[Network Traffic Object][Missing STIX field][Frontend]

[R3dHash]

Description

I'd like to ingest a CSV feed into opencti where dest_IP,dst_port is provided as input for detection purposes. The best suited entity type seem to be Traffic Network Object. However, two fields are missing in the frontend, which hinders to use this type of entity. As such, we loose the information of the port number as we are coerced to use IP entities.

Environment

1. OS (where OpenCTI server runs): Ubuntu 16.4
2. OpenCTI version: OpenCTI 6.0.4

ref: https://docs.oasis-open.org/cti/stix/v2.0/cs01/part4-cyber-observable-objects/stix-v2.0-cs01-part4-cyber-observable-objects.html#_Toc496716259

[jborozco]

Related to #6270

@R3dHash thanks for the info, fyi improving the CSV mapping capacity is one of short term goals.

[R3dHash]

Thanks for the reply. Actually it goes beyond the CSV mapping as it's missing from the frontend also if you want to add an observable of type 'network traffic'.
Best,

[Jipegien]

Also linked to this: #5293

[jborozco]

Hi @R3dHash, we digged a little bit this issue, src_ref and dst_ref are nested objects, you can manually create them in the interface via the knowledge panel.

That being said...

1. the CSV mapper is indeed not working, step to reproduce:

• Go to the CSV mappers page
• Create an entity "IPv6 address"
• Create an entity "Network traffic"
• When trying to map "src and "dst" we should be able to select the IPv6 address object instead of "no options"

2. It is not possible to setup src_ref and dst_ref during manual Traffic Network Object creation.

I'm putting back this ticket in bug.

[lndrtrbn]

@jborozco reading the several messages of this issue, it appears unclear to me what has to be done here to close it. What is the scope / expected fix ?

[Jipegien]

@lndrtrbn In the fields src and dst of a Network traffic representation, ability to fill already created representation of ipv4, ipv6, mac address, domain name to create the ref between the 2.

[nino-filigran]

Removing the need for info as the bug seems clear so as the fix.