misp-modules 2.4.196__py3-none-any.whl

misp_modules/lib/stix2misp.py

@@ -0,0 +1,2080 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#    Copyright (C) 2017-2018 CIRCL Computer Incident Response Center Luxembourg (smile gie)
+#    Copyright (C) 2017-2018 Christian Studer
+#
+#    This program is free software: you can redistribute it and/or modify
+#    it under the terms of the GNU Affero General Public License as
+#    published by the Free Software Foundation, either version 3 of the
+#    License, or (at your option) any later version.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU Affero General Public License for more details.
+#
+#    You should have received a copy of the GNU Affero General Public License
+#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import sys
+import json
+import os
+import time
+import io
+import pymisp
+import stix2misp_mapping
+from collections import defaultdict
+from copy import deepcopy
+from pathlib import Path
+_misp_dir = Path(os.path.realpath(__file__)).parents[4]
+_misp_objects_path = _misp_dir / 'app' / 'files' / 'misp-objects' / 'objects'
+_misp_types = pymisp.AbstractMISP().describe_types.get('types')
+from pymisp import MISPEvent, MISPObject, MISPAttribute
+
+_scripts_path = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(_scripts_path / 'cti-python-stix2'))
+import stix2
+
+
+class StixParser():
+    _galaxy_types = ('intrusion-set', 'malware', 'threat-actor', 'tool')
+    _stix2misp_mapping = {'marking-definition': '_load_marking',
+                          'relationship': '_load_relationship',
+                          'report': '_load_report',
+                          'indicator': '_parse_indicator',
+                          'observed-data': '_parse_observable',
+                          'identity': '_load_identity'}
+    _stix2misp_mapping.update({galaxy_type: '_load_galaxy' for galaxy_type in _galaxy_types})
+    _special_mapping = {'attack-pattern': 'parse_attack_pattern',
+                        'course-of-action': 'parse_course_of_action',
+                        'vulnerability': 'parse_vulnerability'}
+    _timeline_mapping = {'indicator': ('valid_from', 'valid_until'),
+                         'observed-data': ('first_observed', 'last_observed')}
+
+    def __init__(self):
+        super().__init__()
+        self.misp_event = MISPEvent()
+        self.relationship = defaultdict(list)
+        self.tags = set()
+        self.galaxy = {}
+        self.marking_definition = {}
+
+    def handler(self, event, filename, args):
+        self.filename = filename
+        self.stix_version = f"STIX {event['spec_version'] if event.get('spec_version') else '2.1'}"
+        try:
+            event_distribution = args[0]
+            if not isinstance(event_distribution, int):
+                event_distribution = int(event_distribution) if event_distribution.isdigit() else 0
+        except IndexError:
+            event_distribution = 0
+        try:
+            attribute_distribution = args[1]
+            if attribute_distribution == 'event':
+                attribute_distribution = 5
+            if not isinstance(attribute_distribution, int):
+                attribute_distribution = int(attribute_distribution) if attribute_distribution.isdigit() else 5
+        except IndexError:
+            attribute_distribution = 5
+        synonyms_to_tag_names = args[2] if len(args) > 2 else '/var/www/MISP/app/files/scripts/synonymsToTagNames.json'
+        with open(synonyms_to_tag_names, 'rt', encoding='utf-8') as f:
+            self._synonyms_to_tag_names = json.loads(f.read())
+        self.parse_event(event)
+
+    def _load_galaxy(self, galaxy):
+        self.galaxy[galaxy['id'].split('--')[1]] = {'tag_names': self.parse_galaxy(galaxy), 'used': False}
+
+    def _load_identity(self, identity):
+        try:
+            self.identity[identity['id'].split('--')[1]] = identity['name']
+        except AttributeError:
+            self.identity = {identity['id'].split('--')[1]: identity['name']}
+
+    def _load_marking(self, marking):
+        tag = self.parse_marking(marking)
+        self.marking_definition[marking['id'].split('--')[1]] = {'object': tag, 'used': False}
+
+    def _load_relationship(self, relationship):
+        target_uuid = relationship.target_ref.split('--')[1]
+        reference = (target_uuid, relationship.relationship_type)
+        source_uuid = relationship.source_ref.split('--')[1]
+        self.relationship[source_uuid].append(reference)
+
+    def _load_report(self, report):
+        try:
+            self.report[report['id'].split('--')[1]] = report
+        except AttributeError:
+            self.report = {report['id'].split('--')[1]: report}
+
+    def save_file(self):
+        event = self.misp_event.to_json()
+        with open(f'{self.filename}.stix2', 'wt', encoding='utf-8') as f:
+            f.write(event)
+
+    ################################################################################
+    ##                 PARSING FUNCTIONS USED BY BOTH SUBCLASSES.                 ##
+    ################################################################################
+
+    def handle_markings(self):
+        if hasattr(self, 'marking_refs'):
+            for attribute in self.misp_event.attributes:
+                if attribute.uuid in self.marking_refs:
+                    for marking_uuid in self.marking_refs[attribute.uuid]:
+                        attribute.add_tag(self.marking_definition[marking_uuid]['object'])
+                        self.marking_definition[marking_uuid]['used'] = True
+        if self.marking_definition:
+            for marking_definition in self.marking_definition.values():
+                if not marking_definition['used']:
+                    self.tags.add(marking_definition['object'])
+        if self.tags:
+            for tag in self.tags:
+                self.misp_event.add_tag(tag)
+
+    @staticmethod
+    def _parse_email_body(body, references):
+        attributes = []
+        for body_multipart in body:
+            reference = references.pop(body_multipart['body_raw_ref'])
+            feature = body_multipart['content_disposition'].split(';')[0]
+            if feature in stix2misp_mapping.email_references_mapping:
+                attribute = deepcopy(stix2misp_mapping.email_references_mapping[feature])
+            else:
+                print(f'Unknown content disposition in the following email body: {body_multipart}', file=sys.stderr)
+                continue
+            if isinstance(reference, stix2.v20.observables.Artifact):
+                attribute.update({
+                    'value': body_multipart['content_disposition'].split('=')[-1].strip("'"),
+                    'data': reference.payload_bin,
+                    'to_ids': False
+                })
+            else:
+                attribute.update({
+                    'value': reference.name,
+                    'to_ids': False
+                })
+            attributes.append(attribute)
+        return attributes
+
+    @staticmethod
+    def _parse_email_references(email_message, references):
+        attributes = []
+        if hasattr(email_message, 'from_ref'):
+            reference = references.pop(email_message.from_ref)
+            attribute = {
+                'value': reference.value,
+                'to_ids': False
+            }
+            attribute.update(stix2misp_mapping.email_references_mapping['from_ref'])
+            attributes.append(attribute)
+        for feature in ('to_refs', 'cc_refs'):
+            if hasattr(email_message, feature):
+                for ref_id in getattr(email_message, feature):
+                    reference = references.pop(ref_id)
+                    attribute = {
+                        'value': reference.value,
+                        'to_ids': False
+                    }
+                    attribute.update(stix2misp_mapping.email_references_mapping[feature])
+                    attributes.append(attribute)
+        return attributes
+
+    def parse_galaxies(self):
+        for galaxy in self.galaxy.values():
+            if not galaxy['used']:
+                for tag_name in galaxy['tag_names']:
+                    self.tags.add(tag_name)
+
+    @staticmethod
+    def _parse_network_connection_reference(feature_type, feature, value):
+        if feature == 'type':
+            return {type: value.format(feature_type) for type, value in stix2misp_mapping.network_traffic_references_mapping[value].items()}
+        return {feature: value}
+
+    @staticmethod
+    def _parse_network_traffic_protocol(protocol):
+        return {'type': 'text', 'value': protocol, 'to_ids': False,
+                'object_relation': f'layer{stix2misp_mapping.connection_protocols[protocol]}-protocol'}
+
+    @staticmethod
+    def _parse_observable_reference(reference, mapping, feature=None):
+        attribute = {
+            'value': reference.value,
+            'to_ids': False
+        }
+        if feature is not None:
+            attribute.update({key: value.format(feature) for key, value in getattr(stix2misp_mapping, mapping)[reference._type].items()})
+            return attribute
+        attribute.update({key: value for key, value in getattr(stix2misp_mapping, mapping)[reference._type].items()})
+        return attribute
+
+    def parse_pe(self, extension):
+        pe_object = MISPObject('pe', misp_objects_path_custom=_misp_objects_path)
+        self.fill_misp_object(pe_object, extension, 'pe_mapping')
+        for section in extension['sections']:
+            section_object = MISPObject('pe-section', misp_objects_path_custom=_misp_objects_path)
+            self.fill_misp_object(section_object, section, 'pe_section_mapping')
+            if hasattr(section, 'hashes'):
+                self.fill_misp_object(section_object, section.hashes, 'pe_section_mapping')
+            self.misp_event.add_object(section_object)
+            pe_object.add_reference(section_object.uuid, 'includes')
+        self.misp_event.add_object(pe_object)
+        return pe_object.uuid
+
+    def parse_relationships(self):
+        attribute_uuids = tuple(attribute.uuid for attribute in self.misp_event.attributes)
+        object_uuids = tuple(object.uuid for object in self.misp_event.objects)
+        for source, references in self.relationship.items():
+            if source in object_uuids:
+                source_object = self.misp_event.get_object_by_uuid(source)
+                for reference in references:
+                    target, reference = reference
+                    if target in attribute_uuids or target in object_uuids:
+                        source_object.add_reference(target, reference)
+            elif source in attribute_uuids:
+                for attribute in self.misp_event.attributes:
+                    if attribute.uuid == source:
+                        for reference in references:
+                            target, reference = reference
+                            if target in self.galaxy:
+                                for tag_name in self.galaxy[target]['tag_names']:
+                                    attribute.add_tag(tag_name)
+                                self.galaxy[target]['used'] = True
+                        break
+
+    def parse_report(self, event_uuid=None):
+        event_infos = set()
+        self.misp_event.uuid = event_uuid if event_uuid and len(self.report) > 1 else tuple(self.report.keys())[0]
+        for report in self.report.values():
+            if hasattr(report, 'name') and report.name:
+                event_infos.add(report.name)
+            if hasattr(report, 'labels') and report.labels:
+                for label in report.labels:
+                    self.tags.add(label)
+            if hasattr(report, 'object_marking_refs') and report.object_marking_refs:
+                for marking_ref in report.object_marking_refs:
+                    marking_ref = marking_ref.split('--')[1]
+                    try:
+                        self.tags.add(self.marking_definition[marking_ref]['object'])
+                        self.marking_definition[marking_ref]['used'] = True
+                    except KeyError:
+                        continue
+            if hasattr(report, 'external_references'):
+                for reference in report.external_references:
+                    self.misp_event.add_attribute(**{'type': 'link', 'value': reference['url']})
+        if len(event_infos) == 1:
+            self.misp_event.info = event_infos.pop()
+        else:
+            self.misp_event.info = f'Imported with MISP import script for {self.stix_version}'
+
+    @staticmethod
+    def _parse_user_account_groups(groups):
+        attributes = [{'type': 'text', 'object_relation': 'group', 'to_ids': False,
+                       'disable_correlation': True, 'value': group} for group in groups]
