Snippet: Batch Create

Batch Create Group

This snippet will create a group in ThreatConnect using the batch API feature.

batch = self.tcex.api.tc.v2.batch(owner=owner_name, action='Create')
ti = batch.adversary(name=group_name)

# add associations
ti.association(group_xid=group_xid)

# attr_type = 'Description'
# attr_value = 'An example description attribute.'
# displayed = True (only valid for description and source attribute types)
ti.attribute(attr_type=attr_type, attr_value=attr_value, displayed=displayed)

# add security labels
ti.security_label(name=security_label_name)  # e.g., "TLP:WHITE"

# add tags
ti.tag(tag_name)  # e.g., "Cyber Espionage"

# OPTIONAL
# when processing large feeds it's a good idea to save the ti
# object to disk so that the app doesn't use excessive memory.
batch.save(ti)

# submit the batch job
batch_status = batch.submit_all()

# log batch errors
for ti in batch_status:
    # batch errors should be treated as warnings
    for warning in ti.get('errors') or []:
        self.tcex.log.warning(warning)

Batch Create Indicator

This snippet will create an indicator in ThreatConnect using the batch API feature.

batch = self.tcex.api.tc.v2.batch(owner=owner_name, action='Create')
ti = batch.file(md5=md5, rating=rating, confidence=confidence)

# add associations
ti.association(group_xid=group_xid)

# attr_type = 'Description'
# attr_value = 'An example description attribute.'
# displayed = True (only valid for description and source attribute types)
ti.attribute(attr_type=attr_type, attr_value=attr_value, displayed=displayed)

# add security labels
ti.security_label(name=security_label_name)  # e.g., "TLP:WHITE"

# add tags
ti.tag(tag_name)  # e.g., "Cyber Espionage"

# OPTIONAL
# when processing large feeds it's a good idea to save the ti
# object to disk so that the app doesn't use excessive memory.
batch.save(ti)

# submit the batch job
batch_status = batch.submit_all()

# log batch errors
for ti in batch_status:
    # batch errors should be treated as warnings
    for warning in ti.get('errors') or []:
        self.tcex.log.warning(warning)