fix: Extract TTP from the platform

internal-import-file/import-document-ai/src/reportimporter/core.py

@@ -144,7 +144,7 @@ def _download_import_file(self, data: Dict) -> Tuple[str, BytesIO]:
 
     def _process_parsing_results(
         self, parsed: List[Dict], context_entity: Dict
-    ) -> (List[Dict], List[str]):
+    ) -> List[Dict] | List[str]:
         observables = []
         entities = []
         observables = []
@@ -171,6 +171,34 @@ def _process_parsing_results(
                         "created_by_ref": author,
                     },
                 )
+                if match[RESULT_FORMAT_CATEGORY] == "Attack-Pattern.x_mitre_id":
+                    ttp_object = self.helper.api.attack_pattern.read(
+                        filters={
+                            "mode": "and",
+                            "filters": [
+                                {
+                                    "key": "x_mitre_id",
+                                    "values": [match[RESULT_FORMAT_MATCH]],
+                                }
+                            ],
+                            "filterGroups": [],
+                        }
+                    )
+                    ttp_stix_bundle = (
+                        self.helper.api.stix2.get_stix_bundle_or_object_from_entity_id(
+                            entity_type=ttp_object["entity_type"],
+                            entity_id=ttp_object["id"],
+                        )
+                    )
+                    stix_ttp = [
+                        object
+                        for object in ttp_stix_bundle["objects"]
+                        if "x_opencti_id" in object
+                        and object["x_opencti_id"] == ttp_object["id"]
+                    ][0]
+                    stix_object = (
+                        stix_ttp or stix_object
+                    )  # Handle the case where the Attack pattern is not in the platform
                 entities.append(stix_object)
             if match[RESULT_FORMAT_TYPE] == "observable":
                 stix_object = create_stix_object(
@@ -358,7 +386,7 @@ def _process_parsed_objects(
             now = datetime.now(timezone.utc)
             report = stix2.Report(
                 id=Report.generate_id(file_name, now),
-                name="nlp-importdoc-" + file_name,
+                name="import-document-ai" + file_name,
                 description="Automatic import",
                 published=now,
                 report_types=["threat-report"],

internal-import-file/import-document-ai/src/reportimporter/util.py

@@ -114,7 +114,7 @@ def create_stix_object(
         allow_custom=True,
     ),
     "Attack-Pattern.x_mitre_id": lambda value, object_markings, custom_properties: stix2.AttackPattern(
-        id=AttackPattern.generate_id(value),
+        id=AttackPattern.generate_id(name=value, x_mitre_id=value),
         name=value,
         object_markings=object_markings,
         custom_properties=custom_properties,