: BackgroundTaskType + description: String + initiator: Creator + actions: [BackgroundTaskAction] + created_at: DateTime + last_execution_date: DateTime + completed: Boolean + task_expected_number: Int + task_processed_number: Int + errors: [BackgroundTaskError] + work: Work +} + +type RuleTask implements BackgroundTask { + id: ID! + type: BackgroundTaskType + description: String + initiator: Creator + actions: [BackgroundTaskAction] + created_at: DateTime + last_execution_date: DateTime + completed: Boolean + task_expected_number: Int + task_processed_number: Int + errors: [BackgroundTaskError] + rule: ID! + enable: Boolean + work: Work +} + +type ListTask implements BackgroundTask { + id: ID! + type: BackgroundTaskType + description: String + initiator: Creator + actions: [BackgroundTaskAction] + created_at: DateTime + last_execution_date: DateTime + completed: Boolean + task_expected_number: Int + task_processed_number: Int + errors: [BackgroundTaskError] + scope: BackgroundTaskScope! + authorized_members: [MemberAccess!] + authorized_authorities: [String] + task_ids: [ID!] + work: Work +} + +type QueryTask implements BackgroundTask { + id: ID! + type: BackgroundTaskType + description: String + initiator: Creator + actions: [BackgroundTaskAction] + created_at: DateTime + last_execution_date: DateTime + completed: Boolean + task_expected_number: Int + task_processed_number: Int + errors: [BackgroundTaskError] + scope: BackgroundTaskScope! + authorized_members: [MemberAccess!] + authorized_authorities: [String] + task_filters: String! + task_search: String + work: Work +} + +type BackgroundTaskConnectionEdge { + cursor: String! + node: BackgroundTask! +} + +type BackgroundTaskConnection { + pageInfo: PageInfo! + edges: [BackgroundTaskConnectionEdge] +} + +input BackgroundTaskContextOptionsInput { + includeNeighbours: Boolean +} + +input BackgroundTaskContextInput { + field: String + type: BackgroundTaskContextType + values: [String]! + options: BackgroundTaskContextOptionsInput +} + +input BackgroundTaskActionInput { + containerId: String + type: BackgroundTaskActionType! + context: BackgroundTaskContextInput +} + +input ListTaskAddInput { + ids: [ID!] + description: String + actions: [BackgroundTaskActionInput]! + scope: BackgroundTaskScope! +} + +input QueryTaskAddInput { + filters: String + description: String + search: String + excluded_ids: [ID] + actions: [BackgroundTaskActionInput]! + scope: BackgroundTaskScope! +} + +input RetentionRuleAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + filters: String + + "*Constraints:*\n* Minimal value: `1`\n" + max_retention: Int! + retention_unit: RetentionUnit + scope: RetentionRuleScope! +} + +enum RetentionRuleOrdering { + name + scope + remaining_count + last_execution_date + max_retention + _score +} + +enum RetentionRuleScope { + knowledge + file + workbench +} + +enum RetentionUnit { + minutes + hours + days +} + +type RetentionRule { + id: ID! + standard_id: String! + name: String! + filters: String! + max_retention: Int! + retention_unit: RetentionUnit! + last_execution_date: DateTime + last_deleted_count: Int + remaining_count: Int + scope: RetentionRuleScope! +} + +type RetentionRuleConnection { + pageInfo: PageInfo! + edges: [RetentionRuleEdge] +} + +type RetentionRuleEdge { + cursor: String! + node: RetentionRule! +} + +type RetentionRuleEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): RetentionRule +} + +interface BasicObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] +} + +interface InternalObject { + id: ID! + entity_type: String! +} + +type Module { + id: ID! + enable: Boolean! + running: Boolean! + warning: Boolean +} + +type Cluster { + instances_number: Int! +} + +type Provider { + name: String! + type: String + strategy: String + provider: String +} + +type UserStatus { + status: String! + message: String! +} + +input SettingsMessageInput { + id: ID + message: String! + activated: Boolean! + dismissible: Boolean! + color: String + recipients: [String!] +} + +type SettingsMessage { + id: ID! + message: String! + activated: Boolean! + dismissible: Boolean! + updated_at: DateTime! + refreshed_at: DateTime + color: String + recipients: [Member!] +} + +type PlatformEE { + license_enterprise: Boolean! + license_by_configuration: Boolean! + license_customer: String! + license_validated: Boolean! + license_valid_cert: Boolean! + license_expired: Boolean! + license_expiration_prevention: Boolean! + license_start_date: DateTime! + license_expiration_date: DateTime! + license_platform: String! + license_type: String! + license_platform_match: Boolean! + license_creator: String! + license_global: Boolean! + license_extra_expiration: Boolean! + license_extra_expiration_days: Int +} + +enum PlatformCriticalAlertType { + GROUP_WITH_NULL_CONFIDENCE_LEVEL +} + +type PlatformCriticalAlertDetails { + groups: [Group!]! +} + +type PlatformCriticalAlert { + message: String! + type: PlatformCriticalAlertType! + details: PlatformCriticalAlertDetails +} + +type PlatformProtectedSubConfig { + enabled: Boolean! + protected_ids: [String!]! +} + +type PlatformProtectedSensitiveConfig { + enabled: Boolean! + markings: PlatformProtectedSubConfig! + groups: PlatformProtectedSubConfig! + roles: PlatformProtectedSubConfig! + rules: PlatformProtectedSubConfig! + ce_ee_toggle: PlatformProtectedSubConfig! + connector_reset: PlatformProtectedSubConfig! + file_indexing: PlatformProtectedSubConfig! + platform_organization: PlatformProtectedSubConfig! +} + +enum CGUStatus { + pending + disabled + enabled +} + +type PublicProvider { + name: String! + type: String! + provider: String! +} + +interface IntlSettings { + platform_language: String + platform_translations: String +} + +type MetricAttributes { + attribute: String! + name: String! + description: String +} + +type MetricDefinition { + entity_type: String! + metrics: [MetricAttributes!] +} + +interface ThemeSettings { + platform_title: String + platform_favicon: String + platform_theme: Theme +} + +type PublicSettings implements IntlSettings & ThemeSettings { + id: ID! + platform_title: String + platform_favicon: String + platform_login_message: String + platform_consent_message: String + platform_consent_confirm_text: String + platform_banner_text: String + platform_banner_level: String + platform_theme: Theme + platform_map_tile_server_dark: String + platform_map_tile_server_light: String + platform_whitemark: Boolean + platform_language: String + platform_translations: String + platform_providers: [PublicProvider!]! + platform_enterprise_edition_license_validated: Boolean! + playground_enabled: Boolean! + metrics_definition: [MetricDefinition!] +} + +enum PlatformType { + LTS + STANDARD +} + +type Settings implements InternalObject & BasicObject & ThemeSettings & IntlSettings { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String!]! + metrics: [Metric] + platform_enterprise_edition: PlatformEE! + platform_organization: Organization + platform_title: String + platform_favicon: String + platform_email: String + platform_type: PlatformType! + platform_email_configurable: Boolean! + platform_cluster: Cluster! + platform_modules: [Module!] + platform_url: String + platform_providers: [Provider!]! + platform_user_statuses: [UserStatus!]! + platform_language: String + platform_theme: Theme + platform_map_tile_server_dark: String + platform_map_tile_server_light: String + platform_openaev_url: String + platform_opengrc_url: String + platform_xtmhub_url: String + platform_login_message: String + platform_consent_message: String + platform_consent_confirm_text: String + platform_banner_text: String + platform_banner_level: String + platform_session_idle_timeout: Int + platform_session_timeout: Int + platform_whitemark: Boolean + platform_demo: Boolean + platform_reference_attachment: Boolean + platform_feature_flags: [Module!] + platform_critical_alerts: [PlatformCriticalAlert!]! + platform_trash_enabled: Boolean! + platform_translations: String + platform_protected_sensitive_config: PlatformProtectedSensitiveConfig! + created_at: DateTime! + updated_at: DateTime! + refreshed_at: DateTime + activity_listeners: [Member!] + otp_mandatory: Boolean + password_policy_min_length: Int + password_policy_max_length: Int + password_policy_min_symbols: Int + password_policy_min_numbers: Int + password_policy_min_words: Int + password_policy_min_lowercase: Int + password_policy_min_uppercase: Int + platform_messages: [SettingsMessage!] + platform_session_max_concurrent: Int + messages_administration: [SettingsMessage!] + analytics_google_analytics_v4: String + playground_enabled: Boolean! + request_access_enabled: Boolean! + metrics_definition: [MetricDefinition!] + view_all_users: Boolean + editContext: [EditUserContext!] + xtm_hub_token: String + xtm_hub_registration_user_id: String + xtm_hub_registration_user_name: ID + xtm_hub_last_connectivity_check: DateTime + xtm_hub_registration_date: DateTime + xtm_hub_registration_status: XTMHubRegistrationStatus + xtm_hub_backend_is_reachable: Boolean + platform_ai_enabled: Boolean! + platform_ai_type: String + platform_ai_model: String + platform_ai_has_token: Boolean! + filigran_chatbot_ai_url: String + filigran_chatbot_ai_cgu_status: CGUStatus! +} + +enum GroupsOrdering { + name + default_assignation + no_creators + restrict_delete + auto_new_marking + created_at + updated_at + group_confidence_level + _score +} + +type GroupConnection { + pageInfo: PageInfo! + edges: [GroupEdge] +} + +type GroupEdge { + cursor: String! + node: Group! +} + +input DefaultMarkingInput { + entity_type: String! + values: [String!] +} + +type DefaultMarking { + entity_type: String + values: [MarkingDefinition!] +} + +type Group implements InternalObject & BasicObject { + id: ID! + standard_id: String! + entity_type: String! + auto_integration_assignation: [String]! + parent_types: [String]! + metrics: [Metric] + name: String! + default_assignation: Boolean + no_creators: Boolean + restrict_delete: Boolean + auto_new_marking: Boolean + description: String + default_dashboard: Workspace + members(first: Int, after: ID, orderBy: UsersOrdering, orderMode: OrderingMode, search: String): UserConnection + created_at: DateTime + updated_at: DateTime + refreshed_at: DateTime + roles(orderBy: RolesOrdering, orderMode: OrderingMode): RoleConnection + allowed_marking: [MarkingDefinition!] + default_marking: [DefaultMarking!] + not_shareable_marking_types: [String!]! + max_shareable_marking: [MarkingDefinition!]! + default_hidden_types: [String!] + group_confidence_level: ConfidenceLevel + editContext: [EditUserContext!] +} + +input GroupAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + default_assignation: Boolean + no_creators: Boolean + restrict_delete: Boolean + auto_new_marking: Boolean + clientMutationId: String + group_confidence_level: ConfidenceLevelInput! +} + +enum UnitSystem { + auto + Metric + Imperial +} + +enum UsersOrdering { + name + user_email + firstname + lastname + language + external + created_at + updated_at + _score +} + +type UserConnection { + pageInfo: PageInfo! + edges: [UserEdge!]! +} + +type CreatorConnection { + pageInfo: PageInfo! + edges: [CreatorEdge] +} + +type AssigneeConnection { + pageInfo: PageInfo! + edges: [AssigneeEdge!]! +} + +type ParticipantConnection { + pageInfo: PageInfo! + edges: [ParticipantEdge!]! +} + +type MemberConnection { + pageInfo: PageInfo! + edges: [MemberEdge!]! +} + +type UserEdge { + cursor: String! + node: User! +} + +type CreatorEdge { + cursor: String! + node: Creator! +} + +type AssigneeEdge { + cursor: String! + node: Assignee! +} + +type ParticipantEdge { + cursor: String! + node: Participant! +} + +type MemberEdge { + cursor: String! + node: Member! +} + +type Assignee { + id: ID! + name: String! + entity_type: String! +} + +type Participant { + id: ID! + name: String! + entity_type: String! +} + +type Member { + id: ID! + name: String! + entity_type: String! + effective_confidence_level: EffectiveConfidenceLevel + group_confidence_level: ConfidenceLevel +} + +type MemberGroupRestriction { + id: String! + name: String! +} + +type MemberAccess { + id: String! + member_id: ID! + name: String! + entity_type: String! + access_right: String! + groups_restriction: [MemberGroupRestriction!] +} + +input MemberAccessInput { + id: ID! + access_right: String! + groups_restriction_ids: [ID!] +} + +type OtpElement { + secret: String! + uri: String! +} + +type Creator { + id: ID! + name: String! + entity_type: String! + representative: Representative! +} + +type ConfidenceLevel { + max_confidence: Int + overrides: [ConfidenceLevelOverride!]! +} + +type ConfidenceLevelOverride { + entity_type: String! + max_confidence: Int! +} + +type EffectiveConfidenceLevelOverride { + entity_type: String! + max_confidence: Int! + source: EffectiveConfidenceLevelSource +} + +type EffectiveConfidenceLevel { + max_confidence: Int! + overrides: [EffectiveConfidenceLevelOverride!]! + source: EffectiveConfidenceLevelSource +} + +type EffectiveConfidenceLevelSource { + type: EffectiveConfidenceLevelSourceType! + object: EffectiveConfidenceLevelSourceObject +} + +enum EffectiveConfidenceLevelSourceType { + User + Group + Bypass +} + +union EffectiveConfidenceLevelSourceObject = Group | User + +type User implements BasicObject & InternalObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + user_email: String! + api_token: String! + personal_notifiers: [Notifier!] + individual_id: String + name: String! + description: String + firstname: String + otp_activated: Boolean + otp_qr: String + otp_mandatory: Boolean + user_service_account: Boolean + lastname: String + theme: String + language: String + external: Boolean + roles(orderBy: RolesOrdering, orderMode: OrderingMode): [Role!]! + capabilities: [Capability]! + capabilitiesInDraft: [Capability]! + default_hidden_types: [String!]! + user_confidence_level: ConfidenceLevel + effective_confidence_level: EffectiveConfidenceLevel + no_creators: Boolean + restrict_delete: Boolean + groups(orderBy: GroupsOrdering, orderMode: OrderingMode): GroupConnection + objectOrganization(first: Int, orderBy: OrganizationsOrdering, orderMode: OrderingMode): OrganizationConnection + objectAssignedOrganization(first: Int, orderBy: OrganizationsOrdering, orderMode: OrderingMode): OrganizationConnection + created_at: DateTime! + updated_at: DateTime! + refreshed_at: DateTime + sessions: [SessionDetail] + default_time_field: String + account_status: String! + account_lock_after_date: DateTime + administrated_organizations: [Organization!]! + unit_system: UnitSystem + submenu_show_icons: Boolean + submenu_auto_collapse: Boolean + monochrome_labels: Boolean + editContext: [EditUserContext!] + creator: Creator +} + +type MeUser implements BasicObject & InternalObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String!]! + metrics: [Metric] + user_email: String! + name: String! + description: String + firstname: String + otp_activated: Boolean + otp_qr: String + lastname: String + theme: String + language: String + external: Boolean + individual_id: String + api_token: String! + personal_notifiers: [Notifier!] + objectOrganization: MeOrganizationConnection + capabilities: [Capability!]! + capabilitiesInDraft: [Capability!]! + default_hidden_types: [String]! + user_confidence_level: ConfidenceLevel + effective_confidence_level: EffectiveConfidenceLevel + no_creators: Boolean + restrict_delete: Boolean + allowed_marking: [MarkingDefinition!] + default_marking: [DefaultMarking!] + max_shareable_marking: [MarkingDefinition!] + otp_mandatory: Boolean + groups(orderBy: GroupsOrdering, orderMode: OrderingMode): GroupConnection + default_dashboards: [Workspace!]! + default_dashboard: Workspace + default_time_field: String + account_status: String! + account_lock_after_date: DateTime + administrated_organizations: [Organization!]! + unit_system: UnitSystem + submenu_show_icons: Boolean + submenu_auto_collapse: Boolean + monochrome_labels: Boolean + can_manage_sensitive_config: Boolean + draftContext: DraftWorkspace +} + +type SessionDetail { + id: ID! + created: DateTime + ttl: Int + originalMaxAge: Int +} + +type UserSession { + user: Creator + sessions: [SessionDetail] +} + +input UserAddInput { + "*Constraints:*\n* Minimal length: `5`\n* Must match format: `email`\n" + user_email: String + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + password: String + firstname: String + lastname: String + description: String + language: String + theme: String + objectOrganization: [ID!] + account_status: String + account_lock_after_date: DateTime + unit_system: String + submenu_show_icons: Boolean + submenu_auto_collapse: Boolean + monochrome_labels: Boolean + groups: [ID!] + user_confidence_level: ConfidenceLevelInput + prevent_default_groups: Boolean + user_service_account: Boolean + email_template_id: String +} + +input SendUserMailInput { + target_user_id: ID! + email_template_id: ID! +} + +input ConfidenceLevelInput { + max_confidence: Int + overrides: [ConfidenceLevelOverrideInput!]! +} + +input ConfidenceLevelOverrideInput { + entity_type: String! + max_confidence: Int! +} + +input UserLoginInput { + email: String! + password: String! +} + +input UserOTPLoginInput { + code: String! +} + +input LicenseActivationInput { + settingId: ID! + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + license: String! +} + +input UserOTPActivationInput { + secret: String! + code: String! +} + +enum RolesOrdering { + name + created_at + updated_at + _score +} + +type RoleConnection { + pageInfo: PageInfo! + edges: [RoleEdge!] +} + +type RoleEdge { + cursor: String! + node: Role! +} + +type Role implements BasicObject & InternalObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + name: String! + description: String + created_at: DateTime! + updated_at: DateTime! + refreshed_at: DateTime + capabilities: [Capability] + capabilitiesInDraft: [Capability] + editContext: [EditUserContext!] + can_manage_sensitive_config: Boolean +} + +input RoleAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + clientMutationId: String +} + +type CapabilityConnection { + pageInfo: PageInfo! + edges: [CapabilityEdge] +} + +type CapabilityEdge { + cursor: String! + node: Capability! +} + +type Capability implements BasicObject & InternalObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + name: String! + description: String + attribute_order: Int + created_at: DateTime! + updated_at: DateTime! + refreshed_at: DateTime + editContext: [EditUserContext!] +} + +enum ConnectorType { + EXTERNAL_IMPORT + INTERNAL_IMPORT_FILE + INTERNAL_ENRICHMENT + INTERNAL_ANALYSIS + INTERNAL_EXPORT_FILE + STREAM +} + +input ConnectorWithConfig { + connectorId: String + configuration: String +} + +input ExportAskInput { + format: String! + exportType: String! + contentMaxMarkings: [String] + fileMarkings: [String] +} + +input StixCoreObjectsExportAskInput { + format: String! + exportType: String! + contentMaxMarkings: [String] + fileMarkings: [String] + search: String + exportContext: ExportContext + orderBy: StixCoreObjectsOrdering + orderMode: OrderingMode + filters: FilterGroup + selectedIds: [String] +} + +input StixCoreRelationshipsExportAskInput { + format: String! + exportType: String! + contentMaxMarkings: [String] + fileMarkings: [String] + exportContext: ExportContext + search: String + orderBy: StixCoreRelationshipsOrdering + orderMode: OrderingMode + selectedIds: [String] + fromOrToId: [String] + elementWithTargetTypes: [String] + fromId: [String] + fromRole: String + fromTypes: [String] + toId: [String] + toRole: String + toTypes: [String] + relationship_type: [String] + filters: FilterGroup +} + +input StixCyberObservablesExportAskInput { + format: String! + exportType: String! + exportContext: ExportContext + contentMaxMarkings: [String] + fileMarkings: [String] + search: String + orderBy: StixCyberObservablesOrdering + orderMode: OrderingMode + filters: FilterGroup + selectedIds: [String] +} + +input ContractConfigInput { + key: String! + value: String! +} + +input RegisterConnectorInput { + id: ID! + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + type: ConnectorType! + scope: [String!] + auto: Boolean + auto_update: Boolean + enrichment_resolution: String + only_contextual: Boolean + playbook_compatible: Boolean + listen_callback_uri: String +} + +input EditManagedConnectorInput { + id: ID! + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + connector_user_id: ID! + manager_contract_configuration: [ContractConfigInput!]! +} + +input AddManagedConnectorInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + connector_user_id: ID + user_id: ID! + catalog_id: ID! + automatic_user: Boolean + confidence_level: String + manager_contract_image: String! + manager_contract_configuration: [ContractConfigInput!]! +} + +input RegisterConnectorsManagerInput { + id: ID! + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + public_key: String! +} + +input UpdateConnectorManagerStatusInput { + id: ID! +} + +input RequestConnectorStatusInput { + id: ID! + status: ConnectorRequestStatus! +} + +input CurrentConnectorStatusInput { + id: ID! + status: ConnectorCurrentStatus! +} + +input LogsConnectorStatusInput { + id: ID! + logs: [String!]! +} + +input HealthConnectorStatusInput { + id: ID! + restart_count: Int! + started_at: DateTime! + is_in_reboot_loop: Boolean! +} + +type RabbitMQConnection { + host: String! + vhost: String! + use_ssl: Boolean! + port: Int! + user: String! + pass: String! +} + +input ConnectorInfoInput { + run_and_terminate: Boolean! + buffering: Boolean! + queue_threshold: Float! + queue_messages_size: Float! + next_run_datetime: DateTime + last_run_datetime: DateTime +} + +type ConnectorInfo { + run_and_terminate: Boolean! + buffering: Boolean! + queue_threshold: Float! + queue_messages_size: Float! + next_run_datetime: DateTime + last_run_datetime: DateTime +} + +type ConnectorConfig { + connection: RabbitMQConnection! + listen: String! + listen_routing: String! + listen_exchange: String! + listen_callback_uri: String + push: String! + push_routing: String! + push_exchange: String! + dead_letter_routing: String! +} + +type ConnectorMetadata { + configuration: String! +} + +type ConnectorConfiguration { + id: ID! + name: String! + configuration: String! +} + +type ConnectorQueueDetails { + messages_number: Float! + messages_size: Float! +} + +type ConnectorContractConfiguration { + key: String! + value: String + encrypted: Boolean +} + +enum ConnectorRequestStatus { + starting + stopping +} + +enum ConnectorCurrentStatus { + started + stopped +} + +type ManagerContractConfiguration { + key: String + value: String +} + +type ManagerContractExcerpt { + title: String! + slug: String! +} + +enum ConnectorPriorityGroup { + REALTIME + DEFAULT +} + +type Connector implements BasicObject & InternalObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + name: String! + title: String! + active: Boolean + auto: Boolean + auto_update: Boolean + enrichment_resolution: String + only_contextual: Boolean + playbook_compatible: Boolean + connector_trigger_filters: String + connector_type: String + connector_scope: [String!] + connector_state: String + connector_schema: String + connector_schema_ui: String + connector_state_reset: Boolean + connector_state_timestamp: DateTime + connector_user_id: ID + connector_user: User + connector_queue_details: ConnectorQueueDetails! + connector_info: ConnectorInfo + connector_priority_group: ConnectorPriorityGroup! + updated_at: DateTime + refreshed_at: DateTime + created_at: DateTime + config: ConnectorConfig + works(status: String): [Work] + is_managed: Boolean + manager_current_status: String + manager_requested_status: String + manager_contract_image: String + manager_contract_definition: String + manager_contract_excerpt: ManagerContractExcerpt + manager_contract_configuration: [ManagerContractConfiguration!] + manager_connector_logs: [String!] + manager_contract_hash: String + manager_health_metrics: ConnectorHealthMetrics + manager_connector_uptime: Int + built_in: Boolean + configurations: [ConnectorConfiguration!] +} + +type ManagedConnector implements BasicObject & InternalObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + name: String! + connector_user_id: ID + connector_user: User + connector_state_timestamp: DateTime + manager: ConnectorManager + manager_contract_image: String! + manager_current_status: String + manager_requested_status: String! + manager_contract_configuration: [ConnectorContractConfiguration!]! + manager_contract_hash: String! + manager_connector_logs: [String!]! + manager_health_metrics: ConnectorHealthMetrics + manager_connector_uptime: Int +} + +type ConnectorHealthMetrics { + restart_count: Int! + started_at: DateTime! + last_update: DateTime! + is_in_reboot_loop: Boolean! +} + +type ConnectorManager implements BasicObject & InternalObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + name: String! + public_key: String! + last_sync_execution: DateTime + about_version: String! + active: Boolean! +} + +type RuleExecutionError { + timestamp: DateTime + source: String + error: String +} + +type RuleManager { + id: ID! + activated: Boolean! + lastEventId: String + errors: [RuleExecutionError] +} + +type DisplayStep { + source: String + source_color: String + relation: String + target: String + target_color: String + identifier: String + identifier_color: String + action: String +} + +type Display { + if: [DisplayStep] + then: [DisplayStep] +} + +type Rule { + id: ID! + name: String! + description: String! + activated: Boolean! + category: String + display: Display +} + +type InferenceAttribute { + field: String! + value: String! +} + +type Inference { + rule: Rule! + explanation: [StixObjectOrStixRelationship]! + attributes: [InferenceAttribute] +} + +enum DraftOperation { + create + update + update_linked + delete + delete_linked +} + +type DraftVersion { + draft_id: String! + draft_operation: DraftOperation! +} + +interface StixObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + refreshed_at: DateTime + x_opencti_modified_at: DateTime + draftVersion: DraftVersion + creators: [Creator!] + x_opencti_inferences: [Inference] +} + +enum StixMetaObjectsOrdering { + entity_type + created + modified + spec_version + created_at + updated_at + _score +} + +type StixMetaObjectConnection { + pageInfo: PageInfo! + edges: [StixMetaObjectEdge] +} + +type StixMetaObjectEdge { + cursor: String! + node: StixMetaObject! +} + +interface StixMetaObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + refreshed_at: DateTime + draftVersion: DraftVersion + created: DateTime + modified: DateTime +} + +enum MarkingDefinitionsOrdering { + definition_type + definition + x_opencti_order + x_opencti_color + created + modified + created_at + updated_at + _score +} + +type MarkingDefinitionConnection { + pageInfo: PageInfo! + edges: [MarkingDefinitionEdge!]! +} + +type MarkingDefinitionEdge { + cursor: String! + node: MarkingDefinition! +} + +type MarkingDefinition implements BasicObject & StixObject & StixMetaObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + created: DateTime + modified: DateTime + definition_type: String + definition: String + x_opencti_order: Int! + x_opencti_color: String + creators: [Creator!] + toStix(version: Version): String + editContext: [EditUserContext!] +} + +input MarkingDefinitionAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + definition_type: String! + definition: String! + x_opencti_order: Int! + x_opencti_color: String + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + clientMutationId: String + update: Boolean +} + +type MarkingDefinitionShort { + id: ID! + standard_id: String! + entity_type: String! + representative: Representative + definition_type: String + definition: String + x_opencti_order: Int! + x_opencti_color: String +} + +enum LabelsOrdering { + value + color + created + modified + created_at + updated_at + _score +} + +type LabelConnection { + pageInfo: PageInfo! + edges: [LabelEdge!]! +} + +type LabelEdge { + cursor: String! + node: Label! +} + +type Label implements BasicObject & StixObject & StixMetaObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + created: DateTime + modified: DateTime + value: String + color: String + creators: [Creator!] + toStix(version: Version): String + editContext: [EditUserContext!] +} + +input LabelAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + value: String! + color: String + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + clientMutationId: String + update: Boolean +} + +enum ExternalReferencesOrdering { + source_name + url + hash + external_id + created + modified + created_at + updated_at + creator + _score +} + +type ExternalReferenceConnection { + pageInfo: PageInfo! + edges: [ExternalReferenceEdge!]! +} + +type ExternalReferenceEdge { + cursor: String! + node: ExternalReference! +} + +type ExternalReference implements BasicObject & StixObject & StixMetaObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + created: DateTime + modified: DateTime + source_name: String! + description: String + url: String + hash: String + external_id: String + references(types: [String]): StixObjectOrStixRelationshipConnection + fileId: String + creators: [Creator!] + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection! + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection! + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input ExternalReferenceAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + source_name: String! + description: String + url: String + hash: String + file: Upload + external_id: String + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + clientMutationId: String + update: Boolean +} + +enum KillChainPhasesOrdering { + x_opencti_order + kill_chain_name + phase_name + created + modified + created_at + updated_at + _score +} + +type KillChainPhaseConnection { + pageInfo: PageInfo! + edges: [KillChainPhaseEdge!]! +} + +type KillChainPhaseEdge { + cursor: String! + node: KillChainPhase! +} + +type KillChainPhase implements BasicObject & StixObject & StixMetaObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + created: DateTime + modified: DateTime + kill_chain_name: String! + phase_name: String! + x_opencti_order: Int + creators: [Creator!] + editContext: [EditUserContext!] +} + +input KillChainPhaseAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + kill_chain_name: String! + phase_name: String! + x_opencti_order: Int! + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + clientMutationId: String + update: Boolean +} + +type Representative { + main: String! + secondary: String +} + +enum UnknownStixCoreObjectsOrdering { + value + entity_type +} + +enum StixCoreObjectsOrdering { + name + entity_type + created + modified + created_at + updated_at + start_time + stop_time + published + valid_from + valid_until + first_seen + last_seen + indicator_pattern + x_opencti_workflow_id + createdBy + creator + objectMarking + observable_value + subject + value + opinions_metrics_mean + opinions_metrics_min + opinions_metrics_max + opinions_metrics_total + _score + authorized_members_activation_date +} + +type StixCoreObjectConnection { + pageInfo: PageInfo! + edges: [StixCoreObjectEdge!]! +} + +type StixCoreObjectEdge { + cursor: String! + node: StixCoreObject! +} + +union OrganizationOrIndividual = Organization | Individual + +interface StixCoreObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + opinions_metrics: OpinionsMetrics +} + +enum StixDomainObjectsOrdering { + name + entity_type + created + modified + created_at + updated_at + refreshed_at + published + valid_from + valid_until + indicator_pattern + x_opencti_workflow_id + createdBy + creator + objectMarking + _score + first_seen + last_seen + attribute_count + x_opencti_negative + confidence + first_observed + last_observed + number_observed + incident_type + severity + priority + rating + context + attribute_abstract + opinion + pattern_type + report_types + note_types + channel_types + x_opencti_base_severity + event_types + x_opencti_organization_type + submitted + product + result_name + operatingSystem + x_opencti_cvss_base_severity + pir_score + last_pir_score_date +} + +type StixDomainObjectConnection { + pageInfo: PageInfo! + edges: [StixDomainObjectEdge] +} + +type StixDomainObjectEdge { + cursor: String! + node: StixDomainObject! +} + +interface StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +input StixDomainObjectAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + confidence: Int + pattern_type: String + context: String + pattern: String + aliases: [String] + x_opencti_aliases: [String] + type: String! + createdBy: String + objectMarking: [String] + objectLabel: [String] + killChainPhases: [String] + externalReferences: [String] + objects: [String] + clientMutationId: String + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + update: Boolean +} + +enum AttackPatternsOrdering { + x_mitre_id + name + created + modified + created_at + updated_at + objectMarking + x_opencti_workflow_id + _score +} + +type AttackPatternConnection { + pageInfo: PageInfo! + edges: [AttackPatternEdge!]! +} + +type AttackPatternEdge { + cursor: String! + node: AttackPattern! +} + +type AttackPattern implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + aliases: [String] + x_mitre_platforms: [String!] + x_mitre_permissions_required: [String] + x_mitre_detection: String + x_mitre_id: String + killChainPhases: [KillChainPhase!] + coursesOfAction(first: Int, after: ID, orderBy: CoursesOfActionOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): CourseOfActionConnection + parentAttackPatterns(first: Int, after: ID, orderBy: AttackPatternsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): AttackPatternConnection + subAttackPatterns(first: Int, after: ID, orderBy: AttackPatternsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): AttackPatternConnection + isSubAttackPattern: Boolean + dataComponents: DataComponentConnection + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +input AttackPatternAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + aliases: [String] + revoked: Boolean + lang: String + confidence: Int + x_mitre_platforms: [String!] + x_mitre_permissions_required: [String] + x_mitre_detection: String + x_mitre_id: String + createdBy: String + objectMarking: [String] + objectOrganization: [String] + objectLabel: [String] + killChainPhases: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +type AttackPatternForMatrix { + attack_pattern_id: String! + name: String! + description: String + x_mitre_id: String + subAttackPatterns: [SubAttackPatternForMatrix!] + subAttackPatternsSearchText: String + killChainPhasesIds: [String!] +} + +type SubAttackPatternForMatrix { + attack_pattern_id: String! + name: String! + description: String +} + +type AttackPatternsByKillChain { + kill_chain_id: String! + kill_chain_name: String! + phase_name: String! + x_opencti_order: Int! + attackPatterns: [AttackPatternForMatrix!] +} + +type AttackPatternsMatrix { + attackPatternsOfPhases: [AttackPatternsByKillChain!] +} + +enum CampaignsOrdering { + name + first_seen + last_seen + role_played + created + modified + created_at + updated_at + objectMarking + x_opencti_workflow_id + confidence + _score +} + +type CampaignConnection { + pageInfo: PageInfo! + edges: [CampaignEdge] +} + +type CampaignEdge { + cursor: String! + node: Campaign! +} + +type Campaign implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + aliases: [String] + first_seen: DateTime + last_seen: DateTime + objective: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation + securityCoverage: SecurityCoverage +} + +input CampaignAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + aliases: [String] + revoked: Boolean + lang: String + confidence: Int + first_seen: DateTime + last_seen: DateTime + objective: String + createdBy: String + objectMarking: [String] + objectAssignee: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum ContainersOrdering { + name + published + created + modified + created_at + updated_at + createdBy + objectMarking + x_opencti_workflow_id + creator + entity_type + _score +} + +type ContainerConnection { + pageInfo: PageInfo! + edges: [ContainerEdge!]