From e3eb51046798acaabb58579212a90cfb7c615c82 Mon Sep 17 00:00:00 2001 From: Weii Wang Date: Wed, 22 Jan 2025 01:37:12 +0800 Subject: [PATCH] Update OpenCTI graphql API client --- opencti_rock/rockcraft.yaml | 2 +- requirements.txt | 2 +- src/opencti.graphql | 12526 ++++++++++++++++++++++++++++++++++ src/opencti.py | 457 +- 4 files changed, 12637 insertions(+), 350 deletions(-) create mode 100644 src/opencti.graphql diff --git a/opencti_rock/rockcraft.yaml b/opencti_rock/rockcraft.yaml index 84a666c..dd89ed4 100644 --- a/opencti_rock/rockcraft.yaml +++ b/opencti_rock/rockcraft.yaml @@ -3,7 +3,7 @@ name: opencti base: ubuntu@24.04 -version: &version '6.4.1' +version: &version '6.4.5' summary: Open Cyber Threat Intelligence Platform description: >- OpenCTI is an open source platform allowing organizations to manage their diff --git a/requirements.txt b/requirements.txt index 9871783..76ab9c8 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,2 +1,2 @@ ops == 2.17.0 -requests == 2.32.3 +gql[requests] == 3.5.0 diff --git a/src/opencti.graphql b/src/opencti.graphql new file mode 100644 index 0000000..4b7b11f --- /dev/null +++ b/src/opencti.graphql @@ -0,0 +1,12526 @@ +directive @auth(for: [Capabilities] = [], and: Boolean = false) on OBJECT | FIELD_DEFINITION + +directive @public on OBJECT | FIELD_DEFINITION + +directive @constraint(minLength: Int, maxLength: Int, startsWith: String, endsWith: String, notContains: String, pattern: String, format: String, min: Int, max: Int, exclusiveMin: Int, exclusiveMax: Int, multipleOf: Int) on INPUT_FIELD_DEFINITION + +"""Controls the rate of traffic.""" +directive @rateLimit( + """Number of occurrences allowed over duration.""" + limit: Int! = 60 + + """Number of seconds before limit is reset.""" + duration: Int! = 60 +) on OBJECT | FIELD_DEFINITION + +""" +Indicates exactly one field must be supplied and this field must not be `null`. +""" +directive @oneOf on INPUT_OBJECT + +""" +A date-time string at UTC, such as 2007-12-03T10:15:30Z, compliant with the `date-time` format outlined in section 5.6 of the RFC 3339 profile of the ISO 8601 standard for representation of dates and times using the Gregorian calendar. +""" +scalar DateTime + +scalar ConstraintString + +scalar ConstraintNumber + +"""The `Upload` scalar type represents a file upload.""" +scalar Upload + +"""STIX ID Scalar Type""" +scalar StixId + +"""STIX Reference Scalar Type""" +scalar StixRef + +"""Arbitrary object""" +scalar Any + +scalar JSON + +enum State { + wait + progress + complete + timeout +} + +enum Capabilities { + CONNECTORAPI + KNOWLEDGE + KNOWLEDGE_KNUPDATE + KNOWLEDGE_KNPARTICIPATE + KNOWLEDGE_KNUPDATE_KNDELETE + KNOWLEDGE_KNUPDATE_KNORGARESTRICT + KNOWLEDGE_KNUPDATE_KNMANAGEAUTHMEMBERS + KNOWLEDGE_KNUPLOAD + KNOWLEDGE_KNASKIMPORT + KNOWLEDGE_KNGETEXPORT + KNOWLEDGE_KNGETEXPORT_KNASKEXPORT + KNOWLEDGE_KNENRICHMENT + EXPLORE + EXPLORE_EXUPDATE + EXPLORE_EXUPDATE_EXDELETE + EXPLORE_EXUPDATE_PUBLISH + INVESTIGATION + INVESTIGATION_INUPDATE + INVESTIGATION_INUPDATE_INDELETE + MODULES + MODULES_MODMANAGE + SETTINGS + SETTINGS_SETPARAMETERS + SETTINGS_SETACCESSES + SETTINGS_SETMARKINGS + SETTINGS_SETLABELS + SETTINGS_SETCUSTOMIZATION + SETTINGS_SECURITYACTIVITY + SETTINGS_FILEINDEXING + SETTINGS_SUPPORT + TAXIIAPI + TAXIIAPI_SETCOLLECTIONS + INGESTION + INGESTION_SETINGESTIONS + CSVMAPPERS + VIRTUAL_ORGANIZATION_ADMIN +} + +enum MemberType { + User + Group + Organization +} + +type PageInfo { + startCursor: String! + endCursor: String! + hasNextPage: Boolean! + hasPreviousPage: Boolean! + globalCount: Int! +} + +enum OrderingMode { + asc + desc +} + +enum FilterMode { + and + or +} + +enum FilterOperator { + eq + not_eq + lt + lte + gt + gte + match + wildcard + contains + not_contains + ends_with + not_ends_with + starts_with + not_starts_with + script + nil + not_nil + search +} + +input FilterGroup { + mode: FilterMode! + filters: [Filter!]! + filterGroups: [FilterGroup!]! +} + +input Filter { + key: [String!]! + values: [Any!]! + operator: FilterOperator + mode: FilterMode +} + +type RepresentativeWithId { + id: String! + value: String + entity_type: String + color: String +} + +type FilterKeysSchema { + entity_type: String! + filters_schema: [FilterDefinitionSchema!]! +} + +type FilterDefinitionSchema { + filterKey: String! + filterDefinition: FilterDefinition! +} + +type FilterDefinition { + filterKey: String! + label: String! + type: String! + multiple: Boolean! + subEntityTypes: [String!]! + elementsForFilterValuesSearch: [String!]! + subFilters: [FilterDefinition!] +} + +enum EditOperation { + add + replace + remove +} + +input EditInput { + key: String! + object_path: String + value: [Any]! + operation: EditOperation +} + +input EditContext { + focusOn: String +} + +type EditUserContext { + name: String! + focusOn: String +} + +input DictionaryInput { + key: String! + value: String! +} + +type Dictionary { + key: String! + value: String! +} + +"""Dependency information containing the name and the deployed version.""" +type DependencyVersion { + name: String! + version: String! +} + +""" +NodeJs memory. +https://nodejs.org/api/process.html#process_process_memoryusage +https://nodejs.org/docs/latest-v11.x/api/v8.html#v8_v8_getheapstatistics +""" +type AppMemory { + rss: Float + heapTotal: Float + heapUsed: Float + external: Float + arrayBuffers: Float + total_heap_size: Float + total_heap_size_executable: Float + total_physical_size: Float + total_available_size: Float + used_heap_size: Float + heap_size_limit: Float + malloced_memory: Float + peak_malloced_memory: Float + does_zap_garbage: Float +} + +input ExportContext { + entity_id: String + entity_type: String! +} + +type AppDebugDistribution { + label: String! + value: Int +} + +type AppDebugStatistics { + objects: [AppDebugDistribution] + relationships: [AppDebugDistribution] +} + +"""Retrieve the application information version add dependencies""" +type AppInfo { + """The OpenCTI application version""" + version: String! + + """The OpenCTI api current memory usage""" + memory: AppMemory + + """The list of OpenCTI software dependencies""" + dependencies: [DependencyVersion!]! + + """The objects statistics""" + debugStats: AppDebugStatistics +} + +type AckDetails { + rate: Float +} + +type MessagesStats { + ack: String + ack_details: AckDetails +} + +type QueueArguments { + config: String +} + +type QueueMetrics { + name: String! + arguments: QueueArguments + messages: String + messages_ready: String + messages_unacknowledged: String + consumers: String + idle_since: DateTime + message_stats: MessagesStats +} + +type QueueTotals { + messages: String + messages_ready: String + messages_unacknowledged: String +} + +type ObjectTotals { + channels: String + consumers: String + queues: String +} + +type OverviewMetrics { + object_totals: ObjectTotals + queue_totals: QueueTotals + message_stats: MessagesStats +} + +type RabbitMQMetrics { + consumers: String + queues: [QueueMetrics] + overview: OverviewMetrics +} + +type SearchMetrics { + query_total: String + fetch_total: String +} + +type IndexingMetrics { + index_total: String + delete_total: String +} + +type GetMetrics { + total: String +} + +type DocsMetrics { + count: String +} + +type ElasticSearchMetrics { + docs: DocsMetrics + search: SearchMetrics + get: GetMetrics + indexing: IndexingMetrics +} + +enum StatsOperation { + count + sum +} + +type TimeSeries { + date: DateTime! + value: Int! +} + +type MultiTimeSeries { + data: [TimeSeries] +} + +input AuditsTimeSeriesParameters { + field: String! + types: [String] + filters: FilterGroup + search: String +} + +input StixCoreObjectsTimeSeriesParameters { + field: String! + types: [String] + filters: FilterGroup + search: String +} + +input StixRelationshipsTimeSeriesParameters { + field: String! + fromOrToId: [String] + elementWithTargetTypes: [String] + fromId: [String] + fromRole: String + fromTypes: [String] + toId: [String] + toRole: String + toTypes: [String] + relationship_type: [String] + confidences: [Int] + search: String + filters: FilterGroup + dynamicFrom: FilterGroup + dynamicTo: FilterGroup +} + +input StixCoreRelationshipsTimeSeriesParameters { + field: String! + fromOrToId: [String] + elementWithTargetTypes: [String] + fromId: [String] + fromRole: String + fromTypes: [String] + toId: [String] + toRole: String + toTypes: [String] + relationship_type: [String] + confidences: [Int] + search: String + filters: FilterGroup + dynamicFrom: FilterGroup + dynamicTo: FilterGroup +} + +type Distribution { + label: String! + entity: StixObjectOrStixRelationshipOrCreator + value: Int +} + +type MultiDistribution { + data: [Distribution] +} + +input StixCoreObjectsDistributionParameters { + objectId: String + relationship_type: [String] + toTypes: [String] + types: [String] + filters: FilterGroup + search: String +} + +input StixCoreRelationshipsDistributionParameters { + field: String! + fromOrToId: [String] + elementWithTargetTypes: [String] + fromId: [String] + fromRole: String + fromTypes: [String] + toId: [String] + toRole: String + toTypes: [String] + relationship_type: [String] + confidences: [Int] + search: String + filters: FilterGroup +} + +type Number { + total: Int! + count: Int! +} + +input StixCoreObjectsNumberParameters { + types: [String] + filters: FilterGroup + search: String +} + +type OpinionsMetrics { + mean: Float + min: Int + max: Int + total: Int +} + +type LogsWorkerConfig { + elasticsearch_url: [String]! + elasticsearch_proxy: String + elasticsearch_index: String! + elasticsearch_username: String + elasticsearch_password: String + elasticsearch_api_key: String + elasticsearch_ssl_reject_unauthorized: Boolean +} + +enum LogsOrdering { + event + timestamp + created_at + event_type + event_scope + _score +} + +type LogConnection { + pageInfo: PageInfo! + edges: [LogEdge] +} + +type LogEdge { + cursor: String! + node: Log! +} + +type ContextData { + entity_id: String + entity_name: String + entity_type: String + from_id: String + to_id: String + message: String! + commit: String + external_references: [ExternalReference!] +} + +type Log { + id: ID! + entity_type: String + event_type: String! + event_scope: String + event_status: String! + timestamp: DateTime! + user_id: String! + user: Creator + raw_data: String + context_uri: String + context_data: ContextData +} + +enum AttributesOrdering { + value + _score +} + +type AttributeConnection { + pageInfo: PageInfo! + edges: [AttributeEdge!]! +} + +type AttributeEdge { + cursor: String! + node: Attribute! +} + +type Attribute { + id: ID! + key: String! + value: String! +} + +input WorkErrorInput { + error: String + source: String +} + +type TaxiiCollection { + id: ID! + name: String + description: String + filters: String + include_inferences: Boolean + score_to_confidence: Boolean + taxii_public: Boolean + authorized_members: [MemberAccess!] +} + +type TaxiiCollectionConnection { + pageInfo: PageInfo! + edges: [TaxiiCollectionEdge]! +} + +type TaxiiCollectionEdge { + cursor: String! + node: TaxiiCollection! +} + +input TaxiiCollectionAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + filters: String + taxii_public: Boolean + authorized_members: [MemberAccessInput!] + include_inferences: Boolean + score_to_confidence: Boolean +} + +enum TaxiiCollectionOrdering { + name + id + _score +} + +type FeedMapping { + type: String! + attribute: String! +} + +type FeedAttribute { + attribute: String! + mappings: [FeedMapping!]! +} + +type Feed { + id: ID! + standard_id: ID! + name: String! + description: String + filters: String + separator: String! + rolling_time: Int! + feed_date_attribute: String + include_header: Boolean! + feed_types: [String!]! + feed_attributes: [FeedAttribute!]! + feed_public: Boolean + authorized_members: [MemberAccess!] +} + +input FeedMappingInput { + type: String! + attribute: String! +} + +input FeedAttributeMappingInput { + attribute: String! + mappings: [FeedMappingInput!]! +} + +input FeedAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + filters: String + separator: String! + feed_date_attribute: String! + rolling_time: Int! + include_header: Boolean! + feed_types: [String!]! + feed_public: Boolean + feed_attributes: [FeedAttributeMappingInput!]! + authorized_members: [MemberAccessInput!] +} + +enum FeedOrdering { + name + rolling_time + feed_types + _score +} + +type FeedEdge { + cursor: String! + node: Feed! +} + +type FeedConnection { + pageInfo: PageInfo! + edges: [FeedEdge]! +} + +type RemoteStreamCollection { + id: ID! + name: String + description: String + filters: String +} + +type StreamCollection { + id: ID! + name: String + description: String + filters: String + stream_live: Boolean + stream_public: Boolean + authorized_members: [MemberAccess!] +} + +type StreamCollectionConnection { + pageInfo: PageInfo! + edges: [StreamCollectionEdge!]! +} + +type StreamCollectionEdge { + cursor: String! + node: StreamCollection! +} + +input StreamCollectionAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + filters: String + stream_live: Boolean + stream_public: Boolean + authorized_members: [MemberAccessInput!] +} + +enum StreamCollectionOrdering { + name + stream_public + id + stream_live + _score +} + +enum SubTypesOrdering { + label + _score +} + +type SubTypeConnection { + pageInfo: PageInfo! + edges: [SubTypeEdge!]! +} + +type SubTypeEdge { + cursor: String! + node: SubType! +} + +type SubType { + id: ID! + label: String! + statuses: [Status!]! + workflowEnabled: Boolean + settings: EntitySetting +} + +enum StatusTemplateOrdering { + name + _score +} + +type StatusTemplate { + id: ID! + name: String! + color: String! + editContext: [EditUserContext!] + usages: Int +} + +type StatusTemplateConnection { + pageInfo: PageInfo! + edges: [StatusTemplateEdge] +} + +type StatusTemplateEdge { + cursor: String! + node: StatusTemplate! +} + +enum StatusOrdering { + type + order + _score +} + +type Status { + id: ID! + template_id: String! + template: StatusTemplate + type: String! + order: Int! + disabled: Boolean +} + +type StatusConnection { + pageInfo: PageInfo! + edges: [StatusEdge!]! +} + +type StatusEdge { + cursor: String! + node: Status! +} + +input StatusAddInput { + template_id: String! + order: Int! +} + +input StatusTemplateAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + color: String! +} + +enum SynchronizersOrdering { + id + name + current_state_date + running + uri + stream_id + _score +} + +type Synchronizer { + id: ID! + name: String! + uri: String! + token: String + stream_id: String! + user: Creator + running: Boolean! + current_state_date: DateTime + listen_deletion: Boolean! + no_dependencies: Boolean! + ssl_verify: Boolean + synchronized: Boolean + queue_messages: Int! +} + +type SynchronizerEdge { + cursor: String! + node: Synchronizer! +} + +type SynchronizerConnection { + pageInfo: PageInfo! + edges: [SynchronizerEdge] +} + +input SynchronizerAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + + "*Constraints:*\n* Minimal length: `2`\n" + uri: String! + token: String + + "*Constraints:*\n* Minimal length: `2`\n" + stream_id: String! + user_id: String + recover: DateTime + current_state_date: DateTime + listen_deletion: Boolean! + no_dependencies: Boolean! + ssl_verify: Boolean + synchronized: Boolean +} + +input SynchronizerFetchInput { + uri: String! + token: String + ssl_verify: Boolean +} + +enum WorksOrdering { + status + timestamp + _score +} + +type WorkMessage { + timestamp: DateTime + message: String + sequence: Int + source: String +} + +type WorkTracking { + import_expected_number: Int + import_last_processed: DateTime + import_processed_number: Int +} + +type Work { + id: ID! + name: String + user: Creator + connector: Connector + timestamp: DateTime! + status: State! + event_source_id: String + received_time: DateTime + processed_time: DateTime + completed_time: DateTime + completed_number: Int + messages: [WorkMessage] + errors: [WorkMessage] + tracking: WorkTracking +} + +type WorkEdge { + cursor: String! + node: Work! +} + +type WorkConnection { + pageInfo: PageInfo! + edges: [WorkEdge] +} + +type FileMetadata { + encoding: String + mimetype: String + version: String + messages: [WorkMessage] + errors: [WorkMessage] + list_filters: String + entity_id: String + entity: StixObject + labels_text: String + labels: [String] + file_markings: [String] + creator_id: String + external_reference_id: String + creator: Creator + description: String + order: Int + inCarousel: Boolean + analysis_content_source: String + analysis_content_type: String + analysis_type: String +} + +enum FileOrdering { + _score + name + lastModified + objectMarking +} + +type File { + id: ID! + entity_type: String! + name: String! + size: Int + lastModified: DateTime + lastModifiedSinceMin: Int + metaData: FileMetadata + objectMarking: [MarkingDefinition!]! + uploadStatus: State! + works: [Work] +} + +type FileEdge { + cursor: String! + node: File! +} + +type FileConnection { + pageInfo: PageInfo! + edges: [FileEdge!]! +} + +enum WidgetPerspective { + entities + relationships + audits +} + +type WidgetColumn { + attribute: String! + displayStyle: String + label: String + variableName: String +} + +type WidgetDataSelection { + label: String + number: Int + attribute: String + date_attribute: String + centerLat: Float + centerLng: Float + zoom: Float + isTo: Boolean + perspective: WidgetPerspective + filters: String + dynamicFrom: String + dynamicTo: String + columns: [WidgetColumn!] + instance_id: String +} + +type WidgetParameters { + title: String + description: String + interval: String + stacked: Boolean + legend: Boolean + distributed: Boolean +} + +type WidgetLayout { + w: Float + h: Float + x: Float + y: Float + i: Float + moved: Boolean + static: Boolean +} + +type Widget { + id: ID! + type: String! + perspective: WidgetPerspective + dataSelection: [WidgetDataSelection!]! + parameters: WidgetParameters + layout: WidgetLayout +} + +type Template { + id: ID! + name: String! + description: String + filters: String + content: String! + template_widgets_ids: [String!]! +} + +type TemplateAndUtils { + template: Template! + template_widgets: [Widget!]! +} + +type IndexedFile { + id: ID! + name: String! + file_id: String! + uploaded_at: DateTime! + entity: StixObject + searchOccurrences: Int +} + +type IndexedFileEdge { + cursor: String! + node: IndexedFile! +} + +type IndexedFileConnection { + pageInfo: PageInfo! + edges: [IndexedFileEdge] +} + +type MetricsByMimeType { + mimeType: String! + count: Int! + size: Float! +} + +type FilesMetrics { + globalCount: Int! + globalSize: Float! + metricsByMimeType: [MetricsByMimeType!] +} + +type OpenCtiFile { + id: ID! + name: String! + mime_type: String! + description: String + order: Int + inCarousel: Boolean +} + +enum BackgroundTaskType { + QUERY + LIST + RULE +} + +type BackgroundTaskError { + id: ID! + timestamp: DateTime + message: String +} + +enum BackgroundTaskScope { + KNOWLEDGE + USER + SETTINGS + IMPORT + DASHBOARD + PUBLIC_DASHBOARD + INVESTIGATION +} + +enum BackgroundTaskActionType { + DELETE + COMPLETE_DELETE + RESTORE + ADD + REMOVE + REPLACE + MERGE + ENRICHMENT + PROMOTE + RULE_ELEMENT_RESCAN + SHARE + UNSHARE + SHARE_MULTIPLE + UNSHARE_MULTIPLE +} + +enum BackgroundTaskContextType { + ATTRIBUTE + RELATION + REVERSED_RELATION +} + +enum BackgroundTasksOrdering { + id + type + completed + created_at + last_execution_date + _score +} + +type BackgroundTaskContext { + field: String + type: BackgroundTaskContextType + values: [String]! +} + +type BackgroundTaskAction { + type: BackgroundTaskActionType + context: BackgroundTaskContext +} + +interface BackgroundTask { + id: ID! + type: BackgroundTaskType + initiator: Creator + actions: [BackgroundTaskAction] + created_at: DateTime + last_execution_date: DateTime + completed: Boolean + task_expected_number: Int + task_processed_number: Int + errors: [BackgroundTaskError] +} + +type RuleTask implements BackgroundTask { + id: ID! + type: BackgroundTaskType + initiator: Creator + actions: [BackgroundTaskAction] + created_at: DateTime + last_execution_date: DateTime + completed: Boolean + task_expected_number: Int + task_processed_number: Int + errors: [BackgroundTaskError] + rule: ID! + enable: Boolean +} + +type ListTask implements BackgroundTask { + id: ID! + type: BackgroundTaskType + initiator: Creator + actions: [BackgroundTaskAction] + created_at: DateTime + last_execution_date: DateTime + completed: Boolean + task_expected_number: Int + task_processed_number: Int + errors: [BackgroundTaskError] + scope: BackgroundTaskScope! + authorized_members: [MemberAccess!] + authorized_authorities: [String] + task_ids: [ID!] +} + +type QueryTask implements BackgroundTask { + id: ID! + type: BackgroundTaskType + initiator: Creator + actions: [BackgroundTaskAction] + created_at: DateTime + last_execution_date: DateTime + completed: Boolean + task_expected_number: Int + task_processed_number: Int + errors: [BackgroundTaskError] + scope: BackgroundTaskScope! + authorized_members: [MemberAccess!] + authorized_authorities: [String] + task_filters: String! + task_search: String +} + +type BackgroundTaskConnectionEdge { + cursor: String! + node: BackgroundTask! +} + +type BackgroundTaskConnection { + pageInfo: PageInfo! + edges: [BackgroundTaskConnectionEdge] +} + +input BackgroundTaskContextOptionsInput { + includeNeighbours: Boolean +} + +input BackgroundTaskContextInput { + field: String + type: BackgroundTaskContextType + values: [String]! + options: BackgroundTaskContextOptionsInput +} + +input BackgroundTaskActionInput { + containerId: String + type: BackgroundTaskActionType! + context: BackgroundTaskContextInput +} + +input ListTaskAddInput { + ids: [ID!] + actions: [BackgroundTaskActionInput]! + scope: BackgroundTaskScope! +} + +input QueryTaskAddInput { + filters: String + search: String + excluded_ids: [ID] + actions: [BackgroundTaskActionInput]! + scope: BackgroundTaskScope! +} + +input RetentionRuleAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + filters: String + + "*Constraints:*\n* Minimal value: `1`\n" + max_retention: Int! + retention_unit: RetentionUnit + scope: RetentionRuleScope! +} + +enum RetentionRuleOrdering { + name + scope + remaining_count + last_execution_date + max_retention + _score +} + +enum RetentionRuleScope { + knowledge + file + workbench +} + +enum RetentionUnit { + minutes + hours + days +} + +type RetentionRule { + id: ID! + standard_id: String! + name: String! + filters: String! + max_retention: Int! + retention_unit: RetentionUnit! + last_execution_date: DateTime + last_deleted_count: Int + remaining_count: Int + scope: RetentionRuleScope! +} + +type RetentionRuleConnection { + pageInfo: PageInfo! + edges: [RetentionRuleEdge] +} + +type RetentionRuleEdge { + cursor: String! + node: RetentionRule! +} + +type RetentionRuleEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): RetentionRule +} + +interface BasicObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! +} + +interface InternalObject { + id: ID! + entity_type: String! +} + +type Module { + id: ID! + enable: Boolean! + running: Boolean! + warning: Boolean +} + +type Cluster { + instances_number: Int! +} + +type Provider { + name: String! + type: String + strategy: String + provider: String +} + +type UserStatus { + status: String! + message: String! +} + +input SettingsMessageInput { + id: ID + message: String! + activated: Boolean! + dismissible: Boolean! + color: String + recipients: [String!] +} + +type SettingsMessage { + id: ID! + message: String! + activated: Boolean! + dismissible: Boolean! + updated_at: DateTime! + color: String + recipients: [Member!] +} + +enum PlatformCriticalAlertType { + GROUP_WITH_NULL_CONFIDENCE_LEVEL +} + +type PlatformCriticalAlertDetails { + groups: [Group!]! +} + +type PlatformCriticalAlert { + message: String! + type: PlatformCriticalAlertType! + details: PlatformCriticalAlertDetails +} + +type PlatformProtectedSubConfig { + enabled: Boolean! + protected_ids: [String!]! +} + +type PlatformProtectedSensitiveConfig { + enabled: Boolean! + markings: PlatformProtectedSubConfig! + groups: PlatformProtectedSubConfig! + roles: PlatformProtectedSubConfig! + rules: PlatformProtectedSubConfig! + ce_ee_toggle: PlatformProtectedSubConfig! + file_indexing: PlatformProtectedSubConfig! + platform_organization: PlatformProtectedSubConfig! +} + +type Settings implements InternalObject & BasicObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String!]! + platform_organization: Organization + platform_title: String + platform_favicon: String + platform_email: String + platform_cluster: Cluster! + platform_modules: [Module!] + platform_url: String + platform_providers: [Provider!]! + platform_user_statuses: [UserStatus!]! + platform_language: String + platform_theme: String + platform_theme_dark_background: String + platform_theme_dark_paper: String + platform_theme_dark_nav: String + platform_theme_dark_primary: String + platform_theme_dark_secondary: String + platform_theme_dark_accent: String + platform_theme_dark_logo: String + platform_theme_dark_logo_collapsed: String + platform_theme_dark_logo_login: String + platform_theme_light_background: String + platform_theme_light_paper: String + platform_theme_light_nav: String + platform_theme_light_primary: String + platform_theme_light_secondary: String + platform_theme_light_accent: String + platform_theme_light_logo: String + platform_theme_light_logo_collapsed: String + platform_theme_light_logo_login: String + platform_map_tile_server_dark: String + platform_map_tile_server_light: String + platform_openbas_url: String + platform_openbas_disable_display: Boolean + platform_openerm_url: String + platform_openmtd_url: String + platform_ai_enabled: Boolean! + platform_ai_type: String + platform_ai_model: String + platform_ai_has_token: Boolean! + platform_login_message: String + platform_consent_message: String + platform_consent_confirm_text: String + platform_banner_text: String + platform_banner_level: String + platform_session_idle_timeout: Int + platform_session_timeout: Int + platform_whitemark: Boolean + platform_demo: Boolean + platform_reference_attachment: Boolean + platform_feature_flags: [Module!] + platform_critical_alerts: [PlatformCriticalAlert!]! + platform_trash_enabled: Boolean! + platform_protected_sensitive_config: PlatformProtectedSensitiveConfig! + created_at: DateTime! + updated_at: DateTime! + enterprise_edition: DateTime + activity_listeners: [Member!] + otp_mandatory: Boolean + password_policy_min_length: Int + password_policy_max_length: Int + password_policy_min_symbols: Int + password_policy_min_numbers: Int + password_policy_min_words: Int + password_policy_min_lowercase: Int + password_policy_min_uppercase: Int + platform_messages: [SettingsMessage!] + messages_administration: [SettingsMessage!] + analytics_google_analytics_v4: String + editContext: [EditUserContext!] +} + +enum GroupsOrdering { + name + default_assignation + no_creators + restrict_delete + auto_new_marking + created_at + updated_at + group_confidence_level + _score +} + +type GroupConnection { + pageInfo: PageInfo! + edges: [GroupEdge] +} + +type GroupEdge { + cursor: String! + node: Group! +} + +input DefaultMarkingInput { + entity_type: String! + values: [String!] +} + +type DefaultMarking { + entity_type: String + values: [MarkingDefinition!] +} + +type Group implements InternalObject & BasicObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + name: String! + default_assignation: Boolean + no_creators: Boolean + restrict_delete: Boolean + auto_new_marking: Boolean + description: String + default_dashboard: Workspace + members(first: Int, after: ID, orderBy: UsersOrdering, orderMode: OrderingMode, search: String): UserConnection + created_at: DateTime + updated_at: DateTime + roles(orderBy: RolesOrdering, orderMode: OrderingMode): RoleConnection + allowed_marking: [MarkingDefinition!] + default_marking: [DefaultMarking!] + not_shareable_marking_types: [String!]! + max_shareable_marking: [MarkingDefinition!]! + default_hidden_types: [String!] + group_confidence_level: ConfidenceLevel + editContext: [EditUserContext!] +} + +input GroupAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + default_assignation: Boolean + no_creators: Boolean + restrict_delete: Boolean + auto_new_marking: Boolean + clientMutationId: String + group_confidence_level: ConfidenceLevelInput! +} + +enum UnitSystem { + auto + Metric + Imperial +} + +enum UsersOrdering { + name + user_email + firstname + lastname + language + external + created_at + updated_at + _score +} + +type UserConnection { + pageInfo: PageInfo! + edges: [UserEdge!]! +} + +type CreatorConnection { + pageInfo: PageInfo! + edges: [CreatorEdge] +} + +type AssigneeConnection { + pageInfo: PageInfo! + edges: [AssigneeEdge!]! +} + +type ParticipantConnection { + pageInfo: PageInfo! + edges: [ParticipantEdge!]! +} + +type MemberConnection { + pageInfo: PageInfo! + edges: [MemberEdge!]