feat: a SecurityCoverage can have multiple associated results (#14716)

client-python/examples/create_security_coverage_result.py

@@ -0,0 +1,45 @@
+# coding: utf-8
+import os
+from datetime import datetime, timedelta, timezone
+from pprint import pprint
+
+from pycti import OpenCTIApiClient
+
+# Variables
+api_url = os.getenv("OPENCTI_API_URL", "http://opencti:4000")
+api_token = os.getenv("OPENCTI_API_TOKEN", "bfa014e0-e02e-4aa6-a42b-603b19dcf159")
+
+# OpenCTI initialization
+opencti_api_client = OpenCTIApiClient(api_url, api_token)
+now = datetime.now(timezone.utc)
+in_4_weeks = now + timedelta(weeks=4)
+
+# Setup, create a security coverage to link to the result
+report = opencti_api_client.report.create(
+    name="Report for SCR",
+    published=now.isoformat(),
+)
+if not report or "id" not in report:
+    raise RuntimeError("Failed to create report")
+securityCoverage = opencti_api_client.security_coverage.create(
+    name="SC for SCR",
+    description="Super Security Coverage",
+    objectCovered=report["id"],
+    auto_enrichment_disable=False,
+)
+if not securityCoverage or "id" not in report:
+    raise RuntimeError("Failed to create security coverage")
+
+# Create a security coverage result
+scr = opencti_api_client.security_coverage_result.create(
+    resultOf=securityCoverage["id"],
+    external_uri="my-oaev-instance-1",
+    coverage_last_result=now.isoformat(),
+    coverage_valid_from=now.isoformat(),
+    coverage_valid_to=in_4_weeks.isoformat(),
+    coverage_information=[
+        {"coverage_name": "Prevention", "coverage_score": 45},
+        {"coverage_name": "Detection", "coverage_score": 90},
+    ],
+)
+pprint(scr)

client-python/examples/get_security_coverage_result.py

@@ -0,0 +1,23 @@
+# coding: utf-8
+import os
+from pprint import pprint
+
+from pycti import OpenCTIApiClient
+
+# Variables
+api_url = os.getenv("OPENCTI_API_URL", "http://opencti:4000")
+api_token = os.getenv("OPENCTI_API_TOKEN", "bfa014e0-e02e-4aa6-a42b-603b19dcf159")
+
+# OpenCTI initialization
+opencti_api_client = OpenCTIApiClient(api_url, api_token)
+
+# Search
+all_results = opencti_api_client.security_coverage_result.list(getAll=True)
+print(f"Found {len(all_results)} Security Coverage Results")
+pprint(all_results)
+
+# Get by ID
+scr = opencti_api_client.security_coverage_result.read(
+    id="security-coverage-result--7e7aed66-151d-52c4-956c-ee68322dda69"
+)
+pprint(scr)

client-python/pycti/__init__.py

@@ -44,6 +44,7 @@
 from .entities.opencti_report import Report
 from .entities.opencti_role import Role
 from .entities.opencti_security_coverage import SecurityCoverage
+from .entities.opencti_security_coverage_result import SecurityCoverageResult
 from .entities.opencti_settings import Settings
 from .entities.opencti_stix import Stix
 from .entities.opencti_stix_core_object import StixCoreObject
@@ -148,6 +149,7 @@
     "Opinion",
     "Report",
     "SecurityCoverage",
+    "SecurityCoverageResult",
     "Stix",
     "StixCoreObject",
     "StixCoreRelationship",

client-python/pycti/api/opencti_api_client.py

@@ -60,6 +60,7 @@
 from pycti.entities.opencti_report import Report
 from pycti.entities.opencti_role import Role
 from pycti.entities.opencti_security_coverage import SecurityCoverage
+from pycti.entities.opencti_security_coverage_result import SecurityCoverageResult
 from pycti.entities.opencti_settings import Settings
 from pycti.entities.opencti_stix import Stix
 from pycti.entities.opencti_stix_core_object import StixCoreObject
@@ -317,6 +318,7 @@ def __init__(
         self.language = Language(self)
         self.vulnerability = Vulnerability(self)
         self.security_coverage = SecurityCoverage(self)
+        self.security_coverage_result = SecurityCoverageResult(self)
         self.attack_pattern = AttackPattern(self)
         self.course_of_action = CourseOfAction(self)
         self.data_component = DataComponent(self)

client-python/pycti/entities/opencti_security_coverage.py

@@ -450,3 +450,24 @@ def import_from_stix2(self, **kwargs):
                 "[opencti_security_coverage] Missing parameters: stixObject"
             )
             return None
+
+    def delete(self, **kwargs):
+        """Delete a Security-Coverage object.
+
+        :param id: the Security-Coverage id
+        :type id: str
+        """
+        id = kwargs.get("id", None)
+        if id is not None:
+            self.opencti.app_logger.info("Deleting security_coverage", {"id": id})
+            query = """
+                mutation SecurityCoverageDelete($id: ID!) {
+                    securityCoverageDelete(id: $id)
+                }
+            """
+            self.opencti.query(query, {"id": id})
+        else:
+            self.opencti.app_logger.error(
+                "[opencti_security_coverage] Missing parameters: id"
+            )
+            return None