smolkik_adm/agency-agents
1
0
Fork 0
mirror of https://github.com/msitarzewski/agency-agents.git synced 2026-10-19 17:45:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): match admitted IOC types in STIX exports

Browse Source 
Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
This commit is contained in:
Rudy Celekli
2026-10-07 18:54:29 -04:00
parent f99f6aa910
commit 4ff8d66812
1 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/security-threat-intelligence-analyst.md
+13 -6
View File
@@ -394,11 +394,18 @@ class IOC:
def to_stix(self) -> dict:
"""Convert to STIX 2.1 indicator object."""
pattern_map = {
IOCType.IPV4: f"[ipv4-addr:value = '{self.value}']",
IOCType.DOMAIN: f"[domain-name:value = '{self.value}']",
IOCType.SHA256: f"[file:hashes.'SHA-256' = '{self.value}']",
IOCType.URL: f"[url:value = '{self.value}']",
IOCType.IPV4: "ipv4-addr:value",
IOCType.IPV6: "ipv6-addr:value",
IOCType.DOMAIN: "domain-name:value",
IOCType.SHA256: "file:hashes.'SHA-256'",
IOCType.SHA1: "file:hashes.'SHA-1'",
IOCType.MD5: "file:hashes.MD5",
IOCType.EMAIL: "email-addr:value",
IOCType.URL: "url:value",
}
# STIX string literals escape backslashes and apostrophes separately
# from JSON encoding, preserving the exact admitted indicator value.
literal = self.value.replace("\\", "\\\\").replace("'", "\\'")
return {
"type": "indicator",
"spec_version": "2.1",
@@ -406,7 +413,7 @@ class IOC:
"created": self.first_seen.isoformat(),
"modified": self.last_seen.isoformat(),
"name": f"{self.ioc_type.value}: {self.value}",
"pattern": pattern_map.get(self.ioc_type, f"[artifact:payload_bin = '{self.value}']"),
"pattern": f"[{pattern_map[self.ioc_type]} = '{literal}']",
"pattern_type": "stix",
"valid_from": self.first_seen.isoformat(),
"confidence": int(self.confidence * 100),
@@ -645,4 +652,4 @@ You're successful when:
---
**Instructions Reference**: Your analytical methodology is grounded in the Intelligence Community Directive 203 (Analytic Standards), Sherman Kent's principles of intelligence analysis, the Diamond Model of Intrusion Analysis, the Cyber Kill Chain, and MITRE ATT&CK — adapted for the speed and scale of modern cyber threats.
**Instructions Reference**: Your analytical methodology is grounded in the Intelligence Community Directive 203 (Analytic Standards), Sherman Kent's principles of intelligence analysis, the Diamond Model of Intrusion Analysis, the Cyber Kill Chain, and MITRE ATT&CK — adapted for the speed and scale of modern cyber threats.