! +} + +type ContainerEdge { + cursor: String! + node: Container! +} + +interface Container { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + avatar: OpenCtiFile + authorized_members: [MemberAccess!] + authorized_members_activation_date: DateTime + currentUserAccessRight: String + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + relatedContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], viaTypes: [String]): ContainerConnection + filesFromTemplate(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + fintelTemplates: [FintelTemplate!] + creators: [Creator!] + workflowEnabled: Boolean + status: Status +} + +enum NotesOrdering { + attribute_abstract + created + modified + created_at + updated_at + createdBy + x_opencti_workflow_id + objectMarking + note_types + creator + _score +} + +type NoteConnection { + pageInfo: PageInfo! + edges: [NoteEdge!]! +} + +type NoteEdge { + cursor: String! + node: Note! +} + +type Note implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Container { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + authorized_members: [MemberAccess!] + authorized_members_activation_date: DateTime + currentUserAccessRight: String + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + relatedContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], viaTypes: [String]): ContainerConnection + attribute_abstract: String + content: String! + authors: [String] + note_types: [String] + likelihood: Int + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + filesFromTemplate(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + fintelTemplates: [FintelTemplate!] + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +input NoteAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + attribute_abstract: String + + "*Constraints:*\n* Minimal length: `2`\n" + content: String! + authors: [String] + note_types: [String] + likelihood: Int + revoked: Boolean + lang: String + createdBy: String + confidence: Int + objectMarking: [String] + objectLabel: [String] + objectOrganization: [String] + externalReferences: [String] + objects: [String] + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +input NoteUserAddInput { + stix_id: String + x_opencti_stix_ids: [String] + attribute_abstract: String + + "*Constraints:*\n* Minimal length: `2`\n" + content: String! + note_types: [String] + likelihood: Int + revoked: Boolean + lang: String + confidence: Int + objectMarking: [String] + objectLabel: [String] + objectOrganization: [String] + externalReferences: [String] + objects: [String] + created: DateTime + modified: DateTime + clientMutationId: String + update: Boolean +} + +enum ObservedDatasOrdering { + first_observed + last_observed + number_observed + created + modified + created_at + updated_at + createdBy + x_opencti_workflow_id + objectMarking + confidence + _score +} + +type ObservedDataConnection { + pageInfo: PageInfo! + edges: [ObservedDataEdge] +} + +type ObservedDataEdge { + cursor: String! + node: ObservedData! +} + +type ObservedData implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Container { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + authorized_members: [MemberAccess!] + authorized_members_activation_date: DateTime + currentUserAccessRight: String + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + relatedContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], viaTypes: [String]): ContainerConnection + first_observed: DateTime! + last_observed: DateTime! + number_observed: Int! + name: String! + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + filesFromTemplate(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + fintelTemplates: [FintelTemplate!] + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +input ObservedDataAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + first_observed: DateTime! + last_observed: DateTime! + number_observed: Int! + revoked: Boolean + lang: String + confidence: Int + createdBy: String + objectMarking: [String] + objectLabel: [String] + objectOrganization: [String] + externalReferences: [String] + objects: [String]! + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum OpinionsOrdering { + opinion + created + modified + created_at + updated_at + createdBy + objectMarking + x_opencti_workflow_id + confidence + creator + _score +} + +type OpinionConnection { + pageInfo: PageInfo! + edges: [OpinionEdge] +} + +type OpinionEdge { + cursor: String! + node: Opinion! +} + +type Opinion implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Container { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + authorized_members: [MemberAccess!] + authorized_members_activation_date: DateTime + currentUserAccessRight: String + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + relatedContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], viaTypes: [String]): ContainerConnection + explanation: String + authors: [String] + opinion: String! + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + filesFromTemplate(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + fintelTemplates: [FintelTemplate!] + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +input OpinionAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n" + opinion: String! + explanation: String + authors: [String] + revoked: Boolean + lang: String + confidence: Int + createdBy: String + objectMarking: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + objects: [String] + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +input OpinionUserAddInput { + stix_id: String + x_opencti_stix_ids: [String] + opinion: String! + explanation: String + authors: [String] + revoked: Boolean + lang: String + confidence: Int + objectMarking: [String] + objectLabel: [String] + objectOrganization: [String] + externalReferences: [String] + objects: [String] + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + update: Boolean + clientMutationId: String +} + +enum ReportsOrdering { + name + created + modified + published + created_at + updated_at + createdBy + creator + objectMarking + report_types + x_opencti_workflow_id + _score +} + +type ReportConnection { + pageInfo: PageInfo! + edges: [ReportEdge] +} + +type ReportEdge { + cursor: String! + node: Report! +} + +type Report implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Container { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + avatar: OpenCtiFile + authorized_members: [MemberAccess!] + authorized_members_activation_date: DateTime + currentUserAccessRight: String + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + relatedContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], viaTypes: [String]): ContainerConnection + name: String! + description: String + content: String + content_mapping: String + report_types: [String] + x_opencti_reliability: String + published: DateTime + objectParticipant: [Participant!] + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + filesFromTemplate(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + fintelTemplates: [FintelTemplate!] + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + deleteWithElementsCount: Int + pirInformation(pirId: ID!): PirInformation + securityCoverage: SecurityCoverage +} + +input ReportAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + content: String + content_mapping: String + published: DateTime! + report_types: [String] + x_opencti_reliability: String + revoked: Boolean + lang: String + confidence: Int + createdBy: String + objectOrganization: [String] + objectMarking: [String] + objectAssignee: [String] + objectParticipant: [String] + objectLabel: [String] + externalReferences: [String] + objects: [String] + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload + authorized_members: [MemberAccessInput!] +} + +enum CoursesOfActionOrdering { + name + created + modified + created_at + updated_at + x_opencti_workflow_id + objectMarking + x_mitre_id + _score +} + +type CourseOfActionConnection { + pageInfo: PageInfo! + edges: [CourseOfActionEdge] +} + +type CourseOfActionEdge { + cursor: String! + node: CourseOfAction! +} + +type CourseOfAction implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + x_opencti_aliases: [String] + x_mitre_id: String + x_opencti_threat_hunting: String + x_opencti_log_sources: [String] + attackPatterns: AttackPatternConnection + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +input CourseOfActionAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + x_opencti_aliases: [String] + x_mitre_id: String + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum IdentitiesOrdering { + name + created + modified + created_at + updated_at + x_opencti_workflow_id + _score +} + +type IdentityConnection { + pageInfo: PageInfo! + edges: [IdentityEdge] +} + +type IdentityEdge { + cursor: String! + node: Identity! +} + +enum IdentityType { + Sector + Organization + Individual + System +} + +interface Identity { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + avatar: OpenCtiFile + identity_class: String! + name: String! + description: String + roles: [String] + contact_information: String + x_opencti_aliases: [String] + x_opencti_reliability: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input IdentityAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + type: IdentityType! + + "*Constraints:*\n* Minimal length: `1`\n* Must match format: `not-blank`\n" + name: String! + description: String + contact_information: String + roles: [String] + x_opencti_aliases: [String] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectLabel: [String] + externalReferences: [String] + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + clientMutationId: String + created: DateTime + modified: DateTime + update: Boolean +} + +enum IndividualsOrdering { + name + firstname + lastname + created + modified + x_opencti_workflow_id + objectMarking + _score +} + +type IndividualConnection { + pageInfo: PageInfo! + edges: [IndividualEdge] +} + +type IndividualEdge { + cursor: String! + node: Individual! +} + +type Individual implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Identity { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + identity_class: String! + name: String! + description: String + contact_information: String + roles: [String] + x_opencti_aliases: [String] + x_opencti_reliability: String + x_opencti_firstname: String + x_opencti_lastname: String + organizations: OrganizationConnection + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + isUser: Boolean + pirInformation(pirId: ID!): PirInformation +} + +input IndividualAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + contact_information: String + roles: [String] + x_opencti_aliases: [String] + x_opencti_firstname: String + x_opencti_lastname: String + x_opencti_reliability: String + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectOrganization: [String] + objectMarking: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum SectorsOrdering { + name + created + modified + created_at + updated_at + x_opencti_workflow_id + objectMarking + _score +} + +type SectorConnection { + pageInfo: PageInfo! + edges: [SectorEdge] +} + +type SectorEdge { + cursor: String! + types: [String] + node: Sector! +} + +type Sector implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Identity { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + identity_class: String! + name: String! + description: String + contact_information: String + roles: [String] + x_opencti_aliases: [String] + x_opencti_reliability: String + parentSectors: SectorConnection + subSectors: SectorConnection + isSubSector: Boolean + targetedOrganizations: StixCoreRelationshipConnection + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +input SectorAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + contact_information: String + roles: [String] + x_opencti_aliases: [String] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum SystemsOrdering { + name + confidence + firstname + lastname + created + modified + x_opencti_workflow_id + _score +} + +type SystemConnection { + pageInfo: PageInfo! + edges: [SystemEdge] +} + +type SystemEdge { + cursor: String! + node: System! +} + +type System implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Identity { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + identity_class: String! + name: String! + description: String + contact_information: String + roles: [String] + x_opencti_aliases: [String] + x_opencti_reliability: String + x_opencti_firstname: String + x_opencti_lastname: String + organizations: OrganizationConnection + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +input SystemAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + contact_information: String + roles: [String] + x_opencti_aliases: [String] + x_opencti_firstname: String + x_opencti_lastname: String + x_opencti_reliability: String + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectOrganization: [String] + objectMarking: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum InfrastructuresOrdering { + name + infrastructure_types + first_seen + last_seen + created + modified + created_at + updated_at + x_opencti_workflow_id + confidence + createdBy + objectMarking + creator + _score +} + +type InfrastructureConnection { + pageInfo: PageInfo! + edges: [InfrastructureEdge] +} + +type InfrastructureEdge { + cursor: String! + node: Infrastructure! +} + +type Infrastructure implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + aliases: [String] + description: String + infrastructure_types: [String] + first_seen: DateTime + last_seen: DateTime + killChainPhases: [KillChainPhase!] + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +input InfrastructureAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + aliases: [String] + infrastructure_types: [String] + first_seen: DateTime + last_seen: DateTime + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectOrganization: [String] + objectMarking: [String] + objectLabel: [String] + externalReferences: [String] + killChainPhases: [String] + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum IntrusionSetsOrdering { + name + created + modified + created_at + updated_at + x_opencti_workflow_id + resource_level + primary_motivation + confidence + _score + objectMarking +} + +type IntrusionSetConnection { + pageInfo: PageInfo! + edges: [IntrusionSetEdge] +} + +type IntrusionSetEdge { + cursor: String! + node: IntrusionSet! +} + +type IntrusionSet implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + aliases: [String] + first_seen: DateTime + last_seen: DateTime + goals: [String] + resource_level: String + primary_motivation: String + secondary_motivations: [String] + locations: LocationConnection + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation + securityCoverage: SecurityCoverage +} + +input IntrusionSetAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + aliases: [String] + first_seen: DateTime + last_seen: DateTime + goals: [String] + resource_level: String + primary_motivation: String + secondary_motivations: [String] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectAssignee: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + x_opencti_workflow_id: String + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + clientMutationId: String + update: Boolean + file: Upload +} + +enum LocationsOrdering { + name + latitude + longitude + created + modified + created_at + updated_at + x_opencti_workflow_id + _score +} + +type LocationConnection { + pageInfo: PageInfo! + edges: [LocationEdge] +} + +type LocationEdge { + cursor: String! + types: [String] + node: Location! +} + +interface Location { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + avatar: OpenCtiFile + name: String! + description: String + latitude: Float + longitude: Float + precision: Float + x_opencti_aliases: [String] + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input LocationAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + type: String! + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + latitude: Float + longitude: Float + precision: Float + x_opencti_aliases: [String] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectLabel: [String] + externalReferences: [String] + clientMutationId: String + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + update: Boolean +} + +enum PositionsOrdering { + name + postal_address + postal_code + created + modified + created_at + updated_at + x_opencti_workflow_id + _score +} + +type PositionConnection { + pageInfo: PageInfo! + edges: [PositionEdge] +} + +type PositionEdge { + cursor: String! + node: Position! +} + +type Position implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Location { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + latitude: Float + longitude: Float + precision: Float + x_opencti_aliases: [String] + street_address: String + postal_code: String + city: City + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +input PositionAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + latitude: Float + longitude: Float + precision: Float + street_address: String + postal_code: String + confidence: Int + revoked: Boolean + lang: String + x_opencti_aliases: [String] + createdBy: String + objectMarking: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum CitiesOrdering { + name + aliases + created + modified + created_at + updated_at + objectMarking + objectLabel + x_opencti_workflow_id + _score +} + +type CityConnection { + pageInfo: PageInfo! + edges: [CityEdge] +} + +type CityEdge { + cursor: String! + node: City! +} + +type City implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Location { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + latitude: Float + longitude: Float + precision: Float + x_opencti_aliases: [String] + country: Country + administrativeArea: AdministrativeArea + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +input CityAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + latitude: Float + longitude: Float + precision: Float + confidence: Int + revoked: Boolean + lang: String + x_opencti_aliases: [String] + createdBy: String + objectOrganization: [String] + objectMarking: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum CountriesOrdering { + name + created + modified + created_at + updated_at + x_opencti_workflow_id + _score +} + +type CountryConnection { + pageInfo: PageInfo! + edges: [CountryEdge!]! +} + +type CountryEdge { + cursor: String! + node: Country! +} + +type Country implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Location { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + latitude: Float + longitude: Float + precision: Float + x_opencti_aliases: [String] + region: Region + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +input CountryAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + latitude: Float + longitude: Float + precision: Float + confidence: Int + revoked: Boolean + lang: String + x_opencti_aliases: [String] + createdBy: String + objectMarking: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum RegionsOrdering { + name + created + modified + created_at + updated_at + x_opencti_workflow_id + _score +} + +type RegionConnection { + pageInfo: PageInfo! + edges: [RegionEdge] +} + +type RegionEdge { + cursor: String! + node: Region! +} + +type Region implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Location { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + latitude: Float + longitude: Float + precision: Float + x_opencti_aliases: [String] + parentRegions: RegionConnection + subRegions: RegionConnection + countries: CountryConnection + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +input RegionAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + latitude: Float + longitude: Float + precision: Float + confidence: Int + revoked: Boolean + lang: String + x_opencti_aliases: [String] + createdBy: String + objectMarking: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum MalwaresOrdering { + name + malware_types + first_seen + last_seen + created + modified + created_at + updated_at + objectMarking + objectLabel + x_opencti_workflow_id + is_family + confidence + _score +} + +type MalwareConnection { + pageInfo: PageInfo! + edges: [MalwareEdge] +} + +type MalwareEdge { + cursor: String! + node: Malware! +} + +enum Version { + stix_2_0 + stix_2_1 +} + +type Malware implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + aliases: [String] + malware_types: [String] + is_family: Boolean + first_seen: DateTime + last_seen: DateTime + architecture_execution_envs: [String] + implementation_languages: [String] + capabilities: [String] + killChainPhases: [KillChainPhase!] + samples: [StixCyberObservable!] + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +input MalwareAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + malware_types: [String] + aliases: [String] + is_family: Boolean + first_seen: DateTime + last_seen: DateTime + architecture_execution_envs: [String] + implementation_languages: [String] + capabilities: [String] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectAssignee: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + killChainPhases: [String] + samples: [String] + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum ThreatActorsOrdering { + name + created + modified + created_at + updated_at + x_opencti_workflow_id + confidence + sophistication + resource_level + _score + threat_actor_types + objectMarking +} + +type ThreatActorGroupConnection { + pageInfo: PageInfo! + edges: [ThreatActorGroupEdge] +} + +type ThreatActorGroupEdge { + cursor: String! + node: ThreatActorGroup! +} + +interface ThreatActor implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + aliases: [String] + threat_actor_types: [String] + first_seen: DateTime + last_seen: DateTime + roles: [String] + goals: [String] + sophistication: String + resource_level: String + primary_motivation: String + secondary_motivations: [String] + personal_motivations: [String] + locations: LocationConnection + countries: CountryConnection + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +type ThreatActorEdge { + cursor: String! + node: ThreatActor! +} + +type ThreatActorConnection { + pageInfo: PageInfo! + edges: [ThreatActorEdge] +} + +type ThreatActorGroup implements BasicObject & StixObject & StixCoreObject & StixDomainObject & ThreatActor { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + aliases: [String] + threat_actor_types: [String] + first_seen: DateTime + last_seen: DateTime + roles: [String] + goals: [String] + sophistication: String + resource_level: String + primary_motivation: String + secondary_motivations: [String] + personal_motivations: [String] + locations: LocationConnection + countries: CountryConnection + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +input ThreatActorGroupAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + aliases: [String] + threat_actor_types: [String] + first_seen: DateTime + last_seen: DateTime + roles: [String] + goals: [String] + sophistication: String + resource_level: String + primary_motivation: String + secondary_motivations: [String] + personal_motivations: [String] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectOrganization: [String] + objectAssignee: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum ToolsOrdering { + name + created + modified + created_at + updated_at + x_opencti_workflow_id + confidence + _score +} + +type ToolConnection { + pageInfo: PageInfo! + edges: [ToolEdge] +} + +type ToolEdge { + cursor: String! + node: Tool! +} + +type Tool implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + aliases: [String] + tool_types: [String] + tool_version: String + killChainPhases: [KillChainPhase!] + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +input ToolAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + aliases: [String] + tool_types: [String] + tool_version: String + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + killChainPhases: [String] + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum VulnerabilitiesOrdering { + name + x_opencti_cvss_base_score + x_opencti_cvss_base_severity + x_opencti_cvss_attack_vector + created + modified + created_at + updated_at + x_opencti_workflow_id + creator + confidence + _score +} + +type VulnerabilityConnection { + pageInfo: PageInfo! + edges: [VulnerabilityEdge] +} + +type VulnerabilityEdge { + cursor: String! + node: Vulnerability! +} + +type Vulnerability implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + x_opencti_aliases: [String] + x_opencti_cvss_vector_string: String + x_opencti_cvss_base_score: Float + x_opencti_cvss_base_severity: String + x_opencti_cvss_attack_vector: String + x_opencti_cvss_attack_complexity: String + x_opencti_cvss_privileges_required: String + x_opencti_cvss_user_interaction: String + x_opencti_cvss_scope: String + x_opencti_cvss_confidentiality_impact: String + x_opencti_cvss_integrity_impact: String + x_opencti_cvss_availability_impact: String + x_opencti_cvss_exploit_code_maturity: String + x_opencti_cvss_remediation_level: String + x_opencti_cvss_report_confidence: String + x_opencti_cvss_temporal_score: Float + x_opencti_cvss_v2_vector_string: String + x_opencti_cvss_v2_base_score: Float + x_opencti_cvss_v2_access_vector: String + x_opencti_cvss_v2_access_complexity: String + x_opencti_cvss_v2_authentication: String + x_opencti_cvss_v2_confidentiality_impact: String + x_opencti_cvss_v2_integrity_impact: String + x_opencti_cvss_v2_availability_impact: String + x_opencti_cvss_v2_exploitability: String + x_opencti_cvss_v2_remediation_level: String + x_opencti_cvss_v2_report_confidence: String + x_opencti_cvss_v2_temporal_score: Float + x_opencti_cvss_v4_vector_string: String + x_opencti_cvss_v4_base_score: Float + x_opencti_cvss_v4_base_severity: String + x_opencti_cvss_v4_attack_vector: String + x_opencti_cvss_v4_attack_complexity: String + x_opencti_cvss_v4_attack_requirements: String + x_opencti_cvss_v4_privileges_required: String + x_opencti_cvss_v4_user_interaction: String + x_opencti_cvss_v4_confidentiality_impact_v: String + x_opencti_cvss_v4_confidentiality_impact_s: String + x_opencti_cvss_v4_integrity_impact_v: String + x_opencti_cvss_v4_integrity_impact_s: String + x_opencti_cvss_v4_availability_impact_v: String + x_opencti_cvss_v4_availability_impact_s: String + x_opencti_cvss_v4_exploit_maturity: String + x_opencti_cwe: [String] + x_opencti_cisa_kev: Boolean + x_opencti_epss_score: Float + x_opencti_epss_percentile: Float + x_opencti_score: Int + x_opencti_first_seen_active: DateTime + softwares(relationshipType: String, first: Int, after: ID, orderBy: StixCyberObservablesOrdering, orderMode: OrderingMode): StixCyberObservableConnection + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +input VulnerabilityAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + x_opencti_aliases: [String] + x_opencti_cvss_vector_string: String + x_opencti_cvss_base_score: Float + x_opencti_cvss_base_severity: String + x_opencti_cvss_attack_vector: String + x_opencti_cvss_attack_complexity: String + x_opencti_cvss_privileges_required: String + x_opencti_cvss_user_interaction: String + x_opencti_cvss_scope: String + x_opencti_cvss_confidentiality_impact: String + x_opencti_cvss_integrity_impact: String + x_opencti_cvss_availability_impact: String + x_opencti_cvss_exploit_code_maturity: String + x_opencti_cvss_remediation_level: String + x_opencti_cvss_report_confidence: String + x_opencti_cvss_temporal_score: Float + x_opencti_cvss_v2_vector_string: String + x_opencti_cvss_v2_base_score: Float + x_opencti_cvss_v2_access_vector: String + x_opencti_cvss_v2_access_complexity: String + x_opencti_cvss_v2_authentication: String + x_opencti_cvss_v2_confidentiality_impact: String + x_opencti_cvss_v2_integrity_impact: String + x_opencti_cvss_v2_availability_impact: String + x_opencti_cvss_v2_exploitability: String + x_opencti_cvss_v2_remediation_level: String + x_opencti_cvss_v2_report_confidence: String + x_opencti_cvss_v2_temporal_score: Float + x_opencti_cvss_v4_vector_string: String + x_opencti_cvss_v4_base_score: Float + x_opencti_cvss_v4_base_severity: String + x_opencti_cvss_v4_attack_vector: String + x_opencti_cvss_v4_attack_complexity: String + x_opencti_cvss_v4_attack_requirements: String + x_opencti_cvss_v4_privileges_required: String + x_opencti_cvss_v4_user_interaction: String + x_opencti_cvss_v4_confidentiality_impact_v: String + x_opencti_cvss_v4_confidentiality_impact_s: String + x_opencti_cvss_v4_integrity_impact_v: String + x_opencti_cvss_v4_integrity_impact_s: String + x_opencti_cvss_v4_availability_impact_v: String + x_opencti_cvss_v4_availability_impact_s: String + x_opencti_cvss_v4_exploit_maturity: String + x_opencti_cwe: [String] + x_opencti_cisa_kev: Boolean + x_opencti_epss_score: Float + x_opencti_epss_percentile: Float + x_opencti_score: Int + x_opencti_first_seen_active: DateTime + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum IncidentsOrdering { + name + first_seen + last_seen + incident_type + severity + source + created + modified + created_at + updated_at + x_opencti_workflow_id + objectMarking + confidence + objectAssignee + creator + _score +} + +type IncidentConnection { + pageInfo: PageInfo! + edges: [IncidentEdge] +} + +type IncidentEdge { + cursor: String! + node: Incident! +} + +type Incident implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + avatar: OpenCtiFile + name: String! + description: String + aliases: [String] + first_seen: DateTime + last_seen: DateTime + objective: String + incident_type: String + severity: String + source: String + objectParticipant: [Participant!] + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation + securityCoverage: SecurityCoverage +} + +input IncidentAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + confidence: Int + revoked: Boolean + lang: String + objective: String + first_seen: DateTime + last_seen: DateTime + aliases: [String] + incident_type: String + severity: String + source: String + createdBy: String + objectOrganization: [String] + objectMarking: [String] + objectAssignee: [String] + objectParticipant: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum StixCyberObservablesOrdering { + entity_type + created_at + updated_at + observable_value + objectMarking + createdBy + creator + _score +} + +type StixCyberObservableConnection { + pageInfo: PageInfo! + edges: [StixCyberObservableEdge!]