def _create_indicator(
self,
name: str,
description: str,
valid_from: datetime,
observable_type: str,
observable_value: str,
pattern_type: str,
pattern_value: str,
indicator_pattern: str,
) -> Indicator:
kill_chain_phases: List[KillChainPhase] = []
return create_indicator(
name,
description,
self.author,
valid_from,
kill_chain_phases,
observable_type,
observable_value,
pattern_type,
pattern_value,
indicator_pattern,
self.object_marking_refs,
)
def _create_indicator(
self,
kill_chain_phases: List[KillChainPhase],
labels: List[str],
score: int,
) -> Optional[STIXIndicator]:
if not self.create_indicators:
return None
indicator_value = self.indicator.indicator
indicator_pattern = self.observation_factory.create_indicator_pattern(
indicator_value)
indicator_pattern_type = self._INDICATOR_PATTERN_TYPE_STIX
indicator_published = self.indicator.published_date
return create_indicator(
indicator_pattern.pattern,
indicator_pattern_type,
created_by=self.author,
name=indicator_value,
valid_from=indicator_published,
kill_chain_phases=kill_chain_phases,
labels=labels,
confidence=self.confidence_level,
object_markings=self.object_markings,
x_opencti_main_observable_type=indicator_pattern.
main_observable_type,
x_opencti_score=score,
)
def _create_indicator(
self, kill_chain_phases: List[KillChainPhase]) -> STIXIndicator:
indicator = self.indicator
name = indicator.indicator
description = ""
valid_from = indicator.published_date
observable_type = str(self.opencti_type.value)
observable_value = indicator.indicator
pattern_type = self._PATTERN_TYPE_STIX
pattern_value = create_equality_observation_expression_str(
self._OPENCTI_TO_STIX2[self.opencti_type],
self.indicator.indicator)
indicator_pattern = pattern_value
return create_indicator(
name,
description,
self.author,
valid_from,
kill_chain_phases,
observable_type,
observable_value,
pattern_type,
pattern_value,
indicator_pattern,
self.object_marking_refs,
)
def _create_yara_indicator(self) -> Indicator:
rule = self.rule
return create_indicator(
rule.rule,
self._PATTERN_TYPE_YARA,
created_by=self.author,
name=rule.name,
description=rule.description,
valid_from=self.first_seen,
confidence=self.confidence_level,
object_markings=self.object_markings,
)