[crowdstrike] Add function to import malware families (#2003) #5223
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ieval of the malware families
…on, like stix or formating
…he main flow/orchestration
Kakudou
added
filigran team
…ass instead of sector
Kakudou
changed the base branch from
feat/4649-crowdstrike-improve-connector-and-data-modeling
to
master
Kakudou
changed the base branch from
master
to
feat/4649-crowdstrike-improve-connector-and-data-modeling
| """Create the main Malware entity.""" | ||
| description = self._get_description() | ||
| external_references = self._create_external_references() | ||
| capabilities = self._get_capabilities() |
Member
There was a problem hiding this comment.
Can we comment on this part of the code for now, for two reasons:
- There seems to be a problem when parsing this field:
- In my opinion, the "Crowdstrike" field does not correspond to our "capabilities" field but rather to the "malware_type" field.
@CTIBurn0ut : What's your opinion ?
| created_by=self.author, | ||
| is_family=True, | ||
| description=description, | ||
| capabilities=capabilities, |
Member
There was a problem hiding this comment.
As we have information about the "kill chain phases" associated to the malware in CrowdStrike response, can we associate kill chain to the malware when creating it like we do here: https://github.com/OpenCTI-Platform/connectors/blob/master/external-import/crowdstrike/src/crowdstrike_feeds_connector/indicator/builder.py#L468
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed changes
As stated in the issue #2003 we add a way to retrieve the malware families.
Tests have been added for that new feature.
Before:
No way to directly retrieve malware
After:
Related issues
Checklist
Further comments