Snippet: Group Delete

Delete Group by ID

This snippet will delete a group in ThreatConnect with the provided id.

group = self.tcex.api.tc.v3.group(id=group_id)
group.delete()

Delete Group by name

This snippet will delete a group in ThreatConnect with the provided name and in the provided owner. Using TqlOperator requires an additional import of from tcex.api.tc.v3.tql.tql_operator import TqlOperator.

groups = self.tcex.api.tc.v3.groups()
groups.filter.summary(TqlOperator.EQ, group_name)
groups.filter.owner_name(TqlOperator.EQ, owner_name)

# WARNING:
#     group names are NOT guaranteed to be unique, this could delete multiple groups
for group in groups:
    group.delete()

Delete Group by TQL

This snippet will delete one or more group in ThreatConnect with the provided TQL.

groups = self.tcex.api.tc.v3.groups()
groups.filter.tql.raw_tql = raw_tql  # e.g., f'summary EQ "{group_name}"'

# WARNING:
#     this will delete all groups returned by the TQL
for group in groups:
    group.delete()

Delete Group by XID

This snippet will delete a group in ThreatConnect with the provided xid.

group = self.tcex.api.tc.v3.group(xid=group_xid)
# Owner is a optional parameter to specify the owner of the group to delete.
group.delete(params={'owner': owner_name})