! +} + +type UserEdge { + cursor: String! + node: User! +} + +type CreatorEdge { + cursor: String! + node: Creator! +} + +type AssigneeEdge { + cursor: String! + node: Assignee! +} + +type ParticipantEdge { + cursor: String! + node: Participant! +} + +type MemberEdge { + cursor: String! + node: Member! +} + +type Assignee { + id: ID! + name: String! + entity_type: String! +} + +type Participant { + id: ID! + name: String! + entity_type: String! +} + +type Member { + id: ID! + name: String! + entity_type: String! + effective_confidence_level: EffectiveConfidenceLevel + group_confidence_level: ConfidenceLevel +} + +type MemberAccess { + id: ID! + name: String! + entity_type: String! + access_right: String! +} + +input MemberAccessInput { + id: ID! + access_right: String! +} + +type OtpElement { + secret: String! + uri: String! +} + +type Creator { + id: ID! + name: String! + entity_type: String! + representative: Representative! +} + +type ConfidenceLevel { + max_confidence: Int + overrides: [ConfidenceLevelOverride!]! +} + +type ConfidenceLevelOverride { + entity_type: String! + max_confidence: Int! +} + +type EffectiveConfidenceLevelOverride { + entity_type: String! + max_confidence: Int! + source: EffectiveConfidenceLevelSource +} + +type EffectiveConfidenceLevel { + max_confidence: Int! + overrides: [EffectiveConfidenceLevelOverride!]! + source: EffectiveConfidenceLevelSource +} + +type EffectiveConfidenceLevelSource { + type: EffectiveConfidenceLevelSourceType! + object: EffectiveConfidenceLevelSourceObject +} + +enum EffectiveConfidenceLevelSourceType { + User + Group + Bypass +} + +union EffectiveConfidenceLevelSourceObject = Group | User + +type User implements BasicObject & InternalObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + user_email: String! + api_token: String! + personal_notifiers: [Notifier!] + individual_id: String + name: String! + description: String + firstname: String + otp_activated: Boolean + stateless_session: Boolean + otp_qr: String + otp_mandatory: Boolean + lastname: String + theme: String + language: String + external: Boolean + roles(orderBy: RolesOrdering, orderMode: OrderingMode): [Role!]! + capabilities: [Capability]! + default_hidden_types: [String!]! + user_confidence_level: ConfidenceLevel + effective_confidence_level: EffectiveConfidenceLevel + no_creators: Boolean + restrict_delete: Boolean + groups(orderBy: GroupsOrdering, orderMode: OrderingMode): GroupConnection + objectOrganization(orderBy: OrganizationsOrdering, orderMode: OrderingMode): OrganizationConnection + created_at: DateTime! + updated_at: DateTime! + sessions: [SessionDetail] + default_time_field: String + account_status: String! + account_lock_after_date: DateTime + administrated_organizations: [Organization!]! + unit_system: UnitSystem + submenu_show_icons: Boolean + submenu_auto_collapse: Boolean + monochrome_labels: Boolean + editContext: [EditUserContext!] +} + +type MeUser implements BasicObject & InternalObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String!]! + user_email: String! + name: String! + description: String + firstname: String + otp_activated: Boolean + otp_qr: String + lastname: String + theme: String + language: String + external: Boolean + individual_id: String + api_token: String! + personal_notifiers: [Notifier!] + objectOrganization: MeOrganizationConnection + capabilities: [Capability!]! + default_hidden_types: [String]! + user_confidence_level: ConfidenceLevel + effective_confidence_level: EffectiveConfidenceLevel + no_creators: Boolean + restrict_delete: Boolean + allowed_marking: [MarkingDefinition!] + default_marking: [DefaultMarking!] + max_shareable_marking: [MarkingDefinition!] + otp_mandatory: Boolean + groups(orderBy: GroupsOrdering, orderMode: OrderingMode): GroupConnection + default_dashboards: [Workspace!]! + default_dashboard: Workspace + default_time_field: String + account_status: String! + account_lock_after_date: DateTime + administrated_organizations: [Organization!]! + unit_system: UnitSystem + submenu_show_icons: Boolean + submenu_auto_collapse: Boolean + monochrome_labels: Boolean + can_manage_sensitive_config: Boolean + draftContext: DraftWorkspace +} + +type SessionDetail { + id: ID! + created: DateTime + ttl: Int + originalMaxAge: Int +} + +type UserSession { + user: Creator + sessions: [SessionDetail] +} + +input UserAddInput { + "*Constraints:*\n* Minimal length: `5`\n* Must match format: `email`\n" + user_email: String! + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + password: String! + firstname: String + lastname: String + description: String + language: String + theme: String + objectOrganization: [ID!] + account_status: String + account_lock_after_date: DateTime + unit_system: String + submenu_show_icons: Boolean + submenu_auto_collapse: Boolean + monochrome_labels: Boolean + groups: [ID!] + user_confidence_level: ConfidenceLevelInput +} + +input ConfidenceLevelInput { + max_confidence: Int + overrides: [ConfidenceLevelOverrideInput!]! +} + +input ConfidenceLevelOverrideInput { + entity_type: String! + max_confidence: Int! +} + +input UserLoginInput { + email: String! + password: String! +} + +input UserOTPLoginInput { + code: String! +} + +input UserOTPActivationInput { + secret: String! + code: String! +} + +enum RolesOrdering { + name + created_at + updated_at + _score +} + +type RoleConnection { + pageInfo: PageInfo! + edges: [RoleEdge!] +} + +type RoleEdge { + cursor: String! + node: Role! +} + +type Role implements BasicObject & InternalObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + name: String! + description: String + created_at: DateTime! + updated_at: DateTime! + capabilities: [Capability] + editContext: [EditUserContext!] + can_manage_sensitive_config: Boolean +} + +input RoleAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + clientMutationId: String +} + +type CapabilityConnection { + pageInfo: PageInfo! + edges: [CapabilityEdge] +} + +type CapabilityEdge { + cursor: String! + node: Capability! +} + +type Capability implements BasicObject & InternalObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + name: String! + description: String + attribute_order: Int + created_at: DateTime! + updated_at: DateTime! + editContext: [EditUserContext!] +} + +enum ConnectorType { + EXTERNAL_IMPORT + INTERNAL_IMPORT_FILE + INTERNAL_ENRICHMENT + INTERNAL_ANALYSIS + INTERNAL_EXPORT_FILE + STREAM +} + +input ExportAskInput { + format: String! + exportType: String! + contentMaxMarkings: [String] + fileMarkings: [String] +} + +input StixCoreObjectsExportAskInput { + format: String! + exportType: String! + contentMaxMarkings: [String] + fileMarkings: [String] + search: String + exportContext: ExportContext + orderBy: StixCoreObjectsOrdering + orderMode: OrderingMode + filters: FilterGroup + selectedIds: [String] +} + +input StixCoreRelationshipsExportAskInput { + format: String! + exportType: String! + contentMaxMarkings: [String] + fileMarkings: [String] + exportContext: ExportContext + search: String + orderBy: StixCoreRelationshipsOrdering + orderMode: OrderingMode + selectedIds: [String] + fromOrToId: [String] + elementWithTargetTypes: [String] + fromId: [String] + fromRole: String + fromTypes: [String] + toId: [String] + toRole: String + toTypes: [String] + relationship_type: [String] + filters: FilterGroup +} + +input StixCyberObservablesExportAskInput { + format: String! + exportType: String! + exportContext: ExportContext + contentMaxMarkings: [String] + fileMarkings: [String] + search: String + orderBy: StixCyberObservablesOrdering + orderMode: OrderingMode + filters: FilterGroup + selectedIds: [String] +} + +input RegisterConnectorInput { + id: ID! + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + type: ConnectorType! + scope: [String!] + auto: Boolean + only_contextual: Boolean + playbook_compatible: Boolean +} + +type RabbitMQConnection { + host: String! + vhost: String! + use_ssl: Boolean! + port: Int! + user: String! + pass: String! +} + +input ConnectorInfoInput { + run_and_terminate: Boolean! + buffering: Boolean! + queue_threshold: Float! + queue_messages_size: Float! + next_run_datetime: DateTime + last_run_datetime: DateTime +} + +type ConnectorInfo { + run_and_terminate: Boolean! + buffering: Boolean! + queue_threshold: Float! + queue_messages_size: Float! + next_run_datetime: DateTime + last_run_datetime: DateTime +} + +type ConnectorConfig { + connection: RabbitMQConnection! + listen: String! + listen_routing: String! + listen_exchange: String! + push: String! + push_routing: String! + push_exchange: String! +} + +type ConnectorMetadata { + configuration: String! +} + +type ConnectorConfiguration { + id: ID! + name: String! + configuration: String! +} + +type ConnectorQueueDetails { + messages_number: Float! + messages_size: Float! +} + +type Connector implements BasicObject & InternalObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + name: String! + active: Boolean + auto: Boolean + only_contextual: Boolean + playbook_compatible: Boolean + connector_trigger_filters: String + connector_type: String + connector_scope: [String!] + connector_state: String + connector_schema: String + connector_schema_ui: String + connector_state_reset: Boolean + connector_user_id: ID + connector_user: User + connector_queue_details: ConnectorQueueDetails! + connector_info: ConnectorInfo + updated_at: DateTime + created_at: DateTime + config: ConnectorConfig + works(status: String): [Work] + built_in: Boolean + configurations: [ConnectorConfiguration!] +} + +type RuleExecutionError { + timestamp: DateTime + source: String + error: String +} + +type RuleManager { + id: ID! + activated: Boolean! + lastEventId: String + errors: [RuleExecutionError] +} + +type DisplayStep { + source: String + source_color: String + relation: String + target: String + target_color: String + identifier: String + identifier_color: String + action: String +} + +type Display { + if: [DisplayStep] + then: [DisplayStep] +} + +type Rule { + id: ID! + name: String! + description: String! + activated: Boolean! + category: String + display: Display +} + +type InferenceAttribute { + field: String! + value: String! +} + +type Inference { + rule: Rule! + explanation: [StixObjectOrStixRelationship]! + attributes: [InferenceAttribute] +} + +enum DraftOperation { + create + update + delete +} + +type DraftVersion { + draft_id: String! + draft_operation: DraftOperation! +} + +interface StixObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + creators: [Creator!] + x_opencti_inferences: [Inference] +} + +enum StixMetaObjectsOrdering { + entity_type + created + modified + spec_version + created_at + updated_at + _score +} + +type StixMetaObjectConnection { + pageInfo: PageInfo! + edges: [StixMetaObjectEdge] +} + +type StixMetaObjectEdge { + cursor: String! + node: StixMetaObject! +} + +interface StixMetaObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + created: DateTime + modified: DateTime +} + +enum MarkingDefinitionsOrdering { + definition_type + definition + x_opencti_order + x_opencti_color + created + modified + created_at + updated_at + _score +} + +type MarkingDefinitionConnection { + pageInfo: PageInfo! + edges: [MarkingDefinitionEdge!]! +} + +type MarkingDefinitionEdge { + cursor: String! + node: MarkingDefinition! +} + +type MarkingDefinition implements BasicObject & StixObject & StixMetaObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + created: DateTime + modified: DateTime + definition_type: String + definition: String + x_opencti_order: Int! + x_opencti_color: String + creators: [Creator!] + toStix: String + editContext: [EditUserContext!] +} + +input MarkingDefinitionAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + definition_type: String! + definition: String! + x_opencti_order: Int! + x_opencti_color: String + created: DateTime + modified: DateTime + clientMutationId: String + update: Boolean +} + +type MarkingDefinitionShort { + id: ID! + standard_id: String! + entity_type: String! + representative: Representative + definition_type: String + definition: String + x_opencti_order: Int! + x_opencti_color: String +} + +enum LabelsOrdering { + value + color + created + modified + created_at + updated_at + _score +} + +type LabelConnection { + pageInfo: PageInfo! + edges: [LabelEdge!]! +} + +type LabelEdge { + cursor: String! + node: Label! +} + +type Label implements BasicObject & StixObject & StixMetaObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + created: DateTime + modified: DateTime + value: String + color: String + creators: [Creator!] + toStix: String + editContext: [EditUserContext!] +} + +input LabelAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + value: String! + color: String + created: DateTime + modified: DateTime + clientMutationId: String + update: Boolean +} + +enum ExternalReferencesOrdering { + source_name + url + hash + external_id + created + modified + created_at + updated_at + creator + _score +} + +type ExternalReferenceConnection { + pageInfo: PageInfo! + edges: [ExternalReferenceEdge!]! +} + +type ExternalReferenceEdge { + cursor: String! + node: ExternalReference! +} + +type ExternalReference implements BasicObject & StixObject & StixMetaObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + created: DateTime + modified: DateTime + source_name: String! + description: String + url: String + hash: String + external_id: String + references(types: [String]): StixObjectOrStixRelationshipConnection + fileId: String + creators: [Creator!] + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection! + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection! + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input ExternalReferenceAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + source_name: String! + description: String + url: String + hash: String + file: Upload + external_id: String + created: DateTime + modified: DateTime + clientMutationId: String + update: Boolean +} + +enum KillChainPhasesOrdering { + x_opencti_order + kill_chain_name + phase_name + created + modified + created_at + updated_at + _score +} + +type KillChainPhaseConnection { + pageInfo: PageInfo! + edges: [KillChainPhaseEdge!]! +} + +type KillChainPhaseEdge { + cursor: String! + node: KillChainPhase! +} + +type KillChainPhase implements BasicObject & StixObject & StixMetaObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + created: DateTime + modified: DateTime + kill_chain_name: String! + phase_name: String! + x_opencti_order: Int + creators: [Creator!] + editContext: [EditUserContext!] +} + +input KillChainPhaseAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + kill_chain_name: String! + phase_name: String! + x_opencti_order: Int! + created: DateTime + modified: DateTime + clientMutationId: String + update: Boolean +} + +type Representative { + main: String! + secondary: String +} + +enum StixCoreObjectsOrdering { + name + entity_type + created + modified + created_at + updated_at + start_time + stop_time + published + valid_from + valid_until + first_seen + last_seen + indicator_pattern + x_opencti_workflow_id + createdBy + creator + objectMarking + observable_value + subject + value + opinions_metrics_mean + opinions_metrics_min + opinions_metrics_max + opinions_metrics_total + _score +} + +type StixCoreObjectConnection { + pageInfo: PageInfo! + edges: [StixCoreObjectEdge!]! +} + +type StixCoreObjectEdge { + cursor: String! + node: StixCoreObject! +} + +union OrganizationOrIndividual = Organization | Individual + +interface StixCoreObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + opinions_metrics: OpinionsMetrics +} + +enum StixDomainObjectsOrdering { + name + entity_type + created + modified + created_at + updated_at + published + valid_from + valid_until + indicator_pattern + x_opencti_workflow_id + createdBy + creator + objectMarking + _score + first_seen + last_seen + attribute_count + x_opencti_negative + confidence + first_observed + last_observed + number_observed + incident_type + severity + priority + rating + context + attribute_abstract + opinion + pattern_type + report_types + note_types + channel_types + x_opencti_base_severity + event_types + x_opencti_organization_type + submitted + product + result_name + operatingSystem + x_opencti_cvss_base_severity +} + +type StixDomainObjectConnection { + pageInfo: PageInfo! + edges: [StixDomainObjectEdge] +} + +type StixDomainObjectEdge { + cursor: String! + node: StixDomainObject! +} + +interface StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input StixDomainObjectAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + confidence: Int + pattern_type: String + context: String + pattern: String + aliases: [String] + x_opencti_aliases: [String] + type: String! + createdBy: String + objectMarking: [String] + objectLabel: [String] + killChainPhases: [String] + externalReferences: [String] + objects: [String] + clientMutationId: String + created: DateTime + modified: DateTime + update: Boolean +} + +enum AttackPatternsOrdering { + x_mitre_id + name + created + modified + created_at + updated_at + x_opencti_workflow_id + _score +} + +type AttackPatternConnection { + pageInfo: PageInfo! + edges: [AttackPatternEdge!]! +} + +type AttackPatternEdge { + cursor: String! + node: AttackPattern! +} + +type AttackPattern implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + aliases: [String] + x_mitre_platforms: [String!] + x_mitre_permissions_required: [String] + x_mitre_detection: String + x_mitre_id: String + killChainPhases: [KillChainPhase!] + coursesOfAction(first: Int, after: ID, orderBy: CoursesOfActionOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): CourseOfActionConnection + parentAttackPatterns(first: Int, after: ID, orderBy: AttackPatternsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): AttackPatternConnection + subAttackPatterns(first: Int, after: ID, orderBy: AttackPatternsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): AttackPatternConnection + isSubAttackPattern: Boolean + dataComponents: DataComponentConnection + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input AttackPatternAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + aliases: [String] + revoked: Boolean + lang: String + confidence: Int + x_mitre_platforms: [String!] + x_mitre_permissions_required: [String] + x_mitre_detection: String + x_mitre_id: String + createdBy: String + objectMarking: [String] + objectOrganization: [String] + objectLabel: [String] + killChainPhases: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +type AttackPatternForMatrix { + attack_pattern_id: String! + name: String! + description: String + x_mitre_id: String + subAttackPatternsIds: [String!] + subAttackPatternsSearchText: String + killChainPhasesIds: [String!] +} + +type AttackPatternsByKillChain { + kill_chain_id: String! + kill_chain_name: String! + phase_name: String! + x_opencti_order: Int! + attackPatterns: [AttackPatternForMatrix!] +} + +type AttackPatternsMatrix { + attackPatternsOfPhases: [AttackPatternsByKillChain!] +} + +enum CampaignsOrdering { + name + first_seen + last_seen + role_played + created + modified + created_at + updated_at + objectMarking + x_opencti_workflow_id + confidence + _score +} + +type CampaignConnection { + pageInfo: PageInfo! + edges: [CampaignEdge] +} + +type CampaignEdge { + cursor: String! + node: Campaign! +} + +type Campaign implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + aliases: [String] + first_seen: DateTime + last_seen: DateTime + objective: String + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input CampaignAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + aliases: [String] + revoked: Boolean + lang: String + confidence: Int + first_seen: DateTime + last_seen: DateTime + objective: String + createdBy: String + objectMarking: [String] + objectAssignee: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum ContainersOrdering { + name + published + created + modified + created_at + updated_at + createdBy + objectMarking + x_opencti_workflow_id + creator + entity_type + _score +} + +type ContainerConnection { + pageInfo: PageInfo! + edges: [ContainerEdge] +} + +type ContainerEdge { + cursor: String! + node: Container! +} + +interface Container { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + avatar: OpenCtiFile + authorized_members: [MemberAccess!] + currentUserAccessRight: String + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + relatedContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], viaTypes: [String]): ContainerConnection + contentsFromTemplate(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + templates: [Template!] + templateAndUtils(templateId: String!): TemplateAndUtils + creators: [Creator!] + workflowEnabled: Boolean + status: Status +} + +enum NotesOrdering { + attribute_abstract + created + modified + created_at + updated_at + createdBy + x_opencti_workflow_id + objectMarking + note_types + creator + _score +} + +type NoteConnection { + pageInfo: PageInfo! + edges: [NoteEdge!]! +} + +type NoteEdge { + cursor: String! + node: Note! +} + +type Note implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Container { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + authorized_members: [MemberAccess!] + currentUserAccessRight: String + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + relatedContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], viaTypes: [String]): ContainerConnection + attribute_abstract: String + content: String! + authors: [String] + note_types: [String] + likelihood: Int + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + contentsFromTemplate(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + templates: [Template!] + templateAndUtils(templateId: String!): TemplateAndUtils + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input NoteAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + attribute_abstract: String + + "*Constraints:*\n* Minimal length: `2`\n" + content: String! + authors: [String] + note_types: [String] + likelihood: Int + revoked: Boolean + lang: String + createdBy: String + confidence: Int + objectMarking: [String] + objectLabel: [String] + objectOrganization: [String] + externalReferences: [String] + objects: [String] + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +input NoteUserAddInput { + stix_id: String + x_opencti_stix_ids: [String] + attribute_abstract: String + + "*Constraints:*\n* Minimal length: `2`\n" + content: String! + note_types: [String] + likelihood: Int + revoked: Boolean + lang: String + confidence: Int + objectMarking: [String] + objectLabel: [String] + objectOrganization: [String] + externalReferences: [String] + objects: [String] + created: DateTime + modified: DateTime + clientMutationId: String + update: Boolean +} + +enum ObservedDatasOrdering { + first_observed + last_observed + number_observed + created + modified + created_at + updated_at + createdBy + x_opencti_workflow_id + objectMarking + confidence + _score +} + +type ObservedDataConnection { + pageInfo: PageInfo! + edges: [ObservedDataEdge] +} + +type ObservedDataEdge { + cursor: String! + node: ObservedData! +} + +type ObservedData implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Container { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + authorized_members: [MemberAccess!] + currentUserAccessRight: String + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + relatedContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], viaTypes: [String]): ContainerConnection + first_observed: DateTime! + last_observed: DateTime! + number_observed: Int! + name: String! + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + contentsFromTemplate(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + templates: [Template!] + templateAndUtils(templateId: String!): TemplateAndUtils + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input ObservedDataAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + first_observed: DateTime! + last_observed: DateTime! + number_observed: Int! + revoked: Boolean + lang: String + confidence: Int + createdBy: String + objectMarking: [String] + objectLabel: [String] + objectOrganization: [String] + externalReferences: [String] + objects: [String]! + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum OpinionsOrdering { + opinion + created + modified + created_at + updated_at + createdBy + objectMarking + x_opencti_workflow_id + confidence + creator + _score +} + +type OpinionConnection { + pageInfo: PageInfo! + edges: [OpinionEdge] +} + +type OpinionEdge { + cursor: String! + node: Opinion! +} + +type Opinion implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Container { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + authorized_members: [MemberAccess!] + currentUserAccessRight: String + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + relatedContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], viaTypes: [String]): ContainerConnection + explanation: String + authors: [String] + opinion: String! + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + contentsFromTemplate(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + templates: [Template!] + templateAndUtils(templateId: String!): TemplateAndUtils + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input OpinionAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n" + opinion: String! + explanation: String + authors: [String] + revoked: Boolean + lang: String + confidence: Int + createdBy: String + objectMarking: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + objects: [String] + created: DateTime + modified: DateTime + update: Boolean + x_opencti_workflow_id: String + clientMutationId: String + file: Upload +} + +input OpinionUserAddInput { + stix_id: String + x_opencti_stix_ids: [String] + opinion: String! + explanation: String + authors: [String] + revoked: Boolean + lang: String + confidence: Int + objectMarking: [String] + objectLabel: [String] + objectOrganization: [String] + externalReferences: [String] + objects: [String] + created: DateTime + modified: DateTime + update: Boolean + clientMutationId: String +} + +enum ReportsOrdering { + name + created + modified + published + created_at + updated_at + createdBy + creator + objectMarking + report_types + x_opencti_workflow_id + _score +} + +type ReportConnection { + pageInfo: PageInfo! + edges: [ReportEdge] +} + +type ReportEdge { + cursor: String! + node: Report! +} + +type Report implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Container { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + avatar: OpenCtiFile + authorized_members: [MemberAccess!] + currentUserAccessRight: String + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + relatedContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], viaTypes: [String]): ContainerConnection + name: String! + description: String + content: String + content_mapping: String + report_types: [String] + x_opencti_reliability: String + published: DateTime + objectParticipant: [Participant!] + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + contentsFromTemplate(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + templates: [Template!] + templateAndUtils(templateId: String!): TemplateAndUtils + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + deleteWithElementsCount: Int +} + +input ReportAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + content: String + content_mapping: String + published: DateTime! + report_types: [String] + x_opencti_reliability: String + revoked: Boolean + lang: String + confidence: Int + createdBy: String + objectOrganization: [String] + objectMarking: [String] + objectAssignee: [String] + objectParticipant: [String] + objectLabel: [String] + externalReferences: [String] + objects: [String] + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum CoursesOfActionOrdering { + name + created + modified + created_at + updated_at + x_opencti_workflow_id + objectMarking + x_mitre_id + _score +} + +type CourseOfActionConnection { + pageInfo: PageInfo! + edges: [CourseOfActionEdge] +} + +type CourseOfActionEdge { + cursor: String! + node: CourseOfAction! +} + +type CourseOfAction implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + x_opencti_aliases: [String] + x_mitre_id: String + x_opencti_threat_hunting: String + x_opencti_log_sources: [String] + attackPatterns: AttackPatternConnection + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input CourseOfActionAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + x_opencti_aliases: [String] + x_mitre_id: String + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum IdentitiesOrdering { + name + created + modified + created_at + updated_at + x_opencti_workflow_id + _score +} + +type IdentityConnection { + pageInfo: PageInfo! + edges: [IdentityEdge] +} + +type IdentityEdge { + cursor: String! + node: Identity! +} + +enum IdentityType { + Sector + Organization + Individual + System +} + +interface Identity { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + avatar: OpenCtiFile + identity_class: String! + name: String! + description: String + roles: [String] + contact_information: String + x_opencti_aliases: [String] + x_opencti_reliability: String + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input IdentityAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + type: IdentityType! + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + contact_information: