Skip to content
This repository was archived by the owner on Dec 5, 2025. It is now read-only.
This repository was archived by the owner on Dec 5, 2025. It is now read-only.

Missing "identity_class" field when exporting data via the export-file-stix connector #185

@nicocti

Description

@nicocti

Description

When exporting STIX json files from OpenCTI, "identity" entities do not contain an "identity_class" attribute to disambiguate "organization" and "individual". Re-importing such a bundle in another instance can create duplicated "identity" entities (one organization and one individual with the same name and shared alias). Then, "created_by_ref" attributes may no longer be uniquely resolved.

Environment

  1. OS (where OpenCTI server runs): Docker
  2. OpenCTI version: 4.5.4

Reproducible Steps

Steps to create the smallest reproducible scenario:

  1. Export a Stix Bundle from an entity whose "created_by_ref" points to an individual

Expected Output

The "identity_class" attribute should be present and disambiguates "organization" and "individual".

Actual Output

The "identity_class" attribute is currently missing from exported STIX bundles.

Metadata

Metadata

Assignees

No one assigned

    Labels

    featureuse for describing a new feature to developsolveduse to identify issue that has been solved (must be linked to the solving PR)

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions