-
Notifications
You must be signed in to change notification settings - Fork 1.2k
Description
Prerequisites
- I read the Deployment and Setup section of the OpenCTI documentation as well as the Troubleshooting page and didn't find anything relevant to my problem.
- I went through old GitHub issues and couldn't find anything relevant
- I googled the issue and didn't find anything relevant
Description
Hi,
I'm struggling with understanding of what OpenCTI considers to be "Main observable type", specifically when it processes CSV file via custom mapper.
I've got a CSV file with next columns:
Indicator,Malware,Is family,Intrusion_set,TTP,Organization,Pattern type,pattern,main_observable_type
1.2.3.4,,,,,Test-Org,stix,[ipv4-addr:value = '1.2.3.4'],ipv4-addr
The last column, as per STIX 2.1 SCOs, has values like ipv4-addr, domain-name etc.
My mapper is extracting Indicator entity from CSV data and parses the last column as main observable type respectively. CSV mapper test correctly passes with my test file, however when processing this same file via CSV mapper import connector it throws error "Observable type 'ipv4-addr' is not supproted". I have stumbled upon references of this observable type labeled as IPv4-Addr over OpenCTI documentation here and there. So my question is - are the STIX 2.1 SCOs type and OpenCTI's main observable type supposed to be different or am I missing something? If that is my fault, then why does a CSV mapper test successfully passes?
Environment
- OS (where OpenCTI server runs): Ubuntu 24.04 LTS
- OpenCTI version: OpenCTI 1.0.2
- OpenCTI client: frontend
Reproducible Steps
Steps to create the smallest reproducible scenario:
- Create CSV mapper with Inidcator entity
- Extract
main observable typefrom a column having values as per STIX 2.1 SCOs - Run Test over test CSV file
- Import test CSV file into the platform via Global Files
- Run created CSV mapper connector over imported file (validation mode is irrelevant)
- Get error
Observable type ipv4-addr is not supported. - Change last column value from
ipv4-addrtoIPv4-Addr. - Import changed CSV and rerun CSV mapper over it.
- Import successful 💯.
Additional information
