Merge branch 'dev' of github.com:MISP/misp-stix

chrisr3d · chrisr3d · commit 201d8bc8d52c · 2024-03-21T16:41:44.000+01:00
diff --git a/misp_stix_converter/stix2misp/converters/stix2_attack_pattern_converter.py b/misp_stix_converter/stix2misp/converters/stix2_attack_pattern_converter.py
@@ -68,7 +68,9 @@ def _create_cluster(self, attack_pattern: _ATTACK_PATTERN_TYPING,
             )
         if meta:
             attack_pattern_args['meta'] = meta
-        return self._create_misp_galaxy_cluster(attack_pattern_args)
+        return self.main_parser._create_misp_galaxy_cluster(
+            **attack_pattern_args
+        )
 
 
 class InternalSTIX2AttackPatternMapping(
@@ -137,7 +139,9 @@ def _create_cluster(self, attack_pattern: _ATTACK_PATTERN_TYPING,
             )
         if meta:
             attack_pattern_args['meta'] = meta
-        return self._create_misp_galaxy_cluster(attack_pattern_args)
+        return self.main_parser._create_misp_galaxy_cluster(
+            **attack_pattern_args
+        )
 
     def _parse_attack_pattern_object(
             self, attack_pattern: _ATTACK_PATTERN_TYPING):
diff --git a/misp_stix_converter/stix2misp/converters/stix2_campaign_converter.py b/misp_stix_converter/stix2misp/converters/stix2_campaign_converter.py
@@ -51,7 +51,7 @@ def _create_cluster(self, campaign: _CAMPAIGN_TYPING,
             )
         if meta:
             campaign_args['meta'] = meta
-        return self._create_misp_galaxy_cluster(campaign_args)
+        return self.main_parser._create_misp_galaxy_cluster(**campaign_args)
 
 
 class InternalSTIX2CampaignConverter(InternalSTIX2Converter):
diff --git a/misp_stix_converter/stix2misp/converters/stix2_course_of_action_converter.py b/misp_stix_converter/stix2misp/converters/stix2_course_of_action_converter.py
@@ -46,7 +46,9 @@ def _create_cluster(self, course_of_action: _COURSE_OF_ACTION_TYPING,
             )
         if meta:
             course_of_action_args['meta'] = meta
-        return self._create_misp_galaxy_cluster(course_of_action_args)
+        return self.main_parser._create_misp_galaxy_cluster(
+            **course_of_action_args
+        )
 
 
 class InternalSTIX2CourseOfActionMapping(InternalSTIX2Mapping):
@@ -108,7 +110,9 @@ def _create_cluster(self, course_of_action: _COURSE_OF_ACTION_TYPING,
             )
         if meta:
             course_of_action_args['meta'] = meta
-        return self._create_misp_galaxy_cluster(course_of_action_args)
+        return self.main_parser._create_misp_galaxy_cluster(
+            **course_of_action_args
+        )
 
     def _parse_course_of_action_object(
             self, course_of_action: _COURSE_OF_ACTION_TYPING):
diff --git a/misp_stix_converter/stix2misp/converters/stix2_custom_object_converter.py b/misp_stix_converter/stix2misp/converters/stix2_custom_object_converter.py
@@ -89,8 +89,10 @@ def _parse_custom_galaxy_cluster(
             if hasattr(custom_galaxy, 'x_misp_meta'):
                 cluster_args['meta'] = custom_galaxy.x_misp_meta
             clusters[custom_ref] = {
-                'cluster': self._create_misp_galaxy_cluster(cluster_args),
-                'used': {self.event_uuid: False}
+                'used': {self.event_uuid: False},
+                'cluster': self.main_parser._create_misp_galaxy_cluster(
+                    **cluster_args
+                )
             }
             if galaxy_type not in self.main_parser._galaxies:
                 self._create_galaxy_args(galaxy_type, custom_galaxy.x_misp_name)
diff --git a/misp_stix_converter/stix2misp/converters/stix2_identity_converter.py b/misp_stix_converter/stix2misp/converters/stix2_identity_converter.py
@@ -77,7 +77,7 @@ def _create_cluster(self, identity: _IDENTITY_TYPING,
         meta = self._handle_meta_fields(identity)
         if meta:
             sector_args['meta'] = meta
-        return self._create_misp_galaxy_cluster(sector_args)
+        return self.main_parser._create_misp_galaxy_cluster(**sector_args)
 
