Skip to content
This repository was archived by the owner on Dec 5, 2025. It is now read-only.

Commit 70f4e49

Browse files
committed
[client] Handle custom marking definitions
1 parent 61877f2 commit 70f4e49

File tree

1 file changed

+33
-23
lines changed

1 file changed

+33
-23
lines changed

pycti/entities/opencti_marking_definition.py

Lines changed: 33 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -237,31 +237,41 @@ def import_from_stix2(self, **kwargs):
237237
stix_object = kwargs.get("stixObject", None)
238238
update = kwargs.get("update", False)
239239
if stix_object is not None:
240-
definition = None
241-
definition_type = stix_object["definition_type"]
242-
if stix_object["definition_type"] == "tlp":
243-
definition_type = definition_type.upper()
244-
if "definition" in stix_object:
245-
definition = (
246-
definition_type + ":" + stix_object["definition"]["tlp"].upper()
247-
)
248-
elif "name" in stix_object:
249-
definition = stix_object["name"]
240+
if (
241+
"x_opencti_definition_type" in stix_object
242+
and "x_opencti_definition" in stix_object
243+
):
244+
definition_type = stix_object["x_opencti_definition_type"]
245+
definition = stix_object["x_opencti_definition"]
250246
else:
251-
if "definition" in stix_object:
252-
if isinstance(stix_object["definition"], str):
253-
definition = stix_object["definition"]
254-
elif (
255-
isinstance(stix_object["definition"], dict)
256-
and stix_object["definition_type"] in stix_object["definition"]
257-
):
258-
definition = stix_object["definition"][
259-
stix_object["definition_type"]
260-
]
261-
else:
247+
definition_type = stix_object["definition_type"]
248+
definition = None
249+
if stix_object["definition_type"] == "tlp":
250+
definition_type = definition_type.upper()
251+
if "definition" in stix_object:
252+
definition = (
253+
definition_type
254+
+ ":"
255+
+ stix_object["definition"]["tlp"].upper()
256+
)
257+
elif "name" in stix_object:
258+
definition = stix_object["name"]
259+
else:
260+
if "definition" in stix_object:
261+
if isinstance(stix_object["definition"], str):
262+
definition = stix_object["definition"]
263+
elif (
264+
isinstance(stix_object["definition"], dict)
265+
and stix_object["definition_type"]
266+
in stix_object["definition"]
267+
):
268+
definition = stix_object["definition"][
269+
stix_object["definition_type"]
270+
]
271+
else:
272+
definition = stix_object["name"]
273+
elif "name" in stix_object:
262274
definition = stix_object["name"]
263-
elif "name" in stix_object:
264-
definition = stix_object["name"]
265275

266276
# Replace TLP:WHITE
267277
if definition == "TLP:WHITE":

0 commit comments

Comments
 (0)