From ba1cfe3c9ee8af52f947dd4b2bac26ba37e49c0b Mon Sep 17 00:00:00 2001
From: Konstantin <konstantin.kraynov@yandex.ru>
Date: Wed, 12 Jun 2024 06:01:27 +0300
Subject: [PATCH] Filters format migration for OpenCTI 5.12 (#1245)

https://docs.opencti.io/latest/reference/filters-migration/
---
 analyzers/OpenCTI/opencti.py | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/analyzers/OpenCTI/opencti.py b/analyzers/OpenCTI/opencti.py
index a9341749c..08a25bf82 100755
--- a/analyzers/OpenCTI/opencti.py
+++ b/analyzers/OpenCTI/opencti.py
@@ -78,12 +78,16 @@ def run(self):
 
                 # Get a list of reports containing this observable
                 reports = opencti["api_client"].report.list(
-                    filters=[
-                        {
-                            "key": "objectContains",
+                    filters={
+                        "mode": "and",
+                        "filters": [{
+                            "key": "objects",
                             "values": [observable["id"]],
-                        }
-                    ]
+                            "operator": "eq",
+                            "mode": "or",
+                        },],
+                        "filterGroups": [],
+                    }
                 )
 
                 # Strip reports data for lighter output.