Bug: Conversion to STIX2 does not take into account to_ids flag set in objects when creating indicators

[cudeso]

MISP-STIX usage

Integration for Sentinel

Expected behavior

Only have those attributes of an object that have the to_ids flag set to true included in the pattern of the STIX indicator.

Actual behavior

All attributes of an object are included in the conversion, regardless of to_ids flag.

Steps to reproduce

Example with the file object.

If the attribute "filename" is added to the object, but with the to_ids flag set to False then it is still included in the STIX indicator pattern.

Version

2.4.172

Python version

3.8

Relevant log output

No response

Extra attachments

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[chrisr3d]

That is something we've been discussing for a long time with @iglocska
The idea would be:

• generate an indicator with the attribute having an ids flag
• generate an observed data with either all the attributes or only the attribute with no ids flag
• both referencing each other

Will have a look at it to define what I will do with the different fields (comment, UUID, tags, galaxies, etc.)

[cudeso]

Thank you!

I ran into this when uploading indicators in STIX format to Sentinel. The current STIX implementation of Sentinel only accepts indicators (not observations). It was a bit confusing to see indicators with to_ids false (those part of an object) appearing in the Sentinel TI tables.

[SYNchroACK]

• generate an observed data with either all the attributes or only the attribute with no ids flag

@chrisr3d I guess you meant, generate observables objects and associate them to the report object.

I believe, Observed Data object serves a different goal.

[cudeso]

Bump.
Are there any plans on ensuring only attributes with to_ids, which are part of objects, are included in indicator types?
Currently when there's for example a file object with MD5/SHA1 hashes (to_ids:True), but also has a link to a VirusTotal analysis and VT detection score this gets translated into the below pattern, which makes no sense at all for detection/logging purposes.

"description": "Malicious PDF file leading to a phishing website",
"pattern": "[file
.MD5 = '0cb80a67c180a366fbe1408d6cdb93f8' AND file
.SHA1 = 'db2f04c9c1a434a2c5651e5474ecab934e91f6ff' AND file
.SHA256 = '2b0ad69d0adf653324eb9f64cb3e12ef37a856008a29acd719db504825b66e9c' AND file
.SSDEEP = '6144:OiM09lIS1uDVv18x2pipTUleKgj7G0bByS
+TUK+0NyS' AND file
 = 'EduGrant1209337.pdf' AND file
 = '278444' AND file
 = 't1c544235aae4af9ecc3435afb6b7d344b36bf727130ca50824c7d85c38b41864d46792a' AND file
 = '1 \\ 60' AND file
 = '{\'type\': \'Adobe Portable Document Format\', \'probability\': 100.0, \'first_scan\': \'2023-09-04 07:50:55\'}' AND file
 = 'https://www.virustotal.com/gui/file/2b0ad69d0adf653324eb9f64cb3e12ef37a856008a29acd719db504825b66e9c']",