     def _parse_identity_object(self, identity: _IDENTITY_TYPING):
         misp_object = self._create_misp_object('identity', identity)
diff --git a/misp_stix_converter/stix2misp/converters/stix2_intrusion_set_converter.py b/misp_stix_converter/stix2misp/converters/stix2_intrusion_set_converter.py
@@ -63,7 +63,9 @@ def _create_cluster(self, intrusion_set: _INTRUSION_SET_TYPING,
             )
         if meta:
             intrusion_set_args['meta'] = meta
-        return self._create_misp_galaxy_cluster(intrusion_set_args)
+        return self.main_parser._create_misp_galaxy_cluster(
+            **intrusion_set_args
+        )
 
 
 class InternalSTIX2IntrusionSetMapping(
@@ -125,7 +127,9 @@ def _create_cluster(self, intrusion_set: _INTRUSION_SET_TYPING,
             self._handle_cluster_value_with_synonyms(intrusion_set_args, meta)
         if meta:
             intrusion_set_args['meta'] = meta
-        return self._create_misp_galaxy_cluster(intrusion_set_args)
+        return self.main_parser._create_misp_galaxy_cluster(
+            **intrusion_set_args
+        )
 
     def _parse_intrusion_set_object(self, intrusion_set: _INTRUSION_SET_TYPING):
         misp_object = self._create_misp_object('intrusion-set', intrusion_set)
diff --git a/misp_stix_converter/stix2misp/converters/stix2_location_converter.py b/misp_stix_converter/stix2misp/converters/stix2_location_converter.py
@@ -98,7 +98,7 @@ def _create_cluster(self, location: Location,
         meta = self._handle_meta_fields(location)
         if meta:
             location_args['meta'] = meta
-        return self._create_misp_galaxy_cluster(location_args)
+        return self.main_parser._create_misp_galaxy_cluster(**location_args)
 
     def _parse_location_object(self, location: Location):
         misp_object = self._create_misp_object('geolocation', location)
diff --git a/misp_stix_converter/stix2misp/converters/stix2_malware_converter.py b/misp_stix_converter/stix2misp/converters/stix2_malware_converter.py
@@ -155,7 +155,7 @@ def _create_cluster(self, malware: _MALWARE_TYPING,
             self._handle_labels(meta, malware.labels)
         if meta:
             malware_args['meta'] = meta
-        return self._create_misp_galaxy_cluster(malware_args)
+        return self.main_parser._create_misp_galaxy_cluster(**malware_args)
 
     def _parse_malware_object_and_galaxy(self, malware: _MALWARE_TYPING):
         self._parse_galaxy(malware)
@@ -230,7 +230,7 @@ def _create_cluster(self, malware: _MALWARE_TYPING,
             self._handle_labels(meta, malware.labels)
         if meta:
             malware_args['meta'] = meta
-        return self._create_misp_galaxy_cluster(malware_args)
+        return self.main_parser._create_misp_galaxy_cluster(**malware_args)
 
     def _parse_script_object(self, malware: _MALWARE_TYPING):
         misp_object = self._create_misp_object('script', malware)
diff --git a/misp_stix_converter/stix2misp/converters/stix2_threat_actor_converter.py b/misp_stix_converter/stix2misp/converters/stix2_threat_actor_converter.py
@@ -62,7 +62,7 @@ def _create_cluster(self, threat_actor: _THREAT_ACTOR_TYPING,
             self._handle_labels(meta, threat_actor.labels)
         if meta:
             threat_actor_args['meta'] = meta
-        return self._create_misp_galaxy_cluster(threat_actor_args)
+        return self.main_parser._create_misp_galaxy_cluster(**threat_actor_args)
 
 
 class ExternalSTIX2ThreatActorMapping(
diff --git a/misp_stix_converter/stix2misp/converters/stix2_tool_converter.py b/misp_stix_converter/stix2misp/converters/stix2_tool_converter.py
@@ -64,7 +64,7 @@ def _create_cluster(self, tool: _TOOL_TYPING,
             self._handle_labels(meta, tool.labels)
         if meta:
             tool_args['meta'] = meta
-        return self._create_misp_galaxy_cluster(tool_args)
+        return self.main_parser._create_misp_galaxy_cluster(**tool_args)
 