! +} + +type StixCyberObservableEdge { + cursor: String! + node: StixCyberObservable! +} + +interface StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +type AutonomousSystem implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + number: Int + name: String + rir: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input AutonomousSystemAddInput { + number: Int! + name: String + rir: String + file: Upload +} + +type Directory implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + path: String! + path_enc: String + ctime: DateTime + mtime: DateTime + atime: DateTime + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input DirectoryAddInput { + path: String! + path_enc: String + ctime: DateTime + mtime: DateTime + atime: DateTime + file: Upload +} + +type DomainName implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + observable_value: String! + x_opencti_score: Int + x_opencti_description: String + indicators(first: Int): IndicatorConnection + value: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input DomainNameAddInput { + value: String! + file: Upload +} + +type EmailAddr implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + display_name: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input EmailAddrAddInput { + value: String + display_name: String + file: Upload +} + +type EmailMessage implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + is_multipart: Boolean + attribute_date: DateTime + content_type: String + message_id: String + subject: String + received_lines: [String] + body: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input EmailMessageAddInput { + is_multipart: Boolean + attribute_date: DateTime + content_type: String + message_id: String + subject: String + received_lines: [String] + body: String + file: Upload +} + +type EmailMimePartType implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + body: String + content_type: String + content_disposition: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input EmailMimePartTypeAddInput { + body: String + content_type: String + content_disposition: String + file: Upload +} + +input HashInput { + "*Constraints:*\n* Minimal length: `3`\n" + algorithm: String! + + "*Constraints:*\n* Minimal length: `5`\n" + hash: String! +} + +type Hash { + algorithm: String! + hash: String +} + +type StixFileEdge { + cursor: String! + node: StixFile! +} + +type StixFileConnection { + pageInfo: PageInfo! + edges: [StixFileEdge] +} + +interface HashedObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + hashes: [Hash] + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +type Artifact implements BasicObject & StixObject & StixCoreObject & StixCyberObservable & HashedObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + hashes: [Hash] + mime_type: String + payload_bin: String + url: String + encryption_algorithm: String + decryption_key: String + x_opencti_additional_names: [String] + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input ArtifactAddInput { + hashes: [HashInput] + mime_type: String + payload_bin: String + url: String + encryption_algorithm: String + decryption_key: String + x_opencti_additional_names: [String] + file: Upload +} + +type StixFile implements BasicObject & StixObject & StixCoreObject & StixCyberObservable & HashedObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + hashes: [Hash] + extensions: String + size: Int + name: String + name_enc: String + magic_number_hex: String + mime_type: String + ctime: DateTime + mtime: DateTime + atime: DateTime + x_opencti_additional_names: [String] + obsContent: Artifact + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input StixFileAddInput { + hashes: [HashInput] + size: Int + name: String + name_enc: String + magic_number_hex: String + mime_type: String + ctime: DateTime + mtime: DateTime + atime: DateTime + x_opencti_additional_names: [String] + obsContent: ID + file: Upload +} + +type X509Certificate implements BasicObject & StixObject & StixCoreObject & StixCyberObservable & HashedObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + hashes: [Hash] + is_self_signed: Boolean + version: String + serial_number: String + signature_algorithm: String + issuer: String + subject: String + subject_public_key_algorithm: String + subject_public_key_modulus: String + subject_public_key_exponent: Int + validity_not_before: DateTime + validity_not_after: DateTime + basic_constraints: String + name_constraints: String + policy_constraints: String + key_usage: String + extended_key_usage: String + subject_key_identifier: String + authority_key_identifier: String + subject_alternative_name: String + issuer_alternative_name: String + subject_directory_attributes: String + crl_distribution_points: String + inhibit_any_policy: String + private_key_usage_period_not_before: DateTime + private_key_usage_period_not_after: DateTime + certificate_policies: String + policy_mappings: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input X509CertificateAddInput { + hashes: [HashInput] + is_self_signed: Boolean + version: String + serial_number: String + signature_algorithm: String + issuer: String + subject: String + subject_public_key_algorithm: String + subject_public_key_modulus: String + subject_public_key_exponent: Int + validity_not_before: DateTime + validity_not_after: DateTime + basic_constraints: String + name_constraints: String + policy_constraints: String + key_usage: String + extended_key_usage: String + subject_key_identifier: String + authority_key_identifier: String + subject_alternative_name: String + issuer_alternative_name: String + subject_directory_attributes: String + crl_distribution_points: String + inhibit_any_policy: String + private_key_usage_period_not_before: DateTime + private_key_usage_period_not_after: DateTime + certificate_policies: String + policy_mappings: String + file: Upload +} + +type IPv4Addr implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + countries: CountryConnection + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input IPv4AddrAddInput { + value: String + belongsTo: [String] + resolvesTo: [String] + file: Upload +} + +type IPv6Addr implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + countries: CountryConnection + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input IPv6AddrAddInput { + value: String + file: Upload +} + +type MacAddr implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input MacAddrAddInput { + value: String + file: Upload +} + +type Mutex implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + name: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input MutexAddInput { + name: String + file: Upload +} + +type NetworkTraffic implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + extensions: String + start: DateTime + end: DateTime + is_active: Boolean + src_port: Int + dst_port: Int + src_ref: Int + dst_ref: Int + protocols: [String] + src_byte_count: Int + dst_byte_count: Int + src_packets: Int + dst_packets: Int + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input NetworkTrafficAddInput { + start: DateTime + end: DateTime + is_active: Boolean + networkSrc: String + networkDst: String + src_port: Int + dst_port: Int + protocols: [String] + src_byte_count: Int + dst_byte_count: Int + src_packets: Int + dst_packets: Int + file: Upload +} + +type Process implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + extensions: String + is_hidden: Boolean + pid: Int + created_time: DateTime + cwd: String + command_line: String + environment_variables: [String] + aslr_enabled: Boolean + dep_enabled: Boolean + priority: String + owner_sid: String + window_title: String + startup_info: [Dictionary] + integrity_level: String + service_name: String + descriptions: [String] + display_name: String + group_name: String + start_type: String + serviceDlls: StixFileConnection + service_type: String + service_status: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input ProcessAddInput { + is_hidden: Boolean + pid: Int + created_time: DateTime + cwd: String + x_opencti_description: String + command_line: String! + environment_variables: [String] + aslr_enabled: Boolean + dep_enabled: Boolean + priority: String + owner_sid: String + window_title: String + startup_info: [DictionaryInput] + integrity_level: String + service_name: String + descriptions: [String] + display_name: String + group_name: String + start_type: String + serviceDlls: [String] + service_type: String + service_status: String + file: Upload +} + +type Software implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + name: String + cpe: String + swid: String + languages: [String] + vendor: String + version: String + x_opencti_product: String + vulnerabilities: VulnerabilityConnection + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +type SoftwareConnection { + pageInfo: PageInfo! + edges: [SoftwareEdge!]! +} + +type SoftwareEdge { + cursor: String! + node: Software! +} + +input SoftwareAddInput { + name: String + cpe: String + swid: String + languages: [String] + vendor: String + version: String + x_opencti_product: String + file: Upload +} + +type Url implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input UrlAddInput { + value: String + file: Upload +} + +type UserAccount implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + extensions: String + user_id: String + credential: String + account_login: String + account_type: String + display_name: String + is_service_account: Boolean + is_privileged: Boolean + can_escalate_privs: Boolean + is_disabled: Boolean + account_created: DateTime + account_expires: DateTime + credential_last_changed: DateTime + account_first_login: DateTime + account_last_login: DateTime + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input UserAccountAddInput { + user_id: String + credential: String + account_login: String + account_type: String + display_name: String + is_service_account: Boolean + is_privileged: Boolean + can_escalate_privs: Boolean + is_disabled: Boolean + account_created: DateTime + account_expires: DateTime + credential_last_changed: DateTime + account_first_login: DateTime + account_last_login: DateTime + file: Upload +} + +type WindowsRegistryKey implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + attribute_key: String + modified_time: DateTime + number_of_subkeys: Int + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input WindowsRegistryKeyAddInput { + attribute_key: String + modified_time: DateTime + file: Upload + number_of_subkeys: Int +} + +type WindowsRegistryValueType implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + name: String + data: String + data_type: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input WindowsRegistryValueTypeAddInput { + name: String + data: String + data_type: String + file: Upload +} + +type CryptographicKey implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input CryptographicKeyAddInput { + value: String + file: Upload +} + +type CryptocurrencyWallet implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input CryptocurrencyWalletAddInput { + value: String + file: Upload +} + +type Hostname implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input HostnameAddInput { + value: String + file: Upload +} + +type Text implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input TextAddInput { + value: String + file: Upload +} + +type UserAgent implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input UserAgentAddInput { + value: String + file: Upload +} + +type BankAccount implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, fromOrToId: [String], elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + iban: String + bic: String + account_number: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input BankAccountAddInput { + iban: String + bic: String + account_number: String + file: Upload +} + +type TrackingNumber implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!], elementId: [String]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup, filterMode: FilterMode): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, filterMode: FilterMode, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup, filterMode: FilterMode): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input TrackingNumberAddInput { + value: String + file: Upload +} + +type Credential implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!], elementId: [String]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup, filterMode: FilterMode): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, filterMode: FilterMode, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup, filterMode: FilterMode): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input CredentialAddInput { + value: String + file: Upload +} + +type PhoneNumber implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input PhoneNumberAddInput { + value: String + file: Upload +} + +type PaymentCard implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + card_number: String + expiration_date: DateTime + cvv: Int + holder_name: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input PaymentCardAddInput { + card_number: String! + expiration_date: DateTime + cvv: Int + holder_name: String + file: Upload +} + +type MediaContent implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectLabel: [Label!] + objectOrganization: [Organization!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + title: String + description: String + content: String + media_category: String + url: String + publication_date: DateTime + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input MediaContentAddInput { + title: String + content: String + media_category: String + url: String! + publication_date: DateTime + file: Upload +} + +type Persona implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectLabel: [Label!] + objectOrganization: [Organization!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + persona_name: String! + persona_type: String! + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input PersonaAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + persona_name: String! + persona_type: String! +} + +type SSHKey implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectLabel: [Label!] + objectOrganization: [Organization!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + key_type: String + public_key: String + fingerprint_sha256: String! + fingerprint_md5: String + key_length: String + expiration_date: DateTime + comment: String + created: DateTime + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input SSHKeyAddInput { + key_type: String + public_key: String + + "*Constraints:*\n* Minimal length: `5`\n" + fingerprint_sha256: String! + + "*Constraints:*\n* Minimal length: `5`\n" + fingerprint_md5: String + key_length: String + comment: String + created: DateTime + expiration_date: DateTime +} + +interface BasicRelationship { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + fromRole: String + toRole: String + created_at: DateTime! + updated_at: DateTime! + refreshed_at: DateTime + creators: [Creator!] +} + +type InternalRelationship implements BasicRelationship { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + fromRole: String + toRole: String + created_at: DateTime! + updated_at: DateTime! + refreshed_at: DateTime + from: InternalObject + to: InternalObject + creators: [Creator!] +} + +input InternalRelationshipAddInput { + relationship_type: String! + fromId: ID + toId: ID +} + +enum StixObjectOrStixRelationshipsOrdering { + name + entity_type + created_at + updated_at + createdBy + objectMarking + objectLabel + observable_value + start_time + created + modified + relationship_type + creator + _score +} + +type StixObjectOrStixRelationshipConnection { + pageInfo: PageInfo! + edges: [StixObjectOrStixRelationshipEdge] +} + +type StixObjectOrStixRelationshipRefConnection { + pageInfo: PageInfo! + edges: [StixObjectOrStixRelationshipRefEdge] +} + +type StixObjectOrStixRelationshipEdge { + cursor: String! + node: StixObjectOrStixRelationship! +} + +type StixObjectOrStixRelationshipRefEdge { + cursor: String! + types: [String]! + node: StixObjectOrStixRelationship! +} + +union StixObjectOrStixRelationshipOrCreator = MarkingDefinition | Label | KillChainPhase | ExternalReference | AttackPattern | Campaign | Channel | Event | Narrative | Note | ObservedData | Opinion | Report | Grouping | CourseOfAction | Individual | Organization | SecurityPlatform | SecurityCoverage | Sector | System | Indicator | Infrastructure | IntrusionSet | Language | City | AdministrativeArea | Country | Region | Position | Malware | MalwareAnalysis | ThreatActorGroup | ThreatActorIndividual | Tool | Vulnerability | Incident | AutonomousSystem | Directory | DomainName | EmailAddr | EmailMessage | EmailMimePartType | Artifact | StixFile | X509Certificate | SSHKey | IPv4Addr | IPv6Addr | MacAddr | Mutex | NetworkTraffic | Process | Software | Url | UserAccount | WindowsRegistryKey | WindowsRegistryValueType | CryptographicKey | CryptocurrencyWallet | Hostname | Text | UserAgent | BankAccount | Credential | TrackingNumber | PhoneNumber | PaymentCard | MediaContent | Persona | StixCoreRelationship | StixSightingRelationship | StixRefRelationship | Task | DataComponent | DataSource | CaseIncident | CaseRfi | CaseRft | Feedback | CaseTemplate | EntitySetting | ManagerConfiguration | Creator | Group | Workspace | CsvMapper | Status | PublicDashboard | Pir | Theme + +union StixObjectOrStixRelationship = MarkingDefinition | Label | KillChainPhase | ExternalReference | AttackPattern | Campaign | Channel | Event | Narrative | Note | ObservedData | Opinion | Report | Grouping | CourseOfAction | Individual | Organization | SecurityPlatform | Sector | System | Indicator | Infrastructure | IntrusionSet | Language | City | AdministrativeArea | Country | Region | Position | Malware | MalwareAnalysis | ThreatActorGroup | ThreatActorIndividual | Tool | Vulnerability | Incident | AutonomousSystem | Directory | DomainName | EmailAddr | EmailMessage | EmailMimePartType | Artifact | StixFile | X509Certificate | SSHKey | IPv4Addr | IPv6Addr | MacAddr | Mutex | NetworkTraffic | Process | Software | Url | UserAccount | WindowsRegistryKey | WindowsRegistryValueType | CryptographicKey | CryptocurrencyWallet | Hostname | Text | UserAgent | BankAccount | Credential | TrackingNumber | PhoneNumber | PaymentCard | MediaContent | Persona | StixCoreRelationship | StixSightingRelationship | StixRefRelationship | DataComponent | DataSource | CaseIncident | CaseRfi | CaseRft | Feedback | CaseTemplate | Task | EntitySetting | ManagerConfiguration | Workspace | CsvMapper | PublicDashboard | Pir | SecurityCoverage + +union StixCoreObjectOrStixCoreRelationship = AttackPattern | Campaign | Channel | Event | Note | ObservedData | Opinion | Report | Grouping | CourseOfAction | Individual | Organization | SecurityPlatform | Sector | Indicator | Infrastructure | IntrusionSet | Language | City | AdministrativeArea | Country | Region | Position | Malware | MalwareAnalysis | Narrative | ThreatActorGroup | ThreatActorIndividual | Tool | Vulnerability | Incident | AutonomousSystem | Directory | DomainName | EmailAddr | EmailMessage | EmailMimePartType | Artifact | StixFile | X509Certificate | SSHKey | IPv4Addr | IPv6Addr | MacAddr | Mutex | NetworkTraffic | Process | Software | Url | UserAccount | WindowsRegistryKey | WindowsRegistryValueType | CryptographicKey | CryptocurrencyWallet | Hostname | Text | UserAgent | BankAccount | Credential | TrackingNumber | PhoneNumber | PaymentCard | MediaContent | Persona | StixCoreRelationship | DataComponent | DataSource | CaseIncident | CaseRfi | CaseRft | Feedback | CaseTemplate | Task | EntitySetting | ManagerConfiguration | Workspace | PublicDashboard | Theme + +enum StixRelationshipsOrdering { + entity_type + relationship_type + confidence + start_time + stop_time + created + modified + created_at + updated_at + objectMarking + objectLabel + killChainPhase + toName + toValidFrom + toValidUntil + toObservableValue + toPatternType + x_opencti_workflow_id + createdBy + creator + _score +} + +type StixRelationshipConnection { + pageInfo: PageInfo! + edges: [StixRelationshipEdge!]! +} + +type StixRelationshipEdge { + cursor: String! + node: StixRelationship! +} + +interface StixRelationship { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + fromRole: String + toRole: String + created_at: DateTime! + updated_at: DateTime! + refreshed_at: DateTime + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + from: StixObjectOrStixRelationshipOrCreator + to: StixObjectOrStixRelationshipOrCreator + x_opencti_inferences: [Inference] + spec_version: String! + created: DateTime + modified: DateTime + confidence: Int + relationship_type: String! + createdBy: Identity + objectMarking: [MarkingDefinition!] + toStix(version: Version): String + draftVersion: DraftVersion + creators: [Creator!] +} + +type StixRelationshipSchema { + key: String! + values: [String!]! +} + +type StixRelationshipRefSchemaValue { + name: String! + toTypes: [String!]! +} + +type StixRelationshipRefSchema { + key: String! + values: [StixRelationshipRefSchemaValue!]! +} + +enum StixCoreRelationshipsOrdering { + entity_type + relationship_type + confidence + start_time + stop_time + created + modified + created_at + updated_at + objectMarking + objectLabel + killChainPhase + toName + toValidFrom + toValidUntil + toObservableValue + toPatternType + x_opencti_workflow_id + createdBy + creator + _score +} + +type StixCoreRelationshipConnection { + pageInfo: PageInfo! + edges: [StixCoreRelationshipEdge!]! +} + +type StixCoreRelationshipEdge { + cursor: String! + node: StixCoreRelationship! +} + +type StixCoreRelationship implements BasicRelationship & StixRelationship { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + fromRole: String + toRole: String + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + from: StixObjectOrStixRelationshipOrCreator + fromId: String! + fromType: String! + to: StixObjectOrStixRelationshipOrCreator + toId: String! + toType: String! + x_opencti_inferences: [Inference] + spec_version: String! + created: DateTime + modified: DateTime + confidence: Int + relationship_type: String! + createdBy: Identity + objectMarking: [MarkingDefinition!] + draftVersion: DraftVersion + description: String + start_time: DateTime + stop_time: DateTime + revoked: Boolean! + lang: String + objectLabel: [Label!] + objectOrganization: [Organization!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + killChainPhases: [KillChainPhase!] + coverage_information: [CoverageResult!] + creators: [Creator!] + toStix(version: Version): String + editContext: [EditUserContext!] + status: Status + workflowEnabled: Boolean +} + +input SecurityCoverageExpectation { + coverage_name: String! + coverage_score: Int! +} + +input StixCoreRelationshipAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + fromId: StixRef! + toId: StixRef! + created: DateTime + modified: DateTime + confidence: Int + relationship_type: String! + createdBy: String + objectMarking: [String] + description: String + start_time: DateTime + stop_time: DateTime + revoked: Boolean + lang: String + objectLabel: [String] + objectOrganization: [String] + externalReferences: [String] + killChainPhases: [String] + x_opencti_workflow_id: String + x_opencti_modified_at: DateTime + coverage_information: [SecurityCoverageExpectation!] + clientMutationId: String + update: Boolean +} + +enum StixSightingRelationshipsOrdering { + confidence + x_opencti_negative + first_seen + last_seen + created + modified + created_at + updated_at + objectMarking + objectLabel + toName + toValidFrom + toValidUntil + toPatternType + toCreatedAt + attribute_count + x_opencti_workflow_id + _score +} + +type StixSightingRelationshipConnection { + pageInfo: PageInfo! + edges: [StixSightingRelationshipsEdge] +} + +type StixSightingRelationshipsEdge { + cursor: String! + node: StixSightingRelationship! +} + +type StixSightingRelationship implements BasicRelationship & StixRelationship { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + fromRole: String + toRole: String + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + from: StixObjectOrStixRelationshipOrCreator + fromId: String! + fromType: String! + to: StixObjectOrStixRelationshipOrCreator + toId: String! + toType: String! + x_opencti_inferences: [Inference] + spec_version: String! + created: DateTime + modified: DateTime + confidence: Int + relationship_type: String! + createdBy: Identity + objectMarking: [MarkingDefinition!] + draftVersion: DraftVersion + description: String + first_seen: DateTime + last_seen: DateTime + attribute_count: Int! + x_opencti_negative: Boolean! + objectLabel: [Label!] + objectOrganization: [Organization!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + creators: [Creator!] + toStix(version: Version): String + editContext: [EditUserContext!] + status: Status + workflowEnabled: Boolean +} + +input StixSightingRelationshipAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + fromId: StixRef! + toId: StixRef! + created: DateTime + modified: DateTime + confidence: Int + createdBy: String + objectMarking: [String] + description: String + first_seen: DateTime + last_seen: DateTime + attribute_count: Int! + x_opencti_negative: Boolean + objectLabel: [String] + objectOrganization: [String] + externalReferences: [String] + clientMutationId: String + update: Boolean + x_opencti_workflow_id: String + x_opencti_modified_at: DateTime +} + +enum StixRefRelationshipsOrdering { + relationship_type + entity_type + confidence + start_time + stop_time + created + modified + created_at + updated_at + toName + toValidFrom + toValidUntil + toPatternType + toCreatedAt + _score + pir_score +} + +type StixRefRelationshipConnection { + pageInfo: PageInfo! + edges: [StixRefRelationshipEdge!]! +} + +type StixRefRelationshipEdge { + cursor: String! + node: StixRefRelationship! +} + +type StixRefRelationship implements BasicRelationship & StixRelationship { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + fromRole: String + toRole: String + created_at: DateTime! + updated_at: DateTime! + refreshed_at: DateTime + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + from: StixObjectOrStixRelationshipOrCreator + to: StixObjectOrStixRelationshipOrCreator + x_opencti_inferences: [Inference] + spec_version: String! + created: DateTime + modified: DateTime + confidence: Int + relationship_type: String! + createdBy: Identity + objectMarking: [MarkingDefinition!] + draftVersion: DraftVersion + start_time: DateTime + stop_time: DateTime + datable: Boolean + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + notes(first: Int): NoteConnection + reports(first: Int): ReportConnection + opinions(first: Int): OpinionConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + toStix(version: Version): String + creators: [Creator!] + editContext: [EditUserContext!] +} + +type DefinitionRefRelationship { + entity: StixObjectOrStixRelationshipOrCreator! + from: [String!] + to: [String!] +} + +input StixRefRelationshipAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + fromId: StixRef + toId: StixRef + relationship_type: String! + confidence: Int + createdBy: String + start_time: DateTime + stop_time: DateTime + objectMarking: [String] + objectLabel: [String] + created: DateTime + modified: DateTime + clientMutationId: String + update: Boolean + file: Upload +} + +input StixRefRelationshipsAddInput { + relationship_type: String! + fromIds: [StixRef] + toIds: [StixRef!]! +} + +type Query { + stix(id: String!): String + enrichmentConnectors(type: String!): [Connector] + about: AppInfo + logsWorkerConfig: LogsWorkerConfig + rabbitMQMetrics(prefix: String): RabbitMQMetrics + elasticSearchMetrics: ElasticSearchMetrics + logs(first: Int, after: ID, orderBy: LogsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): LogConnection + audits(first: Int, after: ID, types: [String!], orderBy: LogsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): LogConnection + auditsNumber(dateAttribute: String, types: [String], startDate: DateTime, endDate: DateTime, onlyInferred: Boolean, filters: FilterGroup, search: String): Number + auditsTimeSeries(field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime, interval: String!, types: [String], filters: FilterGroup, search: String): [TimeSeries] + auditsDistribution(field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + auditsMultiTimeSeries(operation: StatsOperation!, startDate: DateTime!, endDate: DateTime, interval: String!, onlyInferred: Boolean, timeSeriesParameters: [AuditsTimeSeriesParameters]): [MultiTimeSeries] + subType(id: String!): SubType + subTypes(first: Int, after: ID, orderBy: SubTypesOrdering, orderMode: OrderingMode, type: String, includeParents: Boolean, search: String): SubTypeConnection! + file(id: String!): File + importFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + filesMetrics: FilesMetrics + guessMimeType(fileId: String!): String + askAiActivity(busId: String, language: String, forceRefresh: Boolean): AiActivity + indexedFiles(first: Int, after: ID, search: String): IndexedFileConnection + indexedFilesCount(search: String): Int + indexedFilesMetrics: FilesMetrics + publicSettings: PublicSettings! + settings: Settings! + group(id: String!): Group + groups(first: Int, after: ID, orderBy: GroupsOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): GroupConnection + roles(first: Int, after: ID, orderBy: RolesOrdering, orderMode: OrderingMode, search: String): RoleConnection + me: MeUser! + otpGeneration: OtpElement + user(id: String!): User + creators(entityTypes: [String!]): CreatorConnection + assignees(entityTypes: [String!]): AssigneeConnection + participants(entityTypes: [String!]): ParticipantConnection + members(first: Int, search: String, filters: FilterGroup, filterMode: FilterMode, entityTypes: [MemberType!]): MemberConnection + systemMembers: MemberConnection + users(first: Int, after: ID, orderBy: UsersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): UserConnection + sessions: [UserSession] + role(id: String!): Role + capabilities(first: Int): CapabilityConnection + capabilitiesInDraft(first: Int): CapabilityConnection + connector(id: String!): Connector + connectors: [Connector!]! + connectorManager(managerId: ID!): ConnectorManager! + connectorManagers: [ConnectorManager!]! + connectorsForManagers: [ManagedConnector!] + connectorsForWorker: [Connector] + connectorsForExport: [Connector] + connectorsForImport: [Connector] + connectorsForAnalysis: [Connector] + connectorsForNotification: [Connector] + work(id: ID!): Work + isWorkAlive(id: ID!): Boolean + works(first: Int, after: ID, orderBy: WorksOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): WorkConnection + runtimeAttributes(first: Int, search: String, orderMode: OrderingMode, attributeName: String!): AttributeConnection + schemaAttributeNames(elementType: [String]!): AttributeConnection + schemaAttributes: [AttributesMap] + retentionRule(id: String!): RetentionRule + retentionRules(first: Int, after: ID, search: String, orderBy: RetentionRuleOrdering, orderMode: OrderingMode): RetentionRuleConnection + taxiiCollection(id: String!): TaxiiCollection + taxiiCollections(first: Int, after: ID, orderBy: TaxiiCollectionOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): TaxiiCollectionConnection + streamCollection(id: String!): StreamCollection + feed(id: String!): Feed + feeds(first: Int, after: ID, orderBy: FeedOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FeedConnection + streamCollections(first: Int, after: ID, orderBy: StreamCollectionOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): StreamCollectionConnection! + redisStreamInfo: RedisStreamInfo + statusTemplate(id: String!): StatusTemplate + statusTemplates(first: Int, after: ID, orderBy: StatusTemplateOrdering, orderMode: OrderingMode, search: String): StatusTemplateConnection + statusTemplatesByStatusScope(search: String, scope: StatusScope): [StatusTemplate] + status(id: String!): Status + statuses(first: Int, after: ID, orderBy: StatusOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, scope: StatusScope): StatusConnection + backgroundTask(id: String!): BackgroundTask + backgroundTasks(first: Int, after: ID, orderBy: BackgroundTasksOrdering, orderMode: OrderingMode, includeAuthorities: Boolean, filters: FilterGroup, search: String): BackgroundTaskConnection + rule(id: String!): Rule + rules: [Rule] + ruleManagerInfo: RuleManager + synchronizer(id: String!): Synchronizer + synchronizers(first: Int, after: ID, orderBy: SynchronizersOrdering, orderMode: OrderingMode, search: String): SynchronizerConnection + synchronizerFetch(input: SynchronizerFetchInput): [RemoteStreamCollection] + stixMetaObject(id: String!): StixMetaObject + stixMetaObjects(first: Int, after: ID, types: [String], orderBy: StixMetaObjectsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): StixMetaObjectConnection + markingDefinition(id: String!): MarkingDefinition + markingDefinitions(first: Int, after: ID, orderBy: MarkingDefinitionsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): MarkingDefinitionConnection + label(id: String!): Label + labels(first: Int, after: ID, orderBy: LabelsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): LabelConnection + externalReference(id: String!): ExternalReference + externalReferences(first: Int, after: ID, orderBy: ExternalReferencesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): ExternalReferenceConnection + killChainPhase(id: String!): KillChainPhase + killChainPhases(first: Int, after: ID, orderBy: KillChainPhasesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): KillChainPhaseConnection + stixCoreObjectRaw(id: String!): String + stixCoreObject(id: String!): StixCoreObject + stixCoreObjectAnalysis(id: ID!, contentSource: String!, contentType: AnalysisContentType!): Analysis + stixCoreObjectAskAiActivity(id: ID!, language: String, forceRefresh: Boolean): AiActivity + stixCoreObjectAskAiForecast(id: ID!, language: String, forceRefresh: Boolean): AiForecast + stixCoreObjectAskAiHistory(id: ID!, language: String, forceRefresh: Boolean): AiHistory + stixCoreBackgroundActiveOperations(id: ID!): [BackgroundTask!] + stixCoreObjects(first: Int, after: ID, types: [String], orderBy: StixCoreObjectsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): StixCoreObjectConnection + stixCoreObjectsRestricted(first: Int, after: ID, types: [String], orderBy: StixCoreObjectsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): StixCoreObjectConnection + globalSearch(first: Int, after: ID, search: String, types: [String], orderBy: StixCoreObjectsOrdering, orderMode: OrderingMode, filters: FilterGroup): StixCoreObjectConnection + unknownStixCoreObjects(values: [String!]!, orderBy: UnknownStixCoreObjectsOrdering, orderMode: OrderingMode): [String!]! + stixCoreObjectsExportFiles(first: Int, exportContext: ExportContext!): FileConnection + stixCoreObjectsTimeSeries(authorId: String, field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime, interval: String!, onlyInferred: Boolean, types: [String], filters: FilterGroup, search: String): [TimeSeries] + stixCoreObjectsMultiTimeSeries(startDate: DateTime!, endDate: DateTime, interval: String!, onlyInferred: Boolean, timeSeriesParameters: [StixCoreObjectsTimeSeriesParameters]): [MultiTimeSeries] + stixCoreObjectsNumber(dateAttribute: String, types: [String], startDate: DateTime, endDate: DateTime, onlyInferred: Boolean, filters: FilterGroup, search: String): Number + stixCoreObjectsMultiNumber(dateAttribute: String, startDate: DateTime, endDate: DateTime, onlyInferred: Boolean, numberParameters: [StixCoreObjectsNumberParameters]): [Number] + stixCoreObjectsDistribution(objectId: [String], relationship_type: [String], toTypes: [String], elementWithTargetTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreObjectsMultiDistribution(field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, distributionParameters: StixCoreObjectsDistributionParameters): [MultiDistribution] + filtersRepresentatives(filters: FilterGroup!, isMeValueForbidden: Boolean): [RepresentativeWithId!]