{"action":"created","issue":{"url":"https://api.github.com/repos/MAECProject/maec-to-stix/issues/5","labels_url":"https://api.github.com/repos/MAECProject/maec-to-stix/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/MAECProject/maec-to-stix/issues/5/comments","events_url":"https://api.github.com/repos/MAECProject/maec-to-stix/issues/5/events","html_url":"https://github.com/MAECProject/maec-to-stix/issues/5","id":116538926,"number":5,"title":"When extracting indicatiors, all network indicators are ignored","user":{"login":"Mesaph","id":2856921,"avatar_url":"https://avatars.githubusercontent.com/u/2856921?v=3","gravatar_id":"","url":"https://api.github.com/users/Mesaph","html_url":"https://github.com/Mesaph","followers_url":"https://api.github.com/users/Mesaph/followers","following_url":"https://api.github.com/users/Mesaph/following{/other_user}","gists_url":"https://api.github.com/users/Mesaph/gists{/gist_id}","starred_url":"https://api.github.com/users/Mesaph/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Mesaph/subscriptions","organizations_url":"https://api.github.com/users/Mesaph/orgs","repos_url":"https://api.github.com/users/Mesaph/repos","events_url":"https://api.github.com/users/Mesaph/events{/privacy}","received_events_url":"https://api.github.com/users/Mesaph/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-11-12T12:19:51Z","updated_at":"2015-11-12T14:50:24Z","closed_at":null,"body":"When extracting indicators from a maec file, it seems that all network indicators are ignored.\r\n\r\nExample maec action:\r\n```\r\n<maecBundle:Action id=\"maec-6ae42d195ed01779d8fed50b397fc5d0-act-1612\">\r\n    <cybox:Name xsi:type=\"maecVocabs:NetworkActionNameVocab-1.0\">connect to socket address</cybox:Name>\r\n    <cybox:Associated_Objects>\r\n        <cybox:Associated_Object id=\"maec-6ae42d195ed01779d8fed50b397fc5d0-obj-3378\">\r\n            <cybox:Properties xsi:type=\"NetworkConnectionObj:NetworkConnectionObjectType\">\r\n                <NetworkConnectionObj:Layer4_Protocol datatype=\"string\">UDP</NetworkConnectionObj:Layer4_Protocol>\r\n                <NetworkConnectionObj:Source_Socket_Address xsi:type=\"SocketAddressObj:SocketAddressObjectType\">\r\n                    <SocketAddressObj:IP_Address xsi:type=\"AddressObj:AddressObjectType\" category=\"ipv4-addr\">\r\n                        <AddressObj:Address_Value>192.168.178.11</AddressObj:Address_Value>\r\n                    </SocketAddressObj:IP_Address>\r\n                    <SocketAddressObj:Port xsi:type=\"PortObj:PortObjectType\">\r\n                        <PortObj:Port_Value>1523</PortObj:Port_Value>\r\n                    </SocketAddressObj:Port>\r\n                </NetworkConnectionObj:Source_Socket_Address>\r\n                <NetworkConnectionObj:Destination_Socket_Address xsi:type=\"SocketAddressObj:SocketAddressObjectType\">\r\n                    <SocketAddressObj:IP_Address xsi:type=\"AddressObj:AddressObjectType\" category=\"ipv4-addr\">\r\n                        <AddressObj:Address_Value>192.168.178.2</AddressObj:Address_Value>\r\n                    </SocketAddressObj:IP_Address>\r\n                    <SocketAddressObj:Port xsi:type=\"PortObj:PortObjectType\">\r\n                        <PortObj:Port_Value>53</PortObj:Port_Value>\r\n                    </SocketAddressObj:Port>\r\n                </NetworkConnectionObj:Destination_Socket_Address>\r\n            </cybox:Properties>\r\n        </cybox:Associated_Object>\r\n    </cybox:Associated_Objects>\r\n</maecBundle:Action>\r\n```\r\n\r\nExpected Output: A NetworkConnectionObj\r\nActual Output: Nothing at all.\r\n\r\nIs there any support for network objects planned?"},"comment":{"url":"https://api.github.com/repos/MAECProject/maec-to-stix/issues/comments/156125006","html_url":"https://github.com/MAECProject/maec-to-stix/issues/5#issuecomment-156125006","issue_url":"https://api.github.com/repos/MAECProject/maec-to-stix/issues/5","id":156125006,"user":{"login":"ikiril01","id":1538202,"avatar_url":"https://avatars.githubusercontent.com/u/1538202?v=3","gravatar_id":"","url":"https://api.github.com/users/ikiril01","html_url":"https://github.com/ikiril01","followers_url":"https://api.github.com/users/ikiril01/followers","following_url":"https://api.github.com/users/ikiril01/following{/other_user}","gists_url":"https://api.github.com/users/ikiril01/gists{/gist_id}","starred_url":"https://api.github.com/users/ikiril01/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ikiril01/subscriptions","organizations_url":"https://api.github.com/users/ikiril01/orgs","repos_url":"https://api.github.com/users/ikiril01/repos","events_url":"https://api.github.com/users/ikiril01/events{/privacy}","received_events_url":"https://api.github.com/users/ikiril01/received_events","type":"User","site_admin":false},"created_at":"2015-11-12T14:50:24Z","updated_at":"2015-11-12T14:50:24Z","body":"Hi @Mesaph, I tested the Action in your example and I saw the same output (nothing) - which is odd, because in theory the default configuration supports Network Connection Objects and should extract IP Addresses from them. \r\n\r\nHowever, I eventually realized what's happening: in my wisdom, I implemented a default whitelist of local IP address values - any IP addresses that match it aren't included in the output: \r\n\r\nhttps://github.com/MAECProject/maec-to-stix/blob/master/maec_to_stix/indicator_extractor/config/network_activity_config.json#L289-L291\r\n\r\nI probably should not have made this a default :) What you can do on your end is modify this configuration file (simply remove the \"whitelist\" keyword or any of the regexes that you don't want to use as a filter) and then point to the updated configuration files: http://maec-to-stix.readthedocs.org/en/latest/indicator_extraction/config_files.html#maec-extract-indicators-py"}}