Export to stix bundle bug

Packs/CommonScripts/ReleaseNotes/1_7_19.md

@@ -0,0 +1,5 @@
+
+#### Scripts
+##### StixCreator
+- Fixed an issue where export to STIX failed when more than one indicator was being exported.
+- Fixed an issue where export to STIX failed when trying to export file types.

Packs/CommonScripts/Scripts/StixCreator/StixCreator.py

@@ -13,9 +13,9 @@
 from typing import Any, Callable
 
 SCOs: dict[str, str] = {
-    "file md5": "file:hashes.md5",
-    "file sha1": "file:hashes.sha1",
-    "file sha256": "file:hashes.sha256",
+    "md5": "file:hashes.md5",
+    "sha1": "file:hashes.sha1",
+    "sha256": "file:hashes.sha256",
     "ssdeep": "file:hashes.ssdeep",
     "ip": "ipv4-addr:value",
     "cidr": "ipv4-addr:value",
@@ -43,6 +43,21 @@
 }
 
 
+def hash_type(value: str) -> str:  # pragma: no coverage
+    length = len(value)
+    if length == 32:
+        return 'md5'
+    if length == 40:
+        return 'sha1'
+    if length == 64 and ":" in value:
+        return 'ssdeep'
+    elif length == 64:
+        return 'sha256'
+    if length == 128:
+        return 'sha512'
+    return ''
+
+
 def main():
 
     user_args = demisto.args().get('indicators', 'Unknown')
@@ -94,6 +109,8 @@ def main():
 
         try:
             indicator_type = demisto_indicator_type.lower().replace("-", "")
+            if indicator_type == 'file':
+                indicator_type = hash_type(value)
             indicator = Indicator(pattern=f"[{SCOs[indicator_type]} = '{value}']",
                                   pattern_type='stix',
                                   **kwargs)
@@ -133,7 +150,7 @@ def main():
                 continue
 
     if len(indicators) > 1:
-        bundle = Bundle(indicators)
+        bundle = Bundle(indicators, allow_custom=True)
         context = {
             'StixExportedIndicators(val.pattern && val.pattern == obj.pattern)': json.loads(str(bundle))
         }

Packs/CommonScripts/Scripts/StixCreator/StixCreator_test.py

@@ -0,0 +1,45 @@
+import demistomock as demisto  # noqa: F401
+from CommonServerPython import *  # noqa: F401
+import pytest
+from StixCreator import main
+
+FILE_INDICATOR = \
+    {
+        'indicators':
+            {
+                '0': {'expirationStatus': 'active', 'firstSeen': '2022-07-31T13:26:05Z',
+                      'indicator_type': 'File',
+                      'lastSeen': '2022-07-31T13:26:05Z', 'score': 'good',
+                      'timestamp': '2022-07-31T13:26:05Z',
+                      'value': 'e14daa9c88a7ec91d770ae262758db73b6593b178527a2d7bba14159fad5f1c2'
+                      }
+            }
+    }
+
+DOMAIN_INDICATORS = \
+    {
+        'indicators':
+            {
+                '0': {'expirationStatus': 'active', 'firstSeen': '2022-07-31T13:24:44Z',
+                      'indicator_type': 'Domain',
+                      'lastSeen': '2022-07-31T13:24:44Z', 'score': 'Unknown',
+                      'timestamp': '2022-07-31T13:24:44Z',
+                      'value': 'test.com'
+                      },
+                '1': {'expirationStatus': 'active', 'firstSeen': '2022-07-31T13:24:40Z',
+                      'indicator_type': 'Domain',
+                      'lastSeen': '2022-07-31T13:24:40Z', 'score': 'suspicious',
+                      'timestamp': '2022-07-31T13:24:40Z',
+                      'value': 'bad.com'
+                      }
+            }
+    }
+
+
+@pytest.mark.parametrize('indicators, stix_type', [(DOMAIN_INDICATORS, 'bundle'), (FILE_INDICATOR, 'indicator')])
+def test_stixCreator_with_indicators(mocker, indicators, stix_type):
+    mocker.patch.object(demisto, 'args', return_value=indicators)
+    mocker.patch.object(demisto, 'results')
+    main()
+    results = demisto.results.call_args[0]
+    assert stix_type in results[0]['Contents']

Packs/CommonScripts/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "Common Scripts",
     "description": "Frequently used scripts pack.",
     "support": "xsoar",
-    "currentVersion": "1.7.18",
+    "currentVersion": "1.7.19",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",