! + stixDomainObject(id: String!): StixDomainObject + stixDomainObjects(first: Int, after: ID, types: [String], orderBy: StixDomainObjectsOrdering, pirId: ID, orderMode: OrderingMode, filters: FilterGroup, search: String): StixDomainObjectConnection + bookmarks(first: Int, after: ID, types: [String], filters: FilterGroup): StixDomainObjectConnection + stixDomainObjectsExportFiles(first: Int, exportContext: ExportContext!): FileConnection + stixDomainObjectsTimeSeries(authorId: String, field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime, interval: String!, types: [String], onlyInferred: Boolean, filters: FilterGroup, search: String): [TimeSeries] + stixDomainObjectsNumber(dateAttribute: String, types: [String], endDate: DateTime, onlyInferred: Boolean, filters: FilterGroup, search: String): Number + stixDomainObjectsDistribution(objectId: [String], relationship_type: [String], toTypes: [String], elementWithTargetTypes: [String], field: String!, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + attackPattern(id: String): AttackPattern + attackPatterns(first: Int, after: ID, orderBy: AttackPatternsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): AttackPatternConnection + attackPatternsMatrix: AttackPatternsMatrix + campaign(id: String): Campaign + campaigns(first: Int, after: ID, orderBy: CampaignsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): CampaignConnection + campaignsTimeSeries(objectId: String, field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime!, interval: String!, relationship_type: [String]): [TimeSeries] + container(id: String): Container + containers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): ContainerConnection + containersObjectsOfObject(id: String!, types: [String], filters: FilterGroup, search: String): StixObjectOrStixRelationshipConnection + containersNumber(objectId: String, endDate: DateTime): Number + containersDistribution(objectId: String, authorId: String, field: String!, operation: StatsOperation!, limit: Int, order: String, startDate: DateTime, endDate: DateTime, dateAttribute: String, filters: FilterGroup, search: String): [Distribution] + containersAskAiSummary(busId: String, first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, language: String, forceRefresh: Boolean): AiSummary + note(id: String): Note + notes(first: Int, after: ID, orderBy: NotesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): NoteConnection + notesNumber(objectId: String, endDate: DateTime): Number + notesTimeSeries(objectId: String, authorId: String, field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime!, interval: String!): [TimeSeries] + notesDistribution(objectId: String, field: String!, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String): [Distribution] + noteContainsStixObjectOrStixRelationship(id: String!, stixObjectOrStixRelationshipId: String!): Boolean + observedData(id: String): ObservedData + observedDatas(first: Int, after: ID, orderBy: ObservedDatasOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): ObservedDataConnection + observedDatasTimeSeries(objectId: String, authorId: String, field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime!, interval: String!): [TimeSeries] + observedDatasNumber(objectId: String, endDate: DateTime): Number + observedDatasDistribution(objectId: String, field: String!, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String): [Distribution] + observedDataContainsStixObjectOrStixRelationship(id: String!, stixObjectOrStixRelationshipId: String!): Boolean + opinion(id: String): Opinion + opinions(first: Int, after: ID, orderBy: OpinionsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): OpinionConnection + opinionsTimeSeries(objectId: String, authorId: String, field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime!, interval: String!): [TimeSeries] + opinionsNumber(objectId: String, endDate: DateTime): Number + opinionsDistribution(objectId: String, field: String!, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String): [Distribution] + opinionContainsStixObjectOrStixRelationship(id: String!, stixObjectOrStixRelationshipId: String!): Boolean + myOpinion(id: String!): Opinion + report(id: String): Report + reports(first: Int, after: ID, orderBy: ReportsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): ReportConnection + reportsTimeSeries(objectId: String, authorId: String, reportType: String, field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime!, interval: String!, filters: FilterGroup, search: String): [TimeSeries] + reportsNumber(reportType: String, objectId: String, authorId: String, endDate: DateTime, filters: FilterGroup, search: String): Number + reportsDistribution(objectId: String, authorId: String, field: String!, operation: StatsOperation!, limit: Int, order: String, startDate: DateTime, endDate: DateTime, dateAttribute: String, filters: FilterGroup, search: String): [Distribution] + reportContainsStixObjectOrStixRelationship(id: String!, stixObjectOrStixRelationshipId: String!): Boolean + courseOfAction(id: String): CourseOfAction + coursesOfAction(first: Int, after: ID, orderBy: CoursesOfActionOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): CourseOfActionConnection + identity(id: String!): Identity + identities(first: Int, after: ID, types: [String], orderBy: IdentitiesOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup, toStix: Boolean): IdentityConnection + individual(id: String!): Individual + individuals(first: Int, after: ID, orderBy: IndividualsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): IndividualConnection + sector(id: String): Sector + sectors(first: Int, after: ID, orderBy: SectorsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): SectorConnection + system(id: String): System + systems(first: Int, after: ID, orderBy: SystemsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): SystemConnection + infrastructure(id: String!): Infrastructure + infrastructures(first: Int, after: ID, orderBy: InfrastructuresOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): InfrastructureConnection + intrusionSet(id: String): IntrusionSet + intrusionSets(first: Int, after: ID, orderBy: IntrusionSetsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): IntrusionSetConnection + location(id: String!): Location + locations(first: Int, after: ID, types: [String], orderBy: LocationsOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup, toStix: Boolean): LocationConnection + city(id: String): City + cities(first: Int, after: ID, orderBy: CitiesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): CityConnection + country(id: String): Country + countries(first: Int, after: ID, orderBy: CountriesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): CountryConnection + region(id: String!): Region + regions(first: Int, after: ID, orderBy: RegionsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): RegionConnection + position(id: String!): Position + positions(first: Int, after: ID, orderBy: PositionsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): PositionConnection + malware(id: String): Malware + malwares(first: Int, after: ID, orderBy: MalwaresOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): MalwareConnection + threatActor(id: String): ThreatActor + threatActors(first: Int, after: ID, orderBy: ThreatActorsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): ThreatActorConnection + threatActorGroup(id: String): ThreatActorGroup + threatActorsGroup(first: Int, after: ID, orderBy: ThreatActorsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): ThreatActorGroupConnection + tool(id: String): Tool + tools(first: Int, after: ID, orderBy: ToolsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): ToolConnection + vulnerability(id: String): Vulnerability + vulnerabilities(first: Int, after: ID, orderBy: VulnerabilitiesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): VulnerabilityConnection + incident(id: String): Incident + incidents(first: Int, after: ID, orderBy: IncidentsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): IncidentConnection + incidentsTimeSeries(objectId: String, field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime!, interval: String!, relationship_type: [String]): [TimeSeries] + stixCyberObservable(id: String!): StixCyberObservable + stixCyberObservables(first: Int, after: ID, types: [String], orderBy: StixCyberObservablesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): StixCyberObservableConnection + stixCyberObservablesExportFiles(first: Int, exportContext: ExportContext!): FileConnection + stixCyberObservablesNumber(dateAttribute: String, types: [String], authorId: String, endDate: DateTime, filters: FilterGroup, search: String): Number + stixCyberObservablesTimeSeries(types: [String], filters: FilterGroup, search: String): [TimeSeries] + stixCyberObservablesDistribution(objectId: String, field: String!, dateAttribute: String, operation: String!, filters: FilterGroup, search: String): [Distribution] + stixRelationship(id: String): StixRelationship + stixRelationships(first: Int, after: ID, orderBy: StixRelationshipsOrdering, orderMode: OrderingMode, fromOrToId: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, startDate: DateTime, endDate: DateTime, confidences: [Int], search: String, filters: FilterGroup, dynamicFrom: FilterGroup, dynamicTo: FilterGroup, stix: Boolean): StixRelationshipConnection + stixRelationshipsTimeSeries(field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime, interval: String!, onlyInferred: Boolean, fromOrToId: [String], elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup, dynamicFrom: FilterGroup, dynamicTo: FilterGroup): [TimeSeries] + stixRelationshipsMultiTimeSeries(operation: StatsOperation!, startDate: DateTime!, endDate: DateTime, interval: String!, onlyInferred: Boolean, timeSeriesParameters: [StixRelationshipsTimeSeriesParameters], relationship_type: [String!]): [MultiTimeSeries] + stixRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, fromOrToId: [String], elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup, dynamicFrom: FilterGroup, dynamicTo: FilterGroup, aggregateOnConnections: Boolean): [Distribution] + stixRelationshipsNumber(dateAttribute: String, authorId: String, noDirection: Boolean, endDate: DateTime, onlyInferred: Boolean, fromOrToId: [String], elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup, dynamicFrom: FilterGroup, dynamicTo: FilterGroup): Number + schemaRelationsTypesMapping: [StixRelationshipSchema!]! + schemaRelationsRefTypesMapping: [StixRelationshipRefSchema!]! + filterKeysSchema: [FilterKeysSchema!]! + stixCoreRelationship(id: String): StixCoreRelationship + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromOrToId: [String], elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, startDate: DateTime, endDate: DateTime, confidences: [Int], search: String, filters: FilterGroup, dynamicFrom: FilterGroup, dynamicTo: FilterGroup, stix: Boolean): StixCoreRelationshipConnection + stixCoreRelationshipsTimeSeries(field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime, interval: String!, onlyInferred: Boolean, fromOrToId: [String], elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup, dynamicFrom: FilterGroup, dynamicTo: FilterGroup): [TimeSeries] + stixCoreRelationshipsMultiTimeSeries(operation: StatsOperation!, startDate: DateTime!, endDate: DateTime, interval: String!, onlyInferred: Boolean, timeSeriesParameters: [StixCoreRelationshipsTimeSeriesParameters]): [MultiTimeSeries] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, fromOrToId: [String], elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup, dynamicFrom: FilterGroup, dynamicTo: FilterGroup, aggregateOnConnections: Boolean): [Distribution] + stixCoreRelationshipsNumber(dateAttribute: String, authorId: String, noDirection: Boolean, endDate: DateTime, onlyInferred: Boolean, fromOrToId: [String], elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup, dynamicFrom: FilterGroup, dynamicTo: FilterGroup): Number + stixCoreRelationshipsExportFiles(first: Int, exportContext: ExportContext!): FileConnection + stixSightingRelationship(id: String): StixSightingRelationship + stixSightingRelationships(first: Int, after: ID, orderBy: StixSightingRelationshipsOrdering, orderMode: OrderingMode, fromOrToId: String, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, search: String, filters: FilterGroup, toStix: Boolean): StixSightingRelationshipConnection + stixSightingRelationshipsTimeSeries(fromOrToId: String, fromId: StixRef, toId: StixRef, field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime!, interval: String!, fromTypes: [String], toTypes: [String], search: String, filters: FilterGroup): [TimeSeries] + stixSightingRelationshipsDistribution(fromOrToId: String, fromId: StixRef, toId: StixRef, field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, limit: Int, order: String, fromTypes: [String], toTypes: [String], search: String, filters: FilterGroup): [Distribution] + stixSightingRelationshipsNumber(dateAttribute: String, fromOrToId: String, fromId: StixRef, toId: StixRef, endDate: DateTime, fromTypes: [String], toTypes: [String], search: String, filters: FilterGroup): Number + stixRefRelationship(id: String): StixRefRelationship + stixRefRelationships(first: Int, after: ID, orderBy: StixRefRelationshipsOrdering, orderMode: OrderingMode, fromOrToId: String, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: [String], startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, search: String, filters: FilterGroup, toStix: Boolean): StixRefRelationshipConnection + stixNestedRefRelationships(first: Int, after: ID, orderBy: StixRefRelationshipsOrdering, orderMode: OrderingMode, fromOrToId: String, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: [String], startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, search: String, filters: FilterGroup, toStix: Boolean): StixRefRelationshipConnection + stixSchemaRefRelationships(id: String, toType: String): DefinitionRefRelationship + stixSchemaRefRelationshipsPossibleTypes(type: String!): [String!]! + stixRefRelationshipsDistribution(field: String!, operation: StatsOperation!, relationship_type: [String], isTo: Boolean, toRole: String, toTypes: [String], startDate: DateTime, endDate: DateTime, dateAttribute: String, limit: Int, order: String): [Distribution] + stixRefRelationshipsNumber(types: [String!], fromId: StixRef, endDate: DateTime): Number + stixObjectOrStixRelationship(id: String!): StixObjectOrStixRelationship + stixObjectOrStixRelationships(first: Int, after: ID, search: String, filters: FilterGroup): StixObjectOrStixRelationshipConnection + stixCoreObjectOrStixCoreRelationship(id: String!): StixCoreObjectOrStixCoreRelationship + csvMapperTest(configuration: String!, content: String!): CsvMapperTestResult @deprecated(reason: "[>=6.4 & <6.7]. Use `csvMapperTest mutation`.") + channel(id: String!): Channel + channels(first: Int, after: ID, orderBy: ChannelsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): ChannelConnection + catalog(id: String!): Catalog + catalogs: [Catalog!]! + contract(slug: String!): ExtendedContract + language(id: String!): Language + languages(first: Int, after: ID, orderBy: LanguagesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): LanguageConnection + event(id: String!): Event + events(first: Int, after: ID, orderBy: EventsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): EventConnection + grouping(id: String!): Grouping + groupings(first: Int, after: ID, orderBy: GroupingsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): GroupingConnection + groupingsTimeSeries(objectId: String, authorId: String, groupingType: String, field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime!, interval: String!, filters: FilterGroup, search: String): [TimeSeries] + groupingsNumber(groupingContext: String, objectId: String, authorId: String, endDate: DateTime, filters: FilterGroup): Number + groupingsDistribution(objectId: String, authorId: String, field: String!, operation: StatsOperation!, limit: Int, order: String, startDate: DateTime, endDate: DateTime, dateAttribute: String, filters: FilterGroup, search: String): [Distribution] + groupingContainsStixObjectOrStixRelationship(id: String!, stixObjectOrStixRelationshipId: String!): Boolean + narrative(id: String!): Narrative + narratives(first: Int, after: ID, orderBy: NarrativesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): NarrativeConnection + triggerKnowledge(id: String!): Trigger + triggersKnowledge(first: Int, after: ID, orderBy: TriggersOrdering, orderMode: OrderingMode, filters: FilterGroup, includeAuthorities: Boolean, search: String): TriggerConnection + triggers(first: Int, after: ID, orderBy: TriggersOrdering, orderMode: OrderingMode, filters: FilterGroup, includeAuthorities: Boolean, search: String): TriggerConnection + triggersKnowledgeCount(filters: FilterGroup, includeAuthorities: Boolean, search: String): Int + triggerActivity(id: String!): Trigger + triggersActivity(first: Int, after: ID, orderBy: TriggersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): TriggerConnection + notification(id: String!): Notification + notifications(first: Int, after: ID, orderBy: NotificationsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): NotificationConnection + myNotifications(first: Int, after: ID, orderBy: NotificationsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): NotificationConnection + myUnreadNotificationsCount: Int + dataComponent(id: String!): DataComponent + dataComponents(first: Int, after: ID, orderBy: DataComponentsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): DataComponentConnection + dataSource(id: String!): DataSource + dataSources(first: Int, after: ID, orderBy: DataSourcesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): DataSourceConnection + vocabulary(id: String!): Vocabulary + vocabularyCategories: [VocabularyDefinition!]! + vocabularies(category: VocabularyCategory, first: Int, after: ID, orderBy: VocabularyOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): VocabularyConnection + administrativeArea(id: String!): AdministrativeArea + administrativeAreas(first: Int, after: ID, orderBy: AdministrativeAreasOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): AdministrativeAreaConnection + task(id: String!): Task + tasks(first: Int, after: ID, orderBy: TasksOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): TaskConnection + taskContainsStixObjectOrStixRelationship(id: String!, stixObjectOrStixRelationshipId: String!): Boolean + taskTemplate(id: String!): TaskTemplate + taskTemplates(first: Int, after: ID, orderBy: TaskTemplatesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): TaskTemplateConnection + case(id: String!): Case + cases(first: Int, after: ID, orderBy: CasesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): CaseConnection + caseTemplate(id: String!): CaseTemplate + caseTemplates(first: Int, after: ID, orderBy: CaseTemplatesOrdering, orderMode: OrderingMode, search: String): CaseTemplateConnection + caseIncident(id: String!): CaseIncident + caseIncidents(first: Int, after: ID, orderBy: CaseIncidentsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): CaseIncidentConnection + caseIncidentContainsStixObjectOrStixRelationship(id: String!, stixObjectOrStixRelationshipId: String!): Boolean + caseRfi(id: String!): CaseRfi + caseRfis(first: Int, after: ID, orderBy: CaseRfisOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): CaseRfiConnection + caseRfiContainsStixObjectOrStixRelationship(id: String!, stixObjectOrStixRelationshipId: String!): Boolean + caseRft(id: String!): CaseRft + caseRfts(first: Int, after: ID, orderBy: CaseRftsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): CaseRftConnection + caseRftContainsStixObjectOrStixRelationship(id: String!, stixObjectOrStixRelationshipId: String!): Boolean + feedback(id: String!): Feedback + feedbacks(first: Int, after: ID, orderBy: FeedbacksOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): FeedbackConnection + feedbackContainsStixObjectOrStixRelationship(id: String!, stixObjectOrStixRelationshipId: String!): Boolean + entitySetting(id: String!): EntitySetting + entitySettingByType(targetType: String!): EntitySetting + entitySettings(first: Int, after: ID, orderBy: EntitySettingsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, includeObservables: Boolean): EntitySettingConnection + workspace(id: String!): Workspace + workspaces(first: Int, after: ID, orderBy: WorkspacesOrdering, orderMode: OrderingMode, filters: FilterGroup, includeAuthorities: Boolean, search: String): WorkspaceConnection + malwareAnalysis(id: String!): MalwareAnalysis + malwareAnalyses(first: Int, after: ID, orderBy: MalwareAnalysesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): MalwareAnalysisConnection + managerConfiguration(id: String!): ManagerConfiguration + managerConfigurationByManagerId(managerId: String!): ManagerConfiguration + notificationNotifiers: [Notifier!]! + notifier(id: String!): Notifier + notifierTest(input: NotifierTestInput!): String + notifiers(first: Int, after: ID, orderBy: NotifierOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): NotifierConnection + threatActorIndividual(id: String!): ThreatActorIndividual + threatActorsIndividuals(first: Int, after: ID, orderBy: ThreatActorsIndividualOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): ThreatActorIndividualConnection + playbook(id: String!): Playbook + playbooks(first: Int, after: ID, orderBy: PlaybooksOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): PlaybookConnection + playbookComponents: [PlaybookComponent]! + playbooksForEntity(id: String!): [Playbook] + ingestionRss(id: String!): IngestionRss + ingestionRsss(first: Int, after: ID, orderBy: IngestionRssOrdering, orderMode: OrderingMode, filters: FilterGroup, includeAuthorities: Boolean, search: String): IngestionRssConnection + ingestionTaxii(id: String!): IngestionTaxii + ingestionTaxiis(first: Int, after: ID, orderBy: IngestionTaxiiOrdering, orderMode: OrderingMode, filters: FilterGroup, includeAuthorities: Boolean, search: String): IngestionTaxiiConnection + taxiiFeedAddInputFromImport(file: Upload!): TaxiiFeedAddInputFromImport! + ingestionTaxiiCollection(id: String!): IngestionTaxiiCollection + ingestionTaxiiCollections(first: Int, after: ID, orderBy: IngestionTaxiiCollectionOrdering, orderMode: OrderingMode, filters: FilterGroup, includeAuthorities: Boolean, search: String): IngestionTaxiiCollectionConnection + ingestionCsv(id: String!): IngestionCsv + ingestionCsvs(first: Int, after: ID, orderBy: IngestionCsvOrdering, orderMode: OrderingMode, filters: FilterGroup, includeAuthorities: Boolean, search: String): IngestionCsvConnection + csvFeedAddInputFromImport(file: Upload!): CSVFeedAddInputFromImport! + defaultIngestionGroupCount: Int + userAlreadyExists(name: String!): Boolean + ingestionJson(id: String!): IngestionJson + ingestionJsons(first: Int, after: ID, orderBy: IngestionJsonOrdering, orderMode: OrderingMode, filters: FilterGroup, includeAuthorities: Boolean, search: String): IngestionJsonConnection + indicator(id: String!): Indicator + indicators(first: Int, after: ID, orderBy: IndicatorsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): IndicatorConnection + indicatorsTimeSeries(objectId: String, field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime!, interval: String!, filters: FilterGroup): [TimeSeries] + indicatorsNumber(pattern_type: String, objectId: String, endDate: DateTime): Number + indicatorsDistribution(objectId: String, field: String!, operation: StatsOperation!, limit: Int, order: String, startDate: DateTime, endDate: DateTime, dateAttribute: String): [Distribution] + decayRule(id: String!): DecayRule + decayRules(first: Int, after: ID, orderBy: DecayRuleOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): DecayRuleConnection + decayExclusionRule(id: String!): DecayExclusionRule + decayExclusionRules(first: Int, after: ID, orderBy: DecayExclusionRuleOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): DecayExclusionRuleConnection + organization(id: String!): Organization + organizations(first: Int, after: ID, orderBy: OrganizationsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): OrganizationConnection + securityOrganizations(first: Int, after: ID, orderBy: OrganizationsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): OrganizationConnection + csvMapper(id: ID!): CsvMapper + csvMappers(first: Int, after: ID, orderBy: CsvMapperOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): CsvMapperConnection + csvMapperSchemaAttributes: [CsvMapperSchemaAttributes!]! + csvMapperAddInputFromImport(file: Upload!): CsvMapperAddInputFromImport! + jsonMapper(id: ID!): JsonMapper + jsonMappers(first: Int, after: ID, orderBy: JsonMapperOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): JsonMapperConnection + publicDashboard(id: String!): PublicDashboard + publicDashboards(first: Int, after: ID, orderBy: PublicDashboardsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): PublicDashboardConnection + publicDashboardByUriKey(uri_key: String!): PublicDashboard + publicStixCoreObjectsNumber(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): Number + publicStixRelationshipsNumber(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): Number + publicStixCoreObjectsMultiTimeSeries(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): [MultiTimeSeries] + publicStixRelationshipsMultiTimeSeries(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): [MultiTimeSeries] + publicStixCoreObjectsDistribution(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): [PublicDistribution] + publicStixRelationshipsDistribution(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): [PublicDistribution] + publicBookmarks(uriKey: String!, widgetId: String!): StixDomainObjectConnection + publicStixCoreObjects(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): StixCoreObjectConnection + publicStixRelationships(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): StixRelationshipConnection + theme(id: ID!): Theme + themes(first: Int, after: ID, orderBy: ThemeOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): ThemeConnection + deleteOperation(id: String!): DeleteOperation + deleteOperations(first: Int, after: ID, orderBy: DeleteOperationOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): DeleteOperationConnection + supportPackage(id: String!): SupportPackage + supportPackages(first: Int, after: ID, orderBy: SupportPackageOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): SupportPackageConnection + exclusionList(id: String!): ExclusionList + exclusionLists(first: Int, after: ID, orderBy: ExclusionListOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): ExclusionListConnection + exclusionListCacheStatus: ExclusionListCacheStatus + draftWorkspace(id: String!): DraftWorkspace + draftWorkspaces(first: Int, after: ID, orderBy: DraftWorkspacesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): DraftWorkspaceConnection + draftWorkspacesRestricted(first: Int, after: ID, orderBy: DraftWorkspacesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): DraftWorkspaceConnection + draftWorkspaceEntities(draftId: String!, types: [String], first: Int, after: ID, orderBy: StixCoreObjectsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): StixCoreObjectConnection + draftWorkspaceRelationships(draftId: String!, types: [String], first: Int, after: ID, orderBy: StixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): StixRelationshipConnection + draftWorkspaceSightingRelationships(draftId: String!, types: [String], first: Int, after: ID, orderBy: StixSightingRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): StixSightingRelationshipConnection + fintelTemplate(id: ID!): FintelTemplate + disseminationList(id: ID!): DisseminationList + disseminationLists(first: Int, after: ID, orderBy: DisseminationListOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): DisseminationListConnection + savedFilters(first: Int, after: ID, orderBy: SavedFilterOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): SavedFilterConnection + pir(id: ID!): Pir + pirs(first: Int, after: ID, orderBy: PirOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): PirConnection + pirRelationships(pirId: ID!, first: Int, after: ID, orderBy: PirRelationshipOrdering, orderMode: OrderingMode, fromId: [String], fromRole: String, fromTypes: [String], startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, startDate: DateTime, endDate: DateTime, confidences: [Int], search: String, filters: FilterGroup, dynamicFrom: FilterGroup, stix: Boolean): PirRelationshipConnection + pirRelationshipsDistribution(pirId: ID!, field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, fromId: [String], fromTypes: [String], relationship_type: [String], search: String, filters: FilterGroup, dynamicFrom: FilterGroup, aggregateOnConnections: Boolean): [Distribution] + pirRelationshipsMultiTimeSeries(operation: StatsOperation!, startDate: DateTime!, endDate: DateTime, interval: String!, onlyInferred: Boolean, timeSeriesParameters: [PirRelationshipsTimeSeriesParameters!]!, relationship_type: [String!]): [MultiTimeSeries] + pirLogs(pirId: ID!, first: Int, after: ID, orderBy: LogsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): LogConnection + fintelDesign(id: String!): FintelDesign + fintelDesigns(first: Int, after: ID, orderBy: FintelDesignOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): FintelDesignConnection + securityPlatform(id: String!): SecurityPlatform + securityPlatforms(first: Int, after: ID, orderBy: SecurityPlatformOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): SecurityPlatformConnection + securityCoverage(id: String!): SecurityCoverage + securityCoverages(first: Int, after: ID, orderBy: SecurityCoverageOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): SecurityCoverageConnection + emailTemplate(id: ID!): EmailTemplate + emailTemplates(first: Int, after: ID, orderBy: EmailTemplateOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): EmailTemplateConnection + form(id: ID!): Form + forms(search: String, first: Int, after: ID, orderBy: FormsOrdering, orderMode: OrderingMode, filters: FilterGroup): FormConnection +} + +type Subscription { + me: MeUser + settings(id: ID!): Settings + settingsMessages(id: ID!): Settings + group(id: ID!): Group + user(id: ID!): User + label(id: ID!): Label + statusTemplate(id: ID!): StatusTemplate + markingDefinition(id: ID!): MarkingDefinition + killChainPhase(id: ID!): KillChainPhase + stixCoreObject(id: ID!): StixCoreObject + internalObject(id: ID!): InternalObject @deprecated(reason: "[>=6.3 & <6.6]. Not used in the platform.") + stixDomainObject(id: ID!): StixDomainObject + stixCyberObservable(id: ID!): StixCyberObservable + stixCoreRelationship(id: ID!): StixCoreRelationship + stixSightingRelationship(id: ID!): StixSightingRelationship + stixRefRelationship(id: ID!): StixRefRelationship + externalReference(id: ID!): ExternalReference + notification: Notification + notificationsNumber: NotificationCount + entitySetting(id: ID!): EntitySetting + workspace(id: ID!): Workspace + managerConfiguration(id: ID!): ManagerConfiguration + aiBus(id: ID!): AIBus +} + +type WorkEditMutations { + delete: ID! + ping: ID! + reportExpectation(error: WorkErrorInput): ID! + addExpectations(expectations: Int): ID! + addDraftContext(draftContext: String): ID! + toReceived(message: String): ID! + toProcessed(message: String, inError: Boolean): ID! +} + +type SettingsEditMutations { + fieldPatch(input: [EditInput]!): Settings + contextPatch(input: EditContext): Settings + contextClean: Settings + editMessage(input: SettingsMessageInput!): Settings + deleteMessage(input: String!): Settings +} + +type SubTypeEditMutations { + statusAdd(input: StatusAddInput!): SubType + statusFieldPatch(statusId: String!, input: [EditInput]!): SubType + statusDelete(statusId: String!): SubType +} + +type GroupEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): Group + contextPatch(input: EditContext): Group + contextClean: Group + relationAdd(input: InternalRelationshipAddInput!): InternalRelationship + relationDelete(fromId: StixRef, toId: StixRef, relationship_type: String!): Group + editDefaultMarking(input: DefaultMarkingInput!): Group +} + +type UserEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): User + contextPatch(input: EditContext): User + contextClean: User + tokenRenew: User + relationAdd(input: InternalRelationshipAddInput!): InternalRelationship + relationDelete(toId: StixRef!, relationship_type: String!): User + organizationAdd(organizationId: ID!): User + organizationDelete(organizationId: ID!): User +} + +type RoleEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): Role + contextPatch(input: EditContext): Role + contextClean: Role + relationAdd(input: InternalRelationshipAddInput!): InternalRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Role +} + +type AttributeEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): Attribute +} + +type TaxiiCollectionEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): TaxiiCollection +} + +type StreamCollectionEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): StreamCollection + addGroup(id: ID!): StreamCollection + deleteGroup(id: ID!): StreamCollection +} + +type SynchronizerEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): Synchronizer +} + +type StixEditMutations { + delete(forceDelete: Boolean): ID + merge(stixObjectsIds: [String]!): StixObject +} + +type MarkingDefinitionEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): MarkingDefinition + contextPatch(input: EditContext): MarkingDefinition + contextClean: MarkingDefinition +} + +type LabelEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): Label + contextPatch(input: EditContext): Label + contextClean: Label +} + +type ExternalReferenceEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): ExternalReference + contextPatch(input: EditContext): ExternalReference + contextClean: ExternalReference + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(fromId: StixRef!, relationship_type: String!): ExternalReference + askEnrichment(connectorId: ID!): Work + askEnrichments(connectorIds: [ID!]!): [Work!] + importPush(file: Upload!, fileMarkings: [String], version: DateTime, noTriggerImport: Boolean, embedded: Boolean): File +} + +type KillChainPhaseEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): KillChainPhase + contextPatch(input: EditContext): KillChainPhase + contextClean: KillChainPhase + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): KillChainPhase +} + +enum AnalysisContentType { + fields + file +} + +union Analysis = MappingAnalysis + +input MappingAnalysisInput { + mappedEntities: [MappedEntityInput] +} + +type MappingAnalysis { + analysisType: String! + analysisStatus: State + analysisDate: DateTime + mappedEntities: [MappedEntity!] +} + +input MappedEntityInput { + matchedString: String! + matchedEntityId: String! +} + +type MappedEntity { + matchedString: String! + matchedEntity: StixCoreObject! + isEntityInContainer: Boolean! +} + +type StixCoreObjectEditMutations { + delete: ID + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationsAdd(input: StixRefRelationshipsAddInput!, commitMessage: String, references: [String]): StixCoreObject + relationDelete(toId: StixRef!, relationship_type: String!, commitMessage: String, references: [String]): StixCoreObject + clearAccessRestriction: StixCoreObject + restrictionOrganizationAdd(organizationId: [ID!]!, directContainerSharing: Boolean): StixCoreObject + restrictionOrganizationDelete(organizationId: [ID!]!, directContainerSharing: Boolean): StixCoreObject + askEnrichment(connectorId: ID!): Work + askEnrichments(connectorIds: [ID!]