Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

STIX2 OD not compatible with pattern matcher #73

Open
jmgnc opened this issue Oct 28, 2021 · 2 comments
Open

STIX2 OD not compatible with pattern matcher #73

jmgnc opened this issue Oct 28, 2021 · 2 comments

Comments

@jmgnc
Copy link

jmgnc commented Oct 28, 2021

So, a generated stix2 observed data is not compatible w/ the pattern matcher code. See the attached file.
t.txt

When run, it raises:

$ python t.py
Traceback (most recent call last):
  File "/Users/jmg/work/python-indicator/t.py", line 8, in <module>
    print(repr(stix2matcher.matcher.match("[ artifact:payload = 'pass' ]", [ od ])))
  File "/Users/jmg/work/python-indicator/p/lib/python3.9/site-packages/stix2matcher/matcher.py", line 2349, in match
    return compiled_pattern.match(observed_data_sdos, verbose)
  File "/Users/jmg/work/python-indicator/p/lib/python3.9/site-packages/stix2matcher/matcher.py", line 2322, in match
    matcher = MatchListener(observed_data_sdos, verbose)
  File "/Users/jmg/work/python-indicator/p/lib/python3.9/site-packages/stix2matcher/matcher.py", line 1008, in __init__
    self.__time_intervals.append((_str_to_datetime(sdo["first_observed"]),
  File "/Users/jmg/work/python-indicator/p/lib/python3.9/site-packages/stix2matcher/matcher.py", line 474, in _str_to_datetime
    if not ignore_case and any(c.islower() for c in timestamp_str):
TypeError: 'STIXdatetime' object is not iterable
@jmgnc
Copy link
Author

jmgnc commented Oct 28, 2021

If the object is serialized to json, and then deserialized, such that the STIX2 object wrapper is removed, it works as expected.

that is, adding this code:

od = json.loads(od.serialize())

@clslgrnc
Copy link
Contributor

clslgrnc commented Mar 17, 2022

first_observed and last_observed should be strings, not datetime objects.

My bad: they can be datetime objects, date objects, or timestamp strings. And the error occurs with all of them.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants