text: # coding: utf-8
  
  import json
  
  
  class Incident:
      def __init__(self, opencti):
          self.opencti = opencti
          self.properties = """
              id
              standard_id
              entity_type
              parent_types
              spec_version
              created_at
              updated_at
              createdBy {
                  ... on Identity {
                      id
                      standard_id
                      entity_type
                      parent_types
                      spec_version
                      identity_class
                      name
                      description
                      roles
                      contact_information
                      x_opencti_aliases
                      created
                      modified
                      objectLabel {
                          edges {
                              node {
                                  id
                                  value
                                  color
                              }
                          }
                      }
                  }
                  ... on Organization {
                      x_opencti_organization_type
                      x_opencti_reliability
                  }
                  ... on Individual {
                      x_opencti_firstname
                      x_opencti_lastname
                  }
              }
              objectMarking {
                  edges {
                      node {
                          id
                          standard_id
                          entity_type
                          definition_type
                          definition
                          created
                          modified
                          x_opencti_order
                          x_opencti_color
                      }
                  }
              }
              objectLabel {
                  edges {
                      node {
                          id
                          value
                          color
                      }
                  }
              }
              externalReferences {
                  edges {
                      node {
                          id
                          standard_id
                          entity_type
                          source_name
                          description
                          url
                          hash
                          external_id
                          created
                          modified
                          importFiles {
                              edges {
                                  node {
                                      id
                                      name
                                      size
                                      metaData {
                                          mimetype
                                          version
                                      }
                                  }
                              }
                          }
                      }
                  }
              }
              revoked
              confidence
              created
              modified
              name
              description
              aliases
              first_seen
              last_seen
              objective
              importFiles {
                  edges {
                      node {
                          id
                          name
                          size
                          metaData {
                              mimetype
                              version
                          }
                      }
                  }
              }
          """
  
      """
          List Incident objects
  
          :param filters: the filters to apply
          :param search: the search keyword
          :param first: return the first n rows from the after ID (or the beginning if not set)
          :param after: ID of the first row for pagination
          :return List of Incident objects
      """
  
      def list(self, **kwargs):
          filters = kwargs.get("filters", None)
          search = kwargs.get("search", None)
          first = kwargs.get("first", 500)
          after = kwargs.get("after", None)
          order_by = kwargs.get("orderBy", None)
          order_mode = kwargs.get("orderMode", None)
          custom_attributes = kwargs.get("customAttributes", None)
          get_all = kwargs.get("getAll", False)
          with_pagination = kwargs.get("withPagination", False)
          if get_all:
              first = 500
  
          self.opencti.log(
              "info", "Listing Incidents with filters " + json.dumps(filters) + "."
          )
          query = (
              """
              query Incidents($filters: [IncidentsFiltering], $search: String, $first: Int, $after: ID, $orderBy: IncidentsOrdering, $orderMode: OrderingMode) {
                  incidents(filters: $filters, search: $search, first: $first, after: $after, orderBy: $orderBy, orderMode: $orderMode) {
                      edges {
                          node {
                              """
              + (custom_attributes if custom_attributes is not None else self.properties)
              + """
                          }
                      }
                      pageInfo {
                          startCursor
                          endCursor
                          hasNextPage
                          hasPreviousPage
                          globalCount
                      }
                  }
              }
          """
          )
          result = self.opencti.query(
              query,
              {
                  "filters": filters,
                  "search": search,
                  "first": first,
                  "after": after,
                  "orderBy": order_by,
                  "orderMode": order_mode,
              },
          )
          return self.opencti.process_multiple(
              result["data"]["incidents"], with_pagination
          )
  
      """
          Read a Incident object
  
          :param id: the id of the Incident
          :param filters: the filters to apply if no id provided
          :return Incident object
      """
  
      def read(self, **kwargs):
          id = kwargs.get("id", None)
          filters = kwargs.get("filters", None)
          custom_attributes = kwargs.get("customAttributes", None)
          if id is not None:
              self.opencti.log("info", "Reading Incident {" + id + "}.")
              query = (
                  """
                  query Incident($id: String!) {
                      incident(id: $id) {
                          """
                  + (
                      custom_attributes
                      if custom_attributes is not None
                      else self.properties
                  )
                  + """
                      }
                  }
               """
              )
              result = self.opencti.query(query, {"id": id})
              return self.opencti.process_multiple_fields(result["data"]["incident"])
          elif filters is not None:
              result = self.list(filters=filters)
              if len(result) > 0:
                  return result[0]
              else:
                  return None
          else:
              self.opencti.log(
                  "error", "[opencti_incident] Missing parameters: id or filters"
              )
              return None
  