String + roles: [String] + x_opencti_aliases: [String] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectLabel: [String] + externalReferences: [String] + x_opencti_workflow_id: String + clientMutationId: String + created: DateTime + modified: DateTime + update: Boolean +} + +enum IndividualsOrdering { + name + firstname + lastname + created + modified + x_opencti_workflow_id + objectMarking + _score +} + +type IndividualConnection { + pageInfo: PageInfo! + edges: [IndividualEdge] +} + +type IndividualEdge { + cursor: String! + node: Individual! +} + +type Individual implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Identity { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + identity_class: String! + name: String! + description: String + contact_information: String + roles: [String] + x_opencti_aliases: [String] + x_opencti_reliability: String + x_opencti_firstname: String + x_opencti_lastname: String + organizations: OrganizationConnection + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + isUser: Boolean +} + +input IndividualAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + contact_information: String + roles: [String] + x_opencti_aliases: [String] + x_opencti_firstname: String + x_opencti_lastname: String + x_opencti_reliability: String + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectOrganization: [String] + objectMarking: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum SectorsOrdering { + name + created + modified + created_at + updated_at + x_opencti_workflow_id + objectMarking + _score +} + +type SectorConnection { + pageInfo: PageInfo! + edges: [SectorEdge] +} + +type SectorEdge { + cursor: String! + types: [String] + node: Sector! +} + +type Sector implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Identity { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + identity_class: String! + name: String! + description: String + contact_information: String + roles: [String] + x_opencti_aliases: [String] + x_opencti_reliability: String + parentSectors: SectorConnection + subSectors: SectorConnection + isSubSector: Boolean + targetedOrganizations: StixCoreRelationshipConnection + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input SectorAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + contact_information: String + roles: [String] + x_opencti_aliases: [String] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum SystemsOrdering { + name + confidence + firstname + lastname + created + modified + x_opencti_workflow_id + _score +} + +type SystemConnection { + pageInfo: PageInfo! + edges: [SystemEdge] +} + +type SystemEdge { + cursor: String! + node: System! +} + +type System implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Identity { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + identity_class: String! + name: String! + description: String + contact_information: String + roles: [String] + x_opencti_aliases: [String] + x_opencti_reliability: String + x_opencti_firstname: String + x_opencti_lastname: String + organizations: OrganizationConnection + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input SystemAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + contact_information: String + roles: [String] + x_opencti_aliases: [String] + x_opencti_firstname: String + x_opencti_lastname: String + x_opencti_reliability: String + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectOrganization: [String] + objectMarking: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum InfrastructuresOrdering { + name + infrastructure_types + first_seen + last_seen + created + modified + created_at + updated_at + x_opencti_workflow_id + confidence + createdBy + objectMarking + creator + _score +} + +type InfrastructureConnection { + pageInfo: PageInfo! + edges: [InfrastructureEdge] +} + +type InfrastructureEdge { + cursor: String! + node: Infrastructure! +} + +type Infrastructure implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + aliases: [String] + description: String + infrastructure_types: [String] + first_seen: DateTime + last_seen: DateTime + killChainPhases: [KillChainPhase!] + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input InfrastructureAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + aliases: [String] + infrastructure_types: [String] + first_seen: DateTime + last_seen: DateTime + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectOrganization: [String] + objectMarking: [String] + objectLabel: [String] + externalReferences: [String] + killChainPhases: [String] + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum IntrusionSetsOrdering { + name + created + modified + created_at + updated_at + x_opencti_workflow_id + resource_level + primary_motivation + confidence + _score + objectMarking +} + +type IntrusionSetConnection { + pageInfo: PageInfo! + edges: [IntrusionSetEdge] +} + +type IntrusionSetEdge { + cursor: String! + node: IntrusionSet! +} + +type IntrusionSet implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + aliases: [String] + first_seen: DateTime + last_seen: DateTime + goals: [String] + resource_level: String + primary_motivation: String + secondary_motivations: [String] + locations: LocationConnection + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input IntrusionSetAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + aliases: [String] + first_seen: DateTime + last_seen: DateTime + goals: [String] + resource_level: String + primary_motivation: String + secondary_motivations: [String] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectAssignee: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + x_opencti_workflow_id: String + created: DateTime + modified: DateTime + clientMutationId: String + update: Boolean + file: Upload +} + +enum LocationsOrdering { + name + latitude + longitude + created + modified + created_at + updated_at + x_opencti_workflow_id + _score +} + +type LocationConnection { + pageInfo: PageInfo! + edges: [LocationEdge] +} + +type LocationEdge { + cursor: String! + types: [String] + node: Location! +} + +interface Location { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + avatar: OpenCtiFile + name: String! + description: String + latitude: Float + longitude: Float + precision: Float + x_opencti_aliases: [String] + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input LocationAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + type: String! + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + latitude: Float + longitude: Float + precision: Float + x_opencti_aliases: [String] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectLabel: [String] + externalReferences: [String] + clientMutationId: String + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + update: Boolean +} + +enum PositionsOrdering { + name + postal_address + postal_code + created + modified + created_at + updated_at + x_opencti_workflow_id + _score +} + +type PositionConnection { + pageInfo: PageInfo! + edges: [PositionEdge] +} + +type PositionEdge { + cursor: String! + node: Position! +} + +type Position implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Location { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + latitude: Float + longitude: Float + precision: Float + x_opencti_aliases: [String] + street_address: String + postal_code: String + city: City + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input PositionAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + latitude: Float + longitude: Float + precision: Float + street_address: String + postal_code: String + confidence: Int + revoked: Boolean + lang: String + x_opencti_aliases: [String] + createdBy: String + objectMarking: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum CitiesOrdering { + name + aliases + created + modified + created_at + updated_at + objectMarking + objectLabel + x_opencti_workflow_id + _score +} + +type CityConnection { + pageInfo: PageInfo! + edges: [CityEdge] +} + +type CityEdge { + cursor: String! + node: City! +} + +type City implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Location { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + latitude: Float + longitude: Float + precision: Float + x_opencti_aliases: [String] + country: Country + administrativeArea: AdministrativeArea + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input CityAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + latitude: Float + longitude: Float + precision: Float + confidence: Int + revoked: Boolean + lang: String + x_opencti_aliases: [String] + createdBy: String + objectOrganization: [String] + objectMarking: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum CountriesOrdering { + name + created + modified + created_at + updated_at + x_opencti_workflow_id + _score +} + +type CountryConnection { + pageInfo: PageInfo! + edges: [CountryEdge!]! +} + +type CountryEdge { + cursor: String! + node: Country! +} + +type Country implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Location { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + latitude: Float + longitude: Float + precision: Float + x_opencti_aliases: [String] + region: Region + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input CountryAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + latitude: Float + longitude: Float + precision: Float + confidence: Int + revoked: Boolean + lang: String + x_opencti_aliases: [String] + createdBy: String + objectMarking: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum RegionsOrdering { + name + created + modified + created_at + updated_at + x_opencti_workflow_id + _score +} + +type RegionConnection { + pageInfo: PageInfo! + edges: [RegionEdge] +} + +type RegionEdge { + cursor: String! + node: Region! +} + +type Region implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Location { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + latitude: Float + longitude: Float + precision: Float + x_opencti_aliases: [String] + parentRegions: RegionConnection + subRegions: RegionConnection + countries: CountryConnection + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input RegionAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + latitude: Float + longitude: Float + precision: Float + confidence: Int + revoked: Boolean + lang: String + x_opencti_aliases: [String] + createdBy: String + objectMarking: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum MalwaresOrdering { + name + malware_types + first_seen + last_seen + created + modified + created_at + updated_at + objectMarking + objectLabel + x_opencti_workflow_id + is_family + confidence + _score +} + +type MalwareConnection { + pageInfo: PageInfo! + edges: [MalwareEdge] +} + +type MalwareEdge { + cursor: String! + node: Malware! +} + +type Malware implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + aliases: [String] + malware_types: [String] + is_family: Boolean + first_seen: DateTime + last_seen: DateTime + architecture_execution_envs: [String] + implementation_languages: [String] + capabilities: [String] + killChainPhases: [KillChainPhase!] + samples: [StixCyberObservable!] + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input MalwareAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + malware_types: [String] + aliases: [String] + is_family: Boolean + first_seen: DateTime + last_seen: DateTime + architecture_execution_envs: [String] + implementation_languages: [String] + capabilities: [String] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectAssignee: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + killChainPhases: [String] + samples: [String] + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum ThreatActorsOrdering { + name + created + modified + created_at + updated_at + x_opencti_workflow_id + confidence + sophistication + resource_level + _score + threat_actor_types + objectMarking +} + +type ThreatActorGroupConnection { + pageInfo: PageInfo! + edges: [ThreatActorGroupEdge] +} + +type ThreatActorGroupEdge { + cursor: String! + node: ThreatActorGroup! +} + +interface ThreatActor implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + aliases: [String] + threat_actor_types: [String] + first_seen: DateTime + last_seen: DateTime + roles: [String] + goals: [String] + sophistication: String + resource_level: String + primary_motivation: String + secondary_motivations: [String] + personal_motivations: [String] + locations: LocationConnection + countries: CountryConnection + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +type ThreatActorEdge { + cursor: String! + node: ThreatActor! +} + +type ThreatActorConnection { + pageInfo: PageInfo! + edges: [ThreatActorEdge] +} + +type ThreatActorGroup implements BasicObject & StixObject & StixCoreObject & StixDomainObject & ThreatActor { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + aliases: [String] + threat_actor_types: [String] + first_seen: DateTime + last_seen: DateTime + roles: [String] + goals: [String] + sophistication: String + resource_level: String + primary_motivation: String + secondary_motivations: [String] + personal_motivations: [String] + locations: LocationConnection + countries: CountryConnection + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input ThreatActorGroupAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + aliases: [String] + threat_actor_types: [String] + first_seen: DateTime + last_seen: DateTime + roles: [String] + goals: [String] + sophistication: String + resource_level: String + primary_motivation: String + secondary_motivations: [String] + personal_motivations: [String] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectOrganization: [String] + objectAssignee: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum ToolsOrdering { + name + created + modified + created_at + updated_at + x_opencti_workflow_id + confidence + _score +} + +type ToolConnection { + pageInfo: PageInfo! + edges: [ToolEdge] +} + +type ToolEdge { + cursor: String! + node: Tool! +} + +type Tool implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + aliases: [String] + tool_types: [String] + tool_version: String + killChainPhases: [KillChainPhase!] + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input ToolAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + aliases: [String] + tool_types: [String] + tool_version: String + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + killChainPhases: [String] + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum VulnerabilitiesOrdering { + name + x_opencti_cvss_base_score + x_opencti_cvss_base_severity + x_opencti_cvss_attack_vector + created + modified + created_at + updated_at + x_opencti_workflow_id + creator + confidence + _score +} + +type VulnerabilityConnection { + pageInfo: PageInfo! + edges: [VulnerabilityEdge] +} + +type VulnerabilityEdge { + cursor: String! + node: Vulnerability! +} + +type Vulnerability implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + x_opencti_aliases: [String] + x_opencti_cvss_base_score: Float + x_opencti_cvss_base_severity: String + x_opencti_cvss_attack_vector: String + x_opencti_cvss_integrity_impact: String + x_opencti_cvss_availability_impact: String + x_opencti_cvss_confidentiality_impact: String + x_opencti_cisa_kev: Boolean + x_opencti_epss_score: Float + x_opencti_epss_percentile: Float + softwares(first: Int, after: ID, orderBy: StixCyberObservablesOrdering, orderMode: OrderingMode): StixCyberObservableConnection + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input VulnerabilityAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + x_opencti_aliases: [String] + x_opencti_cvss_base_score: Float + x_opencti_cvss_base_severity: String + x_opencti_cvss_attack_vector: String + x_opencti_cvss_integrity_impact: String + x_opencti_cvss_availability_impact: String + x_opencti_cvss_confidentiality_impact: String + x_opencti_cisa_kev: Boolean + x_opencti_epss_score: Float + x_opencti_epss_percentile: Float + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum IncidentsOrdering { + name + first_seen + last_seen + incident_type + severity + source + created + modified + created_at + updated_at + x_opencti_workflow_id + objectMarking + confidence + objectAssignee + creator + _score +} + +type IncidentConnection { + pageInfo: PageInfo! + edges: [IncidentEdge] +} + +type IncidentEdge { + cursor: String! + node: Incident! +} + +type Incident implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + avatar: OpenCtiFile + name: String! + description: String + aliases: [String] + first_seen: DateTime + last_seen: DateTime + objective: String + incident_type: String + severity: String + source: String + objectParticipant: [Participant!] + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input IncidentAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + confidence: Int + revoked: Boolean + lang: String + objective: String + first_seen: DateTime + last_seen: DateTime + aliases: [String] + incident_type: String + severity: String + source: String + createdBy: String + objectOrganization: [String] + objectMarking: [String] + objectAssignee: [String] + objectParticipant: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +enum StixCyberObservablesOrdering { + entity_type + created_at + updated_at + observable_value + objectMarking + createdBy + creator + _score +} + +type StixCyberObservableConnection { + pageInfo: PageInfo! + edges: [StixCyberObservableEdge!]! +} + +type StixCyberObservableEdge { + cursor: String! + node: StixCyberObservable! +} + +interface StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +type AutonomousSystem implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + number: Int + name: String + rir: String + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input AutonomousSystemAddInput { + number: Int! + name: String + rir: String + file: Upload +} + +type Directory implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + path: String! + path_enc: String + ctime: DateTime + mtime: DateTime + atime: DateTime + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input DirectoryAddInput { + path: String! + path_enc: String + ctime: DateTime + mtime: DateTime + atime: DateTime + file: Upload +} + +type DomainName implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + observable_value: String! + x_opencti_score: Int + x_opencti_description: String + indicators(first: Int): IndicatorConnection + value: String + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input DomainNameAddInput { + value: String! + file: Upload +} + +type EmailAddr implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + display_name: String + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input EmailAddrAddInput { + value: String + display_name: String + file: Upload +} + +type EmailMessage implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + is_multipart: Boolean + attribute_date: DateTime + content_type: String + message_id: String + subject: String + received_lines: [String] + body: String + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input EmailMessageAddInput { + is_multipart: Boolean + attribute_date: DateTime + content_type: String + message_id: String + subject: String + received_lines: [String] + body: String + file: Upload +} + +type EmailMimePartType implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + body: String + content_type: String + content_disposition: String + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input EmailMimePartTypeAddInput { + body: String + content_type: String + content_disposition: String + file: Upload +} + +input HashInput { + "*Constraints:*\n* Minimal length: `3`\n" + algorithm: String! + + "*Constraints:*\n* Minimal length: `5`\n" + hash: String! +} + +type Hash { + algorithm: String! + hash: String +} + +type StixFileEdge { + cursor: String! + node: StixFile! +} + +type StixFileConnection { + pageInfo: PageInfo! + edges: [StixFileEdge] +} + +interface HashedObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + hashes: [Hash] + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +type Artifact implements BasicObject & StixObject & StixCoreObject & StixCyberObservable & HashedObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + hashes: [Hash] + mime_type: String + payload_bin: String + url: String + encryption_algorithm: String + decryption_key: String + x_opencti_additional_names: [String] + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input ArtifactAddInput { + hashes: [HashInput] + mime_type: String + payload_bin: String + url: String + encryption_algorithm: String + decryption_key: String + x_opencti_additional_names: [String] + file: Upload +} + +type StixFile implements BasicObject & StixObject & StixCoreObject & StixCyberObservable & HashedObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + hashes: [Hash] + extensions: String + size: Int + name: String + name_enc: String + magic_number_hex: String + mime_type: String + ctime: DateTime + mtime: DateTime + atime: DateTime + x_opencti_additional_names: [String] + obsContent: Artifact + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input StixFileAddInput { + hashes: [HashInput] + size: Int + name: String + name_enc: String + magic_number_hex: String + mime_type: String + ctime: DateTime + mtime: DateTime + atime: DateTime + x_opencti_additional_names: [String] + obsContent: ID + file: Upload +} + +type X509Certificate implements BasicObject & StixObject & StixCoreObject & StixCyberObservable & HashedObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + hashes: [Hash] + is_self_signed: Boolean + version: String + serial_number: String + signature_algorithm: String + issuer: String + subject: String + subject_public_key_algorithm: String + subject_public_key_modulus: String + subject_public_key_exponent: Int + validity_not_before: DateTime + validity_not_after: DateTime + basic_constraints: String + name_constraints: String + policy_constraints: String + key_usage: String + extended_key_usage: String + subject_key_identifier: String + authority_key_identifier: String + subject_alternative_name: String + issuer_alternative_name: String + subject_directory_attributes: String + crl_distribution_points: String + inhibit_any_policy: String + private_key_usage_period_not_before: DateTime + private_key_usage_period_not_after: DateTime + certificate_policies: String + policy_mappings: String + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input X509CertificateAddInput { + hashes: [HashInput] + is_self_signed: Boolean + version: String + serial_number: String + signature_algorithm: String + issuer: String + subject: String + subject_public_key_algorithm: String + subject_public_key_modulus: String + subject_public_key_exponent: Int + validity_not_before: DateTime + validity_not_after: DateTime + basic_constraints: String + name_constraints: String + policy_constraints: String + key_usage: String + extended_key_usage: String + subject_key_identifier: String + authority_key_identifier: String + subject_alternative_name: String + issuer_alternative_name: String + subject_directory_attributes: String + crl_distribution_points: String + inhibit_any_policy: String + private_key_usage_period_not_before: DateTime + private_key_usage_period_not_after: DateTime + certificate_policies: String + policy_mappings: String + file: Upload +} + +type IPv4Addr implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + countries: CountryConnection + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input IPv4AddrAddInput { + value: String + belongsTo: [String] + resolvesTo: [String] + file: Upload +} + +type IPv6Addr implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + countries: CountryConnection + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input IPv6AddrAddInput { + value: String + file: Upload +} + +type MacAddr implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input MacAddrAddInput { + value: String + file: Upload +} + +type Mutex implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + name: String + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input MutexAddInput { + name: String + file: Upload +} + +type NetworkTraffic implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + extensions: String + start: DateTime + end: DateTime + is_active: Boolean + src_port: Int + dst_port: Int + protocols: [String] + src_byte_count: Int + dst_byte_count: Int + src_packets: Int + dst_packets: Int + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input NetworkTrafficAddInput { + start: DateTime + end: DateTime + is_active: Boolean + networkSrc: String + networkDst: String + src_port: Int + dst_port: Int + protocols: [String] + src_byte_count: Int + dst_byte_count: Int + src_packets: Int + dst_packets: Int + file: Upload +} + +type Process implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + extensions: String + is_hidden: Boolean + pid: Int + created_time: DateTime + cwd: String + command_line: String + environment_variables: [String] + aslr_enabled: Boolean + dep_enabled: Boolean + priority: String + owner_sid: String + window_title: String + startup_info: [Dictionary] + integrity_level: String + service_name: String + descriptions: [String] + display_name: String + group_name: String + start_type: String + serviceDlls: StixFileConnection + service_type: String + service_status: String + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input ProcessAddInput { + is_hidden: Boolean + pid: Int + created_time: DateTime + cwd: String + x_opencti_description: String + command_line: String! + environment_variables: [String] + aslr_enabled: Boolean + dep_enabled: Boolean + priority: String + owner_sid: String + window_title: String + startup_info: [DictionaryInput] + integrity_level: String + service_name: String + descriptions: [String] + display_name: String + group_name: String + start_type: String + serviceDlls: [String] + service_type: String + service_status: String + file: Upload +} + +type Software implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + name: String + cpe: String + swid: String + languages: [String] + vendor: String + version: String + vulnerabilities: VulnerabilityConnection + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +type SoftwareConnection { + pageInfo: PageInfo! + edges: [SoftwareEdge!]! +} + +type SoftwareEdge { + cursor: String! + node: Software! +} + +input SoftwareAddInput { + name: String + cpe: String + swid: String + languages: [String] + vendor: String + version: String + file: Upload +} + +type Url implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input UrlAddInput { + value: String + file: Upload +} + +type UserAccount implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + extensions: String + user_id: String + credential: String + account_login: String + account_type: String + display_name: String + is_service_account: Boolean + is_privileged: Boolean + can_escalate_privs: Boolean + is_disabled: Boolean + account_created: DateTime + account_expires: DateTime + credential_last_changed: DateTime + account_first_login: DateTime + account_last_login: DateTime + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input UserAccountAddInput { + user_id: String + credential: String + account_login: String + account_type: String + display_name: String + is_service_account: Boolean + is_privileged: Boolean + can_escalate_privs: Boolean + is_disabled: Boolean + account_created: DateTime + account_expires: DateTime + credential_last_changed: DateTime + account_first_login: DateTime + account_last_login: DateTime + file: Upload +} + +type WindowsRegistryKey implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + attribute_key: String + modified_time: DateTime + number_of_subkeys: Int + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input WindowsRegistryKeyAddInput { + attribute_key: String + modified_time: DateTime + file: Upload + number_of_subkeys: Int +} + +type WindowsRegistryValueType implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + name: String + data: String + data_type: String + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input WindowsRegistryValueTypeAddInput { + name: String + data: String + data_type: String + file: Upload +} + +type CryptographicKey implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input CryptographicKeyAddInput { + value: String + file: Upload +} + +type CryptocurrencyWallet implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input CryptocurrencyWalletAddInput { + value: String + file: Upload +} + +type Hostname implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input HostnameAddInput { + value: String + file: Upload +} + +type Text implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input TextAddInput { + value: String + file: Upload +} + +type UserAgent implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input UserAgentAddInput { + value: String + file: Upload +} + +type BankAccount implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, fromOrToId: [String], elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + iban: String + bic: String + account_number: String + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input BankAccountAddInput { + iban: String + bic: String + account_number: String + file: Upload +} + +type TrackingNumber implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!], elementId: [String]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup, filterMode: FilterMode): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, filterMode: FilterMode, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup, filterMode: FilterMode): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input TrackingNumberAddInput { + value: String + file: Upload +} + +type Credential implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!], elementId: [String]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup, filterMode: FilterMode): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, filterMode: FilterMode, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup, filterMode: FilterMode): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input CredentialAddInput { + value: String + file: Upload +} + +type PhoneNumber implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + value: String + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input PhoneNumberAddInput { + value: String + file: Upload +} + +type PaymentCard implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + card_number: String + expiration_date: DateTime + cvv: Int + holder_name: String + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input PaymentCardAddInput { + card_number: String! + expiration_date: DateTime + cvv: Int + holder_name: String + file: Upload +} + +type MediaContent implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectLabel: [Label!] + objectOrganization: [Organization!