Open screencoffee opened 7 months ago
Seems we don't manage fully multi_body_part email as we do not create Parts mentionned in the "body_multipart". Problem is: if we respect the STIX 2.1, we have to use Email - Mime Part observables. It is very limited. A better way to manage this could be to create a new nested relationship (part-of_ref ?) and be able to link observables to the Email message. This way, we will leverage the full potential of our graph model. But we will need to handle this in the export connector, to be able to reconstruct the body_multipart content based on "part-of" nested relations.
@Kedae can we talk together about it regarding the complexity of the task plz?
Seems we don't manage fully multi_body_part email as we do not create Parts mentionned in the "body_multipart". Problem is: if we respect the STIX 2.1, we have to use Email - Mime Part observables. It is very limited. A better way to manage this could be to create a new nested relationship "part-of" and link artifact, file, etc. observables to the Email message. This way, we will leverage the full potential of our graph model. But we will need to handle this in the export connector, to be able to reconstruct the body_multipart content based on "part-of" nested relations.
This is kind of the workaround I did in my connector, but using a "related-to" relationship. I did try to use the "Email Message - MIME PART" observable type, inside OpenCTI but it doesn't seem like it supports "body_raw_ref" directly.
I think a good way to handle it would be to convert "body_multipart" into "Email Message - MIME PART" observables on import, because it preserves the "content-disposition". And as as you say recreate the property again on export.
Any updates on this? :)
Description
After playing around with parsing Emails and turning them into stix bundles to be uploaded to OpenCTI, I have come to the conclusion that the current implementation does not conform to the current STIX2.1 standard.
This is due to the "Email MIME Component Type" is a sort of sub-container inside the "Email Message Object". The "Email MIME Component Type" doesn't actually have an id like other observables.
Relevant links: STIX2.1 Specification of Email Message Object STIX2.1 Specification of Email MIME Component Type
Environment
Reproducible Steps
Expected Output
I expected there to be relations between the Email message and the mime components "tabby.png", "tabby_pics.zip" and the email mime component with text body, in the nested objects section.
Actual Output
The only nested objects are the email addresses contained in the bundle.
Additional information
I have tried to add the "Email MIME Component Type" to the stix bundle before sending it, but then it is not a valid bundle.
Screenshots (optional)
Failed result:![image](https://github.com/OpenCTI-Platform/opencti/assets/156308225/de241f03-b5cc-4e73-a91a-69560a1eb034)