Skip to content

Commit 8a08a59

Browse files
chemamartinezchemamartinez
authored
ti_opencti: read indicators from STIX pattern when no observables are present (#16531)
Extracts indicator fields from the STIX pattern when observables_count is 0, so indicators without observables still populate ECS fields.
1 parent e6ceca0 commit 8a08a59

34 files changed

+1719
-41
lines changed

‎packages/ti_opencti/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "2.11.0"
3+
changes:
4+
- description: Read indicators from STIX pattern when no observables are present.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/16531
27
- version: "2.10.1"
38
changes:
49
- description: Fix null reference errors in ingest pipelines.

‎packages/ti_opencti/data_stream/indicator/_dev/test/pipeline/test-cryptocurrency-wallet.json-expected.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,4 +75,4 @@
7575
}
7676
}
7777
]
78-
}
78+
}

‎packages/ti_opencti/data_stream/indicator/_dev/test/pipeline/test-domain-name-with-external-reference.json‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,61 @@
6464
"x_opencti_detection": false,
6565
"x_opencti_main_observable_type": "Domain-Name",
6666
"x_opencti_score": 60
67+
},
68+
{
69+
"confidence": 0,
70+
"created": "2023-11-02T00:17:00.295Z",
71+
"createdBy": {
72+
"identity_class": "organization",
73+
"name": "Stopforumspam"
74+
},
75+
"description": "Stopforumspam",
76+
"externalReferences": {
77+
"edges": [
78+
{
79+
"node": {
80+
"description": "Stopforumspam feed URL",
81+
"source_name": "stopforumspam",
82+
"url": "https://www.stopforumspam.com/downloads/toxic_domains_whole_filtered_50000.txt"
83+
}
84+
},
85+
{
86+
"node": {
87+
"external_id": null,
88+
"source_name": "MISC",
89+
"url": "https://example.com/CVE-0079-1234",
90+
"description": null
91+
}
92+
}
93+
]
94+
},
95+
"id": "fcfa872e-a8b6-4525-847e-f3c756b70035",
96+
"is_inferred": false,
97+
"killChainPhases": [],
98+
"lang": "en",
99+
"modified": "2023-11-09T23:22:20.586Z",
100+
"name": "freelifetimexxxdates.com",
101+
"objectLabel": [
102+
{
103+
"value": "spam"
104+
}
105+
],
106+
"objectMarking": [],
107+
"observables": {
108+
"edges": [],
109+
"pageInfo": {
110+
"globalCount": 0
111+
}
112+
},
113+
"pattern": "[domain-name:value = 'freelifetimexxxdates.com']",
114+
"pattern_type": "stix",
115+
"revoked": false,
116+
"standard_id": "indicator--08a7e875-2ce4-50ab-a8de-2915addd93c4",
117+
"valid_from": "2023-11-09T23:22:19.426Z",
118+
"valid_until": "2024-11-08T23:22:19.426Z",
119+
"x_opencti_detection": false,
120+
"x_opencti_main_observable_type": "Domain-Name",
121+
"x_opencti_score": 60
67122
}
68123
]
69124
}

‎packages/ti_opencti/data_stream/indicator/_dev/test/pipeline/test-domain-name-with-external-reference.json-expected.json‎

