Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug: Conversion to STIX2 does not take into account to_ids flag set in objects when creating indicators #48

Open
1 task done
cudeso opened this issue Jul 19, 2023 · 3 comments
Assignees
Labels
bug Something isn't working

Comments

@cudeso
Copy link

cudeso commented Jul 19, 2023

MISP-STIX usage

Integration for Sentinel

Expected behavior

Only have those attributes of an object that have the to_ids flag set to true included in the pattern of the STIX indicator.

Actual behavior

All attributes of an object are included in the conversion, regardless of to_ids flag.

Steps to reproduce

Example with the file object.

If the attribute "filename" is added to the object, but with the to_ids flag set to False then it is still included in the STIX indicator pattern.

Version

2.4.172

Python version

3.8

Relevant log output

No response

Extra attachments

No response

Code of Conduct

  • I agree to follow this project's Code of Conduct
@cudeso cudeso added the bug Something isn't working label Jul 19, 2023
@chrisr3d
Copy link
Member

That is something we've been discussing for a long time with @iglocska
The idea would be:

  • generate an indicator with the attribute having an ids flag
  • generate an observed data with either all the attributes or only the attribute with no ids flag
  • both referencing each other

Will have a look at it to define what I will do with the different fields (comment, UUID, tags, galaxies, etc.)

@chrisr3d chrisr3d self-assigned this Jul 24, 2023
@cudeso
Copy link
Author

cudeso commented Jul 26, 2023

Thank you!

I ran into this when uploading indicators in STIX format to Sentinel. The current STIX implementation of Sentinel only accepts indicators (not observations). It was a bit confusing to see indicators with to_ids false (those part of an object) appearing in the Sentinel TI tables.

@SYNchroACK
Copy link
Contributor

SYNchroACK commented Sep 28, 2023

  • generate an observed data with either all the attributes or only the attribute with no ids flag

@chrisr3d I guess you meant, generate observables objects and associate them to the report object.

I believe, Observed Data object serves a different goal.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

3 participants