Skip to content

Importing report JSON bundle with tags fails #59

@maertv

Description

@maertv

Description

Importing report JSON bundle with tags fails.

Environment

  1. OS: Ubuntu 18.04.3 LTS
  2. OpenCTI version: 2.1.3
  3. client-python: 2.1.11

Reproducible Steps

Used a connector (helper.send_stix2_bundle) to import following bundle:

{
    "type": "bundle",
    "id": "bundle--d6d095dd-5cb2-4f17-8527-a34b2035dc04",
    "spec_version": "2.0",
    "objects": [
        {
            "type": "identity",
            "id": "identity--b05f0747-adbf-4531-8647-921a56d1372c",
            "created": "2020-01-27T09:05:20.637Z",
            "modified": "2020-01-27T09:05:20.637Z",
            "name": "Test",
            "identity_class": "organization",
            "x_opencti_identity_type": "organization"
        },
        {
            "type": "marking-definition",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "definition": {
                "tlp": "white"
            }
        },
        {
            "type": "report",
            "id": "report--2e0ce812-0f40-40c8-9eb4-5a16783092fb",
            "created_by_ref": "identity--b05f0747-adbf-4531-8647-921a56d1372c",
            "created": "2020-01-27T09:05:20.640Z",
            "modified": "2020-01-27T09:05:20.640Z",
            "name": "Test Report d11cb227-b761-43f1-9f53-f6a54ed71644",
            "description": "Test Report d11cb227-b761-43f1-9f53-f6a54ed71644 Description.",
            "published": "2020-01-27T09:05:20.640614Z",
            "object_refs": [
                "identity--b05f0747-adbf-4531-8647-921a56d1372c"
            ],
            "labels": [
                "threat-report"
            ],
            "external_references": [
                {
                    "source_name": "Test",
                    "url": "https://example.com/reference/d11cb227-b761-43f1-9f53-f6a54ed71644"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ],
            "x_opencti_object_status": 0,
            "x_opencti_report_class": "Threat Report",
            "x_opencti_source_confidence_level": 3,
            "x_opencti_tags": [
                {
                    "color": "#6cc221",
                    "tag_type": "Test",
                    "value": "tag_d11cb227-b761-43f1-9f53-f6a54ed71644"
                }
            ]
        }
    ]
}

Expected Output

Report with tags is imported to OpenCTI.

Actual Output

Report is not imported.

Excerpt from Worker log:

INFO:root:Importing a report (id: report--2e0ce812-0f40-40c8-9eb4-5a16783092fb)
ERROR:root:An unexpected error occurred: { 'id' }
Traceback (most recent call last):
  File "worker.py", line 73, in data_handler
    imported_data = self.api.stix2.import_bundle_from_json(content, update, types)
  File "/home/martv/development/OpenCTI-Platform/opencti_1/opencti-worker/venv/lib/python3.6/site-packages/pycti/utils/opencti_stix2.py", line 130, in import_bundle_from_json
    return self.import_bundle(data, update, types)
  File "/home/martv/development/OpenCTI-Platform/opencti_1/opencti-worker/venv/lib/python3.6/site-packages/pycti/utils/opencti_stix2.py", line 1845, in import_bundle
    self.import_object(item, update, types)
  File "/home/martv/development/OpenCTI-Platform/opencti_1/opencti-worker/venv/lib/python3.6/site-packages/pycti/utils/opencti_stix2.py", line 380, in import_object
    embedded_relationships = self.extract_embedded_relationships(stix_object, types)
  File "/home/martv/development/OpenCTI-Platform/opencti_1/opencti-worker/venv/lib/python3.6/site-packages/pycti/utils/opencti_stix2.py", line 173, in extract_embedded_relationships
    if tag["id"] in self.mapping_cache:
KeyError: 'id'                  
INFO:root:Message processed, thread terminated
INFO:root:Message (delivery_tag=1) acknowledged

Metadata

Metadata

Assignees

Labels

buguse for describing something not working as expectedsolveduse to identify issue that has been solved (must be linked to the solving PR)

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions