Skip to content

Commit 937d0ce

Browse files
committed
add context information
1 parent a0dcf82 commit 937d0ce

2 files changed

Lines changed: 11 additions & 3 deletions

File tree

python_catalyst/client.py

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -540,6 +540,7 @@ def create_report_from_member_content_with_references(
540540
content_id = content.get("id")
541541
slug = content.get("slug", "") # noqa: F841
542542
tlp = content.get("tlp", TLPLevel.CLEAR.value)
543+
topics = content.get("topics", [])
543544
self.converter = self.get_stix_converter(tlp)
544545

545546
if published_on:
@@ -559,6 +560,9 @@ def create_report_from_member_content_with_references(
559560
labels.append(content["category"])
560561
if content.get("sub_category") and content["sub_category"].get("name"):
561562
labels.append(content["sub_category"]["name"])
563+
if len(topics) > 0:
564+
for topic in topics:
565+
labels.append(topic["name"])
562566

563567
report_id = (
564568
f"report--{str(uuid.uuid5(uuid.NAMESPACE_URL, f'catalyst-{content_id}'))}"
@@ -618,14 +622,15 @@ def create_report_from_member_content_with_references(
618622
entity_id = observable.get("id")
619623
entity_value = observable.get("value")
620624
entity_type = observable.get("type")
621-
625+
entity_context = observable.get("context", "")
622626
if entity_id and entity_value and entity_type:
623627
observable_data = {
624628
"id": entity_id,
625629
"value": entity_value,
626630
"type": entity_type,
627631
"post_id": content_id,
628632
"tlp_marking": content_marking,
633+
"context": entity_context,
629634
}
630635

631636
(

python_catalyst/stix_converter.py

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -696,7 +696,6 @@ def create_threat_actor(
696696
Returns:
697697
STIX Threat Actor object
698698
"""
699-
print(context)
700699
external_references = []
701700
if report_reference:
702701
external_references = [report_reference]
@@ -1097,11 +1096,15 @@ def create_indicator_from_observable(
10971096
marking_ref = tlp_marking.id if tlp_marking else self.tlp_marking.id
10981097

10991098
created_by_ref = self.get_created_by_ref()
1099+
description = f"Indicator for {observable_type}: {value}"
1100+
if "context" in observable_data:
1101+
ctx = observable_data["context"]
1102+
description = f"{description}\n\n{ctx}"
11001103

11011104
return stix2.Indicator(
11021105
id=indicator_id,
11031106
name=indicator_name,
1104-
description=f"Indicator for {observable_type}: {value}",
1107+
description=description,
11051108
pattern=pattern,
11061109
pattern_type="stix",
11071110
created_by_ref=created_by_ref,

0 commit comments

Comments
 (0)