From 81971f28c0e94aeced6c6a232824c2cec058b559 Mon Sep 17 00:00:00 2001 From: Julien Richard Date: Wed, 8 Oct 2025 19:55:10 +0200 Subject: [PATCH] [client] New OpenCTI capability "manage taxonomy" prevents creating data (#985) --- pycti/entities/opencti_vocabulary.py | 2 +- pycti/utils/opencti_stix2.py | 18 ++++++++++++------ 2 files changed, 13 insertions(+), 7 deletions(-) diff --git a/pycti/entities/opencti_vocabulary.py b/pycti/entities/opencti_vocabulary.py index c0951a08b..dc090300a 100644 --- a/pycti/entities/opencti_vocabulary.py +++ b/pycti/entities/opencti_vocabulary.py @@ -95,7 +95,7 @@ def read(self, **kwargs): ) return None - def handle_vocab(self, vocab, cache, field): + def read_or_create_unchecked_with_cache(self, vocab, cache, field): if "vocab_" + vocab in cache: vocab_data = cache["vocab_" + vocab] else: diff --git a/pycti/utils/opencti_stix2.py b/pycti/utils/opencti_stix2.py index 93a014567..d3bd5b50b 100644 --- a/pycti/utils/opencti_stix2.py +++ b/pycti/utils/opencti_stix2.py @@ -360,17 +360,23 @@ def extract_embedded_relationships( if isinstance(stix_object.get(f["key"]), list): object_open_vocabularies[f["key"]] = [] for vocab in stix_object[f["key"]]: - object_open_vocabularies[f["key"]].append( - self.opencti.vocabulary.handle_vocab( + resolved_vocab = ( + self.opencti.vocabulary.read_or_create_unchecked_with_cache( vocab, self.mapping_cache_permanent, field=f - )["name"] + ) ) + if resolved_vocab is not None: + object_open_vocabularies[f["key"]].append( + resolved_vocab["name"] + ) else: - object_open_vocabularies[f["key"]] = ( - self.opencti.vocabulary.handle_vocab( + resolved_vocab = ( + self.opencti.vocabulary.read_or_create_unchecked_with_cache( stix_object[f["key"]], self.mapping_cache_permanent, field=f - )["name"] + ) ) + if resolved_vocab is not None: + object_open_vocabularies[f["key"]] = resolved_vocab["name"] # Object Labels object_label_ids = []