search

muchdogesec / arango_cti_processor

A small script that creates relationships between common CTI knowledge-bases in STIX 2.1 format.
https://www.dogesec.com/
Apache License 2.0
3 stars 0 forks source link

Relationship UUIDs not generated as expected #9

Closed himynamesdave closed 4 months ago

himynamesdave commented 4 months ago

UUIDs should be generated as follows

To generate the id of SRO, a UUIDv5 is generated using the namespace 2e51a631-99d8-52a5-95a6-8314d3f4fbf3 and the relationship_type+source_collection_name/source_ref+target_collection_name/target_ref values.

For example, here is a current relationship output from the script

[
  {
    "_key": "relationship--d2facb4b-0dce-5e9e-b11c-97d0a402fc5f+2024-07-24T15:18:18.956565Z",
    "_id": "mitre_capec_edge_collection/relationship--d2facb4b-0dce-5e9e-b11c-97d0a402fc5f+2024-07-24T15:18:18.956565Z",
    "_from": "mitre_capec_vertex_collection/attack-pattern--e3dd79e7-307b-42dd-9e22-d0345c0ec001+2024-07-24T15:17:31.752062Z",
    "_to": "mitre_attack_enterprise_vertex_collection/attack-pattern--191cc6af-1bb2-4344-ab5f-28e496638720+2024-07-24T15:17:20.039281Z",
    "_rev": "_iMTQUFW--B",
    "type": "relationship",
    "spec_version": "2.1",
    "id": "relationship--d2facb4b-0dce-5e9e-b11c-97d0a402fc5f",
    "created_by_ref": "identity--2e51a631-99d8-52a5-95a6-8314d3f4fbf3",
    "created": "2022-09-29T00:00:00.000Z",
    "modified": "2023-01-24T00:00:00.000Z",
    "relationship_type": "technique",
    "source_ref": "attack-pattern--e3dd79e7-307b-42dd-9e22-d0345c0ec001",
    "target_ref": "attack-pattern--191cc6af-1bb2-4344-ab5f-28e496638720",
    "object_marking_refs": [
      "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
      "marking-definition--2e51a631-99d8-52a5-95a6-8314d3f4fbf3"
    ],
    "_is_ref": false,
    "_arango_cti_processor_note": "capec-attack",
    "_record_md5_hash": "accb9916088d2813e31683a6815c6580",
    "_stix2arango_note": "test01",
    "_is_latest": true,
    "_record_created": "2024-07-24T15:18:18.956565Z",
    "_record_modified": "2024-07-24T15:18:18.956565Z"
  }
]

Expected UUID would be

2e51a631-99d8-52a5-95a6-8314d3f4fbf3

technique+mitre_capec_vertex_collection/attack-pattern--e3dd79e7-307b-42dd-9e22-d0345c0ec001+mitre_attack_enterprise_vertex_collection/attack-pattern--191cc6af-1bb2-4344-ab5f-28e496638720

which gives UUIDv5 of 34d58beb-5d4c-5899-b3aa-2a0d5995e82d which is different to the above