!): [Work!] + askAnalysis(contentSource: String!, contentType: AnalysisContentType!, connectorId: ID): Work + analysisPush(file: Upload!, contentSource: String!, contentType: AnalysisContentType!, analysisType: String!): File + analysisClear(contentSource: String!, contentType: AnalysisContentType!): Boolean + importPush(file: Upload!, fileMarkings: [String], version: DateTime, noTriggerImport: Boolean, fromTemplate: Boolean, embedded: Boolean): File + uploadAndAskJobImport(file: Upload!, connectors: [ConnectorWithConfig!], fileMarkings: [String!], validationMode: ValidationMode, draftId: String, noTriggerImport: Boolean): File + exportAsk(input: ExportAskInput!): [File!] + exportPush(file: Upload!): Boolean + removeFromDraft: ID +} + +input StixDomainObjectFileEditInput { + id: String! + description: String + order: Int + inCarousel: Boolean +} + +type StixDomainObjectEditMutations { + delete: ID + changeType(newType: String!): StixDomainObject + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): StixDomainObject + contextPatch(input: EditContext): StixDomainObject + contextClean: StixDomainObject + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationsAdd(input: StixRefRelationshipsAddInput!): StixDomainObject + relationDelete(toId: StixRef!, relationship_type: String): StixDomainObject + importPush(file: Upload!, fileMarkings: [String], version: DateTime, noTriggerImport: Boolean, fromTemplate: Boolean, embedded: Boolean): File + exportAsk(input: ExportAskInput!): [File!] + exportPush(file: Upload!, file_markings: [String]!): Boolean + stixDomainObjectFileEdit(input: StixDomainObjectFileEditInput): StixDomainObject + editAuthorizedMembers(input: [MemberAccessInput!]): StixDomainObject +} + +type AttackPatternEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): AttackPattern + contextPatch(input: EditContext): AttackPattern + contextClean: AttackPattern + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): AttackPattern +} + +type CampaignEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Campaign + contextPatch(input: EditContext): Campaign + contextClean: Campaign + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Campaign +} + +type ContainerEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Container + contextPatch(input: EditContext): Container + contextClean: Container + editAuthorizedMembers(input: [MemberAccessInput!]): Container + relationAdd(input: StixRefRelationshipAddInput!, commitMessage: String, references: [String]): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!, commitMessage: String, references: [String]): Container + investigationAdd: Workspace + knowledgeAddFromInvestigation(workspaceId: ID!): Container +} + +type NoteEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Note + contextPatch(input: EditContext): Note + contextClean: Note + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Note +} + +type ObservedDataEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): ObservedData + contextPatch(input: EditContext): ObservedData + contextClean: ObservedData + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): ObservedData +} + +type OpinionEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Opinion + contextPatch(input: EditContext): Opinion + contextClean: Opinion + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Opinion +} + +type ReportEditMutations { + delete(purgeElements: Boolean): ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Report + contextPatch(input: EditContext): Report + contextClean: Report + relationAdd(input: StixRefRelationshipAddInput!, commitMessage: String, references: [String]): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!, commitMessage: String, references: [String]): Report +} + +type CourseOfActionEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): CourseOfAction + contextPatch(input: EditContext): CourseOfAction + contextClean: CourseOfAction + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): CourseOfAction +} + +type IdentityEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Identity + contextPatch(input: EditContext): Identity + contextClean: Identity + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Identity +} + +type IndividualEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Individual + contextPatch(input: EditContext): Individual + contextClean: Individual + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Individual +} + +type SectorEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Sector + contextPatch(input: EditContext): Sector + contextClean: Sector + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Sector +} + +type SystemEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): System + contextPatch(input: EditContext): System + contextClean: System + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): System +} + +type InfrastructureEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Infrastructure + contextPatch(input: EditContext): Infrastructure + contextClean: Infrastructure + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Infrastructure +} + +type IntrusionSetEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): IntrusionSet + contextPatch(input: EditContext): IntrusionSet + contextClean: IntrusionSet + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): IntrusionSet +} + +type LocationEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Location + contextPatch(input: EditContext): Location + contextClean: Location + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Location +} + +type CityEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): City + contextPatch(input: EditContext): City + contextClean: City + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): City +} + +type CountryEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Country + contextPatch(input: EditContext): Country + contextClean: Country + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Country +} + +type RegionEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Region + contextPatch(input: EditContext): Region + contextClean: Region + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Region +} + +type PositionEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Position + contextPatch(input: EditContext): Position + contextClean: Position + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Position +} + +type MalwareEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Malware + contextPatch(input: EditContext): Malware + contextClean: Malware + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Malware +} + +type ThreatActorGroupEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): ThreatActorGroup + contextPatch(input: EditContext): ThreatActorGroup + contextClean: ThreatActorGroup + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): ThreatActorGroup +} + +type ToolEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Tool + contextPatch(input: EditContext): Tool + contextClean: Tool + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Tool +} + +type VulnerabilityEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Vulnerability + contextPatch(input: EditContext): Vulnerability + contextClean: Vulnerability + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Vulnerability +} + +type IncidentEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Incident + contextPatch(input: EditContext): Incident + contextClean: Incident + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Incident +} + +type StixCyberObservableEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): StixCyberObservable + contextPatch(input: EditContext): StixCyberObservable + contextClean: StixCyberObservable + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationsAdd(input: StixRefRelationshipsAddInput!): StixCyberObservable + relationDelete(toId: StixRef!, relationship_type: String!): StixCyberObservable + promoteToIndicator: Indicator + importPush(file: Upload!, fileMarkings: [String], version: DateTime, noTriggerImport: Boolean, embedded: Boolean): File + exportAsk(format: String!, exportType: String!, maxMarkingDefinition: String): [File!] + exportPush(file: Upload!): Boolean + promote: StixCyberObservable @deprecated(reason: "[>=6.2 & <6.8]. Use `promoteToIndicator`.") +} + +type StixRelationshipEditMutations { + delete: ID +} + +type StixCoreRelationshipEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): StixCoreRelationship + contextPatch(input: EditContext): StixCoreRelationship + contextClean: StixCoreRelationship + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationsAdd(input: StixRefRelationshipsAddInput!, commitMessage: String, references: [String]): StixCoreRelationship + relationDelete(toId: StixRef!, relationship_type: String!, commitMessage: String, references: [String]): StixCoreRelationship + restrictionOrganizationAdd(organizationId: [ID!]!, directContainerSharing: Boolean): StixCoreRelationship + restrictionOrganizationDelete(organizationId: [ID!]!, directContainerSharing: Boolean): StixCoreRelationship + removeFromDraft: ID +} + +type StixSightingRelationshipEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): StixSightingRelationship + contextPatch(input: EditContext): StixSightingRelationship + contextClean: StixSightingRelationship + relationAdd(input: StixRefRelationshipAddInput!): StixSightingRelationship + relationsAdd(input: StixRefRelationshipsAddInput!, commitMessage: String, references: [String]): StixSightingRelationship + relationDelete(toId: StixRef!, relationship_type: String!, commitMessage: String, references: [String]): StixSightingRelationship + restrictionOrganizationAdd(organizationId: [ID!]!, directContainerSharing: Boolean): StixSightingRelationship + restrictionOrganizationDelete(organizationId: [ID!]!, directContainerSharing: Boolean): StixSightingRelationship + removeFromDraft: ID +} + +type StixRefRelationshipEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): StixRefRelationship + contextPatch(input: EditContext): StixRefRelationship +} + +enum ValidationMode { + draft + workbench +} + +type Mutation { + deleteImport(fileName: String): ID + uploadImport(file: Upload!, fileMarkings: [String]): File + uploadAndAskJobImport(file: Upload!, fileMarkings: [String!], connectors: [ConnectorWithConfig!], validationMode: ValidationMode, draftId: String, noTriggerImport: Boolean): File + uploadPending(file: Upload!, entityId: String, labels: [String], errorOnExisting: Boolean, file_markings: [String!], refreshEntity: Boolean): File + askJobImport(fileName: ID!, connectorId: String, configuration: String, bypassEntityId: String, bypassValidation: Boolean, validationMode: ValidationMode, forceValidation: Boolean): File + createDraftAndAskJobImport(fileName: ID!, connectorId: String, configuration: String, bypassEntityId: String, bypassValidation: Boolean, validationMode: ValidationMode, forceValidation: Boolean, authorized_members: [MemberAccessInput!]): File + resetFileIndexing: Boolean + synchronizerAdd(input: SynchronizerAddInput!): Synchronizer + synchronizerEdit(id: ID!): SynchronizerEditMutations + synchronizerStart(id: ID!): Synchronizer + synchronizerStop(id: ID!): Synchronizer + synchronizerTest(input: SynchronizerAddInput): String + workAdd(connectorId: String!, friendlyName: String): Work! + workEdit(id: ID!): WorkEditMutations + workDelete(connectorId: String!): Boolean + deleteBackgroundTask(id: ID!): ID! + listTaskAdd(input: ListTaskAddInput!): BackgroundTask! + queryTaskAdd(input: QueryTaskAddInput!): BackgroundTask! + retentionRuleAdd(input: RetentionRuleAddInput!): RetentionRule! + retentionRuleCheck(input: RetentionRuleAddInput): Int! + retentionRuleEdit(id: ID!): RetentionRuleEditMutations + ruleSetActivation(id: ID!, enable: Boolean!): Rule! + ruleManagerClean(eventId: ID): RuleManager! + ruleApply(elementId: ID!, ruleId: ID!): Boolean + ruleClear(elementId: ID!, ruleId: ID!): Boolean + rulesRescan(elementId: ID!): Boolean + frontendErrorLog(message: String!, codeStack: String, componentStack: String): Boolean + token(input: UserLoginInput): String + otpActivation(input: UserOTPActivationInput): MeUser + otpDeactivation: MeUser + otpUserDeactivation(id: ID!): MeUser + otpLogin(input: UserOTPLoginInput): Boolean + settingsEdit(id: ID!): SettingsEditMutations + setupEnterpriseLicense(input: LicenseActivationInput!): Settings + subTypeEdit(id: ID!): SubTypeEditMutations + statusTemplateAdd(input: StatusTemplateAddInput!): StatusTemplate! + statusTemplateDelete(id: ID!): ID! + statusTemplateFieldPatch(id: ID!, input: [EditInput!]!): StatusTemplate! + statusTemplateContextPatch(id: ID!, input: EditContext!): StatusTemplate! + statusTemplateContextClean(id: ID!): StatusTemplate! + groupAdd(input: GroupAddInput!): Group + groupEdit(id: ID!): GroupEditMutations + userAdd(input: UserAddInput!): User + userEdit(id: ID!): UserEditMutations + meTokenRenew: MeUser + meEdit(input: [EditInput]!, password: String): MeUser + bookmarkAdd(id: ID!, type: String!): StixDomainObject + bookmarkDelete(id: ID!): ID + sendUserMail(input: SendUserMailInput!): Boolean + logout: ID + roleAdd(input: RoleAddInput!): Role + sessionKill(id: ID!): ID + userSessionsKill(id: ID!): [ID] + roleEdit(id: ID!): RoleEditMutations + pingConnector(id: ID!, state: String, connectorInfo: ConnectorInfoInput): Connector + registerConnector(input: RegisterConnectorInput): Connector + managedConnectorEdit(input: EditManagedConnectorInput): ManagedConnector + managedConnectorAdd(input: AddManagedConnectorInput): ManagedConnector + registerConnectorsManager(input: RegisterConnectorsManagerInput): ConnectorManager + updateConnectorManagerStatus(input: UpdateConnectorManagerStatusInput): ConnectorManager + resetStateConnector(id: ID!): Connector + deleteConnector(id: ID!): ID! + updateConnectorRequestedStatus(input: RequestConnectorStatusInput!): ManagedConnector + updateConnectorCurrentStatus(input: CurrentConnectorStatusInput!): ManagedConnector + updateConnectorLogs(input: LogsConnectorStatusInput!): ID! + updateConnectorHealth(input: HealthConnectorStatusInput!): ID! + updateConnectorTrigger(id: ID!, input: [EditInput]!): Connector + feedAdd(input: FeedAddInput!): Feed + feedDelete(id: ID!): ID! + feedEdit(id: ID!, input: FeedAddInput!): Feed! + taxiiCollectionAdd(input: TaxiiCollectionAddInput!): TaxiiCollection + taxiiCollectionEdit(id: ID!): TaxiiCollectionEditMutations + streamCollectionAdd(input: StreamCollectionAddInput!): StreamCollection + streamCollectionEdit(id: ID!): StreamCollectionEditMutations + stixEdit(id: ID!): StixEditMutations + markingDefinitionAdd(input: MarkingDefinitionAddInput!): MarkingDefinition + markingDefinitionEdit(id: ID!): MarkingDefinitionEditMutations + labelAdd(input: LabelAddInput!): Label + labelEdit(id: ID!): LabelEditMutations + externalReferenceAdd(input: ExternalReferenceAddInput!): ExternalReference + externalReferenceEdit(id: ID!): ExternalReferenceEditMutations + killChainPhaseAdd(input: KillChainPhaseAddInput!): KillChainPhase + killChainPhaseEdit(id: ID!): KillChainPhaseEditMutations + stixCoreObjectEdit(id: ID!): StixCoreObjectEditMutations + stixCoreObjectsExportAsk(input: StixCoreObjectsExportAskInput!): [File!] + stixCoreObjectsExportPush(entity_id: String, entity_type: String!, file: Upload!, file_markings: [String]!, listFilters: String): Boolean + stixBundlePush(connectorId: String!, bundle: String!, work_id: String): Boolean + stixDomainObjectAdd(input: StixDomainObjectAddInput!): StixDomainObject + stixDomainObjectEdit(id: ID!): StixDomainObjectEditMutations + stixDomainObjectsExportAsk(format: String!, exportType: String!, contentMaxMarkings: [String], fileMarkings: [String], search: String, exportContext: ExportContext, relationship_type: [String], orderBy: StixDomainObjectsOrdering, pirId: ID, orderMode: OrderingMode, filters: FilterGroup, selectedIds: [String]): [File!] + stixDomainObjectsDelete(id: [ID]!): [ID]! + stixDomainObjectsExportPush(entity_id: String, entity_type: String!, file: Upload!, file_markings: [String]!, listFilters: String): Boolean + attackPatternAdd(input: AttackPatternAddInput!): AttackPattern + attackPatternEdit(id: ID!): AttackPatternEditMutations + campaignAdd(input: CampaignAddInput!): Campaign + campaignEdit(id: ID!): CampaignEditMutations + containerEdit(id: ID!): ContainerEditMutations + noteAdd(input: NoteAddInput!): Note + userNoteAdd(input: NoteUserAddInput!): Note + noteEdit(id: ID!): NoteEditMutations + observedDataAdd(input: ObservedDataAddInput!): ObservedData + observedDataEdit(id: ID!): ObservedDataEditMutations + opinionAdd(input: OpinionAddInput!): Opinion + userOpinionAdd(input: OpinionUserAddInput!): Opinion + opinionEdit(id: ID!): OpinionEditMutations + reportAdd(input: ReportAddInput!): Report + reportEdit(id: ID!): ReportEditMutations + courseOfActionAdd(input: CourseOfActionAddInput!): CourseOfAction + courseOfActionEdit(id: ID!): CourseOfActionEditMutations + identityAdd(input: IdentityAddInput!): Identity + identityEdit(id: ID!): IdentityEditMutations + individualAdd(input: IndividualAddInput!): Individual + individualEdit(id: ID!): IndividualEditMutations + sectorAdd(input: SectorAddInput!): Sector + sectorEdit(id: ID!): SectorEditMutations + systemAdd(input: SystemAddInput!): System + systemEdit(id: ID!): SystemEditMutations + infrastructureAdd(input: InfrastructureAddInput!): Infrastructure + infrastructureEdit(id: ID!): InfrastructureEditMutations + intrusionSetAdd(input: IntrusionSetAddInput!): IntrusionSet + intrusionSetEdit(id: ID!): IntrusionSetEditMutations + locationAdd(input: LocationAddInput!): Location + locationEdit(id: ID!): LocationEditMutations + cityAdd(input: CityAddInput!): City + cityEdit(id: ID!): CityEditMutations + countryAdd(input: CountryAddInput!): Country + countryEdit(id: ID!): CountryEditMutations + regionAdd(input: RegionAddInput!): Region + regionEdit(id: ID!): RegionEditMutations + positionAdd(input: PositionAddInput!): Position + positionEdit(id: ID!): PositionEditMutations + malwareAdd(input: MalwareAddInput!): Malware + malwareEdit(id: ID!): MalwareEditMutations + threatActorGroupAdd(input: ThreatActorGroupAddInput!): ThreatActorGroup + threatActorGroupEdit(id: ID!): ThreatActorGroupEditMutations + toolAdd(input: ToolAddInput!): Tool + toolEdit(id: ID!): ToolEditMutations + vulnerabilityAdd(input: VulnerabilityAddInput!): Vulnerability + vulnerabilityEdit(id: ID!): VulnerabilityEditMutations + incidentAdd(input: IncidentAddInput!): Incident + incidentEdit(id: ID!): IncidentEditMutations + stixCyberObservableAdd(type: String!, stix_id: StixId, x_opencti_score: Int, x_opencti_description: String, x_opencti_modified_at: DateTime, createIndicator: Boolean, createdBy: String, objectMarking: [String], objectLabel: [String], objectOrganization: [String], externalReferences: [String], clientMutationId: String, update: Boolean, AutonomousSystem: AutonomousSystemAddInput, Directory: DirectoryAddInput, DomainName: DomainNameAddInput, EmailAddr: EmailAddrAddInput, EmailMessage: EmailMessageAddInput, EmailMimePartType: EmailMimePartTypeAddInput, Artifact: ArtifactAddInput, StixFile: StixFileAddInput, X509Certificate: X509CertificateAddInput, IPv4Addr: IPv4AddrAddInput, IPv6Addr: IPv6AddrAddInput, MacAddr: MacAddrAddInput, Mutex: MutexAddInput, NetworkTraffic: NetworkTrafficAddInput, Process: ProcessAddInput, Software: SoftwareAddInput, Url: UrlAddInput, UserAccount: UserAccountAddInput, WindowsRegistryKey: WindowsRegistryKeyAddInput, WindowsRegistryValueType: WindowsRegistryValueTypeAddInput, CryptographicKey: CryptographicKeyAddInput, CryptocurrencyWallet: CryptocurrencyWalletAddInput, Hostname: HostnameAddInput, Text: TextAddInput, UserAgent: UserAgentAddInput, BankAccount: BankAccountAddInput, Credential: CredentialAddInput, TrackingNumber: TrackingNumberAddInput, PhoneNumber: PhoneNumberAddInput, PaymentCard: PaymentCardAddInput, MediaContent: MediaContentAddInput, Persona: PersonaAddInput, SSHKey: SSHKeyAddInput): StixCyberObservable + stixCyberObservableEdit(id: ID!): StixCyberObservableEditMutations + stixCyberObservablesExportAsk(input: StixCyberObservablesExportAskInput!): [File!] + stixCyberObservablesExportPush(entity_id: String, entity_type: String!, file: Upload!, file_markings: [String]!, listFilters: String): Boolean + artifactImport(file: Upload!, x_opencti_description: String, createdBy: String, objectMarking: [String], objectLabel: [String]): Artifact + stixRelationshipEdit(id: ID!): StixRelationshipEditMutations + stixCoreRelationshipAdd(input: StixCoreRelationshipAddInput, reversedReturn: Boolean): StixCoreRelationship + stixCoreRelationshipEdit(id: ID!): StixCoreRelationshipEditMutations + stixCoreRelationshipsExportAsk(input: StixCoreRelationshipsExportAskInput!): [File!] + stixCoreRelationshipDelete(fromId: StixRef!, toId: StixRef!, relationship_type: String!): Boolean! + stixCoreRelationshipsExportPush(entity_id: String, entity_type: String!, file: Upload!, file_markings: [String]!, listFilters: String): Boolean + stixRefRelationshipAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + stixRefRelationshipEdit(id: ID!): StixRefRelationshipEditMutations + stixSightingRelationshipAdd(input: StixSightingRelationshipAddInput!): StixSightingRelationship + stixSightingRelationshipEdit(id: ID!): StixSightingRelationshipEditMutations + channelAdd(input: ChannelAddInput!): Channel + channelDelete(id: ID!): ID + channelFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): Channel + channelContextPatch(id: ID!, input: EditContext!): Channel + channelContextClean(id: ID!): Channel + channelRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + channelRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): Channel + languageAdd(input: LanguageAddInput!): Language + languageDelete(id: ID!): ID + languageFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): Language + languageContextPatch(id: ID!, input: EditContext!): Language + languageContextClean(id: ID!): Language + languageRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + languageRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): Language + eventAdd(input: EventAddInput!): Event + eventDelete(id: ID!): ID + eventFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): Event + eventContextPatch(id: ID!, input: EditContext!): Event + eventContextClean(id: ID!): Event + eventRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + eventRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): Event + groupingAdd(input: GroupingAddInput!): Grouping + groupingDelete(id: ID!): ID + groupingFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): Grouping + groupingContextPatch(id: ID!, input: EditContext): Grouping + groupingContextClean(id: ID!): Grouping + groupingRelationAdd(id: ID!, input: StixRefRelationshipAddInput): StixRefRelationship + groupingRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): Grouping + narrativeAdd(input: NarrativeAddInput!): Narrative + narrativeDelete(id: ID!): ID + narrativeFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): Narrative + narrativeContextPatch(id: ID!, input: EditContext!): Narrative + narrativeContextClean(id: ID!): Narrative + narrativeRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + narrativeRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): Narrative + triggerKnowledgeDelete(id: ID!): ID + triggerKnowledgeFieldPatch(id: ID!, input: [EditInput!]!): Trigger + triggerKnowledgeLiveAdd(input: TriggerLiveAddInput!): Trigger + triggerKnowledgeDigestAdd(input: TriggerDigestAddInput!): Trigger + triggerActivityDelete(id: ID!): ID + triggerActivityFieldPatch(id: ID!, input: [EditInput!]!): Trigger + triggerActivityLiveAdd(input: TriggerActivityLiveAddInput!): Trigger + triggerActivityDigestAdd(input: TriggerActivityDigestAddInput!): Trigger + notificationDelete(id: ID!): ID + notificationMarkRead(id: ID!, read: Boolean!): Notification + dataComponentAdd(input: DataComponentAddInput!): DataComponent + dataComponentDelete(id: ID!): ID + dataComponentFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): DataComponent + dataComponentContextPatch(id: ID!, input: EditContext!): DataComponent + dataComponentContextClean(id: ID!): DataComponent + dataComponentRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + dataComponentRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): DataComponent + dataSourceAdd(input: DataSourceAddInput!): DataSource + dataSourceDelete(id: ID!): ID + dataSourceFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): DataSource + dataSourceContextPatch(id: ID!, input: EditContext!): DataSource + dataSourceContextClean(id: ID!): DataSource + dataSourceRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + dataSourceRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): DataSource + dataSourceDataComponentAdd(id: ID!, dataComponentId: ID!): DataSource + dataSourceDataComponentDelete(id: ID!, dataComponentId: ID!): DataSource + vocabularyAdd(input: VocabularyAddInput!): Vocabulary + vocabularyFieldPatch(id: ID!, input: [EditInput!]!): Vocabulary + vocabularyDelete(id: ID!): ID + administrativeAreaAdd(input: AdministrativeAreaAddInput!): AdministrativeArea + administrativeAreaDelete(id: ID!): ID + administrativeAreaFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): AdministrativeArea + administrativeAreaContextPatch(id: ID!, input: EditContext!): AdministrativeArea + administrativeAreaContextClean(id: ID!): AdministrativeArea + administrativeAreaRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + administrativeAreaRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): AdministrativeArea + taskAdd(input: TaskAddInput!): Task + taskDelete(id: ID!): ID + taskFieldPatch(id: ID!, input: [EditInput!]!, commitMessage: String, references: [String]): Task + taskRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + taskRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): Task + taskTemplateAdd(input: TaskTemplateAddInput!): TaskTemplate + taskTemplateDelete(id: ID!): ID + taskTemplateFieldPatch(id: ID!, input: [EditInput!]!, commitMessage: String, references: [String]): TaskTemplate + caseDelete(id: ID!): ID + caseSetTemplate(id: ID!, caseTemplatesId: [ID!]!): Case + caseTemplateAdd(input: CaseTemplateAddInput!): CaseTemplate + caseTemplateDelete(id: ID!): ID + caseTemplateFieldPatch(id: ID!, input: [EditInput!]!, commitMessage: String, references: [String]): CaseTemplate + caseTemplateRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): CaseTemplate + caseTemplateRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): CaseTemplate + caseIncidentAdd(input: CaseIncidentAddInput!): CaseIncident + caseIncidentDelete(id: ID!): ID + caseRfiAdd(input: CaseRfiAddInput!): CaseRfi + caseRfiDelete(id: ID!): ID + caseRfiApprove(id: ID!): CaseRfi + caseRfiDecline(id: ID!): CaseRfi + caseRftAdd(input: CaseRftAddInput!): CaseRft + caseRftDelete(id: ID!): ID + feedbackAdd(input: FeedbackAddInput!): Feedback + feedbackDelete(id: ID!): ID + feedbackEditAuthorizedMembers(id: ID!, input: [MemberAccessInput!]): Feedback + entitySettingsFieldPatch(ids: [ID!]!, input: [EditInput!]!, commitMessage: String, references: [String]): [EntitySetting] + workspaceAdd(input: WorkspaceAddInput!): Workspace + workspaceDuplicate(input: WorkspaceDuplicateInput!): Workspace + workspaceDelete(id: ID!): ID + workspaceFieldPatch(id: ID!, input: [EditInput!]!): Workspace + workspaceEditAuthorizedMembers(id: ID!, input: [MemberAccessInput!]!): Workspace + workspaceContextPatch(id: ID!, input: EditContext!): Workspace + workspaceContextClean(id: ID!): Workspace + workspaceConfigurationImport(file: Upload!): String! + workspaceWidgetConfigurationImport(id: ID!, input: ImportConfigurationInput!): Workspace + malwareAnalysisAdd(input: MalwareAnalysisAddInput!): MalwareAnalysis + malwareAnalysisDelete(id: ID!): ID + malwareAnalysisFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): MalwareAnalysis + malwareAnalysisContextPatch(id: ID!, input: EditContext!): MalwareAnalysis + malwareAnalysisContextClean(id: ID!): MalwareAnalysis + malwareAnalysisRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + malwareAnalysisRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): MalwareAnalysis + managerConfigurationFieldPatch(id: ID!, input: [EditInput!]!, commitMessage: String, references: [String]): ManagerConfiguration + notifierDelete(id: ID!): ID + notifierFieldPatch(id: ID!, input: [EditInput!]!): Notifier + notifierAdd(input: NotifierAddInput!): Notifier + threatActorIndividualAdd(input: ThreatActorIndividualAddInput!): ThreatActorIndividual + threatActorIndividualDelete(id: ID!): ID + threatActorIndividualFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): ThreatActorIndividual + threatActorIndividualContextPatch(id: ID!, input: EditContext): ThreatActorIndividual + threatActorIndividualContextClean(id: ID!): ThreatActorIndividual + threatActorIndividualRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + threatActorIndividualRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): ThreatActorIndividual + playbookAdd(input: PlaybookAddInput!): Playbook + playbookAddNode(id: ID!, input: PlaybookAddNodeInput!): String! + playbookReplaceNode(id: ID!, nodeId: ID!, input: PlaybookAddNodeInput!): String! + playbookInsertNode(id: ID!, parentNodeId: ID!, parentPortId: ID!, childNodeId: ID!, input: PlaybookAddNodeInput!): PlaybookInsertResult! + playbookAddLink(id: ID!, input: PlaybookAddLinkInput!): String! + playbookDelete(id: ID!): ID + playbookDeleteNode(id: ID!, nodeId: ID!): Playbook + playbookDeleteLink(id: ID!, linkId: ID!): Playbook + playbookUpdatePositions(id: ID!, positions: String!): ID + playbookImport(file: Upload!): String! + playbookDuplicate(id: ID!): String! + playbookFieldPatch(id: ID!, input: [EditInput!]!, commitMessage: String, references: [String]): Playbook + playbookStepExecution(execution_id: ID!, event_id: ID!, execution_start: DateTime!, data_instance_id: ID!, playbook_id: ID!, previous_step_id: ID!, step_id: ID!, previous_bundle: String!, bundle: String!): Boolean + playbookExecute(id: ID!, entityId: String!): Boolean + ingestionRssAdd(input: IngestionRssAddInput!): IngestionRss + ingestionRssDelete(id: ID!): ID + ingestionRssFieldPatch(id: ID!, input: [EditInput!]!): IngestionRss + ingestionTaxiiAdd(input: IngestionTaxiiAddInput!): IngestionTaxii + ingestionTaxiiDelete(id: ID!): ID + ingestionTaxiiResetState(id: ID!): IngestionTaxii + ingestionTaxiiFieldPatch(id: ID!, input: [EditInput!]!): IngestionTaxii + ingestionTaxiiAddAutoUser(id: ID!, input: IngestionTaxiiAddAutoUserInput!): IngestionTaxii + ingestionTaxiiCollectionAdd(input: IngestionTaxiiCollectionAddInput!): IngestionTaxiiCollection + ingestionTaxiiCollectionDelete(id: ID!): ID + ingestionTaxiiCollectionFieldPatch(id: ID!, input: [EditInput!]!): IngestionTaxiiCollection + ingestionCsvTester(input: IngestionCsvAddInput!): CsvMapperTestResult + ingestionCsvAdd(input: IngestionCsvAddInput!): IngestionCsv + ingestionCsvResetState(id: ID!): IngestionCsv + ingestionCsvDelete(id: ID!): ID + ingestionCsvFieldPatch(id: ID!, input: [EditInput!]!): IngestionCsv + ingestionCsvAddAutoUser(id: ID!, input: IngestionCsvAddAutoUserInput!): IngestionCsv + ingestionJsonTester(input: IngestionJsonAddInput!): JsonMapperTestResult + ingestionJsonAdd(input: IngestionJsonAddInput!): IngestionJson + ingestionJsonResetState(id: ID!): IngestionJson + ingestionJsonDelete(id: ID!): ID + ingestionJsonFieldPatch(id: ID!, input: [EditInput!]!): IngestionJson + ingestionJsonEdit(id: ID!, input: IngestionJsonAddInput!): IngestionJson + indicatorAdd(input: IndicatorAddInput!): Indicator + indicatorDelete(id: ID!): ID + indicatorFieldPatch(id: ID!, input: [EditInput!]!, commitMessage: String, references: [String]): Indicator + indicatorContextPatch(id: ID!, input: EditContext): Indicator + indicatorContextClean(id: ID!): Indicator + indicatorRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + indicatorRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): Indicator + decayRuleAdd(input: DecayRuleAddInput!): DecayRule + decayRuleDelete(id: ID!): ID + decayRuleFieldPatch(id: ID!, input: [EditInput!]!): DecayRule + decayExclusionRuleAdd(input: DecayExclusionRuleAddInput!): DecayExclusionRule + decayExclusionRuleFieldPatch(id: ID!, input: [EditInput!]!): DecayExclusionRule + decayExclusionRuleDelete(id: ID!): ID + organizationAdd(input: OrganizationAddInput!): Organization + organizationDelete(id: ID!): ID + organizationFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): Organization + organizationContextPatch(id: ID!, input: EditContext!): Organization + organizationContextClean(id: ID!): Organization + organizationRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + organizationRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): Organization + organizationEditAuthorizedAuthorities(id: ID!, input: [String!]!): Organization + organizationAdminAdd(id: ID!, memberId: String!): Organization + organizationAdminRemove(id: ID!, memberId: String!): Organization + csvMapperAdd(input: CsvMapperAddInput!): CsvMapper + csvMapperTest(configuration: String!, file: Upload!): CsvMapperTestResult + csvMapperDelete(id: ID!): ID + csvMapperFieldPatch(id: ID!, input: [EditInput!]!): CsvMapper + jsonMapperAdd(input: JsonMapperAddInput!): JsonMapper + jsonMapperTest(configuration: String!, file: Upload!): JsonMapperTestResult + jsonMapperDelete(id: ID!): ID + jsonMapperImport(file: Upload!): String! + jsonMapperFieldPatch(id: ID!, input: [EditInput!]!): JsonMapper + publicDashboardAdd(input: PublicDashboardAddInput!): PublicDashboard + publicDashboardDelete(id: ID!): ID + publicDashboardFieldPatch(id: ID!, input: [EditInput!]!): PublicDashboard + themeAdd(input: ThemeAddInput!): Theme + themeDelete(id: ID!): ID + themeFieldPatch(id: ID!, input: [EditInput!]!): Theme + themeImport(file: Upload!): Theme + aiContainerGenerateReport(id: ID!, containerId: String!, paragraphs: Int, tone: Tone, format: Format, language: String): String + aiThreatGenerateReport(id: ID!, threatId: String!, paragraphs: Int, tone: Tone, format: Format): String + aiVictimGenerateReport(id: ID!, victimId: String!, paragraphs: Int, tone: Tone, format: Format): String + aiSummarizeFiles(id: ID!, elementId: String!, paragraphs: Int, tone: Tone, format: Format, language: String, fileIds: [String]): String + aiConvertFilesToStix(id: ID!, elementId: String!, fileIds: [String]): String + aiConvertIndicator(id: ID!, indicatorId: String!, format: IndicatorFormat!): String + aiImproveWriting(id: ID!, content: String!, format: Format): String + aiFixSpelling(id: ID!, content: String!, format: Format): String + aiMakeShorter(id: ID!, content: String!, format: Format): String + aiMakeLonger(id: ID!, content: String!, format: Format): String + aiChangeTone(id: ID!, content: String!, format: Format, tone: Tone): String + aiSummarize(id: ID!, content: String!, format: Format): String + aiExplain(id: ID!, content: String!): String + aiNLQ(search: String!): NLQResponse + deleteOperationRestore(id: ID!): ID + deleteOperationConfirm(id: ID!): ID + supportPackageAdd(input: SupportPackageAddInput!): SupportPackage + supportPackageForceZip(input: SupportPackageForceZipInput!): SupportPackage + supportPackageDelete(id: ID!): ID + exclusionListFileAdd(input: ExclusionListFileAddInput!): ExclusionList + exclusionListFieldPatch(id: ID!, input: [EditInput!], file: Upload): ExclusionList + exclusionListDelete(id: ID!): ID + draftWorkspaceAdd(input: DraftWorkspaceAddInput!): DraftWorkspace + draftWorkspaceValidate(id: ID!): Work + draftWorkspaceDelete(id: ID!): ID + draftWorkspaceEditAuthorizedMembers(id: ID!, input: [MemberAccessInput!]): DraftWorkspace + fintelTemplateAdd(input: FintelTemplateAddInput!): FintelTemplate + fintelTemplateDelete(id: ID!): ID + fintelTemplateFieldPatch(id: ID!, input: [EditInput!]!): FintelTemplate + fintelTemplateConfigurationImport(file: Upload!): FintelTemplate + disseminationListAdd(input: DisseminationListAddInput!): DisseminationList + disseminationListDelete(id: ID!): ID + disseminationListFieldPatch(id: ID!, input: [EditInput!]!): DisseminationList + disseminationListSend(id: ID!, input: DisseminationListSendInput!): Boolean + savedFilterAdd(input: SavedFilterAddInput!): SavedFilter + savedFilterDelete(id: ID!): ID + savedFilterFieldPatch(id: ID!, input: [EditInput!]): SavedFilter + requestAccessAdd(input: RequestAccessAddInput!): ID + requestAccessConfigure(input: RequestAccessConfigureInput!): RequestAccessConfiguration + pirAdd(input: PirAddInput!): Pir + pirFieldPatch(id: ID!, input: [EditInput!]