Revert dfiq to main version

yeti-platform · Sep 18, 2024 · 1169561 · 1169561
1 parent 1c221ba
commit 1169561
Showing 1 changed file with 5 additions and 6 deletions.
diff --git a/core/schemas/dfiq.py b/core/schemas/dfiq.py
@@ -14,7 +14,6 @@
 from core.config.config import yeti_config
 from core.helpers import now
 from core.schemas import indicator
-from core.schemas.indicators import forensicartifact, query
 from core.schemas.model import YetiModel
 
 LATEST_SUPPORTED_DFIQ_VERSION = "1.1.0"
@@ -99,7 +98,7 @@ def extract_indicators(question: "DFIQQuestion") -> None:
                 continue
 
             if step.type in ("ForensicArtifact", "artifact"):
-                artifact = forensicartifact.ForensicArtifact.find(name=step.value)
+                artifact = indicator.ForensicArtifact.find(name=step.value)
                 if not artifact:
                     logging.warning(
                         "Missing artifact %s in %s", step.value, question.dfiq_id
@@ -109,9 +108,9 @@ def extract_indicators(question: "DFIQQuestion") -> None:
                 continue
 
             elif step.type and step.value and "query" in step.type:
-                query_indicator = query.Query.find(pattern=step.value)
-                if not query_indicator:
-                    query_indicator = query.Query(
+                query = indicator.Query.find(pattern=step.value)
+                if not query:
+                    query = indicator.Query(
                         name=f"{step.name} ({step.type})",
                         description=step.description or "",
                         pattern=step.value,
@@ -120,7 +119,7 @@ def extract_indicators(question: "DFIQQuestion") -> None:
                         location=step.type,
                         diamond=indicator.DiamondModel.victim,
                     ).save()
-                question.link_to(query_indicator, "query", "Uses query")
+                question.link_to(query, "query", "Uses query")
 
             else:
                 logging.warning(