From 3f7cdad0c31067988acfd5f3b875a92166735246 Mon Sep 17 00:00:00 2001 From: Hannah Ward Date: Fri, 12 Aug 2016 10:06:53 +0100 Subject: [PATCH] Threat actors now get imported by stix --- misp_modules/modules/expansion/stiximport.py | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/misp_modules/modules/expansion/stiximport.py b/misp_modules/modules/expansion/stiximport.py index ce4ff8f..09be362 100755 --- a/misp_modules/modules/expansion/stiximport.py +++ b/misp_modules/modules/expansion/stiximport.py @@ -41,12 +41,26 @@ def handler(q=False): if package.observables: for obs in package.observables: r["results"].append(buildObservable(obs)) - + + if package.threat_actors: + for ta in package.threat_actors: + r["results"].append(buildActor(ta)) return r #Quick and dirty regex for IP addresses ipre = re.compile("([0-9]{1,3}.){3}[0-9]{1,3}") +def buildActor(ta): + """ + Extract the name + and comment of a + threat actor + """ + + r = {"values":[ta.title], "types":["threat-actor"]} + + return r + def buildObservable(o): """ Take a STIX observable