!): Pir + pirEditAuthorizedMembers(id: ID!, input: [MemberAccessInput!]!): Pir + pirDelete(id: ID!): ID + pirFlagElement(id: ID!, input: PirFlagElementInput!): ID + pirUnflagElement(id: ID!, input: PirUnflagElementInput!): ID + fintelDesignAdd(input: FintelDesignAddInput!): FintelDesign + fintelDesignDelete(id: ID!): ID + fintelDesignFieldPatch(id: ID!, input: [EditInput!], file: Upload): FintelDesign + fintelDesignContextPatch(id: ID!, input: EditContext!): FintelDesign + securityPlatformAdd(input: SecurityPlatformAddInput!): SecurityPlatform + securityPlatformDelete(id: ID!): ID + securityPlatformFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): SecurityPlatform + securityPlatformContextPatch(id: ID!, input: EditContext!): SecurityPlatform + securityPlatformContextClean(id: ID!): SecurityPlatform + securityPlatformRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + securityPlatformRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): SecurityPlatform + securityCoverageAdd(input: SecurityCoverageAddInput!): SecurityCoverage + securityCoverageDelete(id: ID!): ID + securityCoverageFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): SecurityCoverage + securityCoverageContextPatch(id: ID!, input: EditContext!): SecurityCoverage + securityCoverageContextClean(id: ID!): SecurityCoverage + securityCoverageRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + securityCoverageRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): SecurityCoverage + askSendOtp(input: AskSendOtpInput!): String + verifyOtp(input: VerifyOtpInput!): VerifyOtp + verifyMfa(input: VerifyMfaInput!): Boolean + changePassword(input: ChangePasswordInput!): Boolean + emailTemplateAdd(input: EmailTemplateAddInput!): EmailTemplate + emailTemplateDelete(id: ID!): ID + emailTemplateFieldPatch(id: ID!, input: [EditInput!]!): EmailTemplate + emailTemplateTestSend(id: ID!): Boolean + formAdd(input: FormAddInput!): Form + formFieldPatch(id: ID!, input: [EditInput!]!): Form + formDelete(id: ID!): ID + formSubmit(input: FormSubmissionInput!, isDraft: Boolean! = false): FormSubmissionResponse + formImport(file: Upload!): Form + checkXTMHubConnectivity: CheckXTMHubConnectivityResponse! + autoRegisterOpenCTI(input: AutoRegisterInput!): Success! + contactUsXtmHub: Success! + metricPatch(id: ID!, input: PatchMetricInput!): BasicObject +} + +type Channel implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + channel_types: [String] + aliases: [String] + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +enum ChannelsOrdering { + name + channel_types + created + modified + created_at + updated_at + objectMarking + objectLabel + x_opencti_workflow_id + confidence + _score +} + +type ChannelConnection { + pageInfo: PageInfo! + edges: [ChannelEdge] +} + +type ChannelEdge { + cursor: String! + node: Channel! +} + +input ChannelAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + channel_types: [String] + aliases: [String] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +type Catalog implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String!]! + metrics: [Metric] + name: String! + description: String! + contracts: [String!]! +} + +type ExtendedContract { + catalog_id: String! + contract: String! +} + +enum CatalogsOrdering { + name + _score +} + +type CatalogConnection { + pageInfo: PageInfo! + edges: [CatalogEdge!]! +} + +type CatalogEdge { + cursor: String! + node: Catalog! +} + +type Language implements BasicObject & StixCoreObject & StixDomainObject & StixObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + aliases: [String] + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +enum LanguagesOrdering { + name + created + modified + created_at + updated_at + objectMarking + objectLabel + x_opencti_workflow_id + _score +} + +type LanguageConnection { + pageInfo: PageInfo! + edges: [LanguageEdge] +} + +type LanguageEdge { + cursor: String! + node: Language! +} + +input LanguageAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + aliases: [String] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + clientMutationId: String + x_opencti_workflow_id: String + x_opencti_modified_at: DateTime + update: Boolean +} + +type Event implements BasicObject & StixCoreObject & StixDomainObject & StixObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + event_types: [String] + start_time: DateTime + stop_time: DateTime + aliases: [String] + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +enum EventsOrdering { + name + event_types + created + modified + created_at + updated_at + objectMarking + objectLabel + x_opencti_workflow_id + start_time + stop_time + _score +} + +type EventConnection { + pageInfo: PageInfo! + edges: [EventEdge] +} + +type EventEdge { + cursor: String! + node: Event! +} + +input EventAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + event_types: [String!] + start_time: DateTime + stop_time: DateTime + aliases: [String] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + clientMutationId: String + x_opencti_workflow_id: String + x_opencti_modified_at: DateTime + update: Boolean + file: Upload +} + +type Grouping implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Container { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + authorized_members: [MemberAccess!] + authorized_members_activation_date: DateTime + currentUserAccessRight: String + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + relatedContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], viaTypes: [String]): ContainerConnection + name: String! + description: String + content: String + content_mapping: String + context: String! + x_opencti_aliases: [String] + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + filesFromTemplate(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + fintelTemplates: [FintelTemplate!] + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation + securityCoverage: SecurityCoverage +} + +enum GroupingsOrdering { + name + created + modified + context + created_at + updated_at + createdBy + objectMarking + x_opencti_workflow_id + creator + _score +} + +type GroupingConnection { + pageInfo: PageInfo! + edges: [GroupingEdge] +} + +type GroupingEdge { + cursor: String! + node: Grouping! +} + +input GroupingAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + content: String + content_mapping: String + + "*Constraints:*\n* Minimal length: `2`\n" + context: String! + x_opencti_aliases: [String] + revoked: Boolean + lang: String + confidence: Int + createdBy: String + objectMarking: [String] + objectLabel: [String] + objectOrganization: [String] + externalReferences: [String] + objects: [String] + created: DateTime + modified: DateTime + clientMutationId: String + x_opencti_workflow_id: String + x_opencti_modified_at: DateTime + update: Boolean + file: Upload + authorized_members: [MemberAccessInput!] +} + +type Narrative implements BasicObject & StixCoreObject & StixDomainObject & StixObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + narrative_types: [String] + aliases: [String] + parentNarratives: NarrativeConnection + subNarratives: NarrativeConnection + isSubNarrative: Boolean + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +enum NarrativesOrdering { + name + narrative_types + created + modified + created_at + updated_at + objectMarking + objectLabel + x_opencti_workflow_id + _score +} + +type NarrativeConnection { + pageInfo: PageInfo! + edges: [NarrativeEdge!]! +} + +type NarrativeEdge { + cursor: String! + node: Narrative! +} + +input NarrativeAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + narrative_types: [String!] + aliases: [String] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + clientMutationId: String + update: Boolean + file: Upload + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String +} + +type ResolvedInstanceFilter { + id: String! + valid: Boolean! + value: String +} + +enum DigestPeriod { + hour + day + week + month +} + +enum TriggersOrdering { + name + created + event_types + trigger_type + notifiers + _score +} + +enum TriggerType { + live + digest +} + +enum TriggerEventType { + create + update + delete +} + +input TriggerLiveAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + event_types: [TriggerEventType!]! + notifiers: [StixRef!] + instance_trigger: Boolean! + filters: String + recipients: [String!] +} + +input TriggerDigestAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + trigger_ids: [String!]! + period: DigestPeriod! + trigger_time: String + notifiers: [StixRef!]! + recipients: [String!] +} + +type Trigger implements InternalObject & BasicObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + created: DateTime + modified: DateTime + created_at: DateTime + updated_at: DateTime + refreshed_at: DateTime + name: String! + description: String + trigger_type: TriggerType! + event_types: [String!] + filters: String + notifiers: [Notifier!] + trigger_ids: [String] + triggers: [Trigger] + recipients: [Member!] + period: DigestPeriod + trigger_time: String + isDirectAdministrator: Boolean + currentUserAccessRight: String + instance_trigger: Boolean +} + +type TriggerConnection { + pageInfo: PageInfo! + edges: [TriggerEdge!]! +} + +type TriggerEdge { + cursor: String! + node: Trigger! +} + +enum TriggerActivityEventType { + authentication + read + mutation + file + command +} + +input TriggerActivityLiveAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + notifiers: [StixRef!] + filters: String + recipients: [String!]! +} + +input TriggerActivityDigestAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + trigger_ids: [String!]! + period: DigestPeriod! + trigger_time: String + notifiers: [StixRef!]! + recipients: [String!]! +} + +enum NotificationsOrdering { + name + created + _score +} + +type NotificationCount { + user_id: String + count: Int +} + +type NotificationEvent { + message: String! + instance_id: String + operation: String! +} + +type NotificationContent { + title: String! + events: [NotificationEvent!]! +} + +type Notification implements InternalObject & BasicObject { + id: ID! + standard_id: String! + entity_type: String! + created: DateTime + name: String! + notification_type: String! + parent_types: [String]! + metrics: [Metric] + notification_content: [NotificationContent!]! + is_read: Boolean! + user_id: String + created_at: DateTime + updated_at: DateTime + refreshed_at: DateTime +} + +type NotificationConnection { + pageInfo: PageInfo! + edges: [NotificationEdge] +} + +type NotificationEdge { + cursor: String! + node: Notification! +} + +type DataComponent implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation + name: String! + description: String + aliases: [String] + dataSource: DataSource + attackPatterns: AttackPatternConnection +} + +enum DataComponentsOrdering { + name + created + modified + created_at + updated_at + x_opencti_workflow_id + confidence + _score +} + +type DataComponentConnection { + pageInfo: PageInfo! + edges: [DataComponentEdge] +} + +type DataComponentEdge { + cursor: String! + node: DataComponent! +} + +input DataComponentAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectLabel: [String] + objectOrganization: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + clientMutationId: String + update: Boolean + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + aliases: [String] + dataSource: String + file: Upload + x_opencti_workflow_id: String + x_opencti_modified_at: DateTime +} + +type DataSource implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation + name: String! + description: String + aliases: [String] + x_mitre_platforms: [String!] + collection_layers: [String!] + dataComponents: DataComponentConnection +} + +enum DataSourcesOrdering { + name + created + modified + created_at + updated_at + x_opencti_workflow_id + confidence + _score +} + +type DataSourceConnection { + pageInfo: PageInfo! + edges: [DataSourceEdge] +} + +type DataSourceEdge { + cursor: String! + node: DataSource! +} + +input DataSourceAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectLabel: [String] + objectOrganization: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + clientMutationId: String + update: Boolean + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + aliases: [String] + x_mitre_platforms: [String!] + collection_layers: [String!] + dataComponents: [String] + file: Upload + x_opencti_workflow_id: String + x_opencti_modified_at: DateTime +} + +enum VocabularyCategory { + account_type_ov + attack_motivation_ov + attack_resource_level_ov + case_severity_ov + case_priority_ov + channel_types_ov + collection_layers_ov + event_type_ov + grouping_context_ov + implementation_language_ov + incident_response_types_ov + incident_type_ov + incident_severity_ov + indicator_type_ov + infrastructure_type_ov + integrity_level_ov + malware_capabilities_ov + malware_result_ov + malware_type_ov + platforms_ov + opinion_ov + organization_type_ov + pattern_type_ov + permissions_ov + processor_architecture_ov + reliability_ov + report_types_ov + request_for_information_types_ov + request_for_takedown_types_ov + security_platform_type_ov + service_status_ov + service_type_ov + start_type_ov + key_type_ov + threat_actor_group_type_ov + threat_actor_group_role_ov + threat_actor_group_sophistication_ov + threat_actor_individual_type_ov + threat_actor_individual_role_ov + threat_actor_individual_sophistication_ov + tool_types_ov + note_types_ov + gender_ov + marital_status_ov + hair_color_ov + eye_color_ov + persona_type_ov + coverage_ov +} + +type VocabularyFieldDefinition { + key: String! + required: Boolean! + multiple: Boolean! +} + +type VocabularyDefinition { + key: VocabularyCategory! + description: String + entity_types: [String!]! + fields: [VocabularyFieldDefinition!]! +} + +type Vocabulary implements BasicObject & StixObject & StixMetaObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + creators: [Creator!] + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + created: DateTime + modified: DateTime + category: VocabularyDefinition! + name: String! + description: String + usages: Int! + aliases: [String!] + builtIn: Boolean + is_hidden: Boolean + order: Int +} + +enum VocabularyOrdering { + name + category + description + order + _score +} + +type VocabularyConnection { + pageInfo: PageInfo! + edges: [VocabularyEdge!]! +} + +type VocabularyEdge { + cursor: String! + node: Vocabulary! +} + +input VocabularyAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `1`\n* Must match format: `not-blank`\n" + name: String! + description: String + category: VocabularyCategory! + order: Int + created: DateTime + modified: DateTime + aliases: [String!] + update: Boolean +} + +type AdministrativeArea implements BasicObject & StixCoreObject & StixDomainObject & StixObject & Location { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + latitude: Float + longitude: Float + precision: Float + x_opencti_aliases: [String] + cases(first: Int): CaseConnection + country: Country + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +enum AdministrativeAreasOrdering { + name + created + modified + created_at + updated_at + objectMarking + objectLabel + x_opencti_workflow_id + _score +} + +type AdministrativeAreaConnection { + pageInfo: PageInfo! + edges: [AdministrativeAreaEdge!] +} + +type AdministrativeAreaEdge { + cursor: String! + node: AdministrativeArea! +} + +input AdministrativeAreaAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + latitude: Float + longitude: Float + x_opencti_aliases: [String] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + clientMutationId: String + x_opencti_workflow_id: String + x_opencti_modified_at: DateTime + update: Boolean + file: Upload +} + +type Task implements Container & StixDomainObject & StixCoreObject & StixObject & BasicObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + authorized_members: [MemberAccess!] + authorized_members_activation_date: DateTime + currentUserAccessRight: String + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + relatedContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], viaTypes: [String]): ContainerConnection + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + filesFromTemplate(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + fintelTemplates: [FintelTemplate!] + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation + name: String! + description: String + due_date: DateTime + content_mapping: String +} + +enum TasksOrdering { + name + description + created + modified + context + created_at + updated_at + creator + createdBy + x_opencti_workflow_id + confidence + due_date + objectAssignee + _score +} + +type TaskEdge { + cursor: String! + node: Task! +} + +type TaskConnection { + pageInfo: PageInfo! + edges: [TaskEdge!]! +} + +input TaskAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + created: DateTime + due_date: DateTime + objectAssignee: [String] + objectParticipant: [String] + objectLabel: [String] + objectMarking: [String] + objectOrganization: [String] + createdBy: String + objects: [String] + x_opencti_workflow_id: String + x_opencti_modified_at: DateTime + update: Boolean +} + +type TaskTemplate implements InternalObject & BasicObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + created: DateTime + modified: DateTime + name: String! + description: String +} + +enum TaskTemplatesOrdering { + name + description + created + modified + created_at + updated_at + creator + _score +} + +type TaskTemplateConnection { + pageInfo: PageInfo! + edges: [TaskTemplateEdge!]! +} + +type TaskTemplateEdge { + cursor: String! + node: TaskTemplate! +} + +input TaskTemplateAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String +} + +interface Case implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Container { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + authorized_members: [MemberAccess!] + authorized_members_activation_date: DateTime + currentUserAccessRight: String + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + relatedContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], viaTypes: [String]): ContainerConnection + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + filesFromTemplate(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + fintelTemplates: [FintelTemplate!] + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation + name: String! + description: String + content: String + content_mapping: String + tasks: TaskConnection! +} + +enum CasesOrdering { + name + created + modified + context + created_at + updated_at + creator + createdBy + x_opencti_workflow_id + confidence + objectMarking + _score +} + +type CaseConnection { + pageInfo: PageInfo! + edges: [CaseEdge] +} + +type CaseEdge { + cursor: String! + node: Case! +} + +type CaseTemplate implements InternalObject & BasicObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + created: DateTime + modified: DateTime + name: String! + description: String + tasks: TaskTemplateConnection! +} + +enum CaseTemplatesOrdering { + name + description + created + _score +} + +type CaseTemplateConnection { + pageInfo: PageInfo! + edges: [CaseTemplateEdge!]! +} + +type CaseTemplateEdge { + cursor: String! + node: CaseTemplate! +} + +input CaseTemplateAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + created: DateTime + tasks: [StixRef!]! +} + +type CaseIncident implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Container & Case { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + authorized_members: [MemberAccess!] + authorized_members_activation_date: DateTime + currentUserAccessRight: String + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + relatedContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], viaTypes: [String]): ContainerConnection + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + filesFromTemplate(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + fintelTemplates: [FintelTemplate!] + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation + securityCoverage: SecurityCoverage + name: String! + description: String + content: String + content_mapping: String + tasks: TaskConnection! + rating: Int + response_types: [String!] + severity: String + priority: String +} + +enum CaseIncidentsOrdering { + name + created + modified + context + severity + priority + created_at + updated_at + creator + createdBy + objectAssignee + x_opencti_workflow_id + confidence + objectMarking + _score +} + +type CaseIncidentConnection { + pageInfo: PageInfo! + edges: [CaseIncidentEdge] +} + +type CaseIncidentEdge { + cursor: String! + node: CaseIncident! +} + +input CaseIncidentAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + severity: String + priority: String + description: String + content: String + content_mapping: String + confidence: Int + revoked: Boolean + lang: String + objects: [String] + createdBy: String + objectMarking: [String] + objectAssignee: [String] + objectParticipant: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + response_types: [String!] + caseTemplates: [String!] + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + file: Upload + clientMutationId: String + update: Boolean + authorized_members: [MemberAccessInput!] +} + +type RfiRequestAccessConfiguration { + configuration: RequestAccessConfiguration + isUserCanAction: Boolean! +} + +type CaseRfi implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Container & Case { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + pirInformation(pirId: ID!): PirInformation + authorized_members: [MemberAccess!] + authorized_members_activation_date: DateTime + currentUserAccessRight: String + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + relatedContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], viaTypes: [String]): ContainerConnection + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + filesFromTemplate(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + fintelTemplates: [FintelTemplate!] + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + name: String! + description: String + content: String + content_mapping: String + tasks: TaskConnection! + information_types: [String!] + severity: String + priority: String + x_opencti_request_access: String + requestAccessConfiguration: RfiRequestAccessConfiguration + x_opencti_workflow_id: String +} + +enum CaseRfisOrdering { + name + created + modified + created_at + updated_at + creator + createdBy + objectAssignee + x_opencti_workflow_id + confidence + objectMarking + severity + priority + _score +} + +type CaseRfiConnection { + pageInfo: PageInfo! + edges: [CaseRfiEdge] +} + +type CaseRfiEdge { + cursor: String! + node: CaseRfi! +} + +input CaseRfiAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + content: String + content_mapping: String + severity: String + priority: String + confidence: Int + revoked: Boolean + lang: String + objects: [String] + createdBy: String + objectMarking: [String] + objectAssignee: [String] + objectParticipant: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + file: Upload + clientMutationId: String + update: Boolean + information_types: [String!] + caseTemplates: [String!] + authorized_members: [MemberAccessInput!] + x_opencti_request_access: String +} + +type CaseRft implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Container & Case { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + pirInformation(pirId: ID!): PirInformation + authorized_members: [MemberAccess!] + authorized_members_activation_date: DateTime + currentUserAccessRight: String + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + relatedContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], viaTypes: [String]): ContainerConnection + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + filesFromTemplate(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + fintelTemplates: [FintelTemplate!] + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + name: String! + description: String + content: String + content_mapping: String + tasks: TaskConnection! + takedown_types: [String!] + severity: String + priority: String +} + +enum CaseRftsOrdering { + name + created + modified + context + created_at + updated_at + creator + createdBy + objectAssignee + x_opencti_workflow_id + confidence + objectMarking + severity + priority + _score +} + +type CaseRftConnection { + pageInfo: PageInfo! + edges: [CaseRftEdge] +} + +type CaseRftEdge { + cursor: String! + node: CaseRft! +} + +input CaseRftAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + content: String + content_mapping: String + severity: String + priority: String + confidence: Int + revoked: Boolean + lang: String + objects: [String] + createdBy: String + objectMarking: [String] + objectAssignee: [String] + objectParticipant: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + file: Upload + clientMutationId: String + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + update: Boolean + takedown_types: [String!] + caseTemplates: [String!] + authorized_members: [MemberAccessInput!] +} + +type Feedback implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Container & Case { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + authorized_members: [MemberAccess!] + authorized_members_activation_date: DateTime + currentUserAccessRight: String + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + relatedContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], viaTypes: [String]): ContainerConnection + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + filesFromTemplate(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + fintelTemplates: [FintelTemplate!] + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation + name: String! + description: String + content: String + content_mapping: String + tasks: TaskConnection! + rating: Int +} + +enum FeedbacksOrdering { + name + created + modified + context + rating + created_at + updated_at + creator + createdBy + x_opencti_workflow_id + confidence + objectMarking + _score +} + +type FeedbackConnection { + pageInfo: PageInfo! + edges: [FeedbackEdge] +} + +type FeedbackEdge { + cursor: String! + node: Feedback! +} + +input FeedbackAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + content: String + content_mapping: String + confidence: Int + revoked: Boolean + lang: String + objects: [String] + createdBy: String + objectMarking: [String] + objectAssignee: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + x_opencti_modified_at: DateTime + file: Upload + clientMutationId: String + update: Boolean + rating: Int +} + +type DefaultValue { + id: String! + name: String! +} + +type TypeAttribute { + name: String! + type: String! + mandatory: Boolean! + mandatoryType: String! + editDefault: Boolean! + multiple: Boolean + upsert: Boolean! + label: String + defaultValues: [DefaultValue!] + scale: String +} + +type ScaleAttribute { + name: String! + scale: String! +} + +type DefaultValueAttribute { + name: String! + type: String! + defaultValues: [DefaultValue!]! +} + +type OverviewWidgetCustomization { + key: String! + width: Int! + label: String! +} + +type EntitySetting implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String!]! + metrics: [Metric] + target_type: String! + platform_entity_files_ref: Boolean + platform_hidden_type: Boolean + enforce_reference: Boolean + attributes_configuration: String + attributesDefinitions: [TypeAttribute!]! + mandatoryAttributes: [String!]! + scaleAttributes: [ScaleAttribute!]! + defaultValuesAttributes: [DefaultValueAttribute!]! + availableSettings: [String!]! + created_at: DateTime! + updated_at: DateTime! + refreshed_at: DateTime + overview_layout_customization: [OverviewWidgetCustomization!] + fintelTemplates(first: Int, after: ID, orderBy: FintelTemplateOrdering, orderMode: OrderingMode, search: String): FintelTemplateConnection + requestAccessConfiguration: RequestAccessConfiguration +} + +enum EntitySettingsOrdering { + target_type + _score +} + +type EntitySettingConnection { + pageInfo: PageInfo! + edges: [EntitySettingEdge!]! +} + +type EntitySettingEdge { + cursor: String! + node: EntitySetting! +} + +type Workspace implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String!]! + metrics: [Metric] + type: String + name: String! + description: String + owner: Creator + tags: [String!] + manifest: String + created_at: DateTime + updated_at: DateTime + refreshed_at: DateTime + editContext: [EditUserContext!] + investigated_entities_ids: [String] + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + graph_data: String + authorizedMembers: [MemberAccess!]! + currentUserAccessRight: String + toStixReportBundle: String + toConfigurationExport: String! + toWidgetExport(widgetId: ID!): String! + isShared: Boolean +} + +enum WorkspacesOrdering { + name + created_at + updated_at + creator + _score +} + +type WorkspaceConnection { + pageInfo: PageInfo! + edges: [WorkspaceEdge!]! +} + +type WorkspaceEdge { + cursor: String! + node: Workspace! +} + +input WorkspaceAddInput { + type: String! + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + tags: [String!] + authorized_members: [MemberAccessInput!] + investigated_entities_ids: [String] +} + +input WorkspaceDuplicateInput { + type: String! + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + manifest: String + tags: [String!] +} + +input ImportConfigurationInput { + importType: String! + file: Upload! + dashboardManifest: String +} + +input ImportWidgetInput { + file: Upload! + dashboardManifest: String +} + +type MalwareAnalysis implements BasicObject & StixCoreObject & StixDomainObject & StixObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + x_opencti_inferences: [Inference] + draftVersion: DraftVersion + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation + product: String! + version: String + hostVm: Software + operatingSystem: Software + installedSoftware: SoftwareConnection + configuration_version: String + modules: [String!] + analysis_engine_version: String + analysis_definition_version: String + submitted: DateTime + analysis_started: DateTime + analysis_ended: DateTime + result_name: String! + result: String + analysisSco: StixCyberObservableConnection + sample: StixCyberObservable +} + +enum MalwareAnalysesOrdering { + result_name + product + operatingSystem + creator + createdBy + objectLabel + submitted + objectMarking + x_opencti_workflow_id + confidence + _score +} + +type MalwareAnalysisConnection { + pageInfo: PageInfo! + edges: [MalwareAnalysisEdge!] +} + +type MalwareAnalysisEdge { + cursor: String! + node: MalwareAnalysis! +} + +input MalwareAnalysisAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + product: String! + version: String + hostVm: String + operatingSystem: String + installedSoftware: [String] + configuration_version: String + modules: [String] + analysis_engine_version: String + analysis_definition_version: String + submitted: DateTime + analysis_started: DateTime + analysis_ended: DateTime + result_name: String! + result: String + analysisSco: [String] + analysisSample: String + created: DateTime + modified: DateTime + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectAssignee: [String] + externalReferences: [String] + objectOrganization: [String] + objectLabel: [String] + clientMutationId: String + x_opencti_workflow_id: String + x_opencti_modified_at: DateTime + update: Boolean + file: Upload +} + +type ManagerConfiguration implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String!]! + metrics: [Metric] + manager_id: String! + manager_running: Boolean + last_run_start_date: DateTime + last_run_end_date: DateTime + manager_setting: JSON +} + +enum NotifierOrdering { + name + created + connector + _score +} + +type NotifierParameter { + key: String + value: String +} + +type NotifierConnector { + id: ID! + name: String! + connector_type: String + connector_schema: String + connector_schema_ui: String + built_in: Boolean +} + +type Notifier implements InternalObject & BasicObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + created: DateTime + modified: DateTime + name: String! + description: String + notifier_connector: NotifierConnector! + notifier_connector_id: String! + notifier_configuration: String! + authorized_members: [MemberAccess!] +} + +type NotifierConnection { + pageInfo: PageInfo! + edges: [NotifierEdge] +} + +type NotifierEdge { + cursor: String! + node: Notifier! +} + +input NotifierTestInput { + notifier_test_id: String! + notifier_connector_id: String! + notifier_configuration: String! +} + +input NotifierAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + notifier_connector_id: String! + notifier_configuration: String! + authorized_members: [MemberAccessInput!] +} + +type Measure { + index: Int + measure: Float + date_seen: DateTime +} + +input MeasureInput { + measure: Float + date_seen: DateTime +} + +type ThreatActorIndividual implements BasicObject & StixObject & StixCoreObject & StixDomainObject & ThreatActor { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + aliases: [String] + threat_actor_types: [String] + first_seen: DateTime + last_seen: DateTime + roles: [String] + goals: [String] + sophistication: String + resource_level: String + primary_motivation: String + secondary_motivations: [String] + personal_motivations: [String] + locations: LocationConnection + countries: CountryConnection + date_of_birth: DateTime + gender: String + job_title: String + marital_status: String + eye_color: String + hair_color: String + height: [Measure!] + weight: [Measure!] + bornIn: Country + ethnicity: Country + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation + securityCoverage: SecurityCoverage +} + +enum ThreatActorsIndividualOrdering { + name + created + modified + created_at + updated_at + x_opencti_workflow_id + sophistication + resource_level + confidence + _score + objectMarking + threat_actor_types +} + +type ThreatActorIndividualConnection { + pageInfo: PageInfo! + edges: [ThreatActorIndividualEdge] +} + +type ThreatActorIndividualEdge { + cursor: String! + node: ThreatActorIndividual! +} + +input ThreatActorIndividualAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + aliases: [String] + threat_actor_types: [String] + first_seen: DateTime + last_seen: DateTime + roles: [String] + goals: [String] + sophistication: String + resource_level: String + primary_motivation: String + secondary_motivations: [String] + personal_motivations: [String] + date_of_birth: DateTime + gender: String + job_title: String + marital_status: String + eye_color: String + hair_color: String + height: [MeasureInput!] + weight: [MeasureInput!] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectOrganization: [String] + objectAssignee: [String] + objectLabel: [String] + bornIn: String + ethnicity: String + externalReferences: [String] + created: DateTime + modified: DateTime + clientMutationId: String + x_opencti_workflow_id: String + x_opencti_modified_at: DateTime + update: Boolean + file: Upload +} + +type PlayBookExecutionStep { + id: ID! + message: String + status: String + in_timestamp: String + out_timestamp: String + duration: Int + bundle_or_patch: String + error: String +} + +type PlayBookExecution { + id: ID! + playbook_id: ID! + execution_start: String + steps: [PlayBookExecutionStep!] +} + +type Playbook implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String!]