diff --git a/analyzers/OpenCTI/opencti.py b/analyzers/OpenCTI/opencti.py index a9341749c..08a25bf82 100755 --- a/analyzers/OpenCTI/opencti.py +++ b/analyzers/OpenCTI/opencti.py @@ -78,12 +78,16 @@ def run(self): # Get a list of reports containing this observable reports = opencti["api_client"].report.list( - filters=[ - { - "key": "objectContains", + filters={ + "mode": "and", + "filters": [{ + "key": "objects", "values": [observable["id"]], - } - ] + "operator": "eq", + "mode": "or", + },], + "filterGroups": [], + } ) # Strip reports data for lighter output.