Skip to content

Fix XSUP-61190: Add Software type support to STIX export #42511

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
MosheEichler merged 10 commits into from
Jan 5, 2026
Merged

Fix XSUP-61190: Add Software type support to STIX export #42511

MosheEichler merged 10 commits into from
Jan 5, 2026
+233 −1

Conversation

@MosheEichler
Copy link
Contributor

@MosheEichler MosheEichler commented Jan 1, 2026

Status

  • In Progress
  • Ready
  • In Hold - (Reason for hold)

Related Issues

fixes: https://jira-dc.paloaltonetworks.com/browse/XSUP-61190

Description

Add Software type support to STIX export

Must have

  • Tests
  • Documentation

@MosheEichler
Fix XSUP-61190: Add Software type support to STIX export
0c760f5 
- Added 'software' to SCOs dictionary mapping to 'software:name' pattern
- Updated create_stix_sco_indicator() to handle software type with name, vendor, version, and CPE fields
- Software indicators now export correctly as STIX 2.1 Cyber Observable Objects
- Fixes issue where Software type indicators resulted in blank export files
@github-actions
Copy link

github-actions bot commented Jan 1, 2026 •
edited
Loading

Coverage

Coverage Report
FileStmtsMissCoverMissing
Packs/CommonScripts/Scripts/StixCreator
   StixCreator.py1604870%87–91, 93–98, 100–104, 193–196, 245, 273, 276–277, 279, 282–283, 286–288, 294, 296–298, 304–307, 309–310, 313–314, 316–317, 320–321, 333–334
TOTAL1604870% 

Tests Skipped Failures Errors Time
23 0 💤 0 ❌ 0 🔥 2.924s ⏱️

@MosheEichler MosheEichler added release-notes-only Indicates that this pull request has ONLY release notes to review for documentation process ready-for-pipeline-running Whether the pr is ready for running the whole pipeline, including testing on SAAS machines ready-for-ai-review The PR is ready for reviewing the PR with the AI Reviewer. labels Jan 4, 2026
@content-bot content-bot removed the ready-for-ai-review The PR is ready for reviewing the PR with the AI Reviewer. label Jan 4, 2026
richardbluestone
richardbluestone reviewed Jan 4, 2026
View reviewed changes
@MosheEichler MosheEichler requested a review from DeanArbel January 4, 2026 14:08
@MosheEichler MosheEichler added the ready-for-ai-review The PR is ready for reviewing the PR with the AI Reviewer. label Jan 4, 2026
@MosheEichler MosheEichler enabled auto-merge (squash) January 4, 2026 14:12
@content-bot content-bot removed the ready-for-ai-review The PR is ready for reviewing the PR with the AI Reviewer. label Jan 4, 2026
@content-bot
Copy link
Collaborator

content-bot commented Jan 4, 2026

🤖 Content-bot Review Disclaimer

This review was generated by an AI-powered tool and may contain inaccuracies. Please be advised, and we extend our sincere apologies for any inconvenience this may cause.

content-bot
content-bot reviewed Jan 4, 2026
View reviewed changes
Copy link
Collaborator

@content-bot content-bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the contribution! I noticed that the PR description mentions adding "Software type support," but the current diff only shows a version bump. It looks like the actual implementation files might be missing, so please ensure those are included.

@DeanArbel, @Ni-Knight please review and approve the results generated by the AI Reviewer by responding 👍 on this comment.

@content-bot
Copy link
Collaborator

content-bot commented Jan 4, 2026

This PR was automatically updated by a GitHub Action

  • CommonScripts pack version was bumped to 1.20.66.

To stop automatic version bumps, add the ignore-auto-bump-version label to the github PR.

@content-bot
Copy link
Collaborator

content-bot commented Jan 5, 2026

Validate summary
The following errors were thrown as a part of this pr: .
If the AG100 validation in the pre-commit GitHub Action fails, the pull request cannot be force-merged.

Verdict: PR can be force merged from validate perspective? ✅

@MosheEichler MosheEichler removed the request for review from Ni-Knight January 5, 2026 10:44
@MosheEichler MosheEichler merged commit fd1495a into master Jan 5, 2026
21 checks passed
@MosheEichler MosheEichler deleted the XSUP-61190-fix-software-stix-export branch January 5, 2026 10:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@richardbluestone richardbluestone richardbluestone left review comments

@content-bot content-bot content-bot left review comments

@DeanArbel DeanArbel DeanArbel approved these changes

Assignees

@richardbluestone richardbluestone

@MosheEichler MosheEichler

Labels

docs-approved ready-for-pipeline-running Whether the pr is ready for running the whole pipeline, including testing on SAAS machines release-notes-only Indicates that this pull request has ONLY release notes to review for documentation process

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@MosheEichler @content-bot @DeanArbel @richardbluestone