From 1ee7a4a481db2b529754408503c5f13c5c905bd0 Mon Sep 17 00:00:00 2001
From: anti <samuel@securejump.cl>
Date: Sat, 9 May 2026 07:26:48 -0400
Subject: [PATCH] fix(ttp/stix_export): _aware() handles ISO string timestamps
 from DB

---
 decnet/ttp/stix_export.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/decnet/ttp/stix_export.py b/decnet/ttp/stix_export.py
index 0d96b032..36a71e01 100644
--- a/decnet/ttp/stix_export.py
+++ b/decnet/ttp/stix_export.py
@@ -38,9 +38,11 @@ _NS = _uuid.UUID("b5d2c3a1-8f4e-4d1b-9a6c-0e7f5b3d2c1a")
 _DECNET_ORG_STIX_ID = f"identity--{_uuid.uuid5(_NS, 'decnet-honeypot')}"
 
 
-def _aware(dt: datetime | None) -> datetime | None:
+def _aware(dt: datetime | str | None) -> datetime | None:
     if dt is None:
         return None
+    if isinstance(dt, str):
+        dt = datetime.fromisoformat(dt.replace("Z", "+00:00"))
     if dt.tzinfo is None:
         return dt.replace(tzinfo=timezone.utc)
     return dt