INNER CODE UNIT · Python

add_indicator

montysecurity/C2-Tracker · opencti-connector/src/connector.py:32

def add_indicator(c2, ip):
    print(f"[+] Adding {c2} indicator", ip)
    date_now = str(date.today().strftime("%Y-%m-%dT%H:%M:%SZ"))
    # Create the tag (if not exists)
    label = opencti_api_client.label.create(
        value="c2-tracker",
        color="#ffa500",
    )

    # Get TLP Clear ID
    TLP_WHITE_CTI = opencti_api_client.marking_definition.read(id=TLP_WHITE["id"])
    
    # Create indicator
    indicator = opencti_api_client.indicator.create(
        name=f"{c2} IP - {ip}",
        description=f"This IP is was recently seen hosting {c2}",
        pattern=f"[ipv4-addr:value = '{str(ip)}']",
        pattern_type="stix",

View source record →