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + title: String + description: String + content: String + media_category: String + url: String + publication_date: DateTime + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input MediaContentAddInput { + title: String + content: String + media_category: String + url: String! + publication_date: DateTime + file: Upload +} + +type Persona implements BasicObject & StixObject & StixCoreObject & StixCyberObservable { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectLabel: [Label!] + objectOrganization: [Organization!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + x_opencti_score: Int + x_opencti_description: String + observable_value: String! + indicators(first: Int): IndicatorConnection + persona_name: String! + persona_type: String! + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] +} + +input PersonaAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + persona_name: String! + persona_type: String! +} + +interface BasicRelationship { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + fromRole: String + toRole: String + created_at: DateTime! + updated_at: DateTime! + creators: [Creator!] +} + +type InternalRelationship implements BasicRelationship { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + fromRole: String + toRole: String + created_at: DateTime! + updated_at: DateTime! + from: InternalObject + to: InternalObject + creators: [Creator!] +} + +input InternalRelationshipAddInput { + relationship_type: String! + fromId: ID + toId: ID +} + +enum StixObjectOrStixRelationshipsOrdering { + name + entity_type + created_at + updated_at + createdBy + objectMarking + objectLabel + observable_value + start_time + created + modified + relationship_type + creator + _score +} + +type StixObjectOrStixRelationshipConnection { + pageInfo: PageInfo! + edges: [StixObjectOrStixRelationshipEdge] +} + +type StixObjectOrStixRelationshipRefConnection { + pageInfo: PageInfo! + edges: [StixObjectOrStixRelationshipRefEdge] +} + +type StixObjectOrStixRelationshipEdge { + cursor: String! + node: StixObjectOrStixRelationship! +} + +type StixObjectOrStixRelationshipRefEdge { + cursor: String! + types: [String]! + node: StixObjectOrStixRelationship! +} + +union StixObjectOrStixRelationshipOrCreator = MarkingDefinition | Label | KillChainPhase | ExternalReference | AttackPattern | Campaign | Channel | Event | Narrative | Note | ObservedData | Opinion | Report | Grouping | CourseOfAction | Individual | Organization | Sector | System | Indicator | Infrastructure | IntrusionSet | Language | City | AdministrativeArea | Country | Region | Position | Malware | MalwareAnalysis | ThreatActorGroup | ThreatActorIndividual | Tool | Vulnerability | Incident | AutonomousSystem | Directory | DomainName | EmailAddr | EmailMessage | EmailMimePartType | Artifact | StixFile | X509Certificate | IPv4Addr | IPv6Addr | MacAddr | Mutex | NetworkTraffic | Process | Software | Url | UserAccount | WindowsRegistryKey | WindowsRegistryValueType | CryptographicKey | CryptocurrencyWallet | Hostname | Text | UserAgent | BankAccount | Credential | TrackingNumber | PhoneNumber | PaymentCard | MediaContent | Persona | StixCoreRelationship | StixSightingRelationship | StixRefRelationship | Task | DataComponent | DataSource | CaseIncident | CaseRfi | CaseRft | Feedback | CaseTemplate | EntitySetting | ManagerConfiguration | Creator | Group | Workspace | CsvMapper | Status | PublicDashboard + +union StixObjectOrStixRelationship = MarkingDefinition | Label | KillChainPhase | ExternalReference | AttackPattern | Campaign | Channel | Event | Narrative | Note | ObservedData | Opinion | Report | Grouping | CourseOfAction | Individual | Organization | Sector | System | Indicator | Infrastructure | IntrusionSet | Language | City | AdministrativeArea | Country | Region | Position | Malware | MalwareAnalysis | ThreatActorGroup | ThreatActorIndividual | Tool | Vulnerability | Incident | AutonomousSystem | Directory | DomainName | EmailAddr | EmailMessage | EmailMimePartType | Artifact | StixFile | X509Certificate | IPv4Addr | IPv6Addr | MacAddr | Mutex | NetworkTraffic | Process | Software | Url | UserAccount | WindowsRegistryKey | WindowsRegistryValueType | CryptographicKey | CryptocurrencyWallet | Hostname | Text | UserAgent | BankAccount | Credential | TrackingNumber | PhoneNumber | PaymentCard | MediaContent | Persona | StixCoreRelationship | StixSightingRelationship | StixRefRelationship | DataComponent | DataSource | CaseIncident | CaseRfi | CaseRft | Feedback | CaseTemplate | Task | EntitySetting | ManagerConfiguration | Workspace | CsvMapper | PublicDashboard + +union StixCoreObjectOrStixCoreRelationship = AttackPattern | Campaign | Channel | Event | Note | ObservedData | Opinion | Report | Grouping | CourseOfAction | Individual | Organization | Sector | Indicator | Infrastructure | IntrusionSet | Language | City | AdministrativeArea | Country | Region | Position | Malware | MalwareAnalysis | Narrative | ThreatActorGroup | ThreatActorIndividual | Tool | Vulnerability | Incident | AutonomousSystem | Directory | DomainName | EmailAddr | EmailMessage | EmailMimePartType | Artifact | StixFile | X509Certificate | IPv4Addr | IPv6Addr | MacAddr | Mutex | NetworkTraffic | Process | Software | Url | UserAccount | WindowsRegistryKey | WindowsRegistryValueType | CryptographicKey | CryptocurrencyWallet | Hostname | Text | UserAgent | BankAccount | Credential | TrackingNumber | PhoneNumber | PaymentCard | MediaContent | Persona | StixCoreRelationship | DataComponent | DataSource | CaseIncident | CaseRfi | CaseRft | Feedback | CaseTemplate | Task | EntitySetting | ManagerConfiguration | Workspace | PublicDashboard + +enum StixRelationshipsOrdering { + entity_type + relationship_type + confidence + start_time + stop_time + created + modified + created_at + updated_at + objectMarking + objectLabel + killChainPhase + toName + toValidFrom + toValidUntil + toObservableValue + toPatternType + x_opencti_workflow_id + createdBy + creator + _score +} + +type StixRelationshipConnection { + pageInfo: PageInfo! + edges: [StixRelationshipEdge] +} + +type StixRelationshipEdge { + cursor: String! + node: StixRelationship! +} + +interface StixRelationship { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + fromRole: String + toRole: String + created_at: DateTime! + updated_at: DateTime! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + from: StixObjectOrStixRelationshipOrCreator + to: StixObjectOrStixRelationshipOrCreator + x_opencti_inferences: [Inference] + spec_version: String! + created: DateTime + modified: DateTime + confidence: Int + relationship_type: String! + createdBy: Identity + objectMarking: [MarkingDefinition!] + toStix: String + draftVersion: DraftVersion + creators: [Creator!] +} + +type StixRelationshipSchema { + key: String! + values: [String!]! +} + +type StixRelationshipRefSchemaValue { + name: String! + toTypes: [String!]! +} + +type StixRelationshipRefSchema { + key: String! + values: [StixRelationshipRefSchemaValue!]! +} + +enum StixCoreRelationshipsOrdering { + entity_type + relationship_type + confidence + start_time + stop_time + created + modified + created_at + updated_at + objectMarking + objectLabel + killChainPhase + toName + toValidFrom + toValidUntil + toObservableValue + toPatternType + x_opencti_workflow_id + createdBy + creator + _score +} + +type StixCoreRelationshipConnection { + pageInfo: PageInfo! + edges: [StixCoreRelationshipEdge!]! +} + +type StixCoreRelationshipEdge { + cursor: String! + node: StixCoreRelationship! +} + +type StixCoreRelationship implements BasicRelationship & StixRelationship { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + fromRole: String + toRole: String + created_at: DateTime! + updated_at: DateTime! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + from: StixObjectOrStixRelationshipOrCreator + fromId: String! + fromType: String! + to: StixObjectOrStixRelationshipOrCreator + toId: String! + toType: String! + x_opencti_inferences: [Inference] + spec_version: String! + created: DateTime + modified: DateTime + confidence: Int + relationship_type: String! + createdBy: Identity + objectMarking: [MarkingDefinition!] + draftVersion: DraftVersion + description: String + start_time: DateTime + stop_time: DateTime + revoked: Boolean! + lang: String + objectLabel: [Label!] + objectOrganization: [Organization!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + killChainPhases: [KillChainPhase!] + creators: [Creator!] + toStix: String + editContext: [EditUserContext!] + status: Status + workflowEnabled: Boolean +} + +input StixCoreRelationshipAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + fromId: StixRef! + toId: StixRef! + created: DateTime + modified: DateTime + confidence: Int + relationship_type: String! + createdBy: String + objectMarking: [String] + description: String + start_time: DateTime + stop_time: DateTime + revoked: Boolean + lang: String + objectLabel: [String] + objectOrganization: [String] + externalReferences: [String] + killChainPhases: [String] + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean +} + +enum StixSightingRelationshipsOrdering { + confidence + x_opencti_negative + first_seen + last_seen + created + modified + created_at + updated_at + objectMarking + objectLabel + toName + toValidFrom + toValidUntil + toPatternType + toCreatedAt + attribute_count + x_opencti_workflow_id + _score +} + +type StixSightingRelationshipConnection { + pageInfo: PageInfo! + edges: [StixSightingRelationshipsEdge] +} + +type StixSightingRelationshipsEdge { + cursor: String! + node: StixSightingRelationship! +} + +type StixSightingRelationship implements BasicRelationship & StixRelationship { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + fromRole: String + toRole: String + created_at: DateTime! + updated_at: DateTime! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + from: StixObjectOrStixRelationshipOrCreator + fromId: String! + fromType: String! + to: StixObjectOrStixRelationshipOrCreator + toId: String! + toType: String! + x_opencti_inferences: [Inference] + spec_version: String! + created: DateTime + modified: DateTime + confidence: Int + relationship_type: String! + createdBy: Identity + objectMarking: [MarkingDefinition!] + draftVersion: DraftVersion + description: String + first_seen: DateTime + last_seen: DateTime + attribute_count: Int! + x_opencti_negative: Boolean! + objectLabel: [Label!] + objectOrganization: [Organization!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + creators: [Creator!] + toStix: String + editContext: [EditUserContext!] + status: Status + workflowEnabled: Boolean +} + +input StixSightingRelationshipAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + fromId: StixRef! + toId: StixRef! + created: DateTime + modified: DateTime + confidence: Int + createdBy: String + objectMarking: [String] + description: String + first_seen: DateTime + last_seen: DateTime + attribute_count: Int! + x_opencti_negative: Boolean + objectLabel: [String] + objectOrganization: [String] + externalReferences: [String] + clientMutationId: String + update: Boolean + x_opencti_workflow_id: String +} + +enum StixRefRelationshipsOrdering { + relationship_type + entity_type + confidence + start_time + stop_time + created + modified + created_at + updated_at + toName + toValidFrom + toValidUntil + toPatternType + toCreatedAt + _score +} + +type StixRefRelationshipConnection { + pageInfo: PageInfo! + edges: [StixRefRelationshipEdge] +} + +type StixRefRelationshipEdge { + cursor: String! + node: StixRefRelationship! +} + +type StixRefRelationship implements BasicRelationship & StixRelationship { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + fromRole: String + toRole: String + created_at: DateTime! + updated_at: DateTime! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + from: StixObjectOrStixRelationshipOrCreator + to: StixObjectOrStixRelationshipOrCreator + x_opencti_inferences: [Inference] + spec_version: String! + created: DateTime + modified: DateTime + confidence: Int + relationship_type: String! + createdBy: Identity + objectMarking: [MarkingDefinition!] + draftVersion: DraftVersion + start_time: DateTime + stop_time: DateTime + datable: Boolean + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + notes(first: Int): NoteConnection + reports(first: Int): ReportConnection + opinions(first: Int): OpinionConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + toStix: String + creators: [Creator!] + editContext: [EditUserContext!] +} + +type DefinitionRefRelationship { + entity: StixObjectOrStixRelationshipOrCreator! + from: [String!] + to: [String!] +} + +input StixRefRelationshipAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + fromId: StixRef + toId: StixRef + relationship_type: String! + confidence: Int + createdBy: String + start_time: DateTime + stop_time: DateTime + objectMarking: [String] + objectLabel: [String] + created: DateTime + modified: DateTime + clientMutationId: String + update: Boolean + file: Upload +} + +input StixRefRelationshipsAddInput { + relationship_type: String! + fromIds: [StixRef] + toIds: [StixRef!]! +} + +type Query { + stix(id: String!): String + enrichmentConnectors(type: String!): [Connector] + about: AppInfo + logsWorkerConfig: LogsWorkerConfig + rabbitMQMetrics(prefix: String): RabbitMQMetrics + elasticSearchMetrics: ElasticSearchMetrics + logs(first: Int, after: ID, orderBy: LogsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): LogConnection + audits(first: Int, after: ID, types: [String!], orderBy: LogsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): LogConnection + auditsNumber(dateAttribute: String, types: [String], startDate: DateTime, endDate: DateTime, onlyInferred: Boolean, filters: FilterGroup, search: String): Number + auditsTimeSeries(field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime, interval: String!, types: [String], filters: FilterGroup, search: String): [TimeSeries] + auditsDistribution(field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + auditsMultiTimeSeries(operation: StatsOperation!, startDate: DateTime!, endDate: DateTime, interval: String!, onlyInferred: Boolean, timeSeriesParameters: [AuditsTimeSeriesParameters]): [MultiTimeSeries] + subType(id: String!): SubType + subTypes(first: Int, after: ID, orderBy: SubTypesOrdering, orderMode: OrderingMode, type: String, includeParents: Boolean, search: String): SubTypeConnection! + file(id: String!): File + importFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + filesMetrics: FilesMetrics + indexedFiles(first: Int, after: ID, search: String): IndexedFileConnection + indexedFilesCount(search: String): Int + indexedFilesMetrics: FilesMetrics + settings: Settings! + group(id: String!): Group + groups(first: Int, after: ID, orderBy: GroupsOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): GroupConnection + roles(first: Int, after: ID, orderBy: RolesOrdering, orderMode: OrderingMode, search: String): RoleConnection + me: MeUser! + otpGeneration: OtpElement + user(id: String!): User + creators(entityTypes: [String!]): CreatorConnection + assignees(entityTypes: [String!]): AssigneeConnection + participants(entityTypes: [String!]): ParticipantConnection + members(first: Int, search: String, filters: FilterGroup, filterMode: FilterMode, entityTypes: [MemberType!]): MemberConnection + systemMembers: MemberConnection + users(first: Int, after: ID, orderBy: UsersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): UserConnection + sessions: [UserSession] + role(id: String!): Role + capabilities(first: Int): CapabilityConnection + connector(id: String!): Connector + connectors: [Connector!] + connectorsForWorker: [Connector] + connectorsForExport: [Connector] + connectorsForImport: [Connector] + connectorsForAnalysis: [Connector] + connectorsForNotification: [Connector] + work(id: ID!): Work + works(first: Int, after: ID, orderBy: WorksOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): WorkConnection + runtimeAttributes(first: Int, search: String, orderMode: OrderingMode, attributeName: String!): AttributeConnection + schemaAttributeNames(elementType: [String]!): AttributeConnection + retentionRule(id: String!): RetentionRule + retentionRules(first: Int, after: ID, search: String, orderBy: RetentionRuleOrdering, orderMode: OrderingMode): RetentionRuleConnection + taxiiCollection(id: String!): TaxiiCollection + taxiiCollections(first: Int, after: ID, orderBy: TaxiiCollectionOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): TaxiiCollectionConnection + streamCollection(id: String!): StreamCollection + feed(id: String!): Feed + feeds(first: Int, after: ID, orderBy: FeedOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FeedConnection + streamCollections(first: Int, after: ID, orderBy: StreamCollectionOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): StreamCollectionConnection! + statusTemplate(id: String!): StatusTemplate + statusTemplates(first: Int, after: ID, orderBy: StatusTemplateOrdering, orderMode: OrderingMode, search: String): StatusTemplateConnection + status(id: String!): Status + statuses(first: Int, after: ID, orderBy: StatusOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): StatusConnection + backgroundTask(id: String!): BackgroundTask + backgroundTasks(first: Int, after: ID, orderBy: BackgroundTasksOrdering, orderMode: OrderingMode, includeAuthorities: Boolean, filters: FilterGroup, search: String): BackgroundTaskConnection + rule(id: String!): Rule + rules: [Rule] + ruleManagerInfo: RuleManager + synchronizer(id: String!): Synchronizer + synchronizers(first: Int, after: ID, orderBy: SynchronizersOrdering, orderMode: OrderingMode, search: String): SynchronizerConnection + synchronizerFetch(input: SynchronizerFetchInput): [RemoteStreamCollection] + stixMetaObject(id: String!): StixMetaObject + stixMetaObjects(first: Int, after: ID, types: [String], orderBy: StixMetaObjectsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): StixMetaObjectConnection + markingDefinition(id: String!): MarkingDefinition + markingDefinitions(first: Int, after: ID, orderBy: MarkingDefinitionsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): MarkingDefinitionConnection + label(id: String!): Label + labels(first: Int, after: ID, orderBy: LabelsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): LabelConnection + externalReference(id: String!): ExternalReference + externalReferences(first: Int, after: ID, orderBy: ExternalReferencesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): ExternalReferenceConnection + killChainPhase(id: String!): KillChainPhase + killChainPhases(first: Int, after: ID, orderBy: KillChainPhasesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): KillChainPhaseConnection + stixCoreObjectRaw(id: String!): String + stixCoreObject(id: String!): StixCoreObject + stixCoreObjectAnalysis(id: ID!, contentSource: String!, contentType: AnalysisContentType!): Analysis + stixCoreObjects(first: Int, after: ID, types: [String], orderBy: StixCoreObjectsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): StixCoreObjectConnection + globalSearch(first: Int, after: ID, search: String, types: [String], orderBy: StixCoreObjectsOrdering, orderMode: OrderingMode, filters: FilterGroup): StixCoreObjectConnection + stixCoreObjectsExportFiles(first: Int, exportContext: ExportContext!): FileConnection + stixCoreObjectsTimeSeries(authorId: String, field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime, interval: String!, onlyInferred: Boolean, types: [String], filters: FilterGroup, search: String): [TimeSeries] + stixCoreObjectsMultiTimeSeries(startDate: DateTime!, endDate: DateTime, interval: String!, onlyInferred: Boolean, timeSeriesParameters: [StixCoreObjectsTimeSeriesParameters]): [MultiTimeSeries] + stixCoreObjectsNumber(dateAttribute: String, types: [String], startDate: DateTime, endDate: DateTime, onlyInferred: Boolean, filters: FilterGroup, search: String): Number + stixCoreObjectsMultiNumber(dateAttribute: String, startDate: DateTime, endDate: DateTime, onlyInferred: Boolean, numberParameters: [StixCoreObjectsNumberParameters]): [Number] + stixCoreObjectsDistribution(objectId: [String], relationship_type: [String], toTypes: [String], elementWithTargetTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreObjectsMultiDistribution(field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, distributionParameters: StixCoreObjectsDistributionParameters): [MultiDistribution] + filtersRepresentatives(filters: FilterGroup!): [RepresentativeWithId!]! + stixDomainObject(id: String!): StixDomainObject + stixDomainObjects(first: Int, after: ID, types: [String], orderBy: StixDomainObjectsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): StixDomainObjectConnection + bookmarks(first: Int, after: ID, types: [String], filters: FilterGroup): StixDomainObjectConnection + stixDomainObjectsExportFiles(first: Int, exportContext: ExportContext!): FileConnection + stixDomainObjectsTimeSeries(authorId: String, field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime, interval: String!, types: [String], onlyInferred: Boolean, filters: FilterGroup, search: String): [TimeSeries] + stixDomainObjectsNumber(dateAttribute: String, types: [String], endDate: DateTime, onlyInferred: Boolean, filters: FilterGroup, search: String): Number + stixDomainObjectsDistribution(objectId: [String], relationship_type: [String], toTypes: [String], elementWithTargetTypes: [String], field: String!, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + attackPattern(id: String): AttackPattern + attackPatterns(first: Int, after: ID, orderBy: AttackPatternsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): AttackPatternConnection + attackPatternsMatrix: AttackPatternsMatrix + campaign(id: String): Campaign + campaigns(first: Int, after: ID, orderBy: CampaignsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): CampaignConnection + campaignsTimeSeries(objectId: String, field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime!, interval: String!, relationship_type: [String]): [TimeSeries] + container(id: String): Container + containers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): ContainerConnection + containersObjectsOfObject(id: String!, types: [String], filters: FilterGroup, search: String): StixObjectOrStixRelationshipConnection + containersNumber(objectId: String, endDate: DateTime): Number + note(id: String): Note + notes(first: Int, after: ID, orderBy: NotesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): NoteConnection + notesNumber(objectId: String, endDate: DateTime): Number + notesTimeSeries(objectId: String, authorId: String, field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime!, interval: String!): [TimeSeries] + notesDistribution(objectId: String, field: String!, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String): [Distribution] + noteContainsStixObjectOrStixRelationship(id: String!, stixObjectOrStixRelationshipId: String!): Boolean + observedData(id: String): ObservedData + observedDatas(first: Int, after: ID, orderBy: ObservedDatasOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): ObservedDataConnection + observedDatasTimeSeries(objectId: String, authorId: String, field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime!, interval: String!): [TimeSeries] + observedDatasNumber(objectId: String, endDate: DateTime): Number + observedDatasDistribution(objectId: String, field: String!, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String): [Distribution] + observedDataContainsStixObjectOrStixRelationship(id: String!, stixObjectOrStixRelationshipId: String!): Boolean + opinion(id: String): Opinion + opinions(first: Int, after: ID, orderBy: OpinionsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): OpinionConnection + opinionsTimeSeries(objectId: String, authorId: String, field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime!, interval: String!): [TimeSeries] + opinionsNumber(objectId: String, endDate: DateTime): Number + opinionsDistribution(objectId: String, field: String!, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String): [Distribution] + opinionContainsStixObjectOrStixRelationship(id: String!, stixObjectOrStixRelationshipId: String!): Boolean + myOpinion(id: String!): Opinion + report(id: String): Report + reports(first: Int, after: ID, orderBy: ReportsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): ReportConnection + reportsTimeSeries(objectId: String, authorId: String, reportType: String, field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime!, interval: String!, filters: FilterGroup, search: String): [TimeSeries] + reportsNumber(reportType: String, objectId: String, authorId: String, endDate: DateTime, filters: FilterGroup, search: String): Number + reportsDistribution(objectId: String, authorId: String, field: String!, operation: StatsOperation!, limit: Int, order: String, startDate: DateTime, endDate: DateTime, dateAttribute: String, filters: FilterGroup, search: String): [Distribution] + reportContainsStixObjectOrStixRelationship(id: String!, stixObjectOrStixRelationshipId: String!): Boolean + courseOfAction(id: String): CourseOfAction + coursesOfAction(first: Int, after: ID, orderBy: CoursesOfActionOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): CourseOfActionConnection + identity(id: String!): Identity + identities(first: Int, after: ID, types: [String], orderBy: IdentitiesOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup, toStix: Boolean): IdentityConnection + individual(id: String!): Individual + individuals(first: Int, after: ID, orderBy: IndividualsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): IndividualConnection + sector(id: String): Sector + sectors(first: Int, after: ID, orderBy: SectorsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): SectorConnection + system(id: String): System + systems(first: Int, after: ID, orderBy: SystemsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): SystemConnection + infrastructure(id: String!): Infrastructure + infrastructures(first: Int, after: ID, orderBy: InfrastructuresOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): InfrastructureConnection + intrusionSet(id: String): IntrusionSet + intrusionSets(first: Int, after: ID, orderBy: IntrusionSetsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): IntrusionSetConnection + location(id: String!): Location + locations(first: Int, after: ID, types: [String], orderBy: LocationsOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup, toStix: Boolean): LocationConnection + city(id: String): City + cities(first: Int, after: ID, orderBy: CitiesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): CityConnection + country(id: String): Country + countries(first: Int, after: ID, orderBy: CountriesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): CountryConnection + region(id: String!): Region + regions(first: Int, after: ID, orderBy: RegionsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): RegionConnection + position(id: String!): Position + positions(first: Int, after: ID, orderBy: PositionsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): PositionConnection + malware(id: String): Malware + malwares(first: Int, after: ID, orderBy: MalwaresOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): MalwareConnection + threatActor(id: String): ThreatActor + threatActors(first: Int, after: ID, orderBy: ThreatActorsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): ThreatActorConnection + threatActorGroup(id: String): ThreatActorGroup + threatActorsGroup(first: Int, after: ID, orderBy: ThreatActorsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): ThreatActorGroupConnection + tool(id: String): Tool + tools(first: Int, after: ID, orderBy: ToolsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): ToolConnection + vulnerability(id: String): Vulnerability + vulnerabilities(first: Int, after: ID, orderBy: VulnerabilitiesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): VulnerabilityConnection + incident(id: String): Incident + incidents(first: Int, after: ID, orderBy: IncidentsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): IncidentConnection + incidentsTimeSeries(objectId: String, field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime!, interval: String!, relationship_type: [String]): [TimeSeries] + stixCyberObservable(id: String!): StixCyberObservable + stixCyberObservables(first: Int, after: ID, types: [String], orderBy: StixCyberObservablesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): StixCyberObservableConnection + stixCyberObservablesExportFiles(first: Int, exportContext: ExportContext!): FileConnection + stixCyberObservablesNumber(dateAttribute: String, types: [String], authorId: String, endDate: DateTime, filters: FilterGroup, search: String): Number + stixCyberObservablesTimeSeries(types: [String], filters: FilterGroup, search: String): [TimeSeries] + stixCyberObservablesDistribution(objectId: String, field: String!, dateAttribute: String, operation: String!, filters: FilterGroup, search: String): [Distribution] + stixRelationship(id: String): StixRelationship + stixRelationships(first: Int, after: ID, orderBy: StixRelationshipsOrdering, orderMode: OrderingMode, fromOrToId: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, startDate: DateTime, endDate: DateTime, confidences: [Int], search: String, filters: FilterGroup, dynamicFrom: FilterGroup, dynamicTo: FilterGroup, stix: Boolean): StixRelationshipConnection + stixRelationshipsTimeSeries(field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime, interval: String!, onlyInferred: Boolean, fromOrToId: [String], elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup, dynamicFrom: FilterGroup, dynamicTo: FilterGroup): [TimeSeries] + stixRelationshipsMultiTimeSeries(operation: StatsOperation!, startDate: DateTime!, endDate: DateTime, interval: String!, onlyInferred: Boolean, timeSeriesParameters: [StixRelationshipsTimeSeriesParameters]): [MultiTimeSeries] + stixRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, fromOrToId: [String], elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup, dynamicFrom: FilterGroup, dynamicTo: FilterGroup, aggregateOnConnections: Boolean): [Distribution] + stixRelationshipsNumber(dateAttribute: String, authorId: String, noDirection: Boolean, endDate: DateTime, onlyInferred: Boolean, fromOrToId: [String], elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup, dynamicFrom: FilterGroup, dynamicTo: FilterGroup): Number + schemaRelationsTypesMapping: [StixRelationshipSchema!]