fix: [stix1 import] Fixed galaxy tag_names fetching from TTP names

- Using the techniques identifier to look for tag
  names when the name does not match any known
  galaxy name
- Prevents the galaxy names to be skipped when
  the provided TTP name is given with the
  identifier and the technique name in an inverted
  order (`Spearphishing Attachment - T1566.001` VS
  `T1566.001 - Spearphishing Attachment`)
pull/8367/head
chrisr3d 2022-04-25 11:57:44 +02:00
parent a5aa18567b
commit 15ce69dcc9
No known key found for this signature in database
GPG Key ID: 6BBED1B63A6D639F
1 changed files with 9 additions and 4 deletions

View File

@ -745,10 +745,15 @@ class StixParser():
for course_of_action in courses_of_action:
self.parse_galaxy(course_of_action, 'title', 'mitre-course-of-action')
def _resolve_galaxy(self, name, default_value):
if name in self.synonyms_to_tag_names:
return self.synonyms_to_tag_names[name]
return [f'misp-galaxy:{default_value}="{name}"']
def _resolve_galaxy(self, galaxy_name, default_value):
if galaxy_name in self.synonyms_to_tag_names:
return self.synonyms_to_tag_names[galaxy_name]
for identifier in galaxy_name.split(' - '):
if identifier[0].isalpha() and any(character.isdecimal() for character in identifier[1:]):
for name, tag_names in self.synonyms_to_tag_names.items():
if identifier in name:
return tag_names
return [f'misp-galaxy:{default_value}="{galaxy_name}"']
################################################################################
## UTILITY FUNCTIONS USED BY PARSING FUNCTION ABOVE ##