Open r-smith opened 5 days ago
The TAXII feed ingestor ignores the valid_until property when ingesting STIX Indicator objects.
valid_until
Indicator
Steps to create the smallest reproducible scenario:
{ "objects": [ { "type": "indicator", "spec_version": "2.1", "id": "indicator--a831dcab-392e-5927-8ed7-9b8c3b343526", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '127.0.0.1']", "pattern_type": "stix", "created": "2024-11-16T12:12:30.000Z", "modified": "2024-11-16T12:12:30.000Z", "valid_from": "2024-11-16T12:12:30.000Z", "valid_until": "2025-01-16T12:12:30.000Z" } ] }
valid_until should be set to the timestamp specified in the STIX Indicator object.
valid_until is ignored and always set to a fixed 9 months.
Description
The TAXII feed ingestor ignores the
valid_until
property when ingesting STIXIndicator
objects.Environment
Reproducible Steps
Steps to create the smallest reproducible scenario:
Expected Output
valid_until
should be set to the timestamp specified in the STIX Indicator object.Actual Output
valid_until
is ignored and always set to a fixed 9 months.