Skip to content

[client] exclude src_ref and dst_ref handling in import_observable (#14597)#14666

Merged
JeremyCloarec merged 1 commit intomasterfrom
issue/14597
Mar 3, 2026
Merged

[client] exclude src_ref and dst_ref handling in import_observable (#14597)#14666
JeremyCloarec merged 1 commit intomasterfrom
issue/14597

Conversation

@JeremyCloarec
Copy link
Contributor

@JeremyCloarec JeremyCloarec commented Feb 27, 2026

Proposed changes

  • exclude src_ref and dst_ref handling in import_observable. They are already handled directly in observable creation in opencti_stix_cyber_observable's create

Related issues

Checklist

  • I consider the submitted work as finished
  • I tested the code for its functionality
  • I wrote test cases for the relevant uses case (coverage and e2e)
  • I added/update the relevant documentation (either on github or on notion)
  • Where necessary I refactored code to improve the overall quality

Further comments

@JeremyCloarec JeremyCloarec marked this pull request as ready for review February 27, 2026 09:24
@github-actions github-actions bot added the filigran team use to identify PR from the Filigran team label Feb 27, 2026
@codecov
Copy link

codecov bot commented Feb 27, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 32.37%. Comparing base (0f1ee38) to head (d20838f).
⚠️ Report is 24 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master   #14666   +/-   ##
=======================================
  Coverage   32.36%   32.37%           
=======================================
  Files        3096     3096           
  Lines      210905   210968   +63     
  Branches    38201    38213   +12     
=======================================
+ Hits        68269    68297   +28     
- Misses     142636   142671   +35     
Flag Coverage Δ
opencti-client-python 45.50% <ø> (ø)
opencti-front 2.83% <ø> (+<0.01%) ⬆️
opencti-graphql 67.73% <ø> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adjusts the Python client STIX2 import logic to avoid creating duplicate nested-ref relationships for Network-Traffic src_ref / dst_ref, which can trigger the “Cant add another relation on single ref” error when importing bundles containing NetworkTraffic + IP observables.

Changes:

  • Excludes src_ref and dst_ref from the generic “iterate over refs and create nested relationships” loop in import_observable.

Comment on lines 1411 to 1420
# Iterate over refs to create appropriate relationships
for key in stix_object.keys():
if key not in [
"created_by_ref",
"object_marking_refs",
"x_opencti_created_by_ref",
"x_opencti_granted_refs",
"src_ref",
"dst_ref",
]:
Copy link

Copilot AI Feb 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change fixes a specific import path (Network-Traffic src_ref/dst_ref), but there’s no unit/integration test ensuring import_observable does not call stix_nested_ref_relationship.create for these keys anymore. Adding a regression test with a mocked api_client/opencti that imports a Network-Traffic observable (with src_ref/dst_ref) and asserts only the observable creation is performed would prevent reintroducing the "Cant add another relation on single ref" error.

Copilot generated this review using guidance from repository custom instructions.
@JeremyCloarec JeremyCloarec merged commit 5efaa0f into master Mar 3, 2026
45 checks passed
@JeremyCloarec JeremyCloarec deleted the issue/14597 branch March 3, 2026 08:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

filigran team use to identify PR from the Filigran team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Error "Cant add another relation on single ref" with a bundle that contains IPv4 address and NetworkTraffic

3 participants