diff --git a/README.md b/README.md
index bec4e4c..e3402aa 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@ Official low-level client for Intel 471's Titan API. It aims at providing common
This Python package is automatically generated by the [OpenAPI Generator](https://openapi-generator.tech) project:
- API version: 1.20.0
-- Package version: 1.20.0.14
+- Package version: 1.20.0.15
- Build package: org.openapitools.codegen.languages.PythonLegacyClientCodegen
## Requirements.
diff --git a/setup.py b/setup.py
index 04ff464..ebb9a7a 100644
--- a/setup.py
+++ b/setup.py
@@ -5,7 +5,7 @@
Official low-level client for Intel 471's Titan API. It aims at providing common ground for all the endpoints in Python.
- The version of the OpenAPI document: 1.20.0.14
+ The version of the OpenAPI document: 1.20.0.15
Generated by: https://openapi-generator.tech
"""
@@ -13,7 +13,7 @@
from setuptools import setup, find_packages # noqa: H301
NAME = "Titan Client"
-VERSION = "1.20.0.14"
+VERSION = "1.20.0.15"
# To install the library, run the following
#
# python setup.py install
diff --git a/test/fixtures/cves_stix.json b/test/fixtures/cves_stix.json
index 5485deb..77406f5 100644
--- a/test/fixtures/cves_stix.json
+++ b/test/fixtures/cves_stix.json
@@ -1,8 +1,8 @@
{
- "id": "bundle--ff3abb6c-7d55-4367-bb06-d80470bf5b5f",
+ "id": "bundle--e9f991c3-fe75-43a9-9762-a0c703198ff0",
"objects": [
{
- "created": "2025-06-09T13:47:35.429129Z",
+ "created": "2025-11-06T14:44:03.72233Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
"description": "CVE-2021-11111 is an out-of-bound write vulnerability.\n\nWeaponization or productization not observed\n\nAcme addressed the vulnerability\n\n### Properties\n\n```yaml\nactivity_location:\n location_opensource: true\n location_private: false\n location_underground: true\nexploit_status:\n available: true\n productized: false\n weaponized: true\ninterest_level:\n disclosed_publicly: true\n exploit_sought: false\n researched_publicly: true\npatch_status: available\n```",
"external_references": [
@@ -25,7 +25,7 @@
"Intel 471 - GIR 1.0.1",
"Intel 471 - GIR 1.0.2"
],
- "modified": "2025-06-09T13:47:35.429129Z",
+ "modified": "2025-11-06T14:44:03.72233Z",
"name": "CVE-2021-11111",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
@@ -43,10 +43,13 @@
"vendor": "Acme"
},
{
- "created": "2025-06-09T13:47:35.429704Z",
+ "created": "2025-11-06T14:44:03.722559Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
"id": "relationship--1358bccd-4ccf-5e2a-aafe-340649962df0",
- "modified": "2025-06-09T13:47:35.429704Z",
+ "modified": "2025-11-06T14:44:03.722559Z",
+ "object_marking_refs": [
+ "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
+ ],
"relationship_type": "has",
"source_ref": "software--1f2e88bf-0277-5c4a-bd98-2282c1bfdb23",
"spec_version": "2.1",
diff --git a/test/fixtures/indicators_stix.json b/test/fixtures/indicators_stix.json
index eb69371..0aba8d6 100644
--- a/test/fixtures/indicators_stix.json
+++ b/test/fixtures/indicators_stix.json
@@ -1,37 +1,28 @@
{
- "type": "bundle",
- "id": "bundle--1c63e103-906a-41b4-a48c-fdd094d1b904",
+ "id": "bundle--db320927-9d8b-4e4d-b4c1-67fc06899dc1",
"objects": [
{
- "type": "malware",
- "spec_version": "2.1",
- "id": "malware--5709afa6-1486-5cfe-98fb-205568ec6491",
+ "created": "2025-11-06T14:44:03.698044Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:44:40.436325Z",
- "modified": "2025-06-09T13:44:40.436325Z",
- "name": "fooBar",
+ "id": "malware--5709afa6-1486-5cfe-98fb-205568ec6491",
"is_family": true,
+ "modified": "2025-11-06T14:44:03.698044Z",
+ "name": "fooBar",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
- ]
+ ],
+ "spec_version": "2.1",
+ "type": "malware"
},
{
- "type": "indicator",
- "spec_version": "2.1",
- "id": "indicator--274128a4-2ad4-50b5-ae7b-b0dea1fa9861",
+ "confidence": 50,
+ "created": "2025-11-06T14:44:03.698464Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:44:40.436759Z",
- "modified": "2025-06-09T13:44:40.436759Z",
- "name": "1.2.3.4",
"description": "fooBar controller IPv4",
+ "id": "indicator--274128a4-2ad4-50b5-ae7b-b0dea1fa9861",
"indicator_types": [
"malicious-activity"
],
- "pattern": "[ipv4-addr:value = '1.2.3.4']",
- "pattern_type": "stix",
- "pattern_version": "2.1",
- "valid_from": "2022-06-03T11:36:14Z",
- "valid_until": "2022-07-03T12:17:39Z",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@@ -42,81 +33,87 @@
"fooBar",
"Intel 471 - GIR 0.0.0"
],
- "confidence": 50,
+ "modified": "2025-11-06T14:44:03.698464Z",
+ "name": "1.2.3.4",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
+ "pattern": "[ipv4-addr:value = '1.2.3.4']",
+ "pattern_type": "stix",
+ "pattern_version": "2.1",
+ "spec_version": "2.1",
+ "type": "indicator",
+ "valid_from": "2022-06-03T11:36:14Z",
+ "valid_until": "2022-07-03T12:17:39Z",
"x_opencti_main_observable_type": "IPv4-Addr"
},
{
- "type": "ipv4-addr",
- "spec_version": "2.1",
"id": "ipv4-addr--0198f97b-e65d-5025-87e5-58bc39d4bdb4",
- "value": "1.2.3.4",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
+ "spec_version": "2.1",
+ "type": "ipv4-addr",
+ "value": "1.2.3.4",
"x_opencti_created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd"
},
{
- "type": "relationship",
- "spec_version": "2.1",
- "id": "relationship--ec4c6d46-736b-5ba8-bce9-63f531170f05",
+ "created": "2025-11-06T14:44:03.701868Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:44:40.440133Z",
- "modified": "2025-06-09T13:44:40.440133Z",
+ "id": "relationship--ec4c6d46-736b-5ba8-bce9-63f531170f05",
+ "modified": "2025-11-06T14:44:03.701868Z",
+ "object_marking_refs": [
+ "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
+ ],
"relationship_type": "indicates",
"source_ref": "indicator--274128a4-2ad4-50b5-ae7b-b0dea1fa9861",
- "target_ref": "malware--5709afa6-1486-5cfe-98fb-205568ec6491"
+ "spec_version": "2.1",
+ "target_ref": "malware--5709afa6-1486-5cfe-98fb-205568ec6491",
+ "type": "relationship"
},
{
- "type": "relationship",
- "spec_version": "2.1",
- "id": "relationship--a787645d-9c70-51d7-b74a-91f3c0a88d3f",
+ "created": "2025-11-06T14:44:03.702064Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:44:40.440264Z",
- "modified": "2025-06-09T13:44:40.440264Z",
+ "id": "relationship--a787645d-9c70-51d7-b74a-91f3c0a88d3f",
+ "modified": "2025-11-06T14:44:03.702064Z",
+ "object_marking_refs": [
+ "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
+ ],
"relationship_type": "based-on",
"source_ref": "indicator--274128a4-2ad4-50b5-ae7b-b0dea1fa9861",
- "target_ref": "ipv4-addr--0198f97b-e65d-5025-87e5-58bc39d4bdb4"
+ "spec_version": "2.1",
+ "target_ref": "ipv4-addr--0198f97b-e65d-5025-87e5-58bc39d4bdb4",
+ "type": "relationship"
},
{
- "type": "identity",
- "spec_version": "2.1",
- "id": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
"created": "2022-01-01T00:00:00.000Z",
+ "id": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
+ "identity_class": "organization",
"modified": "2022-01-01T00:00:00.000Z",
"name": "Intel 471 Inc.",
- "identity_class": "organization"
+ "spec_version": "2.1",
+ "type": "identity"
},
{
- "type": "marking-definition",
- "spec_version": "2.1",
- "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
"created": "2017-01-20T00:00:00.000Z",
- "definition_type": "tlp",
- "name": "TLP:AMBER",
"definition": {
"tlp": "amber"
- }
+ },
+ "definition_type": "tlp",
+ "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
+ "name": "TLP:AMBER",
+ "spec_version": "2.1",
+ "type": "marking-definition"
},
{
- "type": "indicator",
- "spec_version": "2.1",
- "id": "indicator--3c7db02c-8ff5-52a0-bb17-9638d494f6c6",
+ "confidence": 85,
+ "created": "2025-11-06T14:44:03.702776Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:44:40.440863Z",
- "modified": "2025-06-09T13:44:40.440863Z",
- "name": "38a5dfa3ec07f08e8e1788d1d567359a7ed95b0e354953cf0222e0fea1872a7e",
"description": "sample of fooBar malware family",
+ "id": "indicator--3c7db02c-8ff5-52a0-bb17-9638d494f6c6",
"indicator_types": [
"malicious-activity"
],
- "pattern": "[file:hashes.md5 = '4c4712a4141d261ec0ca8f9037950685' OR file:hashes.sha1 = '391e962681972d5625fc3574e112a4bdae603550' OR file:hashes.sha256 = '38a5dfa3ec07f08e8e1788d1d567359a7ed95b0e354953cf0222e0fea1872a7e']",
- "pattern_type": "stix",
- "pattern_version": "2.1",
- "valid_from": "2022-06-03T11:36:14Z",
- "valid_until": "2022-07-03T12:17:39Z",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@@ -127,78 +124,84 @@
"fooBar",
"Intel 471 - GIR 0.0.0"
],
- "confidence": 85,
+ "modified": "2025-11-06T14:44:03.702776Z",
+ "name": "38a5dfa3ec07f08e8e1788d1d567359a7ed95b0e354953cf0222e0fea1872a7e",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
+ "pattern": "[file:hashes.md5 = '4c4712a4141d261ec0ca8f9037950685' OR file:hashes.sha1 = '391e962681972d5625fc3574e112a4bdae603550' OR file:hashes.sha256 = '38a5dfa3ec07f08e8e1788d1d567359a7ed95b0e354953cf0222e0fea1872a7e']",
+ "pattern_type": "stix",
+ "pattern_version": "2.1",
+ "spec_version": "2.1",
+ "type": "indicator",
+ "valid_from": "2022-06-03T11:36:14Z",
+ "valid_until": "2022-07-03T12:17:39Z",
"x_opencti_main_observable_type": "StixFile"
},
{
- "type": "file",
- "spec_version": "2.1",
- "id": "file--274bf59a-4ab3-501c-8438-cb3ee0702542",
"hashes": {
"MD5": "4c4712a4141d261ec0ca8f9037950685",
"SHA-1": "391e962681972d5625fc3574e112a4bdae603550",
"SHA-256": "38a5dfa3ec07f08e8e1788d1d567359a7ed95b0e354953cf0222e0fea1872a7e"
},
+ "id": "file--274bf59a-4ab3-501c-8438-cb3ee0702542",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
+ "spec_version": "2.1",
+ "type": "file",
"x_opencti_created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd"
},
{
- "type": "relationship",
- "spec_version": "2.1",
- "id": "relationship--0b1cb9bd-63fa-5c27-8244-fa579379bb84",
+ "created": "2025-11-06T14:44:03.705188Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:44:40.443136Z",
- "modified": "2025-06-09T13:44:40.443136Z",
+ "id": "relationship--0b1cb9bd-63fa-5c27-8244-fa579379bb84",
+ "modified": "2025-11-06T14:44:03.705188Z",
+ "object_marking_refs": [
+ "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
+ ],
"relationship_type": "indicates",
"source_ref": "indicator--3c7db02c-8ff5-52a0-bb17-9638d494f6c6",
- "target_ref": "malware--5709afa6-1486-5cfe-98fb-205568ec6491"
+ "spec_version": "2.1",
+ "target_ref": "malware--5709afa6-1486-5cfe-98fb-205568ec6491",
+ "type": "relationship"
},
{
- "type": "relationship",
- "spec_version": "2.1",
- "id": "relationship--6a24bb80-8526-557b-9499-bbfdbc6e5a34",
+ "created": "2025-11-06T14:44:03.705301Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:44:40.443236Z",
- "modified": "2025-06-09T13:44:40.443236Z",
+ "id": "relationship--6a24bb80-8526-557b-9499-bbfdbc6e5a34",
+ "modified": "2025-11-06T14:44:03.705301Z",
+ "object_marking_refs": [
+ "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
+ ],
"relationship_type": "based-on",
"source_ref": "indicator--3c7db02c-8ff5-52a0-bb17-9638d494f6c6",
- "target_ref": "file--274bf59a-4ab3-501c-8438-cb3ee0702542"
+ "spec_version": "2.1",
+ "target_ref": "file--274bf59a-4ab3-501c-8438-cb3ee0702542",
+ "type": "relationship"
},
{
- "type": "malware",
- "spec_version": "2.1",
- "id": "malware--7b7a9065-06e7-5861-b500-f1152a4f236c",
+ "created": "2025-11-06T14:44:03.705953Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:44:40.443863Z",
- "modified": "2025-06-09T13:44:40.443863Z",
- "name": "barBaz",
+ "id": "malware--7b7a9065-06e7-5861-b500-f1152a4f236c",
"is_family": true,
+ "modified": "2025-11-06T14:44:03.705953Z",
+ "name": "barBaz",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
- ]
+ ],
+ "spec_version": "2.1",
+ "type": "malware"
},
{
- "type": "indicator",
- "spec_version": "2.1",
- "id": "indicator--1ee5d4d2-2180-573d-ba09-606cfa6052a6",
+ "confidence": 85,
+ "created": "2025-11-06T14:44:03.706188Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:44:40.444099Z",
- "modified": "2025-06-09T13:44:40.444099Z",
- "name": "http://foo.bar/baz",
"description": "barBaz controller URL",
+ "id": "indicator--1ee5d4d2-2180-573d-ba09-606cfa6052a6",
"indicator_types": [
"malicious-activity"
],
- "pattern": "[url:value = 'http://foo.bar/baz']",
- "pattern_type": "stix",
- "pattern_version": "2.1",
- "valid_from": "2022-06-03T11:36:14Z",
- "valid_until": "2022-07-03T12:17:39Z",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@@ -209,43 +212,58 @@
"barBaz",
"Intel 471 - GIR 0.0.0"
],
- "confidence": 85,
+ "modified": "2025-11-06T14:44:03.706188Z",
+ "name": "http://foo.bar/baz",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
+ "pattern": "[url:value = 'http://foo.bar/baz']",
+ "pattern_type": "stix",
+ "pattern_version": "2.1",
+ "spec_version": "2.1",
+ "type": "indicator",
+ "valid_from": "2022-06-03T11:36:14Z",
+ "valid_until": "2022-07-03T12:17:39Z",
"x_opencti_main_observable_type": "Url"
},
{
- "type": "url",
- "spec_version": "2.1",
"id": "url--180e139a-6141-57cd-949c-1bd736c9073e",
- "value": "http://foo.bar/baz",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
+ "spec_version": "2.1",
+ "type": "url",
+ "value": "http://foo.bar/baz",
"x_opencti_created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd"
},
{
- "type": "relationship",
- "spec_version": "2.1",
- "id": "relationship--d770bc83-be90-509c-a47e-adec98532369",
+ "created": "2025-11-06T14:44:03.706476Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:44:40.444383Z",
- "modified": "2025-06-09T13:44:40.444383Z",
+ "id": "relationship--d770bc83-be90-509c-a47e-adec98532369",
+ "modified": "2025-11-06T14:44:03.706476Z",
+ "object_marking_refs": [
+ "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
+ ],
"relationship_type": "indicates",
"source_ref": "indicator--1ee5d4d2-2180-573d-ba09-606cfa6052a6",
- "target_ref": "malware--7b7a9065-06e7-5861-b500-f1152a4f236c"
+ "spec_version": "2.1",
+ "target_ref": "malware--7b7a9065-06e7-5861-b500-f1152a4f236c",
+ "type": "relationship"
},
{
- "type": "relationship",
- "spec_version": "2.1",
- "id": "relationship--b2206f95-3e1e-56bf-9928-e5b79911a2d6",
+ "created": "2025-11-06T14:44:03.70657Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:44:40.44447Z",
- "modified": "2025-06-09T13:44:40.44447Z",
+ "id": "relationship--b2206f95-3e1e-56bf-9928-e5b79911a2d6",
+ "modified": "2025-11-06T14:44:03.70657Z",
+ "object_marking_refs": [
+ "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
+ ],
"relationship_type": "based-on",
"source_ref": "indicator--1ee5d4d2-2180-573d-ba09-606cfa6052a6",
- "target_ref": "url--180e139a-6141-57cd-949c-1bd736c9073e"
+ "spec_version": "2.1",
+ "target_ref": "url--180e139a-6141-57cd-949c-1bd736c9073e",
+ "type": "relationship"
}
- ]
+ ],
+ "type": "bundle"
}
\ No newline at end of file
diff --git a/test/fixtures/iocs_stix.json b/test/fixtures/iocs_stix.json
index f786cbc..3253a85 100644
--- a/test/fixtures/iocs_stix.json
+++ b/test/fixtures/iocs_stix.json
@@ -1,223 +1,235 @@
{
- "type": "bundle",
- "id": "bundle--ef6eabc1-6a18-412b-9348-54af7af36973",
+ "id": "bundle--11b1211c-8079-47ac-b04c-ef6397eebae4",
"objects": [
{
- "type": "indicator",
- "spec_version": "2.1",
- "id": "indicator--d885e6f6-6d7d-5a2b-af05-53b861c3fd51",
+ "created": "2025-11-06T14:44:03.710225Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:45:24.939356Z",
- "modified": "2025-06-09T13:45:24.939356Z",
- "name": "foo.bar",
+ "id": "indicator--d885e6f6-6d7d-5a2b-af05-53b861c3fd51",
"indicator_types": [
"malicious-activity"
],
+ "modified": "2025-11-06T14:44:03.710225Z",
+ "name": "foo.bar",
+ "object_marking_refs": [
+ "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
+ ],
"pattern": "[domain-name:value = 'foo.bar']",
"pattern_type": "stix",
"pattern_version": "2.1",
+ "spec_version": "2.1",
+ "type": "indicator",
"valid_from": "2021-09-02T09:33:53Z",
- "object_marking_refs": [
- "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
- ],
"x_opencti_main_observable_type": "Domain-Name"
},
{
- "type": "domain-name",
- "spec_version": "2.1",
"id": "domain-name--b7a2c682-5608-5ade-aa12-5fde0aa49984",
- "value": "foo.bar",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
+ "spec_version": "2.1",
+ "type": "domain-name",
+ "value": "foo.bar",
"x_opencti_created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd"
},
{
- "type": "relationship",
- "spec_version": "2.1",
- "id": "relationship--f63db25b-c3e8-5589-925e-bc98a0b3d360",
+ "created": "2025-11-06T14:44:03.710784Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:45:24.943103Z",
- "modified": "2025-06-09T13:45:24.943103Z",
+ "id": "relationship--f63db25b-c3e8-5589-925e-bc98a0b3d360",
+ "modified": "2025-11-06T14:44:03.710784Z",
+ "object_marking_refs": [
+ "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
+ ],
"relationship_type": "based-on",
"source_ref": "indicator--d885e6f6-6d7d-5a2b-af05-53b861c3fd51",
- "target_ref": "domain-name--b7a2c682-5608-5ade-aa12-5fde0aa49984"
+ "spec_version": "2.1",
+ "target_ref": "domain-name--b7a2c682-5608-5ade-aa12-5fde0aa49984",
+ "type": "relationship"
},
{
- "type": "identity",
- "spec_version": "2.1",
- "id": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
"created": "2022-01-01T00:00:00.000Z",