Lines changed: 78 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,83 @@
8484
}
8585
}
8686
}
87+
},
88+
{
89+
"ecs": {
90+
"version": "8.11.0"
91+
},
92+
"event": {
93+
"category": [
94+
"threat"
95+
],
96+
"created": "2023-11-02T00:17:00.295Z",
97+
"id": "fcfa872e-a8b6-4525-847e-f3c756b70035",
98+
"kind": "enrichment",
99+
"type": [
100+
"indicator"
101+
]
102+
},
103+
"opencti": {
104+
"indicator": {
105+
"creator_identity_class": "organization",
106+
"detection": false,
107+
"external_reference": {
108+
"description": "Stopforumspam feed URL",
109+
"source_name": [
110+
"stopforumspam",
111+
"MISC"
112+
],
113+
"url": [
114+
"https://www.stopforumspam.com/downloads/toxic_domains_whole_filtered_50000.txt",
115+
"https://example.com/CVE-0079-1234"
116+
]
117+
},
118+
"invalid_or_revoked_from": "2024-11-08T23:22:19.426Z",
119+
"is_inferred": false,
120+
"lang": "en",
121+
"observables_count": 0,
122+
"pattern": "[domain-name:value = 'freelifetimexxxdates.com']",
123+
"pattern_type": "stix",
124+
"revoked": false,
125+
"score": 60,
126+
"standard_id": "indicator--08a7e875-2ce4-50ab-a8de-2915addd93c4",
127+
"valid_from": "2023-11-09T23:22:19.426Z",
128+
"valid_until": "2024-11-08T23:22:19.426Z"
129+
}
130+
},
131+
"related": {
132+
"hosts": [
133+
"freelifetimexxxdates.com"
134+
]
135+
},
136+
"tags": [
137+
"forwarded",
138+
"opencti-indicator",
139+
"spam",
140+
"ecs-indicator-detail"
141+
],
142+
"threat": {
143+
"feed": {
144+
"dashboard_id": "ti_opencti-83b2bef0-591c-11ee-ba5f-49a63bb985cd",
145+
"description": "Indicator data from OpenCTI",
146+
"name": "OpenCTI",
147+
"reference": "https://docs.opencti.io/latest/usage/overview/"
148+
},
149+
"indicator": {
150+
"confidence": "None",
151+
"description": "Stopforumspam",
152+
"modified_at": "2023-11-09T23:22:20.586Z",
153+
"name": "freelifetimexxxdates.com",
154+
"provider": "Stopforumspam",
155+
"reference": "https://demo.opencti.io/dashboard/observations/indicators/fcfa872e-a8b6-4525-847e-f3c756b70035",
156+
"type": "domain-name",
157+
"url": {
158+
"domain": "freelifetimexxxdates.com",
159+
"registered_domain": "freelifetimexxxdates.com",
160+
"top_level_domain": "com"
161+
}
162+
}
163+
}
87164
}
88165
]
89-
}
166+
}

‎packages/ti_opencti/data_stream/indicator/_dev/test/pipeline/test-domain-name.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,54 @@
5757
"globalCount": 1
5858
}
5959
}
60+
},
61+
{
62+
"id": "74241a4b-45c8-412d-8cd5-20ddbefaf065",
63+
"standard_id": "indicator--d187f4b2-ecd0-525f-8227-f1d7aecad5c6",
64+
"is_inferred": false,
65+
"revoked": true,
66+
"confidence": 30,
67+
"lang": "en",
68+
"created": "2023-01-17T06:40:40.348Z",
69+
"modified": "2023-01-17T07:07:01.972Z",
70+
"pattern_type": "stix",
71+
"pattern_version": "2.1",
72+
"pattern": "[domain-name:value = 'mydomain1607.com']",
73+
"name": "mydomain1607.com",
74+
"description": "",
75+
"valid_from": "2017-03-31T10:42:38.000Z",
76+
"valid_until": "2018-03-31T10:42:38.000Z",
77+
"x_opencti_score": 50,
78+
"x_opencti_detection": false,
79+
"x_opencti_main_observable_type": "Domain-Name",
80+
"createdBy": {
81+
"identity_class": "organization",
82+
"name": "AlienVault"
83+
},
84+
"objectMarking": [
85+
{
86+
"definition_type": "TLP",
87+
"definition": "TLP:CLEAR"
88+
}
89+
],
90+
"objectLabel": [
91+
{
92+
"value": "iran"
93+
},
94+
{
95+
"value": "oilrig"
96+
}
97+
],
98+
"killChainPhases": [],
99+
"externalReferences": {
100+
"edges": []
101+
},
102+
"observables": {
103+
"edges": [],
104+
"pageInfo": {
105+
"globalCount": 0
106+
}
107+
}
60108
}
61109
]
62110
}

‎packages/ti_opencti/data_stream/indicator/_dev/test/pipeline/test-domain-name.json-expected.json‎

