Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix connector-cape bugs #3356

Merged
merged 6 commits into from
Feb 4, 2025
Merged

Fix connector-cape bugs #3356

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
241dc62
Fix conflict between pycti and stix2.v21 Malware classes
t-mtsmt Jan 30, 2025
8fc8d74
Fix Get_Malware receiving list instead of string
t-mtsmt Jan 30, 2025
bec0bdf
Fix conflict between pycti and stix2.v21 Indicator classes
t-mtsmt Jan 30, 2025
293deaa
Fix incorrectly sorted and formatted imports
t-mtsmt Jan 30, 2025
edf05c6
Format code using Black
t-mtsmt Jan 30, 2025
623f2f4
Fixed to assign labels in the appropriate format.
t-mtsmt Feb 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 16 additions & 8 deletions external-import/cape/src/cape/telemetry.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,8 @@
cuckooReportTTP,
cuckooTarget,
)
from pycti import Indicator as pyctiIndicator
from pycti import Malware as pyctiMalware
from pycti import Note as pyctiNote
from pycti import Report as pyctiReport
from pycti import StixCoreRelationship
Expand Down Expand Up @@ -130,7 +132,7 @@ def createIPObs(self, hosts):
if self.CreateIndicator:
STIXPattern = self.getStixPattern(host.ip, "ipv4")
IPind = Indicator(
id=Indicator.generate_id(STIXPattern),
id=pyctiIndicator.generate_id(STIXPattern),
name=host.ip,
pattern=STIXPattern,
pattern_type="stix",
Expand Down Expand Up @@ -159,14 +161,14 @@ def createDNSObs(self, DNSOBJ):
if self.CreateIndicator:
STIXPattern = self.getStixPattern(host.domain, "FQDN")
DNSind = Indicator(
id=Indicator.generate_id(STIXPattern),
id=pyctiIndicator.generate_id(STIXPattern),
name=host.domain,
pattern=STIXPattern,
pattern_type="stix",
)
STIXPattern = self.getStixPattern(host.ip, "ipv4")
IPind = Indicator(
id=Indicator.generate_id(STIXPattern),
id=pyctiIndicator.generate_id(STIXPattern),
name=host.ip,
pattern=STIXPattern,
pattern_type="stix",
Expand Down Expand Up @@ -317,7 +319,7 @@ def createPrimaryBinary(self, file: cuckooTarget, external_references):
mime_type=file.type,
)
ind = Indicator(
id=Indicator.generate_id(STIXPattern),
id=pyctiIndicator.generate_id(STIXPattern),
name=file.name,
pattern=STIXPattern,
pattern_type="stix",
Expand Down Expand Up @@ -356,7 +358,7 @@ def createBinarieObs(self, objects):
if self.CreateIndicator:
STIXPattern = self.getStixPattern(file.sha256.upper(), "sha256")
fileind = Indicator(
id=Indicator.generate_id(STIXPattern),
id=pyctiIndicator.generate_id(STIXPattern),
name=file.name,
pattern=STIXPattern,
pattern_type="stix",
Expand Down Expand Up @@ -390,7 +392,8 @@ def createCuckooReport(
reportLabels.append("Malicious")

if report.detections:
reportLabels.append(report.detections)
for detection in report.detections:
reportLabels.append(detection["family"])

labelIDs = []
for labelx in reportLabels:
Expand Down Expand Up @@ -461,7 +464,9 @@ def Get_Malware(self, Detection: str):

if not MalwareX:
MalwareX = Malware(
id=Malware.generate_id(name=Detection), name=Detection, is_family=False
id=pyctiMalware.generate_id(name=Detection),
name=Detection,
is_family=False,
)

return MalwareX
Expand Down Expand Up @@ -567,7 +572,10 @@ def processAndSubmit(self):
AttackPatterns = []

if self.report.detections:
Malware = self.Get_Malware(self.report.detections)
detection = ""
if len(self.report.detections) > 0:
detection = self.report.detections[0]["family"]
Malware = self.Get_Malware(detection)
else:
Malware = None

Expand Down