+ "id": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
+ "identity_class": "organization",
"modified": "2022-01-01T00:00:00.000Z",
"name": "Intel 471 Inc.",
- "identity_class": "organization"
+ "spec_version": "2.1",
+ "type": "identity"
},
{
- "type": "marking-definition",
- "spec_version": "2.1",
- "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
"created": "2017-01-20T00:00:00.000Z",
- "definition_type": "tlp",
- "name": "TLP:AMBER",
"definition": {
"tlp": "amber"
- }
+ },
+ "definition_type": "tlp",
+ "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
+ "name": "TLP:AMBER",
+ "spec_version": "2.1",
+ "type": "marking-definition"
},
{
- "type": "report",
- "spec_version": "2.1",
- "id": "report--a1f3eeb8-c6f0-5c2e-960b-5a5787a2197d",
+ "confidence": 0,
+ "created": "2025-11-06T14:44:03.711084Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:45:24.943651Z",
- "modified": "2025-06-09T13:45:24.943651Z",
- "name": "Lorem ipsum",
"description": "Lorem ipsum",
- "report_types": [
- "spotrep"
- ],
- "published": "2021-09-02T09:33:53Z",
- "object_refs": [
- "indicator--d885e6f6-6d7d-5a2b-af05-53b861c3fd51",
- "domain-name--b7a2c682-5608-5ade-aa12-5fde0aa49984",
- "relationship--f63db25b-c3e8-5589-925e-bc98a0b3d360"
- ],
- "confidence": 0,
"external_references": [
{
"source_name": "Titan URL",
"url": "https://titan.intel471.com/report/spotrep/4c4712a4141d261ec0ca8f9037950685"
}
],
+ "id": "report--a1f3eeb8-c6f0-5c2e-960b-5a5787a2197d",
+ "modified": "2025-11-06T14:44:03.711084Z",
+ "name": "Lorem ipsum",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
+ "object_refs": [
+ "indicator--d885e6f6-6d7d-5a2b-af05-53b861c3fd51",
+ "domain-name--b7a2c682-5608-5ade-aa12-5fde0aa49984",
+ "relationship--f63db25b-c3e8-5589-925e-bc98a0b3d360"
+ ],
+ "published": "2021-09-02T09:33:53Z",
+ "report_types": [
+ "spotrep"
+ ],
+ "spec_version": "2.1",
+ "type": "report",
"x_intel471_com_uid": "14796d40bf40721ed6eab8f54d9402e2"
},
{
- "type": "indicator",
- "spec_version": "2.1",
- "id": "indicator--8bea67b0-12fb-5d07-9f45-135415e7710c",
+ "created": "2025-11-06T14:44:03.711611Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:45:24.94477Z",
- "modified": "2025-06-09T13:45:24.94477Z",
- "name": "foo.bar",
+ "id": "indicator--8bea67b0-12fb-5d07-9f45-135415e7710c",
"indicator_types": [
"malicious-activity"
],
+ "modified": "2025-11-06T14:44:03.711611Z",
+ "name": "foo.bar",
+ "object_marking_refs": [
+ "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
+ ],
"pattern": "[url:value = 'foo.bar']",
"pattern_type": "stix",
"pattern_version": "2.1",
+ "spec_version": "2.1",
+ "type": "indicator",
"valid_from": "2021-09-02T09:33:53Z",
- "object_marking_refs": [
- "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
- ],
"x_opencti_main_observable_type": "Url"
},
{
- "type": "url",
- "spec_version": "2.1",
"id": "url--b7a2c682-5608-5ade-aa12-5fde0aa49984",
- "value": "foo.bar",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
+ "spec_version": "2.1",
+ "type": "url",
+ "value": "foo.bar",
"x_opencti_created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd"
},
{
- "type": "relationship",
- "spec_version": "2.1",
- "id": "relationship--f9ee4e2e-3714-5fc6-942a-e1ba7f93e896",
+ "created": "2025-11-06T14:44:03.711875Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:45:24.945112Z",
- "modified": "2025-06-09T13:45:24.945112Z",
+ "id": "relationship--f9ee4e2e-3714-5fc6-942a-e1ba7f93e896",
+ "modified": "2025-11-06T14:44:03.711875Z",
+ "object_marking_refs": [
+ "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
+ ],
"relationship_type": "based-on",
"source_ref": "indicator--8bea67b0-12fb-5d07-9f45-135415e7710c",
- "target_ref": "url--b7a2c682-5608-5ade-aa12-5fde0aa49984"
+ "spec_version": "2.1",
+ "target_ref": "url--b7a2c682-5608-5ade-aa12-5fde0aa49984",
+ "type": "relationship"
},
{
- "type": "report",
- "spec_version": "2.1",
- "id": "report--69cb0bf4-2762-5f7d-bde4-456e38252b5d",
+ "confidence": 0,
+ "created": "2025-11-06T14:44:03.712032Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:45:24.945312Z",
- "modified": "2025-06-09T13:45:24.945312Z",
- "name": "The quick brown fox",
"description": "The quick brown fox",
- "report_types": [
- "inforep"
- ],
- "published": "2021-09-02T09:33:53Z",
- "object_refs": [
- "indicator--8bea67b0-12fb-5d07-9f45-135415e7710c",
- "url--b7a2c682-5608-5ade-aa12-5fde0aa49984",
- "relationship--f9ee4e2e-3714-5fc6-942a-e1ba7f93e896"
- ],
- "confidence": 0,
"external_references": [
{
"source_name": "Titan URL",
"url": "https://titan.intel471.com/report/inforep/4c4712a4141d261ec0ca8f9037950686"
}
],
+ "id": "report--69cb0bf4-2762-5f7d-bde4-456e38252b5d",
+ "modified": "2025-11-06T14:44:03.712032Z",
+ "name": "The quick brown fox",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
+ "object_refs": [
+ "indicator--8bea67b0-12fb-5d07-9f45-135415e7710c",
+ "url--b7a2c682-5608-5ade-aa12-5fde0aa49984",
+ "relationship--f9ee4e2e-3714-5fc6-942a-e1ba7f93e896"
+ ],
+ "published": "2021-09-02T09:33:53Z",
+ "report_types": [
+ "inforep"
+ ],
+ "spec_version": "2.1",
+ "type": "report",
"x_intel471_com_uid": "14796d40bf40721ed6eab8f54d9402e2"
},
{
- "type": "indicator",
- "spec_version": "2.1",
- "id": "indicator--a831dcab-392e-5927-8ed7-9b8c3b343526",
+ "created": "2025-11-06T14:44:03.712222Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:45:24.945587Z",
- "modified": "2025-06-09T13:45:24.945587Z",
- "name": "127.0.0.1",
+ "id": "indicator--a831dcab-392e-5927-8ed7-9b8c3b343526",
"indicator_types": [
"malicious-activity"
],
+ "modified": "2025-11-06T14:44:03.712222Z",
+ "name": "127.0.0.1",
+ "object_marking_refs": [
+ "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
+ ],
"pattern": "[ipv4-addr:value = '127.0.0.1']",
"pattern_type": "stix",
"pattern_version": "2.1",
+ "spec_version": "2.1",
+ "type": "indicator",
"valid_from": "2021-09-02T09:33:53Z",
- "object_marking_refs": [
- "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
- ],
"x_opencti_main_observable_type": "IPv4-Addr"
},
{
- "type": "ipv4-addr",
- "spec_version": "2.1",
"id": "ipv4-addr--679c6c82-b4be-52e2-9c7a-198689f6f77b",
- "value": "127.0.0.1",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
+ "spec_version": "2.1",
+ "type": "ipv4-addr",
+ "value": "127.0.0.1",
"x_opencti_created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd"
},
{
- "type": "relationship",
- "spec_version": "2.1",
- "id": "relationship--e346975c-efb5-5612-8790-46cecab2027f",
+ "created": "2025-11-06T14:44:03.712491Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:45:24.946171Z",
- "modified": "2025-06-09T13:45:24.946171Z",
+ "id": "relationship--e346975c-efb5-5612-8790-46cecab2027f",
+ "modified": "2025-11-06T14:44:03.712491Z",
+ "object_marking_refs": [
+ "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
+ ],
"relationship_type": "based-on",
"source_ref": "indicator--a831dcab-392e-5927-8ed7-9b8c3b343526",
- "target_ref": "ipv4-addr--679c6c82-b4be-52e2-9c7a-198689f6f77b"
+ "spec_version": "2.1",
+ "target_ref": "ipv4-addr--679c6c82-b4be-52e2-9c7a-198689f6f77b",
+ "type": "relationship"
},
{
- "type": "report",
- "spec_version": "2.1",
- "id": "report--e2f8cf2b-85c9-51ea-b7cf-6bb80fa2e53e",
+ "confidence": 0,
+ "created": "2025-11-06T14:44:03.71263Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:45:24.946339Z",
- "modified": "2025-06-09T13:45:24.946339Z",
- "name": "NVM, will be skipped anyways",
"description": "NVM, will be skipped anyways",
- "report_types": [
- "spotrep"
+ "external_references": [
+ {
+ "source_name": "Titan URL",
+ "url": "https://titan.intel471.com/report/spotrep/4c4712a4141d261ec0ca8f9037950686"
+ }
+ ],
+ "id": "report--e2f8cf2b-85c9-51ea-b7cf-6bb80fa2e53e",
+ "modified": "2025-11-06T14:44:03.71263Z",
+ "name": "NVM, will be skipped anyways",
+ "object_marking_refs": [
+ "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
- "published": "2021-09-02T09:33:53Z",
"object_refs": [
"indicator--a831dcab-392e-5927-8ed7-9b8c3b343526",
"ipv4-addr--679c6c82-b4be-52e2-9c7a-198689f6f77b",
@@ -232,146 +244,152 @@
"file--842a90f8-17e2-5b7c-a356-cafacff88ab8",
"relationship--18c50d20-fe14-586b-b389-2145bab9eefd"
],
- "confidence": 0,
- "external_references": [
- {
- "source_name": "Titan URL",
- "url": "https://titan.intel471.com/report/spotrep/4c4712a4141d261ec0ca8f9037950686"
- }
- ],
- "object_marking_refs": [
- "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
+ "published": "2021-09-02T09:33:53Z",
+ "report_types": [
+ "spotrep"
],
+ "spec_version": "2.1",
+ "type": "report",
