search

OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform
https://opencti.io
Other
6.51k stars 959 forks source link

Add capability for specifying STIX file extensions in the File observable type #5285

Open akshaysth opened 11 months ago

akshaysth commented 11 months ago

Use case

STIX 2.1 specification describes the ability to provide file extensions properties to a file observable for additional granularity e.g. Windows PE File Extension. This provides a mechanism to store additional contextual data on the File observable in question such as imphash.

Current Workaround

None

Proposed Solution

Expand the attributes that can be configured on the File observable to include extensions as listed in the STIX 2.1 specification. https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_99bl2dibcztv

Additional Information

If the feature request is approved, would you be willing to submit a PR?

Yes / No (Help can be provided if you need assistance submitting a PR)

nino-filigran commented 10 months ago

@akshaysth thanks for your request! We'll work on this and update the ticket when done!