[client] Limit stix_ids explosion by rewriting the standard_id in client python (#659)

Author: richard-julien

pycti/connector/opencti_connector_helper.py

@@ -849,6 +849,13 @@ def __init__(self, config: Dict, playbook_compatible=False) -> None:
             False,
             True,
         )
+        self.keep_original_id = get_config_variable(
+            "CONNECTOR_KEEP_ORIGINAL_ID",
+            ["connector", "keep_original_id"],
+            config,
+            False,
+            False,
+        )
         self.bundle_send_to_directory = get_config_variable(
             "CONNECTOR_SEND_TO_DIRECTORY",
             ["connector", "send_to_directory"],
@@ -1571,6 +1578,7 @@ def send_stix2_bundle(self, bundle: str, **kwargs) -> list:
         file_name = kwargs.get("file_name", None)
         bundle_send_to_queue = kwargs.get("send_to_queue", self.bundle_send_to_queue)
         cleanup_inconsistent_bundle = kwargs.get("cleanup_inconsistent_bundle", False)
+        keep_original_id = kwargs.get("keep_original_id", self.keep_original_id)
         bundle_send_to_directory = kwargs.get(
             "send_to_directory", self.bundle_send_to_directory
         )
@@ -1581,6 +1589,11 @@ def send_stix2_bundle(self, bundle: str, **kwargs) -> list:
             "send_to_directory_retention", self.bundle_send_to_directory_retention
         )
 
+        # Bundle ids must be rewritten
+        bundle = self.api.stix2.prepare_bundle_ids(
+            bundle=bundle, use_json=True, keep_original_id=keep_original_id
+        )
+
         # In case of enrichment ingestion, ensure the sharing if needed
         if self.enrichment_shared_organizations is not None:
             # Every element of the bundle must be enriched with the same organizations

pycti/entities/opencti_attack_pattern.py

@@ -222,15 +222,18 @@ def __init__(self, opencti):
 
     @staticmethod
     def generate_id(name, x_mitre_id=None):
-        name = name.lower().strip()
         if x_mitre_id is not None:
             data = {"x_mitre_id": x_mitre_id}
         else:
-            data = {"name": name}
+            data = {"name": name.lower().strip()}
         data = canonicalize(data, utf8=False)
         id = str(uuid.uuid5(uuid.UUID("00abedb4-aa42-466c-9c01-fed23315a9b7"), data))
         return "attack-pattern--" + id
 
+    @staticmethod
+    def generate_id_from_data(data):
+        return AttackPattern.generate_id(data.get("name"), data.get("x_mitre_id"))
+
     """
         List Attack-Pattern objects
 

pycti/entities/opencti_campaign.py

@@ -216,6 +216,10 @@ def generate_id(name):
         id = str(uuid.uuid5(uuid.UUID("00abedb4-aa42-466c-9c01-fed23315a9b7"), data))
         return "campaign--" + id
 
+    @staticmethod
+    def generate_id_from_data(data):
+        return Campaign.generate_id(data["name"])
+
     """
         List Campaign objects
 

pycti/entities/opencti_case_incident.py

@@ -461,6 +461,10 @@ def generate_id(name, created):
         id = str(uuid.uuid5(uuid.UUID("00abedb4-aa42-466c-9c01-fed23315a9b7"), data))
         return "case-incident--" + id
 
+    @staticmethod
+    def generate_id_from_data(data):
+        return CaseIncident.generate_id(data["name"], data["created"])
+
     """
         List Case Incident objects
         

pycti/entities/opencti_case_rfi.py

@@ -457,6 +457,10 @@ def generate_id(name, created):
         id = str(uuid.uuid5(uuid.UUID("00abedb4-aa42-466c-9c01-fed23315a9b7"), data))
         return "case-rfi--" + id
 
+    @staticmethod
+    def generate_id_from_data(data):
+        return CaseRfi.generate_id(data["name"], data["created"])
+
     """
         List Case Rfi objects
         

pycti/entities/opencti_case_rft.py

@@ -457,6 +457,10 @@ def generate_id(name, created):
         id = str(uuid.uuid5(uuid.UUID("00abedb4-aa42-466c-9c01-fed23315a9b7"), data))
         return "case-rft--" + id
 
+    @staticmethod
+    def generate_id_from_data(data):
+        return CaseRft.generate_id(data["name"], data["created"])
+
     """
         List Case Rft objects
         

pycti/entities/opencti_channel.py

@@ -212,6 +212,10 @@ def generate_id(name):
         id = str(uuid.uuid5(uuid.UUID("00abedb4-aa42-466c-9c01-fed23315a9b7"), data))
         return "channel--" + id
 
+    @staticmethod
+    def generate_id_from_data(data):
+        return Channel.generate_id(data["name"])
+
     """
         List Channel objects
 

pycti/entities/opencti_course_of_action.py

@@ -196,15 +196,18 @@ def __init__(self, opencti):
 
     @staticmethod
     def generate_id(name, x_mitre_id=None):
-        name = name.lower().strip()
         if x_mitre_id is not None:
             data = {"x_mitre_id": x_mitre_id}
         else:
-            data = {"name": name}
+            data = {"name": name.lower().strip()}
         data = canonicalize(data, utf8=False)
         id = str(uuid.uuid5(uuid.UUID("00abedb4-aa42-466c-9c01-fed23315a9b7"), data))
         return "course-of-action--" + id
 
+    @staticmethod
+    def generate_id_from_data(data):
+        return CourseOfAction.generate_id(data.get("name"), data.get("x_mitre_id"))
+
     """
         List Course-Of-Action objects
 

pycti/entities/opencti_data_component.py

@@ -246,6 +246,10 @@ def generate_id(name):
         id = str(uuid.uuid5(uuid.UUID("00abedb4-aa42-466c-9c01-fed23315a9b7"), data))
         return "data-component--" + id
 
+    @staticmethod
+    def generate_id_from_data(data):
+        return DataComponent.generate_id(data["name"])
+
     """
         List Data-Component objects
 

pycti/entities/opencti_data_source.py

@@ -204,6 +204,10 @@ def generate_id(name):
         id = str(uuid.uuid5(uuid.UUID("00abedb4-aa42-466c-9c01-fed23315a9b7"), data))
         return "data-source--" + id
 
+    @staticmethod
+    def generate_id_from_data(data):
+        return DataSource.generate_id(data["name"])
+
     """
         List Data-Source objects