muchdogesec / stix2arango

stix2arango is a command line tool that takes a group of STIX 2.1 objects in a bundle and inserts them into ArangoDB. It can also handle updates to existing objects in ArangoDB imported in a bundle.
https://www.dogesec.com/
Apache License 2.0
4 stars 0 forks source link

Nested relationship_types should be more descriptive #17

Closed himynamesdave closed 3 months ago

himynamesdave commented 3 months ago

In #13 we covered the generation of nested embedded relationships,

e.g.

{
    "type": "bundle",
    "id": "bundle--7985964e-a029-410a-98d8-a1bcd67ef32d",
    "objects": [
        {
            "type": "cryptocurrency-transaction",
            "spec_version": "2.1",
            "id": "cryptocurrency-transaction--f437c493-b651-5cbb-845a-3dd231a39ec6",
            "symbol": "BTC",
            "hash": "cfb39d98f66da8bfe42ad86894f116a3c1d8c6d1189456fcffae615a80623c49",
            "execution_time": "2020-04-25T18:24:13Z",
            "output": [
                {
                    "address_ref": "cryptocurrency-wallet--d3efcf4e-d9fa-578d-a83f-f11af4c2504c",
                    "amount": 43577930
                }
            ],
            "extensions": {
                "extension-definition--151d042d-4dcf-5e44-843f-1024440318e5": {
                    "extension_type": "new-sco"
                }
            }
        }
    ]
}

currently creates an embedded relationship with relationship_type = address. Problem is, this ignores the upper level key, which is actually important.

In this case relationship_type should = output-address.

For all nested keys, they should be included in the relationship_type.

Each key should be separated with a -.

This example shows a key nested 1 level lower than root. It is possible that keys can be on lower levels too.

Test 18 has been updated to test for this.

fqrious commented 3 months ago

okay, this is not a bug... the source_ref (the cryptocurrency-transaction object above) does not have created or modified property. I have tested by adding created/modified and it works

himynamesdave commented 3 months ago

@fqrious i don't understand, this has nothing to do with timestamps.

It is totally possible some objects have neither created or modified times.

See ticket: https://github.com/muchdogesec/stix2arango/issues/16

fqrious commented 3 months ago

My bad, I commented on the wrong issue... I already fixed this one

The comment was meant for #16