Improve CSV mapper for IOCs

[jborozco]

Use case

1. For an indicator to be ingested, it needs to have a formatted pattern.

This "[url:value = 'http://219.155.17.110:39399/i']" is a valid a STIX patern => The indicator will be ingested

This "http://219.155.17.110:39399/i'" is not, the indicator will not be ingested.

In the case of CSV feeds, we often treat raw info without the right formatting and CSV Mapper doesn't allow us to reformat, which leads to many indicators not being ingested.

2. In the CSV mapper, we can only map one column at the time but it would make sense to import multiple column to create complex pattern.

Current Workaround

None

Proposed Solution

To ingest indicators in the right format, in our CSV mapper, we need to be able to:

• Choose the type of pattern (STIX at least)
• Write down the format we want to use and have placeholders for the CSV Values
• Be able to call multiple column
• Test if the format is right.

Additional Information

Feed to import:
https://www.loldrivers.io/api/drivers.csv

[drivers.csv](https://prod-files-secure.s3.us-west-2.amazonaws.com/aafc277c-e0cd-4c16-ad83-b076df0f9eef/c492f738-4e49-422e-bceb-84000bb89738/drivers.csv)

Important columns for the mapping :
R: hash265
K: External reference
AA: filename/Tool

If the feature request is approved, would you be willing to submit a PR?

Yes

[nino-filigran]

Closing this issue since in the end we will not do it as such.
To answer the first use case explained above, the solution is to ingest the data as an bservable & trhough automation to promote the associated IOC.

To answer the second use case, the goal would be to be able to introduce some computation to be able for instance to concatenate some values. Ticket to follow is this one: #9148