Allow the import of actors from Threatr

PiRogueToolSuite · Sep 22, 2024 · 8730207 · 8730207
1 parent 15b29a5
commit 8730207
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 2 deletions.
diff --git a/colander/core/rest/views.py b/colander/core/rest/views.py
@@ -21,7 +21,7 @@
     Observable,
     ObservableType,
     Threat,
-    ThreatType, Device, DeviceType,
+    ThreatType, Device, DeviceType, Actor, ActorType,
 )
 from colander.core.rest.serializers import DetailedEntitySerializer
 
@@ -114,6 +114,11 @@ def get_threatr_entity_type(entity):
             return Threat, ThreatType.objects.get(short_name=entity['type']['short_name'])
         except Exception:
             return None, None
+    if entity['super_type']['short_name'] == 'ACTOR':
+        try:
+            return Actor, ActorType.objects.get(short_name=entity['type']['short_name'])
+        except Exception:
+            return None, None
     if entity['super_type']['short_name'] == 'EVENT':
         try:
             return Event, EventType.objects.get(short_name=entity['type']['short_name'])

diff --git a/colander/core/views/investigate_views.py b/colander/core/views/investigate_views.py
@@ -74,7 +74,7 @@ def investigate_search_view(request):
                     'external_doc': 0,
                     },
                     # ToDo: get rid of the hardcoded list of types
-                    'importable_types': ['OBSERVABLE', 'DEVICE', 'THREAT'],
+                    'importable_types': ['OBSERVABLE', 'DEVICE', 'THREAT', 'ACTOR'],
                     'types': {
                     }
                 }