[client] exclude src_ref and dst_ref handling in import_observable (#14597)#14666
[client] exclude src_ref and dst_ref handling in import_observable (#14597)#14666JeremyCloarec merged 1 commit intomasterfrom
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #14666 +/- ##
=======================================
Coverage 32.36% 32.37%
=======================================
Files 3096 3096
Lines 210905 210968 +63
Branches 38201 38213 +12
=======================================
+ Hits 68269 68297 +28
- Misses 142636 142671 +35
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
Adjusts the Python client STIX2 import logic to avoid creating duplicate nested-ref relationships for Network-Traffic src_ref / dst_ref, which can trigger the “Cant add another relation on single ref” error when importing bundles containing NetworkTraffic + IP observables.
Changes:
- Excludes
src_refanddst_reffrom the generic “iterate over refs and create nested relationships” loop inimport_observable.
| # Iterate over refs to create appropriate relationships | ||
| for key in stix_object.keys(): | ||
| if key not in [ | ||
| "created_by_ref", | ||
| "object_marking_refs", | ||
| "x_opencti_created_by_ref", | ||
| "x_opencti_granted_refs", | ||
| "src_ref", | ||
| "dst_ref", | ||
| ]: |
There was a problem hiding this comment.
This change fixes a specific import path (Network-Traffic src_ref/dst_ref), but there’s no unit/integration test ensuring import_observable does not call stix_nested_ref_relationship.create for these keys anymore. Adding a regression test with a mocked api_client/opencti that imports a Network-Traffic observable (with src_ref/dst_ref) and asserts only the observable creation is performed would prevent reintroducing the "Cant add another relation on single ref" error.
Proposed changes
Related issues
Checklist
Further comments