Skip to content
This repository was archived by the owner on Dec 5, 2025. It is now read-only.

Commit 82d2507

Browse files
author
Samuel Hassine
committed
[client] Fix creation of attack patterns that have the same name
1 parent f910ba5 commit 82d2507

File tree

2 files changed

+37
-8
lines changed

2 files changed

+37
-8
lines changed

pycti/entities/opencti_attack_pattern.py

Lines changed: 36 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -347,21 +347,50 @@ def create(self, **kwargs):
347347
}
348348
}
349349
... on AttackPattern {
350+
killChainPhases {
351+
edges {
352+
node {
353+
id
354+
kill_chain_name
355+
phase_name
356+
}
357+
}
358+
}
350359
platform
351360
required_permission
352-
external_id
361+
external_id
353362
}
354363
"""
355-
object_result = self.opencti.stix_domain_entity.get_by_stix_id_or_name(
356-
types=["Attack-Pattern"],
357-
stix_id_key=stix_id_key,
358-
name=name,
359-
customAttributes=custom_attributes,
360-
)
364+
object_result = None
365+
if stix_id_key is not None:
366+
object_result = self.read(
367+
id=stix_id_key, customAttributes=custom_attributes
368+
)
361369
if object_result is None and external_id is not None:
362370
object_result = self.read(
363371
filters=[{"key": "external_id", "values": [external_id]}]
364372
)
373+
if object_result is None and name is not None:
374+
object_result = self.read(
375+
filters=[{"key": "name", "values": [name]}],
376+
customAttributes=custom_attributes,
377+
)
378+
if object_result is None:
379+
object_result = self.read(
380+
filters=[{"key": "alias", "values": [name]}],
381+
customAttributes=custom_attributes,
382+
)
383+
if object_result is not None:
384+
# Check kill chain phase
385+
if kill_chain_phases is not None and len(object_result["killChainPhasesIds"]) > 0:
386+
is_kill_chain_phase_match = False
387+
for kill_chain_phase in kill_chain_phases:
388+
for kill_chain_phase_id in object_result["killChainPhasesIds"]:
389+
if kill_chain_phase_id == kill_chain_phase:
390+
is_kill_chain_phase_match = True
391+
if not is_kill_chain_phase_match:
392+
object_result = None
393+
365394
if object_result is not None:
366395
if update or object_result["createdByRefId"] == created_by_ref:
367396
# name

setup.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
from setuptools import setup
66
from setuptools.command.install import install
77

8-
VERSION = "3.2.4"
8+
VERSION = "3.2.5"
99

1010
with open("README.md", "r") as fh:
1111
long_description = fh.read()

0 commit comments

Comments
 (0)