Important

The resource module is deprecated. The framework now has a new TI (Threat Intel) module that provides the same functionality.

Module: Resources

The ThreatConnect TcEx Framework provides access to the ThreatConnect API using the tcex_resources module. The Resource Classes can be accessed directly via the tcex.resources property of the TcEx Framework or indirectly via the tcex.resource() method.

Direct Access

Important

The Direct Access method is not supported on Custom Indicator Types.

1
2
3
4
5
6
7
8
9
tcex = TcEx()

resource = tcex.resources.Adversary(tcex)
# paginate over results
for result in resource:
    print(result['status'])
    print(result['data'])

tcex.exit()

Dynamic Access

1
2
3
4
5
6
7
8
9
tcex = TcEx()

resource = tcex.resource('User Agent')
# paginate over results
for result in resource:
    print(result['status'])
    print(result['data'])

tcex.exit()

Note

For result sets that do not support pagination, the resource.request() method can be called directly.

Custom Metric Resources

The TcEx Resource Module provides Access to the customMetric API endpoint to create configurations and add data.

Important

Custom Metrics are available in 5.4+ versions of the ThreatConnect API.

Resource Type Class
Custom Metric CustomMetric

Data Store Resources

The TcEx Module provide CRUD (Create, Read, Update, and Delete) operations to the ThreatConnect DataStore. The DataStore provides access to three domains: Local, Organization, and System.

Db Method Method
Create create()
Read read()
Update update()
Delete delete()

Group Resources

Resource Type Class
Group (Base) Group
Adversary Adversary
Campaign Campaign
Document Document
Email Email
Incident Incident
Signature Signature
Threat Threat

Indicator Resources

Resource Type Class
Indicator (Base) Indicator
Address Address
EmailAddress EmailAddress
File File
Host Host
URL URL

Examples

Indicator Resource Examples

Note

Custom Indicators can be accessed by type. The ThreatConnect platform supports Custom Indicator types with a space in the name. To prevent issues with the space all Custom Resource (Indicator) types should be made safe by using the safe_rt() method.

Owner Resources

Resource Type Class
Owner Owner

Security Label Resources

Resource Type Class
SecurityLabel SecurityLabel

Tag Resources

Resource Type Class
Tag Tag

Task Resources

Resource Type Class
Task Task

Victim Resources

Resource Type Class
Victim Victim