Misp: STIX2 export type transformation

[ufo0531]

Work environment

| Questions | Answers
|---------------------------|--------------------
| Type of issue | Bug
| OS version (server) | ubuntu
| OS version (client) | Ubuntu
| PHP version | 7.2
| MISP version / git hash | 2.4.112
| Browser | If applicable

Expected behavior

We have a MISP event with object type stix2-pattern.
e.g.

"Object": [
            {
                "id": "2908",
                "name": "stix2-pattern",
                "meta-category": "stix2-pattern",
                "description": "An object describing a STIX pattern. The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a STIX pattern.",
                "template_uuid": "0c5bd072-7c3e-4d45-86f7-a8104d9143b9",
                "template_version": "2",
                "event_id": "980",
                "uuid": "b3b2ad18-5c9a-4cf4-ac55-c6c9f6b605c0",
                "timestamp": "1573135139",
                "distribution": "5",
                "sharing_group_id": "0",
                "comment": "",
                "deleted": false,
                "ObjectReference": [],
                "Attribute": [
                    {
                        "id": "8724",
                        "type": "text",
                        "category": "Other",
                        "to_ids": false,
                        "uuid": "399e9b74-5cb9-4e0b-9888-1798b9f272b7",
                        "event_id": "980",
                        "distribution": "5",
                        "timestamp": "1573135139",
                        "comment": "",
                        "sharing_group_id": "0",
                        "deleted": false,
                        "disable_correlation": true,
                        "object_id": "2908",
                        "object_relation": "version",
                        "value": "STIX 2.0",
                        "Galaxy": [],
                        "ShadowAttribute": []
                    },
                    {
                        "id": "8725",
                        "type": "stix2-pattern",
                        "category": "Payload installation",
                        "to_ids": true,
                        "uuid": "189c7bb5-d9eb-40d2-9aff-d6673ee161c3",
                        "event_id": "980",
                        "distribution": "5",
                        "timestamp": "1573135138",
                        "comment": "",
                        "sharing_group_id": "0",
                        "deleted": false,
                        "disable_correlation": false,
                        "object_id": "2908",
                        "object_relation": "stix2-pattern",
                        "value": "[domain-name:value='nid1969.org']",
                        "Galaxy": [],
                        "ShadowAttribute": []
                    }
                ]
            },
...

When we export this event to STIX2.0, it should be an indicator type in STIX2.0.
e.g.

{
    "id": "indicator--5dc42feb-4f2c-4f90-b789-4bf51c4ddf5d",
    "type": "indicator",
            ...
    "pattern": "[...]",
}

But we got a custom misp object in exported STIX2.0 file.

{
         "id": "x-misp-object--b3b2ad18-5c9a-4cf4-ac55-c6c9f6b605c0",
         "x_misp_values": {
            "text_version": "STIX 2.0",
            "stix2-pattern_stix2-pattern": "[domain-name:value='nid1969.org']"
         },
         "labels": [
            "misp:type=\"stix2-pattern\"",
            "misp:category=\"stix2-pattern\"",
            "misp:to_ids=\"True\"",
            "from_object"
         ],
         "x_misp_category": "stix2-pattern",
         "created_by_ref": "identity--5ca5c957-6f98-43c6-b175-0cdac0a8fb04",
         "x_misp_timestamp": "2019-11-07 13:58:59",
         "type": "x-misp-object-stix2-pattern",
         "created": "2019-11-07T17:01:00.864Z",
         "modified": "2019-11-07T17:01:00.864Z"
 }

It seems no such mapping in the script misp2stix2_mapping.py.
Thanks.

[chrisr3d]

Should be fixed with 6beb549.
Tell me if anything still goes wrong
I hope it helps

[ufo0531]

Thanks. It should be this commit https://github.com/MISP/MISP/commit/478015a32a898e1041ba1e1f22518f2f19b101ee

I'll give it a try.

[ufo0531]

Hi, @chrisr3d It seems not work.
There is no stix2-pattern mapping in this function:
https://github.com/MISP/MISP/blob/74f61bcf4c495b1f66f64282288b8eef57bfc186/app/files/scripts/stix2/misp2stix2.py#L190
So it can not generate the indicator in stix2

[chrisr3d]

It was indeed in my changes so it worked for me but I missed it and did not push it, so it kept failing for you.
It should work as intended now