Closed lyiqian closed 5 years ago
Hi @liu1000! Did you try first defining the custom extension as described here: https://stix2.readthedocs.io/en/latest/guide/custom.html#Custom-Cyber-Observable-Extensions?
Hi @clenk thanks for the reply! First defining a custom extension for URL works for me.
@stix2.CustomExtension(stix2.URL, 'x-observable-ext', [
('indicators', stix2.properties.ListProperty(contained=dict, required=False)),
])
class ObservableExtension:
pass
Just one more thing I thought worth mentioning: I used SDO classes but not observable classes in this module. Even if I didn't first define the custom extension, there was no errors when I added it to File or Process observables, which have built-in extensions defined. This is inconsistent in my opinion.
Hello again @liu1000. I haven't been able to replicate what you mentioned. I think without first defining the custom extension you would get an error saying "Can't parse unknown extension type: x-observable-ext". Could you provide example code that has the inconsistency you mentioned and doesn't give an error?
Hi @clenk , here is the example code:
import stix2
file_sdo = stix2.ObservedData(
allow_custom=True, # note this is set
first_observed="2017-02-12T19:11:11.232Z",
last_observed="2017-02-12T19:11:11.232Z",
number_observed=1,
objects={
"0": {
"type": "file",
"name": "bar.txt",
"extensions": {
"x-observable-ext": {
"len": 1,
}
}
}
}
)
print("Created file_sdo with custom extensions without first defining it!")
print(file_sdo)
url_sdo = stix2.ObservedData(
allow_custom=True, # note this is set
first_observed="2017-02-12T19:11:11.232Z",
last_observed="2017-02-12T19:11:11.232Z",
number_observed=1,
objects={
"0": {
"type": "url",
"value": "https://www.google.ca",
"extensions": {
"x-observable-ext": {
"len": 1,
}
}
}
}
)
Thanks, @liu1000; a fix is on the way.
According to the stix2 standard, URL observables have
extensions
Common Properties. But I encountered this error when I tried to add a custom extension to a URL observable.