+        return attributes
+
+    ################################################################################
+    ##                             UTILITY FUNCTIONS.                             ##
+    ################################################################################
+
+    @staticmethod
+    def _choose_with_priority(container, first_choice, second_choice):
+        return first_choice if first_choice in container else second_choice
+
+    def filter_main_object(self, observable, main_type, test_function='_standard_test_filter'):
+        references = {}
+        main_objects = []
+        for key, value in observable.items():
+            if getattr(self, test_function)(value, main_type):
+                main_objects.append(value)
+            else:
+                references[key] = value
+        if len(main_objects) > 1:
+            print(f'More than one {main_type} objects in this observable: {observable}', file=sys.stderr)
+        return main_objects[0] if main_objects else None, references
+
+    @staticmethod
+    def getTimestampfromDate(date):
+        try:
+            return int(date.timestamp())
+        except AttributeError:
+            return int(time.mktime(time.strptime(date.split('+')[0], "%Y-%m-%dT%H:%M:%S.%fZ")))
+
+    @staticmethod
+    def _handle_data(data):
+        return io.BytesIO(data.encode())
+
+    @staticmethod
+    def parse_marking(marking):
+        marking_type = marking.definition_type
+        tag = getattr(marking.definition, marking_type)
+        return "{}:{}".format(marking_type, tag)
+
+    def parse_timeline(self, stix_object):
+        misp_object = {'timestamp': self.getTimestampfromDate(stix_object.modified)}
+        try:
+            first, last = self._timeline_mapping[stix_object._type]
+            first_seen = getattr(stix_object, first)
+            if stix_object.created != first_seen and stix_object.modified != first_seen:
+                misp_object['first_seen'] = first_seen
+                if hasattr(stix_object, last):
+                    misp_object['last_seen'] = getattr(stix_object, last)
+            elif hasattr(stix_object, last):
+                misp_object.update({'first_seen': first_seen, 'last_seen': getattr(stix_object, last)})
+        except KeyError:
+            pass
+        return misp_object
+
+    @staticmethod
+    def _process_test_filter(value, main_type):
+        _is_main_process = any(feature in value for feature in ('parent_ref', 'child_refs'))
+        return isinstance(value, getattr(stix2.v20.observables, main_type)) and _is_main_process
+
+    @staticmethod
+    def _standard_test_filter(value, main_type):
+        return isinstance(value, getattr(stix2.v20.observables, main_type))
+
+    def update_marking_refs(self, attribute_uuid, marking_refs):
+        try:
+            self.marking_refs[attribute_uuid] = tuple(marking.split('--')[1] for marking in marking_refs)
+        except AttributeError:
+            self.marking_refs = {attribute_uuid: tuple(marking.split('--')[1] for marking in marking_refs)}
+
+
+class StixFromMISPParser(StixParser):
+    def __init__(self):
+        super().__init__()
+        self._stix2misp_mapping.update({'custom_object': '_parse_custom'})
+        self._stix2misp_mapping.update({special_type: '_parse_undefined' for special_type in ('attack-pattern', 'course-of-action', 'vulnerability')})
+        self._custom_objects = tuple(filename.name.replace('_', '-') for filename  in _misp_objects_path.glob('*') if '_' in filename.name)
+
+    def parse_event(self, stix_event):
+        for stix_object in stix_event.objects:
+            object_type = stix_object['type']
+            if object_type.startswith('x-misp-object'):
+                object_type = 'custom_object'
+            if object_type in self._stix2misp_mapping:
+                getattr(self, self._stix2misp_mapping[object_type])(stix_object)
+            else:
+                print(f'not found: {object_type}', file=sys.stderr)
+        if self.relationship:
+            self.parse_relationships()
+        if self.galaxy:
+            self.parse_galaxies()
+        if hasattr(self, 'report'):
+            self.parse_report()
+        self.handle_markings()
+
+    def _parse_custom(self, custom):
+        if 'from_object' in custom['labels']:
+            self.parse_custom_object(custom)
+        else:
+            self.parse_custom_attribute(custom)
+
+    def _parse_indicator(self, indicator):
+        if 'from_object' in indicator['labels']:
+            self.parse_indicator_object(indicator)
+        else:
+            self.parse_indicator_attribute(indicator)
+
+    def _parse_observable(self, observable):
+        if 'from_object' in observable['labels']:
+            self.parse_observable_object(observable)
+        else:
+            self.parse_observable_attribute(observable)
+
+    def _parse_undefined(self, stix_object):
+        if any(label.startswith('misp-galaxy:') for label in stix_object.get('labels', [])):
+            self._load_galaxy(stix_object)
+        else:
+            getattr(self, self._special_mapping[stix_object._type])(stix_object)
+
+    ################################################################################
+    ##                             PARSING FUNCTIONS.                             ##
+    ################################################################################
+
+    def fill_misp_object(self, misp_object, stix_object, mapping,
+                         to_call='_fill_observable_object_attribute'):
+        for feature, value in stix_object.items():
+            if feature not in getattr(stix2misp_mapping, mapping):
+                if feature.startswith('x_misp_'):
+                    attribute = self.parse_custom_property(feature)
+                    if isinstance(value, list):
+                        self._fill_misp_object_from_list(misp_object, attribute, value)
+                        continue
+                else:
+                    continue
+            else:
+                attribute = deepcopy(getattr(stix2misp_mapping, mapping)[feature])
+            attribute.update(getattr(self, to_call)(feature, value))
+            misp_object.add_attribute(**attribute)
+
+    @staticmethod
+    def _fill_misp_object_from_list(misp_object, mapping, values):
+        for value in values:
+            attribute = {'value': value}
+            attribute.update(mapping)
+            misp_object.add_attribute(**attribute)
+
+    def parse_attack_pattern(self, attack_pattern):
+        misp_object, _ = self.create_misp_object(attack_pattern)
+        if hasattr(attack_pattern, 'external_references'):
+            for reference in attack_pattern.external_references:
+                value = reference['external_id'].split('-')[1] if reference['source_name'] == 'capec' else reference['url']
+                misp_object.add_attribute(**{
+                    'type': 'text', 'object_relation': 'id',
+                    'value': value
+                })
+        self.fill_misp_object(misp_object, attack_pattern, 'attack_pattern_mapping',
+                              '_fill_observable_object_attribute')
+        self.misp_event.add_object(**misp_object)
+
+    def parse_course_of_action(self, course_of_action):
+        misp_object, _ = self.create_misp_object(course_of_action)
+        self.fill_misp_object(misp_object, course_of_action, 'course_of_action_mapping',
+                              '_fill_observable_object_attribute')
+        self.misp_event.add_object(**misp_object)
+
+    def parse_custom_attribute(self, custom):
+        attribute_type = custom['type'].split('x-misp-object-')[1]
+        if attribute_type not in _misp_types:
+            replacement = ' ' if attribute_type == 'named-pipe' else '|'
+            attribute_type = attribute_type.replace('-', replacement)
+        attribute = {'type': attribute_type,
+                     'timestamp': self.getTimestampfromDate(custom['modified']),
+                     'to_ids': bool(custom['labels'][1].split('=')[1]),
+                     'value': custom['x_misp_value'],
+                     'category': self.get_misp_category(custom['labels']),
+                     'uuid': custom['id'].split('--')[1]}
+        if custom.get('object_marking_refs'):
+            self.update_marking_refs(attribute['uuid'], custom['object_marking_refs'])
+        self.misp_event.add_attribute(**attribute)
+
+    def parse_custom_object(self, custom):
+        name = custom['type'].split('x-misp-object-')[1]
+        if name in self._custom_objects:
+            name = name.replace('-', '_')
+        misp_object = MISPObject(name, misp_objects_path_custom=_misp_objects_path)
+        misp_object.timestamp = self.getTimestampfromDate(custom['modified'])
+        misp_object.uuid = custom['id'].split('--')[1]
+        try:
+            misp_object.category = custom['category']
+        except KeyError:
+            misp_object.category = self.get_misp_category(custom['labels'])
+        for key, value in custom['x_misp_values'].items():
+            attribute_type, object_relation = key.replace('_DOT_', '.').split('_')
+            if isinstance(value, list):
+                for single_value in value:
+                    misp_object.add_attribute(**{'type': attribute_type, 'value': single_value,
+                                                 'object_relation': object_relation})
+            else:
+                misp_object.add_attribute(**{'type': attribute_type, 'value': value,
+                                             'object_relation': object_relation})
+        self.misp_event.add_object(**misp_object)
+
+    def parse_galaxy(self, galaxy):
+        if hasattr(galaxy, 'labels'):
+            return [label for label in galaxy.labels if label.startswith('misp-galaxy:')]
+        try:
+            return self._synonyms_to_tag_names[galaxy.name]
+        except KeyError:
+            print(f'Unknown {galaxy._type} name: {galaxy.name}', file=sys.stderr)
+            return [f'misp-galaxy:{galaxy._type}="{galaxy.name}"']
+
+    def parse_indicator_attribute(self, indicator):
+        attribute = self.create_attribute_dict(indicator)
+        attribute['to_ids'] = True
+        pattern = indicator.pattern.replace('\\\\', '\\')
+        if attribute['type'] in ('malware-sample', 'attachment'):
+            value, data = self.parse_attribute_pattern_with_data(pattern)
+            attribute.update({feature: value for feature, value in zip(('value', 'data'), (value, io.BytesIO(data.encode())))})
+        else:
+            attribute['value'] = self.parse_attribute_pattern(pattern)
+        self.misp_event.add_attribute(**attribute)
+
+    def parse_indicator_object(self, indicator):
+        misp_object, object_type = self.create_misp_object(indicator)
+        pattern = self._handle_pattern(indicator.pattern).replace('\\\\', '\\').split(' AND ')
+        try:
+            attributes = getattr(self, stix2misp_mapping.objects_mapping[object_type]['pattern'])(pattern)
+        except KeyError:
+            print(f"Unable to map {object_type} object:\n{indicator}", file=sys.stderr)
+            return
+        if isinstance(attributes, tuple):
+            attributes, target_uuid = attributes
+            misp_object.add_reference(target_uuid, 'includes')
+        for attribute in attributes:
+            misp_object.add_attribute(**attribute)
+        self.misp_event.add_object(misp_object)
+
+    def parse_observable_attribute(self, observable):
+        attribute = self.create_attribute_dict(observable)
+        attribute['to_ids'] = False
+        objects = observable.objects
+        value = self.parse_single_attribute_observable(objects, attribute['type'])
+        if isinstance(value, tuple):
+            value, data = value
+            attribute['data'] = data
+        attribute['value'] = value
+        self.misp_event.add_attribute(**attribute)
+
+    def parse_observable_object(self, observable):
+        misp_object, object_type = self.create_misp_object(observable)
+        observable_object = observable.objects
+        try:
+            attributes = getattr(self, stix2misp_mapping.objects_mapping[object_type]['observable'])(observable_object)
+        except KeyError:
+            print(f"Unable to map {object_type} object:\n{observable}", file=sys.stderr)
+            return
+        if isinstance(attributes, tuple):
+            attributes, target_uuid = attributes
+            misp_object.add_reference(target_uuid, 'includes')
+        for attribute in attributes:
+            misp_object.add_attribute(**attribute)
+        self.misp_event.add_object(misp_object)
+
+    def parse_vulnerability(self, vulnerability):
+        attributes = self.fill_observable_attributes(vulnerability, 'vulnerability_mapping')
+        if hasattr(vulnerability, 'external_references'):
