From ff95147ee2440e5b1d9589c5cb260ee272060d3a Mon Sep 17 00:00:00 2001 From: Jeremy Cloarec Date: Thu, 24 Apr 2025 11:42:52 +0200 Subject: [PATCH 1/3] [client] now use internal id when possible for patch operations --- pycti/utils/opencti_stix2.py | 28 ++++++++++++++++++++++------ 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/pycti/utils/opencti_stix2.py b/pycti/utils/opencti_stix2.py index 252335560..6f629a5a4 100644 --- a/pycti/utils/opencti_stix2.py +++ b/pycti/utils/opencti_stix2.py @@ -2418,6 +2418,13 @@ def apply_patch_files(self, item): field_patch_files = next( (op for op in field_patch if op["key"] == "x_opencti_files"), None ) + item_id = self.opencti.get_attribute_in_extension( + "id", item + ) + worker_logger = self.opencti.logger_class("worker") + worker_logger.warning("id found: " + item_id) + if item_id is None: + item_id = item["id"] do_add_file = self.opencti.stix_domain_object.add_file if StixCyberObservableTypes.has_value(item["type"]): do_add_file = self.opencti.stix_cyber_observable.add_file @@ -2427,7 +2434,7 @@ def apply_patch_files(self, item): for file in field_patch_files["value"]: if "data" in file: do_add_file( - id=item["id"], + id=item_id, file_name=file["name"], version=file.get("version", None), data=base64.b64decode(file["data"]), @@ -2445,26 +2452,31 @@ def apply_patch(self, item): field_patch_without_files = [ op for op in field_patch if op["key"] != "x_opencti_files" ] + item_id = self.opencti.get_attribute_in_extension( + "id", item + ) + if item_id is None: + item_id = item["id"] if len(field_patch_without_files) > 0: if item["type"] == "relationship": self.opencti.stix_core_relationship.update_field( - id=item["id"], input=field_patch_without_files + id=item_id, input=field_patch_without_files ) elif item["type"] == "sighting": self.opencti.stix_sighting_relationship.update_field( - id=item["id"], input=field_patch_without_files + id=item_id, input=field_patch_without_files ) elif StixCyberObservableTypes.has_value(item["type"]): self.opencti.stix_cyber_observable.update_field( - id=item["id"], input=field_patch_without_files + id=item_id, input=field_patch_without_files ) elif item["type"] == "external-reference": self.opencti.external_reference.update_field( - id=item["id"], input=field_patch_without_files + id=item_id, input=field_patch_without_files ) else: self.opencti.stix_domain_object.update_field( - id=item["id"], input=field_patch_without_files + id=item_id, input=field_patch_without_files ) self.apply_patch_files(item) @@ -2707,6 +2719,10 @@ def import_item( # Platform does not know what to do and raises an error: # That also works for missing reference with too much execution else: + worker_logger.error( + "Message reprocess for bad gateway", + {"count": processing_count}, + ) bundles_technical_error_counter.add(1) if work_id is not None: item_str = json.dumps(item) From e6f9a8d98850579ad95e31ba8576b940bfb40e71 Mon Sep 17 00:00:00 2001 From: Jeremy Cloarec Date: Thu, 24 Apr 2025 12:09:45 +0200 Subject: [PATCH 2/3] [client] now use internal id when possible for patch operations --- pycti/utils/opencti_stix2.py | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) diff --git a/pycti/utils/opencti_stix2.py b/pycti/utils/opencti_stix2.py index 6f629a5a4..666ac797e 100644 --- a/pycti/utils/opencti_stix2.py +++ b/pycti/utils/opencti_stix2.py @@ -2418,11 +2418,8 @@ def apply_patch_files(self, item): field_patch_files = next( (op for op in field_patch if op["key"] == "x_opencti_files"), None ) - item_id = self.opencti.get_attribute_in_extension( - "id", item - ) + item_id = self.opencti.get_attribute_in_extension("id", item) worker_logger = self.opencti.logger_class("worker") - worker_logger.warning("id found: " + item_id) if item_id is None: item_id = item["id"] do_add_file = self.opencti.stix_domain_object.add_file @@ -2452,9 +2449,7 @@ def apply_patch(self, item): field_patch_without_files = [ op for op in field_patch if op["key"] != "x_opencti_files" ] - item_id = self.opencti.get_attribute_in_extension( - "id", item - ) + item_id = self.opencti.get_attribute_in_extension("id", item) if item_id is None: item_id = item["id"] if len(field_patch_without_files) > 0: @@ -2719,10 +2714,6 @@ def import_item( # Platform does not know what to do and raises an error: # That also works for missing reference with too much execution else: - worker_logger.error( - "Message reprocess for bad gateway", - {"count": processing_count}, - ) bundles_technical_error_counter.add(1) if work_id is not None: item_str = json.dumps(item) From 7a92ef2e0dc2c34fd48f979613fa064e8346eed4 Mon Sep 17 00:00:00 2001 From: Jeremy Cloarec Date: Thu, 24 Apr 2025 12:39:42 +0200 Subject: [PATCH 3/3] [client] linter fix --- pycti/utils/opencti_stix2.py | 1 - 1 file changed, 1 deletion(-) diff --git a/pycti/utils/opencti_stix2.py b/pycti/utils/opencti_stix2.py index 666ac797e..a303844c3 100644 --- a/pycti/utils/opencti_stix2.py +++ b/pycti/utils/opencti_stix2.py @@ -2419,7 +2419,6 @@ def apply_patch_files(self, item): (op for op in field_patch if op["key"] == "x_opencti_files"), None ) item_id = self.opencti.get_attribute_in_extension("id", item) - worker_logger = self.opencti.logger_class("worker") if item_id is None: item_id = item["id"] do_add_file = self.opencti.stix_domain_object.add_file