MISP
/
MISP
mirror of https://github.com/MISP/MISP
2
2
Fork 0
Code Issues Releases Wiki Activity

new: [stix import] Parsing observable compositions from external STIX files

pull/4769/head
chrisr3d 2019-06-17 09:15:59 +02:00
parent 57766f03e1
commit 62a1bd8aa3
No known key found for this signature in database
GPG Key ID: 6BBED1B63A6D639F
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
app/files/scripts/stix2misp.py
View File

@ -1103,12 +1103,14 @@ class ExternalStixParser(StixParser):
self.handle_object_case(attribute_type, attribute_value, compl_data, to_ids=True, object_uuid=uuid)
except AttributeError:
self.parse_description(indicator)
elif hasattr(observable, 'observable_composition') and observable.observable_composition:
self.parse_external_observable(observable.observable_composition.observables, to_ids=True)
if hasattr(indicator, 'related_indicators') and indicator.related_indicators:
for related_indicator in indicator.related_indicators:
self.parse_external_single_indicator(related_indicator.item)
# Parse observables of an external STIX document
def parse_external_observable(self, observables):
def parse_external_observable(self, observables, to_ids=False):
for observable in observables:
title = observable.title
observable_object = observable.object_
@ -1126,7 +1128,7 @@ class ExternalStixParser(StixParser):
object_uuid = self.fetch_uuid(observable_object.id_)
if isinstance(attribute_value, (str, int)):
# if the returned value is a simple value, we build an attribute
attribute = {'to_ids': False, 'uuid': object_uuid}
attribute = {'to_ids': to_ids, 'uuid': object_uuid}
if hasattr(observable, 'handling') and observable.handling:
attribute['Tag'] = []
for handling in observable.handling: