def create_indicator_stix(self, entity):
# Export to STIX bundle
stix2_bundle = self.helper.api.stix2.export_entity(
"Indicator",
entity["id"],
"simple",
None,
True,
)
# Convert the STIX 2 bundle in STIX 1
try:
initialize_options()
stix_indicator = slide_string(stix2_bundle)
payload = {"intelDoc": stix_indicator}
intel_document = self._query(
"post",
"/plugin/products/detect3/api/v1/sources/" + self.source_id + "/intels",
payload,
"application/xml",
"stix",
)
return intel_document
except Exception as e:
self.helper.log_error(str(e))
return None
def _create_indicator_stix(self, entity, original_intel_document=None):
if original_intel_document is None:
intel_document = self._get_by_id(entity["id"])
if intel_document is not None:
return intel_document
stix2_bundle = self.helper.api.stix2.export_entity(
entity["entity_type"],
entity["id"],
"simple",
None,
True,
True,
)
initialize_options()
stix_indicator = slide_string(stix2_bundle)
stix_indicator = re.sub(
r"<indicator:Description>(.*?)<\/indicator:Description>",
r"<indicator:Description>" + entity["id"] + "</indicator:Description>",
stix_indicator,
)
stix_indicator = re.sub(
r"<indicator:Description ordinality=\"1\">(.*?)<\/indicator:Description>",
r'<indicator:Description ordinality="1">'
+ entity["id"]
+ "</indicator:Description>",
stix_indicator,
)
payload = {"intelDoc": stix_indicator}
if original_intel_document is not None:
intel_document = self._query(
"put",
"/plugin/products/detect3/api/v1/intels/"
+ str(original_intel_document["id"]),
stix_indicator,
"application/xml",
"stix",
)
else:
intel_document = self._query(
"post",
"/plugin/products/detect3/api/v1/sources/"
+ str(self.source_id)
+ "/intels",
payload,
"application/xml",
"stix",
)
return intel_document
def update_indicator_stix(self, intel_id, entity):
# Export to STIX bundle
stix2_bundle = self.helper.api.stix2.export_entity(
"Indicator",
entity["id"],
"simple",
None,
True,
)
# Convert the STIX 2 bundle in STIX 1
try:
initialize_options()
stix_indicator = slide_string(stix2_bundle)
intel_document = self._query(
"put",
"/plugin/products/detect3/api/v1/intels/" + intel_id,
stix_indicator,
"application/xml",
"stix",
)
return intel_document
except Exception as e:
self.helper.log_error(str(e))
return None