"x_intel471_com_uid": "14796d40bf40721ed6eab8f54d9402e2"
},
{
- "type": "indicator",
- "spec_version": "2.1",
- "id": "indicator--42cd3d21-a2b3-5dc5-8eb0-4db53eacf338",
+ "created": "2025-11-06T14:44:03.712851Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:45:24.946716Z",
- "modified": "2025-06-09T13:45:24.946716Z",
- "name": "1bec8600cb85bcbeed8b9992a0b87ae4",
+ "id": "indicator--42cd3d21-a2b3-5dc5-8eb0-4db53eacf338",
"indicator_types": [
"malicious-activity"
],
+ "modified": "2025-11-06T14:44:03.712851Z",
+ "name": "1bec8600cb85bcbeed8b9992a0b87ae4",
+ "object_marking_refs": [
+ "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
+ ],
"pattern": "[file:hashes.md5 = '1bec8600cb85bcbeed8b9992a0b87ae4']",
"pattern_type": "stix",
"pattern_version": "2.1",
+ "spec_version": "2.1",
+ "type": "indicator",
"valid_from": "2021-09-02T09:33:53Z",
- "object_marking_refs": [
- "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
- ],
"x_opencti_main_observable_type": "StixFile"
},
{
- "type": "file",
- "spec_version": "2.1",
- "id": "file--85995aa9-36db-5c5b-b620-270b86ac82b3",
"hashes": {
"MD5": "1bec8600cb85bcbeed8b9992a0b87ae4"
},
+ "id": "file--85995aa9-36db-5c5b-b620-270b86ac82b3",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
+ "spec_version": "2.1",
+ "type": "file",
"x_opencti_created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd"
},
{
- "type": "relationship",
- "spec_version": "2.1",
- "id": "relationship--d142b244-dea0-5797-8656-2290bc2dac2e",
+ "created": "2025-11-06T14:44:03.713155Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:45:24.948479Z",
- "modified": "2025-06-09T13:45:24.948479Z",
+ "id": "relationship--d142b244-dea0-5797-8656-2290bc2dac2e",
+ "modified": "2025-11-06T14:44:03.713155Z",
+ "object_marking_refs": [
+ "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
+ ],
"relationship_type": "based-on",
"source_ref": "indicator--42cd3d21-a2b3-5dc5-8eb0-4db53eacf338",
- "target_ref": "file--85995aa9-36db-5c5b-b620-270b86ac82b3"
+ "spec_version": "2.1",
+ "target_ref": "file--85995aa9-36db-5c5b-b620-270b86ac82b3",
+ "type": "relationship"
},
{
- "type": "indicator",
- "spec_version": "2.1",
- "id": "indicator--2c172df2-247b-5b3c-be44-54f9c787657f",
+ "created": "2025-11-06T14:44:03.714673Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:45:24.948966Z",
- "modified": "2025-06-09T13:45:24.948966Z",
- "name": "d520bb6cd46674b9f29ec5fa3280d678b635ecd8",
+ "id": "indicator--2c172df2-247b-5b3c-be44-54f9c787657f",
"indicator_types": [
"malicious-activity"
],
+ "modified": "2025-11-06T14:44:03.714673Z",
+ "name": "d520bb6cd46674b9f29ec5fa3280d678b635ecd8",
+ "object_marking_refs": [
+ "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
+ ],
"pattern": "[file:hashes.sha1 = 'd520bb6cd46674b9f29ec5fa3280d678b635ecd8']",
"pattern_type": "stix",
"pattern_version": "2.1",
+ "spec_version": "2.1",
+ "type": "indicator",
"valid_from": "2021-09-02T09:33:53Z",
- "object_marking_refs": [
- "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
- ],
"x_opencti_main_observable_type": "StixFile"
},
{
- "type": "file",
- "spec_version": "2.1",
- "id": "file--f11f895a-307f-5fab-8888-75291f2bae81",
"hashes": {
"SHA-1": "d520bb6cd46674b9f29ec5fa3280d678b635ecd8"
},
+ "id": "file--f11f895a-307f-5fab-8888-75291f2bae81",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
+ "spec_version": "2.1",
+ "type": "file",
"x_opencti_created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd"
},
{
- "type": "relationship",
- "spec_version": "2.1",
- "id": "relationship--b4d3f76b-3f5b-5065-b5c9-344f25650557",
+ "created": "2025-11-06T14:44:03.715034Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:45:24.949509Z",
- "modified": "2025-06-09T13:45:24.949509Z",
+ "id": "relationship--b4d3f76b-3f5b-5065-b5c9-344f25650557",
+ "modified": "2025-11-06T14:44:03.715034Z",
+ "object_marking_refs": [
+ "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
+ ],
"relationship_type": "based-on",
"source_ref": "indicator--2c172df2-247b-5b3c-be44-54f9c787657f",
- "target_ref": "file--f11f895a-307f-5fab-8888-75291f2bae81"
+ "spec_version": "2.1",
+ "target_ref": "file--f11f895a-307f-5fab-8888-75291f2bae81",
+ "type": "relationship"
},
{
- "type": "indicator",
- "spec_version": "2.1",
- "id": "indicator--49a0cb32-1206-53d4-8dd6-cbfdd2606169",
+ "created": "2025-11-06T14:44:03.715407Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:45:24.949896Z",
- "modified": "2025-06-09T13:45:24.949896Z",
- "name": "7623def2702a70942c6a0335f3fff55710c8effc18ed9a6bd2896a4c1f66b752",
+ "id": "indicator--49a0cb32-1206-53d4-8dd6-cbfdd2606169",
"indicator_types": [
"malicious-activity"
],
+ "modified": "2025-11-06T14:44:03.715407Z",
+ "name": "7623def2702a70942c6a0335f3fff55710c8effc18ed9a6bd2896a4c1f66b752",
+ "object_marking_refs": [
+ "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
+ ],
"pattern": "[file:hashes.sha256 = '7623def2702a70942c6a0335f3fff55710c8effc18ed9a6bd2896a4c1f66b752']",
"pattern_type": "stix",
"pattern_version": "2.1",
+ "spec_version": "2.1",
+ "type": "indicator",
"valid_from": "2021-09-02T09:33:53Z",
- "object_marking_refs": [
- "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
- ],
"x_opencti_main_observable_type": "StixFile"
},
{
- "type": "file",
- "spec_version": "2.1",
- "id": "file--842a90f8-17e2-5b7c-a356-cafacff88ab8",
"hashes": {
"SHA-256": "7623def2702a70942c6a0335f3fff55710c8effc18ed9a6bd2896a4c1f66b752"
},
+ "id": "file--842a90f8-17e2-5b7c-a356-cafacff88ab8",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
+ "spec_version": "2.1",
+ "type": "file",
"x_opencti_created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd"
},
{
- "type": "relationship",
- "spec_version": "2.1",
- "id": "relationship--18c50d20-fe14-586b-b389-2145bab9eefd",
+ "created": "2025-11-06T14:44:03.715783Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:45:24.950371Z",
- "modified": "2025-06-09T13:45:24.950371Z",
+ "id": "relationship--18c50d20-fe14-586b-b389-2145bab9eefd",
+ "modified": "2025-11-06T14:44:03.715783Z",
+ "object_marking_refs": [
+ "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
+ ],
"relationship_type": "based-on",
"source_ref": "indicator--49a0cb32-1206-53d4-8dd6-cbfdd2606169",
- "target_ref": "file--842a90f8-17e2-5b7c-a356-cafacff88ab8"
+ "spec_version": "2.1",
+ "target_ref": "file--842a90f8-17e2-5b7c-a356-cafacff88ab8",
+ "type": "relationship"
}
- ]
+ ],
+ "type": "bundle"
}
\ No newline at end of file
diff --git a/test/fixtures/report_breach_alert_stix.json b/test/fixtures/report_breach_alert_stix.json
index 0eafdd2..6906a50 100644
--- a/test/fixtures/report_breach_alert_stix.json
+++ b/test/fixtures/report_breach_alert_stix.json
@@ -1,76 +1,59 @@
{
- "type": "bundle",
- "id": "bundle--63fa406c-e67e-455a-a174-db6ab8d55063",
+ "id": "bundle--7723b86c-670e-42d9-86ba-c5f9d57ceca2",
"objects": [
{
- "type": "marking-definition",
- "spec_version": "2.1",
- "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
"created": "2017-01-20T00:00:00.000Z",
- "definition_type": "tlp",
- "name": "TLP:AMBER",
"definition": {
"tlp": "amber"
- }
+ },
+ "definition_type": "tlp",
+ "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
+ "name": "TLP:AMBER",
+ "spec_version": "2.1",
+ "type": "marking-definition"
},
{
- "type": "identity",
- "spec_version": "2.1",
- "id": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
"created": "2022-01-01T00:00:00.000Z",
+ "id": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
+ "identity_class": "organization",
"modified": "2022-01-01T00:00:00.000Z",
"name": "Intel 471 Inc.",
- "identity_class": "organization"
+ "spec_version": "2.1",
+ "type": "identity"
},
{
- "type": "threat-actor",
- "spec_version": "2.1",
- "id": "threat-actor--5edd2856-cb02-566e-a052-d158a2d11bcd",
+ "created": "2025-11-06T14:44:03.727692Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:49:19.650663Z",
- "modified": "2025-06-09T13:49:19.650663Z",
+ "id": "threat-actor--5edd2856-cb02-566e-a052-d158a2d11bcd",
+ "modified": "2025-11-06T14:44:03.727692Z",
"name": "Lorem ipsum",
- "resource_level": "individual",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
- ]
+ ],
+ "resource_level": "individual",
+ "spec_version": "2.1",
+ "type": "threat-actor"
},
{
- "type": "identity",
- "spec_version": "2.1",
- "id": "identity--b7403ffd-634d-52ec-964d-bb755241c27c",
+ "contact_information": "https://www.example.com",
+ "created": "2025-11-06T14:44:03.72782Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:49:19.651053Z",
- "modified": "2025-06-09T13:49:19.651053Z",
- "name": "Dummy",
