Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Error 'standard_id' when using the export-file-stix connector v6.1.10 on a report that contains nested relationships #2214

Closed
fboissel opened this issue Jun 14, 2024 · 2 comments
Labels
bug use for describing something not working as expected needs more info Intel needed about the use case

Comments

@fboissel
Copy link

fboissel commented Jun 14, 2024

Description

The export-file-stix connector v6.1.10 generate an error 'standard_id' when trying to export a report which contains nested relationships (e.g. Sample relationship between a Malware SDO and a File SCO). The connector doesn't seem to be able to retrieve a standard_id for these entities. I am not sure that STIX2.1 is attributing an id to these nested relationships:
"The sample_refs property specifies a list of identifiers of the SCO file or artifact objects associated with this malware instance(s) or family."(https://docs.oasis-open.org/cti/stix/v2.1/csprd01/stix-v2.1-csprd01.html#_Toc16070645)

Environment

  1. OS (where OpenCTI server runs): docker
  2. OpenCTI version: 6.1.10
  3. OpenCTI client: python

Reproducible Steps

Steps to create the smallest reproductible scenario:

  1. Create a report
  2. Add a Maware SDO
  3. Add a File SCO
  4. Create a Nested relationship between Malware and File, with a relationship type: Sample
  5. In the Data tab of the Report, generate an application/json export using the export-file-stix connector for v6.1.10

Expected Output

We are expecting to generate a json file in STIX of the report that we can download.

Actual Output

Connector error: "KeyError: 'standard_id"

Additional information

Screenshots (optional)

@fboissel fboissel added bug use for describing something not working as expected needs triage use to identify issue needing triage from Filigran Product team labels Jun 14, 2024
@nino-filigran nino-filigran added needs more info Intel needed about the use case and removed needs triage use to identify issue needing triage from Filigran Product team labels Jun 24, 2024
@nino-filigran
Copy link

@fboissel can you try to upgrade your openCTI version to the latest?
I can't seem to reproduce your issue in our environment.

@fboissel
Copy link
Author

Hi @nino-filigran
Sorry for the late answer, the process to get our platform upgraded took a while.
I confirm that an upgrade of OpenCTI to the v6.2.5 with the compatible export connectors solved the problem.
I think this issue can be close as resolved.
Thanks a lot!
Fred

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug use for describing something not working as expected needs more info Intel needed about the use case
Projects
None yet
Development

No branches or pull requests

2 participants