[sentinel-intel]: Incorrect File indicator metadata sent to Azure Sentinel resulting in incorrect STIX Pattern

[romain-filigran]

Description

When converting a File STIX indicator to Azure tiIndicator, some invalid file metadata is published. This is the case for :

• filename where we take the name of the STIX indicator and not the file name
• filesize where we default to 0 because we don't have this property on an STIX tag
• fileCreatedDateTime where we set the indicator's creation date, which does not correspond to the file's creation date.

This bad mapping results in a bad STIX pattern creation on the Azure Sentinel side like :

_[file:ctime = '2/13/2025 10:11:36 PM +00:00' AND file:hashes.MD5 = '81BBD0D10663DF88CB07BC5EB67EEEB2' AND file:name = '81BBD0D10663DF88CB07BC5EB67EEEB2' AND file:size = '0']__.

Todo : Do not fill in such information on files to avoid creating invalid STIX patterns on Sentinel side.

Environment

OpenCTI version: 6.5.1