+ "id": "identity--b7403ffd-634d-52ec-964d-bb755241c27c",
"identity_class": "organization",
- "contact_information": "https://www.example.com",
+ "modified": "2025-11-06T14:44:03.72782Z",
+ "name": "Dummy",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
- ]
+ ],
+ "spec_version": "2.1",
+ "type": "identity"
},
{
- "type": "report",
- "spec_version": "2.1",
- "id": "report--4112ce81-62af-5272-9ebb-7ce2cd3ccef8",
+ "confidence": 15,
+ "content": "",
+ "created": "2025-11-06T14:44:03.728134Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:49:19.651454Z",
- "modified": "2025-06-09T13:49:19.651454Z",
- "name": "Lorem",
"description": "Lorem ipsum",
- "report_types": [
- "breach_alert"
- ],
- "published": "2023-11-14T22:13:20.001Z",
- "object_refs": [
- "threat-actor--5edd2856-cb02-566e-a052-d158a2d11bcd",
- "identity--b7403ffd-634d-52ec-964d-bb755241c27c"
- ],
- "labels": [
- "Intel 471 - GIR 1.1.1 - Lorem",
- "Intel 471 - GIR 1.2"
- ],
- "confidence": 15,
"external_references": [
{
"source_name": "Titan URL",
@@ -81,11 +64,28 @@
"url": "https://titan.intel471.com/post_thread/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
],
+ "id": "report--4112ce81-62af-5272-9ebb-7ce2cd3ccef8",
+ "labels": [
+ "Intel 471 - GIR 1.1.1 - Lorem",
+ "Intel 471 - GIR 1.2"
+ ],
+ "modified": "2025-11-06T14:44:03.728134Z",
+ "name": "Lorem",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
- "content": "",
+ "object_refs": [
+ "threat-actor--5edd2856-cb02-566e-a052-d158a2d11bcd",
+ "identity--b7403ffd-634d-52ec-964d-bb755241c27c"
+ ],
+ "published": "2023-11-14T22:13:20.001Z",
+ "report_types": [
+ "breach_alert"
+ ],
+ "spec_version": "2.1",
+ "type": "report",
"x_intel471_com_uid": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
- ]
+ ],
+ "type": "bundle"
}
\ No newline at end of file
diff --git a/test/fixtures/report_fintel_actor_profile_stix.json b/test/fixtures/report_fintel_actor_profile_stix.json
index e43cfbf..a322e9d 100644
--- a/test/fixtures/report_fintel_actor_profile_stix.json
+++ b/test/fixtures/report_fintel_actor_profile_stix.json
@@ -1,116 +1,116 @@
{
- "type": "bundle",
- "id": "bundle--9bf57533-0cfe-4290-80a9-88955fa85396",
+ "id": "bundle--741569cb-876b-4797-ad0c-e922468b286d",
"objects": [
{
- "type": "marking-definition",
- "spec_version": "2.1",
- "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
"created": "2017-01-20T00:00:00.000Z",
- "definition_type": "tlp",
- "name": "TLP:AMBER",
"definition": {
"tlp": "amber"
- }
+ },
+ "definition_type": "tlp",
+ "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
+ "name": "TLP:AMBER",
+ "spec_version": "2.1",
+ "type": "marking-definition"
},
{
- "type": "identity",
- "spec_version": "2.1",
- "id": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
"created": "2022-01-01T00:00:00.000Z",
+ "id": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
+ "identity_class": "organization",
"modified": "2022-01-01T00:00:00.000Z",
"name": "Intel 471 Inc.",
- "identity_class": "organization"
+ "spec_version": "2.1",
+ "type": "identity"
},
{
- "type": "domain-name",
- "spec_version": "2.1",
"id": "domain-name--5738557b-186f-5e7f-bbbc-a6678ea6513d",
- "value": "bad",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
+ "spec_version": "2.1",
+ "type": "domain-name",
+ "value": "bad",
"x_opencti_created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd"
},
{
- "type": "identity",
- "spec_version": "2.1",
- "id": "identity--b7403ffd-634d-52ec-964d-bb755241c27c",
+ "contact_information": "https://dummy",
+ "created": "2025-11-06T14:44:03.733744Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:50:09.09923Z",
- "modified": "2025-06-09T13:50:09.09923Z",
- "name": "Dummy",
+ "id": "identity--b7403ffd-634d-52ec-964d-bb755241c27c",
"identity_class": "organization",
- "contact_information": "https://dummy",
+ "modified": "2025-11-06T14:44:03.733744Z",
+ "name": "Dummy",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
- ]
+ ],
+ "spec_version": "2.1",
+ "type": "identity"
},
{
- "type": "identity",
- "spec_version": "2.1",
- "id": "identity--fe08297a-ec76-5a20-8e80-f472731dfe4f",
+ "contact_information": "https://dummy2",
+ "created": "2025-11-06T14:44:03.733823Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:50:09.099318Z",
- "modified": "2025-06-09T13:50:09.099318Z",
- "name": "Dummy2",
+ "id": "identity--fe08297a-ec76-5a20-8e80-f472731dfe4f",
"identity_class": "organization",
- "contact_information": "https://dummy2",
+ "modified": "2025-11-06T14:44:03.733823Z",
+ "name": "Dummy2",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
- ]
+ ],
+ "spec_version": "2.1",
+ "type": "identity"
},
{
- "type": "threat-actor",
- "spec_version": "2.1",
- "id": "threat-actor--84f6dbda-f947-591d-847e-cf36c6958f9e",
+ "created": "2025-11-06T14:44:03.734069Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:50:09.099664Z",
- "modified": "2025-06-09T13:50:09.099664Z",
- "name": "Lorem",
"description": "The Lorem actor is a hacktivist",
- "resource_level": "individual",
+ "id": "threat-actor--84f6dbda-f947-591d-847e-cf36c6958f9e",
+ "modified": "2025-11-06T14:44:03.734069Z",
+ "name": "Lorem",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
- ]
+ ],
+ "resource_level": "individual",
+ "spec_version": "2.1",
+ "type": "threat-actor"
},
{
- "type": "report",
- "spec_version": "2.1",
- "id": "report--e93c4093-b63b-59a0-90f7-73979423226b",
+ "confidence": 90,
+ "content": "Actor summary
The Lorem actor is a hacktivist
Lorem ipsum
",
+ "created": "2025-11-06T14:44:03.734224Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:50:09.099979Z",
- "modified": "2025-06-09T13:50:09.099979Z",
- "name": "Actor Profile \u2013 Lorem",
"description": "The Lorem actor is a hacktivist",
- "report_types": [
- "fintel",
- "actor_profile"
- ],
- "published": "2023-11-14T22:13:20.001Z",
- "object_refs": [
- "domain-name--5738557b-186f-5e7f-bbbc-a6678ea6513d",
- "threat-actor--84f6dbda-f947-591d-847e-cf36c6958f9e",
- "identity--b7403ffd-634d-52ec-964d-bb755241c27c",
- "identity--fe08297a-ec76-5a20-8e80-f472731dfe4f"
- ],
- "labels": [
- "Intel 471 - GIR 1.1.1 - Lorem",
- "Intel 471 - GIR 1.1.9",
- "Intel 471 - GIR 1.1.10"
- ],
- "confidence": 90,
"external_references": [
{
"source_name": "Titan URL",
"url": "https://titan.intel471.com/report/fintel/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
],
+ "id": "report--e93c4093-b63b-59a0-90f7-73979423226b",
+ "labels": [
+ "Intel 471 - GIR 1.1.1 - Lorem",
+ "Intel 471 - GIR 1.1.9",
+ "Intel 471 - GIR 1.1.10"
+ ],
+ "modified": "2025-11-06T14:44:03.734224Z",
+ "name": "Actor Profile \u2013 Lorem",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
- "content": "Actor summary
The Lorem actor is a hacktivist
Lorem ipsum
",
+ "object_refs": [
+ "domain-name--5738557b-186f-5e7f-bbbc-a6678ea6513d",
+ "threat-actor--84f6dbda-f947-591d-847e-cf36c6958f9e",
+ "identity--b7403ffd-634d-52ec-964d-bb755241c27c",
+ "identity--fe08297a-ec76-5a20-8e80-f472731dfe4f"
+ ],
+ "published": "2023-11-14T22:13:20.001Z",
+ "report_types": [
+ "fintel",
+ "actor_profile"
+ ],
+ "spec_version": "2.1",
+ "type": "report",
"x_intel471_com_uid": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
- ]
+ ],
+ "type": "bundle"
}
\ No newline at end of file
diff --git a/test/fixtures/report_fintel_stix.json b/test/fixtures/report_fintel_stix.json
index 4684ca1..4e79674 100644
--- a/test/fixtures/report_fintel_stix.json
+++ b/test/fixtures/report_fintel_stix.json
@@ -1,101 +1,101 @@
{
- "type": "bundle",
- "id": "bundle--f918f05e-f035-4f6a-b844-3a73b25a7238",
+ "id": "bundle--1fe4f7a0-5765-4140-ae68-f68517300b4b",
"objects": [
{
- "type": "marking-definition",
- "spec_version": "2.1",
- "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
"created": "2017-01-20T00:00:00.000Z",
- "definition_type": "tlp",
- "name": "TLP:AMBER",
"definition": {
"tlp": "amber"
- }
+ },
+ "definition_type": "tlp",
+ "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
+ "name": "TLP:AMBER",
+ "spec_version": "2.1",
+ "type": "marking-definition"
},
{
- "type": "identity",
- "spec_version": "2.1",
- "id": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
"created": "2022-01-01T00:00:00.000Z",
+ "id": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
+ "identity_class": "organization",
"modified": "2022-01-01T00:00:00.000Z",
"name": "Intel 471 Inc.",
- "identity_class": "organization"
+ "spec_version": "2.1",
+ "type": "identity"
},
{
- "type": "domain-name",
- "spec_version": "2.1",
"id": "domain-name--5738557b-186f-5e7f-bbbc-a6678ea6513d",
- "value": "bad",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