! + metrics: [Metric] + name: String! + description: String + playbook_running: Boolean + playbook_definition: String + last_executions: [PlayBookExecution!] + queue_messages: Int! + toConfigurationExport: String! +} + +type PlaybookComponentPort { + id: ID! + type: String! +} + +type PlaybookComponent { + id: ID! + name: String! + description: String! + icon: String! + is_entry_point: Boolean + is_internal: Boolean + configuration_schema: String + ports: [PlaybookComponentPort!]! +} + +type PlaybookInsertResult { + nodeId: String! + linkId: String! +} + +enum PlaybooksOrdering { + name + playbook_running + _score +} + +type PlaybookConnection { + pageInfo: PageInfo! + edges: [PlaybookEdge!]! +} + +type PlaybookEdge { + cursor: String! + node: Playbook! +} + +input PlaybookAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String +} + +input PositionInput { + x: Float! + y: Float! +} + +input PlaybookAddNodeInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + component_id: String! + position: PositionInput! + configuration: String +} + +input PlaybookAddLinkInput { + from_node: String! + from_port: String! + to_node: String! +} + +type IngestionRss implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String!]! + metrics: [Metric] + created_at: DateTime + updated_at: DateTime + refreshed_at: DateTime + name: String! + description: String + scheduling_period: String + uri: String! + user: Creator + defaultCreatedBy: Identity + defaultMarkingDefinitions: [MarkingDefinition] + report_types: [String!] + current_state_date: DateTime + last_execution_date: DateTime + ingestion_running: Boolean +} + +enum IngestionRssOrdering { + name + created_at + updated_at + uri + _score +} + +type IngestionRssConnection { + pageInfo: PageInfo! + edges: [IngestionRssEdge!]! +} + +type IngestionRssEdge { + cursor: String! + node: IngestionRss! +} + +input IngestionRssAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + scheduling_period: String + + "*Constraints:*\n* Minimal length: `5`\n" + uri: String! + current_state_date: DateTime + ingestion_running: Boolean + user_id: String + created_by_ref: String + object_marking_refs: [String!] + report_types: [String!] +} + +enum TaxiiVersion { + v1 + v2 + v21 +} + +enum IngestionAuthType { + none + basic + bearer + certificate +} + +type IngestionTaxii implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String!]! + metrics: [Metric] + created_at: DateTime + updated_at: DateTime + refreshed_at: DateTime + name: String! + description: String + uri: String! + collection: String! + version: TaxiiVersion! + authentication_type: IngestionAuthType! + authentication_value: String + user_id: String + user: Creator + current_state_cursor: String + added_after_start: DateTime + ingestion_running: Boolean + last_execution_date: DateTime + confidence_to_score: Boolean + toConfigurationExport: String! +} + +enum IngestionTaxiiOrdering { + name + created_at + updated_at + uri + version + _score +} + +type IngestionTaxiiConnection { + pageInfo: PageInfo! + edges: [IngestionTaxiiEdge!]! +} + +type IngestionTaxiiEdge { + cursor: String! + node: IngestionTaxii! +} + +type TaxiiFeedAddInputFromImport { + name: String! + description: String! + uri: String! + version: String! + collection: String! + authentication_type: String! + authentication_value: String! + added_after_start: String +} + +input IngestionTaxiiAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + version: TaxiiVersion! + authentication_type: IngestionAuthType! + authentication_value: String + + "*Constraints:*\n* Minimal length: `5`\n" + uri: String! + + "*Constraints:*\n* Minimal length: `5`\n" + collection: String! + added_after_start: DateTime + ingestion_running: Boolean + confidence_to_score: Boolean + user_id: String! + automatic_user: Boolean + confidence_level: Int +} + +input IngestionTaxiiAddAutoUserInput { + user_name: String! + confidence_level: Int! +} + +type IngestionTaxiiCollection implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String!]! + metrics: [Metric] + created_at: DateTime + updated_at: DateTime + refreshed_at: DateTime + name: String! + ingestion_running: Boolean + confidence_to_score: Boolean + description: String + user_id: String + user: Creator + authorized_members: [MemberAccess!] +} + +enum IngestionTaxiiCollectionOrdering { + name + created_at + updated_at + _score +} + +type IngestionTaxiiCollectionConnection { + pageInfo: PageInfo! + edges: [IngestionTaxiiCollectionEdge!]! +} + +type IngestionTaxiiCollectionEdge { + cursor: String! + node: IngestionTaxiiCollection! +} + +input IngestionTaxiiCollectionAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + user_id: String + confidence_to_score: Boolean + authorized_members: [MemberAccessInput!]! +} + +type IngestionCsv implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String]! + metrics: [Metric] + created_at: DateTime + updated_at: DateTime + refreshed_at: DateTime + name: String! + description: String + scheduling_period: String + uri: String! + csv_mapper_type: IngestionCsvMapperType + csvMapper: CsvMapper! + authentication_type: IngestionAuthType! + authentication_value: String + user_id: String! + user: Creator + ingestion_running: Boolean + current_state_hash: String + current_state_date: DateTime + last_execution_date: DateTime + markings: [String!] + toConfigurationExport: String! + duplicateCsvMapper: CsvMapper! +} + +enum IngestionCsvOrdering { + name + created_at + updated_at + uri + mapper + _score +} + +enum IngestionCsvMapperType { + inline + id +} + +type IngestionCsvConnection { + pageInfo: PageInfo! + edges: [IngestionCsvEdge!]! +} + +type IngestionCsvEdge { + cursor: String! + node: IngestionCsv! +} + +type CSVFeedAddInputFromImport { + name: String! + description: String! + uri: String! + authentication_type: String! + markings: [String!]! + authentication_value: String! + csvMapper: CsvMapperAddInputFromImport! + csv_mapper_type: IngestionCsvMapperType + scheduling_period: String +} + +input IngestionCsvAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + scheduling_period: String + authentication_type: IngestionAuthType! + authentication_value: String + current_state_date: DateTime + + "*Constraints:*\n* Minimal length: `5`\n" + uri: String! + csv_mapper_id: String + csv_mapper: String + csv_mapper_type: IngestionCsvMapperType + ingestion_running: Boolean + user_id: String! + automatic_user: Boolean + confidence_level: Int + markings: [String!] +} + +input IngestionCsvAddAutoUserInput { + user_name: String! + confidence_level: Int! +} + +type IngestionHeader { + name: String! + value: String! +} + +type IngestionQueryAttribute { + type: String + from: String + to: String + data_operation: String + state_operation: String + default: String + exposed: String +} + +type IngestionJson implements InternalObject & BasicObject { + id: ID! + entity_type: String! + connector_id: String! + standard_id: String! + parent_types: [String]! + metrics: [Metric] + created_at: DateTime + updated_at: DateTime + refreshed_at: DateTime + name: String! + description: String + scheduling_period: String + uri: String! + verb: String! + body: String + pagination_with_sub_page: Boolean + pagination_with_sub_page_attribute_path: String + pagination_with_sub_page_query_verb: String + headers: [IngestionHeader!] + query_attributes: [IngestionQueryAttribute!] + jsonMapper: JsonMapper! + authentication_type: IngestionAuthType! + authentication_value: String + user_id: String! + user: Creator + ingestion_running: Boolean + last_execution_date: DateTime + markings: [String!] +} + +enum IngestionJsonOrdering { + name + created_at + updated_at + uri + mapper + _score +} + +type IngestionJsonConnection { + pageInfo: PageInfo! + edges: [IngestionJsonEdge!]! +} + +type IngestionJsonEdge { + cursor: String! + node: IngestionJson! +} + +input HeaderInput { + name: String! + value: String! +} + +input QueryAttribute { + type: String + from: String + to: String + data_operation: String + state_operation: String + default: String + exposed: String +} + +input IngestionJsonAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + scheduling_period: String + authentication_type: IngestionAuthType! + authentication_value: String + current_state_date: DateTime + + "*Constraints:*\n* Minimal length: `5`\n" + uri: String! + verb: String! + body: String + pagination_with_sub_page: Boolean + pagination_with_sub_page_attribute_path: String + pagination_with_sub_page_query_verb: String + headers: [HeaderInput!] + query_attributes: [QueryAttribute!] + json_mapper_id: String! + ingestion_running: Boolean + user_id: String! + markings: [String!] +} + +enum IndicatorsOrdering { + pattern_type + pattern_version + pattern + name + indicator_types + valid_from + valid_until + x_opencti_score + x_opencti_detection + confidence + created + modified + created_at + updated_at + x_opencti_workflow_id + objectMarking + creator + createdBy + _score +} + +type IndicatorConnection { + pageInfo: PageInfo! + edges: [IndicatorEdge] +} + +type IndicatorEdge { + cursor: String! + node: Indicator! +} + +type DecayHistory { + updated_at: DateTime! + refreshed_at: DateTime + score: Int! +} + +type IndicatorDecayRule { + decay_rule_id: String + decay_lifetime: Int! + decay_pound: Float! + decay_points: [Int!] + decay_revoke_score: Int! +} + +type IndicatorDecayExclusionRule { + decay_exclusion_id: String! + decay_exclusion_name: String! + decay_exclusion_created_at: DateTime! + decay_exclusion_filters: String! +} + +type DecayLiveDetails { + live_score: Int! + live_points: [DecayHistory!] +} + +type DecayChartData { + live_score_serie: [DecayHistory!] +} + +type ObservablesValues { + type: String + value: String + hashes: [Hash!] +} + +type Indicator implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + pattern_type: String + pattern_version: String + pattern: String + name: String! + description: String + indicator_types: [String] + valid_from: DateTime + valid_until: DateTime + x_opencti_score: Int + x_opencti_detection: Boolean + x_opencti_main_observable_type: String + x_opencti_observable_values: [ObservablesValues!] + x_mitre_platforms: [String] + killChainPhases: [KillChainPhase!] + observables(first: Int): StixCyberObservableConnection + decay_base_score: Int + decay_base_score_date: DateTime + decay_applied_rule: IndicatorDecayRule + decay_exclusion_applied_rule: IndicatorDecayExclusionRule + decay_history: [DecayHistory!] + decayLiveDetails: DecayLiveDetails + decayChartData: DecayChartData + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +input IndicatorAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId!] + pattern_type: String! + pattern_version: String + pattern: String! + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + indicator_types: [String!] + valid_from: DateTime + valid_until: DateTime + confidence: Int + revoked: Boolean + lang: String + + "*Constraints:*\n* Minimal value: `0`\n* Maximal value: `100`\n" + x_opencti_score: Int + x_opencti_detection: Boolean + x_opencti_main_observable_type: String + x_mitre_platforms: [String!] + killChainPhases: [String!] + createdBy: String + objectMarking: [String!] + objectLabel: [String!] + objectOrganization: [String!] + externalReferences: [String!] + created: DateTime + modified: DateTime + clientMutationId: String + update: Boolean + createObservables: Boolean + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + file: Upload + basedOn: [String!] +} + +type DecayRule implements InternalObject & BasicObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + created_at: DateTime! + updated_at: DateTime! + refreshed_at: DateTime + name: String! + description: String + order: Int! + active: Boolean! + built_in: Boolean + appliedIndicatorsCount: Int! + decay_lifetime: Int! + decay_pound: Float! + decay_points: [Int!] + decay_revoke_score: Int! + decay_observable_types: [String!] + decaySettingsChartData: DecayData +} + +type DecayData { + live_score_serie: [DecayHistory!] +} + +enum DecayRuleOrdering { + name + order + _score +} + +type DecayRuleConnection { + pageInfo: PageInfo! + edges: [DecayRuleEdge!]! +} + +type DecayRuleEdge { + cursor: String! + node: DecayRule! +} + +input DecayRuleAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + order: Int! + active: Boolean! + decay_lifetime: Int! + decay_pound: Float! + decay_points: [Int!] + decay_revoke_score: Int! + decay_observable_types: [String!] +} + +type DecayExclusionRule implements InternalObject & BasicObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + created_at: DateTime! + name: String! + description: String + decay_exclusion_filters: String! + active: Boolean +} + +enum DecayExclusionRuleOrdering { + name + active + _score +} + +type DecayExclusionRuleEdge { + cursor: String! + node: DecayExclusionRule! +} + +type DecayExclusionRuleConnection { + pageInfo: PageInfo! + edges: [DecayExclusionRuleEdge!]! +} + +input DecayExclusionRuleAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + decay_exclusion_filters: String! + active: Boolean! +} + +type Organization implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Identity { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + authorized_members: [MemberAccess!] + authorized_members_activation_date: DateTime + currentUserAccessRight: String + identity_class: String! + name: String! + description: String + contact_information: String + roles: [String] + x_opencti_aliases: [String] + x_opencti_reliability: String + x_opencti_organization_type: String + x_opencti_score: Int + sectors: SectorConnection + members(first: Int, after: ID, orderBy: UsersOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): UserConnection + authorized_authorities: [String] + grantable_groups: [Group!] + subOrganizations: OrganizationConnection + parentOrganizations: OrganizationConnection + default_dashboard: Workspace + default_hidden_types: [String!] + restrict_access: Boolean + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +enum OrganizationsOrdering { + name + confidence + created + created_at + modified + updated_at + x_opencti_organization_type + x_opencti_workflow_id + x_opencti_score + _score +} + +type OrganizationConnection { + pageInfo: PageInfo! + edges: [OrganizationEdge!]! +} + +type OrganizationEdge { + cursor: String! + node: Organization! +} + +input OrganizationAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `1`\n* Must match format: `not-blank`\n" + name: String! + description: String + contact_information: String + roles: [String] + x_opencti_aliases: [String] + confidence: Int + revoked: Boolean + lang: String + x_opencti_organization_type: String + x_opencti_reliability: String + + "*Constraints:*\n* Minimal value: `0`\n* Maximal value: `100`\n" + x_opencti_score: Int + createdBy: String + objectMarking: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_modified_at: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +type MeOrganization { + id: ID! + name: String! +} + +type MeOrganizationEdge { + cursor: String! + node: MeOrganization! +} + +type MeOrganizationConnection { + pageInfo: PageInfo! + edges: [MeOrganizationEdge!]! +} + +type AttributeColumnConfiguration { + separator: String + pattern_date: String + timezone: String +} + +type AttributeColumn { + column_name: String + configuration: AttributeColumnConfiguration +} + +type AttributeBasedOn { + identifier: String + representations: [String] +} + +type AttributeRef { + multiple: Boolean + id: String + ids: [String] +} + +type CsvMapperRepresentationAttribute { + key: String! + column: AttributeColumn + based_on: AttributeBasedOn + ref: AttributeRef + default_values: [DefaultValue!] +} + +enum CsvMapperOperator { + eq + not_eq +} + +type CsvMapperRepresentationTargetColumn { + column_reference: String + operator: CsvMapperOperator + value: String +} + +type CsvMapperRepresentationTarget { + entity_type: String! + column_based: CsvMapperRepresentationTargetColumn +} + +enum CsvMapperRepresentationType { + entity + relationship +} + +type CsvMapperRepresentation { + id: ID! + type: CsvMapperRepresentationType! + target: CsvMapperRepresentationTarget! + attributes: [CsvMapperRepresentationAttribute!]! + from: String + to: String +} + +type CsvMapperAddInputFromImport { + name: String! + has_header: Boolean! + separator: String! + representations: [CsvMapperRepresentation!]! + skipLineChar: String +} + +type CsvMapper implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String!]! + metrics: [Metric] + name: String! + has_header: Boolean! + separator: String! + skipLineChar: String + representations: [CsvMapperRepresentation!]! + errors: String + toConfigurationExport: String! +} + +enum CsvMapperOrdering { + name + _score +} + +type CsvMapperConnection { + pageInfo: PageInfo! + edges: [CsvMapperEdge!]! +} + +type CsvMapperEdge { + cursor: String! + node: CsvMapper! +} + +type CsvMapperTestResult { + objects: String! + nbRelationships: Int! + nbEntities: Int! +} + +type CsvMapperSchemaAttribute { + name: String! + type: String! + mandatory: Boolean! + mandatoryType: String! + editDefault: Boolean! + multiple: Boolean! + defaultValues: [DefaultValue!] + label: String! + mappings: [CsvMapperSchemaAttribute!] +} + +type CsvMapperSchemaAttributes { + name: String! + attributes: [CsvMapperSchemaAttribute!]! +} + +enum JsonMapperOrdering { + name + _score +} + +type JsonMapperConnection { + pageInfo: PageInfo! + edges: [JsonMapperEdge!]! +} + +type JsonMapperEdge { + cursor: String! + node: JsonMapper! +} + +input AttributeColumnConfigurationInput { + separator: String + pattern_date: String + timezone: String +} + +input AttributeColumnInput { + column_name: String + configuration: AttributeColumnConfigurationInput +} + +input AttributeBasedOnInput { + representations: [String] +} + +input AttributeRefInput { + multiple: Boolean + id: String + ids: [String] +} + +input CsvMapperRepresentationAttributeInput { + key: String + column: AttributeColumnInput + based_on: AttributeBasedOnInput + ref: AttributeRefInput +} + +input CsvMapperRepresentationTargetColumnInput { + column_reference: String + operator: CsvMapperOperator + value: String +} + +input CsvMapperRepresentationTargetInput { + entity_type: String! + column_based: CsvMapperRepresentationTargetColumnInput +} + +input CsvMapperRepresentationInput { + id: ID! + type: CsvMapperRepresentationType! + target: CsvMapperRepresentationTargetInput! + attributes: [CsvMapperRepresentationAttributeInput]! + from: String + to: String +} + +input CsvMapperAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + has_header: Boolean! + separator: String! + representations: String! + skipLineChar: String +} + +enum JsonMapperRepresentationType { + entity + relationship +} + +type AttributePath { + path: String! + independent: Boolean + configuration: AttributeColumnConfiguration +} + +type ComplexVariable { + path: String! + variable: String! + independent: Boolean +} + +type ComplexPath { + formula: String! + variables: [ComplexVariable!] + configuration: AttributeColumnConfiguration +} + +type JsonMapperRepresentationAttribute { + key: String! + mode: String! + attr_path: AttributePath + complex_path: ComplexPath + based_on: AttributeBasedOn + default_values: [DefaultValue!] +} + +type JsonMapperRepresentationTarget { + entity_type: String! + path: String! +} + +type JsonMapperRepresentation { + id: ID! + type: JsonMapperRepresentationType! + target: JsonMapperRepresentationTarget! + identifier: String + attributes: [JsonMapperRepresentationAttribute!]! + from: String + to: String +} + +interface JsonAttributeColumnConfiguration { + separator: String + pattern_date: String + timezone: String +} + +type JsonComplexPathVariable { + path: String + variable: String + independent: Boolean +} + +type JsonComplexPathConfiguration { + complex: JsonComplexPathConfiguration + formula: String +} + +type JsonComplexPath { + complex: JsonComplexPathConfiguration + configuration: JsonAttributeColumnConfiguration +} + +type JsonMapperVariable { + name: String! + path: JsonComplexPath +} + +type JsonMapper implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String!]! + metrics: [Metric] + name: String! + variables: [JsonMapperVariable!] + representations: [JsonMapperRepresentation!]! + errors: String + toConfigurationExport: String! +} + +type JsonMapperTestResult { + objects: String! + nbRelationships: Int! + nbEntities: Int! + state: String! +} + +type JsonMapperAddInputFromImport { + name: String! + representations: [JsonMapperRepresentation!]! +} + +input JsonMapperAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + representations: String! +} + +type PublicDashboard implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String!]! + metrics: [Metric] + name: String! + owner: Creator + description: String + dashboard_id: String! + dashboard: Workspace! + user_id: String! + public_manifest: String + private_manifest: String + uri_key: String! + allowed_markings_ids: [String!] + allowed_markings: [MarkingDefinitionShort!] + created_at: DateTime + updated_at: DateTime + editContext: [EditUserContext!] + enabled: Boolean! +} + +type PublicDistribution { + label: String! + entity: StixObjectOrStixRelationshipOrCreator + value: Int + breakdownDistribution: [Distribution] +} + +enum PublicDashboardsOrdering { + name + created_at + updated_at + user_id + enabled + dashboard + uri_key + _score +} + +type PublicDashboardConnection { + pageInfo: PageInfo! + edges: [PublicDashboardEdge!]! +} + +type PublicDashboardEdge { + cursor: String! + node: PublicDashboard! +} + +input PublicDashboardAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + uri_key: String! + description: String + dashboard_id: String! + allowed_markings_ids: [String!] + enabled: Boolean! +} + +type Theme implements InternalObject & BasicObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String!]! + name: String! + theme_background: String! + theme_paper: String! + theme_nav: String! + theme_primary: String! + theme_secondary: String! + theme_accent: String! + theme_logo: String + theme_logo_collapsed: String + theme_logo_login: String + theme_text_color: String! + toConfigurationExport: String! + built_in: Boolean + metrics: [Metric] +} + +type ThemeConnection { + pageInfo: PageInfo! + edges: [ThemeEdge!]! +} + +type ThemeEdge { + cursor: String! + node: Theme! +} + +enum ThemeOrdering { + name + created_at + _score +} + +input ThemeAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + theme_background: String! + theme_paper: String! + theme_nav: String! + theme_primary: String! + theme_secondary: String! + theme_accent: String! + theme_logo: String + theme_logo_collapsed: String + theme_logo_login: String + theme_text_color: String! + built_in: Boolean +} + +enum Tone { + tactical + operational + strategic +} + +enum Format { + text + html + markdown + json +} + +enum IndicatorFormat { + stix + sigma + yara +} + +type AIBus { + bus_id: String! + content: String! +} + +type NLQResponse { + filters: String! + notResolvedValues: [String!]! +} + +type DeletedElement { + id: String! + source_index: String! +} + +type DeleteOperation implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String!]! + metrics: [Metric] + objectMarking: [MarkingDefinition!] + confidence: Int + created_at: DateTime + deletedBy: Creator + main_entity_type: String! + main_entity_id: String! + main_entity_name: String! + deleted_elements: [DeletedElement!]! +} + +enum DeleteOperationOrdering { + main_entity_name + created_at + deletedBy + objectMarking + _score +} + +type DeleteOperationConnection { + pageInfo: PageInfo! + edges: [DeleteOperationEdge!]! +} + +type DeleteOperationEdge { + cursor: String! + node: DeleteOperation! +} + +type SupportPackage implements InternalObject & BasicObject { + id: ID! + name: String! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + created_at: DateTime! + package_status: PackageStatus! + package_url: String + package_upload_dir: String + nodes_count: Int! + createdBy: Individual + creators: [Creator!] +} + +type SupportPackageConnection { + pageInfo: PageInfo! + edges: [SupportPackageEdge!]! +} + +type SupportPackageEdge { + cursor: String! + node: SupportPackage! +} + +enum PackageStatus { + IN_PROGRESS + READY + IN_ERROR +} + +enum SupportPackageOrdering { + name + created_at + package_status +} + +input SupportPackageAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! +} + +input SupportPackageForceZipInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + id: String! +} + +type ExclusionList implements InternalObject & BasicObject { + id: ID! + name: String! + description: String + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + created_at: DateTime! + enabled: Boolean! + exclusion_list_entity_types: [String!]! + exclusion_list_values_count: Int + file_id: String! + exclusion_list_file_size: Int +} + +type ExclusionListConnection { + pageInfo: PageInfo! + edges: [ExclusionListEdge!] +} + +type ExclusionListEdge { + cursor: String! + node: ExclusionList! +} + +type ExclusionListCacheStatus { + refreshVersion: String! + cacheVersion: String! + isCacheRebuildInProgress: Boolean! +} + +enum ExclusionListOrdering { + name + created_at + enabled + exclusion_list_values_count + _score +} + +input ExclusionListFileAddInput { + name: String! + description: String + exclusion_list_entity_types: [String!]! + file: Upload! +} + +enum DraftStatus { + open + validated +} + +type DraftWorkspace implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String!]! + metrics: [Metric] + name: String! + created_at: DateTime! + creators: [Creator!] + entity_id: String + objectsCount: DraftObjectsCount! + draft_status: DraftStatus! + processingCount: Int! + works(first: Int): [Work!] + validationWork: Work + authorizedMembers: [MemberAccess!]! + currentUserAccessRight: String +} + +type DraftObjectsCount { + totalCount: Int! + entitiesCount: Int! + observablesCount: Int! + relationshipsCount: Int! + sightingsCount: Int! + containersCount: Int! +} + +enum DraftWorkspacesOrdering { + name + created_at + creator + draft_status + _score +} + +type DraftWorkspaceConnection { + pageInfo: PageInfo! + edges: [DraftWorkspaceEdge!]! +} + +type DraftWorkspaceEdge { + cursor: String! + node: DraftWorkspace! +} + +input DraftWorkspaceAddInput { + name: String! + entity_id: String + authorized_members: [MemberAccessInput!] +} + +type FintelTemplateWidget { + variable_name: String! + widget: Widget! +} + +type FintelTemplate implements BasicObject & InternalObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + name: String! + settings_types: [String!]! + description: String + instance_filters: String + template_content: String! + start_date: DateTime + fintel_template_widgets: [FintelTemplateWidget!]! + toConfigurationExport: String! +} + +input FintelTemplateWidgetAddInput { + "*Constraints:*\n* Minimal length: `1`\n* Must match format: `not-blank`\n" + variable_name: String! + widget: Any! +} + +input FintelTemplateAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + settings_types: [String!]! + instance_filters: String + template_content: String + start_date: DateTime + fintel_template_widgets: [FintelTemplateWidgetAddInput!] +} + +type FintelTemplateEdge { + cursor: String! + node: FintelTemplate! +} + +type FintelTemplateConnection { + pageInfo: PageInfo! + edges: [FintelTemplateEdge!]! +} + +enum FintelTemplateOrdering { + name + start_date +} + +type DisseminationList implements InternalObject & BasicObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + created_at: DateTime! + updated_at: DateTime! + refreshed_at: DateTime + name: String! + emails: [String!]! + description: String +} + +enum DisseminationListOrdering { + name + _score +} + +type DisseminationListConnection { + pageInfo: PageInfo! + edges: [DisseminationListEdge!]! +} + +type DisseminationListEdge { + cursor: String! + node: DisseminationList! +} + +input DisseminationListAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + emails: [String!]! + description: String +} + +input DisseminationListSendInput { + entity_id: ID! + use_octi_template: Boolean! + email_object: String! + email_body: String! + email_attachment_ids: [ID!]! + html_to_body_file_id: ID +} + +type SavedFilter implements InternalObject & BasicObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + name: String! + filters: String! + scope: String! +} + +type SavedFilterEdge { + cursor: String! + node: SavedFilter! +} + +type SavedFilterConnection { + pageInfo: PageInfo! + edges: [SavedFilterEdge!] +} + +enum SavedFilterOrdering { + name + _score +} + +input SavedFilterAddInput { + name: String! + filters: String! + scope: String! +} + +enum RequestAccessType { + organization_sharing +} + +type RequestAccessMember { + id: ID! + name: String! +} + +type RequestAccessConfiguration { + id: ID! + approved_status: Status + declined_status: Status + approval_admin: [RequestAccessMember] +} + +type RequestAccessWorkflow { + approved_workflow_id: String + declined_workflow_id: String + approval_admin: [ID] +} + +type RequestAccessStatus { + id: ID! + template_id: String + statusTemplate: [StatusTemplate] +} + +input RequestAccessAddInput { + request_access_reason: String + request_access_entities: [ID!]! + request_access_members: [ID!]! + request_access_type: RequestAccessType +} + +input RequestAccessConfigureInput { + approved_status_id: ID + declined_status_id: ID + approval_admin: [ID] +} + +type PirCriterion { + filters: String! + weight: Int! +} + +type PirScore { + pir_id: ID! + pir_score: Int! +} + +enum PirType { + THREAT_LANDSCAPE + THREAT_ORIGIN + THREAT_CUSTOM +} + +type PirDependency { + element_id: ID! + author_id: ID +} + +type PirExplanation { + dependencies: [PirDependency!]! + criterion: PirCriterion! +} + +type PirInformation { + pir_score: Int! + last_pir_score_date: DateTime! + pir_explanation: [PirExplanation!]! +} + +type Pir implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String!]! + metrics: [Metric] + created_at: DateTime! + updated_at: DateTime! + refreshed_at: DateTime + creators: [Creator!] + name: String! + pir_type: PirType! + description: String + pir_rescan_days: Int! + pir_criteria: [PirCriterion!]! + pir_filters: String! + lastEventId: String! + authorizedMembers: [MemberAccess!]! + currentUserAccessRight: String + pirContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): ContainerConnection + queue_messages: Int! +} + +type PirRelationship implements BasicRelationship { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + fromRole: String + toRole: String + created_at: DateTime! + updated_at: DateTime! + refreshed_at: DateTime + fromId: String! + toId: String! + fromType: String! + toType: String! + from: StixDomainObject + to: Pir + creators: [Creator!] + pir_explanation: [PirExplanation!] + pir_score: Int +} + +enum PirOrdering { + _score + name + created_at + updated_at + creator +} + +enum PirRelationshipOrdering { + created_at + updated_at + pir_score +} + +type PirConnection { + pageInfo: PageInfo! + edges: [PirEdge!]! +} + +type PirEdge { + cursor: String! + node: Pir! +} + +type PirRelationshipConnection { + pageInfo: PageInfo! + edges: [PirRelationshipEdge!]! +} + +type PirRelationshipEdge { + cursor: String! + node: PirRelationship! +} + +input PirCriterionInput { + weight: Int! + filters: FilterGroup! +} + +input PirDependencyInput { + element_id: ID! + author_id: ID +} + +input PirExplanationInput { + dependencies: [PirDependencyInput!]! + criterion: PirCriterionInput! +} + +input PirAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + pir_type: PirType! + description: String + pir_rescan_days: Int! + pir_criteria: [PirCriterionInput!]! + pir_filters: FilterGroup! + authorized_members: [MemberAccessInput!] +} + +input PirFlagElementInput { + relationshipId: ID! + sourceId: ID! + matchingCriteria: [PirCriterionInput!]! + relationshipAuthorId: ID +} + +input PirUnflagElementInput { + relationshipId: ID! + sourceId: ID! +} + +input PirRelationshipsTimeSeriesParameters { + pirId: ID! + field: String! + elementWithTargetTypes: [String] + fromId: [String] + fromTypes: [String] + relationship_type: [String] + confidences: [Int] + search: String + filters: FilterGroup + dynamicFrom: FilterGroup +} + +type FintelDesign implements BasicObject & InternalObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + name: String! + description: String + file_id: String + gradiantFromColor: String + gradiantToColor: String + textColor: String +} + +input FintelDesignAddInput { + "*Constraints:*\n* Minimal length: `1`\n* Must match format: `not-blank`\n" + name: String! + description: String + gradiantFromColor: String + gradiantToColor: String + textColor: String + file: Upload +} + +type FintelDesignEdge { + cursor: String! + node: FintelDesign +} + +type FintelDesignConnection { + pageInfo: PageInfo! + edges: [FintelDesignEdge!]! +} + +enum FintelDesignOrdering { + _score + name + created_at +} + +type SecurityPlatform implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Identity { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + refreshed_at: DateTime + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + identity_class: String! + name: String! + description: String + contact_information: String + roles: [String] + x_opencti_aliases: [String] + x_opencti_reliability: String + security_platform_type: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation +} + +enum SecurityPlatformOrdering { + name + confidence + created + created_at + modified + updated_at + security_platform_type + _score +} + +type SecurityPlatformConnection { + pageInfo: PageInfo! + edges: [SecurityPlatformEdge!]! +} + +type SecurityPlatformEdge { + cursor: String! + node: SecurityPlatform! +} + +input SecurityPlatformAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + security_platform_type: String + confidence: Int + createdBy: String + objectMarking: [String] + objectLabel: [String] + created: DateTime + modified: DateTime + revoked: Boolean + stix_id: StixId + x_opencti_stix_ids: [StixId] + x_opencti_workflow_id: String + x_opencti_modified_at: DateTime + externalReferences: [String] + update: Boolean +} + +type CoverageResult { + coverage_name: String! + coverage_score: Int! +} + +type SecurityCoverage implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_modified_at: DateTime + draftVersion: DraftVersion + refreshed_at: DateTime + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + identity_class: String! + name: String! + description: String + contact_information: String + roles: [String] + x_opencti_aliases: [String] + x_opencti_reliability: String + security_platform_type: String + creators: [Creator!] + toStix(version: Version): String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + pirInformation(pirId: ID!): PirInformation + coverage_last_result: DateTime + coverage_valid_from: DateTime + coverage_valid_to: DateTime + coverage_information: [CoverageResult!] + external_uri: String + periodicity: String + duration: String + type_affinity: String + platforms_affinity: [String!] + auto_enrichment_disable: Boolean + objectCovered: StixDomainObject + toStixBundle: String +} + +enum SecurityCoverageOrdering { + name + confidence + created + created_at + creator + modified + updated_at + objectMarking + coverage_last_result + _score +} + +type SecurityCoverageConnection { + pageInfo: PageInfo! + edges: [SecurityCoverageEdge!]