mvt icon indicating copy to clipboard operation
mvt copied to clipboard

Improves STIX2 parsing and doc

Open Te-k opened this issue 1 year ago • 0 comments
trafficstars

As raised by #517, we are not supporting everything we could in STIX2 specifications and aren't clear on how we use it, which means that some people may import STIX2 files without understanding that some indicators won't be used by MVT.

Tasks:

  • [x] Double check that our implementation matches others (it seems for instance that we use file:hashes.sha256 but OTX file:hashes.'SHA-256')
  • [x] Adds support for URL, SHA1 and MD5
  • [x] Clarify in the documentation how we use STIX2
  • [x] Adds tests
  • [x] Adds logs when we can't parse indicators in STIX2 files

Te-k avatar Aug 20 '24 07:08 Te-k