search

opencybersecurityalliance / stix-shifter

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.
https://stix-shifter.readthedocs.io
Other
229 stars 233 forks source link

Some modules produce an "id" property in their to_stix_mapping, but it's a reserved property #783

Closed pcoccoli closed 2 years ago

pcoccoli commented 2 years ago

Describe the bug In 2.1, every SCO has an id property (just like SDOs), so you can't map a native field to <sco_type>.id.

To Reproduce In the source tree, run a command like find stix_shifter_modules/ -name "*to_stix_map.json" -exec grep -Hne '\.id"' {} \;

Output should be tested with stix2_validator (https://github.com/oasis-open/cti-stix-validator)

Expected behavior If these native IDs need to be mapped, the modules should either use (deprecated) custom properties (see https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_p2sz1mp7z524) or extension definitions (https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_32j232tfvtly)

Screenshots

$ find stix_shifter_modules/ -name "*to_stix_map.json" -exec grep -Hne '\.id"' {} \;
stix_shifter_modules/async_dummy/stix_translation/json/to_stix_map.json:111:        "key": "process.id"
stix_shifter_modules/elastic_ecs/stix_translation/json/stix_2_1/to_stix_map.json:635:      "key": "x-oca-event.id",
stix_shifter_modules/elastic_ecs/stix_translation/json/stix_2_1/to_stix_map.json:1039:        "key": "x-ecs-user.id",
stix_shifter_modules/elastic_ecs/stix_translation/json/stix_2_1/to_stix_map.json:1127:      "key": "x-ecs-container.id",
stix_shifter_modules/elastic_ecs/stix_translation/json/stix_2_1/to_stix_map.json:1328:      "key": "x-ecs-error.id",
stix_shifter_modules/elastic_ecs/stix_translation/json/stix_2_1/to_stix_map.json:1501:      "key": "x-ecs-group.id",
stix_shifter_modules/elastic_ecs/stix_translation/json/stix_2_1/to_stix_map.json:1530:      "key": "x-oca-asset.id",
stix_shifter_modules/elastic_ecs/stix_translation/json/stix_2_1/to_stix_map.json:1928:      "key": "x-ecs-organization.id",
stix_shifter_modules/elastic_ecs/stix_translation/json/stix_2_1/to_stix_map.json:2021:      "key": "x-ecs-rule.id",
stix_shifter_modules/elastic_ecs/stix_translation/json/stix_2_1/to_stix_map.json:2051:      "key": "x-ecs-service.id",
stix_shifter_modules/elastic_ecs/stix_translation/json/stix_2_1/to_stix_map.json:2239:      "key": "x-ecs-trace.id",
stix_shifter_modules/elastic_ecs/stix_translation/json/stix_2_1/to_stix_map.json:2245:      "key": "x-ecs-transaction.id",
stix_shifter_modules/elastic_ecs/stix_translation/json/stix_2_1/to_stix_map.json:2287:      "key": "x-ecs-vulnerability.id",
stix_shifter_modules/elastic_ecs/stix_translation/json/to_stix_map.json:635:      "key": "x-oca-event.id",
stix_shifter_modules/elastic_ecs/stix_translation/json/to_stix_map.json:1067:        "key": "x-ecs-user.id",
stix_shifter_modules/elastic_ecs/stix_translation/json/to_stix_map.json:1155:      "key": "x-ecs-container.id",
stix_shifter_modules/elastic_ecs/stix_translation/json/to_stix_map.json:1356:      "key": "x-ecs-error.id",
stix_shifter_modules/elastic_ecs/stix_translation/json/to_stix_map.json:1529:      "key": "x-ecs-group.id",
stix_shifter_modules/elastic_ecs/stix_translation/json/to_stix_map.json:1558:      "key": "x-oca-asset.id",
stix_shifter_modules/elastic_ecs/stix_translation/json/to_stix_map.json:1956:      "key": "x-ecs-organization.id",
stix_shifter_modules/elastic_ecs/stix_translation/json/to_stix_map.json:2049:      "key": "x-ecs-rule.id",
stix_shifter_modules/elastic_ecs/stix_translation/json/to_stix_map.json:2079:      "key": "x-ecs-service.id",
stix_shifter_modules/elastic_ecs/stix_translation/json/to_stix_map.json:2267:      "key": "x-ecs-trace.id",
stix_shifter_modules/elastic_ecs/stix_translation/json/to_stix_map.json:2273:      "key": "x-ecs-transaction.id",
stix_shifter_modules/elastic_ecs/stix_translation/json/to_stix_map.json:2315:      "key": "x-ecs-vulnerability.id",
stix_shifter_modules/guardium/stix_translation/json/to_stix_map.json:207:        "key": "process.id"
stix_shifter_modules/security_advisor/stix_translation/json/to_stix_map.json:50:    "key": "x-security-advisor-finding.id",
stix_shifter_modules/synchronous_dummy/stix_translation/json/to_stix_map.json:111:        "key": "process.id"
stix_shifter_modules/infoblox/stix_translation/json/to_stix_map.json:272:                "key": "x-infoblox-threat.id",

Desktop (please complete the following information): N/A

Smartphone (please complete the following information): N/A

Additional context N/A

delliott90 commented 2 years ago

Resolved via https://github.com/opencybersecurityalliance/stix-shifter/pull/819