! + schemaRelationsRefTypesMapping: [StixRelationshipRefSchema!]! + filterKeysSchema: [FilterKeysSchema!]! + stixCoreRelationship(id: String): StixCoreRelationship + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromOrToId: [String], elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, startDate: DateTime, endDate: DateTime, confidences: [Int], search: String, filters: FilterGroup, stix: Boolean): StixCoreRelationshipConnection + stixCoreRelationshipsTimeSeries(field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime, interval: String!, onlyInferred: Boolean, fromOrToId: [String], elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup, dynamicFrom: FilterGroup, dynamicTo: FilterGroup): [TimeSeries] + stixCoreRelationshipsMultiTimeSeries(operation: StatsOperation!, startDate: DateTime!, endDate: DateTime, interval: String!, onlyInferred: Boolean, timeSeriesParameters: [StixCoreRelationshipsTimeSeriesParameters]): [MultiTimeSeries] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, fromOrToId: [String], elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup, dynamicFrom: FilterGroup, dynamicTo: FilterGroup, aggregateOnConnections: Boolean): [Distribution] + stixCoreRelationshipsNumber(dateAttribute: String, authorId: String, noDirection: Boolean, endDate: DateTime, onlyInferred: Boolean, fromOrToId: [String], elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup, dynamicFrom: FilterGroup, dynamicTo: FilterGroup): Number + stixCoreRelationshipsExportFiles(first: Int, exportContext: ExportContext!): FileConnection + stixSightingRelationship(id: String): StixSightingRelationship + stixSightingRelationships(first: Int, after: ID, orderBy: StixSightingRelationshipsOrdering, orderMode: OrderingMode, fromOrToId: String, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, search: String, filters: FilterGroup, toStix: Boolean): StixSightingRelationshipConnection + stixSightingRelationshipsTimeSeries(fromOrToId: String, fromId: StixRef, toId: StixRef, field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime!, interval: String!, fromTypes: [String], toTypes: [String], search: String, filters: FilterGroup): [TimeSeries] + stixSightingRelationshipsDistribution(fromOrToId: String, fromId: StixRef, toId: StixRef, field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, limit: Int, order: String, fromTypes: [String], toTypes: [String], search: String, filters: FilterGroup): [Distribution] + stixSightingRelationshipsNumber(dateAttribute: String, fromOrToId: String, fromId: StixRef, toId: StixRef, endDate: DateTime, fromTypes: [String], toTypes: [String], search: String, filters: FilterGroup): Number + stixRefRelationship(id: String): StixRefRelationship + stixRefRelationships(first: Int, after: ID, orderBy: StixRefRelationshipsOrdering, orderMode: OrderingMode, fromOrToId: String, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: [String], startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, search: String, filters: FilterGroup, toStix: Boolean): StixRefRelationshipConnection + stixNestedRefRelationships(first: Int, after: ID, orderBy: StixRefRelationshipsOrdering, orderMode: OrderingMode, fromOrToId: String, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: [String], startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, search: String, filters: FilterGroup, toStix: Boolean): StixRefRelationshipConnection + stixSchemaRefRelationships(id: String, toType: String): DefinitionRefRelationship + stixRefRelationshipsDistribution(field: String!, operation: StatsOperation!, relationship_type: [String], isTo: Boolean, toRole: String, toTypes: [String], startDate: DateTime, endDate: DateTime, dateAttribute: String, limit: Int, order: String): [Distribution] + stixRefRelationshipsNumber(types: [String!], fromId: StixRef, endDate: DateTime): Number + stixObjectOrStixRelationship(id: String!): StixObjectOrStixRelationship + stixObjectOrStixRelationships(first: Int, after: ID, search: String, filters: FilterGroup): StixObjectOrStixRelationshipConnection + stixCoreObjectOrStixCoreRelationship(id: String!): StixCoreObjectOrStixCoreRelationship + channel(id: String!): Channel + channels(first: Int, after: ID, orderBy: ChannelsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): ChannelConnection + language(id: String!): Language + languages(first: Int, after: ID, orderBy: LanguagesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): LanguageConnection + event(id: String!): Event + events(first: Int, after: ID, orderBy: EventsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): EventConnection + grouping(id: String!): Grouping + groupings(first: Int, after: ID, orderBy: GroupingsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): GroupingConnection + groupingsTimeSeries(objectId: String, authorId: String, groupingType: String, field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime!, interval: String!, filters: FilterGroup, search: String): [TimeSeries] + groupingsNumber(groupingContext: String, objectId: String, authorId: String, endDate: DateTime, filters: FilterGroup): Number + groupingsDistribution(objectId: String, authorId: String, field: String!, operation: StatsOperation!, limit: Int, order: String, startDate: DateTime, endDate: DateTime, dateAttribute: String, filters: FilterGroup, search: String): [Distribution] + groupingContainsStixObjectOrStixRelationship(id: String!, stixObjectOrStixRelationshipId: String!): Boolean + narrative(id: String!): Narrative + narratives(first: Int, after: ID, orderBy: NarrativesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): NarrativeConnection + triggerKnowledge(id: String!): Trigger + triggersKnowledge(first: Int, after: ID, orderBy: TriggersOrdering, orderMode: OrderingMode, filters: FilterGroup, includeAuthorities: Boolean, search: String): TriggerConnection + triggersKnowledgeCount(filters: FilterGroup, includeAuthorities: Boolean, search: String): Int + triggerActivity(id: String!): Trigger + triggersActivity(first: Int, after: ID, orderBy: TriggersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): TriggerConnection + notification(id: String!): Notification + notifications(first: Int, after: ID, orderBy: NotificationsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): NotificationConnection + myNotifications(first: Int, after: ID, orderBy: NotificationsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): NotificationConnection + myUnreadNotificationsCount: Int + dataComponent(id: String!): DataComponent + dataComponents(first: Int, after: ID, orderBy: DataComponentsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): DataComponentConnection + dataSource(id: String!): DataSource + dataSources(first: Int, after: ID, orderBy: DataSourcesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): DataSourceConnection + vocabulary(id: String!): Vocabulary + vocabularyCategories: [VocabularyDefinition!]! + vocabularies(category: VocabularyCategory, first: Int, after: ID, orderBy: VocabularyOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): VocabularyConnection + administrativeArea(id: String!): AdministrativeArea + administrativeAreas(first: Int, after: ID, orderBy: AdministrativeAreasOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): AdministrativeAreaConnection + task(id: String!): Task + tasks(first: Int, after: ID, orderBy: TasksOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): TaskConnection + taskContainsStixObjectOrStixRelationship(id: String!, stixObjectOrStixRelationshipId: String!): Boolean + taskTemplate(id: String!): TaskTemplate + taskTemplates(first: Int, after: ID, orderBy: TaskTemplatesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): TaskTemplateConnection + case(id: String!): Case + cases(first: Int, after: ID, orderBy: CasesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): CaseConnection + caseTemplate(id: String!): CaseTemplate + caseTemplates(first: Int, after: ID, orderBy: CaseTemplatesOrdering, orderMode: OrderingMode, search: String): CaseTemplateConnection + caseIncident(id: String!): CaseIncident + caseIncidents(first: Int, after: ID, orderBy: CaseIncidentsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): CaseIncidentConnection + caseIncidentContainsStixObjectOrStixRelationship(id: String!, stixObjectOrStixRelationshipId: String!): Boolean + caseRfi(id: String!): CaseRfi + caseRfis(first: Int, after: ID, orderBy: CaseRfisOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): CaseRfiConnection + caseRfiContainsStixObjectOrStixRelationship(id: String!, stixObjectOrStixRelationshipId: String!): Boolean + caseRft(id: String!): CaseRft + caseRfts(first: Int, after: ID, orderBy: CaseRftsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): CaseRftConnection + caseRftContainsStixObjectOrStixRelationship(id: String!, stixObjectOrStixRelationshipId: String!): Boolean + feedback(id: String!): Feedback + feedbacks(first: Int, after: ID, orderBy: FeedbacksOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): FeedbackConnection + feedbackContainsStixObjectOrStixRelationship(id: String!, stixObjectOrStixRelationshipId: String!): Boolean + entitySetting(id: String!): EntitySetting + entitySettingByType(targetType: String!): EntitySetting + entitySettings(first: Int, after: ID, orderBy: EntitySettingsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): EntitySettingConnection + workspace(id: String!): Workspace + workspaces(first: Int, after: ID, orderBy: WorkspacesOrdering, orderMode: OrderingMode, filters: FilterGroup, includeAuthorities: Boolean, search: String): WorkspaceConnection + malwareAnalysis(id: String!): MalwareAnalysis + malwareAnalyses(first: Int, after: ID, orderBy: MalwareAnalysesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): MalwareAnalysisConnection + managerConfiguration(id: String!): ManagerConfiguration + managerConfigurationByManagerId(managerId: String!): ManagerConfiguration + notificationNotifiers: [Notifier!]! + notifier(id: String!): Notifier + notifierTest(input: NotifierTestInput!): String + notifiers(first: Int, after: ID, orderBy: NotifierOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): NotifierConnection + threatActorIndividual(id: String!): ThreatActorIndividual + threatActorsIndividuals(first: Int, after: ID, orderBy: ThreatActorsIndividualOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): ThreatActorIndividualConnection + threatActorIndividualContainsStixObjectOrStixRelationship(id: String!, stixObjectOrStixRelationshipId: String!): Boolean + playbook(id: String!): Playbook + playbooks(first: Int, after: ID, orderBy: PlaybooksOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): PlaybookConnection + playbookComponents: [PlaybookComponent]! + playbooksForEntity(id: String!): [Playbook] + ingestionRss(id: String!): IngestionRss + ingestionRsss(first: Int, after: ID, orderBy: IngestionRssOrdering, orderMode: OrderingMode, filters: FilterGroup, includeAuthorities: Boolean, search: String): IngestionRssConnection + ingestionTaxii(id: String!): IngestionTaxii + ingestionTaxiis(first: Int, after: ID, orderBy: IngestionTaxiiOrdering, orderMode: OrderingMode, filters: FilterGroup, includeAuthorities: Boolean, search: String): IngestionTaxiiConnection + ingestionCsv(id: String!): IngestionCsv + ingestionCsvs(first: Int, after: ID, orderBy: IngestionCsvOrdering, orderMode: OrderingMode, filters: FilterGroup, includeAuthorities: Boolean, search: String): IngestionCsvConnection + indicator(id: String!): Indicator + indicators(first: Int, after: ID, orderBy: IndicatorsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): IndicatorConnection + indicatorsTimeSeries(objectId: String, field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime!, interval: String!, filters: FilterGroup): [TimeSeries] + indicatorsNumber(pattern_type: String, objectId: String, endDate: DateTime): Number + indicatorsDistribution(objectId: String, field: String!, operation: StatsOperation!, limit: Int, order: String, startDate: DateTime, endDate: DateTime, dateAttribute: String): [Distribution] + decayRule(id: String!): DecayRule + decayRules(first: Int, after: ID, orderBy: DecayRuleOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): DecayRuleConnection + organization(id: String!): Organization + organizations(first: Int, after: ID, orderBy: OrganizationsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): OrganizationConnection + csvMapper(id: String!): CsvMapper + csvMappers(first: Int, after: ID, orderBy: CsvMapperOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): CsvMapperConnection + csvMapperTest(configuration: String!, content: String!): CsvMapperTestResult + csvMapperSchemaAttributes: [CsvMapperSchemaAttributes!]! + publicDashboard(id: String!): PublicDashboard + publicDashboards(first: Int, after: ID, orderBy: PublicDashboardsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): PublicDashboardConnection + publicDashboardByUriKey(uri_key: String!): PublicDashboard + publicStixCoreObjectsNumber(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): Number + publicStixRelationshipsNumber(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): Number + publicStixCoreObjectsMultiTimeSeries(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): [MultiTimeSeries] + publicStixRelationshipsMultiTimeSeries(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): [MultiTimeSeries] + publicStixCoreObjectsDistribution(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): [PublicDistribution] + publicStixRelationshipsDistribution(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): [PublicDistribution] + publicBookmarks(uriKey: String!, widgetId: String!): StixDomainObjectConnection + publicStixCoreObjects(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): StixCoreObjectConnection + publicStixRelationships(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): StixRelationshipConnection + obasStixCoreObjectSimulationsResult(id: ID!): StixObjectSimulationsResult + obasScenarioElementsDistribution(id: ID!, type: ScenarioType, filters: FilterGroup): [Distribution] + deleteOperation(id: String!): DeleteOperation + deleteOperations(first: Int, after: ID, orderBy: DeleteOperationOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): DeleteOperationConnection + supportPackage(id: String!): SupportPackage + supportPackages(first: Int, after: ID, orderBy: SupportPackageOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): SupportPackageConnection + exclusionList(id: String!): ExclusionList + exclusionLists(first: Int, after: ID, orderBy: ExclusionListOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): ExclusionListConnection + draftWorkspace(id: String!): DraftWorkspace + draftWorkspaces(first: Int, after: ID, orderBy: DraftWorkspacesOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): DraftWorkspaceConnection + draftWorkspaceEntities(draftId: String!, types: [String], first: Int, after: ID, orderBy: StixCoreObjectsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): StixCoreObjectConnection + draftWorkspaceRelationships(draftId: String!, types: [String], first: Int, after: ID, orderBy: StixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): StixRelationshipConnection +} + +type Subscription { + me: MeUser + settings(id: ID!): Settings + settingsMessages(id: ID!): Settings + group(id: ID!): Group + user(id: ID!): User + label(id: ID!): Label + statusTemplate(id: ID!): StatusTemplate + markingDefinition(id: ID!): MarkingDefinition + killChainPhase(id: ID!): KillChainPhase + stixCoreObject(id: ID!): StixCoreObject + internalObject(id: ID!): InternalObject @deprecated(reason: "[>=6.3 & <6.6]. Not used in the platform.") + stixDomainObject(id: ID!): StixDomainObject + stixCyberObservable(id: ID!): StixCyberObservable + stixCoreRelationship(id: ID!): StixCoreRelationship + stixSightingRelationship(id: ID!): StixSightingRelationship + stixRefRelationship(id: ID!): StixRefRelationship + externalReference(id: ID!): ExternalReference + notification: Notification + notificationsNumber: NotificationCount + entitySetting(id: ID!): EntitySetting + workspace(id: ID!): Workspace + managerConfiguration(id: ID!): ManagerConfiguration + aiBus(id: ID!): AIBus +} + +type WorkEditMutations { + delete: ID! + ping: ID! + reportExpectation(error: WorkErrorInput): ID! + addExpectations(expectations: Int): ID! + toReceived(message: String): ID! + toProcessed(message: String, inError: Boolean): ID! +} + +type SettingsEditMutations { + fieldPatch(input: [EditInput]!): Settings + contextPatch(input: EditContext): Settings + contextClean: Settings + editMessage(input: SettingsMessageInput!): Settings + deleteMessage(input: String!): Settings +} + +type SubTypeEditMutations { + statusAdd(input: StatusAddInput!): SubType + statusFieldPatch(statusId: String!, input: [EditInput]!): SubType + statusDelete(statusId: String!): SubType +} + +type GroupEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): Group + contextPatch(input: EditContext): Group + contextClean: Group + relationAdd(input: InternalRelationshipAddInput!): InternalRelationship + relationDelete(fromId: StixRef, toId: StixRef, relationship_type: String!): Group + editDefaultMarking(input: DefaultMarkingInput!): Group +} + +type UserEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): User + contextPatch(input: EditContext): User + contextClean: User + tokenRenew: User + relationAdd(input: InternalRelationshipAddInput!): InternalRelationship + relationDelete(toId: StixRef!, relationship_type: String!): User + organizationAdd(organizationId: ID!): User + organizationDelete(organizationId: ID!): User +} + +type RoleEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): Role + contextPatch(input: EditContext): Role + contextClean: Role + relationAdd(input: InternalRelationshipAddInput!): InternalRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Role +} + +type AttributeEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): Attribute +} + +type TaxiiCollectionEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): TaxiiCollection +} + +type StreamCollectionEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): StreamCollection + addGroup(id: ID!): StreamCollection + deleteGroup(id: ID!): StreamCollection +} + +type SynchronizerEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): Synchronizer +} + +type StixEditMutations { + delete: ID + merge(stixObjectsIds: [String]!): StixObject +} + +type MarkingDefinitionEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): MarkingDefinition + contextPatch(input: EditContext): MarkingDefinition + contextClean: MarkingDefinition +} + +type LabelEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): Label + contextPatch(input: EditContext): Label + contextClean: Label +} + +type ExternalReferenceEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): ExternalReference + contextPatch(input: EditContext): ExternalReference + contextClean: ExternalReference + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(fromId: StixRef!, relationship_type: String!): ExternalReference + askEnrichment(connectorId: ID!): Work + importPush(file: Upload!, fileMarkings: [String], version: DateTime, noTriggerImport: Boolean): File +} + +type KillChainPhaseEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): KillChainPhase + contextPatch(input: EditContext): KillChainPhase + contextClean: KillChainPhase + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): KillChainPhase +} + +enum AnalysisContentType { + fields + file +} + +union Analysis = MappingAnalysis + +input MappingAnalysisInput { + mappedEntities: [MappedEntityInput] +} + +type MappingAnalysis { + analysisType: String! + analysisStatus: State + analysisDate: DateTime + mappedEntities: [MappedEntity!] +} + +input MappedEntityInput { + matchedString: String! + matchedEntityId: String! +} + +type MappedEntity { + matchedString: String! + matchedEntity: StixCoreObject! + isEntityInContainer: Boolean! +} + +type StixCoreObjectEditMutations { + delete: ID + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationsAdd(input: StixRefRelationshipsAddInput!, commitMessage: String, references: [String]): StixCoreObject + relationDelete(toId: StixRef!, relationship_type: String!, commitMessage: String, references: [String]): StixCoreObject + restrictionOrganizationAdd(organizationId: ID!): StixCoreObject + restrictionOrganizationDelete(organizationId: ID!): StixCoreObject + askEnrichment(connectorId: ID!): Work + askAnalysis(contentSource: String!, contentType: AnalysisContentType!, connectorId: ID): Work + analysisPush(file: Upload!, contentSource: String!, contentType: AnalysisContentType!, analysisType: String!): File + analysisClear(contentSource: String!, contentType: AnalysisContentType!): Boolean + importPush(file: Upload!, fileMarkings: [String], version: DateTime, noTriggerImport: Boolean, fromTemplate: Boolean): File + exportAsk(input: ExportAskInput!): [File!] + exportPush(file: Upload!): Boolean +} + +input StixDomainObjectFileEditInput { + id: String! + description: String + order: Int + inCarousel: Boolean +} + +type StixDomainObjectEditMutations { + delete: ID + changeType(newType: String!): StixDomainObject + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): StixDomainObject + contextPatch(input: EditContext): StixDomainObject + contextClean: StixDomainObject + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationsAdd(input: StixRefRelationshipsAddInput!): StixDomainObject + relationDelete(toId: StixRef!, relationship_type: String): StixDomainObject + importPush(file: Upload!, fileMarkings: [String], version: DateTime, noTriggerImport: Boolean, fromTemplate: Boolean): File + exportAsk(input: ExportAskInput!): [File!] + exportPush(file: Upload!, file_markings: [String]!): Boolean + stixDomainObjectFileEdit(input: StixDomainObjectFileEditInput): StixDomainObject +} + +type AttackPatternEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): AttackPattern + contextPatch(input: EditContext): AttackPattern + contextClean: AttackPattern + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): AttackPattern +} + +type CampaignEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Campaign + contextPatch(input: EditContext): Campaign + contextClean: Campaign + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Campaign +} + +type ContainerEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Container + contextPatch(input: EditContext): Container + contextClean: Container + editAuthorizedMembers(input: [MemberAccessInput!]): Container + relationAdd(input: StixRefRelationshipAddInput!, commitMessage: String, references: [String]): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!, commitMessage: String, references: [String]): Container + investigationAdd: Workspace + knowledgeAddFromInvestigation(workspaceId: ID!): Container +} + +type NoteEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Note + contextPatch(input: EditContext): Note + contextClean: Note + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Note +} + +type ObservedDataEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): ObservedData + contextPatch(input: EditContext): ObservedData + contextClean: ObservedData + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): ObservedData +} + +type OpinionEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Opinion + contextPatch(input: EditContext): Opinion + contextClean: Opinion + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Opinion +} + +type ReportEditMutations { + delete(purgeElements: Boolean): ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Report + contextPatch(input: EditContext): Report + contextClean: Report + relationAdd(input: StixRefRelationshipAddInput!, commitMessage: String, references: [String]): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!, commitMessage: String, references: [String]): Report +} + +type CourseOfActionEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): CourseOfAction + contextPatch(input: EditContext): CourseOfAction + contextClean: CourseOfAction + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): CourseOfAction +} + +type IdentityEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Identity + contextPatch(input: EditContext): Identity + contextClean: Identity + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Identity +} + +type IndividualEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Individual + contextPatch(input: EditContext): Individual + contextClean: Individual + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Individual +} + +type SectorEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Sector + contextPatch(input: EditContext): Sector + contextClean: Sector + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Sector +} + +type SystemEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): System + contextPatch(input: EditContext): System + contextClean: System + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): System +} + +type InfrastructureEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Infrastructure + contextPatch(input: EditContext): Infrastructure + contextClean: Infrastructure + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Infrastructure +} + +type IntrusionSetEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): IntrusionSet + contextPatch(input: EditContext): IntrusionSet + contextClean: IntrusionSet + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): IntrusionSet +} + +type LocationEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Location + contextPatch(input: EditContext): Location + contextClean: Location + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Location +} + +type CityEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): City + contextPatch(input: EditContext): City + contextClean: City + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): City +} + +type CountryEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Country + contextPatch(input: EditContext): Country + contextClean: Country + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Country +} + +type RegionEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Region + contextPatch(input: EditContext): Region + contextClean: Region + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Region +} + +type PositionEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Position + contextPatch(input: EditContext): Position + contextClean: Position + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Position +} + +type MalwareEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Malware + contextPatch(input: EditContext): Malware + contextClean: Malware + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Malware +} + +type ThreatActorGroupEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): ThreatActorGroup + contextPatch(input: EditContext): ThreatActorGroup + contextClean: ThreatActorGroup + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): ThreatActorGroup +} + +type ToolEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Tool + contextPatch(input: EditContext): Tool + contextClean: Tool + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Tool +} + +type VulnerabilityEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Vulnerability + contextPatch(input: EditContext): Vulnerability + contextClean: Vulnerability + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Vulnerability +} + +type IncidentEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): Incident + contextPatch(input: EditContext): Incident + contextClean: Incident + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationDelete(toId: StixRef!, relationship_type: String!): Incident +} + +type StixCyberObservableEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): StixCyberObservable + contextPatch(input: EditContext): StixCyberObservable + contextClean: StixCyberObservable + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationsAdd(input: StixRefRelationshipsAddInput!): StixCyberObservable + relationDelete(toId: StixRef!, relationship_type: String!): StixCyberObservable + promoteToIndicator: Indicator + importPush(file: Upload!, fileMarkings: [String], version: DateTime, noTriggerImport: Boolean): File + exportAsk(format: String!, exportType: String!, maxMarkingDefinition: String): [File!] + exportPush(file: Upload!): Boolean + promote: StixCyberObservable @deprecated(reason: "[>=6.2 & <6.5]. Use `promoteToIndicator`.") +} + +type StixRelationshipEditMutations { + delete: ID +} + +type StixCoreRelationshipEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): StixCoreRelationship + contextPatch(input: EditContext): StixCoreRelationship + contextClean: StixCoreRelationship + relationAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + relationsAdd(input: StixRefRelationshipsAddInput!, commitMessage: String, references: [String]): StixCoreRelationship + relationDelete(toId: StixRef!, relationship_type: String!, commitMessage: String, references: [String]): StixCoreRelationship + restrictionOrganizationAdd(organizationId: ID!): StixCoreRelationship + restrictionOrganizationDelete(organizationId: ID!): StixCoreRelationship +} + +type StixSightingRelationshipEditMutations { + delete: ID + fieldPatch(input: [EditInput]!, commitMessage: String, references: [String]): StixSightingRelationship + contextPatch(input: EditContext): StixSightingRelationship + contextClean: StixSightingRelationship + relationAdd(input: StixRefRelationshipAddInput!): StixSightingRelationship + relationsAdd(input: StixRefRelationshipsAddInput!, commitMessage: String, references: [String]): StixSightingRelationship + relationDelete(toId: StixRef!, relationship_type: String!, commitMessage: String, references: [String]): StixSightingRelationship + restrictionOrganizationAdd(organizationId: ID!): StixSightingRelationship + restrictionOrganizationDelete(organizationId: ID!): StixSightingRelationship +} + +type StixRefRelationshipEditMutations { + delete: ID + fieldPatch(input: [EditInput]!): StixRefRelationship + contextPatch(input: EditContext): StixRefRelationship +} + +type Mutation { + deleteImport(fileName: String): ID + uploadImport(file: Upload!, fileMarkings: [String]): File + uploadPending(file: Upload!, entityId: String, labels: [String], errorOnExisting: Boolean, refreshEntity: Boolean): File + askJobImport(fileName: ID!, connectorId: String, configuration: String, bypassEntityId: String, bypassValidation: Boolean): File + resetFileIndexing: Boolean + synchronizerAdd(input: SynchronizerAddInput!): Synchronizer + synchronizerEdit(id: ID!): SynchronizerEditMutations + synchronizerStart(id: ID!): Synchronizer + synchronizerStop(id: ID!): Synchronizer + synchronizerTest(input: SynchronizerAddInput): String + workAdd(connectorId: String!, friendlyName: String): Work! + workEdit(id: ID!): WorkEditMutations + workDelete(connectorId: String!): Boolean + deleteBackgroundTask(id: ID!): ID! + listTaskAdd(input: ListTaskAddInput!): BackgroundTask! + queryTaskAdd(input: QueryTaskAddInput!): BackgroundTask! + retentionRuleAdd(input: RetentionRuleAddInput!): RetentionRule! + retentionRuleCheck(input: RetentionRuleAddInput): Int! + retentionRuleEdit(id: ID!): RetentionRuleEditMutations + ruleSetActivation(id: ID!, enable: Boolean!): Rule! + ruleManagerClean(eventId: ID): RuleManager! + frontendErrorLog(message: String!, codeStack: String, componentStack: String): Boolean + token(input: UserLoginInput): String + otpActivation(input: UserOTPActivationInput): MeUser + otpDeactivation: MeUser + otpUserDeactivation(id: ID!): MeUser + otpLogin(input: UserOTPLoginInput): Boolean + settingsEdit(id: ID!): SettingsEditMutations + subTypeEdit(id: ID!): SubTypeEditMutations + statusTemplateAdd(input: StatusTemplateAddInput!): StatusTemplate! + statusTemplateDelete(id: ID!): ID! + statusTemplateFieldPatch(id: ID!, input: [EditInput!]!): StatusTemplate! + statusTemplateContextPatch(id: ID!, input: EditContext!): StatusTemplate! + statusTemplateContextClean(id: ID!): StatusTemplate! + groupAdd(input: GroupAddInput!): Group + groupEdit(id: ID!): GroupEditMutations + userAdd(input: UserAddInput!): User + userEdit(id: ID!): UserEditMutations + meTokenRenew: MeUser + meEdit(input: [EditInput]!, password: String): MeUser + bookmarkAdd(id: ID!, type: String!): StixDomainObject + bookmarkDelete(id: ID!): ID + logout: ID + roleAdd(input: RoleAddInput!): Role + sessionKill(id: ID!): ID + userSessionsKill(id: ID!): [ID] + roleEdit(id: ID!): RoleEditMutations + pingConnector(id: ID!, state: String, connectorInfo: ConnectorInfoInput): Connector + registerConnector(input: RegisterConnectorInput): Connector + resetStateConnector(id: ID!): Connector + deleteConnector(id: ID!): ID! + updateConnectorTrigger(id: ID!, input: [EditInput]!): Connector + feedAdd(input: FeedAddInput!): Feed + feedDelete(id: ID!): ID! + feedEdit(id: ID!, input: FeedAddInput!): Feed! + taxiiCollectionAdd(input: TaxiiCollectionAddInput!): TaxiiCollection + taxiiCollectionEdit(id: ID!): TaxiiCollectionEditMutations + streamCollectionAdd(input: StreamCollectionAddInput!): StreamCollection + streamCollectionEdit(id: ID!): StreamCollectionEditMutations + stixEdit(id: ID!): StixEditMutations + markingDefinitionAdd(input: MarkingDefinitionAddInput!): MarkingDefinition + markingDefinitionEdit(id: ID!): MarkingDefinitionEditMutations + labelAdd(input: LabelAddInput!): Label + labelEdit(id: ID!): LabelEditMutations + externalReferenceAdd(input: ExternalReferenceAddInput!): ExternalReference + externalReferenceEdit(id: ID!): ExternalReferenceEditMutations + killChainPhaseAdd(input: KillChainPhaseAddInput!): KillChainPhase + killChainPhaseEdit(id: ID!): KillChainPhaseEditMutations + stixCoreObjectEdit(id: ID!): StixCoreObjectEditMutations + stixCoreObjectsExportAsk(input: StixCoreObjectsExportAskInput!): [File!] + stixCoreObjectsExportPush(entity_id: String, entity_type: String!, file: Upload!, file_markings: [String]!, listFilters: String): Boolean + stixBundlePush(connectorId: String!, bundle: String!): Boolean + stixDomainObjectAdd(input: StixDomainObjectAddInput!): StixDomainObject + stixDomainObjectEdit(id: ID!): StixDomainObjectEditMutations + stixDomainObjectsExportAsk(format: String!, exportType: String!, contentMaxMarkings: [String], fileMarkings: [String], search: String, exportContext: ExportContext, relationship_type: [String], orderBy: StixDomainObjectsOrdering, orderMode: OrderingMode, filters: FilterGroup, selectedIds: [String]): [File!] + stixDomainObjectsDelete(id: [ID]!): [ID]! + stixDomainObjectsExportPush(entity_id: String, entity_type: String!, file: Upload!, file_markings: [String]!, listFilters: String): Boolean + attackPatternAdd(input: AttackPatternAddInput!): AttackPattern + attackPatternEdit(id: ID!): AttackPatternEditMutations + campaignAdd(input: CampaignAddInput!): Campaign + campaignEdit(id: ID!): CampaignEditMutations + containerEdit(id: ID!): ContainerEditMutations + noteAdd(input: NoteAddInput!): Note + userNoteAdd(input: NoteUserAddInput!): Note + noteEdit(id: ID!): NoteEditMutations + observedDataAdd(input: ObservedDataAddInput!): ObservedData + observedDataEdit(id: ID!): ObservedDataEditMutations + opinionAdd(input: OpinionAddInput!): Opinion + userOpinionAdd(input: OpinionUserAddInput!): Opinion + opinionEdit(id: ID!): OpinionEditMutations + reportAdd(input: ReportAddInput!): Report + reportEdit(id: ID!): ReportEditMutations + courseOfActionAdd(input: CourseOfActionAddInput!): CourseOfAction + courseOfActionEdit(id: ID!): CourseOfActionEditMutations + identityAdd(input: IdentityAddInput!): Identity + identityEdit(id: ID!): IdentityEditMutations + individualAdd(input: IndividualAddInput!): Individual + individualEdit(id: ID!): IndividualEditMutations + sectorAdd(input: SectorAddInput!): Sector + sectorEdit(id: ID!): SectorEditMutations + systemAdd(input: SystemAddInput!): System + systemEdit(id: ID!): SystemEditMutations + infrastructureAdd(input: InfrastructureAddInput!): Infrastructure + infrastructureEdit(id: ID!): InfrastructureEditMutations + intrusionSetAdd(input: IntrusionSetAddInput!): IntrusionSet + intrusionSetEdit(id: ID!): IntrusionSetEditMutations + locationAdd(input: LocationAddInput!): Location + locationEdit(id: ID!): LocationEditMutations + cityAdd(input: CityAddInput!): City + cityEdit(id: ID!): CityEditMutations + countryAdd(input: CountryAddInput!): Country + countryEdit(id: ID!): CountryEditMutations + regionAdd(input: RegionAddInput!): Region + regionEdit(id: ID!): RegionEditMutations + positionAdd(input: PositionAddInput!): Position + positionEdit(id: ID!): PositionEditMutations + malwareAdd(input: MalwareAddInput!): Malware + malwareEdit(id: ID!): MalwareEditMutations + threatActorGroupAdd(input: ThreatActorGroupAddInput!): ThreatActorGroup + threatActorGroupEdit(id: ID!): ThreatActorGroupEditMutations + toolAdd(input: ToolAddInput!): Tool + toolEdit(id: ID!): ToolEditMutations + vulnerabilityAdd(input: VulnerabilityAddInput!): Vulnerability + vulnerabilityEdit(id: ID!): VulnerabilityEditMutations + incidentAdd(input: IncidentAddInput!): Incident + incidentEdit(id: ID!): IncidentEditMutations + stixCyberObservableAdd(type: String!, stix_id: StixId, x_opencti_score: Int, x_opencti_description: String, createIndicator: Boolean, createdBy: String, objectMarking: [String], objectLabel: [String], objectOrganization: [String], externalReferences: [String], clientMutationId: String, update: Boolean, AutonomousSystem: AutonomousSystemAddInput, Directory: DirectoryAddInput, DomainName: DomainNameAddInput, EmailAddr: EmailAddrAddInput, EmailMessage: EmailMessageAddInput, EmailMimePartType: EmailMimePartTypeAddInput, Artifact: ArtifactAddInput, StixFile: StixFileAddInput, X509Certificate: X509CertificateAddInput, IPv4Addr: IPv4AddrAddInput, IPv6Addr: IPv6AddrAddInput, MacAddr: MacAddrAddInput, Mutex: MutexAddInput, NetworkTraffic: NetworkTrafficAddInput, Process: ProcessAddInput, Software: SoftwareAddInput, Url: UrlAddInput, UserAccount: UserAccountAddInput, WindowsRegistryKey: WindowsRegistryKeyAddInput, WindowsRegistryValueType: WindowsRegistryValueTypeAddInput, CryptographicKey: CryptographicKeyAddInput, CryptocurrencyWallet: CryptocurrencyWalletAddInput, Hostname: HostnameAddInput, Text: TextAddInput, UserAgent: UserAgentAddInput, BankAccount: BankAccountAddInput, Credential: CredentialAddInput, TrackingNumber: TrackingNumberAddInput, PhoneNumber: PhoneNumberAddInput, PaymentCard: PaymentCardAddInput, MediaContent: MediaContentAddInput, Persona: PersonaAddInput): StixCyberObservable + stixCyberObservableEdit(id: ID!): StixCyberObservableEditMutations + stixCyberObservablesExportAsk(input: StixCyberObservablesExportAskInput!): [File!] + stixCyberObservablesExportPush(entity_id: String, entity_type: String!, file: Upload!, file_markings: [String]!, listFilters: String): Boolean + artifactImport(file: Upload!, x_opencti_description: String, createdBy: String, objectMarking: [String], objectLabel: [String]): Artifact + stixRelationshipEdit(id: ID!): StixRelationshipEditMutations + stixCoreRelationshipAdd(input: StixCoreRelationshipAddInput, reversedReturn: Boolean): StixCoreRelationship + stixCoreRelationshipEdit(id: ID!): StixCoreRelationshipEditMutations + stixCoreRelationshipsExportAsk(input: StixCoreRelationshipsExportAskInput!): [File!] + stixCoreRelationshipDelete(fromId: StixRef!, toId: StixRef!, relationship_type: String!): Boolean! + stixCoreRelationshipsExportPush(entity_id: String, entity_type: String!, file: Upload!, file_markings: [String]!, listFilters: String): Boolean + stixRefRelationshipAdd(input: StixRefRelationshipAddInput!): StixRefRelationship + stixRefRelationshipEdit(id: ID!): StixRefRelationshipEditMutations + stixSightingRelationshipAdd(input: StixSightingRelationshipAddInput!): StixSightingRelationship + stixSightingRelationshipEdit(id: ID!): StixSightingRelationshipEditMutations + channelAdd(input: ChannelAddInput!): Channel + channelDelete(id: ID!): ID + channelFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): Channel + channelContextPatch(id: ID!, input: EditContext!): Channel + channelContextClean(id: ID!): Channel + channelRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + channelRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): Channel + languageAdd(input: LanguageAddInput!): Language + languageDelete(id: ID!): ID + languageFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): Language + languageContextPatch(id: ID!, input: EditContext!): Language + languageContextClean(id: ID!): Language + languageRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + languageRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): Language + eventAdd(input: EventAddInput!): Event + eventDelete(id: ID!): ID + eventFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): Event + eventContextPatch(id: ID!, input: EditContext!): Event + eventContextClean(id: ID!): Event + eventRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + eventRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): Event + groupingAdd(input: GroupingAddInput!): Grouping + groupingDelete(id: ID!): ID + groupingFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): Grouping + groupingContextPatch(id: ID!, input: EditContext): Grouping + groupingContextClean(id: ID!): Grouping + groupingRelationAdd(id: ID!, input: StixRefRelationshipAddInput): StixRefRelationship + groupingRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): Grouping + narrativeAdd(input: NarrativeAddInput!): Narrative + narrativeDelete(id: ID!): ID + narrativeFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): Narrative + narrativeContextPatch(id: ID!, input: EditContext!): Narrative + narrativeContextClean(id: ID!): Narrative + narrativeRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + narrativeRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): Narrative + triggerKnowledgeDelete(id: ID!): ID + triggerKnowledgeFieldPatch(id: ID!, input: [EditInput!]!): Trigger + triggerKnowledgeLiveAdd(input: TriggerLiveAddInput!): Trigger + triggerKnowledgeDigestAdd(input: TriggerDigestAddInput!): Trigger + triggerActivityDelete(id: ID!): ID + triggerActivityFieldPatch(id: ID!, input: [EditInput!]!): Trigger + triggerActivityLiveAdd(input: TriggerActivityLiveAddInput!): Trigger + triggerActivityDigestAdd(input: TriggerActivityDigestAddInput!): Trigger + notificationDelete(id: ID!): ID + notificationMarkRead(id: ID!, read: Boolean!): Notification + dataComponentAdd(input: DataComponentAddInput!): DataComponent + dataComponentDelete(id: ID!): ID + dataComponentFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): DataComponent + dataComponentContextPatch(id: ID!, input: EditContext!): DataComponent + dataComponentContextClean(id: ID!): DataComponent + dataComponentRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + dataComponentRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): DataComponent + dataSourceAdd(input: DataSourceAddInput!): DataSource + dataSourceDelete(id: ID!): ID + dataSourceFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): DataSource + dataSourceContextPatch(id: ID!, input: EditContext!): DataSource + dataSourceContextClean(id: ID!): DataSource + dataSourceRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + dataSourceRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): DataSource + dataSourceDataComponentAdd(id: ID!, dataComponentId: ID!): DataSource + dataSourceDataComponentDelete(id: ID!, dataComponentId: ID!): DataSource + vocabularyAdd(input: VocabularyAddInput!): Vocabulary + vocabularyFieldPatch(id: ID!, input: [EditInput!]!): Vocabulary + vocabularyDelete(id: ID!): ID + administrativeAreaAdd(input: AdministrativeAreaAddInput!): AdministrativeArea + administrativeAreaDelete(id: ID!): ID + administrativeAreaFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): AdministrativeArea + administrativeAreaContextPatch(id: ID!, input: EditContext!): AdministrativeArea + administrativeAreaContextClean(id: ID!): AdministrativeArea + administrativeAreaRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + administrativeAreaRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): AdministrativeArea + taskAdd(input: TaskAddInput!): Task + taskDelete(id: ID!): ID + taskFieldPatch(id: ID!, input: [EditInput!]!, commitMessage: String, references: [String]): Task + taskRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + taskRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): Task + taskTemplateAdd(input: TaskTemplateAddInput!): TaskTemplate + taskTemplateDelete(id: ID!): ID + taskTemplateFieldPatch(id: ID!, input: [EditInput!]!, commitMessage: String, references: [String]): TaskTemplate + caseDelete(id: ID!): ID + caseSetTemplate(id: ID!, caseTemplatesId: [ID!]!): Case + caseTemplateAdd(input: CaseTemplateAddInput!): CaseTemplate + caseTemplateDelete(id: ID!): ID + caseTemplateFieldPatch(id: ID!, input: [EditInput!]!, commitMessage: String, references: [String]): CaseTemplate + caseTemplateRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): CaseTemplate + caseTemplateRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): CaseTemplate + caseIncidentAdd(input: CaseIncidentAddInput!): CaseIncident + caseIncidentDelete(id: ID!): ID + caseRfiAdd(input: CaseRfiAddInput!): CaseRfi + caseRfiDelete(id: ID!): ID + caseRftAdd(input: CaseRftAddInput!): CaseRft + caseRftDelete(id: ID!): ID + feedbackAdd(input: FeedbackAddInput!): Feedback + feedbackDelete(id: ID!): ID + feedbackEditAuthorizedMembers(id: ID!, input: [MemberAccessInput!]): Feedback + entitySettingsFieldPatch(ids: [ID!]!, input: [EditInput!]!, commitMessage: String, references: [String]): [EntitySetting] + workspaceAdd(input: WorkspaceAddInput!): Workspace + workspaceDuplicate(input: WorkspaceDuplicateInput!): Workspace + workspaceDelete(id: ID!): ID + workspaceFieldPatch(id: ID!, input: [EditInput!]!): Workspace + workspaceEditAuthorizedMembers(id: ID!, input: [MemberAccessInput!]!): Workspace + workspaceContextPatch(id: ID!, input: EditContext!): Workspace + workspaceContextClean(id: ID!): Workspace + workspaceConfigurationImport(file: Upload!): String! + workspaceWidgetConfigurationImport(id: ID!, input: ImportConfigurationInput!): Workspace + malwareAnalysisAdd(input: MalwareAnalysisAddInput!): MalwareAnalysis + malwareAnalysisDelete(id: ID!): ID + malwareAnalysisFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): MalwareAnalysis + malwareAnalysisContextPatch(id: ID!, input: EditContext!): MalwareAnalysis + malwareAnalysisContextClean(id: ID!): MalwareAnalysis + malwareAnalysisRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + malwareAnalysisRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): MalwareAnalysis + managerConfigurationFieldPatch(id: ID!, input: [EditInput!]!, commitMessage: String, references: [String]): ManagerConfiguration + notifierDelete(id: ID!): ID + notifierFieldPatch(id: ID!, input: [EditInput!]!): Notifier + notifierAdd(input: NotifierAddInput!): Notifier + threatActorIndividualAdd(input: ThreatActorIndividualAddInput!): ThreatActorIndividual + threatActorIndividualDelete(id: ID!): ID + threatActorIndividualFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): ThreatActorIndividual + threatActorIndividualContextPatch(id: ID!, input: EditContext): ThreatActorIndividual + threatActorIndividualContextClean(id: ID!): ThreatActorIndividual + threatActorIndividualRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + threatActorIndividualRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): ThreatActorIndividual + playbookAdd(input: PlaybookAddInput!): Playbook + playbookAddNode(id: ID!, input: PlaybookAddNodeInput!): String! + playbookReplaceNode(id: ID!, nodeId: ID!, input: PlaybookAddNodeInput!): String! + playbookInsertNode(id: ID!, parentNodeId: ID!, parentPortId: ID!, childNodeId: ID!, input: PlaybookAddNodeInput!): PlaybookInsertResult! + playbookAddLink(id: ID!, input: PlaybookAddLinkInput!): String! + playbookDelete(id: ID!): ID + playbookDeleteNode(id: ID!, nodeId: ID!): Playbook + playbookDeleteLink(id: ID!, linkId: ID!): Playbook + playbookUpdatePositions(id: ID!, positions: String!): ID + playbookFieldPatch(id: ID!, input: [EditInput!]!, commitMessage: String, references: [String]): Playbook + playbookStepExecution(execution_id: ID!, event_id: ID!, execution_start: DateTime!, data_instance_id: ID!, playbook_id: ID!, previous_step_id: ID!, step_id: ID!, previous_bundle: String!, bundle: String!): Boolean + playbookExecute(id: ID!, entityId: String!): Boolean + ingestionRssAdd(input: IngestionRssAddInput!): IngestionRss + ingestionRssDelete(id: ID!): ID + ingestionRssFieldPatch(id: ID!, input: [EditInput!]!): IngestionRss + ingestionTaxiiAdd(input: IngestionTaxiiAddInput!): IngestionTaxii + ingestionTaxiiDelete(id: ID!): ID + ingestionTaxiiFieldPatch(id: ID!, input: [EditInput!]!): IngestionTaxii + ingestionCsvTester(input: IngestionCsvAddInput!): CsvMapperTestResult + ingestionCsvAdd(input: IngestionCsvAddInput!): IngestionCsv + ingestionCsvDelete(id: ID!): ID + ingestionCsvFieldPatch(id: ID!, input: [EditInput!]!): IngestionCsv + indicatorAdd(input: IndicatorAddInput!): Indicator + indicatorDelete(id: ID!): ID + indicatorFieldPatch(id: ID!, input: [EditInput!]!, commitMessage: String, references: [String]): Indicator + indicatorContextPatch(id: ID!, input: EditContext): Indicator + indicatorContextClean(id: ID!): Indicator + indicatorRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + indicatorRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): Indicator + decayRuleAdd(input: DecayRuleAddInput!): DecayRule + decayRuleDelete(id: ID!): ID + decayRuleFieldPatch(id: ID!, input: [EditInput!]!): DecayRule + organizationAdd(input: OrganizationAddInput!): Organization + organizationDelete(id: ID!): ID + organizationFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): Organization + organizationContextPatch(id: ID!, input: EditContext!): Organization + organizationContextClean(id: ID!): Organization + organizationRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship + organizationRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): Organization + organizationEditAuthorizedAuthorities(id: ID!, input: [String!]!): Organization + organizationAdminAdd(id: ID!, memberId: String!): Organization + organizationAdminRemove(id: ID!, memberId: String!): Organization + csvMapperAdd(input: CsvMapperAddInput!): CsvMapper + csvMapperDelete(id: ID!): ID + csvMapperFieldPatch(id: ID!, input: [EditInput!]!): CsvMapper + publicDashboardAdd(input: PublicDashboardAddInput!): PublicDashboard + publicDashboardDelete(id: ID!): ID + publicDashboardFieldPatch(id: ID!, input: [EditInput!]!): PublicDashboard + aiContainerGenerateReport(id: ID!, containerId: String!, paragraphs: Int, tone: Tone, format: Format, language: String): String + aiThreatGenerateReport(id: ID!, threatId: String!, paragraphs: Int, tone: Tone, format: Format): String + aiVictimGenerateReport(id: ID!, victimId: String!, paragraphs: Int, tone: Tone, format: Format): String + aiSummarizeFiles(id: ID!, elementId: String!, paragraphs: Int, tone: Tone, format: Format, language: String, fileIds: [String]): String + aiConvertFilesToStix(id: ID!, elementId: String!, fileIds: [String]): String + aiConvertIndicator(id: ID!, indicatorId: String!, format: IndicatorFormat!): String + aiImproveWriting(id: ID!, content: String!, format: Format): String + aiFixSpelling(id: ID!, content: String!, format: Format): String + aiMakeShorter(id: ID!, content: String!, format: Format): String + aiMakeLonger(id: ID!, content: String!, format: Format): String + aiChangeTone(id: ID!, content: String!, format: Format, tone: Tone): String + aiSummarize(id: ID!, content: String!, format: Format): String + aiExplain(id: ID!, content: String!): String + obasContainerGenerateScenario(id: ID!, interval: Int, selection: Selection, simulationType: SimulationType, useAI: Boolean, filters: FilterGroup): String + obasThreatGenerateScenario(id: ID!, interval: Int, selection: Selection, simulationType: SimulationType, useAI: Boolean, filters: FilterGroup): String + obasVictimGenerateScenario(id: ID!, interval: Int, selection: Selection, simulationType: SimulationType, useAI: Boolean, filters: FilterGroup): String + deleteOperationRestore(id: ID!): ID + deleteOperationConfirm(id: ID!): ID + supportPackageAdd(input: SupportPackageAddInput!): SupportPackage + supportPackageForceZip(input: SupportPackageForceZipInput!): SupportPackage + supportPackageDelete(id: ID!): ID + exclusionListContentAdd(input: ExclusionListContentAddInput!): ExclusionList + exclusionListFileAdd(input: ExclusionListFileAddInput!): ExclusionList + exclusionListDelete(id: ID!): ID + draftWorkspaceAdd(input: DraftWorkspaceAddInput!): DraftWorkspace + draftWorkspaceValidate(id: ID!): Work + draftWorkspaceDelete(id: ID!): ID +} + +type Channel implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + channel_types: [String] + aliases: [String] + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +enum ChannelsOrdering { + name + channel_types + created + modified + created_at + updated_at + objectMarking + objectLabel + x_opencti_workflow_id + confidence + _score +} + +type ChannelConnection { + pageInfo: PageInfo! + edges: [ChannelEdge] +} + +type ChannelEdge { + cursor: String! + node: Channel! +} + +input ChannelAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + channel_types: [String] + aliases: [String] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +type Language implements BasicObject & StixCoreObject & StixDomainObject & StixObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + aliases: [String] + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +enum LanguagesOrdering { + name + created + modified + created_at + updated_at + objectMarking + objectLabel + x_opencti_workflow_id + _score +} + +type LanguageConnection { + pageInfo: PageInfo! + edges: [LanguageEdge] +} + +type LanguageEdge { + cursor: String! + node: Language! +} + +input LanguageAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + aliases: [String] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + clientMutationId: String + update: Boolean +} + +type Event implements BasicObject & StixCoreObject & StixDomainObject & StixObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + event_types: [String] + start_time: DateTime + stop_time: DateTime + aliases: [String] + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +enum EventsOrdering { + name + event_types + created + modified + created_at + updated_at + objectMarking + objectLabel + x_opencti_workflow_id + start_time + stop_time + _score +} + +type EventConnection { + pageInfo: PageInfo! + edges: [EventEdge] +} + +type EventEdge { + cursor: String! + node: Event! +} + +input EventAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + event_types: [String!] + start_time: DateTime + stop_time: DateTime + aliases: [String] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + clientMutationId: String + x_opencti_workflow_id: String + update: Boolean + file: Upload +} + +type Grouping implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Container { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + authorized_members: [MemberAccess!] + currentUserAccessRight: String + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + relatedContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], viaTypes: [String]): ContainerConnection + name: String! + description: String + content: String + content_mapping: String + context: String! + x_opencti_aliases: [String] + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + contentsFromTemplate(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + templates: [Template!] + templateAndUtils(templateId: String!): TemplateAndUtils + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +enum GroupingsOrdering { + name + created + modified + context + created_at + updated_at + createdBy + objectMarking + x_opencti_workflow_id + creator + _score +} + +type GroupingConnection { + pageInfo: PageInfo! + edges: [GroupingEdge] +} + +type GroupingEdge { + cursor: String! + node: Grouping! +} + +input GroupingAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + content: String + content_mapping: String + + "*Constraints:*\n* Minimal length: `2`\n" + context: String! + x_opencti_aliases: [String] + revoked: Boolean + lang: String + confidence: Int + createdBy: String + objectMarking: [String] + objectLabel: [String] + objectOrganization: [String] + externalReferences: [String] + objects: [String] + created: DateTime + modified: DateTime + clientMutationId: String + x_opencti_workflow_id: String + update: Boolean + file: Upload +} + +type Narrative implements BasicObject & StixCoreObject & StixDomainObject & StixObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + narrative_types: [String] + aliases: [String] + parentNarratives: NarrativeConnection + subNarratives: NarrativeConnection + isSubNarrative: Boolean + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +enum NarrativesOrdering { + name + narrative_types + created + modified + created_at + updated_at + objectMarking + objectLabel + x_opencti_workflow_id + _score +} + +type NarrativeConnection { + pageInfo: PageInfo! + edges: [NarrativeEdge!]