+            for reference in vulnerability.external_references:
+                if reference['source_name'] == 'url':
+                    attributes.append({'type': 'link', 'object_relation': 'references', 'value': reference['url']})
+        if len(attributes) > 1:
+            vulnerability_object, _ = self.create_misp_object(vulnerability)
+            for attribute in attributes:
+                vulnerability_object.add_attribute(**attribute)
+            self.misp_event.add_object(**vulnerability_object)
+        else:
+            attribute = self.create_attribute_dict(vulnerability)
+            attribute['value'] = attributes[0]['value']
+            self.misp_event.add_attribute(**attribute)
+
+    ################################################################################
+    ##                        OBSERVABLE PARSING FUNCTIONS                        ##
+    ################################################################################
+
+    @staticmethod
+    def _define_hash_type(hash_type):
+        if 'sha' in hash_type:
+            return f'SHA-{hash_type.split("sha")[1]}'
+        return hash_type.upper() if hash_type == 'md5' else hash_type
+
+    @staticmethod
+    def _fetch_file_observable(observable_objects):
+        for key, observable in observable_objects.items():
+            if observable['type'] == 'file':
+                return key
+        return '0'
+
+    @staticmethod
+    def _fill_observable_attribute(attribute_type, object_relation, value):
+        return {'type': attribute_type,
+                'object_relation': object_relation,
+                'value': value,
+                'to_ids': False}
+
+    def fill_observable_attributes(self, observable, object_mapping):
+        attributes = []
+        for key, value in observable.items():
+            if key in getattr(stix2misp_mapping, object_mapping):
+                attribute = deepcopy(getattr(stix2misp_mapping, object_mapping)[key])
+            elif key.startswith('x_misp_'):
+                attribute = self.parse_custom_property(key)
+                if isinstance(value, list):
+                    for single_value in value:
+                        single_attribute = {'value': single_value, 'to_ids': False}
+                        single_attribute.update(attribute)
+                        attributes.append(single_attribute)
+                    continue
+            else:
+                continue
+            attribute.update({'value': value, 'to_ids': False})
+            attributes.append(attribute)
+        return attributes
+
+    def _handle_multiple_file_fields(self, file):
+        attributes = []
+        for feature, attribute_type in zip(('filename', 'path', 'fullpath'), ('filename', 'text', 'text')):
+            key = f'x_misp_multiple_{feature}'
+            if key in file:
+                attributes.append(self._fill_observable_attribute(attribute_type, feature, file.pop(key)))
+            elif f'{key}s' in file:
+                attributes.extend(self._fill_observable_attribute(attribute_type, feature, value) for value in file.pop(key))
+        attributes.extend(self.fill_observable_attributes(file, 'file_mapping'))
+        return attributes
+
+    def parse_asn_observable(self, observable):
+        attributes = []
+        mapping = 'asn_mapping'
+        for observable_object in observable.values():
+            if isinstance(observable_object, stix2.v20.observables.AutonomousSystem):
+                attributes.extend(self.fill_observable_attributes(observable_object, mapping))
+            else:
+                attributes.append(self._parse_observable_reference(observable_object, mapping))
+        return attributes
+
+    def _parse_attachment(self, observable):
+        if len(observable) > 1:
+            return self._parse_name(observable, index='1'), self._parse_payload(observable)
+        return self._parse_name(observable)
+
+    def parse_credential_observable(self, observable):
+        return self.fill_observable_attributes(observable['0'], 'credential_mapping')
+
+    def _parse_domain_ip_attribute(self, observable):
+        return f'{self._parse_value(observable)}|{self._parse_value(observable, index="1")}'
+
+    @staticmethod
+    def parse_domain_ip_observable(observable):
+        attributes = []
+        for observable_object in observable.values():
+            attribute = deepcopy(stix2misp_mapping.domain_ip_mapping[observable_object._type])
+            attribute.update({'value': observable_object.value, 'to_ids': False})
+            attributes.append(attribute)
+        return attributes
+
+    @staticmethod
+    def _parse_email_message(observable, attribute_type):
+        return observable['0'].get(attribute_type.split('-')[1])
+
+    def parse_email_observable(self, observable):
+        email, references = self.filter_main_object(observable, 'EmailMessage')
+        attributes = self.fill_observable_attributes(email, 'email_mapping')
+        if hasattr(email, 'additional_header_fields'):
+            attributes.extend(self.fill_observable_attributes(email.additional_header_fields, 'email_mapping'))
+        attributes.extend(self._parse_email_references(email, references))
+        if hasattr(email, 'body_multipart') and email.body_multipart:
+            attributes.extend(self._parse_email_body(email.body_multipart, references))
+        return attributes
+
+    @staticmethod
+    def _parse_email_reply_to(observable):
+        return observable['0'].additional_header_fields.get('Reply-To')
+
+    def parse_file_observable(self, observable):
+        file, references = self.filter_main_object(observable, 'File')
+        references = {key: {'object': value, 'used': False} for key, value in references.items()}
+        file = {key: value for key, value in file.items()}
+        multiple_fields = any(f'x_misp_multiple_{feature}' in file for feature in ('filename', 'path', 'fullpath'))
+        attributes = self._handle_multiple_file_fields(file) if multiple_fields else self.fill_observable_attributes(file, 'file_mapping')
+        if 'hashes' in file:
+            attributes.extend(self.fill_observable_attributes(file['hashes'], 'file_mapping'))
+        if 'content_ref' in file:
+            reference = references[file['content_ref']]
+            value = f'{reference["object"].name}|{reference["object"].hashes["MD5"]}'
+            attributes.append({'type': 'malware-sample', 'object_relation': 'malware-sample', 'value': value,
+                               'to_ids': False, 'data': reference['object'].payload_bin})
+            reference['used'] = True
+        if 'parent_directory_ref' in file:
+            reference = references[file['parent_directory_ref']]
+            attributes.append({'type': 'text', 'object_relation': 'path',
+                               'value': reference['object'].path, 'to_ids': False})
+            reference['used'] = True
+        for reference in references.values():
+            if not reference['used']:
+                attributes.append({
+                    'type': 'attachment',
+                    'object_relation': 'attachment',
+                    'value': reference['object'].name,
+                    'data': reference['object'].payload_bin,
+                    'to_ids': False
+                })
+        return attributes
+
+    def _parse_filename_hash(self, observable, attribute_type, index='0'):
+        hash_type = attribute_type.split('|')[1]
+        filename = self._parse_name(observable, index=index)
+        hash_value = self._parse_hash(observable, hash_type, index=index)
+        return f'{filename}|{hash_value}'
+
+    def _parse_hash(self, observable, attribute_type, index='0'):
+        hash_type = self._define_hash_type(attribute_type)
+        return observable[index]['hashes'].get(hash_type)
+
+    def parse_ip_port_observable(self, observable):
+        network_traffic, references = self.filter_main_object(observable, 'NetworkTraffic')
+        attributes = []
+        for feature in ('src', 'dst'):
+            port = f'{feature}_port'
+            if hasattr(network_traffic, port):
+                attribute = deepcopy(stix2misp_mapping.ip_port_mapping[port])
+                attribute.update({'value': getattr(network_traffic, port), 'to_ids': False})
+                attributes.append(attribute)
+            ref = f'{feature}_ref'
+            if hasattr(network_traffic, ref):
+                attributes.append(self._parse_observable_reference(references.pop(getattr(network_traffic, ref)), 'ip_port_references_mapping', feature))
+        for reference in references.values():
+            attribute = deepcopy(stix2misp_mapping.ip_port_references_mapping[reference._type])
+            attribute.update({'value': reference.value, 'to_ids': False})
+            attributes.append(attribute)
+        return attributes
+
+    def _parse_malware_sample(self, observable):
+        if len(observable) > 1:
+            value = self._parse_filename_hash(observable, 'filename|md5', '1')
+            return value, self._parse_payload(observable)
+        return self._parse_filename_hash(observable, 'filename|md5')
+
+    @staticmethod
+    def _parse_name(observable, index='0'):
+        return observable[index].get('name')
+
+    def _parse_network_attribute(self, observable):
+        port = self._parse_port(observable, index='1')
+        return f'{self._parse_value(observable)}|{port}'
+
+    def parse_network_connection_observable(self, observable):
+        network_traffic, references = self.filter_main_object(observable, 'NetworkTraffic')
+        attributes = self._parse_network_traffic(network_traffic, references)
+        if hasattr(network_traffic, 'protocols'):
+            attributes.extend(self._parse_network_traffic_protocol(protocol) for protocol in network_traffic.protocols if protocol in stix2misp_mapping.connection_protocols)
+        if references:
+            for reference in references.values():
+                attributes.append(self._parse_observable_reference(reference, 'domain_ip_mapping'))
+        return attributes
+
+    def parse_network_socket_observable(self, observable):
+        network_traffic, references = self.filter_main_object(observable, 'NetworkTraffic')
+        attributes = self._parse_network_traffic(network_traffic, references)
+        if hasattr(network_traffic, 'protocols'):
+            attributes.append({'type': 'text', 'object_relation': 'protocol', 'to_ids': False,
+                               'value': network_traffic.protocols[0].strip("'")})
+        if hasattr(network_traffic, 'extensions') and network_traffic.extensions:
+            attributes.extend(self._parse_socket_extension(network_traffic.extensions['socket-ext']))
+        if references:
+            for reference in references.values():
+                attributes.append(self._parse_observable_reference(reference, 'domain_ip_mapping'))
+        return attributes
+
+    def _parse_network_traffic(self, network_traffic, references):
+        attributes = []
+        mapping = 'network_traffic_references_mapping'
+        for feature in ('src', 'dst'):
+            port = f'{feature}_port'
+            if hasattr(network_traffic, port):
+                attribute = deepcopy(stix2misp_mapping.network_traffic_mapping[port])
+                attribute.update({'value': getattr(network_traffic, port), 'to_ids': False})
+                attributes.append(attribute)
+            ref = f'{feature}_ref'
+            if hasattr(network_traffic, ref):
+                attributes.append(self._parse_observable_reference(references.pop(getattr(network_traffic, ref)), mapping, feature))
+            if hasattr(network_traffic, f'{ref}s'):
+                for ref in getattr(network_traffic, f'{ref}s'):
+                    attributes.append(self._parse_observable_reference(references.pop(ref), mapping, feature))
+        return attributes
+
+    @staticmethod
+    def _parse_number(observable):
+        return observable['0'].get('number')
+
+    @staticmethod
+    def _parse_payload(observable):
+        return observable['0'].payload_bin
+
+    def parse_pe_observable(self, observable):
+        key = self._fetch_file_observable(observable)
+        extension = observable[key]['extensions']['windows-pebinary-ext']
+        pe_uuid = self.parse_pe(extension)
+        return self.parse_file_observable(observable), pe_uuid
+
+    @staticmethod
+    def _parse_port(observable, index='0'):
+        port_observable = observable[index]
+        return port_observable['src_port'] if 'src_port' in port_observable else port_observable['dst_port']
+
+    def parse_process_observable(self, observable):
+        process, references = self.filter_main_object(observable, 'Process', test_function='_process_test_filter')
+        attributes = self.fill_observable_attributes(process, 'process_mapping')
+        if hasattr(process, 'parent_ref'):
+            attributes.extend(self.fill_observable_attributes(references[process.parent_ref], 'parent_process_reference_mapping'))
+        if hasattr(process, 'child_refs'):
+            for reference in process.child_refs:
+                attributes.extend(self.fill_observable_attributes(references[reference], 'child_process_reference_mapping'))
+        if hasattr(process, 'binary_ref'):
+            reference = references[process.binary_ref]
+            attribute = deepcopy(stix2misp_mapping.process_image_mapping)
+            attribute.update({'value': reference.name, 'to_ids': False})
+            attributes.append(attribute)
+        return attributes
+
+    @staticmethod
+    def _parse_regkey_attribute(observable):
+        return observable['0'].get('key')
+
+    def parse_regkey_observable(self, observable):
+        attributes = []
+        for key, value in observable['0'].items():
+            if key in stix2misp_mapping.regkey_mapping:
+                attribute = deepcopy(stix2misp_mapping.regkey_mapping[key])
+                attribute.update({'value': value.replace('\\\\', '\\'), 'to_ids': False})
+                attributes.append(attribute)
+        if 'values' in observable['0']:
+            attributes.extend(self.fill_observable_attributes(observable['0']['values'][0], 'regkey_mapping'))
+        return attributes
+
+    def _parse_regkey_value(self, observable):
+        regkey = self._parse_regkey_attribute(observable)
+        return f'{regkey}|{observable["0"]["values"][0].get("data")}'
+
+    def parse_single_attribute_observable(self, observable, attribute_type):
+        if attribute_type in stix2misp_mapping.attributes_type_mapping:
+            return getattr(self, stix2misp_mapping.attributes_type_mapping[attribute_type])(observable, attribute_type)
+        return getattr(self, stix2misp_mapping.attributes_mapping[attribute_type])(observable)
+
+    def _parse_socket_extension(self, extension):
+        attributes = []
+        extension = {key: value for key, value in extension.items()}
+        if 'x_misp_text_address_family' in extension:
+            extension.pop('address_family')
+        for element, value in extension.items():
+            if element in stix2misp_mapping.network_socket_extension_mapping:
+                attribute = deepcopy(stix2misp_mapping.network_socket_extension_mapping[element])
+                if element in ('is_listening', 'is_blocking'):
+                    if value is False:
+                        continue
+                    value = element.split('_')[1]
+            elif element.startswith('x_misp_'):
+                attribute = self.parse_custom_property(element)
+            else:
+                continue
+            attribute.update({'value': value, 'to_ids': False})
+            attributes.append(attribute)
+        return attributes
+
+    @staticmethod
+    def parse_url_observable(observable):
+        attributes = []
+        for object in observable.values():
+            feature = 'dst_port' if isinstance(object, stix2.v20.observables.NetworkTraffic) else 'value'
+            attribute = deepcopy(stix2misp_mapping.url_mapping[object._type])
+            attribute.update({'value': getattr(object, feature), 'to_ids': False})
+            attributes.append(attribute)
+        return attributes
+
+    def parse_user_account_observable(self, observable):
+        observable = observable['0']
+        attributes = self.fill_observable_attributes(observable, 'user_account_mapping')
+        if 'extensions' in observable and 'unix-account-ext' in observable['extensions']:
+            extension = observable['extensions']['unix-account-ext']
+            if 'groups' in extension:
+                attributes.extend(self._parse_user_account_groups(extension['groups']))
+            attributes.extend(self.fill_observable_attributes(extension, 'user_account_mapping'))
+        return attributes
+
+    @staticmethod
+    def _parse_value(observable, index='0'):
+        return observable[index].get('value')
+
+    def _parse_x509_attribute(self, observable, attribute_type):
+        hash_type = attribute_type.split('-')[-1]
+        return self._parse_hash(observable, hash_type)
+
+    def parse_x509_observable(self, observable):
+        attributes = self.fill_observable_attributes(observable['0'], 'x509_mapping')
+        if hasattr(observable['0'], 'hashes') and observable['0'].hashes:
+            attributes.extend(self.fill_observable_attributes(observable['0'].hashes, 'x509_mapping'))
+        return attributes
+
+    ################################################################################
+    ##                         PATTERN PARSING FUNCTIONS.                         ##
+    ################################################################################
+
+    def fill_pattern_attributes(self, pattern, object_mapping):
+        attributes = []
+        for pattern_part in pattern:
+            pattern_type, pattern_value = pattern_part.split(' = ')
+            if pattern_type not in getattr(stix2misp_mapping, object_mapping):
+                if 'x_misp_' in pattern_type:
+                    attribute = self.parse_custom_property(pattern_type)
+                    attribute['value'] = pattern_value.strip("'")
+                    attributes.append(attribute)
+                continue
+            attribute = deepcopy(getattr(stix2misp_mapping, object_mapping)[pattern_type])
+            attribute['value'] = pattern_value.strip("'")
+            attributes.append(attribute)
+        return attributes
+
+    def parse_asn_pattern(self, pattern):
+        return self.fill_pattern_attributes(pattern, 'asn_mapping')
+
+    def parse_credential_pattern(self, pattern):
+        return self.fill_pattern_attributes(pattern, 'credential_mapping')
+
+    def parse_domain_ip_pattern(self, pattern):
+        return self.fill_pattern_attributes(pattern, 'domain_ip_mapping')
+
+    def parse_email_pattern(self, pattern):
+        attributes = []
+        attachments = defaultdict(dict)
+        for pattern_part in pattern:
+            pattern_type, pattern_value = pattern_part.split(' = ')
+            if 'body_multipart' in pattern_type:
+                pattern_type = pattern_type.split('.')
+                feature = 'data' if pattern_type[-1] == 'payload_bin' else 'value'
+                attachments[pattern_type[0][-2]][feature] = pattern_value.strip("'")
+                continue
+            if pattern_type not in stix2misp_mapping.email_mapping:
+                if 'x_misp_' in pattern_type:
+                    attribute = self.parse_custom_property(pattern_type)
+                    attribute['value'] = pattern_value.strip("'")
+                    attributes.append(attribute)
+                continue
+            attribute = deepcopy(stix2misp_mapping.email_mapping[pattern_type])
+            attribute['value'] = pattern_value.strip("'")
+            attributes.append(attribute)
+        for attachment in attachments.values():
+            if 'data' in attachment:
+                attribute = {'type': 'attachment', 'object_relation': 'screenshot', 'data': attachment['data']}
+            else:
+                attribute = {'type': 'email-attachment', 'object_relation': 'attachment'}
+            attribute['value'] = attachment['value']
+            attributes.append(attribute)
+        return attributes
+
+    def parse_file_pattern(self, pattern):
+        attributes = []
+        attachment = {}
+        for pattern_part in pattern:
+            pattern_type, pattern_value = pattern_part.split(' = ')
+            if pattern_type in stix2misp_mapping.attachment_types:
+                attachment[pattern_type] = pattern_value.strip("'")
+            if pattern_type not in stix2misp_mapping.file_mapping:
+                continue
+            attribute = deepcopy(stix2misp_mapping.file_mapping[pattern_type])
+            attribute['value'] = pattern_value.strip("'")
+            attributes.append(attribute)
+        if 'file:content_ref.payload_bin' in attachment:
+            filename = self._choose_with_priority(attachment, 'file:content_ref.name', 'file:name')
+            md5 = self._choose_with_priority(attachment, "file:content_ref.hashes.'MD5'", "file:hashes.'MD5'")
+            attributes.append({
+                'type': 'malware-sample',
+                'object_relation': 'malware-sample',
+                'value': f'{attachment[filename]}|{attachment[md5]}',
+                'data': attachment['file:content_ref.payload_bin']
+            })
+        if 'artifact:payload_bin' in attachment:
+            attributes.append({
+                'type': 'attachment',
+                'object_relation': 'attachment',
+                'value': attachment['artifact:x_misp_text_name'] if 'artifact:x_misp_text_name' in attachment else attachment['file:name'],
+                'data': attachment['artifact:payload_bin']
+            })
+        return attributes
+
+    def parse_ip_port_pattern(self, pattern):
+        return self.fill_pattern_attributes(pattern, 'ip_port_mapping')
+
+    def parse_network_connection_pattern(self, pattern):
+        attributes = []
+        references = defaultdict(dict)
+        for pattern_part in pattern:
+            pattern_type, pattern_value = pattern_part.split(' = ')
+            if pattern_type not in stix2misp_mapping.network_traffic_mapping:
+                pattern_value = pattern_value.strip("'")
+                if pattern_type.startswith('network-traffic:protocols['):
+                    attributes.append({
+                        'type': 'text', 'value': pattern_value,
+                        'object_relation': f'layer{stix2misp_mapping.connection_protocols[pattern_value]}-protocol'
+                    })
+                elif any(pattern_type.startswith(f'network-traffic:{feature}_ref') for feature in ('src', 'dst')):
+                    feature_type, ref = pattern_type.split(':')[1].split('_')
+                    ref, feature = ref.split('.')
+                    ref = f"{feature_type}_{'0' if ref == 'ref' else ref.strip('ref[]')}"
+                    references[ref].update(self._parse_network_connection_reference(feature_type, feature, pattern_value))
+                continue
+            attribute = deepcopy(stix2misp_mapping.network_traffic_mapping[pattern_type])
+            attribute['value'] = pattern_value.strip("'")
+            attributes.append(attribute)
+        attributes.extend(attribute for attribute in references.values())
+        return attributes
+
+    def parse_network_socket_pattern(self, pattern):
+        attributes = []
+        references = defaultdict(dict)
+        for pattern_part in pattern:
+            pattern_type, pattern_value = pattern_part.split(' = ')
+            pattern_value = pattern_value.strip("'")
+            if pattern_type not in stix2misp_mapping.network_traffic_mapping:
+                if pattern_type in stix2misp_mapping.network_socket_extension_mapping:
+                    attribute = deepcopy(stix2misp_mapping.network_socket_extension_mapping[pattern_type])
+                    if pattern_type.startswith("network-traffic:extensions.'socket-ext'.is_"):
+                        if pattern_value != 'True':
+                            continue
+                        pattern_value = pattern_type.split('_')[1]
+                else:
+                    if pattern_type.startswith('network-traffic:protocols['):
+                        attributes.append({'type': 'text', 'object_relation': 'protocol', 'value': pattern_value})
+                    elif any(pattern_type.startswith(f'network-traffic:{feature}_ref') for feature in ('src', 'dst')):
+                        feature_type, ref = pattern_type.split(':')[1].split('_')
+                        ref, feature = ref.split('.')
+                        ref = f"{feature_type}_{'0' if ref == 'ref' else ref.strip('ref[]')}"
+                        references[ref].update(self._parse_network_connection_reference(feature_type, feature, pattern_value))
+                    continue
+            else:
+                attribute = deepcopy(stix2misp_mapping.network_traffic_mapping[pattern_type])
+            attribute['value'] = pattern_value
+            attributes.append(attribute)
+        attributes.extend(attribute for attribute in references.values())
+        return attributes
+
+    def parse_pe_pattern(self, pattern):
+        attributes = []
+        sections = defaultdict(dict)
+        pe = MISPObject('pe', misp_objects_path_custom=_misp_objects_path)
+        for pattern_part in pattern:
+            pattern_type, pattern_value = pattern_part.split(' = ')
+            if ':extensions.' in pattern_type:
+                if '.sections[' in pattern_type:
+                    pattern_type = pattern_type.split('.')
