MISP
/
MISP
mirror of https://github.com/MISP/MISP
2
2
Fork 0
Code Issues Releases Wiki Activity

fix: [stix import] Importing uuids for objects from external sources

pull/3808/head
chrisr3d 2018-10-24 11:07:46 +02:00
parent c3a7fd27ff
commit 238cc35b33
No known key found for this signature in database
GPG Key ID: 6BBED1B63A6D639F
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
app/files/scripts/stix2misp.py
View File

@ -871,19 +871,20 @@ class StixParser():
if hasattr(indicator, 'observable') and indicator.observable:
observable = indicator.observable
if hasattr(observable, 'object_') and observable.object_:
uuid = self.fetch_uuid(observable.object_.id_)
try:
properties = observable.object_.properties
if properties:
attribute_type, attribute_value, compl_data = self.handle_attribute_type(properties)
if isinstance(attribute_value, (str, int)):
# if the returned value is a simple value, we build an attribute
attribute = {'to_ids': True}
attribute = {'to_ids': True, 'uuid': uuid}
if indicator.timestamp:
attribute['timestamp'] = self.getTimestampfromDate(indicator.timestamp)
self.handle_attribute_case(attribute_type, attribute_value, compl_data, attribute)
else:
# otherwise, it is a dictionary of attributes, so we build an object
self.handle_object_case(attribute_type, attribute_value, compl_data, to_ids=True)
self.handle_object_case(attribute_type, attribute_value, compl_data, to_ids=True, object_uuid=uuid)
except AttributeError:
self.parse_description(indicator)
if hasattr(indicator, 'related_indicators') and indicator.related_indicators: