I noticed that with https://github.com/AmnestyTech/investigations/blob/master/2024-12-16_serbia_novispy/novispy.stix2 , the associated IPv4s are represented with the domain-name pattern in Stix, but Stix has an ipv4-addr pattern.
I'm not sure but I think this might cause incorrect ingestion of these observables from the Stix files.
Best,