Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[backend/frontend] Introduce TAXII push endpoints #9471

Merged
merged 8 commits into from
Jan 3, 2025

Conversation

richard-julien
Copy link
Member

@richard-julien richard-julien commented Dec 27, 2024

Concept here is to offer a way for OpenCTI to receive POST request compliant with TAXII https://docs.oasis-open.org/cti/taxii/v2.1/os/taxii-v2.1-os.html

You can create in the UI some TAXII push definition that will open a dedicated queue for TAXII push.

Example of push

POST http://localhost:3000/taxii2/root/collections/5900ea97-db72-4ecb-8f1e-c8583deb746a/objects

JSON Body

{
  "objects": [
    {
      "id": "identity--7b82b010-b1c0-4dae-981f-7756374a17df",
      "type": "identity",
      "spec_version": "2.1",
      "name": "ANSSI",
      "identity_class": "organization",
      "labels": ["identity"],
      "created": "2020-02-23T23:40:53.575Z",
      "modified": "2020-02-27T08:45:39.351Z",
      "x_opencti_organization_type": "CSIRT",
      "x_opencti_reliability": "A - Completely reliable"
    }
  ]
}

JSON response

{
    "id": "work_fc8af532-3b9b-5a8a-a7d5-85e33fef889a_2024-12-27T17:24:03.420Z",
    "status": "pending",
    "request_timestamp": "2024-12-27T17:24:03.511Z",
    "total_count": 1,
    "success_count": 0,
    "failure_count": 0,
    "pending_count": 1
}

Stix 2 or 2.1 is supported

Id can then be used to get the integration job statistic as defined in the TAXII specification.

GET http://localhost:3000/taxii2/root/status/work_0724b040-e9a6-59dd-877d-e8edb098b4cc_2024-12-27T14:53:17.605Z

Taxii Push listing
image

Taxii push virtual connector
image

@github-actions github-actions bot added the filigran team use to identify PR from the Filigran team label Dec 27, 2024
Copy link

codecov bot commented Dec 27, 2024

Codecov Report

Attention: Patch coverage is 35.01946% with 167 lines in your changes missing coverage. Please review.

Project coverage is 65.24%. Comparing base (c0ce0c2) to head (c392f96).
Report is 9 commits behind head on master.

Files with missing lines Patch % Lines
...cti-platform/opencti-graphql/src/http/httpTaxii.js 0.00% 71 Missing ⚠️
...les/ingestion/ingestion-taxii-collection-domain.ts 10.00% 54 Missing ⚠️
...rm/opencti-graphql/src/manager/ingestionManager.ts 34.61% 17 Missing ⚠️
...aphql/src/modules/ingestion/ingestion-converter.ts 6.25% 15 Missing ⚠️
...s/ingestion/ingestion-taxii-collection-resolver.ts 76.00% 6 Missing ⚠️
...rc/modules/ingestion/ingestion-taxii-collection.ts 91.83% 4 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #9471      +/-   ##
==========================================
- Coverage   65.35%   65.24%   -0.12%     
==========================================
  Files         624      628       +4     
  Lines       59697    59923     +226     
  Branches     6687     6688       +1     
==========================================
+ Hits        39016    39096      +80     
- Misses      20681    20827     +146     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@SamuelHassine SamuelHassine merged commit 3497aa7 into master Jan 3, 2025
8 of 9 checks passed
@SamuelHassine SamuelHassine deleted the oob/taxii_push branch January 3, 2025 10:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
filigran team use to identify PR from the Filigran team
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Implement "TAXII inbox" (supporting pushing data to TAXII endpoint as part of the TAXII protocol)
2 participants