 
 class InternalSTIX2ToolMapping(
@@ -120,7 +120,7 @@ def _create_cluster(self, tool: _TOOL_TYPING,
             self._handle_labels(meta, tool.labels)
         if meta:
             tool_args['meta'] = meta
-        return self._create_misp_galaxy_cluster(tool_args)
+        return self.main_parser._create_misp_galaxy_cluster(**tool_args)
 
     def _parse_script_object(self, tool: _TOOL_TYPING):
         misp_object = self._create_misp_object('script', tool)
diff --git a/misp_stix_converter/stix2misp/converters/stix2_vulnerability_converter.py b/misp_stix_converter/stix2misp/converters/stix2_vulnerability_converter.py
@@ -52,7 +52,9 @@ def _create_cluster(self, vulnerability: _VULNERABILITY_TYPING,
             )
         if meta:
             vulnerability_args['meta'] = meta
-        return self._create_misp_galaxy_cluster(vulnerability_args)
+        return self.main_parser._create_misp_galaxy_cluster(
+            **vulnerability_args
+        )
 
 
 class ExternalSTIX2VulnerabilityConverter(
diff --git a/misp_stix_converter/stix2misp/converters/stix2converter.py b/misp_stix_converter/stix2misp/converters/stix2converter.py
@@ -6,7 +6,7 @@
 from abc import ABCMeta
 from collections import defaultdict
 from datetime import datetime
-from pymisp import AbstractMISP, MISPGalaxy, MISPGalaxyCluster, MISPObject
+from pymisp import AbstractMISP, MISPGalaxyCluster, MISPObject
 from stix2.v20.sdo import (
     AttackPattern as AttackPattern_v20, Malware as Malware_v20)
 from stix2.v21.sdo import (
@@ -73,12 +73,6 @@ def _create_misp_object(
             misp_object.from_dict(**self._parse_timeline(stix_object))
         return misp_object
 
-    @staticmethod
-    def _create_misp_galaxy_cluster(cluster_args: dict) -> MISPGalaxyCluster:
-        cluster = MISPGalaxyCluster()
-        cluster.from_dict(**cluster_args)
-        return cluster
-
     ############################################################################
     #                     STIX OBJECTS CONVERSION METHODS.                     #
     ############################################################################
@@ -286,7 +280,6 @@ def _create_cluster_args(
 
     def _create_galaxy_args(self, stix_object: _GALAXY_OBJECTS_TYPING,
                             galaxy_type: Optional[str] = None):
-        misp_galaxy = MISPGalaxy()
         if galaxy_type is None:
             galaxy_type = stix_object.type
         mapping = self._mapping.galaxy_name_mapping(galaxy_type)
@@ -305,12 +298,8 @@ def _create_galaxy_args(self, stix_object: _GALAXY_OBJECTS_TYPING,
                 }
             )
             galaxy_type = f'stix-{version}-{galaxy_type}'
-        misp_galaxy.from_dict(
-            **{
-                'type': galaxy_type, 'name': name, **galaxy_args
-            }
-        )
-        self.main_parser._galaxies[galaxy_type] = misp_galaxy
+        galaxy_args.update({'type': galaxy_type, 'name': name})
+        self.main_parser._galaxies[galaxy_type] = galaxy_args
 
     def _handle_meta_fields(self, stix_object: _GALAXY_OBJECTS_TYPING) -> dict:
         mapping = f"{stix_object.type.replace('-', '_')}_meta_mapping"
@@ -394,16 +383,9 @@ def _handle_object_forcing(attributes: list, force_object: tuple) -> bool:
     def _handle_object_case(self, stix_object: _SDO_TYPING, attributes: list,
                             name: str) -> MISPObject:
         misp_object = self._create_misp_object(name, stix_object)
-        tags = tuple(self._handle_tags_from_stix_fields(stix_object))
-        if tags:
-            for attribute in attributes:
-                misp_attribute = misp_object.add_attribute(**attribute)
-                for tag in tags:
-                    misp_attribute.add_tag(tag)
-            return self.main_parser.misp_event.add_object(misp_object)
         for attribute in attributes:
             misp_object.add_attribute(**attribute)
-        return self.main_parser.misp_event.add_object(misp_object)
+        return self.main_parser._add_misp_object(misp_object, stix_object)
 
 
 class InternalSTIX2Converter(STIX2Converter, metaclass=ABCMeta):
@@ -444,21 +426,12 @@ def _create_cluster_args(
         cluster_args['description'] = value.capitalize()
         return cluster_args
 