! +} + +type SecurityCoverageEdge { + cursor: String! + node: SecurityCoverage! +} + +input SecurityCoverageAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + confidence: Int + createdBy: String + objectMarking: [String] + objectLabel: [String] + objectCovered: String! + created: DateTime + modified: DateTime + revoked: Boolean + stix_id: StixId + x_opencti_stix_ids: [StixId] + x_opencti_workflow_id: String + x_opencti_modified_at: DateTime + external_uri: String + externalReferences: [String] + update: Boolean + auto_enrichment_disable: Boolean! + periodicity: String + duration: String + type_affinity: String + platforms_affinity: [String] + coverage_last_result: DateTime + coverage_valid_from: DateTime + coverage_valid_to: DateTime + coverage_information: [SecurityCoverageExpectation!] +} + +input AskSendOtpInput { + email: String! +} + +input VerifyOtpInput { + otp: String! + transactionId: String! +} + +input VerifyMfaInput { + code: String! + transactionId: String! +} + +input ChangePasswordInput { + transactionId: String! + otp: String! + newPassword: String! +} + +type VerifyOtp { + mfa_activated: Boolean! +} + +type EmailTemplate implements InternalObject & BasicObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + metrics: [Metric] + name: String! + description: String + email_object: String! + sender_email: String! + template_body: String! +} + +type EmailTemplateConnection { + pageInfo: PageInfo! + edges: [EmailTemplateEdge!]! +} + +type EmailTemplateEdge { + cursor: String! + node: EmailTemplate! +} + +enum EmailTemplateOrdering { + name + _score +} + +input EmailTemplateAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + email_object: String! + sender_email: String! + template_body: String! +} + +type Form implements BasicObject & InternalObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String!]! + metrics: [Metric] + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + name: String! + description: String! + form_schema: String! + active: Boolean! + toConfigurationExport: String! +} + +type FormEdge { + cursor: String! + node: Form! +} + +type FormConnection { + pageInfo: PageInfo! + edges: [FormEdge!]! +} + +enum FormsOrdering { + name + created_at + updated_at + active +} + +input FormAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String! + form_schema: String! + active: Boolean +} + +input FormSubmissionInput { + formId: String! + values: String! +} + +type FormSubmissionResponse { + success: Boolean! + bundleId: String + message: String + entityId: String +} + +type CheckXTMHubConnectivityResponse { + status: XTMHubRegistrationStatus +} + +input AutoRegisterInput { + platform_token: String! +} + +type Success { + success: Boolean! +} + +type Metric { + name: ID! + value: Float! +} + +input PatchMetricInput { + name: String! + value: Float! +} \ No newline at end of file diff --git a/pyproject.toml b/pyproject.toml index 0c141df..898bc7b 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -31,6 +31,7 @@ pytest = "^8.4.2" pytest-mock = "^3.15.0" vcrpy = "^7.0.0" pytest-asyncio = "^1.2.0" +graphql-core = "^3.2.3" [build-system] requires = ["poetry-core"] diff --git a/src/pyapiary/__init__.py b/src/pyapiary/__init__.py index d19c1e3..76c5f57 100644 --- a/src/pyapiary/__init__.py +++ b/src/pyapiary/__init__.py @@ -6,6 +6,8 @@ flashpoint, ipqs, generic, + graphql, + opencti, ) # DBMS connectors @@ -21,11 +23,13 @@ "elasticsearch", "flashpoint", "generic", + "graphql", "ipqs", "mongo", "odbc", + "opencti", "splunk", "spycloud", "twilio", "urlscan", -] \ No newline at end of file +] diff --git a/src/pyapiary/api_connectors/graphql.py b/src/pyapiary/api_connectors/graphql.py new file mode 100644 index 0000000..142cc21 --- /dev/null +++ b/src/pyapiary/api_connectors/graphql.py @@ -0,0 +1,97 @@ +import httpx +from typing import Any, Dict, List, Optional +from pyapiary.api_connectors.broker import ( + Broker, + AsyncBroker, + bubble_broker_init_signature, + log_method_call, +) + + +class GraphQLError(Exception): + """Raised when a GraphQL response returns a top-level ``errors`` array. + + GraphQL returns HTTP 200 even when a query fails, so ``raise_for_status`` + (already applied by Broker) never catches these. This exception surfaces + those query-level errors. Transport failures (4xx/5xx) still raise + ``httpx.HTTPStatusError`` from Broker as usual. + + Attributes: + errors (List[Dict[str, Any]]): The raw ``errors`` array from the response. + """ + + def __init__(self, errors: List[Dict[str, Any]]): + self.errors = errors + super().__init__("; ".join(e.get("message", str(e)) for e in errors)) + + +@bubble_broker_init_signature() +class GraphQLConnector(Broker): + """A generic, schema-agnostic GraphQL executor. + + Like the DBMS connectors, this connector does not know or care what your + query is -- it just runs it. Point it at any GraphQL endpoint. Built on + ``Broker``, so it inherits retries, proxy handling, timeouts, logging, and + optional environment config loading. + + Attributes: + endpoint (str): Path appended to ``base_url`` for GraphQL requests. + """ + + def __init__(self, base_url: str, endpoint: str = "/graphql", **kwargs): + super().__init__(base_url=base_url, **kwargs) + self.endpoint = endpoint + + @log_method_call + def execute( + self, + query: str, + variables: Optional[Dict[str, Any]] = None, + raise_on_errors: bool = True, + ) -> httpx.Response: + """Execute a GraphQL document and return the raw ``httpx.Response``. + + Args: + query (str): The GraphQL query or mutation document. + variables (Optional[Dict[str, Any]]): GraphQL variables. + raise_on_errors (bool): If True (default), raise ``GraphQLError`` + when the 200 response body contains an ``errors`` array. Set + False to let the caller inspect ``response.json()["errors"]``. + + Returns: + httpx.Response: The raw response object (house convention). + + Raises: + GraphQLError: When ``raise_on_errors`` and the body has ``errors``. + httpx.HTTPStatusError: On transport-level failures (via Broker). + """ + resp = self.post(self.endpoint, json={"query": query, "variables": variables or {}}) + if raise_on_errors: + body = resp.json() + if body.get("errors"): + raise GraphQLError(body["errors"]) + return resp + + +@bubble_broker_init_signature() +class AsyncGraphQLConnector(AsyncBroker): + """Async version of :class:`GraphQLConnector` using ``AsyncBroker``.""" + + def __init__(self, base_url: str, endpoint: str = "/graphql", **kwargs): + super().__init__(base_url=base_url, **kwargs) + self.endpoint = endpoint + + @log_method_call + async def execute( + self, + query: str, + variables: Optional[Dict[str, Any]] = None, + raise_on_errors: bool = True, + ) -> httpx.Response: + """Async execute a GraphQL document. See :meth:`GraphQLConnector.execute`.""" + resp = await self.post(self.endpoint, json={"query": query, "variables": variables or {}}) + if raise_on_errors: + body = resp.json() + if body.get("errors"): + raise GraphQLError(body["errors"]) + return resp diff --git a/src/pyapiary/api_connectors/opencti.py b/src/pyapiary/api_connectors/opencti.py new file mode 100644 index 0000000..d49fe16 --- /dev/null +++ b/src/pyapiary/api_connectors/opencti.py @@ -0,0 +1,257 @@ +import httpx +from typing import Any, Dict, List, Optional, Union +from pyapiary.api_connectors.graphql import GraphQLConnector, AsyncGraphQLConnector +from pyapiary.api_connectors.broker import bubble_broker_init_signature, log_method_call +from pyapiary.helpers import combine_env_configs +from pyapiary.api_connectors import opencti_queries as q + + +def _as_list(value: Optional[Union[str, List[str]]]) -> Optional[List[str]]: + """Normalize a scalar/list value to a list (or None) for list-typed args.""" + if value is None: + return None + return value if isinstance(value, list) else [value] + + +def _build_filter_group(key: str, values, operator: str = "eq", mode: str = "or") -> Dict[str, Any]: + """Build an OpenCTI 6.9.x FilterGroup for a single key/value(s) filter. + + Verified against the 6.9.6 schema: ``Filter.key`` is ``[String!]!`` and + ``values`` is ``[Any!]!`` (both lists). + + Args: + key (str): The field key to filter on (e.g. "name", "entity_type"). + values: A single value or list of values to match. + operator (str): A FilterOperator (eq, not_eq, match, wildcard, contains, + starts_with, gt, lt, nil, search, ...). Defaults to "eq". + mode (str): "and" or "or" within this filter's values. Defaults to "or". + + Returns: + Dict[str, Any]: A FilterGroup dict ready to pass as the ``filters`` arg. + """ + if not isinstance(values, list): + values = [values] + return { + "mode": "and", + "filters": [{"key": [key], "values": values, "operator": operator, "mode": mode}], + "filterGroups": [], + } + + +@bubble_broker_init_signature() +class OpenCTIConnector(GraphQLConnector): + """Curated operations for OpenCTI 6.9.x over its GraphQL API. + + A thick connector (urlscan-style) on top of the generic GraphQLConnector. + Query field selections are pinned to the schema captured in + ``docs/opencti-6.9.6.graphql``. For anything outside the curated catalog, + use the inherited :meth:`execute` directly with your own query. + + Credentials are read from ``OPENCTI_URL`` and ``OPENCTI_TOKEN`` (or passed + explicitly). Access is governed by the permissions on the token's user. + + Attributes: + token (str): The API token used for Bearer auth. + """ + + def __init__(self, url: Optional[str] = None, token: Optional[str] = None, **kwargs): + # The OpenCTI instance URL is deployment-specific, so resolve url/token + # eagerly from env here (Broker's env_config is only populated after + # super().__init__, but we need the url to call it). + env = combine_env_configs() + url = url or env.get("OPENCTI_URL") + token = token or env.get("OPENCTI_TOKEN") + if not url: + raise ValueError("OpenCTIConnector requires a url (or OPENCTI_URL env var)") + if not token: + raise ValueError("OpenCTIConnector requires a token (or OPENCTI_TOKEN env var)") + + super().__init__(base_url=url, endpoint="/graphql", **kwargs) + self.token = token + self.headers.update({ + "Authorization": f"Bearer {token}", + "Content-Type": "application/json", + }) + + # --- helpers ------------------------------------------------------------- + @staticmethod + def filter_group(key: str, values, operator: str = "eq", mode: str = "or") -> Dict[str, Any]: + """Build an OpenCTI FilterGroup. See :func:`_build_filter_group`.""" + return _build_filter_group(key, values, operator=operator, mode=mode) + + def list_entity_types(self) -> tuple: + """Return the curated tuple of searchable OpenCTI entity types.""" + return q.SEARCHABLE_TYPES + + # --- request methods: return httpx.Response (house convention) ----------- + @log_method_call + def search_entities( + self, + types: Optional[List[str]] = None, + search: Optional[str] = None, + filters: Optional[Dict[str, Any]] = None, + first: int = 100, + after: Optional[str] = None, + ) -> httpx.Response: + """Search/list STIX core objects of any type (threats, arsenal, + techniques, locations, entities, ...). Paginate by passing ``after`` + with the previous page's ``pageInfo.endCursor``. + + Returns: + httpx.Response: ``data.stixCoreObjects`` connection in the body. + """ + return self.execute( + q.SEARCH_ENTITIES_QUERY, + {"types": types, "search": search, "filters": filters, "first": first, "after": after}, + ) + + @log_method_call + def get_indicators( + self, + filters: Optional[Dict[str, Any]] = None, + search: Optional[str] = None, + first: int = 100, + after: Optional[str] = None, + ) -> httpx.Response: + """Fetch indicators with indicator-specific fields (pattern, score, ...).""" + return self.execute( + q.INDICATORS_QUERY, + {"filters": filters, "search": search, "first": first, "after": after}, + ) + + @log_method_call + def get_observables( + self, + types: Optional[List[str]] = None, + filters: Optional[Dict[str, Any]] = None, + search: Optional[str] = None, + first: int = 100, + after: Optional[str] = None, + ) -> httpx.Response: + """Fetch STIX cyber observables (observable_value, score, ...).""" + return self.execute( + q.OBSERVABLES_QUERY, + {"types": types, "filters": filters, "search": search, "first": first, "after": after}, + ) + + @log_method_call + def get_relationships( + self, + from_id: Optional[Union[str, List[str]]] = None, + to_id: Optional[Union[str, List[str]]] = None, + relationship_type: Optional[Union[str, List[str]]] = None, + filters: Optional[Dict[str, Any]] = None, + first: int = 100, + after: Optional[str] = None, + ) -> httpx.Response: + """Traverse STIX core relationships. ``from_id``/``to_id``/ + ``relationship_type`` accept a single value or a list (the schema args + are ``[String]``).""" + return self.execute( + q.RELATIONSHIPS_QUERY, + { + "fromId": _as_list(from_id), + "toId": _as_list(to_id), + "relationship_type": _as_list(relationship_type), + "filters": filters, + "first": first, + "after": after, + }, + ) + + +@bubble_broker_init_signature() +class AsyncOpenCTIConnector(AsyncGraphQLConnector): + """Async version of :class:`OpenCTIConnector`.""" + + def __init__(self, url: Optional[str] = None, token: Optional[str] = None, **kwargs): + env = combine_env_configs() + url = url or env.get("OPENCTI_URL") + token = token or env.get("OPENCTI_TOKEN") + if not url: + raise ValueError("AsyncOpenCTIConnector requires a url (or OPENCTI_URL env var)") + if not token: + raise ValueError("AsyncOpenCTIConnector requires a token (or OPENCTI_TOKEN env var)") + + super().__init__(base_url=url, endpoint="/graphql", **kwargs) + self.token = token + self.headers.update({ + "Authorization": f"Bearer {token}", + "Content-Type": "application/json", + }) + + @staticmethod + def filter_group(key: str, values, operator: str = "eq", mode: str = "or") -> Dict[str, Any]: + """Build an OpenCTI FilterGroup. See :func:`_build_filter_group`.""" + return _build_filter_group(key, values, operator=operator, mode=mode) + + def list_entity_types(self) -> tuple: + """Return the curated tuple of searchable OpenCTI entity types.""" + return q.SEARCHABLE_TYPES + + @log_method_call + async def search_entities( + self, + types: Optional[List[str]] = None, + search: Optional[str] = None, + filters: Optional[Dict[str, Any]] = None, + first: int = 100, + after: Optional[str] = None, + ) -> httpx.Response: + """Async search/list STIX core objects. See :meth:`OpenCTIConnector.search_entities`.""" + return await self.execute( + q.SEARCH_ENTITIES_QUERY, + {"types": types, "search": search, "filters": filters, "first": first, "after": after}, + ) + + @log_method_call + async def get_indicators( + self, + filters: Optional[Dict[str, Any]] = None, + search: Optional[str] = None, + first: int = 100, + after: Optional[str] = None, + ) -> httpx.Response: + """Async fetch indicators. See :meth:`OpenCTIConnector.get_indicators`.""" + return await self.execute( + q.INDICATORS_QUERY, + {"filters": filters, "search": search, "first": first, "after": after}, + ) + + @log_method_call + async def get_observables( + self, + types: Optional[List[str]] = None, + filters: Optional[Dict[str, Any]] = None, + search: Optional[str] = None, + first: int = 100, + after: Optional[str] = None, + ) -> httpx.Response: + """Async fetch observables. See :meth:`OpenCTIConnector.get_observables`.""" + return await self.execute( + q.OBSERVABLES_QUERY, + {"types": types, "filters": filters, "search": search, "first": first, "after": after}, + ) + + @log_method_call + async def get_relationships( + self, + from_id: Optional[Union[str, List[str]]] = None, + to_id: Optional[Union[str, List[str]]] = None, + relationship_type: Optional[Union[str, List[str]]] = None, + filters: Optional[Dict[str, Any]] = None, + first: int = 100, + after: Optional[str] = None, + ) -> httpx.Response: + """Async traverse relationships. See :meth:`OpenCTIConnector.get_relationships`.""" + return await self.execute( + q.RELATIONSHIPS_QUERY, + { + "fromId": _as_list(from_id), + "toId": _as_list(to_id), + "relationship_type": _as_list(relationship_type), + "filters": filters, + "first": first, + "after": after, + }, + ) diff --git a/src/pyapiary/api_connectors/opencti_queries.py b/src/pyapiary/api_connectors/opencti_queries.py new file mode 100644 index 0000000..0e43490 --- /dev/null +++ b/src/pyapiary/api_connectors/opencti_queries.py @@ -0,0 +1,148 @@ +"""Curated GraphQL query catalog for OpenCTI 6.9.x. + +These are static, schema-verified query documents (validated against +``docs/opencti-6.9.6.graphql``). They are the "shape" decisions -- which fields +to fetch -- separated from the connector logic so they stay readable and are +easy to validate in CI. + +Notes verified against the live 6.9.6 schema: + - ``StixCoreObject`` is an interface; it has no ``name``. Every entity does + expose ``representative { main secondary }``, a universal display label, + so the generic search selects that instead of per-type fragments. + - ``Filter.key`` is ``[String!]!`` and ``values`` is ``[Any!]!`` (both lists). + - List connections expose ``pageInfo { endCursor hasNextPage globalCount }``. + - ``stixCoreRelationships`` takes list args (``fromId``/``toId``/ + ``relationship_type`` are ``[String]``). +""" + +# Common OpenCTI entity types accepted by the `types` argument of +# `stixCoreObjects` / `stixCyberObservables`. Not exhaustive -- extend as needed. +SEARCHABLE_TYPES = ( + "Stix-Cyber-Observable", + "Indicator", + # threats + "Threat-Actor-Group", + "Threat-Actor-Individual", + "Intrusion-Set", + "Campaign", + # arsenal + "Malware", + "Tool", + "Channel", + "Vulnerability", + # techniques + "Attack-Pattern", + "Narrative", + "Course-Of-Action", + # locations + "Region", + "Country", + "City", + "Position", + "Administrative-Area", + # entities + "Individual", + "Organization", + "Sector", + "System", + "Event", + "Infrastructure", +) + + +# Generic entity search/listing across any STIX core object type. +# Uses `representative` for a type-agnostic display label. +SEARCH_ENTITIES_QUERY = """ +query SearchEntities($types: [String], $search: String, $filters: FilterGroup, $first: Int, $after: ID) { + stixCoreObjects(types: $types, search: $search, filters: $filters, first: $first, after: $after) { + edges { + node { + id + standard_id + entity_type + parent_types + created_at + updated_at + representative { main secondary } + } + } + pageInfo { endCursor hasNextPage globalCount } + } +} +""" + + +INDICATORS_QUERY = """ +query Indicators($filters: FilterGroup, $search: String, $first: Int, $after: ID) { + indicators(filters: $filters, search: $search, first: $first, after: $after) { + edges { + node { + id + standard_id + entity_type + created_at + updated_at + name + description + pattern + pattern_type + indicator_types + valid_from + valid_until + revoked + confidence + x_opencti_score + x_opencti_detection + x_opencti_main_observable_type + } + } + pageInfo { endCursor hasNextPage globalCount } + } +} +""" + + +OBSERVABLES_QUERY = """ +query Observables($types: [String], $filters: FilterGroup, $search: String, $first: Int, $after: ID) { + stixCyberObservables(types: $types, filters: $filters, search: $search, first: $first, after: $after) { + edges { + node { + id + standard_id + entity_type + created_at + updated_at + observable_value + x_opencti_score + x_opencti_description + } + } + pageInfo { endCursor hasNextPage globalCount } + } +} +""" + + +RELATIONSHIPS_QUERY = """ +query Relationships($fromId: [String], $toId: [String], $relationship_type: [String], $filters: FilterGroup, $first: Int, $after: ID) { + stixCoreRelationships(fromId: $fromId, toId: $toId, relationship_type: $relationship_type, filters: $filters, first: $first, after: $after) { + edges { + node { + id + standard_id + entity_type + relationship_type + fromId + fromType + toId + toType + start_time + stop_time + created_at + confidence + } + } + pageInfo { endCursor hasNextPage globalCount } + } +} +""" diff --git a/src/pyapiary/tests/test_graphql/test_unit_async_graphql.py b/src/pyapiary/tests/test_graphql/test_unit_async_graphql.py new file mode 100644 index 0000000..f9de797 --- /dev/null +++ b/src/pyapiary/tests/test_graphql/test_unit_async_graphql.py @@ -0,0 +1,68 @@ +import json +import httpx +import pytest +from pyapiary.api_connectors.graphql import AsyncGraphQLConnector, GraphQLError + + +def _resp(payload, status=200): + req = httpx.Request("POST", "https://example.test/graphql") + return httpx.Response( + status, + request=req, + content=json.dumps(payload).encode("utf-8"), + headers={"Content-Type": "application/json"}, + ) + + +@pytest.mark.asyncio +async def test_async_execute_returns_httpx_response(): + c = AsyncGraphQLConnector(base_url="https://example.test") + + async def fake_post(endpoint, json=None): + return _resp({"data": {"ok": 1}}) + + c.post = fake_post + result = await c.execute("query { ok }") + assert isinstance(result, httpx.Response) + assert result.json()["data"]["ok"] == 1 + + +@pytest.mark.asyncio +async def test_async_execute_sends_query_and_variables(): + c = AsyncGraphQLConnector(base_url="https://example.test", endpoint="/graphql") + captured = {} + + async def fake_post(endpoint, json=None): + captured["endpoint"] = endpoint + captured["json"] = json + return _resp({"data": {}}) + + c.post = fake_post + await c.execute("query Q { a }", {"x": 1}) + assert captured["endpoint"] == "/graphql" + assert captured["json"] == {"query": "query Q { a }", "variables": {"x": 1}} + + +@pytest.mark.asyncio +async def test_async_execute_raises_graphql_error(): + c = AsyncGraphQLConnector(base_url="https://example.test") + + async def fake_post(endpoint, json=None): + return _resp({"errors": [{"message": "boom"}]}) + + c.post = fake_post + with pytest.raises(GraphQLError, match="boom"): + await c.execute("query { bad }") + + +@pytest.mark.asyncio +async def test_async_execute_no_raise_when_disabled(): + c = AsyncGraphQLConnector(base_url="https://example.test") + + async def fake_post(endpoint, json=None): + return _resp({"errors": [{"message": "boom"}]}) + + c.post = fake_post + result = await c.execute("query { bad }", raise_on_errors=False) + assert isinstance(result, httpx.Response) + assert result.json()["errors"][0]["message"] == "boom" diff --git a/src/pyapiary/tests/test_graphql/test_unit_graphql.py b/src/pyapiary/tests/test_graphql/test_unit_graphql.py new file mode 100644 index 0000000..0e66590 --- /dev/null +++ b/src/pyapiary/tests/test_graphql/test_unit_graphql.py @@ -0,0 +1,79 @@ +import json +import httpx +import pytest +from pyapiary.api_connectors.graphql import GraphQLConnector, GraphQLError + + +def _resp(payload, status=200): + req = httpx.Request("POST", "https://example.test/graphql") + return httpx.Response( + status, + request=req, + content=json.dumps(payload).encode("utf-8"), + headers={"Content-Type": "application/json"}, + ) + + +def test_init_sets_endpoint(): + c = GraphQLConnector(base_url="https://example.test") + assert c.base_url == "https://example.test" + assert c.endpoint == "/graphql" + c2 = GraphQLConnector(base_url="https://example.test", endpoint="/api/graphql") + assert c2.endpoint == "/api/graphql" + + +def test_execute_returns_httpx_response(): + c = GraphQLConnector(base_url="https://example.test") + c.post = lambda endpoint, json=None: _resp({"data": {"ok": 1}}) + result = c.execute("query { ok }") + assert isinstance(result, httpx.Response) + assert result.json()["data"]["ok"] == 1 + + +def test_execute_sends_query_and_variables_to_endpoint(): + c = GraphQLConnector(base_url="https://example.test", endpoint="/graphql") + captured = {} + + def fake_post(endpoint, json=None): + captured["endpoint"] = endpoint + captured["json"] = json + return _resp({"data": {}}) + + c.post = fake_post + c.execute("query Q { a }", {"x": 1}) + assert captured["endpoint"] == "/graphql" + assert captured["json"] == {"query": "query Q { a }", "variables": {"x": 1}} + + +def test_execute_defaults_variables_to_empty_dict(): + c = GraphQLConnector(base_url="https://example.test") + captured = {} + + def fake_post(endpoint, json=None): + captured["json"] = json + return _resp({"data": {}}) + + c.post = fake_post + c.execute("query { a }") + assert captured["json"]["variables"] == {} + + +def test_execute_raises_graphql_error_on_200_errors(): + c = GraphQLConnector(base_url="https://example.test") + c.post = lambda endpoint, json=None: _resp({"errors": [{"message": "boom"}]}) + with pytest.raises(GraphQLError, match="boom"): + c.execute("query { bad }") + + +def test_execute_no_raise_when_disabled(): + c = GraphQLConnector(base_url="https://example.test") + c.post = lambda endpoint, json=None: _resp({"errors": [{"message": "boom"}]}) + result = c.execute("query { bad }", raise_on_errors=False) + assert isinstance(result, httpx.Response) + assert result.json()["errors"][0]["message"] == "boom" + + +def test_graphql_error_carries_errors_and_message(): + err = GraphQLError([{"message": "a"}, {"message": "b"}]) + assert err.errors[0]["message"] == "a" + assert str(err) == "a; b" diff --git a/src/pyapiary/tests/test_opencti/test_query_catalog.py b/src/pyapiary/tests/test_opencti/test_query_catalog.py new file mode 100644 index 0000000..fc5f33e --- /dev/null +++ b/src/pyapiary/tests/test_opencti/test_query_catalog.py @@ -0,0 +1,44 @@ +"""Offline validation of the shipped OpenCTI query catalog against the pinned SDL. + +This catches schema drift in our own query constants when OpenCTI changes +versions: regenerate docs/opencti-.graphql, run this suite, and any +query referencing a renamed/removed field or bad arg type fails here -- not in +production. No live OpenCTI instance is needed. +""" +from pathlib import Path +import pytest + +from pyapiary.api_connectors import opencti_queries as q + +# graphql-core is a dev dependency; skip cleanly if unavailable. +graphql = pytest.importorskip("graphql") +from graphql import build_schema, parse, validate # noqa: E402 + + +def _find_sdl() -> Path | None: + for parent in Path(__file__).resolve().parents: + candidate = parent / "docs" / "opencti-6.9.6.graphql" + if candidate.exists(): + return candidate + return None + + +SDL_PATH = _find_sdl() + +SHIPPED_QUERIES = { + name: getattr(q, name) + for name in dir(q) + if name.endswith("_QUERY") and isinstance(getattr(q, name), str) +} + + +def test_catalog_has_queries(): + assert SHIPPED_QUERIES, "no *_QUERY constants found in opencti_queries" + + +@pytest.mark.skipif(SDL_PATH is None, reason="docs/opencti-6.9.6.graphql snapshot not present") +@pytest.mark.parametrize("name", sorted(SHIPPED_QUERIES)) +def test_shipped_query_matches_schema(name): + schema = build_schema(SDL_PATH.read_text()) + errors = validate(schema, parse(SHIPPED_QUERIES[name])) + assert not errors, f"{name} drifted from schema: {[e.message for e in errors]}" diff --git a/src/pyapiary/tests/test_opencti/test_unit_async_opencti.py b/src/pyapiary/tests/test_opencti/test_unit_async_opencti.py new file mode 100644 index 0000000..c002a3f --- /dev/null +++ b/src/pyapiary/tests/test_opencti/test_unit_async_opencti.py @@ -0,0 +1,66 @@ +import json +import httpx +import pytest +from unittest.mock import patch +from pyapiary.api_connectors.opencti import AsyncOpenCTIConnector +from pyapiary.api_connectors import opencti_queries as q + + +def _resp(payload=None): + req = httpx.Request("POST", "https://octi.test/graphql") + return httpx.Response( + 200, + request=req, + content=json.dumps(payload or {"data": {}}).encode("utf-8"), + headers={"Content-Type": "application/json"}, + ) + + +@pytest.mark.asyncio +@patch("pyapiary.api_connectors.opencti.combine_env_configs", return_value={}) +async def test_async_init_explicit(_env): + c = AsyncOpenCTIConnector(url="https://octi.test", token="tok") + assert c.base_url == "https://octi.test" + assert c.headers["Authorization"] == "Bearer tok" + + +@pytest.mark.asyncio +@patch("pyapiary.api_connectors.opencti.combine_env_configs", return_value={}) +async def test_async_init_missing_token_raises(_env): + with pytest.raises(ValueError, match="token"): + AsyncOpenCTIConnector(url="https://octi.test") + + +@pytest.mark.asyncio +@patch("pyapiary.api_connectors.opencti.combine_env_configs", return_value={}) +async def test_async_search_entities(_env): + c = AsyncOpenCTIConnector(url="https://octi.test", token="tok") + captured = {} + + async def fake_execute(query, variables=None, raise_on_errors=True): + captured["query"] = query + captured["vars"] = variables + return _resp() + + c.execute = fake_execute + result = await c.search_entities(types=["Malware"], first=3) + assert isinstance(result, httpx.Response) + assert captured["query"] == q.SEARCH_ENTITIES_QUERY + assert captured["vars"]["types"] == ["Malware"] + assert captured["vars"]["first"] == 3 + + +@pytest.mark.asyncio +@patch("pyapiary.api_connectors.opencti.combine_env_configs", return_value={}) +async def test_async_get_relationships_normalizes(_env): + c = AsyncOpenCTIConnector(url="https://octi.test", token="tok") + captured = {} + + async def fake_execute(query, variables=None, raise_on_errors=True): + captured["vars"] = variables + return _resp() + + c.execute = fake_execute + await c.get_relationships(from_id="abc", relationship_type="uses") + assert captured["vars"]["fromId"] == ["abc"] + assert captured["vars"]["relationship_type"] == ["uses"] diff --git a/src/pyapiary/tests/test_opencti/test_unit_opencti.py b/src/pyapiary/tests/test_opencti/test_unit_opencti.py new file mode 100644 index 0000000..a5e9a72 --- /dev/null +++ b/src/pyapiary/tests/test_opencti/test_unit_opencti.py @@ -0,0 +1,142 @@ +import json +import httpx +import pytest +from unittest.mock import patch +from pyapiary.api_connectors.opencti import OpenCTIConnector +from pyapiary.api_connectors import opencti_queries as q + + +def _resp(payload=None): + req = httpx.Request("POST", "https://octi.test/graphql") + return httpx.Response( + 200, + request=req, + content=json.dumps(payload or {"data": {}}).encode("utf-8"), + headers={"Content-Type": "application/json"}, + ) + + +@patch("pyapiary.api_connectors.opencti.combine_env_configs", return_value={}) +def test_init_explicit_args(_env): + c = OpenCTIConnector(url="https://octi.test", token="tok") + assert c.base_url == "https://octi.test" + assert c.token == "tok" + assert c.headers["Authorization"] == "Bearer tok" + assert c.headers["Content-Type"] == "application/json" + assert c.endpoint == "/graphql" + + +@patch( + "pyapiary.api_connectors.opencti.combine_env_configs", + return_value={"OPENCTI_URL": "https://env.test", "OPENCTI_TOKEN": "envtok"}, +) +def test_init_from_env(_env): + c = OpenCTIConnector() + assert c.base_url == "https://env.test" + assert c.token == "envtok" + assert c.headers["Authorization"] == "Bearer envtok" + + +@patch("pyapiary.api_connectors.opencti.combine_env_configs", return_value={}) +def test_init_missing_url_raises(_env): + with pytest.raises(ValueError, match="url"): + OpenCTIConnector(token="tok") + + +@patch("pyapiary.api_connectors.opencti.combine_env_configs", return_value={}) +def test_init_missing_token_raises(_env): + with pytest.raises(ValueError, match="token"): + OpenCTIConnector(url="https://octi.test") + + +@patch("pyapiary.api_connectors.opencti.combine_env_configs", return_value={}) +def test_filter_group_wraps_key_and_values_in_lists(_env): + fg = OpenCTIConnector.filter_group("name", "Cobalt Strike") + assert fg == { + "mode": "and", + "filters": [ + {"key": ["name"], "values": ["Cobalt Strike"], "operator": "eq", "mode": "or"} + ], + "filterGroups": [], + } + + +@patch("pyapiary.api_connectors.opencti.combine_env_configs", return_value={}) +def test_filter_group_keeps_list_values(_env): + fg = OpenCTIConnector.filter_group("entity_type", ["Malware", "Tool"], operator="eq") + assert fg["filters"][0]["values"] == ["Malware", "Tool"] + assert fg["filters"][0]["key"] == ["entity_type"] + + +@patch("pyapiary.api_connectors.opencti.combine_env_configs", return_value={}) +def test_list_entity_types(_env): + c = OpenCTIConnector(url="https://octi.test", token="tok") + assert c.list_entity_types() == q.SEARCHABLE_TYPES + assert "Indicator" in c.list_entity_types() + + +@patch("pyapiary.api_connectors.opencti.combine_env_configs", return_value={}) +def test_search_entities_sends_query_and_returns_response(_env): + c = OpenCTIConnector(url="https://octi.test", token="tok") + captured = {} + + def fake_execute(query, variables=None, raise_on_errors=True): + captured["query"] = query + captured["vars"] = variables + return _resp() + + c.execute = fake_execute + result = c.search_entities(types=["Malware"], search="cobalt", first=5) + assert isinstance(result, httpx.Response) + assert captured["query"] == q.SEARCH_ENTITIES_QUERY + assert captured["vars"]["types"] == ["Malware"] + assert captured["vars"]["search"] == "cobalt" + assert captured["vars"]["first"] == 5 + assert captured["vars"]["after"] is None + + +@patch("pyapiary.api_connectors.opencti.combine_env_configs", return_value={}) +def test_get_indicators_uses_indicator_query(_env): + c = OpenCTIConnector(url="https://octi.test", token="tok") + captured = {} + + def fake_execute(query, variables=None, raise_on_errors=True): + captured["query"] = query + captured["vars"] = variables + return _resp() + + c.execute = fake_execute + c.get_indicators(first=10) + assert captured["query"] == q.INDICATORS_QUERY + assert captured["vars"]["first"] == 10 + + +@patch("pyapiary.api_connectors.opencti.combine_env_configs", return_value={}) +def test_get_relationships_normalizes_scalars_to_lists(_env): + c = OpenCTIConnector(url="https://octi.test", token="tok") + captured = {} + + def fake_execute(query, variables=None, raise_on_errors=True): + captured["vars"] = variables + return _resp() + + c.execute = fake_execute + c.get_relationships(from_id="abc", relationship_type="uses") + assert captured["vars"]["fromId"] == ["abc"] + assert captured["vars"]["relationship_type"] == ["uses"] + assert captured["vars"]["toId"] is None + + +@patch("pyapiary.api_connectors.opencti.combine_env_configs", return_value={}) +def test_get_relationships_keeps_lists(_env): + c = OpenCTIConnector(url="https://octi.test", token="tok") + captured = {} + + def fake_execute(query, variables=None, raise_on_errors=True): + captured["vars"] = variables + return _resp() + + c.execute = fake_execute + c.get_relationships(to_id=["x", "y"]) + assert captured["vars"]["toId"] == ["x", "y"] + assert captured["vars"]["fromId"] is None diff --git a/uv.lock b/uv.lock index bda0207..a5bc514 100644 --- a/uv.lock +++ b/uv.lock @@ -1,3 +1,3 @@ version = 1 revision = 3 -requires-python = ">=3.13" +requires-python = ">=3.14"