diff --git a/pycti/entities/opencti_stix_cyber_observable.py b/pycti/entities/opencti_stix_cyber_observable.py index cb69cece1..d0c1b794e 100644 --- a/pycti/entities/opencti_stix_cyber_observable.py +++ b/pycti/entities/opencti_stix_cyber_observable.py @@ -809,6 +809,18 @@ def create(self, **kwargs): ), } elif type == "Software": + if ( + "x_opencti_product" not in observable_data + and self.opencti.get_attribute_in_extension( + "x_opencti_product", observable_data + ) + is not None + ): + observable_data["x_opencti_product"] = ( + self.opencti.get_attribute_in_extension( + "x_opencti_product", observable_data + ) + ) input_variables["Software"] = { "name": ( observable_data["name"] if "name" in observable_data else None @@ -832,6 +844,11 @@ def create(self, **kwargs): if "version" in observable_data else None ), + "x_opencti_product": ( + observable_data["x_opencti_product"] + if "x_opencti_product" in observable_data + else None + ), } elif type == "Url": input_variables["Url"] = { diff --git a/pycti/entities/opencti_vulnerability.py b/pycti/entities/opencti_vulnerability.py index b9b118012..2d6a55d05 100644 --- a/pycti/entities/opencti_vulnerability.py +++ b/pycti/entities/opencti_vulnerability.py @@ -150,6 +150,7 @@ def __init__(self, opencti): x_opencti_cvss_v4_availability_impact_s x_opencti_cvss_v4_exploit_maturity x_opencti_cwe + x_opencti_first_seen_active x_opencti_cisa_kev x_opencti_epss_score x_opencti_epss_percentile @@ -452,6 +453,7 @@ def create(self, **kwargs): x_opencti_epss_score = kwargs.get("x_opencti_epss_score", None) x_opencti_epss_percentile = kwargs.get("x_opencti_epss_percentile", None) x_opencti_score = kwargs.get("x_opencti_score", None) + x_opencti_first_seen_active = kwargs.get("x_opencti_first_seen_active", None) x_opencti_stix_ids = kwargs.get("x_opencti_stix_ids", None) granted_refs = kwargs.get("objectOrganization", None) x_opencti_workflow_id = kwargs.get("x_opencti_workflow_id", None) @@ -538,6 +540,7 @@ def create(self, **kwargs): "x_opencti_epss_score": x_opencti_epss_score, "x_opencti_epss_percentile": x_opencti_epss_percentile, "x_opencti_score": x_opencti_score, + "x_opencti_first_seen_active": x_opencti_first_seen_active, "x_opencti_stix_ids": x_opencti_stix_ids, "x_opencti_workflow_id": x_opencti_workflow_id, "update": update, @@ -867,6 +870,12 @@ def import_from_stix2(self, **kwargs): stix_object["x_opencti_score"] = ( self.opencti.get_attribute_in_extension("score", stix_object) ) + if "x_opencti_first_seen_active" not in stix_object: + stix_object["x_opencti_first_seen_active"] = ( + self.opencti.get_attribute_in_extension( + "first_seen_active", stix_object + ) + ) return self.create( stix_id=stix_object["id"], @@ -1158,6 +1167,11 @@ def import_from_stix2(self, **kwargs): if "x_opencti_score" in stix_object else None ), + x_opencti_first_seen_active=( + stix_object["x_opencti_first_seen_active"] + if "x_opencti_first_seen_active" in stix_object + else None + ), update=update, ) else: diff --git a/pycti/entities/stix_cyber_observable/opencti_stix_cyber_observable_properties.py b/pycti/entities/stix_cyber_observable/opencti_stix_cyber_observable_properties.py index 70f95a289..176de35f7 100644 --- a/pycti/entities/stix_cyber_observable/opencti_stix_cyber_observable_properties.py +++ b/pycti/entities/stix_cyber_observable/opencti_stix_cyber_observable_properties.py @@ -215,6 +215,7 @@ languages vendor version + x_opencti_product } ... on Url { value @@ -519,6 +520,7 @@ languages vendor version + x_opencti_product } ... on Url { value