in tools/stix-to-ecs/stix_to_ecs.py [0:0]
def __set_file_data(self) -> STIXToECSPatternParser:
for x in self.__loot:
if not x[1] in self.__data.keys():
self.__data[x[1]] = dict()
# ctf -> I.e property: "sha256:..., sha1:..., etc"
# ctf -> Will break if property length is > 2, i.e "sha256:sha1:..."
properties = x[2].split(":")
match len(properties):
case 1:
self.__data[x[1]] = properties[0]
case 2:
self.__data[x[1]][properties[0]] = properties[1]
case _:
raise NotImplemented(f"Properties length is > 2")
return self