2.3.25

Fixes

• rework fast translation so that (most) stix-shifter transformers run before grouping is handled
• fix ValueError: invalid literal for int() with base 10: '' in asyncstorage.py

2.3.24

Changes

• SqlStorage.extract_observeddata_attribtutes will now accept a list of strings for name_of_attribute to add multiple attributes; it will still accept single string if you only want a single attribute form the original observation

Fixes

• SqlStorage.extract_observeddata_attribtutes will rename the observation id field to observation_id automatically to avoid clashing with the existing id field (fixes opencybersecurityalliance/kestrel-lang#360)

2.3.23

Fixes

• restore the "flattening" of extension properties on custom SCOs which was inadvertently disabled in 2.3.20 by the change in handling deeply nested JSON.

2.3.22

"Fast translation" (aio/ingest.py) fixes only

Fixes

• fast translate: fix final round of reference resolution
• fast translate: handle 'truth value of an array' error

2.3.21

Fixes

• allow MATCHES operator in query.Predicate

Added

• SqlStorage.extract_observeddata_attribute for joining SCOs back with a single attribute from their originating observed-data

2.3.20

Fixes

• aio/ingest.py: fix KeyError with unmapped columns
• better handling of deeply nested JSON in custom STIX cyber observable objects (SCOs)

2.3.19

Fixes

• add IF NOT EXISTS to CREATE INDEX statements to fix an aio fast translation issue in kestrel

2.3.18

Single bug fix release

Fixes

• correct alias names when joining network-traffic with ipv4-addr and ipv6-addr tables with different columns, which could raise an exception like asyncpg.exceptions.UndefinedTableError (missing FROM-clause entry for table "src4")

2.3.17

Another async fix

Fixes

• drop unnecessary type column from ingest DataFrame

2.3.16

A mostly async (aio) bug fix release.

Fixes

• aio storage: actually raise SessionExists/SessionNotFound in create/attach. The docs have claimed this behavior, but it was still a TODO until now.
• aio ingest: handle 2 native result fields mapped to same property. We'll take the first non-null value.
• aio ingest: ensure epoch times are ints in EpochToTimestamp