[all] Allow custom entities in relationships

OpenCTI-Platform · Nov 29, 2021 · 3a03f85 · 3a03f85
1 parent 819d547
commit 3a03f85
Show file tree

Hide file tree

Showing 9 changed files with 43 additions and 4 deletions.
diff --git a/external-import/alienvault/src/alienvault/utils/__init__.py b/external-import/alienvault/src/alienvault/utils/__init__.py
@@ -358,6 +358,7 @@ def create_relationship(
         stop_time=stop_time,
         confidence=confidence,
         object_marking_refs=object_markings,
+        allow_custom=True,
     )
 
 

diff --git a/external-import/cape/src/cape/telemetry.py b/external-import/cape/src/cape/telemetry.py
@@ -139,7 +139,10 @@ def createDNSObs(self, DNSOBJ):
                 value=host.domain
             )  # , resolves_to_refs=IP.id) ref https://github.com/OpenCTI-Platform/client-python/issues/155
             Rel = Relationship(
-                source_ref=DNS.id, target_ref=IP.id, relationship_type="resolves-to"
+                source_ref=DNS.id,
+                target_ref=IP.id,
+                relationship_type="resolves-to",
+                allow_custom=True,
             )
 
             if self.CreateIndicator:
@@ -304,7 +307,10 @@ def createPrimaryBinary(self, file: cuckooTarget, external_references):
         )
 
         rel = Relationship(
-            source_ref=Filex.id, relationship_type="based-on", target_ref=ind.id
+            source_ref=Filex.id,
+            relationship_type="based-on",
+            target_ref=ind.id,
+            allow_custom=True,
         )
 
         return [Filex, ind, rel]
@@ -565,6 +571,7 @@ def processAndSubmit(self):
                             relationship_type="related-to",
                             source_ref=payload[0].id,
                             target_ref=IDx,
+                            allow_custom=True,
                         )
                     )
             for ATP in AttackPatterns:
@@ -573,6 +580,7 @@ def processAndSubmit(self):
                         relationship_type="related-to",
                         source_ref=payload[0].id,
                         target_ref=ATP["standard_id"],
+                        allow_custom=True,
                     )
                 )
             if Malware:
@@ -585,6 +593,7 @@ def processAndSubmit(self):
                     relationship_type="related-to",
                     source_ref=payload[0].id,
                     target_ref=ID,
+                    allow_custom=True,
                 )
 
             IDs.append(payload[0])  # Add Observeable

diff --git a/external-import/crowdstrike/src/crowdstrike/utils/__init__.py b/external-import/crowdstrike/src/crowdstrike/utils/__init__.py
@@ -609,6 +609,7 @@ def create_relationship(
         stop_time=stop_time,
         confidence=confidence,
         object_marking_refs=object_markings,
+        allow_custom=True,
     )
 
 

diff --git a/external-import/cuckoo/src/cuckoo/telemetry.py b/external-import/cuckoo/src/cuckoo/telemetry.py
@@ -112,7 +112,10 @@ def createDNSObs(self, DNSOBJ):
                 value=host["domain"]
             )  # , resolves_to_refs=IP.id) ref https://github.com/OpenCTI-Platform/client-python/issues/155
             Rel = Relationship(
-                source_ref=DNS.id, target_ref=IP.id, relationship_type="resolves-to"
+                source_ref=DNS.id,
+                target_ref=IP.id,
+                relationship_type="resolves-to",
+                allow_custom=True,
             )
 
             if self.CreateIndicator:
@@ -210,7 +213,10 @@ def createPrimaryBinary(self, file: cuckooReportDropped, external_references):
         )
 
         rel = Relationship(
-            source_ref=Filex.id, relationship_type="based-on", target_ref=ind.id
+            source_ref=Filex.id,
+            relationship_type="based-on",
+            target_ref=ind.id,
+            allow_custom=True,
         )
 
         return [Filex, ind, rel]
@@ -437,6 +443,7 @@ def processAndSubmit(self):
                     relationship_type="related-to",
                     source_ref=payload[0].id,
                     target_ref=IDx,
+                    allow_custom=True,
                 )
             )
         for ATP in AttackPatterns:
@@ -445,6 +452,7 @@ def processAndSubmit(self):
                     relationship_type="related-to",
                     source_ref=payload[0].id,
                     target_ref=ATP,
+                    allow_custom=True,
                 )
             )
         IDs.append(payload[0])  # Add Observeable

diff --git a/external-import/cyber-threat-coalition/src/cyber-threat-coalition.py b/external-import/cyber-threat-coalition/src/cyber-threat-coalition.py
@@ -183,6 +183,7 @@ def fetch_and_send(self):
                                 created_by_ref=organization,
                                 source_ref=indicator.id,
                                 target_ref=observable.id,
+                                allow_custom=True,
                             )
                             bundle_objects.append(relationship)
                             report_object_refs.append(relationship["id"])

