client-python
client-python copied to clipboard
Identity ID generated for "The MITRE Corporation" inconsistent with what is provided by MITRE
Description
The issue is related to Identity ID for "The MITRE Corporation". I encountered two IDs and they are inconsistent.
- When generated by using the
pycti.Identity.generate_id, the ID isidentity--f11b0831-e7e6-5214-9431-ccf054e53e94; - When found on the internet, the ID is
identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
So the question is,
- Why are there two inconsistent ones for the same identity?
- What are some acceptable mitigations in order to load MITRE ATT&CK?
Environment
pycti 5.3.17
Actual Output (or pycti Output)
Steps to create the smallest reproducible scenario:
# Code
from pycti import Identity
mitre_id = Identity.generate_id("The MITRE Corporation", "organization")
print(mitre_id)
# Result
identity--f11b0831-e7e6-5214-9431-ccf054e53e94
Expected Output (or Internet Expectation)
It seems that the "correct" ID corresponding to "The MITRE Corporation" should be identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5.
Evidence 1
# Source: https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"
Evidence 2
# source: https://api.intelligence.fireeye.com/docs#indicators-collection
{
"object_marking_refs": [],
"id": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"name": "The MITRE Corporation",
"type": "identity",
"created": "2017-06-01T00:00:00.000Z",
"modified": "2017-06-01T00:00:00.000Z",
"revoked": false,
"identity_class": "organization",
"lang": "en",
"spec_version": "2.1"
},
Evidence 3
# Source: https://docs.sekoia.io/tip/features/data_model/
{
"type": "attack-pattern",
"name": "Spearphishing Link",
"id": "attack-pattern--6cd1a813-ccdf-4ba0-9b54-cb808f1059cc",
"created_by_ref": "identity--357447d7-9229-4ce1-b7fa-f1b83587048e", # SEKOIA
"x_inthreat_sources_refs": [
"identity--357447d7-9229-4ce1-b7fa-f1b83587048e", # SEKOIA
"identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5" # The MITRE Corporation
],
[...]
}