Closed rlynch-ironnet closed 2 years ago
I suppose I'll have to do something similar to how the old sekoia issues fixed things.
reproducible snippet:
bundle_objects = [{
'type': 'report',
'spec_version': '2.1',
'id': 'report--3fa375fc-085b-5296-a6bb-7901d831d5e2',
'created': '2022-08-12T18:54:35.505Z',
'modified': '2022-08-12T18:54:35.505Z',
'object_marking_refs': ['marking-definition--f88d31f6-486f-44da-b317-01333bde0b82'],
'name': 'abc123',
'report_types': ['News Analysis'],
'published': '2022-08-12T18:54:35.505Z',
'object_refs': ['report--3fa375fc-085b-5296-a6bb-7901d831d5e2']
}]
import pycti.utils.opencti_stix2_splitter
splitter = pycti.utils.opencti_stix2_splitter.OpenCTIStix2Splitter()
import stix2
bundle = stix2.Bundle(objects=bundle_objects, allow_custom=True).serialize()
splitter.split_bundle(bundle)
Looks like we forget to check this kind of cycling dependency. We need to check that correctly and i think we will continue to reject this kind of data. We can maybe cleanup the cyclic ref but it will be difficult to take the correct decision in every situation
what if we wrap the enlist_element method inside another that just keeps a list of processed entity IDs? The recursion can happen either in the inner method?
Something like...
def enlist_element(...):
tracked = set()
def inner_enlist(id, ...):
if id in tracked:
return
tracked.add(id)
...stuff...
inner_enlist(recursive args)
Finally we decide to rewrite the bundle removing this kind of cyclic problem. So in your bundle sample, the report will not have anymore it self in the object_refs.
Dont hesitate to see with your data provider to really cleanup the bundle on their side to improve data quality overall :)
Description
When ingesting from the mandiant api v4 stix/taxii report endpoint, a recursion error happens. At a glance, without digging too deep into the bundle splitting, it appears to be because of the self referencial reports they send back.
Environment
Reproducible Steps
Steps to create the smallest reproducible scenario:
Expected Output
Handles it properly.
Actual Output
Recursion error
Additional information