+                    relation = pattern_type[-1].strip("'")
+                    if relation in stix2misp_mapping.pe_section_mapping:
+                        sections[pattern_type[2][-2]][relation] = pattern_value.strip("'")
+                else:
+                    pattern_type = pattern_type.split('.')[-1]
+                    if pattern_type not in stix2misp_mapping.pe_mapping:
+                        if pattern_type.startswith('x_misp_'):
+                            attribute = self.parse_custom_property(pattern_type)
+                            attribute['value'] = pattern_value.strip("'")
+                            pe.add_attribute(**attribute)
+                        continue
+                    attribute = deepcopy(stix2misp_mapping.pe_mapping[pattern_type])
+                    attribute['value'] = pattern_value.strip("'")
+                    pe.add_attribute(**attribute)
+            else:
+                if pattern_type not in stix2misp_mapping.file_mapping:
+                    if pattern_type.startswith('x_misp_'):
+                        attribute = self.parse_custom_property(pattern_type)
+                        attribute['value'] = pattern_value.strip("'")
+                        attributes.append(attribute)
+                    continue
+                attribute = deepcopy(stix2misp_mapping.file_mapping[pattern_type])
+                attribute['value'] = pattern_value.strip("'")
+                attributes.append(attribute)
+        for section in sections.values():
+            pe_section = MISPObject('pe-section', misp_objects_path_custom=_misp_objects_path)
+            for feature, value in section.items():
+                attribute = deepcopy(stix2misp_mapping.pe_section_mapping[feature])
+                attribute['value'] = value
+                pe_section.add_attribute(**attribute)
+            self.misp_event.add_object(pe_section)
+            pe.add_reference(pe_section.uuid, 'includes')
+        self.misp_event.add_object(pe)
+        return attributes, pe.uuid
+
+    def parse_process_pattern(self, pattern):
+        return self.fill_pattern_attributes(pattern, 'process_mapping')
+
+    def parse_regkey_pattern(self, pattern):
+        return self.fill_pattern_attributes(pattern, 'regkey_mapping')
+
+    def parse_url_pattern(self, pattern):
+        return self.fill_pattern_attributes(pattern, 'url_mapping')
+
+    @staticmethod
+    def parse_user_account_pattern(pattern):
+        attributes = []
+        for pattern_part in pattern:
+            pattern_type, pattern_value = pattern_part.split(' = ')
+            pattern_type = pattern_type.split('.')[-1].split('[')[0] if "extensions.'unix-account-ext'" in pattern_type else pattern_type.split(':')[-1]
+            if pattern_type not in stix2misp_mapping.user_account_mapping:
+                if pattern_type.startswith('group'):
+                    attributes.append({'type': 'text', 'object_relation': 'group', 'value': pattern_value.strip("'")})
+                continue
+            attribute = deepcopy(stix2misp_mapping.user_account_mapping[pattern_type])
+            attribute['value'] = pattern_value.strip("'")
+            attributes.append(attribute)
+        return attributes
+
+    def parse_x509_pattern(self, pattern):
+        return self.fill_pattern_attributes(pattern, 'x509_mapping')
+
+    ################################################################################
+    ##                             UTILITY FUNCTIONS.                             ##
+    ################################################################################
+
+    def create_attribute_dict(self, stix_object):
+        labels = stix_object['labels']
+        attribute_uuid = stix_object.id.split('--')[1]
+        attribute = {'uuid': attribute_uuid,
+                     'type': self.get_misp_type(labels),
+                     'category': self.get_misp_category(labels)}
+        tags = [{'name': label} for label in labels[3:]]
+        if tags:
+            attribute['Tag'] = tags
+        attribute.update(self.parse_timeline(stix_object))
+        if hasattr(stix_object, 'description') and stix_object.description:
+            attribute['comment'] = stix_object.description
+        if hasattr(stix_object, 'object_marking_refs'):
+            self.update_marking_refs(attribute_uuid, stix_object.object_marking_refs)
+        return attribute
+
+    def create_misp_object(self, stix_object):
+        labels = stix_object['labels']
+        object_type = self.get_misp_type(labels)
+        misp_object = MISPObject('file' if object_type == 'WindowsPEBinaryFile' else object_type,
+                                 misp_objects_path_custom=_misp_objects_path)
+        misp_object.uuid = stix_object.id.split('--')[1]
+        if hasattr(stix_object, 'description') and stix_object.description:
+            misp_object.comment = stix_object.description
+        misp_object.update(self.parse_timeline(stix_object))
+        return misp_object, object_type
+
+    @staticmethod
+    def _fill_object_attribute(feature, value):
+        return {'value': str(value) if feature in ('entropy', 'size') else value}
+
+    @staticmethod
+    def _fill_observable_object_attribute(feature, value):
+        return {'value': str(value) if feature in ('entropy', 'size') else value,
+                'to_ids': False}
+
+    @staticmethod
+    def get_misp_category(labels):
+        return labels[1].split('=')[1].strip('"')
+
+    @staticmethod
+    def get_misp_type(labels):
+        return labels[0].split('=')[1].strip('"')
+
+    @staticmethod
+    def parse_attribute_pattern(pattern):
+        if ' AND ' in pattern:
+            pattern_parts = pattern.strip('[]').split(' AND ')
+            if len(pattern_parts) == 3:
+                _, value1 = pattern_parts[2].split(' = ')
+                _, value2 = pattern_parts[0].split(' = ')
+                return '{}|{}'.format(value1.strip("'"), value2.strip("'"))
+            else:
+                _, value1 = pattern_parts[0].split(' = ')
+                _, value2 = pattern_parts[1].split(' = ')
+                if value1 in ("'ipv4-addr'", "'ipv6-addr'"):
+                    return value2.strip("'")
+                return '{}|{}'.format(value1.strip("'"), value2.strip("'"))
+        else:
+            return pattern.split(' = ')[1].strip("]'")
+
+    def parse_attribute_pattern_with_data(self, pattern):
+        if 'file:content_ref.payload_bin' not in pattern:
+            return self.parse_attribute_pattern(pattern)
+        pattern_parts = pattern.strip('[]').split(' AND ')
+        if len(pattern_parts) == 3:
+            filename = pattern_parts[0].split(' = ')[1]
+            md5 = pattern_parts[1].split(' = ')[1]
+            return "{}|{}".format(filename.strip("'"), md5.strip("'")), pattern_parts[2].split(' = ')[1].strip("'")
+        return pattern_parts[0].split(' = ')[1].strip("'"), pattern_parts[1].split(' = ')[1].strip("'")
+
+    @staticmethod
+    def parse_custom_property(custom_property):
+        properties = custom_property.split('_')
+        return {'type': properties[2], 'object_relation': '-'.join(properties[3:])}
+
+
+class ExternalStixParser(StixParser):
+    def __init__(self):
+        super().__init__()
+        self._stix2misp_mapping.update({'attack-pattern': 'parse_attack_pattern',
+                                        'course-of-action': 'parse_course_of_action',
+                                        'vulnerability': 'parse_vulnerability'})
+
+    ################################################################################
+    ##                             PARSING FUNCTIONS.                             ##
+    ################################################################################
+
+    def parse_event(self, stix_event):
+        for stix_object in stix_event.objects:
+            object_type = stix_object['type']
+            if object_type in self._stix2misp_mapping:
+                getattr(self, self._stix2misp_mapping[object_type])(stix_object)
+            else:
+                print(f'not found: {object_type}', file=sys.stderr)
+        if self.relationship:
+            self.parse_relationships()
+        if self.galaxy:
+            self.parse_galaxies()
+        event_uuid = stix_event.id.split('--')[1]
+        if hasattr(self, 'report'):
+            self.parse_report(event_uuid=event_uuid)
+        else:
+            self.misp_event.uuid = event_uuid
+            self.misp_event.info = 'Imported with the STIX to MISP import script.'
+        self.handle_markings()
+
+    def parse_galaxy(self, galaxy):
+        galaxy_names = self._check_existing_galaxy_name(galaxy.name)
+        if galaxy_names is not None:
+            return galaxy_names
+        return [f'misp-galaxy:{galaxy._type}="{galaxy.name}"']
+
+    def _parse_indicator(self, indicator):
+        pattern = indicator.pattern
+        if any(relation in pattern for relation in stix2misp_mapping.pattern_forbidden_relations) or all(relation in pattern for relation in (' OR ', ' AND ')):
+            self.add_stix2_pattern_object(indicator)
+        separator = ' OR ' if ' OR ' in pattern else ' AND '
+        self.parse_usual_indicator(indicator, separator)
+
+    def _parse_observable(self, observable):
+        types = self._parse_observable_types(observable.objects)
+        try:
+            getattr(self, stix2misp_mapping.observable_mapping[types])(observable)
+        except KeyError:
+            print(f'Type(s) not supported at the moment: {types}\n', file=sys.stderr)
+
+    def _parse_undefined(self, stix_object):
+        try:
+            self.objects_to_parse[stix_object['id'].split('--')[1]] = stix_object
+        except AttributeError:
+            self.objects_to_parse = {stix_object['id'].split('--')[1]: stix_object}
+
+    def add_stix2_pattern_object(self, indicator):
+        misp_object = MISPObject('stix2-pattern', misp_objects_path_custom=_misp_objects_path)
+        misp_object.uuid = indicator.id.split('--')[1]
+        misp_object.update(self.parse_timeline(indicator))
+        version = f'STIX {indicator.pattern_version}' if hasattr(indicator, 'pattern_version') else 'STIX 2.0'
+        misp_object.add_attribute(**{'type': 'text', 'object_relation': 'version', 'value': version})
+        misp_object.add_attribute(**{'type': 'stix2-pattern', 'object_relation': 'stix2-pattern',
+                                     'value': indicator.pattern})
+        self.misp_event.add_object(**misp_object)
+
+    @staticmethod
+    def fill_misp_object(misp_object, stix_object, mapping):
+        for key, feature in getattr(stix2misp_mapping, mapping).items():
+            if hasattr(stix_object, key):
+                attribute = deepcopy(feature)
+                attribute['value'] = getattr(stix_object, key)
+                misp_object.add_attribute(**attribute)
+
+    @staticmethod
+    def fill_misp_object_from_dict(misp_object, stix_object, mapping):
+        for key, feature in getattr(stix2misp_mapping, mapping).items():
+            if key in stix_object:
+                attribute = deepcopy(feature)
+                attribute['value'] = stix_object[key]
+                misp_object.add_attribute(**attribute)
+
+    def parse_attack_pattern(self, attack_pattern):
+        galaxy_names = self._check_existing_galaxy_name(attack_pattern.name)
+        if galaxy_names is not None:
+            self.galaxy[attack_pattern['id'].split('--')[1]] = {'tag_names': galaxy_names, 'used': False}
+        else:
+            misp_object = self.create_misp_object(attack_pattern)
+            if hasattr(attack_pattern, 'external_references'):
+                for reference in attack_pattern.external_references:
+                    source_name = reference['source_name']
+                    value = reference['external_id'].split('-')[1] if source_name == 'capec' else reference['url']
+                    attribute = deepcopy(stix2misp_mapping.attack_pattern_references_mapping[source_name]) if source_name in stix2misp_mapping.attack_pattern_references_mapping else stix2misp_mapping.references_attribute_mapping
+                    attribute['value'] = value
+                    misp_object.add_attribute(**attribute)
+            self.fill_misp_object(misp_object, attack_pattern, 'attack_pattern_mapping')
+            self.misp_event.add_object(**misp_object)
+
+    def parse_course_of_action(self, course_of_action):
+        galaxy_names = self._check_existing_galaxy_name(course_of_action.name)
+        if galaxy_names is not None:
+            self.galaxy[course_of_action['id'].split('--')[1]] = {'tag_names': galaxy_names, 'used': False}
+        else:
+            misp_object = self.create_misp_object(course_of_action)
+            self.fill_misp_object(misp_object, course_of_action, 'course_of_action_mapping')
+            self.misp_event.add_object(**misp_object)
+
+    def parse_usual_indicator(self, indicator, separator):
+        pattern = tuple(part.strip() for part in self._handle_pattern(indicator.pattern).split(separator))
+        types = self._parse_pattern_types(pattern)
+        try:
+            getattr(self, stix2misp_mapping.pattern_mapping[types])(indicator, separator)
+        except KeyError:
+            print(f'Type(s) not supported at the moment: {types}\n', file=sys.stderr)
+            self.add_stix2_pattern_object(indicator)
+
+    def parse_vulnerability(self, vulnerability):
+        galaxy_names = self._check_existing_galaxy_name(vulnerability.name)
+        if galaxy_names is not None:
+            self.galaxy[vulnerability['id'].split('--')[1]] = {'tag_names': galaxy_names, 'used': False}
+        else:
+            attributes = self._get_attributes_from_observable(vulnerability, 'vulnerability_mapping')
+            if hasattr(vulnerability, 'external_references'):
+                for reference in vulnerability.external_references:
+                    if reference['source_name'] == 'url':
+                        attribute = deepcopy(stix2misp_mapping.references_attribute_mapping)
+                        attribute['value'] = reference['url']
+                        attributes.append(attribute)
+            if len(attributes) == 1 and attributes[0]['object_relation'] == 'id':
+                attributes[0]['type'] = 'vulnerability'
+            self.handle_import_case(vulnerability, attributes, 'vulnerability')
+
+    ################################################################################
+    ##                        OBSERVABLE PARSING FUNCTIONS                        ##
+    ################################################################################
+
+    @staticmethod
+    def _fetch_reference_type(references, object_type):
+        for key, reference in references.items():
+            if isinstance(reference, getattr(stix2.v20.observables, object_type)):
+                return key
+        return None
+
+    @staticmethod