! +} + +type NarrativeEdge { + cursor: String! + node: Narrative! +} + +input NarrativeAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + narrative_types: [String!] + aliases: [String] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + clientMutationId: String + update: Boolean + file: Upload + x_opencti_workflow_id: String +} + +type ResolvedInstanceFilter { + id: String! + valid: Boolean! + value: String +} + +enum DigestPeriod { + hour + day + week + month +} + +enum TriggersOrdering { + name + created + event_types + trigger_type + notifiers + _score +} + +enum TriggerType { + live + digest +} + +enum TriggerEventType { + create + update + delete +} + +input TriggerLiveAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + event_types: [TriggerEventType!]! + notifiers: [StixRef!] + instance_trigger: Boolean! + filters: String + recipients: [String!] +} + +input TriggerDigestAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + trigger_ids: [String!]! + period: DigestPeriod! + trigger_time: String + notifiers: [StixRef!]! + recipients: [String!] +} + +type Trigger implements InternalObject & BasicObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + created: DateTime + modified: DateTime + created_at: DateTime + updated_at: DateTime + name: String! + description: String + trigger_type: TriggerType! + event_types: [String!] + filters: String + notifiers: [Notifier!] + trigger_ids: [String] + triggers: [Trigger] + recipients: [Member!] + period: DigestPeriod + trigger_time: String + isDirectAdministrator: Boolean + currentUserAccessRight: String + instance_trigger: Boolean +} + +type TriggerConnection { + pageInfo: PageInfo! + edges: [TriggerEdge!]! +} + +type TriggerEdge { + cursor: String! + node: Trigger! +} + +enum TriggerActivityEventType { + authentication + read + mutation + file + command +} + +input TriggerActivityLiveAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + notifiers: [StixRef!] + filters: String + recipients: [String!]! +} + +input TriggerActivityDigestAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + trigger_ids: [String!]! + period: DigestPeriod! + trigger_time: String + notifiers: [StixRef!]! + recipients: [String!]! +} + +enum NotificationsOrdering { + name + created + _score +} + +type NotificationCount { + user_id: String + count: Int +} + +type NotificationEvent { + message: String! + instance_id: String + operation: String! +} + +type NotificationContent { + title: String! + events: [NotificationEvent!]! +} + +type Notification implements InternalObject & BasicObject { + id: ID! + standard_id: String! + entity_type: String! + created: DateTime + name: String! + notification_type: String! + parent_types: [String]! + notification_content: [NotificationContent!]! + is_read: Boolean! + user_id: String + created_at: DateTime + updated_at: DateTime +} + +type NotificationConnection { + pageInfo: PageInfo! + edges: [NotificationEdge] +} + +type NotificationEdge { + cursor: String! + node: Notification! +} + +type DataComponent implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + name: String! + description: String + aliases: [String] + dataSource: DataSource + attackPatterns: AttackPatternConnection +} + +enum DataComponentsOrdering { + name + created + modified + created_at + updated_at + x_opencti_workflow_id + confidence + _score +} + +type DataComponentConnection { + pageInfo: PageInfo! + edges: [DataComponentEdge] +} + +type DataComponentEdge { + cursor: String! + node: DataComponent! +} + +input DataComponentAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectLabel: [String] + objectOrganization: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + clientMutationId: String + update: Boolean + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + aliases: [String] + dataSource: String + file: Upload + x_opencti_workflow_id: String +} + +type DataSource implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + name: String! + description: String + aliases: [String] + x_mitre_platforms: [String!] + collection_layers: [String!] + dataComponents: DataComponentConnection +} + +enum DataSourcesOrdering { + name + created + modified + created_at + updated_at + x_opencti_workflow_id + confidence + _score +} + +type DataSourceConnection { + pageInfo: PageInfo! + edges: [DataSourceEdge] +} + +type DataSourceEdge { + cursor: String! + node: DataSource! +} + +input DataSourceAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectLabel: [String] + objectOrganization: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + clientMutationId: String + update: Boolean + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + aliases: [String] + x_mitre_platforms: [String!] + collection_layers: [String!] + dataComponents: [String] + file: Upload + x_opencti_workflow_id: String +} + +enum VocabularyCategory { + account_type_ov + attack_motivation_ov + attack_resource_level_ov + case_severity_ov + case_priority_ov + channel_types_ov + collection_layers_ov + event_type_ov + grouping_context_ov + implementation_language_ov + incident_response_types_ov + incident_type_ov + incident_severity_ov + indicator_type_ov + infrastructure_type_ov + integrity_level_ov + malware_capabilities_ov + malware_result_ov + malware_type_ov + platforms_ov + opinion_ov + organization_type_ov + pattern_type_ov + permissions_ov + processor_architecture_ov + reliability_ov + report_types_ov + request_for_information_types_ov + request_for_takedown_types_ov + service_status_ov + service_type_ov + start_type_ov + threat_actor_group_type_ov + threat_actor_group_role_ov + threat_actor_group_sophistication_ov + threat_actor_individual_type_ov + threat_actor_individual_role_ov + threat_actor_individual_sophistication_ov + tool_types_ov + note_types_ov + gender_ov + marital_status_ov + hair_color_ov + eye_color_ov + persona_type_ov +} + +type VocabularyFieldDefinition { + key: String! + required: Boolean! + multiple: Boolean! +} + +type VocabularyDefinition { + key: VocabularyCategory! + description: String + entity_types: [String!]! + fields: [VocabularyFieldDefinition!]! +} + +type Vocabulary implements BasicObject & StixObject & StixMetaObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + creators: [Creator!] + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + created: DateTime + modified: DateTime + category: VocabularyDefinition! + name: String! + description: String + usages: Int! + aliases: [String!] + builtIn: Boolean + order: Int +} + +enum VocabularyOrdering { + name + category + description + order + _score +} + +type VocabularyConnection { + pageInfo: PageInfo! + edges: [VocabularyEdge!]! +} + +type VocabularyEdge { + cursor: String! + node: Vocabulary! +} + +input VocabularyAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `1`\n* Must match format: `not-blank`\n" + name: String! + description: String + category: VocabularyCategory! + order: Int + created: DateTime + modified: DateTime + aliases: [String!] + update: Boolean +} + +type AdministrativeArea implements BasicObject & StixCoreObject & StixDomainObject & StixObject & Location { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + latitude: Float + longitude: Float + precision: Float + x_opencti_aliases: [String] + cases(first: Int): CaseConnection + country: Country + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +enum AdministrativeAreasOrdering { + name + created + modified + created_at + updated_at + objectMarking + objectLabel + x_opencti_workflow_id + _score +} + +type AdministrativeAreaConnection { + pageInfo: PageInfo! + edges: [AdministrativeAreaEdge!] +} + +type AdministrativeAreaEdge { + cursor: String! + node: AdministrativeArea! +} + +input AdministrativeAreaAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + latitude: Float + longitude: Float + x_opencti_aliases: [String] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + clientMutationId: String + x_opencti_workflow_id: String + update: Boolean + file: Upload +} + +type Task implements Container & StixDomainObject & StixCoreObject & StixObject & BasicObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + authorized_members: [MemberAccess!] + currentUserAccessRight: String + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + relatedContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], viaTypes: [String]): ContainerConnection + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + contentsFromTemplate(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + templates: [Template!] + templateAndUtils(templateId: String!): TemplateAndUtils + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + name: String! + description: String + due_date: DateTime +} + +enum TasksOrdering { + name + description + created + modified + context + created_at + updated_at + creator + createdBy + x_opencti_workflow_id + confidence + due_date + objectAssignee + _score +} + +type TaskEdge { + cursor: String! + node: Task! +} + +type TaskConnection { + pageInfo: PageInfo! + edges: [TaskEdge!]! +} + +input TaskAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + created: DateTime + due_date: DateTime + objectAssignee: [String] + objectParticipant: [String] + objectLabel: [String] + objectMarking: [String] + objectOrganization: [String] + createdBy: String + objects: [String] + x_opencti_workflow_id: String + update: Boolean +} + +type TaskTemplate implements InternalObject & BasicObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + created: DateTime + modified: DateTime + name: String! + description: String +} + +enum TaskTemplatesOrdering { + name + description + created + modified + created_at + updated_at + creator + _score +} + +type TaskTemplateConnection { + pageInfo: PageInfo! + edges: [TaskTemplateEdge!]! +} + +type TaskTemplateEdge { + cursor: String! + node: TaskTemplate! +} + +input TaskTemplateAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String +} + +interface Case implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Container { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + authorized_members: [MemberAccess!] + currentUserAccessRight: String + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + relatedContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], viaTypes: [String]): ContainerConnection + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + contentsFromTemplate(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + templates: [Template!] + templateAndUtils(templateId: String!): TemplateAndUtils + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + name: String! + description: String + content: String + content_mapping: String + tasks: TaskConnection! +} + +enum CasesOrdering { + name + created + modified + context + created_at + updated_at + creator + createdBy + x_opencti_workflow_id + confidence + objectMarking + _score +} + +type CaseConnection { + pageInfo: PageInfo! + edges: [CaseEdge] +} + +type CaseEdge { + cursor: String! + node: Case! +} + +type CaseTemplate implements InternalObject & BasicObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + created: DateTime + modified: DateTime + name: String! + description: String + tasks: TaskTemplateConnection! +} + +enum CaseTemplatesOrdering { + name + description + created + _score +} + +type CaseTemplateConnection { + pageInfo: PageInfo! + edges: [CaseTemplateEdge!]! +} + +type CaseTemplateEdge { + cursor: String! + node: CaseTemplate! +} + +input CaseTemplateAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + created: DateTime + tasks: [StixRef!]! +} + +type CaseIncident implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Container & Case { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + authorized_members: [MemberAccess!] + currentUserAccessRight: String + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + relatedContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], viaTypes: [String]): ContainerConnection + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + contentsFromTemplate(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + templates: [Template!] + templateAndUtils(templateId: String!): TemplateAndUtils + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + name: String! + description: String + content: String + content_mapping: String + tasks: TaskConnection! + rating: Int + response_types: [String!] + severity: String + priority: String +} + +enum CaseIncidentsOrdering { + name + created + modified + context + severity + priority + created_at + updated_at + creator + createdBy + objectAssignee + x_opencti_workflow_id + confidence + objectMarking + _score +} + +type CaseIncidentConnection { + pageInfo: PageInfo! + edges: [CaseIncidentEdge] +} + +type CaseIncidentEdge { + cursor: String! + node: CaseIncident! +} + +input CaseIncidentAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + severity: String + priority: String + description: String + content: String + content_mapping: String + confidence: Int + revoked: Boolean + lang: String + objects: [String] + createdBy: String + objectMarking: [String] + objectAssignee: [String] + objectParticipant: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + response_types: [String!] + caseTemplates: [String!] + x_opencti_workflow_id: String + file: Upload + clientMutationId: String + update: Boolean +} + +type CaseRfi implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Container & Case { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + authorized_members: [MemberAccess!] + currentUserAccessRight: String + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + relatedContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], viaTypes: [String]): ContainerConnection + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + contentsFromTemplate(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + templates: [Template!] + templateAndUtils(templateId: String!): TemplateAndUtils + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + name: String! + description: String + content: String + content_mapping: String + tasks: TaskConnection! + information_types: [String!] + severity: String + priority: String +} + +enum CaseRfisOrdering { + name + created + modified + created_at + updated_at + creator + createdBy + objectAssignee + x_opencti_workflow_id + confidence + objectMarking + severity + priority + _score +} + +type CaseRfiConnection { + pageInfo: PageInfo! + edges: [CaseRfiEdge] +} + +type CaseRfiEdge { + cursor: String! + node: CaseRfi! +} + +input CaseRfiAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + content: String + content_mapping: String + severity: String + priority: String + confidence: Int + revoked: Boolean + lang: String + objects: [String] + createdBy: String + objectMarking: [String] + objectAssignee: [String] + objectParticipant: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + file: Upload + clientMutationId: String + update: Boolean + information_types: [String!] + caseTemplates: [String!] +} + +type CaseRft implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Container & Case { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + authorized_members: [MemberAccess!] + currentUserAccessRight: String + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + relatedContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], viaTypes: [String]): ContainerConnection + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + contentsFromTemplate(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + templates: [Template!] + templateAndUtils(templateId: String!): TemplateAndUtils + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + name: String! + description: String + content: String + content_mapping: String + tasks: TaskConnection! + takedown_types: [String!] + severity: String + priority: String +} + +enum CaseRftsOrdering { + name + created + modified + context + created_at + updated_at + creator + createdBy + objectAssignee + x_opencti_workflow_id + confidence + objectMarking + severity + priority + _score +} + +type CaseRftConnection { + pageInfo: PageInfo! + edges: [CaseRftEdge] +} + +type CaseRftEdge { + cursor: String! + node: CaseRft! +} + +input CaseRftAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + content: String + content_mapping: String + severity: String + priority: String + confidence: Int + revoked: Boolean + lang: String + objects: [String] + createdBy: String + objectMarking: [String] + objectAssignee: [String] + objectParticipant: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + file: Upload + clientMutationId: String + x_opencti_workflow_id: String + update: Boolean + takedown_types: [String!] + caseTemplates: [String!] +} + +type Feedback implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Container & Case { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + authorized_members: [MemberAccess!] + currentUserAccessRight: String + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + relatedContainers(first: Int, after: ID, orderBy: ContainersOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], viaTypes: [String]): ContainerConnection + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + contentsFromTemplate(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + templates: [Template!] + templateAndUtils(templateId: String!): TemplateAndUtils + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + name: String! + description: String + content: String + content_mapping: String + tasks: TaskConnection! + rating: Int +} + +enum FeedbacksOrdering { + name + created + modified + context + rating + created_at + updated_at + creator + createdBy + x_opencti_workflow_id + confidence + objectMarking + _score +} + +type FeedbackConnection { + pageInfo: PageInfo! + edges: [FeedbackEdge] +} + +type FeedbackEdge { + cursor: String! + node: Feedback! +} + +input FeedbackAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + content: String + content_mapping: String + confidence: Int + revoked: Boolean + lang: String + objects: [String] + createdBy: String + objectMarking: [String] + objectAssignee: [String] + objectOrganization: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + file: Upload + clientMutationId: String + update: Boolean + rating: Int +} + +type DefaultValue { + id: String! + name: String! +} + +type TypeAttribute { + name: String! + type: String! + mandatory: Boolean! + mandatoryType: String! + editDefault: Boolean! + multiple: Boolean + label: String + defaultValues: [DefaultValue!] + scale: String +} + +type ScaleAttribute { + name: String! + scale: String! +} + +type DefaultValueAttribute { + name: String! + type: String! + defaultValues: [DefaultValue!]! +} + +type OverviewWidgetCustomization { + key: String! + width: Int! + label: String! +} + +type EntitySetting implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String!]! + target_type: String! + platform_entity_files_ref: Boolean + platform_hidden_type: Boolean + enforce_reference: Boolean + attributes_configuration: String + attributesDefinitions: [TypeAttribute!]! + mandatoryAttributes: [String!]! + scaleAttributes: [ScaleAttribute!]! + defaultValuesAttributes: [DefaultValueAttribute!]! + availableSettings: [String!]! + created_at: DateTime! + updated_at: DateTime! + overview_layout_customization: [OverviewWidgetCustomization!] +} + +enum EntitySettingsOrdering { + target_type + _score +} + +type EntitySettingConnection { + pageInfo: PageInfo! + edges: [EntitySettingEdge!]! +} + +type EntitySettingEdge { + cursor: String! + node: EntitySetting! +} + +type Workspace implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String!]! + type: String + name: String! + description: String + owner: Creator + tags: [String] + manifest: String + created_at: DateTime + updated_at: DateTime + editContext: [EditUserContext!] + investigated_entities_ids: [String] + objects(first: Int, after: ID, orderBy: StixObjectOrStixRelationshipsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, types: [String], all: Boolean): StixObjectOrStixRelationshipRefConnection + graph_data: String + authorizedMembers: [MemberAccess!]! + currentUserAccessRight: String + toStixReportBundle: String + toConfigurationExport: String! + toWidgetExport(widgetId: ID!): String! + isShared: Boolean +} + +enum WorkspacesOrdering { + name + created_at + updated_at + creator + _score +} + +type WorkspaceConnection { + pageInfo: PageInfo! + edges: [WorkspaceEdge!]! +} + +type WorkspaceEdge { + cursor: String! + node: Workspace! +} + +input WorkspaceAddInput { + type: String! + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + tags: [String] + authorized_members: [MemberAccessInput!] + investigated_entities_ids: [String] +} + +input WorkspaceDuplicateInput { + type: String! + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + manifest: String + tags: [String] +} + +input ImportConfigurationInput { + importType: String! + file: Upload! + dashboardManifest: String +} + +input ImportWidgetInput { + file: Upload! + dashboardManifest: String +} + +type MalwareAnalysis implements BasicObject & StixCoreObject & StixDomainObject & StixObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + x_opencti_inferences: [Inference] + draftVersion: DraftVersion + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean + product: String! + version: String + hostVm: Software + operatingSystem: Software + installedSoftware: SoftwareConnection + configuration_version: String + modules: [String!] + analysis_engine_version: String + analysis_definition_version: String + submitted: DateTime + analysis_started: DateTime + analysis_ended: DateTime + result_name: String! + result: String + analysisSco: StixCyberObservableConnection + sample: StixCyberObservable +} + +enum MalwareAnalysesOrdering { + result_name + product + operatingSystem + creator + createdBy + objectLabel + submitted + objectMarking + x_opencti_workflow_id + confidence + _score +} + +type MalwareAnalysisConnection { + pageInfo: PageInfo! + edges: [MalwareAnalysisEdge!] +} + +type MalwareAnalysisEdge { + cursor: String! + node: MalwareAnalysis! +} + +input MalwareAnalysisAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + product: String! + version: String + hostVm: String + operatingSystem: String + installedSoftware: [String] + configuration_version: String + modules: [String] + analysis_engine_version: String + analysis_definition_version: String + submitted: DateTime + analysis_started: DateTime + analysis_ended: DateTime + result_name: String! + result: String + analysisSco: [String] + analysisSample: String + created: DateTime + modified: DateTime + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectAssignee: [String] + externalReferences: [String] + objectOrganization: [String] + objectLabel: [String] + clientMutationId: String + x_opencti_workflow_id: String + update: Boolean + file: Upload +} + +type ManagerConfiguration implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String!]! + manager_id: String! + manager_running: Boolean + last_run_start_date: DateTime + last_run_end_date: DateTime + manager_setting: JSON +} + +enum NotifierOrdering { + name + created + connector + _score +} + +type NotifierParameter { + key: String + value: String +} + +type NotifierConnector { + id: ID! + name: String! + connector_type: String + connector_schema: String + connector_schema_ui: String + built_in: Boolean +} + +type Notifier implements InternalObject & BasicObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + created: DateTime + modified: DateTime + name: String! + description: String + notifier_connector: NotifierConnector! + notifier_connector_id: String! + notifier_configuration: String! + authorized_members: [MemberAccess!] +} + +type NotifierConnection { + pageInfo: PageInfo! + edges: [NotifierEdge] +} + +type NotifierEdge { + cursor: String! + node: Notifier! +} + +input NotifierTestInput { + notifier_test_id: String! + notifier_connector_id: String! + notifier_configuration: String! +} + +input NotifierAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + notifier_connector_id: String! + notifier_configuration: String! + authorized_members: [MemberAccessInput!] +} + +type Measure { + index: Int + measure: Float + date_seen: DateTime +} + +input MeasureInput { + measure: Float + date_seen: DateTime +} + +type ThreatActorIndividual implements BasicObject & StixObject & StixCoreObject & StixDomainObject & ThreatActor { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + name: String! + description: String + aliases: [String] + threat_actor_types: [String] + first_seen: DateTime + last_seen: DateTime + roles: [String] + goals: [String] + sophistication: String + resource_level: String + primary_motivation: String + secondary_motivations: [String] + personal_motivations: [String] + locations: LocationConnection + countries: CountryConnection + date_of_birth: DateTime + gender: String + job_title: String + marital_status: String + eye_color: String + hair_color: String + height: [Measure!] + weight: [Measure!] + bornIn: Country + ethnicity: Country + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +enum ThreatActorsIndividualOrdering { + name + created + modified + created_at + updated_at + x_opencti_workflow_id + sophistication + resource_level + confidence + _score + objectMarking + threat_actor_types +} + +type ThreatActorIndividualConnection { + pageInfo: PageInfo! + edges: [ThreatActorIndividualEdge] +} + +type ThreatActorIndividualEdge { + cursor: String! + node: ThreatActorIndividual! +} + +input ThreatActorIndividualAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + aliases: [String] + threat_actor_types: [String] + first_seen: DateTime + last_seen: DateTime + roles: [String] + goals: [String] + sophistication: String + resource_level: String + primary_motivation: String + secondary_motivations: [String] + personal_motivations: [String] + date_of_birth: DateTime + gender: String + job_title: String + marital_status: String + eye_color: String + hair_color: String + height: [MeasureInput!] + weight: [MeasureInput!] + confidence: Int + revoked: Boolean + lang: String + createdBy: String + objectMarking: [String] + objectOrganization: [String] + objectAssignee: [String] + objectLabel: [String] + bornIn: String + ethnicity: String + externalReferences: [String] + created: DateTime + modified: DateTime + clientMutationId: String + x_opencti_workflow_id: String + update: Boolean + file: Upload +} + +type PlayBookExecutionStep { + id: ID! + message: String + status: String + in_timestamp: String + out_timestamp: String + duration: Int + bundle_or_patch: String + error: String +} + +type PlayBookExecution { + id: ID! + playbook_id: ID! + execution_start: String + steps: [PlayBookExecutionStep!] +} + +type Playbook implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String!]! + name: String! + description: String + playbook_running: Boolean + playbook_definition: String + last_executions: [PlayBookExecution!] + queue_messages: Int! +} + +type PlaybookComponentPort { + id: ID! + type: String! +} + +type PlaybookComponent { + id: ID! + name: String! + description: String! + icon: String! + is_entry_point: Boolean + is_internal: Boolean + configuration_schema: String + ports: [PlaybookComponentPort!]