Skip to content
This repository was archived by the owner on Dec 5, 2025. It is now read-only.

[client] fix handling of None values for externalReferences and killChainPhases (#922) #923

Merged
JeremyCloarec merged 1 commit into from
Jun 20, 2025
Merged

[client] fix handling of None values for externalReferences and killChainPhases (#922) #923

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 20 additions & 5 deletions pycti/utils/opencti_stix2.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -420,7 +420,10 @@ def extract_embedded_relationships(
stix_object["kill_chain_phases"] = self.opencti.get_attribute_in_extension(
"kill_chain_phases", stix_object
)
if "kill_chain_phases" in stix_object:
if (
"kill_chain_phases" in stix_object
and stix_object["kill_chain_phases"] is not None
):
for kill_chain_phase in stix_object["kill_chain_phases"]:
if (
kill_chain_phase["kill_chain_name"] + kill_chain_phase["phase_name"]
Expand Down Expand Up @@ -463,7 +466,10 @@ def extract_embedded_relationships(
"type": kill_chain_phase["entity_type"],
}
kill_chain_phases_ids.append(kill_chain_phase["id"])
elif "x_opencti_kill_chain_phases" in stix_object:
elif (
"x_opencti_kill_chain_phases" in stix_object
and stix_object["x_opencti_kill_chain_phases"] is not None
):
for kill_chain_phase in stix_object["x_opencti_kill_chain_phases"]:
if (
kill_chain_phase["kill_chain_name"] + kill_chain_phase["phase_name"]
Expand Down Expand Up @@ -525,7 +531,10 @@ def extract_embedded_relationships(
"external_references", stix_object
)
)
if "external_references" in stix_object:
if (
"external_references" in stix_object
and stix_object["external_references"] is not None
):
for external_reference in stix_object["external_references"]:
try:
url = (
Expand Down Expand Up @@ -706,7 +715,10 @@ def extract_embedded_relationships(
self.opencti.app_logger.warning(
"Cannot generate external reference"
)
elif "x_opencti_external_references" in stix_object:
elif (
"x_opencti_external_references" in stix_object
and stix_object["x_opencti_external_references"] is not None
):
for external_reference in stix_object["x_opencti_external_references"]:
url = external_reference["url"] if "url" in external_reference else None
source_name = (
Expand Down Expand Up @@ -775,7 +787,10 @@ def extract_embedded_relationships(
granted_refs_ids = self.opencti.get_attribute_in_extension(
"granted_refs", stix_object
)
elif "x_opencti_granted_refs" in stix_object:
elif (
"x_opencti_granted_refs" in stix_object
and stix_object["x_opencti_granted_refs"] is not None
):
granted_refs_ids = stix_object["x_opencti_granted_refs"]
# Sample refs
sample_refs_ids = (
Expand Down
4 changes: 2 additions & 2 deletions pycti/utils/opencti_stix2_splitter.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,7 +123,7 @@ def enlist_element(
else:
item[key] = None
# Case for embedded elements (deduplicating and cleanup)
elif key == "external_references":
elif key == "external_references" and item[key] is not None:
# specific case of splitting external references
# reference_ids = []
deduplicated_references = []
Expand All @@ -149,7 +149,7 @@ def enlist_element(
# reference_ids.append(reference_id)
# nb_deps += self.enlist_element(reference_id, raw_data)
item[key] = deduplicated_references
elif key == "kill_chain_phases":
elif key == "kill_chain_phases" and item[key] is not None:
# specific case of splitting kill_chain phases
# kill_chain_ids = []
deduplicated_kill_chain = []
Expand Down