+ "spec_version": "2.1",
+ "type": "domain-name",
+ "value": "bad",
"x_opencti_created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd"
},
{
- "type": "identity",
- "spec_version": "2.1",
- "id": "identity--b7403ffd-634d-52ec-964d-bb755241c27c",
+ "contact_information": "https://dummy",
+ "created": "2025-11-06T14:44:03.730767Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:49:47.141357Z",
- "modified": "2025-06-09T13:49:47.141357Z",
- "name": "Dummy",
+ "id": "identity--b7403ffd-634d-52ec-964d-bb755241c27c",
"identity_class": "organization",
- "contact_information": "https://dummy",
+ "modified": "2025-11-06T14:44:03.730767Z",
+ "name": "Dummy",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
- ]
+ ],
+ "spec_version": "2.1",
+ "type": "identity"
},
{
- "type": "identity",
- "spec_version": "2.1",
- "id": "identity--fe08297a-ec76-5a20-8e80-f472731dfe4f",
+ "contact_information": "https://dummy2",
+ "created": "2025-11-06T14:44:03.730948Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:49:47.141472Z",
- "modified": "2025-06-09T13:49:47.141472Z",
- "name": "Dummy2",
+ "id": "identity--fe08297a-ec76-5a20-8e80-f472731dfe4f",
"identity_class": "organization",
- "contact_information": "https://dummy2",
+ "modified": "2025-11-06T14:44:03.730948Z",
+ "name": "Dummy2",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
- ]
+ ],
+ "spec_version": "2.1",
+ "type": "identity"
},
{
- "type": "report",
- "spec_version": "2.1",
- "id": "report--4112ce81-62af-5272-9ebb-7ce2cd3ccef8",
+ "confidence": 90,
+ "content": "",
+ "created": "2025-11-06T14:44:03.731514Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:49:47.14189Z",
- "modified": "2025-06-09T13:49:47.14189Z",
- "name": "Lorem",
"description": "Lorem",
- "report_types": [
- "fintel",
- "intelligence_bulletin"
- ],
- "published": "2023-11-14T22:13:20.001Z",
- "object_refs": [
- "domain-name--5738557b-186f-5e7f-bbbc-a6678ea6513d",
- "identity--b7403ffd-634d-52ec-964d-bb755241c27c",
- "identity--fe08297a-ec76-5a20-8e80-f472731dfe4f"
- ],
- "labels": [
- "Intel 471 - GIR 1.1.1 - Lorem",
- "Intel 471 - GIR 1.1.9",
- "Intel 471 - GIR 1.1.10"
- ],
- "confidence": 90,
"external_references": [
{
"source_name": "Titan URL",
"url": "https://titan.intel471.com/report/fintel/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
],
+ "id": "report--4112ce81-62af-5272-9ebb-7ce2cd3ccef8",
+ "labels": [
+ "Intel 471 - GIR 1.1.1 - Lorem",
+ "Intel 471 - GIR 1.1.9",
+ "Intel 471 - GIR 1.1.10"
+ ],
+ "modified": "2025-11-06T14:44:03.731514Z",
+ "name": "Lorem",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
- "content": "",
+ "object_refs": [
+ "domain-name--5738557b-186f-5e7f-bbbc-a6678ea6513d",
+ "identity--b7403ffd-634d-52ec-964d-bb755241c27c",
+ "identity--fe08297a-ec76-5a20-8e80-f472731dfe4f"
+ ],
+ "published": "2023-11-14T22:13:20.001Z",
+ "report_types": [
+ "fintel",
+ "intelligence_bulletin"
+ ],
+ "spec_version": "2.1",
+ "type": "report",
"x_intel471_com_uid": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
- ]
+ ],
+ "type": "bundle"
}
\ No newline at end of file
diff --git a/test/fixtures/report_inforep_stix.json b/test/fixtures/report_inforep_stix.json
index 380b423..608e290 100644
--- a/test/fixtures/report_inforep_stix.json
+++ b/test/fixtures/report_inforep_stix.json
@@ -1,82 +1,82 @@
{
- "type": "bundle",
- "id": "bundle--faf9badc-df4a-472c-816b-755aa23daa69",
+ "id": "bundle--615804c9-787d-4d18-a646-92cf1708161a",
"objects": [
{
- "type": "marking-definition",
- "spec_version": "2.1",
- "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
"created": "2017-01-20T00:00:00.000Z",
- "definition_type": "tlp",
- "name": "TLP:AMBER",
"definition": {
"tlp": "amber"
- }
+ },
+ "definition_type": "tlp",
+ "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
+ "name": "TLP:AMBER",
+ "spec_version": "2.1",
+ "type": "marking-definition"
},
{
- "type": "identity",
- "spec_version": "2.1",
- "id": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
"created": "2022-01-01T00:00:00.000Z",
+ "id": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
+ "identity_class": "organization",
"modified": "2022-01-01T00:00:00.000Z",
"name": "Intel 471 Inc.",
- "identity_class": "organization"
+ "spec_version": "2.1",
+ "type": "identity"
},
{
- "type": "email-addr",
- "spec_version": "2.1",
"id": "email-addr--fa518209-6108-53fe-a004-6d80cfcdcc16",
- "value": "example@exaple.com",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
+ "spec_version": "2.1",
+ "type": "email-addr",
+ "value": "example@exaple.com",
"x_opencti_created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd"
},
{
- "type": "domain-name",
- "spec_version": "2.1",
"id": "domain-name--bedb4899-d24b-5401-bc86-8f6b4cc18ec7",
- "value": "example.com",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
+ "spec_version": "2.1",
+ "type": "domain-name",
+ "value": "example.com",
"x_opencti_created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd"
},
{
- "type": "report",
- "spec_version": "2.1",
- "id": "report--0fee6c6f-e494-5b8c-bbfd-8dfe7a748434",
+ "confidence": 50,
+ "content": "Source Characterization
\nLorem ipsum",
+ "created": "2025-11-06T14:44:03.736968Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:50:32.271045Z",
- "modified": "2025-06-09T13:50:32.271045Z",
- "name": "Lorem ipsum",
"description": "Lorem ipsum",
- "report_types": [
- "inforep"
- ],
- "published": "2023-11-14T22:13:20.001Z",
- "object_refs": [
- "email-addr--fa518209-6108-53fe-a004-6d80cfcdcc16",
- "domain-name--bedb4899-d24b-5401-bc86-8f6b4cc18ec7"
- ],
- "labels": [
- "Intel 471 - sensitive source",
- "Intel 471 - GIR 1.1.1 - Lorem",
- "Intel 471 - GIR 1.2"
- ],
- "confidence": 50,
"external_references": [
{
"source_name": "Titan URL",
"url": "https://titan.intel471.com/report/inforep/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
],
+ "id": "report--0fee6c6f-e494-5b8c-bbfd-8dfe7a748434",
+ "labels": [
+ "Intel 471 - sensitive source",
+ "Intel 471 - GIR 1.1.1 - Lorem",
+ "Intel 471 - GIR 1.2"
+ ],
+ "modified": "2025-11-06T14:44:03.736968Z",
+ "name": "Lorem ipsum",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
- "content": "Source Characterization
\nLorem ipsum",
+ "object_refs": [
+ "email-addr--fa518209-6108-53fe-a004-6d80cfcdcc16",
+ "domain-name--bedb4899-d24b-5401-bc86-8f6b4cc18ec7"
+ ],
+ "published": "2023-11-14T22:13:20.001Z",
+ "report_types": [
+ "inforep"
+ ],
+ "spec_version": "2.1",
+ "type": "report",
"x_intel471_com_uid": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"x_opencti_reliability": "C - Fairly reliable"
}
- ]
+ ],
+ "type": "bundle"
}
\ No newline at end of file
diff --git a/test/fixtures/report_malware_stix.json b/test/fixtures/report_malware_stix.json
index ce821a3..52daf66 100644
--- a/test/fixtures/report_malware_stix.json
+++ b/test/fixtures/report_malware_stix.json
@@ -1,72 +1,72 @@
{
- "type": "bundle",
- "id": "bundle--0c791b04-72c9-474c-8c5c-e75184973177",
+ "id": "bundle--bfd6f208-aab2-4ce1-9b43-ed96415ac7dc",
"objects": [
{
- "type": "marking-definition",
- "spec_version": "2.1",
- "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
"created": "2017-01-20T00:00:00.000Z",
- "definition_type": "tlp",
- "name": "TLP:AMBER",
"definition": {
"tlp": "amber"
- }
+ },
+ "definition_type": "tlp",
+ "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
+ "name": "TLP:AMBER",
+ "spec_version": "2.1",
+ "type": "marking-definition"
},
{
- "type": "identity",
- "spec_version": "2.1",
- "id": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
"created": "2022-01-01T00:00:00.000Z",
+ "id": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
+ "identity_class": "organization",
"modified": "2022-01-01T00:00:00.000Z",
"name": "Intel 471 Inc.",
- "identity_class": "organization"
+ "spec_version": "2.1",
+ "type": "identity"
},
{
- "type": "malware",
- "spec_version": "2.1",
- "id": "malware--dca465bc-be4d-5973-9276-573135e47d69",
+ "created": "2025-11-06T14:44:03.742244Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:51:09.357142Z",
- "modified": "2025-06-09T13:51:09.357142Z",
- "name": "lorem",
+ "id": "malware--dca465bc-be4d-5973-9276-573135e47d69",
"is_family": true,
+ "modified": "2025-11-06T14:44:03.742244Z",
+ "name": "lorem",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
- ]
+ ],
+ "spec_version": "2.1",
+ "type": "malware"
},
{
- "type": "report",
- "spec_version": "2.1",
- "id": "report--0fee6c6f-e494-5b8c-bbfd-8dfe7a748434",
+ "confidence": 0,
+ "content": "report text
",
+ "created": "2025-11-06T14:44:03.742588Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:51:09.357817Z",
