diff --git a/misp_modules/modules/expansion/stiximport.py b/misp_modules/modules/expansion/stiximport.py index ce4ff8f..09be362 100755 --- a/misp_modules/modules/expansion/stiximport.py +++ b/misp_modules/modules/expansion/stiximport.py @@ -41,12 +41,26 @@ def handler(q=False): if package.observables: for obs in package.observables: r["results"].append(buildObservable(obs)) - + + if package.threat_actors: + for ta in package.threat_actors: + r["results"].append(buildActor(ta)) return r #Quick and dirty regex for IP addresses ipre = re.compile("([0-9]{1,3}.){3}[0-9]{1,3}") +def buildActor(ta): + """ + Extract the name + and comment of a + threat actor + """ + + r = {"values":[ta.title], "types":["threat-actor"]} + + return r + def buildObservable(o): """ Take a STIX observable