Skip to content
This repository was archived by the owner on Dec 5, 2025. It is now read-only.

Commit d1ff8fc

Browse files
committed
[client] Rollback changes on sightings
1 parent bee6de5 commit d1ff8fc

File tree

1 file changed

+39
-8
lines changed

1 file changed

+39
-8
lines changed

pycti/utils/opencti_stix2.py

Lines changed: 39 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1314,6 +1314,38 @@ def import_sighting(
13141314
}
13151315

13161316
# Create the sighting
1317+
1318+
### Get the FROM
1319+
if from_id in self.mapping_cache:
1320+
final_from_id = self.mapping_cache[from_id]["id"]
1321+
else:
1322+
stix_object_result = (
1323+
self.opencti.opencti_stix_object_or_stix_relationship.read(id=from_id)
1324+
)
1325+
if stix_object_result is not None:
1326+
final_from_id = stix_object_result["id"]
1327+
else:
1328+
self.opencti.app_logger.error(
1329+
"From ref of the sighting not found, doing nothing..."
1330+
)
1331+
return None
1332+
1333+
### Get the TO
1334+
final_to_id = None
1335+
if to_id:
1336+
if to_id in self.mapping_cache:
1337+
final_to_id = self.mapping_cache[to_id]["id"]
1338+
else:
1339+
stix_object_result = (
1340+
self.opencti.opencti_stix_object_or_stix_relationship.read(id=to_id)
1341+
)
1342+
if stix_object_result is not None:
1343+
final_to_id = stix_object_result["id"]
1344+
else:
1345+
self.opencti.app_logger.error(
1346+
"To ref of the sighting not found, doing nothing..."
1347+
)
1348+
return None
13171349
if (
13181350
"x_opencti_negative" not in stix_sighting
13191351
and self.opencti.get_attribute_in_extension("negative", stix_sighting)
@@ -1327,8 +1359,8 @@ def import_sighting(
13271359
self.opencti.get_attribute_in_extension("workflow_id", stix_sighting)
13281360
)
13291361
stix_sighting_result = self.opencti.stix_sighting_relationship.create(
1330-
fromId=from_id,
1331-
toId=to_id,
1362+
fromId=final_from_id,
1363+
toId=final_to_id,
13321364
stix_id=stix_sighting["id"] if "id" in stix_sighting else None,
13331365
description=(
13341366
self.convert_markdown(stix_sighting["description"])
@@ -2404,7 +2436,7 @@ def import_item(
24042436
if len(to_ids) > 0:
24052437
for to_id in to_ids:
24062438
self.import_sighting(item, from_id, to_id, update)
2407-
elif (
2439+
if (
24082440
self.opencti.get_attribute_in_extension("sighting_of_ref", item)
24092441
is not None
24102442
):
@@ -2414,11 +2446,10 @@ def import_item(
24142446
if len(to_ids) > 0:
24152447
for to_id in to_ids:
24162448
self.import_sighting(item, from_id, to_id, update)
2417-
else:
2418-
from_id = item["sighting_of_ref"]
2419-
if len(to_ids) > 0:
2420-
for to_id in to_ids:
2421-
self.import_sighting(item, from_id, to_id, update)
2449+
from_id = item["sighting_of_ref"]
2450+
if len(to_ids) > 0:
2451+
for to_id in to_ids:
2452+
self.import_sighting(item, from_id, to_id, update)
24222453
# Import observed_data_refs
24232454
if "observed_data_refs" in item:
24242455
for observed_data_ref in item["observed_data_refs"]:

0 commit comments

Comments
 (0)