stix2.exceptions.InvalidValueError

[sgmnt-qzh]

Traceback (most recent call last):
  File "/usr/local/bin/stix2_slider", line 11, in <module>
    load_entry_point('stix2-slider==1.0.1', 'console_scripts', 'stix2_slider')()
  File "/usr/local/lib/python2.7/dist-packages/stix2slider/cli.py", line 132, in main
    result = slide_file(slider_args.file_)
  File "/usr/local/lib/python2.7/dist-packages/stix2slider/__init__.py", line 27, in slide_file
    obj = stix2.parse(json_content)
  File "/usr/local/lib/python2.7/dist-packages/stix2/core.py", line 100, in parse
    obj = dict_to_stix2(obj, allow_custom, version)
  File "/usr/local/lib/python2.7/dist-packages/stix2/core.py", line 147, in dict_to_stix2
    return obj_class(allow_custom=allow_custom, **stix_dict)
  File "/usr/local/lib/python2.7/dist-packages/stix2/core.py", line 68, in __init__
    super(Bundle, self).__init__(**kwargs)
  File "/usr/local/lib/python2.7/dist-packages/stix2/base.py", line 160, in __init__
    self._check_property(prop_name, prop_metadata, setting_kwargs)
  File "/usr/local/lib/python2.7/dist-packages/stix2/base.py", line 93, in _check_property
    raise InvalidValueError(self.__class__, prop_name, reason=str(exc))
stix2.exceptions.InvalidValueError: Invalid value for Bundle 'objects': Invalid value for Indicator 'pattern': FAIL: Error found at line 1:1. extraneous input '"' expecting {IdentifierWithoutHyphen, IdentifierWithHyphen, '('}

[rpiazza]

Hi @sgmnt-qzh

Is it possible to get more detail on this error. Maybe send us the file which caused the problem?? Thanks!!

[sgmnt-qzh]

Thanks for answer! This 2 files in archive for example.

Reports_Fin.zip

[rpiazza]

Hi @sgmnt-qzh

I ran Report.json, and notice that there were several typos that is causing the slider to fail.

• in the patterns, you have the following text: "[\"domain-name:value = 'mail.ru'\"]". The escaped double quotes are causing a problem. They are not necessary, and make the pattern invalid. Was there a reason you thought you needed them? This is the case with most of the patterns in the file
• in other patterns, you specify the hash algorithm using values that are slightly wrong due to case issues and missing hyphens (-). See the correct literals for hash algorithms in section 7.3 of Part 1 of the STIX specification. This gets a little tricky, because if the hash algorithm name included a hyphen (-), it must be (single) quoted, but otherwise it shouldn't be. So where you had md5 you should have MD5, but there you had sha1 you should have 'SHA-1'

It looks like the other file has similar issues.

Please correct the typos and see if that fixes the problems.

[rpiazza]

Please reopen if this is still an issue