(self, incidents)
Parse list of Incidents.

        :param incidents: List of STIX Incidents.
        :type incidents: list
Parse list of Incidents.
Parse list of Incidents .
def parse_incidents(self, incidents):
        """
        Parse list of Incidents.

        :param incidents: List of STIX Incidents.
        :type incidents: list
        """
        for incident in incidents:
            if incident.title:
                title = incident.title
            else:
                title = "STIX Incident: %s" % incident.id_
            description = str(incident.description or "")
            if incident.short_description in EventTypes.values():
                event_type = incident.short_description
            elif incident.categories and incident.categories[0].value:
                event_type = get_crits_event_type(incident.categories[0].value)
            else:
                event_type = EventTypes.INTEL_SHARING
            if getattr(incident.time, 'incident_discovery', None):
                event_date = incident.time.incident_discovery.value
            elif getattr(incident.time, 'incident_reported', None):
                event_date = incident.time.incident_reported.value
            else:
                event_date = datetime.datetime.now()
            if event_date.tzinfo:
                event_date = event_date.astimezone(pytz.utc)
                event_date = event_date.replace(tzinfo=None)

        if self.preview:
            self.imported[incident.id_] = ('Event', None, title)
            for rel in incident.related_indicators or ():
                if rel.item.id_:
                    self.parse_indicators([rel.item])
            for rel in incident.related_observables or ():
                if rel.item.id_:
                    self.parse_observables([rel.item], is_ind=self.obs_as_ind)
        else:
            res = add_new_event(title,
                                description,
                                event_type,
                                self.source.name,
                                self.source_instance.method,
                                self.source_instance.reference,
                                event_date,
                                self.source_instance.analyst)
            self.parsed.append(incident.id_)
            if res['success']:
                self.imported[incident.id_] = ('Event',
                                               res['object'].id, title)
                self.updates[res['object'].id] = res['object']

                # Get relationships to the Event
                for rel in incident.related_indicators or ():
                    r = rel.relationship or RelationshipTypes.RELATED_TO
                    c = getattr(rel.confidence, 'value', None) or 'Unknown'
                    if rel.item.id_:
                        self.parse_indicators([rel.item])
                        ind_idref = rel.item.id_
                    else:
                        ind_idref = rel.item.idref
                    for ind_id in self.idMap.get(ind_idref, [ind_idref]):
                        self.relationships.append((incident.id_, str(r),
                                                   ind_id, str(c)))
                for rel in incident.related_observables or ():
                    r = rel.relationship or RelationshipTypes.RELATED_TO
                    c = getattr(rel.confidence, 'value', None) or 'Unknown'
                    if rel.item.id_:
                        self.parse_observables([rel.item],
                                               is_ind=self.obs_as_ind)
                        obs_idref = rel.item.id_
                    else:
                        obs_idref = rel.item.idref
                    for obs_id in self.idMap.get(obs_idref, [obs_idref]):
                        self.relationships.append((incident.id_, str(r),
                                                   obs_id, str(c)))
            else:
                self.failed.append((res['message'],
                                    "Event (%s)" % title,
                                    incident.id_))
def parse_incidents ( self , incidents ) : for incident in incidents : if incident . title : title = incident . title else : title = "STIX Incident: %s" % incident . id_ description = str ( incident . description or "" ) if incident . short_description in EventTypes . values ( ) : event_type = incident . short_description elif incident . categories and incident . categories [ 0 ] . value : event_type = get_crits_event_type ( incident . categories [ 0 ] . value ) else : event_type = EventTypes . INTEL_SHARING if getattr ( incident . time , 'incident_discovery' , None ) : event_date = incident . time . incident_discovery . value elif getattr ( incident . time , 'incident_reported' , None ) : event_date = incident . time . incident_reported . value else : event_date = datetime . datetime . now ( ) if event_date . tzinfo : event_date = event_date . astimezone ( pytz . utc ) event_date = event_date . replace ( tzinfo = None ) if self . preview : self . imported [ incident . id_ ] = ( 'Event' , None , title ) for rel in incident . related_indicators or ( ) : if rel . item . id_ : self . parse_indicators ( [ rel . item ] ) for rel in incident . related_observables or ( ) : if rel . item . id_ : self . parse_observables ( [ rel . item ] , is_ind = self . obs_as_ind ) else : res = add_new_event ( title , description , event_type , self . source . name , self . source_instance . method , self . source_instance . reference , event_date , self . source_instance . analyst ) self . parsed . append ( incident . id_ ) if res [ 'success' ] : self . imported [ incident . id_ ] = ( 'Event' , res [ 'object' ] . id , title ) self . updates [ res [ 'object' ] . id ] = res [ 'object' ] # Get relationships to the Event for rel in incident . related_indicators or ( ) : r = rel . relationship or RelationshipTypes . RELATED_TO c = getattr ( rel . confidence , 'value' , None ) or 'Unknown' if rel . item . id_ : self . parse_indicators ( [ rel . item ] ) ind_idref = rel . item . id_ else : ind_idref = rel . item . idref for ind_id in self . idMap . get ( ind_idref , [ ind_idref ] ) : self . relationships . append ( ( incident . id_ , str ( r ) , ind_id , str ( c ) ) ) for rel in incident . related_observables or ( ) : r = rel . relationship or RelationshipTypes . RELATED_TO c = getattr ( rel . confidence , 'value' , None ) or 'Unknown' if rel . item . id_ : self . parse_observables ( [ rel . item ] , is_ind = self . obs_as_ind ) obs_idref = rel . item . id_ else : obs_idref = rel . item . idref for obs_id in self . idMap . get ( obs_idref , [ obs_idref ] ) : self . relationships . append ( ( incident . id_ , str ( r ) , obs_id , str ( c ) ) ) else : self . failed . append ( ( res [ 'message' ] , "Event (%s)" % title , incident . id_ ) )