[client] report error expection when element is ignored during import

Author: JeremyCloarec

pycti/utils/opencti_stix2.py

@@ -2748,16 +2748,24 @@ def import_bundle(
         )
 
         stix2_splitter = OpenCTIStix2Splitter()
-        _, nb_incompatible_elements, bundles = (
+        _, incompatible_elements, bundles = (
             stix2_splitter.split_bundle_with_expectations(
                 stix_bundle, False, event_version
             )
         )
 
         # Report every element ignored during bundle splitting
         if work_id is not None:
-            for i in range(nb_incompatible_elements):
-                self.opencti.work.report_expectation(work_id, None)
+            for incompatible_element in incompatible_elements:
+                self.opencti.work.report_expectation(
+                    work_id,
+                    {
+                        "error": "Incompatible element in bundle",
+                        "source": "Element "
+                        + incompatible_element["id"]
+                        + " is incompatible and couldn't be processed",
+                    },
+                )
 
         # Import every element in a specific order
         imported_elements = []

pycti/utils/opencti_stix2_splitter.py

@@ -35,7 +35,7 @@ def __init__(self):
         self.cache_index = {}
         self.cache_refs = {}
         self.elements = []
-        self.nb_incompatible_items = 0
+        self.incompatible_items = []
 
     def get_internal_ids_in_extension(self, item):
         ids = []
@@ -191,7 +191,7 @@ def enlist_element(
             if is_compatible:
                 self.elements.append(item)
             else:
-                self.nb_incompatible_items = self.nb_incompatible_items + 1
+                self.incompatible_items.append(item)
             self.cache_index[item_id] = item
             for internal_id in self.get_internal_ids_in_extension(item):
                 self.cache_index[internal_id] = item
@@ -204,7 +204,7 @@ def split_bundle_with_expectations(
         use_json=True,
         event_version=None,
         cleanup_inconsistent_bundle=False,
-    ) -> Tuple[int, int, list]:
+    ) -> Tuple[int, list, list]:
         """splits a valid stix2 bundle into a list of bundles"""
         if use_json:
             try:
@@ -254,7 +254,7 @@ def by_dep_size(elem):
                 )
             )
 
-        return number_expectations, self.nb_incompatible_items, bundles
+        return number_expectations, self.incompatible_items, bundles
 
     @deprecated("Use split_bundle_with_expectations instead")
     def split_bundle(self, bundle, use_json=True, event_version=None) -> list: