mvt
mvt copied to clipboard
Improves STIX2 parsing and doc
trafficstars
As raised by #517, we are not supporting everything we could in STIX2 specifications and aren't clear on how we use it, which means that some people may import STIX2 files without understanding that some indicators won't be used by MVT.
Tasks:
- [x] Double check that our implementation matches others (it seems for instance that we use file:hashes.sha256 but OTX file:hashes.'SHA-256')
- [x] Adds support for URL, SHA1 and MD5
- [x] Clarify in the documentation how we use STIX2
- [x] Adds tests
- [x] Adds logs when we can't parse indicators in STIX2 files