diff --git a/external-import/cybercrime-tracker/src/cybercrime-tracker.py b/external-import/cybercrime-tracker/src/cybercrime-tracker.py
@@ -252,6 +252,7 @@ def run(self):
                                     created=parsed_entry["date"],
                                     modified=parsed_entry["date"],
                                     external_references=[external_reference],
+                                    allow_custom=True,
                                 )
                                 bundle_objects.append(relation)
                             if self.create_observables:
@@ -303,6 +304,7 @@ def run(self):
                                         created_by_ref=organization.id,
                                         source_ref=indicator.id,
                                         target_ref=observable_url.id,
+                                        allow_custom=True,
                                     )
                                     bundle_objects.append(relationship_1)
                                     relationship_2 = stix2.Relationship(
@@ -313,6 +315,7 @@ def run(self):
                                         created_by_ref=organization.id,
                                         source_ref=indicator.id,
                                         target_ref=observable_ip.id,
+                                        allow_custom=True,
                                     )
                                     bundle_objects.append(relationship_2)
                                     if observable_domain is not None:
@@ -324,6 +327,7 @@ def run(self):
                                             created_by_ref=organization.id,
                                             source_ref=indicator.id,
                                             target_ref=observable_domain.id,
+                                            allow_custom=True,
                                         )
                                         bundle_objects.append(relationship_3)
 

diff --git a/external-import/kaspersky/src/kaspersky/utils/stix2.py b/external-import/kaspersky/src/kaspersky/utils/stix2.py
@@ -412,6 +412,7 @@ def create_relationship(
         stop_time=stop_time,
         confidence=confidence,
         object_marking_refs=object_markings,
+        allow_custom=True,
     )
 
 

diff --git a/external-import/misp/src/misp.py b/external-import/misp/src/misp.py
@@ -593,6 +593,7 @@ def process_events(self, work_id, events):
                                     + ref["comment"],
                                     source_ref=src_result["entity"]["id"],
                                     target_ref=target_result["entity"]["id"],
+                                    allow_custom=True,
                                 )
                             )
             # Add object_relationships
@@ -886,6 +887,7 @@ def process_attribute(
                         created_by_ref=author,
                         source_ref=indicator.id,
                         target_ref=observable.id,
+                        allow_custom=True,
                     )
                 )
             ### Create relationship between MISP attribute (indicator or observable) and MISP object (observable)
@@ -901,6 +903,7 @@ def process_attribute(
                         target_ref=observable.id
                         if (observable is not None)
                         else indicator.id,
+                        allow_custom=True,
                     )
                 )
             # Event threats
@@ -924,6 +927,7 @@ def process_attribute(
                             description=attribute["comment"],
                             object_marking_refs=attribute_markings,
                             confidence=self.helper.connect_confidence_level,
+                            allow_custom=True,
                         )
                     )
                 if observable is not None:
@@ -939,6 +943,7 @@ def process_attribute(
                             description=attribute["comment"],
                             object_marking_refs=attribute_markings,
                             confidence=self.helper.connect_confidence_level,
+                            allow_custom=True,
                         )
                     )
 
@@ -965,6 +970,7 @@ def process_attribute(
                             description=attribute["comment"],
                             object_marking_refs=attribute_markings,
                             confidence=self.helper.connect_confidence_level,
+                            allow_custom=True,
                         )
                     )
                 if observable is not None:
@@ -980,6 +986,7 @@ def process_attribute(
                             description=attribute["comment"],
                             object_marking_refs=attribute_markings,
                             confidence=self.helper.connect_confidence_level,
+                            allow_custom=True,
                         )
                     )
             # Event Attack Patterns
@@ -1004,6 +1011,7 @@ def process_attribute(
                         description=attribute["comment"],
                         object_marking_refs=attribute_markings,
                         confidence=self.helper.connect_confidence_level,
+                        allow_custom=True,
                     )
                     relationships.append(relationship_uses)
                     # if indicator is not None:
@@ -1057,6 +1065,7 @@ def process_attribute(
                         target_ref=attack_pattern.id,
                         description=attribute["comment"],
                         object_marking_refs=attribute_markings,
+                        allow_custom=True,
                     )
                     relationships.append(relationship_uses)
                     # if indicator is not None:
@@ -1101,6 +1110,7 @@ def process_attribute(
                             description=attribute["comment"],
                             object_marking_refs=attribute_markings,
                             confidence=self.helper.connect_confidence_level,
+                            allow_custom=True,
                         )
                     )
                 if observable is not None:
@@ -1116,6 +1126,7 @@ def process_attribute(
                             description=attribute["comment"],
                             object_marking_refs=attribute_markings,
                             confidence=self.helper.connect_confidence_level,
+                            allow_custom=True,
                         )
                     )
 
@@ -1133,6 +1144,7 @@ def process_attribute(
                             description=attribute["comment"],
                             object_marking_refs=attribute_markings,
                             confidence=self.helper.connect_confidence_level,
+                            allow_custom=True,
                         )
                     )
                 if observable is not None:
@@ -1148,6 +1160,7 @@ def process_attribute(
                             description=attribute["comment"],
                             object_marking_refs=attribute_markings,
                             confidence=self.helper.connect_confidence_level,
+                            allow_custom=True,
                         )
                     )
             return {

diff --git a/external-import/thehive/src/thehive.py b/external-import/thehive/src/thehive.py
@@ -148,6 +148,7 @@ def generate_case_bundle(self, case):
                     source_ref=stix_observable.id,
                     target_ref=incident.id,
                     object_marking_refs=markings,
+                    allow_custom=True,
                 )
                 bundle_objects.append(stix_observable)
                 bundle_objects.append(stix_observable_relation)