! +} + +type PlaybookInsertResult { + nodeId: String! + linkId: String! +} + +enum PlaybooksOrdering { + name + playbook_running + _score +} + +type PlaybookConnection { + pageInfo: PageInfo! + edges: [PlaybookEdge!]! +} + +type PlaybookEdge { + cursor: String! + node: Playbook! +} + +input PlaybookAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String +} + +input PositionInput { + x: Float! + y: Float! +} + +input PlaybookAddNodeInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + component_id: String! + position: PositionInput! + configuration: String +} + +input PlaybookAddLinkInput { + from_node: String! + from_port: String! + to_node: String! +} + +type IngestionRss implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String!]! + created_at: DateTime + updated_at: DateTime + name: String! + description: String + uri: String! + user: Creator + defaultCreatedBy: Identity + defaultMarkingDefinitions: [MarkingDefinition] + report_types: [String!] + current_state_date: DateTime + ingestion_running: Boolean +} + +enum IngestionRssOrdering { + name + created_at + updated_at + uri + _score +} + +type IngestionRssConnection { + pageInfo: PageInfo! + edges: [IngestionRssEdge!]! +} + +type IngestionRssEdge { + cursor: String! + node: IngestionRss! +} + +input IngestionRssAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + + "*Constraints:*\n* Minimal length: `5`\n" + uri: String! + current_state_date: DateTime + ingestion_running: Boolean + user_id: String + created_by_ref: String + object_marking_refs: [String!] + report_types: [String!] +} + +enum TaxiiVersion { + v1 + v2 + v21 +} + +enum IngestionAuthType { + none + basic + bearer + certificate +} + +type IngestionTaxii implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String!]! + created_at: DateTime + updated_at: DateTime + name: String! + description: String + uri: String! + collection: String! + version: TaxiiVersion! + authentication_type: IngestionAuthType! + authentication_value: String + user_id: String + user: Creator + current_state_cursor: String + added_after_start: DateTime + ingestion_running: Boolean + last_execution_date: DateTime + confidence_to_score: Boolean +} + +enum IngestionTaxiiOrdering { + name + created_at + updated_at + uri + version + _score +} + +type IngestionTaxiiConnection { + pageInfo: PageInfo! + edges: [IngestionTaxiiEdge!]! +} + +type IngestionTaxiiEdge { + cursor: String! + node: IngestionTaxii! +} + +input IngestionTaxiiAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + version: TaxiiVersion! + authentication_type: IngestionAuthType! + authentication_value: String + + "*Constraints:*\n* Minimal length: `5`\n" + uri: String! + + "*Constraints:*\n* Minimal length: `5`\n" + collection: String! + added_after_start: DateTime + ingestion_running: Boolean + confidence_to_score: Boolean + user_id: String +} + +type IngestionCsv implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String]! + created_at: DateTime + updated_at: DateTime + name: String! + description: String + uri: String! + csvMapper: CsvMapper! + authentication_type: IngestionAuthType! + authentication_value: String + user_id: String! + user: Creator + ingestion_running: Boolean + current_state_hash: String + current_state_date: DateTime + markings: [String!] +} + +enum IngestionCsvOrdering { + name + created_at + updated_at + uri + mapper + _score +} + +type IngestionCsvConnection { + pageInfo: PageInfo! + edges: [IngestionCsvEdge!]! +} + +type IngestionCsvEdge { + cursor: String! + node: IngestionCsv! +} + +input IngestionCsvAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + authentication_type: IngestionAuthType! + authentication_value: String + current_state_date: DateTime + + "*Constraints:*\n* Minimal length: `5`\n" + uri: String! + csv_mapper_id: String! + ingestion_running: Boolean + user_id: String! + markings: [String!] +} + +enum IndicatorsOrdering { + pattern_type + pattern_version + pattern + name + indicator_types + valid_from + valid_until + x_opencti_score + x_opencti_detection + confidence + created + modified + created_at + updated_at + x_opencti_workflow_id + objectMarking + creator + createdBy + _score +} + +type IndicatorConnection { + pageInfo: PageInfo! + edges: [IndicatorEdge] +} + +type IndicatorEdge { + cursor: String! + node: Indicator! +} + +type DecayHistory { + updated_at: DateTime! + score: Int! +} + +type IndicatorDecayRule { + decay_rule_id: String + decay_lifetime: Int! + decay_pound: Float! + decay_points: [Int!] + decay_revoke_score: Int! +} + +type DecayLiveDetails { + live_score: Int! + live_points: [DecayHistory!] +} + +type DecayChartData { + live_score_serie: [DecayHistory!] +} + +type ObservablesValues { + type: String + value: String +} + +type Indicator implements BasicObject & StixObject & StixCoreObject & StixDomainObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + pattern_type: String + pattern_version: String + pattern: String + name: String! + description: String + indicator_types: [String] + valid_from: DateTime + valid_until: DateTime + x_opencti_score: Int + x_opencti_detection: Boolean + x_opencti_main_observable_type: String + x_opencti_observable_values: [ObservablesValues!] + x_mitre_platforms: [String] + killChainPhases: [KillChainPhase!] + observables(first: Int): StixCyberObservableConnection + decay_base_score: Int + decay_base_score_date: DateTime + decay_applied_rule: IndicatorDecayRule + decay_history: [DecayHistory!] + decayLiveDetails: DecayLiveDetails + decayChartData: DecayChartData + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +input IndicatorAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId!] + pattern_type: String! + pattern_version: String + pattern: String! + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + indicator_types: [String!] + valid_from: DateTime + valid_until: DateTime + confidence: Int + revoked: Boolean + lang: String + x_opencti_score: Int + x_opencti_detection: Boolean + x_opencti_main_observable_type: String + x_mitre_platforms: [String!] + killChainPhases: [String!] + createdBy: String + objectMarking: [String!] + objectLabel: [String!] + objectOrganization: [String!] + externalReferences: [String!] + created: DateTime + modified: DateTime + clientMutationId: String + update: Boolean + createObservables: Boolean + x_opencti_workflow_id: String + file: Upload + basedOn: [String!] +} + +type DecayRule implements InternalObject & BasicObject { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + created_at: DateTime! + updated_at: DateTime! + name: String! + description: String + order: Int! + active: Boolean! + built_in: Boolean + appliedIndicatorsCount: Int! + decay_lifetime: Int! + decay_pound: Float! + decay_points: [Int!] + decay_revoke_score: Int! + decay_observable_types: [String!] + decaySettingsChartData: DecayData +} + +type DecayData { + live_score_serie: [DecayHistory!] +} + +enum DecayRuleOrdering { + name + order + _score +} + +type DecayRuleConnection { + pageInfo: PageInfo! + edges: [DecayRuleEdge!]! +} + +type DecayRuleEdge { + cursor: String! + node: DecayRule! +} + +input DecayRuleAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + order: Int! + active: Boolean! + decay_lifetime: Int! + decay_pound: Float! + decay_points: [Int!] + decay_revoke_score: Int! + decay_observable_types: [String!] +} + +type Organization implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Identity { + id: ID! + standard_id: String! + entity_type: String! + parent_types: [String]! + representative: Representative! + x_opencti_stix_ids: [StixId] + is_inferred: Boolean! + spec_version: String! + created_at: DateTime! + updated_at: DateTime! + draftVersion: DraftVersion + x_opencti_inferences: [Inference] + createdBy: Identity + numberOfConnectedElement: Int! + objectMarking: [MarkingDefinition!] + objectOrganization: [Organization!] + objectLabel: [Label!] + externalReferences(first: Int): ExternalReferenceConnection + containersNumber: Number + containers(first: Int, entityTypes: [String!]): ContainerConnection + reports(first: Int): ReportConnection + notes(first: Int): NoteConnection + opinions(first: Int): OpinionConnection + observedData(first: Int): ObservedDataConnection + groupings(first: Int): GroupingConnection + cases(first: Int): CaseConnection + stixCoreRelationships(first: Int, after: ID, orderBy: StixCoreRelationshipsOrdering, orderMode: OrderingMode, fromId: StixRef, toId: StixRef, fromTypes: [String], toTypes: [String], relationship_type: String, startTimeStart: DateTime, startTimeStop: DateTime, stopTimeStart: DateTime, stopTimeStop: DateTime, firstSeenStart: DateTime, firstSeenStop: DateTime, lastSeenStart: DateTime, lastSeenStop: DateTime, confidences: [Int], search: String, filters: FilterGroup): StixCoreRelationshipConnection + stixCoreObjectsDistribution(relationship_type: [String], toTypes: [String], field: String!, startDate: DateTime, endDate: DateTime, dateAttribute: String, operation: StatsOperation!, limit: Int, order: String, types: [String], filters: FilterGroup, search: String): [Distribution] + stixCoreRelationshipsDistribution(field: String!, operation: StatsOperation!, startDate: DateTime, endDate: DateTime, dateAttribute: String, isTo: Boolean, limit: Int, order: String, elementWithTargetTypes: [String], fromId: [String], fromRole: String, fromTypes: [String], toId: [String], toRole: String, toTypes: [String], relationship_type: [String], confidences: [Int], search: String, filters: FilterGroup): [Distribution] + opinions_metrics: OpinionsMetrics + revoked: Boolean! + confidence: Int + lang: String + created: DateTime + modified: DateTime + x_opencti_graph_data: String + objectAssignee: [Assignee!] + objectParticipant: [Participant!] + avatar: OpenCtiFile + identity_class: String! + name: String! + description: String + contact_information: String + roles: [String] + x_opencti_aliases: [String] + x_opencti_reliability: String + x_opencti_organization_type: String + sectors: SectorConnection + members(first: Int, after: ID, orderBy: UsersOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): UserConnection + authorized_authorities: [String] + grantable_groups: [Group!] + subOrganizations: OrganizationConnection + parentOrganizations: OrganizationConnection + default_dashboard: Workspace + default_hidden_types: [String!] + creators: [Creator!] + toStix: String + importFiles(first: Int, prefixMimeType: String, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + pendingFiles(first: Int, after: ID, orderBy: FileOrdering, orderMode: OrderingMode, search: String, filters: FilterGroup): FileConnection + exportFiles(first: Int): FileConnection + editContext: [EditUserContext!] + connectors(onlyAlive: Boolean): [Connector] + jobs(first: Int): [Work] + status: Status + workflowEnabled: Boolean +} + +enum OrganizationsOrdering { + name + confidence + created + created_at + modified + updated_at + x_opencti_organization_type + x_opencti_workflow_id + _score +} + +type OrganizationConnection { + pageInfo: PageInfo! + edges: [OrganizationEdge!]! +} + +type OrganizationEdge { + cursor: String! + node: Organization! +} + +input OrganizationAddInput { + stix_id: StixId + x_opencti_stix_ids: [StixId] + + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + description: String + contact_information: String + roles: [String] + x_opencti_aliases: [String] + confidence: Int + revoked: Boolean + lang: String + x_opencti_organization_type: String + x_opencti_reliability: String + createdBy: String + objectMarking: [String] + objectLabel: [String] + externalReferences: [String] + created: DateTime + modified: DateTime + x_opencti_workflow_id: String + clientMutationId: String + update: Boolean + file: Upload +} + +type MeOrganization { + id: ID! + name: String! +} + +type MeOrganizationEdge { + cursor: String! + node: MeOrganization! +} + +type MeOrganizationConnection { + pageInfo: PageInfo! + edges: [MeOrganizationEdge!]! +} + +type AttributeColumnConfiguration { + separator: String + pattern_date: String + timezone: String +} + +type AttributeColumn { + column_name: String + configuration: AttributeColumnConfiguration +} + +type AttributeBasedOn { + representations: [String] +} + +type AttributeRef { + multiple: Boolean + id: String + ids: [String] +} + +type CsvMapperRepresentationAttribute { + key: String! + column: AttributeColumn + based_on: AttributeBasedOn + ref: AttributeRef + default_values: [DefaultValue!] +} + +enum CsvMapperOperator { + eq + not_eq +} + +type CsvMapperRepresentationTargetColumn { + column_reference: String + operator: CsvMapperOperator + value: String +} + +type CsvMapperRepresentationTarget { + entity_type: String! + column_based: CsvMapperRepresentationTargetColumn +} + +enum CsvMapperRepresentationType { + entity + relationship +} + +type CsvMapperRepresentation { + id: ID! + type: CsvMapperRepresentationType! + target: CsvMapperRepresentationTarget! + attributes: [CsvMapperRepresentationAttribute!]! + from: String + to: String +} + +type CsvMapper implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String!]! + name: String! + has_header: Boolean! + separator: String! + skipLineChar: String + representations: [CsvMapperRepresentation!]! + errors: String +} + +enum CsvMapperOrdering { + name + _score +} + +type CsvMapperConnection { + pageInfo: PageInfo! + edges: [CsvMapperEdge!]! +} + +type CsvMapperEdge { + cursor: String! + node: CsvMapper! +} + +type CsvMapperTestResult { + objects: String! + nbRelationships: Int! + nbEntities: Int! +} + +type CsvMapperSchemaAttribute { + name: String! + type: String! + mandatory: Boolean! + mandatoryType: String! + editDefault: Boolean! + multiple: Boolean! + defaultValues: [DefaultValue!] + label: String! + mappings: [CsvMapperSchemaAttribute!] +} + +type CsvMapperSchemaAttributes { + name: String! + attributes: [CsvMapperSchemaAttribute!]! +} + +input AttributeColumnConfigurationInput { + separator: String + pattern_date: String + timezone: String +} + +input AttributeColumnInput { + column_name: String + configuration: AttributeColumnConfigurationInput +} + +input AttributeBasedOnInput { + representations: [String] +} + +input AttributeRefInput { + multiple: Boolean + id: String + ids: [String] +} + +input CsvMapperRepresentationAttributeInput { + key: String + column: AttributeColumnInput + based_on: AttributeBasedOnInput + ref: AttributeRefInput +} + +input CsvMapperRepresentationTargetColumnInput { + column_reference: String + operator: CsvMapperOperator + value: String +} + +input CsvMapperRepresentationTargetInput { + entity_type: String! + column_based: CsvMapperRepresentationTargetColumnInput +} + +input CsvMapperRepresentationInput { + id: ID! + type: CsvMapperRepresentationType! + target: CsvMapperRepresentationTargetInput! + attributes: [CsvMapperRepresentationAttributeInput]! + from: String + to: String +} + +input CsvMapperAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + has_header: Boolean! + separator: String! + representations: String! + skipLineChar: String +} + +type PublicDashboard implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String!]! + name: String! + owner: Creator + description: String + dashboard_id: String! + dashboard: Workspace! + user_id: String! + public_manifest: String + private_manifest: String + uri_key: String! + allowed_markings_ids: [String!] + allowed_markings: [MarkingDefinitionShort!] + created_at: DateTime + updated_at: DateTime + editContext: [EditUserContext!] + enabled: Boolean! +} + +type PublicDistribution { + label: String! + entity: StixObjectOrStixRelationshipOrCreator + value: Int + breakdownDistribution: [Distribution] +} + +enum PublicDashboardsOrdering { + name + created_at + updated_at + user_id + enabled + dashboard + uri_key + _score +} + +type PublicDashboardConnection { + pageInfo: PageInfo! + edges: [PublicDashboardEdge!]! +} + +type PublicDashboardEdge { + cursor: String! + node: PublicDashboard! +} + +input PublicDashboardAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! + uri_key: String! + description: String + dashboard_id: String! + allowed_markings_ids: [String!] + enabled: Boolean! +} + +enum Tone { + tactical + operational + strategic +} + +enum Format { + text + html + markdown + json +} + +enum IndicatorFormat { + stix + sigma + yara +} + +type AIBus { + bus_id: String! + content: String! +} + +enum ScenarioType { + container + threat + victim +} + +enum Selection { + multiple + random +} + +enum SimulationType { + technical + simulated + mixed +} + +type SimulationsResult { + unknown: Int + success: Int + failure: Int +} + +type StixObjectSimulationsResult { + prevention: SimulationsResult + detection: SimulationsResult + human: SimulationsResult +} + +type DeletedElement { + id: String! + source_index: String! +} + +type DeleteOperation implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String!]! + objectMarking: [MarkingDefinition!] + confidence: Int + created_at: DateTime + deletedBy: Creator + main_entity_type: String! + main_entity_id: String! + main_entity_name: String! + deleted_elements: [DeletedElement!]! +} + +enum DeleteOperationOrdering { + main_entity_name + created_at + deletedBy + objectMarking + _score +} + +type DeleteOperationConnection { + pageInfo: PageInfo! + edges: [DeleteOperationEdge!]! +} + +type DeleteOperationEdge { + cursor: String! + node: DeleteOperation! +} + +type SupportPackage implements InternalObject & BasicObject { + id: ID! + name: String! + standard_id: String! + entity_type: String! + parent_types: [String]! + created_at: DateTime! + package_status: PackageStatus! + package_url: String + package_upload_dir: String + nodes_count: Int! + createdBy: Individual + creators: [Creator!] +} + +type SupportPackageConnection { + pageInfo: PageInfo! + edges: [SupportPackageEdge!]! +} + +type SupportPackageEdge { + cursor: String! + node: SupportPackage! +} + +enum PackageStatus { + IN_PROGRESS + READY + IN_ERROR +} + +enum SupportPackageOrdering { + name + created_at + package_status +} + +input SupportPackageAddInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + name: String! +} + +input SupportPackageForceZipInput { + "*Constraints:*\n* Minimal length: `2`\n* Must match format: `not-blank`\n" + id: String! +} + +type ExclusionList implements InternalObject & BasicObject { + id: ID! + name: String! + description: String + standard_id: String! + entity_type: String! + parent_types: [String]! + created_at: DateTime! + enabled: Boolean! + list_entity_types: [ExclusionListEntityTypes!]! + file_id: String! +} + +type ExclusionListConnection { + pageInfo: PageInfo! + edges: [ExclusionListEdge!] +} + +type ExclusionListEdge { + cursor: String! + node: ExclusionList! +} + +enum ExclusionListOrdering { + name + created_at +} + +enum ExclusionListEntityTypes { + IPV4_ADDR + IPV6_ADDR + DOMAIN_NAME + URL +} + +input ExclusionListContentAddInput { + name: String! + description: String + list_entity_types: [ExclusionListEntityTypes!]! + content: String! +} + +input ExclusionListFileAddInput { + name: String! + description: String + list_entity_types: [ExclusionListEntityTypes!]! + file: Upload! +} + +type DraftWorkspace implements InternalObject & BasicObject { + id: ID! + entity_type: String! + standard_id: String! + parent_types: [String!]! + name: String! + created_at: DateTime! + creators: [Creator!] + entity_id: String +} + +enum DraftWorkspacesOrdering { + name + created_at + creator +} + +type DraftWorkspaceConnection { + pageInfo: PageInfo! + edges: [DraftWorkspaceEdge!]! +} + +type DraftWorkspaceEdge { + cursor: String! + node: DraftWorkspace! +} + +input DraftWorkspaceAddInput { + name: String! + entity_id: String +} \ No newline at end of file diff --git a/src/opencti.py b/src/opencti.py index a304349..7384455 100644 --- a/src/opencti.py +++ b/src/opencti.py @@ -2,13 +2,15 @@ # See LICENSE file for licensing details. """OpenCTI API client.""" - +import functools +import pathlib import secrets -import textwrap import typing import urllib.parse -import requests +import gql +import gql.dsl +import gql.transport.requests class OpenctiUser(typing.NamedTuple): @@ -55,69 +57,56 @@ def __init__(self, url: str, api_token: str) -> None: url: URL of the Opencti API. api_token: Opencti API token. """ - self._query_url = urllib.parse.urljoin(url, "graphql") - self._api_token = api_token - self._cached_users: list[OpenctiUser] | None = None - self._cached_groups: list[OpenctiGroup] | None = None - - def _graphql( - self, - query_id: str, - query: str, - variables: dict | None = None, - ) -> dict: - """Call the OpenCTI GraphQL endpoint. - - Args: - query_id: GraphQL id. - query: GraphQL query. - variables: GraphQL variables. - - Returns: - data in GraphQL response. - - Raises: - GraphqlError: errors returned in GraphQL response. - """ - variables = variables or {} - response = requests.post( - self._query_url, - json={"id": query_id, "query": query, "variables": variables}, - headers={"Authorization": f"Bearer {self._api_token}"}, - timeout=10, + transport = gql.transport.requests.RequestsHTTPTransport( + url=urllib.parse.urljoin(url, "graphql"), + headers={"Authorization": f"Bearer {api_token}"}, ) - response.raise_for_status() - result = response.json() - if "errors" in result: - raise GraphqlError(result["errors"]) - return result["data"] + self._client = gql.Client( + transport=transport, + schema=(pathlib.Path(__file__).parent / "opencti.graphql").read_text(), + ) + self._dsl_schema = gql.dsl.DSLSchema(self._client.schema) - def list_users(self) -> list[OpenctiUser]: + @functools.lru_cache(maxsize=None) + def list_users(self, name_starts_with: str | None = None) -> list[OpenctiUser]: """List OpenCTI users. + Args: + name_starts_with: list users with name starts with. + Returns: list of OpenctiUser objects. """ - if self._cached_users is not None: - return self._cached_users - query = textwrap.dedent( - """\ - query ListUsers { - users { - edges { - node { - id - name - user_email - account_status - api_token - } - } - } - } - """ + filters = None + if name_starts_with: + filters = { + "mode": "and", + "filters": [ + { + "key": "name", + "values": name_starts_with, + "operator": "starts_with", + "mode": "and", + } + ], + "filterGroups": [], + } + query = gql.dsl.dsl_gql( + gql.dsl.DSLQuery( + self._dsl_schema.Query.users(filters=filters).select( + self._dsl_schema.UserConnection.edges.select( + self._dsl_schema.UserEdge.node.select( + self._dsl_schema.User.id, + self._dsl_schema.User.name, + self._dsl_schema.User.user_email, + self._dsl_schema.User.account_status, + self._dsl_schema.User.api_token, + ), + ), + ) + ) ) - data = self._graphql("ListUsers", query=query) + data = self._client.execute(query) users = [] for user in data["users"]["edges"]: node = user["node"] @@ -130,7 +119,6 @@ def list_users(self) -> list[OpenctiUser]: api_token=node["api_token"], ) ) - self._cached_users = users return users def create_user( @@ -138,89 +126,76 @@ def create_user( name: str, user_email: str | None = None, groups: list[str] | None = None, - ) -> None: + ) -> OpenctiUser: """Create a OpenCTI user. Args: name: User name. user_email: User's email address. groups: User's groups. + + Returns: + new user. """ - self._cached_users = None + self.list_users.cache_clear() if user_email is None: user_email = f"{name}@opencti.local" if groups is None: groups = [] - query = textwrap.dedent( - """\ - mutation UserCreationMutation( - $input: UserAddInput! - ) { - userAdd(input: $input) { - ...UserLine_node - id - } - } - fragment UserLine_node on User { - id - name - user_email - firstname - external - lastname - effective_confidence_level { - max_confidence - } - otp_activated - created_at - } - """ + query = gql.dsl.dsl_gql( + gql.dsl.DSLMutation( + self._dsl_schema.Mutation.userAdd.args( + input=dict( + name=name, + user_email=user_email, + first_name="", + last_name="", + password=secrets.token_urlsafe(32), + account_status="Active", + groups=groups, + ) + ).select( + self._dsl_schema.User.id, + self._dsl_schema.User.name, + self._dsl_schema.User.user_email, + self._dsl_schema.User.account_status, + self._dsl_schema.User.api_token, + ) + ) + ) + result = self._client.execute(query) + user = result["userAdd"] + return OpenctiUser( + id=user["id"], + name=user["name"], + user_email=user["user_email"], + account_status=user["account_status"], + api_token=user["api_token"], ) - variables = { - "input": { - "name": name, - "user_email": user_email, - "firstname": "", - "lastname": "", - "description": "", - "password": secrets.token_urlsafe(32), - "account_status": "Active", - "account_lock_after_date": None, - "objectOrganization": [], - "groups": groups, - "user_confidence_level": None, - } - } - self._graphql("UserCreationMutation", query=query, variables=variables) + @functools.lru_cache(maxsize=None) def list_groups(self) -> list[OpenctiGroup]: """List OpenCTI groups. Returns: list of OpenctiGroup objects. """ - if self._cached_groups is not None: - return self._cached_groups - query = textwrap.dedent( - """\ - query ListGroups { - groups { - edges { - node { - id - name - } - } - } - } - """ + query = gql.dsl.dsl_gql( + gql.dsl.DSLQuery( + self._dsl_schema.Query.groups.select( + self._dsl_schema.GroupConnection.edges.select( + self._dsl_schema.GroupEdge.node.select( + self._dsl_schema.Group.id, self._dsl_schema.Group.name + ) + ) + ) + ) ) - data = self._graphql("ListGroups", query=query) + data = self._client.execute(query) groups = [] for group in data["groups"]["edges"]: group = group["node"] groups.append(OpenctiGroup(id=group["id"], name=group["name"])) - self._cached_groups = groups return groups def set_account_status( @@ -234,234 +209,20 @@ def set_account_status( user_id: Opencti user id. status: Opencti account status. """ - self._cached_users = None - query = textwrap.dedent( - """ - mutation UserEditionOverviewFieldPatchMutation( - $id: ID! - $input: [EditInput]! - ) { - userEdit(id: $id) { - fieldPatch(input: $input) { - ...UserEditionOverview_user - ...UserEdition_user - id - } - } - } - fragment UserEditionGroups_user_2AtC8h on User { - id - objectOrganization(orderBy: name, orderMode: asc) { - edges { - node { - id - name - grantable_groups { - id - name - group_confidence_level { - max_confidence - } - } - } - } - } - roles(orderBy: name, orderMode: asc) { - id - name - } - groups(orderBy: name, orderMode: asc) { - edges { - node { - id - name - } - } - } - effective_confidence_level { - max_confidence - source { - type - object { - __typename - ... on User { - entity_type - id - name - } - ... on Group { - entity_type - id - name - } - } - } - } - } - fragment UserEditionOrganizationsAdmin_user_Z483F on User { - id - user_email - objectOrganization(orderBy: name, orderMode: asc) { - edges { - node { - id - name - description - authorized_authorities - } - } - } - } - fragment UserEditionOverview_user on User { - id - name - description - external - user_email - firstname - lastname - language - theme - api_token - otp_activated - stateless_session - otp_qr - account_status - account_lock_after_date - roles(orderBy: name, orderMode: asc) { - id - name - } - objectOrganization(orderBy: name, orderMode: asc) { - edges { - node { - id - name - } - } - } - groups(orderBy: name, orderMode: asc) { - edges { - node { - id - name - } - } - } - } - fragment UserEditionOverview_user_2AtC8h on User { - id - name - description - external - user_email - firstname - lastname - language - theme - api_token - otp_activated - stateless_session - otp_qr - account_status - account_lock_after_date - roles(orderBy: name, orderMode: asc) { - id - name - } - objectOrganization(orderBy: name, orderMode: asc) { - edges { - node { - id - name - } - } - } - groups(orderBy: name, orderMode: asc) { - edges { - node { - id - name - } - } - } - } - fragment UserEditionPassword_user on User { - id - } - fragment UserEdition_user on User { - id - external - user_confidence_level { - max_confidence - overrides { - max_confidence - entity_type - } - } - effective_confidence_level { - max_confidence - overrides { - max_confidence - entity_type - source { - type - object { - __typename - ... on User { - entity_type - id - name - } - ... on Group { - entity_type - id - name - } - } - } - } - source { - type - object { - __typename - ... on User { - entity_type - id - name - } - ... on Group { - entity_type - id - name - } - } - } - } - groups(orderBy: name, orderMode: asc) { - edges { - node { - id - name - } - } - } - ...UserEditionOverview_user_2AtC8h - ...UserEditionPassword_user - ...UserEditionGroups_user_2AtC8h - ...UserEditionOrganizationsAdmin_user_Z483F - editContext { - name - focusOn - } - } - """ - ) - self._graphql( - query_id="UserEditionOverviewFieldPatchMutation", - query=query, - variables={ - "id": user_id, - "input": {"key": "account_status", "value": status}, - }, + self.list_users.cache_clear() + query = gql.dsl.dsl_gql( + gql.dsl.DSLMutation( + self._dsl_schema.Mutation.userEdit(id=user_id).select( + self._dsl_schema.UserEditMutations.fieldPatch( + input=[ + dict( + key="account_status", + value=status, + operation="replace", + ) + ] + ).select(self._dsl_schema.User.id) + ) + ) ) + self._client.execute(query)