Skip to content

Commit 68d8112

Browse files
committed
fix: [stix2 import] Avoiding issues with network_traffic.[src,dst]_type being converted as a hostname attribute
- While this may sound weird, it is not a logical feature we're fixing here but a fallback case, in other words "it is not an IP address, so the other option is: probably hostname"
1 parent a6e4716 commit 68d8112

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

misp_stix_converter/stix2misp/converters/stix2_indicator_converter.py

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -778,6 +778,8 @@ def _parse_network_traffic_attribute(
778778
values: Union[str, tuple], indicator_id: str, name: str):
779779
field = keys[0]
780780
if any(field == f'{feature}_ref' for feature in ('src', 'dst')):
781+
if keys [-1] == 'type':
782+
return
781783
if isinstance(values, tuple):
782784
for value in values:
783785
misp_object.add_attribute(

0 commit comments

Comments
 (0)