Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[eset] FIX: Add x_opencti_main_observable_type when missing from atomic indicators #3013

Merged
merged 2 commits into from
Jan 9, 2025
Merged

[eset] FIX: Add x_opencti_main_observable_type when missing from atomic indicators #3013

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
325c943
[eset] Add x_opencti_main_observable_type when missing from atomic in…
ckane Nov 21, 2024
b291d53
[eset] Add empty where_sighted_refs to quiet a schema validation error
ckane Nov 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions external-import/eset/src/eset.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
import datetime
import json
import os
import re
import sys
import time

Expand All @@ -21,6 +22,15 @@

TMP_DIR = "TMP"

OBSERVABLE_TYPES_MAP = {
"url:value": "Url",
"domain-name:value": "Domain-Name",
"ipv4-addr:value": "IPv4-Addr",
"file:hashes.MD5": "MD5",
"file:hashes.'SHA-1'": "SHA-1",
"file:hashes.'SHA-256'": "SHA-256",
}


class Eset:
def __init__(self):
Expand Down Expand Up @@ -164,6 +174,7 @@ def _import_collection(self, collection, work_id, start_epoch):
client.set_auth(username=self.eset_username, password=self.eset_password)
no_more_result = False
end_epoch = start_epoch + 3600
atomic_ind_pattern = re.compile(r"\[(\S+) = '[^']+'\]")
while no_more_result is False:
self.helper.log_info(
"Iterating with collection="
Expand Down Expand Up @@ -249,10 +260,22 @@ def _import_collection(self, collection, work_id, start_epoch):
else:
id_remaps[object["id"]] = new_id
object["id"] = new_id

# Attempt to fill in x_opencti_main_observable_type
atomic_match = atomic_ind_pattern.fullmatch(
object["pattern"]
)
if atomic_match:
pattern_field_name = atomic_match.group(1)
if pattern_field_name in OBSERVABLE_TYPES_MAP:
object["x_opencti_main_observable_type"] = (
OBSERVABLE_TYPES_MAP[pattern_field_name]
)
if self.eset_create_observables:
object["x_opencti_create_observables"] = (
self.eset_create_observables
)
object["where_sighted_refs"] = []
objects.append(object)
parsed_content["objects"] = objects
self.helper.send_stix2_bundle(
Expand Down