in msticpy/nbtools/security_alert.py [0:0]
def _resolve_entity_refs(self):
"""
Resolve and replace entity properties that are '$ref' type.
When serialized the nested entities can be references to other
referenced objects in the collection. This iterates through
the raw entities and replaces referenced items with the actual
object reference. If the Id referenced by this property exists
in the entities dictionary we replace the original property
with a reference to the entity in the dictionary.
"""
for _, entity in self._src_entities.items():
if not isinstance(entity, Entity):
continue
# Resolve all the simple references
ref_props = {
name: prop
for name, prop in entity.properties.items()
if isinstance(prop, dict) and "$ref" in prop
}
for prop_name, prop_val in ref_props.items():
entity_id = prop_val["$ref"]
if entity_id in self._src_entities:
entity[prop_name] = self._src_entities[entity_id]
entity.add_edge(entity[prop_name], edge_attrs={"name": prop_name})
# Resolve all the lists of references
ref_props_multi = {
name: prop
for name, prop in entity.properties.items()
if isinstance(prop, list)
and any(elem for elem in prop if "$ref" in elem)
}
for prop_name, prop_val in ref_props_multi.items():
for idx, elem in enumerate(prop_val):
if not isinstance(elem, dict):
continue
entity_id = elem["$ref"]
if entity_id in self._src_entities:
entity[prop_name][idx] = self._src_entities[entity_id]
entity.add_edge(
self._src_entities[entity_id],
edge_attrs={"name": prop_name},
)