- "modified": "2025-06-09T13:51:09.357817Z",
- "name": "Lorem ipsum",
"description": "Lorem ipsum",
- "report_types": [
- "malware"
- ],
- "published": "2023-11-14T22:13:20.001Z",
- "object_refs": [
- "malware--dca465bc-be4d-5973-9276-573135e47d69"
- ],
- "labels": [
- "lorem",
- "Intel 471 - GIR 1.1.1 - Lorem"
- ],
- "confidence": 0,
"external_references": [
{
"source_name": "Titan URL",
"url": "https://titan.intel471.com/report/malware/eaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
],
+ "id": "report--0fee6c6f-e494-5b8c-bbfd-8dfe7a748434",
+ "labels": [
+ "lorem",
+ "Intel 471 - GIR 1.1.1 - Lorem"
+ ],
+ "modified": "2025-11-06T14:44:03.742588Z",
+ "name": "Lorem ipsum",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
- "content": "report text
",
+ "object_refs": [
+ "malware--dca465bc-be4d-5973-9276-573135e47d69"
+ ],
+ "published": "2023-11-14T22:13:20.001Z",
+ "report_types": [
+ "malware"
+ ],
+ "spec_version": "2.1",
+ "type": "report",
"x_intel471_com_uid": "eaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
- ]
+ ],
+ "type": "bundle"
}
\ No newline at end of file
diff --git a/test/fixtures/report_spot_stix.json b/test/fixtures/report_spot_stix.json
index 6f67e12..e99b8ea 100644
--- a/test/fixtures/report_spot_stix.json
+++ b/test/fixtures/report_spot_stix.json
@@ -1,74 +1,58 @@
{
- "type": "bundle",
- "id": "bundle--137c1241-70d1-4dfb-a731-68dde5e6be81",
+ "id": "bundle--f387dff5-0be7-40ae-adcf-eb17183355b6",
"objects": [
{
- "type": "marking-definition",
- "spec_version": "2.1",
- "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
"created": "2017-01-20T00:00:00.000Z",
- "definition_type": "tlp",
- "name": "TLP:AMBER",
"definition": {
"tlp": "amber"
- }
+ },
+ "definition_type": "tlp",
+ "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
+ "name": "TLP:AMBER",
+ "spec_version": "2.1",
+ "type": "marking-definition"
},
{
- "type": "identity",
- "spec_version": "2.1",
- "id": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
"created": "2022-01-01T00:00:00.000Z",
+ "id": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
+ "identity_class": "organization",
"modified": "2022-01-01T00:00:00.000Z",
"name": "Intel 471 Inc.",
- "identity_class": "organization"
+ "spec_version": "2.1",
+ "type": "identity"
},
{
- "type": "threat-actor",
- "spec_version": "2.1",
- "id": "threat-actor--6f18e374-7f3b-53c2-89c2-4584c62773de",
+ "created": "2025-11-06T14:44:03.739217Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:50:52.364568Z",
- "modified": "2025-06-09T13:50:52.364568Z",
+ "id": "threat-actor--6f18e374-7f3b-53c2-89c2-4584c62773de",
+ "modified": "2025-11-06T14:44:03.739217Z",
"name": "Dummy handle",
- "resource_level": "individual",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
- ]
+ ],
+ "resource_level": "individual",
+ "spec_version": "2.1",
+ "type": "threat-actor"
},
{
- "type": "threat-actor",
- "spec_version": "2.1",
- "id": "threat-actor--771cb531-1676-596f-8e3a-533952a34615",
+ "created": "2025-11-06T14:44:03.739363Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:50:52.36501Z",
- "modified": "2025-06-09T13:50:52.36501Z",
+ "id": "threat-actor--771cb531-1676-596f-8e3a-533952a34615",
+ "modified": "2025-11-06T14:44:03.739363Z",
"name": "Dummy handle2",
- "resource_level": "individual",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
- ]
+ ],
+ "resource_level": "individual",
+ "spec_version": "2.1",
+ "type": "threat-actor"
},
{
- "type": "report",
- "spec_version": "2.1",
- "id": "report--0fee6c6f-e494-5b8c-bbfd-8dfe7a748434",
+ "confidence": 0,
+ "content": "",
+ "created": "2025-11-06T14:44:03.739759Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:50:52.365487Z",
- "modified": "2025-06-09T13:50:52.365487Z",
- "name": "Lorem ipsum",
"description": "Lorem ipsum",
- "report_types": [
- "spotrep"
- ],
- "published": "2023-11-14T22:13:20.001Z",
- "object_refs": [
- "threat-actor--6f18e374-7f3b-53c2-89c2-4584c62773de",
- "threat-actor--771cb531-1676-596f-8e3a-533952a34615"
- ],
- "labels": [
- "Intel 471 - GIR 1.1.1 - Lorem"
- ],
- "confidence": 0,
"external_references": [
{
"source_name": "Titan URL",
@@ -79,11 +63,27 @@
"url": "https://dummy"
}
],
+ "id": "report--0fee6c6f-e494-5b8c-bbfd-8dfe7a748434",
+ "labels": [
+ "Intel 471 - GIR 1.1.1 - Lorem"
+ ],
+ "modified": "2025-11-06T14:44:03.739759Z",
+ "name": "Lorem ipsum",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
- "content": "",
+ "object_refs": [
+ "threat-actor--6f18e374-7f3b-53c2-89c2-4584c62773de",
+ "threat-actor--771cb531-1676-596f-8e3a-533952a34615"
+ ],
+ "published": "2023-11-14T22:13:20.001Z",
+ "report_types": [
+ "spotrep"
+ ],
+ "spec_version": "2.1",
+ "type": "report",
"x_intel471_com_uid": "11111111111111111111111111111111"
}
- ]
+ ],
+ "type": "bundle"
}
\ No newline at end of file
diff --git a/test/fixtures/reports_from_iocs_stix.json b/test/fixtures/reports_from_iocs_stix.json
index 63cd910..3edcd9e 100644
--- a/test/fixtures/reports_from_iocs_stix.json
+++ b/test/fixtures/reports_from_iocs_stix.json
@@ -1,14 +1,14 @@
{
- "id": "bundle--a0f7aff1-9db8-43a8-9c1f-86cc2382f538",
+ "id": "bundle--f590231e-f84e-4fd2-864a-a96a91b1a299",
"objects": [
{
- "created": "2025-06-09T13:48:24.173193Z",
+ "created": "2025-11-06T14:44:03.72429Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
"id": "indicator--e61008aa-ce88-585b-bc65-a37626ce9f1b",
"indicator_types": [
"malicious-activity"
],
- "modified": "2025-06-09T13:48:24.173193Z",
+ "modified": "2025-11-06T14:44:03.72429Z",
"name": "38a5dfa3ec07f08e8e1788d1d567359a7ed95b0e354953cf0222e0fea1872a7e",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
@@ -34,10 +34,13 @@
"x_opencti_created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd"
},
{
- "created": "2025-06-09T13:48:24.177795Z",
+ "created": "2025-11-06T14:44:03.724684Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
"id": "relationship--91ce1401-7c34-51e2-87a5-5ee68a47962a",
- "modified": "2025-06-09T13:48:24.177795Z",
+ "modified": "2025-11-06T14:44:03.724684Z",
+ "object_marking_refs": [
+ "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
+ ],
"relationship_type": "based-on",
"source_ref": "indicator--e61008aa-ce88-585b-bc65-a37626ce9f1b",
"spec_version": "2.1",
@@ -66,7 +69,7 @@
},
{
"confidence": 50,
- "created": "2025-06-09T13:48:24.178313Z",
+ "created": "2025-11-06T14:44:03.724945Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
"description": "ACME Corp. possibly compromised by actor Coyote one",
"external_references": [
@@ -76,7 +79,7 @@
}
],
"id": "report--0822a415-51bb-5067-aea0-8dd4247da211",
- "modified": "2025-06-09T13:48:24.178313Z",
+ "modified": "2025-11-06T14:44:03.724945Z",
"name": "ACME Corp. possibly compromised by actor Coyote one",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
@@ -96,7 +99,7 @@
},
{
"confidence": 90,
- "created": "2025-06-09T13:48:24.178676Z",
+ "created": "2025-11-06T14:44:03.725113Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
"description": "ACME Corp. possibly compromised by actor Coyote two",
"external_references": [
@@ -106,7 +109,7 @@
}
],
"id": "report--396ddf19-958f-5cac-839a-684a91910999",
- "modified": "2025-06-09T13:48:24.178676Z",
+ "modified": "2025-11-06T14:44:03.725113Z",
"name": "ACME Corp. possibly compromised by actor Coyote two",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
@@ -126,7 +129,7 @@
},
{
"confidence": 0,
- "created": "2025-06-09T13:48:24.178845Z",
+ "created": "2025-11-06T14:44:03.725266Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
"description": "ACME Corp. possibly compromised by actor Coyote three",
"external_references": [
@@ -136,7 +139,7 @@
}
],
"id": "report--aa0981d3-e9af-5f3b-8970-a9fc24385ab1",
- "modified": "2025-06-09T13:48:24.178845Z",
+ "modified": "2025-11-06T14:44:03.725266Z",
"name": "ACME Corp. possibly compromised by actor Coyote three",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
@@ -156,7 +159,7 @@
},
{
"confidence": 0,
- "created": "2025-06-09T13:48:24.179016Z",
+ "created": "2025-11-06T14:44:03.725414Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
"description": "ACME Corp. possibly compromised by actor Coyote four",
"external_references": [
@@ -166,7 +169,7 @@
}
],
"id": "report--eb6c0c43-799d-52bc-b1f9-4a766141adff",
- "modified": "2025-06-09T13:48:24.179016Z",
+ "modified": "2025-11-06T14:44:03.725414Z",
"name": "ACME Corp. possibly compromised by actor Coyote four",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
diff --git a/test/fixtures/yara_stix.json b/test/fixtures/yara_stix.json
