Merge pull request #13 from misje/dev

Use filter mode 'and' for stix pattern type + values. Closes #9.
misje · Jan 22, 2024 · cffa40b · cffa40b
2 parents 4901fdb + 88bd8ad
commit cffa40b
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/custom-opencti.py b/custom-opencti.py
@@ -545,14 +545,14 @@ def query_opencti(alert, url, token):
                     'obs': {
                         "mode": "or",
                         "filterGroups": [],
-                        "filters": [{'key': filter_key, 'values': filter_values}]
+                        "filters": [{"key": filter_key, "values": filter_values}]
                     },
                     'ind': {
-                        "mode": "or",
+                        "mode": "and",
                         "filterGroups": [],
                         "filters": [
-                            {'key': 'pattern_type', 'values': ['stix']},
-                            {'key': 'pattern', 'values': ind_filter},
+                            {"key": "pattern_type", "values": ["stix"]},
+                            {"mode": "or", "key": "pattern", "values": ind_filter},
                         ]
                     }
                     }}