def description()

in tools/stix-to-ecs/stix_to_ecs.py [0:0]


    def description(self) -> str:
        """
        Get ECS description.
        """

        if type(self.data) is dict and (hash := self.data.get("hash", None)):
            # ctf -> SHA256 may not be always available, in this case do we want to crash or take an other algo?
            observable = (
                hash.get("sha256", None)
                or hash.get("sha1", None)
                or hash.get("md5", None)
            )
            if not observable:
                raise RuntimeError(
                    "Missing SHA256, SHA1, or MD5 observable from set of hashes."
                )
        else:
            observable = self.data

        return f"Simple indicator of observable {{{observable}}}"