index 2280529..671fd40 100644
--- a/test/fixtures/yara_stix.json
+++ b/test/fixtures/yara_stix.json
@@ -1,72 +1,75 @@
{
- "type": "bundle",
- "id": "bundle--09b50c59-6ca1-40fc-9c99-39c0d698c279",
+ "id": "bundle--d6bc3554-1c5c-48da-a7b5-97d6b62c22b6",
"objects": [
{
- "type": "malware",
- "spec_version": "2.1",
- "id": "malware--5709afa6-1486-5cfe-98fb-205568ec6491",
+ "created": "2025-11-06T14:44:03.719556Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:45:58.901896Z",
- "modified": "2025-06-09T13:45:58.901896Z",
- "name": "foobar",
+ "id": "malware--5709afa6-1486-5cfe-98fb-205568ec6491",
"is_family": true,
+ "modified": "2025-11-06T14:44:03.719556Z",
+ "name": "foobar",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
- ]
+ ],
+ "spec_version": "2.1",
+ "type": "malware"
},
{
- "type": "indicator",
- "spec_version": "2.1",
- "id": "indicator--dee6befd-c56e-599f-89c5-5fe70bb7c0f1",
+ "confidence": 85,
+ "created": "2025-11-06T14:44:03.719676Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:45:58.902267Z",
- "modified": "2025-06-09T13:45:58.902267Z",
+ "id": "indicator--dee6befd-c56e-599f-89c5-5fe70bb7c0f1",
"indicator_types": [
"malicious-activity"
],
- "pattern": "rule Foobar\n{\n meta:\n author = \"Myself\"\n}",
- "pattern_type": "yara",
- "valid_from": "2022-05-30T12:06:12Z",
"labels": [
"foobar",
"Intel 471 - GIR 1.1"
],
- "confidence": 85,
+ "modified": "2025-11-06T14:44:03.719676Z",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
- ]
+ ],
+ "pattern": "rule Foobar\n{\n meta:\n author = \"Myself\"\n}",
+ "pattern_type": "yara",
+ "spec_version": "2.1",
+ "type": "indicator",
+ "valid_from": "2022-05-30T12:06:12Z"
},
{
- "type": "relationship",
- "spec_version": "2.1",
- "id": "relationship--f5e2c605-33d8-5050-b980-6079f52f9e82",
+ "created": "2025-11-06T14:44:03.719773Z",
"created_by_ref": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
- "created": "2025-06-09T13:45:58.902386Z",
- "modified": "2025-06-09T13:45:58.902386Z",
+ "id": "relationship--f5e2c605-33d8-5050-b980-6079f52f9e82",
+ "modified": "2025-11-06T14:44:03.719773Z",
+ "object_marking_refs": [
+ "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
+ ],
"relationship_type": "indicates",
"source_ref": "indicator--dee6befd-c56e-599f-89c5-5fe70bb7c0f1",
- "target_ref": "malware--5709afa6-1486-5cfe-98fb-205568ec6491"
+ "spec_version": "2.1",
+ "target_ref": "malware--5709afa6-1486-5cfe-98fb-205568ec6491",
+ "type": "relationship"
},
{
- "type": "identity",
- "spec_version": "2.1",
- "id": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
"created": "2022-01-01T00:00:00.000Z",
+ "id": "identity--ba6a107e-4a66-5fd3-833c-43318ba163fd",
+ "identity_class": "organization",
"modified": "2022-01-01T00:00:00.000Z",
"name": "Intel 471 Inc.",
- "identity_class": "organization"
+ "spec_version": "2.1",
+ "type": "identity"
},
{
- "type": "marking-definition",
- "spec_version": "2.1",
- "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
"created": "2017-01-20T00:00:00.000Z",
- "definition_type": "tlp",
- "name": "TLP:AMBER",
"definition": {
"tlp": "amber"
- }
+ },
+ "definition_type": "tlp",
+ "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
+ "name": "TLP:AMBER",
+ "spec_version": "2.1",
+ "type": "marking-definition"
}
- ]
+ ],
+ "type": "bundle"
}
\ No newline at end of file
diff --git a/titan_client/__init__.py b/titan_client/__init__.py
index 0fecb36..2027453 100644
--- a/titan_client/__init__.py
+++ b/titan_client/__init__.py
@@ -14,7 +14,7 @@
from __future__ import absolute_import
-__version__ = "1.20.0.14"
+__version__ = "1.20.0.15"
# import apis into sdk package
from titan_client.api.actors_api import ActorsApi
diff --git a/titan_client/api_client.py b/titan_client/api_client.py
index 2afd616..07d0bc8 100644
--- a/titan_client/api_client.py
+++ b/titan_client/api_client.py
@@ -78,7 +78,7 @@ def __init__(self, configuration=None, header_name=None, header_value=None,
self.default_headers[header_name] = header_value
self.cookie = cookie
# Set default User-Agent.
- self.user_agent = 'OpenAPI-Generator/1.20.0.14/python'
+ self.user_agent = 'OpenAPI-Generator/1.20.0.15/python'
self.client_side_validation = configuration.client_side_validation
def __enter__(self):
diff --git a/titan_client/configuration.py b/titan_client/configuration.py
index a1f8340..8ef8069 100644
--- a/titan_client/configuration.py
+++ b/titan_client/configuration.py
@@ -409,7 +409,7 @@ def to_debug_report(self):
"OS: {env}\n"\
"Python Version: {pyversion}\n"\
"Version of the API: 1.20.0\n"\
- "SDK Package Version: 1.20.0.14".\
+ "SDK Package Version: 1.20.0.15".\
format(env=sys.platform, pyversion=sys.version)
def get_host_settings(self):
diff --git a/titan_client/titan_stix/mappers/cves.py b/titan_client/titan_stix/mappers/cves.py
index 3830eae..c64e926 100644
--- a/titan_client/titan_stix/mappers/cves.py
+++ b/titan_client/titan_stix/mappers/cves.py
@@ -77,6 +77,7 @@ def map(self, source: dict) -> Bundle:
source_ref=software,
relationship_type= "has",
target_ref=vulnerability,
+ object_marking_refs=[MARKING],
created_by_ref=author_identity)
container.extend([vulnerability, software, rel, author_identity, MARKING])
if container:
diff --git a/titan_client/titan_stix/mappers/indicators.py b/titan_client/titan_stix/mappers/indicators.py
index 5619c5d..b06d448 100644
--- a/titan_client/titan_stix/mappers/indicators.py
+++ b/titan_client/titan_stix/mappers/indicators.py
@@ -2,13 +2,14 @@
from pytz import UTC
import pycti
-from stix2 import Indicator, Bundle, Relationship, KillChainPhase, TLP_AMBER
+from stix2 import Indicator, Bundle, Relationship, KillChainPhase
from .. import author_identity, StixObjects
from .common import StixMapper, BaseMapper, MappingConfig
from ..patterning import create_url_pattern, create_ipv4_pattern, create_file_pattern
from ..sco import map_url, map_ipv4, map_file
from ..sdo import map_malware
+from ..constants import MARKING
@StixMapper.register("indicators", lambda x: "indicatorTotalCount" in x)
@@ -84,7 +85,7 @@ def map(self, source: dict) -> Bundle:
valid_from=valid_from,
valid_until=valid_until,
created_by_ref=author_identity,
- object_marking_refs=[TLP_AMBER],
+ object_marking_refs=[MARKING],
name=name,
description=description,
labels=labels,
@@ -102,6 +103,7 @@ def map(self, source: dict) -> Bundle:
source_ref=indicator,
relationship_type="indicates",
target_ref=malware,
+ object_marking_refs=[MARKING],
created_by_ref=author_identity
)
r2 = Relationship(
@@ -112,6 +114,7 @@ def map(self, source: dict) -> Bundle:
source_ref=indicator,
relationship_type="based-on",
target_ref=observable,
+ object_marking_refs=[MARKING],
created_by_ref=author_identity
)
for stix_object in [
@@ -121,7 +124,7 @@ def map(self, source: dict) -> Bundle:
r1,
r2,
author_identity,
- TLP_AMBER,
+ MARKING,
]:
container.add(stix_object)
if container:
diff --git a/titan_client/titan_stix/mappers/iocs.py b/titan_client/titan_stix/mappers/iocs.py
index f40f8f8..6d8d1a0 100644
--- a/titan_client/titan_stix/mappers/iocs.py
+++ b/titan_client/titan_stix/mappers/iocs.py
@@ -105,6 +105,7 @@ def map(self, source: dict) -> Bundle:
source_ref=indicator,
relationship_type="based-on",
target_ref=observable,
+ object_marking_refs=[MARKING],
created_by_ref=author_identity
)
container.extend([indicator, observable, r1, author_identity, MARKING])
diff --git a/titan_client/titan_stix/mappers/yara.py b/titan_client/titan_stix/mappers/yara.py
index 2ec0316..81d302c 100644
--- a/titan_client/titan_stix/mappers/yara.py
+++ b/titan_client/titan_stix/mappers/yara.py
@@ -2,10 +2,11 @@
from pytz import UTC
import pycti
-from stix2 import Indicator, Bundle, Relationship, TLP_AMBER
+from stix2 import Indicator, Bundle, Relationship
from .common import StixMapper, BaseMapper
from .. import author_identity, StixObjects
from ..sdo import map_malware
+from ..constants import MARKING
@StixMapper.register("yara", lambda x: "yaraTotalCount" in x)
@@ -30,7 +31,7 @@ def map(self, source: dict) -> Bundle:
indicator_types=["malicious-activity"],
valid_from=valid_from,
created_by_ref=author_identity,
- object_marking_refs=[TLP_AMBER],
+ object_marking_refs=[MARKING],
labels=labels,
confidence=confidence,
)
@@ -42,6 +43,7 @@ def map(self, source: dict) -> Bundle:
source_ref=indicator,
relationship_type="indicates",
target_ref=malware,
+ object_marking_refs=[MARKING],
created_by_ref=author_identity
)
for stix_object in [
@@ -49,7 +51,7 @@ def map(self, source: dict) -> Bundle:
indicator,
relationship,
author_identity,
- TLP_AMBER,
+ MARKING,
]:
container.add(stix_object)
if container: