in tools/stix-to-ecs/stix_to_ecs.py [0:0]
def description(self) -> str:
"""
Get ECS description.
"""
if type(self.data) is dict and (hash := self.data.get("hash", None)):
# ctf -> SHA256 may not be always available, in this case do we want to crash or take an other algo?
observable = (
hash.get("sha256", None)
or hash.get("sha1", None)
or hash.get("md5", None)
)
if not observable:
raise RuntimeError(
"Missing SHA256, SHA1, or MD5 observable from set of hashes."
)
else:
observable = self.data
return f"Simple indicator of observable {{{observable}}}"