[client] Add new SCO - SSH-key (#10905)

Co-authored-by: ValentinBouzinFiligran

Author: CelineSebe

examples/create_observable_sshkey.py

@@ -0,0 +1,17 @@
+# coding: utf-8
+import os
+
+from pycti import OpenCTIApiClient
+
+# Variables
+api_url = os.getenv("OPENCTI_API_URL", "http://opencti:4000")
+api_token = os.getenv("OPENCTI_API_TOKEN", "bfa014e0-e02e-4aa6-a42b-603b19dcf159")
+
+# OpenCTI initialization
+opencti_api_client = OpenCTIApiClient(api_url, api_token)
+
+observable_sshkey = opencti_api_client.stix_cyber_observable.create(
+    observableData={"type": "SSH-Key", "fingerprint_sha256": "sha256_test"}
+)
+
+print(observable_sshkey)

examples/delete_observable_sshkey.py

@@ -0,0 +1,25 @@
+# coding: utf-8
+import os
+
+from pycti import OpenCTIApiClient
+
+# Variables
+api_url = os.getenv("OPENCTI_API_URL", "http://opencti:4000")
+api_token = os.getenv("OPENCTI_API_TOKEN", "bfa014e0-e02e-4aa6-a42b-603b19dcf159")
+
+# OpenCTI initialization
+opencti_api_client = OpenCTIApiClient(api_url, api_token)
+
+opencti_api_client.stix_cyber_observable.create(
+    observableData={"type": "SSH-Key", "fingerprint_sha256": "sha256_test"}
+)
+
+observable_sshkey = opencti_api_client.stix_cyber_observable.read(
+    filters={
+        "mode": "and",
+        "filters": [{"key": "fingerprint_sha256", "values": ["sha256_test"]}],
+        "filterGroups": [],
+    }
+)
+
+opencti_api_client.stix_cyber_observable.delete(id=observable_sshkey.get("id"))

examples/update_observable_attributes.py

@@ -52,3 +52,12 @@
 opencti_api_client.stix_cyber_observable.update_created_by(
     id=observable["id"], identity_id=author["id"]
 )
+
+observable_sshkey = opencti_api_client.stix_cyber_observable.create(
+    observableData={"type": "SSH-Key", "fingerprint_sha256": "sha256_test"}
+)
+
+opencti_api_client.stix_cyber_observable.update_field(
+    id=observable_sshkey.get("id"),
+    input={"key": "fingerprint_sha256", "value": "sha256_test_edit_name"},
+)

pycti/entities/opencti_stix_cyber_observable.py

@@ -287,6 +287,8 @@ def create(self, **kwargs):
             type = "IPv6-Addr"
         elif type.lower() == "persona":
             type = "Persona"
+        elif type.lower() == "ssh-key":
+            type = "SSH-Key"
         elif type.lower() == "hostname" or type.lower() == "x-opencti-hostname":
             type = "Hostname"
         elif type.lower() == "payment-card" or type.lower() == "x-opencti-payment-card":
@@ -420,6 +422,7 @@ def create(self, **kwargs):
                     $PaymentCard: PaymentCardAddInput
                     $Persona: PersonaAddInput
                     $MediaContent: MediaContentAddInput
+                    $SSHKey: SSHKeyAddInput
                 ) {
                     stixCyberObservableAdd(
                         type: $type,
@@ -465,6 +468,7 @@ def create(self, **kwargs):
                         PaymentCard: $PaymentCard
                         Persona: $Persona
                         MediaContent: $MediaContent
+                        SSHKey: $SSHKey
                     ) {
                         id
                         standard_id
@@ -713,6 +717,49 @@ def create(self, **kwargs):
                         else None
                     ),
                 }
+            elif type == "SSH-Key" or type.lower() == "ssh-key":
+                input_variables["SSHKey"] = {
+                    "key_type": (
+                        observable_data["key_type"]
+                        if "key_type" in observable_data
+                        else None
+                    ),
+                    "public_key": (
+                        observable_data["public_key"]
+                        if "public_key" in observable_data
+                        else None
+                    ),
+                    "fingerprint_sha256": (
+                        observable_data["fingerprint_sha256"]
+                        if "fingerprint_sha256" in observable_data
+                        else False
+                    ),
+                    "fingerprint_md5": (
+                        observable_data["fingerprint_md5"]
+                        if "fingerprint_md5" in observable_data
+                        else None
+                    ),
+                    "key_length": (
+                        observable_data["key_length"]
+                        if "key_length" in observable_data
+                        else None
+                    ),
+                    "comment": (
+                        observable_data["comment"]
+                        if "comment" in observable_data
+                        else None
+                    ),
+                    "created": (
+                        observable_data["created"]
+                        if "created" in observable_data
+                        else None
+                    ),
+                    "expiration_date": (
+                        observable_data["expiration_date"]
+                        if "expiration_date" in observable_data
+                        else None
+                    ),
+                }
             elif type == "IPv4-Addr":
                 input_variables["IPv4Addr"] = {
                     "value": (

pycti/entities/stix_cyber_observable/opencti_stix_cyber_observable_properties.py

@@ -173,6 +173,16 @@
           algorithm
           hash
         }
+    }
+     ... on SSHKey {
+        key_type
+        public_key
+        fingerprint_sha256
+        fingerprint_md5
+        key_length
+        expiration_date
+        comment
+        created
     }
     ... on IPv4Addr {
         value
@@ -479,6 +489,16 @@
           hash
         }
     }
+    ... on SSHKey {
+        key_type
+        public_key
+        fingerprint_sha256
+        fingerprint_md5
+        key_length
+        expiration_date
+        comment
+        created
+    }
     ... on IPv4Addr {
         value
     }

pycti/utils/constants.py

@@ -46,6 +46,7 @@ class StixCyberObservableTypes(Enum):
     MEDIA_CONTENT = "Media-Content"
     SIMPLE_OBSERVABLE = "Simple-Observable"
     PERSONA = "Persona"
+    SSH_KEY = "SSH-Key"
 
     @classmethod
     def has_value(cls, value: str) -> bool:

pycti/utils/opencti_stix2_utils.py

@@ -103,6 +103,7 @@
     "media-content": "Media-Content",
     "simple-observable": "Simple-Observable",
     "persona": "Persona",
+    "ssh-key": "SSH-Key",
 }
 
 STIX_OBJECTS = (