search

opencybersecurityalliance / stix-shifter

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.
https://stix-shifter.readthedocs.io
Other
229 stars 233 forks source link

stix-shifter is breaking on stix2-patterns 1.2.0 #208

Closed delliott90 closed 4 years ago

delliott90 commented 4 years ago

Describe the bug The CTI Pattern Validator project was updated a few days ago from 1.1.0 to 1.2.0. https://github.com/oasis-open/cti-pattern-validator/releases/tag/v1.2.0 This is causing the following error ModuleNotFoundError: No module named 'stix2patterns.pattern' This can be reproduced by running a translation command from the CLI or by just running pytest

To Reproduce Steps to reproduce the behavior:

  1. Create a python virtual environment from the current requirements.txt
  2. Run a translation command from the CLI, for instance python main.py translate msatp query '{}' "[ipv4-addr:value = '127.0.0.1']"
  3. See error

Expected behavior There shouldn't be an error and the pattern should be successfully translated.

Additional context As a quick fix, we may need to just lock the stix2-patterns version to 1.1.0 until we can figure out what's going on.

JasonKeirstead commented 4 years ago

@delliott90 Unless we're prepared to support STIX 2.1 (which I am unsure if we ware?) we should likely reference explicitly 1.1.0

delliott90 commented 4 years ago

The newer version of stix2-patterns has the fix for qualifier timestamps. The timestamp format we use for START STOP isn't a 2.1 feature, but it was never supported in the older version of the pattern validator.

mdazam1942 commented 4 years ago

Importing stix2patterns.pattern throws exception as the location of pattern is moved in the latest tag version of stix2-patterns==1.2.0.I have created an issue in cti-stix-validator

Until they verify and/or fix the issue we can explicitly set the versions for both pattern and stix validator package,

mdazam1942 commented 4 years ago

This is fixed now. They have released a new patch of stix2patterns to fix backwards compatibility issue.