search

threatgrid / ctia

Cisco Threat Intelligence API
Eclipse Public License 1.0
69 stars 26 forks source link

Allowed values for the sensor property are not taken into account in CTIA Sightings #818

Closed hshahman closed 5 years ago

hshahman commented 5 years ago

Env: TEST

Based on the CTIM documentations here, the Sensor property should accept only a list of allowed values, but at the moment we can use any strings for that property. Here is an example which I could post a sighting with test value for the Sensor property without getting any error:

[
  {
    "description": "C282888000",
    "schema_version": "1.0.11",
    "observables": [
      {
        "value": "d2ea2110136b18175d394f84aafb5076c72f858244a86322f657df9433b3ea8a",
        "type": "sha256"
      }
    ],
    "type": "sighting",
    "id": "https://private.intel.test.iroh.site:443/ctia/sighting/sighting-c228bd62-d29e-4a8c-bce8-97bff050ad47",
    "count": 1,
    "tlp": "amber",
    "timestamp": "2019-04-29T18:59:02.988Z",
    "confidence": "Unknown",
    "observed_time": {
      "start_time": "2019-04-29T18:59:02.366Z",
      "end_time": "2019-04-29T18:59:02.366Z"
    },
    "sensor": "test"
  }
]
msprunck commented 5 years ago

The sensor property is an open vocabulary defined in CTIM here https://github.com/threatgrid/ctim/blob/master/src/ctim/schemas/vocabularies.cljc#L385. There is no restriction on its value, only suggestions.

hshahman commented 5 years ago

verified in relv1.24