+    def _fetch_user_account_type_observable(observable_objects):
+        for observable_object in observable_objects.values():
+            if hasattr(observable_object, 'extensions') or any(key not in ('user_id', 'credential', 'type') for key in observable_object):
+                return 'user-account', 'user_account_mapping'
+        return 'credential', 'credential_mapping'
+
+    @staticmethod
+    def _get_attributes_from_observable(stix_object, mapping):
+        attributes = []
+        for key, value in stix_object.items():
+            if key in getattr(stix2misp_mapping, mapping) and value:
+                attribute = deepcopy(getattr(stix2misp_mapping, mapping)[key])
+                attribute.update({'value': value, 'to_ids': False})
+                attributes.append(attribute)
+        return attributes
+
+    def get_network_traffic_attributes(self, network_traffic, references):
+        attributes = self._get_attributes_from_observable(network_traffic, 'network_traffic_mapping')
+        mapping = 'network_traffic_references_mapping'
+        attributes.extend(self.parse_network_traffic_references(network_traffic, references, mapping))
+        if references:
+            for reference in references.values():
+                attributes.append(self._parse_observable_reference(reference, mapping, 'dst'))
+        return attributes
+
+    @staticmethod
+    def _handle_attachment_type(stix_object, is_reference, filename):
+        _has_md5 = hasattr(stix_object, 'hashes') and 'MD5' in stix_object.hashes
+        if is_reference and _has_md5:
+            return 'malware-sample', f'{filename}|{stix_object.hashes["MD5"]}'
+        return 'attachment', filename
+
+    def handle_pe_observable(self, attributes, extension, observable):
+        pe_uuid = self.parse_pe(extension)
+        file = self.create_misp_object(observable, 'file')
+        file.add_reference(pe_uuid, 'includes')
+        for attribute in attributes:
+            file.add_attribute(**attribute)
+        self.misp_event.add_object(file)
+
+    @staticmethod
+    def _is_reference(network_traffic, reference):
+        for feature in ('src', 'dst'):
+            for reference_type in (f'{feature}_{ref}' for ref in ('ref', 'refs')):
+                if reference in network_traffic.get(reference_type, []):
+                    return True
+        return False
+
+    @staticmethod
+    def _network_traffic_has_extension(network_traffic):
+        if not hasattr(network_traffic, 'extensions'):
+            return None
+        if 'socket-ext' in network_traffic.extensions:
+            return 'parse_socket_extension_observable'
+        return None
+
+    def parse_asn_observable(self, observable):
+        autonomous_system, references = self.filter_main_object(observable.objects, 'AutonomousSystem')
+        mapping = 'asn_mapping'
+        attributes = self._get_attributes_from_observable(autonomous_system, mapping)
+        if references:
+            for reference in references.values():
+                attributes.append(self._parse_observable_reference(reference, mapping))
+        self.handle_import_case(observable, attributes, 'asn')
+
+    def parse_domain_ip_observable(self, observable):
+        domain, references = self.filter_main_object(observable.objects, 'DomainName')
+        mapping = 'domain_ip_mapping'
+        attributes = [self._parse_observable_reference(domain, mapping)]
+        if references:
+            for reference in references.values():
+                attributes.append(self._parse_observable_reference(reference, mapping))
+        self.handle_import_case(observable, attributes, 'domain-ip')
+
+    def parse_domain_ip_network_traffic_observable(self, observable):
+        network_traffic, references = self.filter_main_object(observable.objects, 'NetworkTraffic')
+        extension = self._network_traffic_has_extension(network_traffic)
+        if extension:
+            attributes, object_name = getattr(self, extension)(network_traffic, references)
+            return self.handle_import_case(observable, attributes, object_name)
+        if self._required_protocols(network_traffic.protocols):
+            attributes = self.parse_network_connection_object(network_traffic, references)
+            return self.handle_import_case(observable, attributes, 'network-connection')
+        attributes, object_name = self.parse_network_traffic_objects(network_traffic, references)
+        self.handle_import_case(observable, attributes, object_name)
+
+    def parse_domain_network_traffic_observable(self, observable):
+        network_traffic, references = self.filter_main_object(observable.objects, 'NetworkTraffic')
+        extension = self._network_traffic_has_extension(network_traffic)
+        if extension:
+            attributes, object_name = getattr(self, extension)(network_traffic, references)
+            return self.handle_import_case(observable, attributes, object_name)
+        attributes = self.parse_network_connection_object(network_traffic, references)
+        self.handle_import_case(observable, attributes, 'network-connection')
+
+    def parse_email_address_observable(self, observable):
+        self.add_attributes_from_observable(observable, 'email-src', 'value')
+
+    def parse_email_observable(self, observable):
+        email_message, references = self.filter_main_object(observable.objects, 'EmailMessage')
+        attributes = self._get_attributes_from_observable(email_message, 'email_mapping')
+        if hasattr(email_message, 'additional_header_fields'):
+            attributes.extend(self._get_attributes_from_observable(email_message.additional_header_fields, 'email_mapping'))
+        attributes.extend(self._parse_email_references(email_message, references))
+        if hasattr(email_message, 'body_multipart') and email_message.body_multipart:
+            attributes.extend(self._parse_email_body(email_message.body_multipart, references))
+        if references:
+            print(f'Unable to parse the following observable objects: {references}', file=sys.stderr)
+        self.handle_import_case(observable, attributes, 'email')
+
+    def parse_file_observable(self, observable):
+        file_object, references = self.filter_main_object(observable.objects, 'File')
+        attributes = self._get_attributes_from_observable(file_object, 'file_mapping')
+        if 'hashes' in file_object:
+            attributes.extend(self._get_attributes_from_observable(file_object.hashes, 'file_mapping'))
+        if references:
+            filename = file_object.name if hasattr(file_object, 'name') else 'unknown_filename'
+            for key, reference in references.items():
+                if isinstance(reference, stix2.v20.observables.Artifact):
+                    _is_content_ref = 'content_ref' in file_object and file_object.content_ref == key
+                    attribute_type, value = self._handle_attachment_type(reference, _is_content_ref, filename)
+                    attribute = {
+                        'type': attribute_type,
+                        'object_relation': attribute_type,
+                        'value': value,
+                        'to_ids': False
+                    }
+                    if hasattr(reference, 'payload_bin'):
+                        attribute['data'] = reference.payload_bin
+                    attributes.append(attribute)
+                elif isinstance(reference, stix2.v20.observables.Directory):
+                    attribute = {
+                        'type': 'text',
+                        'object_relation': 'path',
+                        'value': reference.path,
+                        'to_ids': False
+                    }
+                    attributes.append(attribute)
+        if hasattr(file_object, 'extensions'):
+            # Support of more extension types probably in the future
+            if 'windows-pebinary-ext' in file_object.extensions:
+                # Here we do not go to the standard route of "handle_import_case"
+                # because we want to make sure a file object is created
+                return self.handle_pe_observable(attributes, file_object.extensions['windows-pebinary-ext'], observable)
+            extension_types = (extension_type for extension_type in file_object.extensions.keys())
+            print(f'File extension type(s) not supported at the moment: {", ".join(extension_types)}', file=sys.stderr)
+        self.handle_import_case(observable, attributes, 'file', _force_object=('file-encoding', 'path'))
+
+    def parse_ip_address_observable(self, observable):
+        attributes = []
+        for observable_object in observable.objects.values():
+            attribute = {
+                'value': observable_object.value,
+                'to_ids': False
+            }
+            attribute.update(stix2misp_mapping.ip_attribute_mapping)
+            attributes.append(attribute)
+        self.handle_import_case(observable, attributes, 'ip-port')
+
+    def parse_ip_network_traffic_observable(self, observable):
+        network_traffic, references = self.filter_main_object(observable.objects, 'NetworkTraffic')
+        extension = self._network_traffic_has_extension(network_traffic)
+        if extension:
+            attributes, object_name = getattr(self, extension)(network_traffic, references)
+            return self.handle_import_case(observable, attributes, object_name)
+        attributes = self.parse_ip_port_object(network_traffic, references)
+        self.handle_import_case(observable, attributes, 'ip-port')
+
+    def parse_ip_port_object(self, network_traffic, references):
+        attributes = self._get_attributes_from_observable(network_traffic, 'network_traffic_mapping')
+        attributes.extend(self.parse_network_traffic_references(network_traffic, references, 'ip_port_references_mapping'))
+        if references:
+            for reference in references.values():
+                attributes.append(self._parse_observable_reference(reference, 'domain_ip_mapping'))
+        return attributes
+
+    def parse_mac_address_observable(self, observable):
+        self.add_attributes_from_observable(observable, 'mac-address', 'value')
+
+    def parse_network_connection_object(self, network_traffic, references):
+        attributes = self.get_network_traffic_attributes(network_traffic, references)
+        attributes.extend(self.parse_protocols(network_traffic.protocols, 'observable object'))
+        return attributes
+
+    def parse_network_traffic_objects(self, network_traffic, references):
+        _has_domain = self._fetch_reference_type(references.values(), 'DomainName')
+        if _has_domain and self._is_reference(network_traffic, _has_domain):
+            return self.parse_network_connection_object(network_traffic, references), 'network-connection'
+        return self.parse_ip_port_object(network_traffic, references), 'ip-port'
+
+    def parse_network_traffic_references(self, network_traffic, references, mapping):
+        attributes = []
+        for feature in ('src', 'dst'):
+            ref = f'{feature}_ref'
+            if hasattr(network_traffic, ref):
+                reference = getattr(network_traffic, ref)
+                attributes.append(self._parse_observable_reference(references.pop(reference), mapping, feature))
+            if hasattr(network_traffic, f'{ref}s'):
+                for reference in getattr(network_traffic, f'{ref}s'):
+                    attributes.append(self._parse_observable_reference(references.pop(reference), mapping, feature))
+        return attributes
+
+    def parse_mutex_observable(self, observable):
+        self.add_attributes_from_observable(observable, 'mutex', 'name')
+
+    def parse_process_observable(self, observable):
+        process, references = self.filter_main_object(observable.objects, 'Process', test_function='_process_test_filter')
+        attributes = self._get_attributes_from_observable(process, 'process_mapping')
+        if hasattr(process, 'parent_ref'):
+            attributes.extend(self._get_attributes_from_observable(references.pop(process.parent_ref), 'parent_process_reference_mapping'))
+        if hasattr(process, 'child_refs'):
+            for reference in process.child_refs:
+                attributes.extend(self._get_attributes_from_observable(references.pop(reference), 'child_process_reference_mapping'))
+        if hasattr(process, 'binary_ref'):
+            reference = references.pop(process.binary_ref)
+            attribute = {
+                'value': reference.name,
+                'to_ids': False
+            }
+            attribute.update(stix2misp_mapping.process_image_mapping)
+            attributes.append(attribute)
+        if references:
+            print(f'Unable to parse the following observable objects: {references}', file=sys.stderr)
+        self.handle_import_case(observable, attributes, 'process', _force_object=True)
+
+    def parse_protocols(self, protocols, object_type):
+        attributes = []
+        protocols = (protocol.upper() for protocol in protocols)
+        for protocol in protocols:
+            try:
+                attributes.append(self._parse_network_traffic_protocol(protocol))
+            except KeyError:
+                print(f'Unknown protocol in network-traffic {object_type}: {protocol}', file=sys.stderr)
+        return attributes
+
+    def parse_regkey_observable(self, observable):
+        attributes = []
+        for observable_object in observable.objects.values():
+            attributes.extend(self._get_attributes_from_observable(observable_object, 'regkey_mapping'))
+            if 'values' in observable_object:
+                for registry_value in observable_object['values']:
+                    attributes.extend(self._get_attributes_from_observable(registry_value, 'regkey_mapping'))
+        self.handle_import_case(observable, attributes, 'registry-key')
+
+    def parse_socket_extension_observable(self, network_traffic, references):
+        attributes = self.get_network_traffic_attributes(network_traffic, references)
+        for key, value in network_traffic.extensions['socket-ext'].items():
+            if key not in stix2misp_mapping.network_socket_extension_mapping:
+                print(f'Unknown socket extension field in observable object: {key}', file=sys.stderr)
+                continue
+            if key.startswith('is_') and not value:
+                continue
+            attribute = {
+                'value': key.split('_')[1] if key.startswith('is_') else value,
+                'to_ids': False
+            }
+            attribute.update(stix2misp_mapping.network_socket_extension_mapping[key])
+            attributes.append(attribute)
+        return attributes, 'network-socket'
+
+    def parse_url_observable(self, observable):
+        network_traffic, references = self.filter_main_object(observable.objects, 'NetworkTraffic')
