cti-pattern-matcher
cti-pattern-matcher copied to clipboard
STIX2 OD not compatible with pattern matcher
So, a generated stix2 observed data is not compatible w/ the pattern matcher code. See the attached file. t.txt
When run, it raises:
$ python t.py
Traceback (most recent call last):
File "/Users/jmg/work/python-indicator/t.py", line 8, in <module>
print(repr(stix2matcher.matcher.match("[ artifact:payload = 'pass' ]", [ od ])))
File "/Users/jmg/work/python-indicator/p/lib/python3.9/site-packages/stix2matcher/matcher.py", line 2349, in match
return compiled_pattern.match(observed_data_sdos, verbose)
File "/Users/jmg/work/python-indicator/p/lib/python3.9/site-packages/stix2matcher/matcher.py", line 2322, in match
matcher = MatchListener(observed_data_sdos, verbose)
File "/Users/jmg/work/python-indicator/p/lib/python3.9/site-packages/stix2matcher/matcher.py", line 1008, in __init__
self.__time_intervals.append((_str_to_datetime(sdo["first_observed"]),
File "/Users/jmg/work/python-indicator/p/lib/python3.9/site-packages/stix2matcher/matcher.py", line 474, in _str_to_datetime
if not ignore_case and any(c.islower() for c in timestamp_str):
TypeError: 'STIXdatetime' object is not iterable
If the object is serialized to json, and then deserialized, such that the STIX2 object wrapper is removed, it works as expected.
that is, adding this code:
od = json.loads(od.serialize())
~first_observed
and last_observed
should be strings, not datetime objects.~
My bad: they can be datetime objects, date objects, or timestamp strings. And the error occurs with all of them.