You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Dec 5, 2025. It is now read-only.
When exporting STIX json files from OpenCTI, "identity" entities do not contain an "identity_class" attribute to disambiguate "organization" and "individual". Re-importing such a bundle in another instance can create duplicated "identity" entities (one organization and one individual with the same name and shared alias). Then, "created_by_ref" attributes may no longer be uniquely resolved.
Environment
OS (where OpenCTI server runs): Docker
OpenCTI version: 4.5.4
Reproducible Steps
Steps to create the smallest reproducible scenario:
Export a Stix Bundle from an entity whose "created_by_ref" points to an individual
Expected Output
The "identity_class" attribute should be present and disambiguates "organization" and "individual".
Actual Output
The "identity_class" attribute is currently missing from exported STIX bundles.