-    def _create_galaxy_args(
-            self, galaxy_type: str, galaxy_name: str):
-        misp_galaxy = MISPGalaxy()
-        if galaxy_type in self.main_parser.galaxy_definitions:
-            misp_galaxy.from_dict(
-                **self.main_parser.galaxy_definitions[galaxy_type]
-            )
-        else:
-            misp_galaxy.from_dict(
-                **{
-                    'type': galaxy_type,
-                    'name': galaxy_name
-                }
-            )
-        self.main_parser._galaxies[galaxy_type] = misp_galaxy
+    def _create_galaxy_args(self, galaxy_type: str, galaxy_name: str):
+        self.main_parser._galaxies[galaxy_type] = (
+            self.main_parser.galaxy_definitions[galaxy_type]
+            if galaxy_type in self.main_parser.galaxy_definitions
+            else {'type': galaxy_type, 'name': galaxy_name}
+        )
 
     def _extract_custom_fields(self, stix_object: _GALAXY_OBJECTS_TYPING):
         for key, value in stix_object.items():
diff --git a/misp_stix_converter/stix2misp/stix2_mapping.py b/misp_stix_converter/stix2misp/stix2_mapping.py
@@ -15,6 +15,19 @@ class STIX2toMISPMapping(metaclass=ABCMeta):
             '2': '_parse_bundle_with_multiple_reports'
         }
     )
+    __mac_address_pattern = '^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$'
+    __marking_extension_mapping = Mapping(
+        **{
+            'extension-definition--3a65884d-005a-4290-8335-cb2d778a83ce': 'acs'
+        }
+    )
+    __marking_vocabularies_fields = (
+        'caveat', 'classification', 'entity', 'formal_determination',
+        'sensitivity', 'shareability'
+    )
+    __object_type_refs_to_skip = (
+        'opinion', 'relationship', 'sighting', 'x-misp-opinion'
+    )
     __observable_object_types = (
         'network-traffic',
         'file',
@@ -35,17 +48,6 @@ class STIX2toMISPMapping(metaclass=ABCMeta):
         'windows-registry-key',
         'x509-certificate'
     )
-    __timeline_mapping = Mapping(
-        **{
-            'indicator': ('valid_from', 'valid_until'),
-            'observed-data': ('first_observed', 'last_observed')
-        }
-    )
-    __mac_address_pattern = '^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$'
-
-    __object_type_refs_to_skip = (
-        'opinion', 'relationship', 'sighting', 'x-misp-opinion'
-    )
     __stix_object_loading_mapping = Mapping(
         **{
             'attack-pattern': '_load_attack_pattern',
@@ -103,6 +105,12 @@ class STIX2toMISPMapping(metaclass=ABCMeta):
             'x-misp-object': '_parse_custom_object'
         }
     )
+    __timeline_mapping = Mapping(
+        **{
+            'indicator': ('valid_from', 'valid_until'),
+            'observed-data': ('first_observed', 'last_observed')
+        }
+    )
 
     # SINGLE ATTRIBUTES MAPPING
     __access_time_attribute = Mapping(
@@ -818,6 +826,14 @@ def longitude_attribute(cls) -> dict:
     def mac_address_pattern(cls) -> str:
         return cls.__mac_address_pattern
 
+    @classmethod
+    def marking_extension_mapping(cls, field: str) -> Union[str, None]:
+        return cls.__marking_extension_mapping.get(field)
+
+    @classmethod
+    def marking_vocabularies_fields(cls) -> tuple:
+        return cls.__marking_vocabularies_fields
+
     @classmethod
     def message_id_attribute(cls) -> dict:
         return cls.__message_id_attribute
diff --git a/misp_stix_converter/stix2misp/stix2_to_misp.py b/misp_stix_converter/stix2misp/stix2_to_misp.py

Original file line number	Diff line number	Diff line change
`@@ -51,7 +51,7 @@ def _create_cluster(self, campaign: _CAMPAIGN_TYPING,`
`51`	`51`	`)`
`52`	`52`	`if meta:`
`53`	`53`	`campaign_args['meta'] = meta`
`54`		`- return self._create_misp_galaxy_cluster(campaign_args)`
	`54`	`+ return self.main_parser._create_misp_galaxy_cluster(**campaign_args)`
`55`	`55`
`56`	`56`
`57`	`57`	`class InternalSTIX2CampaignConverter(InternalSTIX2Converter):`