yeti-platform / pyeti Goto Github PK

Can anyone share a working example of yeti api that pulls data from Yeti.

I don't know what arguments to be where can i find them in my local hosted yeti.

Sharing Screenshots would be more helpful.

result = self.api.observable_add(value=obs_value)

This would just return None and there is no way I can catch the exception Couldn't guess observable type as it's just logged.

I am trying to add more functionality to the YetiApi class.
When I tried the get entity it worked, but for adding a entity it gives error

ERROR:root:An error occurred (500):

Any pointers towards this would be welcome, There was no documentation of json values of entity object so I did a get entity and used similar json object in entity_add

Following are my functions added to api.py

    def entity_details(self, id):
        """Get details on an entity.
        Args:
            id: A string representing the entity's ObjectID

        Returns:
            JSON representation of the requested entity
        """
        return self._make_get("entity/{}".format(id))

    def entity_add(self, name,etype,description,aliases=[], tags=[],context={},source="API"):
        """Add an entity to the dataset

        Args:
            name: the name of entity
            etype: type of entity ('Actor','TTP' etc)
            description: description of Entity
            tags: An array of strings representing tags
            context: A dictionary object with context information
            source: A string representing the source of the data. Defaults to
                   "API".

        Returns:
            JSON representation of the created observable.
        """
        json = {
            'description':description,
            'tags':tags,
            'aliases':aliases,
            'type':etype,
            'name':name,
            'context':context,
            'source':source
        }

        return self._make_post('entity/', json=json)

Can you attach a license to this repo please? Thanks!

This lib is simple and the migration shouldn't be too difficult.

I have tried to add entity using both pyet and curl -POST but neither of them worked. I am able to get_entity but if I add the function entity_add with the required parameters ( name, description & tags) - it doesnt work. Moreover, As one of your suggestions in one of the issues - that, this will add an entity but to add sub-object ( malware, threat actor etc) _cls needs to be set manually. Can you please explain this in bit detail?

The function that I added

def entity_add(self,name,description,tags=None, source="API"):

    if tags is None:
        tages = []
    json = {

        "name": name,
                    "description": description,
        "tags": tags,
        "source": source
    }
    return self._make_post('entity/', json=json)

When I call this function - I get followin error

results = api.entity_add("malware","malwaredescription",['tags1'])
ERROR:root:An error occurred (500): http://localhost:5000/api/entity/

Same way, when I tried to add with curl

$$$curl -d '{"value":"malware","tags":['a','b']}' -H "Content-type: application/json" -X POST http://localhost:5000/api/entity/

The browser (or proxy) sent a request that this server could not understand.

$$$curl -d '{"value":"malware"}' -H "Content-type: application/json" -X POST http://localhost:5000/api/entity/

The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.

Another Try using Curl

entity.json
{
"value":"malwre"
"tags":['a','b']
}

$$$$curl -d "@entity.json" -H "Content-type: application/json" -X POST http://localhost:5000/api/entity/

The browser (or proxy) sent a request that this server could not understand.

Can you please help ?