+        attributes = self._get_attributes_from_observable(network_traffic, 'network_traffic_mapping') if network_traffic else []
+        if references:
+            for reference in references.values():
+                attributes.append(self._parse_observable_reference(reference, 'url_mapping'))
+        self.handle_import_case(observable, attributes, 'url')
+
+    def parse_user_account_extension(self, extension):
+        attributes = self._parse_user_account_groups(extension['groups']) if 'groups' in extension else []
+        attributes.extend(self._get_attributes_from_observable(extension, 'user_account_mapping'))
+        return attributes
+
+    def parse_user_account_observable(self, observable):
+        attributes = []
+        object_name, mapping = self._fetch_user_account_type_observable(observable.objects)
+        for observable_object in observable.objects.values():
+            attributes.extend(self._get_attributes_from_observable(observable_object, mapping))
+            if hasattr(observable_object, 'extensions') and observable_object.extensions.get('unix-account-ext'):
+                attributes.extend(self.parse_user_account_extension(observable_object.extensions['unix-account-ext']))
+        self.handle_import_case(observable, attributes, object_name)
+
+    def parse_x509_observable(self, observable):
+        attributes = []
+        for observable_object in observable.objects.values():
+            attributes.extend(self._get_attributes_from_observable(observable_object, 'x509_mapping'))
+            if hasattr(observable_object, 'hashes'):
+                attributes.extend(self._get_attributes_from_observable(observable_object.hashes, 'x509_mapping'))
+        self.handle_import_case(observable, attributes, 'x509')
+
+    ################################################################################
+    ##                         PATTERN PARSING FUNCTIONS.                         ##
+    ################################################################################
+
+    @staticmethod
+    def _fetch_user_account_type_pattern(pattern):
+        for stix_object in pattern:
+            if 'extensions' in stix_object or all(key not in stix_object for key in ('user_id', 'credential', 'type')):
+                return 'user-account', 'user_account_mapping'
+        return 'credential', 'credential_mapping'
+
+    def get_attachment(self, attachment, filename):
+        attribute = {
+            'type': 'attachment',
+            'object_relation': 'attachment',
+            'value': attachment.pop(filename)
+        }
+        data_feature = self._choose_with_priority(attachment, 'file:content_ref.payload_bin', 'artifact:payload_bin')
+        attribute['data'] = attachment.pop(data_feature)
+        return attribute
+
+    def get_attributes_from_pattern(self, pattern, mapping, separator):
+        attributes = []
+        for pattern_part in pattern.strip('[]').split(separator):
+            pattern_type, pattern_value = self.get_type_and_value_from_pattern(pattern_part)
+            try:
+                attribute = deepcopy(getattr(stix2misp_mapping, mapping)[pattern_type])
+            except KeyError:
+                print(f'Pattern type not supported at the moment: {pattern_type}', file=sys.stderr)
+                continue
+            attribute['value'] = pattern_value
+            attributes.append(attribute)
+        return attributes
+
+    def get_malware_sample(self, attachment, filename):
+        md5_feature = self._choose_with_priority(attachment, "file:content_ref.hashes.'MD5'", "file:hashes.'MD5'")
+        attribute = {
+            'type': 'malware-sample',
+            'object_relation': 'malware-sample',
+            'value': f'{attachment.pop(filename)}|{attachment.pop(md5_feature)}'
+        }
+        data_feature = self._choose_with_priority(attachment, 'file:content_ref.payload_bin', 'artifact:payload_bin')
+        attribute['data'] = attachment.pop(data_feature)
+        return attribute
+
+    def _handle_file_attachments(self, attachment):
+        attributes = []
+        if any('content_ref' in feature for feature in attachment.keys()):
+            attribute_type = 'attachment'
+            value = attachment['file:name'] if 'file:name' in attachment else 'unknown_filename'
+            if "file:content_ref.hashes.'MD5'" in attachment:
+                attribute_type = 'malware-sample'
+                md5 = attachment.pop("file:content_ref.hashes.'MD5'")
+                value = f'{value}|{md5}'
+            data = self._choose_with_priority(attachment, 'file:content_ref.payload_bin', 'artifact:payload_bin')
+            attribute = {
+                'type': attribute_type,
+                'object_relation': attribute_type,
+                'value': value,
+                'data': attachment.pop(data)
+            }
+            attributes.append(attribute)
+        if 'artifact:payload_bin' in attachment:
+            attribute = {
+                'type': 'attachment',
+                'object_relation': 'attachment',
+                'value': attachment['file:name'],
+                'data': attachment.pop('artifact:payload_bin')
+            }
+            attributes.append(attribute)
+        return attributes
+
+    def parse_as_pattern(self, indicator, separator):
+        attributes = self.get_attributes_from_pattern(indicator.pattern, 'asn_mapping', separator)
+        self.handle_import_case(indicator, attributes, 'asn')
+
+    def parse_domain_ip_port_pattern(self, indicator, separator):
+        attributes = []
+        references = defaultdict(dict)
+        for pattern_part in self._handle_pattern(indicator.pattern).split(separator):
+            pattern_type, pattern_value = self.get_type_and_value_from_pattern(pattern_part)
+            if pattern_type not in stix2misp_mapping.domain_ip_mapping:
+                if any(pattern_type.startswith(f'network-traffic:{feature}_ref') for feature in ('src', 'dst')):
+                    feature_type, ref = pattern_type.split(':')[1].split('_')
+                    ref, feature = ref.split('.')
+                    ref = f"{feature_type}_{'0' if ref == 'ref' else ref.strip('ref[]')}"
+                    references[ref].update(self._parse_network_connection_reference(feature_type, feature, pattern_value))
+                else:
+                    print(f'Pattern type not currently mapped: {pattern_type}', file=sys.stderr)
+                continue
+            attribute = deepcopy(stix2misp_mapping.domain_ip_mapping[pattern_type])
+            attribute['value'] = pattern_value
+            attributes.append(attribute)
+        if references:
+            attributes.extend(references.values())
+        object_name = 'ip-port' if 'network-traffic' in indicator.pattern else 'domain-ip'
+        self.handle_import_case(indicator, attributes, object_name)
+
+    def parse_email_address_pattern(self, indicator, separator):
+        self.add_attributes_from_indicator(indicator, 'email-src', separator)
+
+    def parse_email_message_pattern(self, indicator, separator):
+        attributes = []
+        attachments = defaultdict(dict)
+        for pattern_part in self._handle_pattern(indicator.pattern).split(separator):
+            pattern_type, pattern_value = self.get_type_and_value_from_pattern(pattern_part)
+            if pattern_type not in stix2misp_mapping.email_mapping:
+                if pattern_type.startswith('email-message:body_multipart'):
+                    features = pattern_type.split('.')
+                    if len(features) == 3 and features[1] == 'body_raw_ref':
+                        index = features[0].split('[')[1].strip(']') if '[' in features[0] else '0'
+                        key = 'data' if features[2] == 'payload_bin' else 'value'
+                        attachments[index][key] = pattern_value
+                        continue
+                print(f'Pattern type not supported at the moment: {pattern_type}', file=sys.stderr)
+                continue
+            attribute = deepcopy(stix2misp_mapping.email_mapping[pattern_type])
+            attribute['value'] = pattern_value
+            attributes.append(attribute)
+        if attachments:
+            for attachment in attachments.values():
+                attribute = {
+                    'type': 'attachment',
+                    'object_relation': 'screenshot'
+                } if 'data' in attachment else {
+                    'type': 'email-attachment',
+                    'object_relation': 'attachment'
+                }
+                attribute.update(attachment)
+                attributes.append(attribute)
+        self.handle_import_case(indicator, attributes, 'email')
+
+    def parse_file_pattern(self, indicator, separator):
+        attributes = []
+        attachment = {}
+        extensions = defaultdict(lambda: defaultdict(dict))
+        for pattern_part in self._handle_pattern(indicator.pattern).split(separator):
+            pattern_type, pattern_value = self.get_type_and_value_from_pattern(pattern_part)
+            if pattern_type in stix2misp_mapping.attachment_types:
+                attachment[pattern_type] = pattern_value.strip("'")
+                continue
+            if pattern_type not in stix2misp_mapping.file_mapping:
+                if 'extensions' in pattern_type:
+                    features = pattern_type.split('.')[1:]
+                    extension_type = features.pop(0).strip("'")
+                    if 'section' in features[0] and features[0] != 'number_of_sections':
+                        index = features[0].split('[')[1].strip(']') if '[' in features[0] else '0'
+                        extensions[extension_type][f'section_{index}'][features[-1].strip("'")] = pattern_value
+                    else:
+                        extensions[extension_type]['.'.join(features)] = pattern_value
+                continue
+            attribute = deepcopy(stix2misp_mapping.file_mapping[pattern_type])
+            attribute['value'] = pattern_value
+            attributes.append(attribute)
+        if any(key.endswith('payload_bin') for key in attachment.keys()):
+            attributes.extend(self._handle_file_attachments(attachment))
+        if attachment:
+            for pattern_type, value in attachment.items():
+                if pattern_type in stix2misp_mapping.file_mapping:
+                    attribute = deepcopy(stix2misp_mapping.file_mapping[pattern_type])
+                    attribute['value'] = value
+                    attributes.append(attribute)
+        if extensions:
+            file_object = self.create_misp_object(indicator, 'file')
+            self.parse_file_extension(file_object, attributes, extensions)
+        else:
+            self.handle_import_case(indicator, attributes, 'file', _force_object=('file-encoding', 'path'))
+
+    def parse_file_extension(self, file_object, attributes, extensions):
+        for attribute in attributes:
+            file_object.add_attribute(**attribute)
+        if 'windows-pebinary-ext' in extensions:
+            pe_extension = extensions['windows-pebinary-ext']
+            pe_object = MISPObject('pe', misp_objects_path_custom=_misp_objects_path)
+            sections = self._get_sections(pe_extension)
+            self.fill_misp_object_from_dict(pe_object, pe_extension, 'pe_mapping')
+            if sections:
+                for section in sections:
+                    section_object = MISPObject('pe-section')
+                    self.fill_misp_object_from_dict(section_object, section, 'pe_section_mapping')
+                    self.misp_event.add_object(section_object)
+                    pe_object.add_reference(section_object.uuid, 'includes')
+            self.misp_event.add_object(pe_object)
+            file_object.add_reference(pe_object.uuid, 'includes')
+        self.misp_event.add_object(file_object)
+
+    def parse_ip_address_pattern(self, indicator, separator):
+        self.add_attributes_from_indicator(indicator, 'ip-dst', separator)
+
+    def parse_mac_address_pattern(self, indicator, separator):
+        self.add_attributes_from_indicator(indicator, 'mac-address', separator)
+
+    def parse_mutex_pattern(self, indicator, separator):
+        self.add_attributes_from_indicator(indicator, 'mutex', separator)
+
+    def parse_network_connection_pattern(self, indicator, attributes, references):
+        attributes.extend(self._parse_network_pattern_references(references, 'network_traffic_references_mapping'))
+        self.handle_import_case(indicator, attributes, 'network-connection')
+
+    @staticmethod
+    def _parse_network_pattern_references(references, mapping):
+        attributes = []
+        for feature, reference in references.items():
+            feature = feature.split('_')[0]
+            attribute = {key: value.format(feature) for key, value in getattr(stix2misp_mapping, mapping)[reference['type']].items()}
+            attribute['value'] = reference['value']
+            attributes.append(attribute)
+        return attributes
+
+    def parse_network_socket_pattern(self, indicator, attributes, references, extension):
+        attributes.extend(self._parse_network_pattern_references(references, 'network_traffic_references_mapping'))
+        for key, value in extension.items():
+            if key not in stix2misp_mapping.network_socket_extension_mapping:
+                print(f'Unknown socket extension field in pattern: {key}', file=sys.stderr)
+                continue
+            if key.startswith('is_') and not json.loads(value.lower()):
+                continue
+            attribute = deepcopy(stix2misp_mapping.network_socket_extension_mapping[key])
+            attribute['value'] = key.split('_')[1] if key.startswith('is_') else value
+            attributes.append(attribute)
+        self.handle_import_case(indicator, attributes, 'network-socket')
+
+    def parse_network_traffic_pattern(self, indicator, separator):
+        attributes = []
+        protocols = []
+        references = defaultdict(dict)
+        extensions = defaultdict(dict)
+        for pattern_part in self._handle_pattern(indicator.pattern).split(separator):
+            pattern_type, pattern_value = self.get_type_and_value_from_pattern(pattern_part)
+            if pattern_type in stix2misp_mapping.network_traffic_mapping:
+                attribute = deepcopy(stix2misp_mapping.network_traffic_mapping[pattern_type])
+                attribute['value'] = pattern_value.strip("'")
+                attributes.append(attribute)
+                continue
+            if pattern_type.startswith('network-traffic:protocols['):
+                protocols.append(pattern_value)
+            elif any(pattern_type.startswith(f'network-traffic:{feature}_ref') for feature in ('src', 'dst')):
+                feature_type, ref = pattern_type.split(':')[1].split('_')
+                ref, feature = ref.split('.')