      """
          Create a Incident object
  
          :param name: the name of the Incident
          :return Incident object
      """
  
      def create(self, **kwargs):
          stix_id = kwargs.get("stix_id", None)
          created_by = kwargs.get("createdBy", None)
          object_marking = kwargs.get("objectMarking", None)
          object_label = kwargs.get("objectLabel", None)
          external_references = kwargs.get("externalReferences", None)
          revoked = kwargs.get("revoked", None)
          confidence = kwargs.get("confidence", None)
          lang = kwargs.get("lang", None)
          created = kwargs.get("created", None)
          modified = kwargs.get("modified", None)
          name = kwargs.get("name", None)
          description = kwargs.get("description", "")
          aliases = kwargs.get("aliases", None)
          first_seen = kwargs.get("first_seen", None)
          last_seen = kwargs.get("last_seen", None)
          objective = kwargs.get("objective", None)
          x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None)
          update = kwargs.get("update", False)
  
          if name is not None and description is not None:
              self.opencti.log("info", "Creating Incident {" + name + "}.")
              query = """
                  mutation IncidentAdd($input: IncidentAddInput) {
                      incidentAdd(input: $input) {
                          id
                          standard_id
                          entity_type
                          parent_types
                      }
                 }
              """
              result = self.opencti.query(
                  query,
                  {
                      "input": {
                          "stix_id": stix_id,
                          "createdBy": created_by,
                          "objectMarking": object_marking,
                          "objectLabel": object_label,
                          "externalReferences": external_references,
                          "revoked": revoked,
                          "confidence": confidence,
                          "lang": lang,
                          "created": created,
                          "modified": modified,
                          "name": name,
                          "description": description,
                          "aliases": aliases,
                          "first_seen": first_seen,
                          "last_seen": last_seen,
                          "objective": objective,
                          "x_opencti_stix_ids": x_opencti_stix_ids,
                          "update": update,
                      }
                  },
              )
              return self.opencti.process_multiple_fields(result["data"]["incidentAdd"])
          else:
              self.opencti.log("error", "Missing parameters: name and description")
  
      """
          Import a Incident object from a STIX2 object
  
          :param stixObject: the Stix-Object Incident
          :return Incident object
      """
  
      def import_from_stix2(self, **kwargs):
          stix_object = kwargs.get("stixObject", None)
          extras = kwargs.get("extras", {})
          update = kwargs.get("update", False)
          if stix_object is not None:
              return self.create(
                  stix_id=stix_object["id"],
                  createdBy=extras["created_by_id"]
                  if "created_by_id" in extras
                  else None,
                  objectMarking=extras["object_marking_ids"]
                  if "object_marking_ids" in extras
                  else None,
                  objectLabel=extras["object_label_ids"]
                  if "object_label_ids" in extras
                  else [],
                  externalReferences=extras["external_references_ids"]
                  if "external_references_ids" in extras
                  else [],
                  revoked=stix_object["revoked"] if "revoked" in stix_object else None,
                  confidence=stix_object["confidence"]
                  if "confidence" in stix_object
                  else None,
                  lang=stix_object["lang"] if "lang" in stix_object else None,
                  created=stix_object["created"] if "created" in stix_object else None,
                  modified=stix_object["modified"] if "modified" in stix_object else None,
                  name=stix_object["name"],
                  description=self.opencti.stix2.convert_markdown(
                      stix_object["description"]
                  )
                  if "description" in stix_object
                  else "",
                  aliases=self.opencti.stix2.pick_aliases(stix_object),
                  objective=stix_object["objective"]
                  if "objective" in stix_object
                  else None,
                  first_seen=stix_object["first_seen"]
                  if "first_seen" in stix_object
                  else None,
                  last_seen=stix_object["last_seen"]
                  if "last_seen" in stix_object
                  else None,
                  x_opencti_stix_ids=stix_object["x_opencti_stix_ids"]
                  if "x_opencti_stix_ids" in stix_object
                  else None,
                  update=update,
              )
          else:
              self.opencti.log(
                  "error", "[opencti_incident] Missing parameters: stixObject"
              )
  