From 9bacd00d62804d8b5c4cb2ea76c83f7eb58a8895 Mon Sep 17 00:00:00 2001 From: Samuel Hassine Date: Thu, 12 Jan 2023 01:08:02 +0100 Subject: [PATCH] [misp] Fix TLP AMBER + STRICT --- external-import/misp-feed/src/misp-feed.py | 3 +++ external-import/misp/src/misp.py | 3 +++ 2 files changed, 6 insertions(+) diff --git a/external-import/misp-feed/src/misp-feed.py b/external-import/misp-feed/src/misp-feed.py index 3e50f9f86d..a0ac03a7df 100644 --- a/external-import/misp-feed/src/misp-feed.py +++ b/external-import/misp-feed/src/misp-feed.py @@ -263,6 +263,8 @@ def _resolve_markings(self, tags, with_default=True): markings.append(stix2.TLP_GREEN) if tag["name"] == "tlp:amber": markings.append(stix2.TLP_AMBER) + if tag["name"] == "tlp:amber+strict": + markings.append(stix2.TLP_AMBER) if tag["name"] == "tlp:red": markings.append(stix2.TLP_RED) if len(markings) == 0 and with_default: @@ -574,6 +576,7 @@ def _resolve_tags(self, tags): tag["name"] != "tlp:white" and tag["name"] != "tlp:green" and tag["name"] != "tlp:amber" + and tag["name"] != "tlp:amber+strict" and tag["name"] != "tlp:red" and not tag["name"].startswith("misp-galaxy:threat-actor") and not tag["name"].startswith("misp-galaxy:mitre-threat-actor") diff --git a/external-import/misp/src/misp.py b/external-import/misp/src/misp.py index 179d6bd2d1..e5edc194a7 100644 --- a/external-import/misp/src/misp.py +++ b/external-import/misp/src/misp.py @@ -2022,6 +2022,8 @@ def resolve_markings(self, tags, with_default=True): markings.append(stix2.TLP_GREEN) if tag["name"] == "tlp:amber": markings.append(stix2.TLP_AMBER) + if tag["name"] == "tlp:amber+strict": + markings.append(stix2.TLP_AMBER) if tag["name"] == "tlp:red": markings.append(stix2.TLP_RED) if len(markings) == 0 and with_default: @@ -2039,6 +2041,7 @@ def resolve_tags(self, tags): tag["name"] != "tlp:white" and tag["name"] != "tlp:green" and tag["name"] != "tlp:amber" + and tag["name"] != "tlp:amber+strict" and tag["name"] != "tlp:red" and not tag["name"].startswith("misp-galaxy:threat-actor") and not tag["name"].startswith("misp-galaxy:mitre-threat-actor")