[Recorded Future] Another formatting error prevents incident creation

[Lhorus6]

Description

Alerts on Recorded Future side are not created in OpenCTI (as Incident) because a formatting error is raised. The problem seems to occur on the "identity" alerts.

Traceback (most recent call last):\n File \"/opt/opencti-connector-recorded-future/rflib/rf_playbook_alerts.py\", line 117, in run\n self.create_incident_from_playbook_alert_identity_novel_exposures(\n File \"/opt/opencti-connector-recorded-future/rflib/rf_playbook_alerts.py\", line 513, in create_incident_from_playbook_alert_identity_novel_exposures\n self.helper.send_stix2_bundle(bundle, update=True, work_id=self.work_id)\n File \"/usr/local/lib/python3.12/site-packages/pycti/connector/opencti_connector_helper.py\", line 1721, in send_stix2_bundle\n ) = stix2_splitter.split_bundle_with_expectations(\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n File \"/usr/local/lib/python3.12/site-packages/pycti/utils/opencti_stix2_splitter.py\", line 227, in split_bundle_with_expectations\n self.enlist_element(item[\"id\"], raw_data, cleanup_inconsistent_bundle, [])\n File \"/usr/local/lib/python3.12/site-packages/pycti/utils/opencti_stix2_splitter.py\", line 97, in enlist_element\n is_missing_ref = raw_data.get(value) is None\n ^^^^^^^^^^^^^^^^^^^\nTypeError: unhashable type: 'dict'

Environment

OCTI 6.4.4

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. Run the RF connector with this configuration

                ALERT_DEFAULT_OPENCTI_SEVERITY: 'P3 - low'
                ALERT_ENABLE: 'False'
                ALERT_PRIORITY_ALERTS_ONLY: 'True'
                CONNECTOR_DURATION_PERIOD: PT5M
                CONNECTOR_NAME: recordedfuture-playbook-alerts
                CONNECTOR_SCOPE: ipv4-addr,ipv6-addr,vulnerability,domain,url,StixFile
                CONNECTOR_TYPE: EXTERNAL_IMPORT
                PLAYBOOK_ALERT_DEBUG: 'False'
                PLAYBOOK_ALERT_ENABLE: 'True'
                PLAYBOOK_ALERT_SEVERITY_THRESHOLD_CODE_REPO_LEAKAGE: 'Informational'
                PLAYBOOK_ALERT_SEVERITY_THRESHOLD_DOMAIN_ABUSE: 'Moderate'
                PLAYBOOK_ALERT_SEVERITY_THRESHOLD_IDENTITY_NOVEL_EXPOSURES: 'Informational'
                RECORDED_FUTURE_INITIAL_LOOKBACK: '240'
                RECORDED_FUTURE_INSIKT_ONLY: 'True'
                RECORDED_FUTURE_LAST_PUBLISHED_NOTES: '24'
                RECORDED_FUTURE_PERSON_TO_TA: 'True'
                RECORDED_FUTURE_PULL_ANALYST_NOTES: 'False'
                RECORDED_FUTURE_PULL_RISK_LIST: 'False'
                RECORDED_FUTURE_PULL_SIGNATURES: 'True'
                RECORDED_FUTURE_PULL_THREAT_MAPS: 'False'
                RECORDED_FUTURE_RISKLIST_RELATED_ENTITIES: 'Malware,Hash,URL,Threat Actor,MitreAttackIdentifier'
                RECORDED_FUTURE_RISK_AS_SCORE: 'True'
                RECORDED_FUTURE_RISK_LIST_THRESHOLD: '70'
                RECORDED_FUTURE_RISK_THRESHOLD: '58'
                RECORDED_FUTURE_TA_TO_INTRUSION_SET: 'True'
                RECORDED_FUTURE_TLP: Green
                RECORDED_FUTURE_TOKEN: <your_token>
                RECORDED_FUTURE_TOPIC: VTrvnW,g1KBGl,ZjnoP0,aDKkpk,TXSFt5,UrMRnT,TXSFt3,TXSFt4,ZjnoP2,hPX1cE,UX0YlU,TXSFt1,TXSFt2,UZmDut,irEim2,VlIhvG