From e2a0f27d75476453c85306f78f9b9109b2e42996 Mon Sep 17 00:00:00 2001 From: chrisr3d Date: Wed, 24 Jul 2019 14:58:45 +0200 Subject: [PATCH] fix: Fixed direction of the relationship between files, PEs and their sections - The file object includes a PE, and the PE includes sections, not the other way round --- misp_modules/lib/joe_parser.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/misp_modules/lib/joe_parser.py b/misp_modules/lib/joe_parser.py index 83eca3b..182398f 100644 --- a/misp_modules/lib/joe_parser.py +++ b/misp_modules/lib/joe_parser.py @@ -236,7 +236,7 @@ class JoeParser(): def parse_pe(self, fileinfo, file_object): peinfo = fileinfo['pe'] pe_object = MISPObject('pe') - file_object.add_reference(pe_object.uuid, 'included-in') + file_object.add_reference(pe_object.uuid, 'includes') self.misp_event.add_object(**file_object) for field, mapping in pe_object_fields.items(): attribute_type, object_relation = mapping @@ -267,7 +267,7 @@ class JoeParser(): for section in peinfo['sections']['section']: section_object = self.parse_pe_section(section) self.references[pe_object.uuid].append(dict(referenced_uuid=section_object.uuid, - relationship_type='included-in')) + relationship_type='includes')) self.misp_event.add_object(**section_object) def parse_pe_section(self, section):