Lines changed: 71 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,76 @@
7777
}
7878
}
7979
}
80+
},
81+
{
82+
"ecs": {
83+
"version": "8.11.0"
84+
},
85+
"event": {
86+
"category": [
87+
"threat"
88+
],
89+
"created": "2023-01-17T06:40:40.348Z",
90+
"id": "74241a4b-45c8-412d-8cd5-20ddbefaf065",
91+
"kind": "enrichment",
92+
"type": [
93+
"indicator"
94+
]
95+
},
96+
"opencti": {
97+
"indicator": {
98+
"creator_identity_class": "organization",
99+
"detection": false,
100+
"invalid_or_revoked_from": "2018-03-31T10:42:38.000Z",
101+
"is_inferred": false,
102+
"lang": "en",
103+
"observables_count": 0,
104+
"pattern": "[domain-name:value = 'mydomain1607.com']",
105+
"pattern_type": "stix",
106+
"pattern_version": "2.1",
107+
"revoked": true,
108+
"score": 50,
109+
"standard_id": "indicator--d187f4b2-ecd0-525f-8227-f1d7aecad5c6",
110+
"valid_from": "2017-03-31T10:42:38.000Z",
111+
"valid_until": "2018-03-31T10:42:38.000Z"
112+
}
113+
},
114+
"related": {
115+
"hosts": [
116+
"mydomain1607.com"
117+
]
118+
},
119+
"tags": [
120+
"forwarded",
121+
"opencti-indicator",
122+
"iran",
123+
"oilrig",
124+
"ecs-indicator-detail"
125+
],
126+
"threat": {
127+
"feed": {
128+
"dashboard_id": "ti_opencti-83b2bef0-591c-11ee-ba5f-49a63bb985cd",
129+
"description": "Indicator data from OpenCTI",
130+
"name": "OpenCTI",
131+
"reference": "https://docs.opencti.io/latest/usage/overview/"
132+
},
133+
"indicator": {
134+
"confidence": "Medium",
135+
"marking": {
136+
"tlp": "CLEAR"
137+
},
138+
"modified_at": "2023-01-17T07:07:01.972Z",
139+
"name": "mydomain1607.com",
140+
"provider": "AlienVault",
141+
"reference": "https://demo.opencti.io/dashboard/observations/indicators/74241a4b-45c8-412d-8cd5-20ddbefaf065",
142+
"type": "domain-name",
143+
"url": {
144+
"domain": "mydomain1607.com",
145+
"registered_domain": "mydomain1607.com",
146+
"top_level_domain": "com"
147+
}
148+
}
149+
}
80150
}
81151
]
82-
}
152+
}

‎packages/ti_opencti/data_stream/indicator/_dev/test/pipeline/test-email-addr.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,54 @@
5858
"globalCount": 1
5959
}
6060
}
61+
},
62+
{
63+
"id": "3a2616f1-b063-4c85-9c2f-bad7a61c547e",
64+
"standard_id": "indicator--34da552c-ed45-5ee8-9a0a-833e7fb50713",
65+
"is_inferred": false,
66+
"revoked": true,
67+
"confidence": 30,
68+
"lang": "en",
69+
"created": "2023-01-17T06:44:17.361Z",
70+
"modified": "2023-01-17T09:13:06.584Z",
71+
"pattern_type": "stix",
72+
"pattern_version": "2.1",
73+
"pattern": "[email-addr:value = '[email protected]']",
74+
"name": "[email protected]",
75+
"description": "",
76+
"valid_from": "2017-08-04T09:57:02.000Z",
77+
"valid_until": "2018-08-04T09:57:02.000Z",
78+
"x_opencti_score": 50,
79+
"x_opencti_detection": false,
80+
"x_opencti_main_observable_type": "Email-Addr",
81+
"createdBy": {
82+
"identity_class": "organization",
83+
"name": "AlienVault"
84+
},
85+
"objectMarking": [
86+
{
87+
"definition_type": "TLP",
88+
"definition": "TLP:CLEAR"
89+
}
90+
],
91+
"objectLabel": [
92+
{
93+
"value": "ransomware"
94+
},
95+
{
96+
"value": "gryphon"
97+
}
98+
],
99+
"killChainPhases": [],
100+
"externalReferences": {
101+
"edges": []
102+
},
103+
"observables": {
104+
"edges": [],
105+
"pageInfo": {
106+
"globalCount": 0
107+
}
108+
}
61109
}
62110
]
63111
}

0 commit comments

Comments
 (0)