+                ref = f"{feature_type}_{'0' if ref == 'ref' else ref.strip('ref[]')}"
+                references[ref].update({feature: pattern_value})
+            elif pattern_type.startswith('network-traffic:extensions.'):
+                _, extension_type, feature = pattern_type.split('.')
+                extensions[extension_type.strip("'")][feature] = pattern_value
+            else:
+                print(f'Pattern type not supported at the moment: {pattern_type}', file=sys.stderr)
+        if extensions:
+            if 'socket-ext' in extensions:
+                return self.parse_network_socket_pattern(indicator, attributes, references, extensions['socket-ext'])
+            print(f'Unknown network extension(s) in pattern: {", ".join(extensions.keys())}', file=sys.stderr)
+        if protocols and self._required_protocols(protocols):
+            attributes.extend(self.parse_protocols(protocols, 'pattern'))
+            return self.parse_network_connection_pattern(indicator, attributes, references)
+        attributes.extend(self._parse_network_pattern_references(references, 'ip_port_references_mapping'))
+        self.handle_import_case(indicator, attributes, 'ip-port')
+
+    def parse_process_pattern(self, indicator, separator):
+        attributes = []
+        parent = {}
+        child = defaultdict(set)
+        for pattern_part in self._handle_pattern(indicator.pattern).split(separator):
+            pattern_type, pattern_value = self.get_type_and_value_from_pattern(pattern_part)
+            if 'parent_' in pattern_type:
+                child[pattern_type.split('.')[-1]].add(pattern_value)
+            elif 'child_' in pattern_type:
+                parent[pattern_type.split('.')[-1]] = pattern_value
+            else:
+                try:
+                    attribute = deepcopy(stix2misp_mapping.process_mapping[pattern_type])
+                except KeyError:
+                    print(f'Pattern type not supported at the moment: {pattern_type}', file=sys.stderr)
+                    continue
+                attribute['value'] = pattern_value
+                attributes.append(attribute)
+        if parent:
+            for key, value in parent.items():
+                if key not in stix2misp_mapping.parent_process_reference_mapping:
+                    print(f'Parent process key from pattern not supported at the moment: {key}', file=sys.stderr)
+                    continue
+                attribute = {'value': value}
+                attribute.update(stix2misp_mapping.parent_process_reference_mapping[key])
+                attributes.append(attribute)
+        if child:
+            for key, values in child.items():
+                if key not in stix2misp_mapping.child_process_reference_mapping:
+                    print(f'Child process key from pattern not supported at the moment: {key}', file=sys.stderr)
+                    continue
+                for value in values:
+                    attribute = {'value': value}
+                    attribute.update(stix2misp_mapping.child_process_reference_mapping[key])
+                    attributes.append(attribute)
+        self.handle_import_case(indicator, attributes, 'process', _force_object=True)
+
+    def parse_regkey_pattern(self, indicator, separator):
+        attributes = self.get_attributes_from_pattern(indicator.pattern, 'regkey_mapping', separator)
+        self.handle_import_case(indicator, attributes, 'registry-key')
+
+    def parse_url_pattern(self, indicator, separator):
+        attributes = self.get_attributes_from_pattern(indicator.pattern, 'url_mapping', separator)
+        self.handle_import_case(indicator, attributes, 'url')
+
+    def parse_user_account_pattern(self, indicator, separator):
+        attributes = []
+        pattern = self._handle_pattern(indicator.pattern).split(separator)
+        object_name, mapping = self._fetch_user_account_type_pattern(pattern)
+        for pattern_part in pattern:
+            pattern_type, pattern_value = self.get_type_and_value_from_pattern(pattern_part)
+            pattern_type = pattern_type.split(':')[1]
+            if pattern_type.startswith('extensions.'):
+                pattern_type = pattern_type.split('.')[-1]
+                if '[' in pattern_type:
+                    pattern_type = pattern_type.split('[')[0]
+                if pattern_type in ('group', 'groups'):
+                    attributes.append({'type': 'text', 'object_relation': 'group', 'value': pattern_value})
+                    continue
+            if pattern_type in getattr(stix2misp_mapping, mapping):
+                attribute = deepcopy(getattr(stix2misp_mapping, mapping)[pattern_type])
+                attribute['value'] = pattern_value
+                attributes.append(attribute)
+        self.handle_import_case(indicator, attributes, object_name)
+
+    def parse_x509_pattern(self, indicator, separator):
+        attributes = self.get_attributes_from_pattern(indicator.pattern, 'x509_mapping', separator)
+        self.handle_import_case(indicator, attributes, 'x509')
+
+    ################################################################################
+    ##                             UTILITY FUNCTIONS.                             ##
+    ################################################################################
+
+    def add_attributes_from_indicator(self, indicator, attribute_type, separator):
+        patterns = self._handle_pattern(indicator.pattern).split(separator)
+        if len(patterns) == 1:
+            _, value = self.get_type_and_value_from_pattern(patterns[0])
+            attribute = MISPAttribute()
+            attribute.from_dict(**{
+                'uuid': indicator.id.split('--')[1],
+                'type': attribute_type,
+                'value': value,
+                'to_ids': True
+            })
+            attribute.update(self.parse_timeline(indicator))
+            self.misp_event.add_attribute(**attribute)
+        else:
+            tmp_attribute = self.parse_timeline(indicator)
+            for pattern in patterns:
+                _, value = self.get_type_and_value_from_pattern(pattern)
+                attribute = MISPAttribute()
+                attribute.from_dict(**{
+                    'type': attribute_type,
+                    'value': value,
+                    'to_ids': True
+                })
+                attribute.update(tmp_attribute)
+                self.misp_event.add_attribute(**attribute)
+
+    def add_attributes_from_observable(self, observable, attribute_type, feature):
+        if len(observable.objects) == 1:
+            attribute = MISPAttribute()
+            attribute.from_dict(**{
+                'uuid': observable.id.split('--')[1],
+                'type': attribute_type,
+                'value': getattr(observable.objects['0'], feature),
+                'to_ids': False
+            })
+            attribute.update(self.parse_timeline(observable))
+            self.misp_event.add_attribute(**attribute)
+        else:
+            tmp_attribute = self.parse_timeline(observable)
+            for observable_object in observable.objects.values():
+                attribute = MISPAttribute()
+                attribute.from_dict(**{
+                    'type': attribute_type,
+                    'value': getattr(observable_object, feature),
+                    'to_ids': False
+                })
+                attribute.update(tmp_attribute)
+                self.misp_event.add_attribute(**attribute)
+
+    def _check_existing_galaxy_name(self, galaxy_name):
+        if galaxy_name in self._synonyms_to_tag_names:
+            return self._synonyms_to_tag_names[galaxy_name]
+        for name, tag_names in self._synonyms_to_tag_names.items():
+            if galaxy_name in name:
+                return tag_names
+        return None
+
+    def create_misp_object(self, stix_object, name=None):
+        misp_object = MISPObject(name if name is not None else stix_object.type,
+                                 misp_objects_path_custom=_misp_objects_path)
+        misp_object.uuid = stix_object.id.split('--')[1]
+        if hasattr(stix_object, 'description') and stix_object.description:
+            misp_object.comment = stix_object.description
+        misp_object.update(self.parse_timeline(stix_object))
+        return misp_object
+
+    @staticmethod
+    def _get_sections(pe_extension):
+        sections = [feature for feature in pe_extension.keys() if feature.startswith('section_')]
+        return (pe_extension.pop(feature) for feature in sections)
+
+    @staticmethod
+    def get_type_and_value_from_pattern(pattern):
+        pattern = pattern.strip('[]')
+        try:
+            pattern_type, pattern_value = pattern.split(' = \'')
+        except ValueError:
+            pattern_type, pattern_value = pattern.split('=')
+        return pattern_type.strip(), pattern_value.strip("'")
+
+    def handle_import_case(self, stix_object, attributes, name, _force_object=False):
+        try:
+            if len(attributes) > 1 or (_force_object and self._handle_object_forcing(_force_object, attributes[0])):
+                misp_object = self.create_misp_object(stix_object, name)
+                for attribute in attributes:
+                    misp_object.add_attribute(**attribute)
+                self.misp_event.add_object(**misp_object)
+            else:
+                attribute = {field: attributes[0][field] for field in stix2misp_mapping.single_attribute_fields if attributes[0].get(field) is not None}
+                attribute['uuid'] = stix_object.id.split('--')[1]
+                attribute.update(self.parse_timeline(stix_object))
+                if isinstance(stix_object, stix2.v20.Indicator):
+                    attribute['to_ids'] = True
+                if hasattr(stix_object, 'object_marking_refs'):
+                    self.update_marking_refs(attribute['uuid'], stix_object.object_marking_refs)
+                self.misp_event.add_attribute(**attribute)
+        except IndexError:
+            object_type = 'indicator' if isinstance(stix_object, stix2.Indicator) else 'observable objects'
+            print(f'No attribute or object could be imported from the following {object_type}: {stix_object}', file=sys.stderr)
+
+    @staticmethod
+    def _handle_object_forcing(_force_object, attribute):
+        if isinstance(_force_object, (list, tuple)):
+            return attribute['object_relation'] in _force_object
+        return _force_object
+
+    @staticmethod
+    def _handle_pattern(pattern):
+        return pattern.strip().strip('[]')
+
+    @staticmethod
+    def _parse_observable_types(observable_objects):
+        types = {observable_object._type for observable_object in observable_objects.values()}
+        return tuple(sorted(types))
+
+    @staticmethod
+    def _parse_pattern_types(pattern):
+        types = {part.split('=')[0].split(':')[0].strip('[') for part in pattern}
+        return tuple(sorted(types))
+
+    @staticmethod
+    def _required_protocols(protocols):
+        protocols = tuple(protocol.upper() for protocol in protocols)
+        if any(protocol not in ('TCP', 'IP') for protocol in protocols):
+            return True
+        return False
+
+
+def from_misp(stix_objects):
+    for stix_object in stix_objects:
+        if stix_object['type'] == "report" and 'misp:tool="misp2stix2"' in stix_object.get('labels', []):
+            return True
+    return False
+
+
+def main(args):
+    filename = args[1] if args[1][0] == '/' else Path(os.path.dirname(args[0]), args[1])
+    with open(filename, 'rt', encoding='utf-8') as f:
+        event = stix2.parse(f.read(), allow_custom=True, interoperability=True)
+    stix_parser = StixFromMISPParser() if from_misp(event.objects) else ExternalStixParser()
+    stix_parser.handler(event, filename, args[2:])
+    stix_parser.save_file()
+    print(1)
+
+
+if __name__ == '__main__':
+    main(sys.argv)