cti-pattern-matcher icon indicating copy to clipboard operation
cti-pattern-matcher copied to clipboard

STIX2 OD not compatible with pattern matcher

Open jmgnc opened this issue 3 years ago • 2 comments

So, a generated stix2 observed data is not compatible w/ the pattern matcher code. See the attached file. t.txt

When run, it raises:

$ python t.py
Traceback (most recent call last):
  File "/Users/jmg/work/python-indicator/t.py", line 8, in <module>
    print(repr(stix2matcher.matcher.match("[ artifact:payload = 'pass' ]", [ od ])))
  File "/Users/jmg/work/python-indicator/p/lib/python3.9/site-packages/stix2matcher/matcher.py", line 2349, in match
    return compiled_pattern.match(observed_data_sdos, verbose)
  File "/Users/jmg/work/python-indicator/p/lib/python3.9/site-packages/stix2matcher/matcher.py", line 2322, in match
    matcher = MatchListener(observed_data_sdos, verbose)
  File "/Users/jmg/work/python-indicator/p/lib/python3.9/site-packages/stix2matcher/matcher.py", line 1008, in __init__
    self.__time_intervals.append((_str_to_datetime(sdo["first_observed"]),
  File "/Users/jmg/work/python-indicator/p/lib/python3.9/site-packages/stix2matcher/matcher.py", line 474, in _str_to_datetime
    if not ignore_case and any(c.islower() for c in timestamp_str):
TypeError: 'STIXdatetime' object is not iterable

jmgnc avatar Oct 28 '21 00:10 jmgnc

If the object is serialized to json, and then deserialized, such that the STIX2 object wrapper is removed, it works as expected.

that is, adding this code:

od = json.loads(od.serialize())

jmgnc avatar Oct 28 '21 00:10 jmgnc

~first_observed and last_observed should be strings, not datetime objects.~

My bad: they can be datetime objects, date objects, or timestamp strings. And the error occurs with all of them.

clslgrnc avatar Mar 17 '22 16:03 clslgrnc